Database password dynamic encryption replacement method and system based on double users

Abstract

The invention relates to a database password dynamic encryption replacement method and system based on double users, and the method comprises the steps: a database pre-creates a double-user mechanism, and records the configuration information of the double users and the database to a configuration management system; the configuration management system calls a database configuration API interface to transmit configuration information through the bastion host; the configuration management system issues the configuration information to the application system, and a data source switching component of the application system judges that the current data source identifier is a first user identifier; and executing a data source switching operation, switching the data source identifier into a second user identifier by the data source switching component, creating a new data source connection pool, and connecting the connection in the new data source connection pool to the database through a second user and a corresponding second user database password. According to the method, the database password leakage risk of the application system is reduced, the safety of the application system is ensured, and the application system has the regular database password dynamic encryption modification capability.

Description

Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a method and system for dynamically encrypting and replacing database passwords based on dual users. Background Art

[0002] In the field of information security, systems involving users and passwords often implement mandatory regular password changes to reduce the risk of password leaks and ensure system security. Software design principles generally recommend separating configuration parameters from business logic and storing them separately in configuration files, databases, or separate systems. This allows business logic behavior to be determined by modifying configuration parameter values, reducing application code modifications and improving system maintainability and flexibility. Systems that store configurations separately are called configuration management systems. They centrally manage and accurately distribute configurations across multiple systems, providing comprehensive configuration management capabilities for separating applications from configuration. Dynamic configuration delivery is the process of distributing configuration changes or parameter updates to system instances in real time through tools or systems without requiring a system restart. This technology is crucial in microservices and cloud-native architectures, allowing for quick enablement or disablement of features based on required configuration adjustments, facilitating phased rollouts or traffic control. Traditional database technologies require creating and destroying a new connection for each data operation. These creation and destruction operations incur significant system time losses, especially in high-concurrency scenarios, where database operations can be extremely time-consuming and significantly impact system response time. In order to solve the performance overhead caused by frequent database connections and improve system processing efficiency and response speed, the system usually pre-creates one or more groups of idle database connections and saves them in a pool. When a request needs to operate the database, it obtains an available connection from the pool, and puts it back into the pool after use to wait for reuse by other requests.

[0003] The configuration management system can dynamically send the modified configuration to the application system and make it effective, but the configuration related to database users and passwords involves the database itself and all application systems connected to it. When modifying such special configurations, the database and application systems must be required to take effect at the same time, otherwise the database user password may be changed during runtime. At the same time as the password is changed, the application system cannot immediately obtain the changed password. If the system request involves a new database connection operation at this time, the username and password before the change will be used (the password has expired), so the connection cannot be established, resulting in transaction failure and affecting normal business transactions. Traditional configuration dynamic delivery technology only guarantees that the configuration can take effect dynamically when it is sent to the application system, but the time of delivery to each specific instance cannot be guaranteed. There is a certain time difference. If the above situation exists during this time difference, the transaction will fail. The existing technology can only modify the database password after stopping all application instances, and cannot be achieved through rolling restart, which affects normal business transactions (especially important business systems without downtime windows). Therefore, most application systems rarely adjust passwords after initial resource requests, and regular changes are impossible. Mitigation measures are implemented, such as establishing process flows that prohibit hard-coding database usernames and passwords in code and scripts; implementing management procedures to prohibit improper access to database user passwords, or prohibiting unauthorized operations by other high-privilege users; and other disciplinary controls to minimize database password leaks. However, this approach is time-consuming and fails to address the root cause of system security risks. If a password leak occurs, the only option is to stop the application system service, shut down all instances, manually modify the database username and password, and restart all instances. During this modification period, the system remains unavailable, potentially causing significant business losses. Summary of the Invention

[0004] In order to reduce the risk of application system database password leakage, ensure the security of the application system, and enable the application system to have the ability to regularly dynamically encrypt and modify database passwords, the present invention proposes a dual-user-based database password dynamic encryption replacement method and system.

