Universal database access system and method thereof

Abstract

The invention provides a universal database access system and method, and the system comprises a client which is used for transmitting client information to a client management service, connecting to a distributed database service according to the received connection authentication information, and executing a database operation; the client management service is used for managing the connection information and the client information of the database server side, verifying the legality of the client information and returning corresponding connection authentication information and node links according to a verification result; and the server side is used for receiving the request of the client management service, returning the encrypted authentication key, and receiving and processing the authentication information and the database operation statement of the client service system. The method aims at solving the problems that in the prior art, different database drive software is different, operation methods are inconsistent, client connection authentication is different, and safety management is complex.

Description

Technical Field

[0001] The present invention relates to the technical field of database access, and in particular to a universal database access system and method thereof. Background Art

[0002] With the rapid development of information technology, various database systems are widely used in various fields. However, due to differences in driver software, operation methods, and client connection authentication methods, these systems bring many inconveniences to business system deployment management, software development, and network security management.

[0003] Specifically, the existing technology has the following problems:

[0004] 1. Different databases and driver software are different, which is not conducive to business system deployment and management;

[0005] 2. Different databases have different operation methods, which is not conducive to business system software development;

[0006] 3. Differences in connection authentication between various database clients are not conducive to network security management. Summary of the Invention

[0007] In response to the shortcomings of the existing technology, the present invention provides a universal database access system and method thereof, aiming to solve the problems in the existing technology such as different database driver software, inconsistent operation methods, different client connection authentication and complex security management.

[0008] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0009] A general database access system, comprising:

[0010] The client is used to send client information to the client management service, connect to the assigned database service based on the received connection authentication information, and perform database operations;

[0011] Client management service, used to manage database server connection information, client information, verify the legitimacy of client information, and return corresponding connection authentication information and node links based on the verification results;

[0012] The server side is used to receive client management service requests and return encrypted authentication keys, as well as receive and process client business system authentication information and database operation statements.

[0013] A general database access method includes the following steps:

[0014] The client sends client information to the client management service to obtain server-side authentication information;

[0015] The client connects to the assigned database service based on the connection authentication information received from the client management service;

[0016] The client performs operations on the connected database according to the needs of the business system;

[0017] Among them, the client management service receives the client's connection message and verifies the legitimacy of the client information based on the added client information; if the verification passes, it returns a node link with relatively idle load based on the name of the database to be connected, and applies for a connection authentication key from the node and returns it to the client; if the verification fails, it closes the connection and returns an error message.

[0018] According to a general database access method provided by the present invention, the client management service further performs the following steps:

[0019] Add the connection information of the database server on the management page;

[0020] Add client information on the management page, which can be selected according to the network security level;

[0021] The client information is verified, wherein the verification includes at least checking the format validity of the IP address, confirming the uniqueness and format validity of the MAC address, and verifying the validity of the security certificate when a security certificate is provided; and, according to the requirements of the network security level, fine-grained configuration and review of database operation permissions.

[0022] According to a general database access method provided by the present invention, the server performs the following steps:

[0023] Receive the client management service's request for connection authentication information and return an encrypted authentication key;

[0024] Receives authentication information and database operation statements sent by the client business system, decrypts the authentication key, and compares the current connection IP address, connected database name, database operation permissions, and key authorization time to see if they are valid; if the key is confirmed to be valid, returns the database operation result; if the authentication key is invalid, returns an error message.

[0025] According to a general database access method provided by the present invention, the client management service also includes a load balancing function, specifically:

[0026] Monitor the load of each database server, including at least the response time for request processing, the number of current connections, CPU usage, memory usage, and other indicators;

[0027] Based on the monitored load situation, the load weight of each database server is calculated in real time to determine the node with the least load.

[0028] When a client requests to connect to the database, a node link with relatively low load is allocated to the client according to the load weight, so as to ensure balanced distribution and efficient operation of the database server.