[0005] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0006] A method for dynamically encrypting and replacing a database password based on dual users, comprising:

[0007] S1. The database pre-creates a dual-user mechanism, and records the dual-user and database configuration information to the configuration management system. The dual-user includes a primary user and a backup user. The first user is set as the primary user, and the second user is set as the backup user.

[0008] S2. The configuration management system calls the database configuration API interface through the bastion host to transmit configuration information. The bastion host is used to modify the database configuration through the database configuration API interface and is used to modify the configuration information through the idempotent data configuration script;

[0009] S3 configuration management system sends configuration information to the application system, the application system includes a configuration management system access component and a data source switching component, the data source switching component determines the current data source identifier as the first user identifier;

[0010] S4. Execute the data source switching operation, set the second user as the primary user, set the first user as the backup user, and the data source switching component switches the data source identifier to the second user identifier. A new data source connection pool is created, and the connections in the new data source connection pool connect to the database through the second user and the corresponding second user database password.

[0011] Furthermore, the configuration management system sends the configuration information to the application system, the application system includes a configuration management system access component and a data source switching component, and the data source switching component determines that the current data source identifier is the first user identifier, including:

[0012] The configuration management system access component of the application system calls an interface to obtain configuration information in the configuration management system, wherein the configuration information includes user information and database configuration information;

[0013] The data source switching component of the application system determines that the current data source identifier is recorded as the first user identifier;

[0014] Creating a first data source based on the configuration information, where the first data source includes the username and version number of the first user, and creating a second data source that is empty;

[0015] The first data source is used as an old data source, and the second data source is used as a new data source.

[0016] Furthermore, after performing the data source switching operation and setting the second user as the primary user and the first user as the backup user, the method further includes:

[0017] The bastion host idempotently modifies the password of the second user database, encrypts the modified password of the second user database using an encryption algorithm, and transmits it to the configuration management system. The configuration management system stores the ciphertext of the password of the second user database;

[0018] The configuration management system sends the second user database password ciphertext and the user switching event to the message queue;

[0019] The application system monitors the events sent from the message queue through the data source switching component, and the configuration management system access component decrypts the ciphertext of the second user database password.

[0020] Furthermore, the data source switching operation is performed, the second user is set as the primary user, the first user is set as the backup user, the data source switching component switches the data source identifier to the second user identifier, a new data source connection pool is created, and the connection in the new data source connection pool connects to the database through the second user and the corresponding second user database password, including:

[0021] When the data source switching component switches the data source identifier, the data source switching component intercepts database connection-related operations and selects the corresponding database connection pool based on the current data source identifier;

[0022] If the current transaction is an existing connected transaction, the number of active connections in the old data source connection pool will be checked cyclically. When the number of active connections in the old data source connection pool reaches 0, the old data source connection pool will be closed.

[0023] If the current transaction is a new transaction, a new connection in the data source connection pool is created and connected to the database.

[0024] Furthermore, selecting a corresponding database connection pool based on the current data source identifier includes:

[0025] When the data source identifier is the first user identifier, the first data source is obtained based on the first user identifier, the database connection is intercepted and obtained from the data source connection pool based on the first data source, and the corresponding operation is performed in the database based on the intercepted and obtained database connection.

[0026] Furthermore, the method further comprises:

[0027] The data source switching component receives a message queue event notification and changes the data source identifier to a second user identifier;

[0028] The data source switching component intercepts and obtains the database connection;

[0029] Acquire a second data source based on the second user identifier, where the second data source is empty;

[0030] Create a second data source based on the username and version number of the second user, and use the second data source as a new data source;

[0031] Return a database connection based on the new data source, and perform corresponding database operations based on the returned database connection;

[0032] Set a timer task to cyclically determine the number of active connections in the old data source connection pool. When the number of active connections in the old data source connection pool is 0, close the old data source connection pool.

[0033] The second data source is set as the old data source in subsequent transactions, and the first data source is set to empty as the new data source in subsequent transactions.

[0034] The present invention also relates to a dual-user database password dynamic encryption replacement system, which is characterized by comprising:

[0035] A preset module is used to pre-create a dual-user mechanism in the database and record the configuration information of the dual users and the database into the configuration management system. The dual users include a primary user and a backup user, with the first user set as the primary user and the second user set as the backup user;

[0036] A configuration module is used to configure the management system to transmit configuration information by calling the database configuration API interface through the bastion host. The bastion host is used to modify the database configuration through the database configuration API interface and to modify the configuration information through the idempotent data configuration script;

[0037] A sending module, configured to send the configuration information from the configuration management system to the application system, wherein the application system includes a configuration management system access component and a data source switching component, and the data source switching component determines that the current data source identifier is the first user identifier;

[0038] The switching module is used to perform a data source switching operation, set the second user as the primary user, set the first user as the backup user, and the data source switching component switches the data source identifier to the second user identifier, creates a new data source connection pool, and the connections in the new data source connection pool connect to the database through the second user and the corresponding second user database password.

[0039] The present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0040] The present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0041] The memory is used to store program instructions;

[0042] The processor is used to execute the above method by calling program instructions.

[0043] The present invention also relates to a computer program product, comprising a computer program and / or instructions, characterized in that the computer program and / or instructions implement the steps of the above method when executed by a processor.

[0044] The beneficial effects of the present invention are:

[0045] The present invention discloses a method and system for dynamically encrypting and changing database passwords based on dual users. The method provides a management method for dual users (one primary and one backup, with equal permissions) in a database. A scheduled task is set in a configuration management system to periodically modify the backup user and password of an application system database. After the modification is complete, the backup user and password are issued for switching, turning the original backup user into the primary user and the original primary user into the backup user. This enables the application system to periodically dynamically encrypt and change database passwords, fundamentally resolving the risk of password leakage caused by the inability to regularly modify passwords. This saves manual inspection and reduces labor costs, allowing the program to automatically change database user passwords. When the configuration management system changes the database user password, only the backup user's password is modified, without affecting the use of the primary user to connect to the database. After the backup user's password is successfully modified, the backup user configuration is issued for user switching. During the switching period, the application system creates a new connection pool using the issued backup user and password. New requests use connections in the new connection pool to call the database, while existing requests continue to use the connection pool created with the original user and password. A separate thread monitors the original connection pool until the number of active connections in the connection pool reaches zero, destroying it. This completes the switching process without affecting normal business transactions in the application system and supporting dynamic switching or rolling restart during runtime. The traditional method of changing the database password involves application downtime due to manual setting. Generally, there are many application nodes, the downtime lasts for a long time, and it is a major change. The change process needs to be applied for many days in advance, and business personnel need to be notified in advance to issue a downtime announcement, etc. The process is complicated and cumbersome, the labor cost is extremely high, and the business impact is large. The present invention does not involve application downtime due to dynamic setting, which technically avoids major changes. It does not involve all the above processes and can be executed according to the general change steps of the application system. Moreover, since only the configuration is changed and no code modification is involved, developers do not need to participate. The operation and maintenance personnel only need to click the modify button. If regular changes are set, the operation and maintenance personnel do not need to participate. The entire process is automatically processed, and the application is not affected and the business is not affected. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments of the present application.

[0047] Figure 1 This is a flow chart of a method for dynamically encrypting and replacing a database password based on dual users of the present invention;

[0048] Figure 2 This is a schematic diagram of the structure of a dual-user database password dynamic encryption and replacement system according to the present invention;

[0049] Figure 3 The figure is a schematic structural diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. It should be understood that the described embodiments are only part of the embodiments of this application, not all of the embodiments, and these embodiments are only used to illustrate this application and are not used to limit the scope of this application. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0051] like Figure 1 As shown, the embodiment of the present invention discloses a method for dynamically encrypting and replacing a database password based on dual users, the steps of which include:

[0052] Step S1. The database pre-creates a dual-user mechanism and records the configuration information of the dual users and the database into the configuration management system. The dual users include a primary user and a backup user. The first user is set as the primary user and the second user is set as the backup user.