[0029] According to a general database access method provided by the present invention, the client performs operations on the connected database according to the requirements of the business system, including:

[0030] Receiving a database operation request sent by a business system, wherein the operation request includes at least one of adding data, deleting data, modifying data, and querying data;

[0031] Parse the received operation request to determine the operation type, target database, operation object, and operation parameters;

[0032] According to the analysis results, build corresponding database operation instructions;

[0033] Execute the database operation instructions to perform add, delete, modify and query operations on the target database to meet the data processing requirements of the business system;

[0034] The operation results are returned to the business system so that the business system can perform subsequent processing based on the operation results.

[0035] According to a general database access method provided by the present invention, the function of adding database server connection information to the management page is specifically as follows:

[0036] Provide a management page, which includes an input interface for entering database server connection information;

[0037] Receive database server connection information entered by the user through the management page, the connection information including at least the database server address, port number, database name, user account and password;

[0038] Verify the received connection information to ensure that the format of the connection information is correct and meets the system requirements;

[0039] Save the verified connection information to the system configuration so that the management system can establish a connection with the database server when needed;

[0040] Provides a connection test function that allows users to test whether the added database server connection information is valid on the management page and display the test results.

[0041] According to a general database access method provided by the present invention, when the server executes decryption of the authentication key, the following steps are included:

[0042] A key pair is pre-established between the client business system and the server, where the public key is stored on the server and the private key is securely stored in the client business system;

[0043] When the client business system sends a database operation request, it first uses the FIDO2 authentication standard to generate authentication information containing user identity information, and then uses the public key to encrypt the authentication information to generate an encrypted authentication key;

[0044] After receiving the encrypted authentication key and database operation statement, the server uses the private key to decrypt the encrypted authentication key and verifies the decrypted authentication information according to the FIDO2 authentication standard to confirm the validity of the user identity and operation permissions;

[0045] If the authentication information verification is successful, the server will execute the database operation statement and return the operation result to the client business system; if the authentication information verification fails, the operation statement will be refused to execute and an error message will be returned to the client business system.

[0046] According to a general database access method provided by the present invention, when comparing the current connected IP address and the connected database name to see if they are valid, the specific implementation includes:

[0047] IP Address Verification:

[0048] When the server receives a connection request from the client business system, it obtains and records the client's IP address; compares the obtained client IP address with the pre-set list of allowed access IP addresses; if the client IP address is in the allowed access list, the IP address verification is successful; otherwise, the connection request is rejected and an error message is returned;

[0049] Database name verification:

[0050] The client business system includes the name of the database requested in the connection request; the server receives and parses the connection request, extracts the database name, and compares the extracted database name with the list of legal database names configured on the server; if the requested database name is in the legal list, the database name verification passes; otherwise, the connection request is rejected and an error message is returned.

[0051] According to a general database access method provided by the present invention, when comparing the database operation authority and the key authorization time to see whether they are valid, the specific implementation method includes:

[0052] Operation permission verification:

[0053] When the client business system sends a database operation request, it also includes the permission information required for the operation. The server checks whether the client has the required permission to perform the requested operation based on the decrypted authentication information or the preset user permission configuration. If the client has the corresponding permission, the operation permission verification is passed; otherwise, the operation is rejected and an error message is returned.

[0054] Key authorization time verification:

[0055] The client business system includes the authorization time or validity period of the key in the authentication information; after decrypting the authentication information, the server extracts and checks the authorization time or validity period of the key; if the current time is within the authorization time range or validity period of the key, the key authorization time verification is successful; otherwise, the key is considered expired, the connection request or operation request is rejected, and an error message is returned.

[0056] It can be seen that the present invention provides a universal database access method and system, and its beneficial effects are mainly reflected in the following aspects:

[0057] The method of the present invention can access different databases using the same connection method across different operating system versions, greatly simplifying the complexity of database access and eliminating the need for developers to write database access code for different operating systems. This improves development efficiency and code maintainability. Furthermore, it greatly facilitates the deployment of cross-platform business systems.