[0053] The database pre-creates a dual-user mechanism. One database contains both primary and backup users. Both have the same permissions and support primary and backup switching at any time.

[0054] Step S2. The configuration management system calls the database configuration API interface through the bastion host to transmit configuration information. The bastion host is used to modify the database configuration through the database configuration API interface and to modify the configuration information through the idempotent data configuration script.

[0055] The configuration management system supports database dual-user and password setting functions, including adding, deleting and modifying information; the configuration management system supports database dual-user switching function, switching the primary and backup users used by the current application system. Operation and maintenance personnel can choose to manually click or set up regular calls to the database configuration module function in the configuration management system to perform user switching based on the application system requirements of the actual usage plan; the configuration management system provides a database password configuration escape mechanism, which can force operations to cover various extreme scenarios where program execution fails.

[0056] The bastion host can provide a database configuration API for the configuration management system to regularly call to initiate database-related configuration modifications. It can also provide data configuration scripts to ensure idempotent modifications to database user names, passwords, and other configurations.

[0057] Step S3: The configuration management system sends the configuration information to the application system. The application system includes a configuration management system access component and a data source switching component. The data source switching component determines that the current data source identifier is the first user identifier.

[0058] The data source switching component provides a core mechanism for systems that require regular dynamic encryption. Its functions include:

[0059] Take over the system database connection based on the aspect, and obtain the database connection from the specified data connection pool in real time as needed, without the need for application system processing, which is safe and efficient.

[0060] Based on the special user identifier, the data source tag changes are judged in real time, new data sources are dynamically created and adapted to all the original data sources of the system (supporting single data source and multiple data sources) to achieve fast and seamless switching.

[0061] The data source tag change is realized based on the event monitoring mechanism, so that event message information can be received in real time during runtime, and the tag information can be updated seamlessly without affecting the existing business processing flow.

[0062] In this embodiment, the method further includes:

[0063] The configuration management system access component of the application system calls an interface to obtain configuration information in the configuration management system, wherein the configuration information includes user information and database configuration information;

[0064] The data source switching component of the application system determines that the current data source identifier is recorded as the first user identifier;

[0065] Creating a first data source based on the configuration information, where the first data source includes the username and version number of the first user, and creating a second data source that is empty;

[0066] The first data source is used as an old data source, and the second data source is used as a new data source.

[0067] Step S4. Execute the data source switching operation, set the second user as the primary user, set the first user as the backup user, the data source switching component switches the data source identifier to the second user identifier, creates a new data source connection pool, and the connections in the new data source connection pool connect to the database through the second user and the corresponding second user database password.

[0068] The operation and maintenance personnel manually click or set a periodic call to the database configuration module button in the configuration management system to change the database password of the backup user and set the user as the primary user.

[0069] In this embodiment, after performing the data source switching operation and setting the second user as the primary user and the first user as the backup user, the following steps are included:

[0070] The bastion host idempotently modifies the password of the second user database, encrypts the modified password of the second user database using an encryption algorithm, and transmits it to the configuration management system. The configuration management system stores the ciphertext of the password of the second user database;

[0071] The configuration management system sends the second user database password ciphertext and the user switching event to the message queue;

[0072] The application system monitors the events sent from the message queue through the data source switching component, and the configuration management system access component decrypts the ciphertext of the second user database password.

[0073] In this embodiment, the method further includes:

[0074] When the data source switching component switches the data source identifier, the data source switching component intercepts database connection-related operations and selects the corresponding database connection pool based on the current data source identifier;

[0075] If the current transaction is an existing connected transaction, the number of active connections in the old data source connection pool will be checked cyclically. When the number of active connections in the old data source connection pool reaches 0, the old data source connection pool will be closed.

[0076] If the current transaction is a new transaction, a new connection in the data source connection pool is created and connected to the database.

[0077] In this embodiment, selecting a corresponding database connection pool based on the current data source identifier includes:

[0078] When the data source identifier is the first user identifier, the first data source is obtained based on the first user identifier, the database connection is intercepted and obtained from the data source connection pool based on the first data source, and the corresponding operation is performed in the database based on the intercepted and obtained database connection.

[0079] In this embodiment, the method further includes:

[0080] The data source switching component receives a message queue event notification and changes the data source identifier to a second user identifier;

[0081] The data source switching component intercepts and obtains the database connection;

[0082] Acquire a second data source based on the second user identifier, where the second data source is empty;

[0083] Create a second data source based on the username and version number of the second user, and use the second data source as a new data source;

[0084] Return a database connection based on the new data source, and perform corresponding database operations based on the returned database connection;

[0085] Set a timer task to cyclically determine the number of active connections in the old data source connection pool. When the number of active connections in the old data source connection pool is 0, close the old data source connection pool.

[0086] The second data source is set as the old data source in subsequent transactions, and the first data source is set to empty as the new data source in subsequent transactions.

[0087] The data source switching component switches the data source identifier in real time during system operation based on the monitoring event, and creates a new data source connection pool based on the identifier. All connections in the new data source connection pool use the user and password issued this time to connect to the database, that is, the second user's username and password are used to connect to the database.

[0088] During the data source switch, users can access the application system normally. Any database operations involved are intercepted by the data source switch component, which then selects the appropriate database connection pool based on the current data source identifier. New transactions will access the database using connections from the new connection pool. Existing transactions will be re-evaluated for activity. Once all active connections in the old connection pool are zero, the old connection pool will be closed, completing the switch. The application system remains unaware of the data source switch, and the business is not impacted.

[0089] In the present invention, when accessing the data source switching component for the first time, the following operations need to be performed, including:

[0090] (1) Pre-configure the database for dual users;

[0091] (2) Enter the dual-user and database-related configurations in the configuration management system. The configuration information includes the usernames, passwords (encrypted text), and other configurations (such as database connection pool size, timeout, etc.) of the primary and backup users. In this case, the primary user is the first user (user A) and the backup user is the second user (user B).

[0092] (3) The application system accesses the configuration management system access component. When the application starts, the configuration management system access component automatically calls the API interface to obtain the user name, password and other configurations configured in the configuration management system;

[0093] (4) The application system accesses the data source switching component. When the application starts, the data source switching component creates an old data source with key = first user (user A) + version number based on the obtained configuration information, and marks it as the first user ID (user A). The new data source is not created and is set to null.

[0094] In the present invention, the normal transaction process includes:

[0095] (1) If the transaction initiated by the user involves database operations, obtain a database connection to perform subsequent database operations;

[0096] (2) The data source switching component intercepts all operations to obtain database connections based on the AOP aspect, such as intercepting the getConnection method of the SpringBoot project;

[0097] (3) After interception, the data source switching component determines the identifier of the current data source. Since the data source switching operation has not been performed at this time, the data source identifier is the first user identifier (user A). The data source with key = first user (user A) + version number is obtained. This data source is the old data source, and the new data source is null at this time.

[0098] (4) Obtain a database connection based on the obtained data source (old data source) and return the database connection to the interceptor;

[0099] (5) The interceptor performs database-related operations based on the database connection returned by the data source and obtains the execution results.

[0100] In the present invention, when a data source switch occurs, the following steps are performed:

[0101] (1) The system administrator switches the data source, changes the primary user to the secondary user (User B), modifies the password of the primary user (User B), and sends the password change and user switch events to the message queue. At this time, the primary user is the secondary user (User B) and the backup user is the first user (User A).

[0102] (2) The data source switching component monitors events in real time;

[0103] (3) After receiving the event, the current data source identifier is modified to the second user identifier (user B);

[0104] (4) If the transaction initiated by the user involves database operations, obtain a database connection to perform subsequent database operations;

[0105] (5) The data source switching component intercepts all operations to obtain database connections based on the AOP aspect, such as intercepting the getConnection method of the SpringBoot project.