[0058] The present invention provides a unified and standardized database operation method. Developers can achieve unified operation of multiple databases without having to deeply understand the specific operation details and differences of various databases. This not only reduces the learning cost of developers, but also improves development efficiency, allowing developers to focus more on the implementation of business logic rather than tedious database operation details.

[0059] This invention unifies client connection authentication methods, meeting the security level requirements of different users and effectively reducing database security vulnerabilities. By adopting advanced encryption technology and authentication mechanisms, this invention ensures the security of database access, preventing unauthorized access and data leakage, thereby protecting user privacy and data security.

[0060] The present invention supports automatic switching of multiple nodes in a distributed database and achieves load balancing, which is particularly important for large-scale database systems. It can not only improve the concurrent processing capability of the database, but also automatically adjust the access strategy according to the load of the node, thereby optimizing system performance and reducing response time.

[0061] The present invention manages database connections uniformly on the server side, eliminates the client's dependence on database drivers, makes the installation and management of business software more convenient, and eliminates the need to install various database drivers on the client side, thereby reducing the complexity and maintenance costs of the system.

[0062] The database operation method provided by the present invention achieves the separation of business software and database, thereby increasing the security of database software. By using components such as middleware or proxy servers, business software no longer needs to directly access the database, but instead indirectly accesses the database through these components. This isolates the direct interaction between the business software and the database, reducing the risk of data leakage.

[0063] In summary, the present invention provides an efficient, secure, and easy-to-use universal database access method and system, which provides great convenience for developers and also provides strong guarantees for the security and performance optimization of database systems.

[0064] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a principle diagram of an embodiment of a universal database access system of the present invention.

[0066] Figure 2 It is a flow chart of an embodiment of a universal database access method of the present invention. DETAILED DESCRIPTION

[0067] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0068] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0069] A general database access system embodiment

[0070] See also Figure 1 , this embodiment provides a universal database access system, including:

[0071] The client is used to send client information to the client management service, connect to the assigned database service according to the received connection authentication information, and perform database operations.

[0072] The client management service is used to manage the connection information and client information of the database server, verify the legitimacy of the client information, and return the corresponding connection authentication information and node link based on the verification results.

[0073] The server side is used to receive client management service requests and return encrypted authentication keys, as well as receive and process client business system authentication information and database operation statements.

[0074] A general database access method embodiment

[0075] See also Figure 2 , this embodiment provides a general database access method, including the following steps:

[0076] The client sends client information to the client management service to obtain server-side authentication information. The client information includes the IP and MAC addresses of all current network cards, the name of the database to be connected, and the certificate key.

[0077] The client connects to the assigned database service based on the connection authentication information received from the client management service. This connection authentication information consists of an HTTP(S) link and an encrypted authentication key. The authentication key is issued by the server and is decrypted and authenticated by the server when the client connects to the database.

[0078] The client performs operations such as adding, deleting, modifying, and querying on the connected database according to the needs of the business system.

[0079] The client management service receives the client's connection message (http / https link and database name) and verifies the legitimacy of the client information based on the added client information. The client information includes IP address, MAC address, security certificate, database operation permissions, etc., which can be selected according to the network security level.

[0080] If the verification passes, the node link with relatively low load will be returned according to the name of the database to be connected, and the connection authentication key will be applied to the node and returned to the client; if the verification fails, the connection will be closed and an error message will be returned.

[0081] In this embodiment, the client management service further performs the following steps:

[0082] Add the connection information of the database server on the management page;

[0083] Add client information on the management page, which can be selected according to the network security level;

[0084] Verify the client information, where verification includes at least checking the format validity of the IP address, confirming the uniqueness and format validity of the MAC address, and verifying the validity of the security certificate when it is provided; and, based on the requirements of the network security level, fine-grained configuration and review of database operation permissions.

[0085] In this embodiment, the server performs the following steps:

[0086] Receives requests from the client management service to obtain connection authentication information (the connection authentication key is only available to the client management service), and returns an encrypted authentication key, which contains the connecting client IP, the name of the database to be connected, the permission to connect to the database, and the time of the authorized connection.