[0106] (6) After interception, the data source switching component determines the identifier of the current data source. Since the data source switching operation has been performed at this time, the data source identifier is the second user identifier (user B). The data source with key = second user (user B) + version number is obtained. If the data source is null, a new data source is created using the primary user (second user) + password. At this time, the old data source key = first user (user A) + version number.

[0107] (7) Obtain a database connection based on the obtained data source (new data source) and return the database connection to the interceptor;

[0108] (8) The interceptor performs database-related operations based on the database connection returned by the data source and obtains the execution results;

[0109] (9) This process starts a scheduled task synchronously, cyclically judging the number of active connections of the old data source, and closing the old data source when the number of connections is 0. At this time, the new data source is key = second user (user B) + version number. The new data source is the old data source for subsequent normal transactions. The old data source is key = first user (user A) + version number. The old data source is null and is the new data source for subsequent normal transactions.

[0110] During the entire switching process in the embodiment of the present invention, the switching between the first user and the second user is achieved based on the creation and clearing of the old and new data sources. The application system does not need to be shut down. All database connection operations are intercepted by the data source switching component, and the new / old data sources created based on different users are returned according to the configuration of the system administrator. The entire switching process forms a closed loop, and the system users are completely unaware and the business is not affected. After using this solution, the user, password and other related configurations of the database are all taken over by the operation and maintenance personnel. There is no need for developers. Regular dynamic modifications are set according to the needs of the application system, access is made to the configuration management system, access is made to the data source switching component, and application is made for database dual-user management to achieve dual-user switching. From a technical perspective, it solves the risk of password leakage caused by the inability to change passwords regularly in a safe, efficient and low-cost manner.

[0111] The present invention fundamentally solves the risk of password leakage caused by the inability to modify passwords regularly. There is no need for mitigation measures, which saves manual inspection and discipline control costs. The program automates the process of changing database user passwords. It does not affect the normal business transactions of the application system, and the database user password is dynamically switched during runtime without any changes. The database password is randomly generated when it is modified, and the ciphertext is transmitted and stored throughout the entire process. When the program connects to the database, it is automatically decrypted according to the key. Neither development nor operation and maintenance personnel have access to the password information, ensuring data security.

[0112] like Figure 2 As shown, the embodiment of the present invention discloses a database password dynamic encryption replacement system based on dual users, the structure of which includes:

[0113] A preset module is used to pre-create a dual-user mechanism in the database and record the configuration information of the dual users and the database into the configuration management system. The dual users include a primary user and a backup user, with the first user set as the primary user and the second user set as the backup user;

[0114] A configuration module is used to configure the management system to transmit configuration information by calling the database configuration API interface through the bastion host. The bastion host is used to modify the database configuration through the database configuration API interface and to modify the configuration information through the idempotent data configuration script;

[0115] A sending module, configured to send the configuration information from the configuration management system to the application system, wherein the application system includes a configuration management system access component and a data source switching component, and the data source switching component determines that the current data source identifier is the first user identifier;

[0116] The switching module is used to perform a data source switching operation, set the second user as the primary user, set the first user as the backup user, and the data source switching component switches the data source identifier to the second user identifier, creates a new data source connection pool, and the connections in the new data source connection pool connect to the database through the second user and the corresponding second user database password.

[0117] By using this system, the above-mentioned calculation and processing method can be executed and the corresponding technical effects can be achieved.

[0118] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all steps of the method in the above embodiment. The computer-readable storage medium stores a computer program that implements all steps of the method in the above embodiment when executed by a processor.

[0119] The embodiment of the present invention further provides an electronic device for executing the above method, as an implementation device of the method, whose structure is as follows: Figure 3 As shown, the electronic device 300 includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may further include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one. It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the specific structure of the electronic device 300. In other embodiments of the present application, the electronic device 300 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. Optionally, the electronic device may further include a display screen 305 for displaying images, or receiving user operation instructions when necessary.

[0120] The processor 301 is used in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 304 may include a receiver and a transmitter. The transceiver 304 is used in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0121] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0122] The processor 301 may also include one or more processing units. For example, the processor 301 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). The different processing units may be independent devices or integrated into one or more processors. The controller may serve as the nerve center and command center of the electronic device 300. The controller may generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution. The processor 301 may also include memory for storing instructions and data. In some embodiments, the memory in the processor 301 is a high-speed cache memory. This memory can store instructions or data that have just been used or are being recycled by the processor 301. If the processor 301 needs to use the instruction or data again, it can directly retrieve it from the memory. This avoids duplicate accesses, reduces the processor 301's waiting time, and thus improves system efficiency.

[0123] The processor 301 can execute the method provided in the embodiments of the present application. The processor 301 can include different devices. For example, when the processor 301 integrates a CPU and a GPU, the CPU and the GPU can cooperate to execute the method provided in the embodiments of the present application. For example, part of the algorithm in the method is executed by the CPU, and another part of the algorithm is executed by the GPU to achieve faster processing efficiency.

[0124] The bus 302 may include a path for transmitting information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0125] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory), or may include a high-speed random access memory. It may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), or other optical disk storage, optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0126] Optionally, the memory 303 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the method provided in any embodiment of the present application.

[0127] The memory 303 can be used to store computer executable program code, which includes instructions. The processor 301 executes various functional applications and data processing of the electronic device 300 by running the instructions stored in the memory 303. The memory 303 may include a program storage area and a data storage area. Among them, the program storage area can store the code of the operating system and application programs, etc. The data storage area can store data created during the use of the electronic device 300 (such as images and videos collected by the camera application, etc.).

[0128] The memory 303 may also store one or more computer programs corresponding to the methods provided in the embodiments of the present application. The one or more computer programs are stored in the memory 303 and configured to be executed by the one or more processors 301. The one or more computer programs include instructions that can be used to perform the various steps in the above-mentioned corresponding embodiments.

[0129] Of course, the code of the method provided in the embodiment of the present application can also be stored in an external memory. In this case, the processor 301 can run the code of the method stored in the external memory through the external memory interface, and the processor 301 can control the running process.

[0130] The display screen 305 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a MiniLED, a MicroLED, a Micro-oLed, a quantum dot light-emitting diode (QLED), or the like. In some embodiments, the electronic device 300 may include one or N display screens 305, where N is a positive integer greater than 1. The display screen 305 can be used to display information input by a user or information provided to a user, as well as various graphical user interfaces (GUIs). For example, the display screen 305 can display photos, videos, web pages, or files.

[0131] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding method provided above, and will not be repeated here.

[0132] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0133] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or boxes.

[0134] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction system that is implemented in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The present invention is described in detail below. ...

[0136] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention are intended to be covered by the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for dynamically encrypting and replacing database passwords based on dual users, characterized in that: include: S1. The database pre-creates a dual-user mechanism, and records the dual-user and database configuration information to the configuration management system. The dual-user includes a primary user and a backup user. The first user is set as the primary user, and the second user is set as the backup user. S2. The configuration management system calls the database configuration API interface through the bastion host to transmit configuration information. The bastion host is used to modify the database configuration through the database configuration API interface and is used to modify the configuration information through the idempotent data configuration script; S3 configuration management system sends configuration information to the application system, the application system includes a configuration management system access component and a data source switching component, the data source switching component determines the current data source identifier as the first user identifier; S4. Execute the data source switching operation, set the second user as the primary user, set the first user as the backup user, and the data source switching component switches the data source identifier to the second user identifier. A new data source connection pool is created, and the connections in the new data source connection pool connect to the database through the second user and the corresponding second user database password.