[0087] Receives authentication information and database operation statements sent by the client business system, decrypts the authentication key, and compares the current connection IP address, connected database name, database operation permissions, and key authorization time to see if they are valid; if the key is confirmed to be valid, returns the database operation result; if the authentication key is invalid, returns an error message.

[0088] In this embodiment, the client management service also includes a load balancing function, specifically:

[0089] Monitor the load of each database server, including at least the response time for request processing, the number of current connections, CPU usage, memory usage, and other indicators;

[0090] Based on the monitored load situation, the load weight of each database server is calculated in real time to determine the node with the least load.

[0091] When a client requests to connect to the database, a node link with relatively low load is allocated to the client based on the load weight to ensure balanced distribution and efficient operation of the database server.

[0092] In this embodiment, the client performs operations on the connected database according to the needs of the business system, including:

[0093] Receiving a database operation request sent by a business system, the operation request including at least one of adding data, deleting data, modifying data, and querying data;

[0094] Parse the received operation request to determine the operation type, target database, operation object, and operation parameters;

[0095] According to the analysis results, build corresponding database operation instructions;

[0096] Execute database operation instructions and perform add, delete, modify and query operations on the target database to meet the data processing needs of the business system;

[0097] The operation results are returned to the business system so that the business system can perform subsequent processing based on the operation results.

[0098] In this embodiment, the function of adding database server connection information to the management page is as follows:

[0099] Provide a management page, which includes an input interface for entering database server connection information;

[0100] Receive the database server connection information entered by the user through the management page, the connection information at least includes the database server address, port number, database name, user account and password;

[0101] Verify the received connection information to ensure that the format of the connection information is correct and meets the system requirements;

[0102] Save the verified connection information to the system configuration so that the management system can establish a connection with the database server when needed;

[0103] Provides a connection test function that allows users to test whether the added database server connection information is valid on the management page and display the test results.

[0104] In this embodiment, when the server executes decryption of the authentication key, the following steps are included:

[0105] A key pair is pre-established between the client business system and the server, where the public key is stored on the server and the private key is securely stored in the client business system;

[0106] When the client business system sends a database operation request, it first uses the FIDO2 authentication standard to generate authentication information containing user identity information, and then uses the public key to encrypt the authentication information to generate an encrypted authentication key;

[0107] After receiving the encrypted authentication key and database operation statement, the server uses the private key to decrypt the encrypted authentication key and verifies the decrypted authentication information according to the FIDO2 authentication standard to confirm the validity of the user identity and operation permissions;

[0108] If the authentication information verification is successful, the server will execute the database operation statement and return the operation result to the client business system; if the authentication information verification fails, the operation statement will be refused to execute and an error message will be returned to the client business system.

[0109] It can be seen that by combining public key cryptography with the FIDO2 authentication standard, this embodiment not only improves the security of the authentication key, but also enhances the convenience and reliability of user identity authentication, and effectively prevents unauthorized database access and operation.

[0110] In this embodiment, when comparing the current connected IP address and the connected database name to see if they are valid, the specific implementation includes:

[0111] IP Address Verification:

[0112] When the server receives a connection request from the client business system, it obtains and records the client's IP address; compares the obtained client IP address with the pre-set list of allowed access IP addresses; if the client IP address is in the allowed access list, the IP address verification is successful; otherwise, the connection request is rejected and an error message is returned;

[0113] Database name verification:

[0114] The client business system includes the name of the database requested in the connection request; the server receives and parses the connection request, extracts the database name, and compares the extracted database name with the list of legal database names configured on the server; if the requested database name is in the legal list, the database name verification passes; otherwise, the connection request is rejected and an error message is returned.

[0115] In this embodiment, when comparing the database operation authority and the key authorization time to see if they are valid, the specific implementation methods include:

[0116] Operation permission verification:

[0117] When the client business system sends a database operation request, it also includes the permission information required for the operation. The server checks whether the client has the required permission to perform the requested operation based on the decrypted authentication information or the preset user permission configuration. If the client has the corresponding permission, the operation permission verification is passed; otherwise, the operation is rejected and an error message is returned.