2. The method according to claim 1, wherein The configuration management system sends the configuration information to the application system, which includes a configuration management system access component and a data source switching component. The data source switching component determines that the current data source identifier is the first user identifier, including: The configuration management system access component of the application system calls an interface to obtain configuration information in the configuration management system, wherein the configuration information includes user information and database configuration information; The data source switching component of the application system determines that the current data source identifier is recorded as the first user identifier; Creating a first data source based on the configuration information, where the first data source includes the username and version number of the first user, and creating a second data source that is empty; The first data source is used as an old data source, and the second data source is used as a new data source.

3. The method according to claim 1, wherein After performing the data source switching operation and setting the second user as the primary user and the first user as the backup user, the method includes: The bastion host idempotently modifies the password of the second user database, encrypts the modified password of the second user database using an encryption algorithm, and transmits it to the configuration management system. The configuration management system stores the ciphertext of the password of the second user database; The configuration management system sends the second user database password ciphertext and the user switching event to the message queue; The application system monitors the events sent from the message queue through the data source switching component, and the configuration management system access component decrypts the ciphertext of the second user database password.

4. The method according to claim 1, wherein The method of performing a data source switching operation, setting the second user as the primary user and the first user as the backup user, switching the data source identifier of the data source switching component to the second user identifier, creating a new data source connection pool, and connecting the connection in the new data source connection pool to the database through the second user and the corresponding second user database password, includes: When the data source switching component switches the data source identifier, the data source switching component intercepts database connection-related operations and selects the corresponding database connection pool based on the current data source identifier; If the current transaction is an existing connected transaction, the number of active connections in the old data source connection pool will be determined in a loop. When the number of active connections in the old data source connection pool reaches 0, the old data source connection pool will be closed. If the current transaction is a new transaction, a new connection in the data source connection pool is created and connected to the database.

5. The method according to claim 4, wherein The selecting a corresponding database connection pool based on the current data source identifier includes: When the data source identifier is the first user identifier, the first data source is obtained based on the first user identifier, the database connection is intercepted and obtained from the data source connection pool based on the first data source, and the corresponding operation is performed in the database based on the intercepted and obtained database connection.

6. The method according to claim 5, wherein The method further comprises: The data source switching component receives the message queue event notification and changes the data source identifier to the second user identifier; The data source switching component intercepts and obtains the database connection; Acquire a second data source based on the second user identifier, where the second data source is empty; Create a second data source based on the username and version number of the second user, and use the second data source as a new data source; Return a database connection based on the new data source, and perform corresponding database operations based on the returned database connection; Set a timer task to cyclically determine the number of active connections in the old data source connection pool. When the number of active connections in the old data source connection pool is 0, close the old data source connection pool. The second data source is set as the old data source in subsequent transactions, and the first data source is set to empty as the new data source in subsequent transactions.

7. A database password dynamic encryption replacement system based on dual users, characterized in that: include: A preset module is used to pre-create a dual-user mechanism in the database and record the configuration information of the dual users and the database into the configuration management system. The dual users include a primary user and a backup user, with the first user set as the primary user and the second user set as the backup user; A configuration module is used to configure the management system to transmit configuration information by calling the database configuration API interface through the bastion host. The bastion host is used to modify the database configuration through the database configuration API interface and to modify the configuration information through the idempotent data configuration script; A sending module, configured to send the configuration information from the configuration management system to the application system, wherein the application system includes a configuration management system access component and a data source switching component, and the data source switching component determines that the current data source identifier is the first user identifier; The switching module is used to perform a data source switching operation, set the second user as the primary user, set the first user as the backup user, and the data source switching component switches the data source identifier to the second user identifier, creates a new data source connection pool, and the connections in the new data source connection pool connect to the database through the second user and the corresponding second user database password.

8. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which implements the method according to any one of claims 1 to 6 when executed by a processor.

9. An electronic device, characterized in that: including processor and memory; The memory is used to store program instructions; The processor is configured to execute the method according to any one of claims 1 to 6 by calling program instructions.

10. A computer program product comprising a computer program and / or instructions, characterized in that When the computer program and / or instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images