[0118] Key authorization time verification:

[0119] The client business system includes the authorization time or validity period of the key in the authentication information; after decrypting the authentication information, the server extracts and checks the authorization time or validity period of the key; if the current time is within the authorization time range or validity period of the key, the key authorization time verification is successful; otherwise, the key is considered expired, the connection request or operation request is rejected, and an error message is returned.

[0120] Through the above steps, the present invention can comprehensively and accurately verify the access request of the client business system, ensuring that only clients that meet the security requirements can access and operate the database, effectively improving the security and reliability of the database.

[0121] In summary, this embodiment provides a unified and standard database operation method. Developers can implement unified operations on multiple databases without having to deeply understand the specific operation details and differences of various databases. This not only reduces the learning cost for developers, but also improves development efficiency, allowing developers to focus more on implementing business logic rather than tedious database operation details.

[0122] Furthermore, the method of this embodiment can access different databases using the same connection method across different operating system versions, greatly simplifying the complexity of database access and eliminating the need for developers to write database access code for different operating systems. This improves development efficiency and code maintainability. This also greatly facilitates the deployment of cross-platform business systems.

[0123] Furthermore, this embodiment, by unifying client connection authentication methods, meets the security requirements of different users and effectively reduces database security vulnerabilities. By employing advanced encryption technology and authentication mechanisms, this embodiment ensures database access security, preventing unauthorized access and data leakage, thereby protecting user privacy and data security.

[0124] Furthermore, this embodiment supports automatic switching of multiple nodes in a distributed database, achieving load balancing, which is particularly important for large-scale database systems. It can not only improve the concurrent processing capabilities of the database, but also automatically adjust the access strategy according to the load conditions of the node, thereby optimizing system performance and reducing response time.

[0125] Furthermore, this embodiment manages database connections uniformly on the server side, eliminating the client's reliance on database drivers, making the installation and management of business software more convenient. There is no need to install various database drivers on the client side, thereby reducing system complexity and maintenance costs.

[0126] Furthermore, the database operation method provided in this embodiment separates business software from the database, enhancing the security of the database software. By using components such as middleware or proxy servers, business software no longer needs to directly access the database, but instead indirectly accesses it through these components. This isolates direct interaction between the business software and the database, reducing the risk of data leakage.

[0127] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0128] The above embodiments are only preferred embodiments of the present invention and cannot be used to limit the scope of protection of the present invention. Any non-substantial changes and replacements made by technicians in this field on the basis of the present invention fall within the scope of protection required by the present invention.

Claims

1. A universal database access system, characterized in that: include: The client is used to send client information to the client management service, connect to the assigned database service based on the received connection authentication information, and perform database operations; Client management service, used to manage database server connection information, client information, verify the legitimacy of client information, and return corresponding connection authentication information and node links based on the verification results; The server side is used to receive client management service requests and return encrypted authentication keys, as well as receive and process client business system authentication information and database operation statements.

2. A general database access method, characterized in that: The following steps are involved: The client sends client information to the client management service to obtain server-side authentication information; The client connects to the assigned database service based on the connection authentication information received from the client management service; The client performs operations on the connected database according to the needs of the business system; The client management service receives the connection message from the client and verifies the legitimacy of the client information based on the added client information; If the verification passes, the node link with relatively low load will be returned according to the name of the database to be connected, and the connection authentication key will be applied to the node and returned to the client; if the verification fails, the connection will be closed and an error message will be returned.

3. The method according to claim 2, characterized in that The client management service also performs the following steps: Add the connection information of the database server on the management page; Add client information on the management page, which can be selected according to the network security level; The client information is verified, wherein the verification includes at least checking the format validity of the IP address, confirming the uniqueness and format validity of the MAC address, and verifying the validity of the security certificate when a security certificate is provided; and, according to the requirements of the network security level, fine-grained configuration and review of database operation permissions.

4. The method according to claim 2, characterized in that The server performs the following steps: Receive the client management service's request for connection authentication information and return an encrypted authentication key; Receive the authentication information and database operation statements sent by the client business system, decrypt the authentication key, and compare the current connection IP address, connected database name, database operation permissions, and key authorization time to see if they are valid; If the key is confirmed to be valid, the database operation result is returned; If the authentication key is invalid, an error message is returned.

5. The method according to claim 2, characterized in that The client management service also includes load balancing functions, specifically: Monitor the load of each database server, including at least the response time for request processing, the number of current connections, CPU usage, memory usage, and other indicators; Based on the monitored load situation, the load weight of each database server is calculated in real time to determine the node with the least load. When a client requests to connect to the database, a node link with relatively low load is allocated to the client according to the load weight, so as to ensure balanced distribution and efficient operation of the database server.

6. The method according to claim 2, characterized in that The client performs operations on the connected database according to the needs of the business system, including: Receiving a database operation request sent by a business system, wherein the operation request includes at least one of adding data, deleting data, modifying data, and querying data; Parse the received operation request to determine the operation type, target database, operation object, and operation parameters; According to the analysis results, build corresponding database operation instructions; Execute the database operation instructions to perform add, delete, modify and query operations on the target database to meet the data processing requirements of the business system; The operation results are returned to the business system so that the business system can perform subsequent processing based on the operation results.

7. The method according to claim 3, characterized in that Add the function of database server connection information on the management page, specifically: Provide a management page, which includes an input interface for entering database server connection information; Receive database server connection information entered by the user through the management page, the connection information including at least the database server address, port number, database name, user account and password; Verify the received connection information to ensure that the format of the connection information is correct and meets the system requirements; Save the verified connection information to the system configuration so that the management system can establish a connection with the database server when needed; Provides a connection test function that allows users to test whether the added database server connection information is valid on the management page and display the test results.

8. The method according to claim 4, characterized in that When the server executes the decryption authentication key, the following steps are included: A key pair is pre-established between the client business system and the server, where the public key is stored on the server and the private key is securely stored in the client business system; When the client business system sends a database operation request, it first uses the FIDO2 authentication standard to generate authentication information containing user identity information, and then uses the public key to encrypt the authentication information to generate an encrypted authentication key; After receiving the encrypted authentication key and database operation statement, the server uses the private key to decrypt the encrypted authentication key and verifies the decrypted authentication information according to the FIDO2 authentication standard to confirm the validity of the user identity and operation permissions; If the authentication information verification is successful, the server will execute the database operation statement and return the operation result to the client business system; if the authentication information verification fails, the operation statement will be refused to execute and an error message will be returned to the client business system.

9. The method according to claim 4, characterized in that When comparing the current connected IP address and the connected database name to see if they are valid, the specific implementation methods include: IP Address Verification: When the server receives a connection request from the client business system, it obtains and records the client's IP address; compares the obtained client IP address with the pre-set list of allowed access IP addresses; if the client IP address is in the allowed access list, the IP address verification is successful; otherwise, the connection request is rejected and an error message is returned; Database name verification: The client business system includes the name of the database requested in the connection request; the server receives and parses the connection request, extracts the database name, and compares the extracted database name with the list of legal database names configured on the server; if the requested database name is in the legal list, the database name verification passes; otherwise, the connection request is rejected and an error message is returned.

10. The method according to claim 9, characterized in that When comparing the database operation permissions and key authorization time to see if they are valid, the specific implementation methods include: Operation permission verification: When the client business system sends a database operation request, it also includes the permission information required for the operation. The server checks whether the client has the required permission to perform the requested operation based on the decrypted authentication information or the preset user permission configuration. If the client has the corresponding permission, the operation permission verification is passed; otherwise, the operation is rejected and an error message is returned. Key authorization time verification: The client business system includes the authorization time or validity period of the key in the authentication information; after decrypting the authentication information, the server extracts and checks the authorization time or validity period of the key; if the current time is within the authorization time range or validity period of the key, the key authorization time verification is successful; otherwise, the key is considered expired, the connection request or operation request is rejected, and an error message is returned.

Images