Data processing method, device and system and electronic equipment

Abstract

The invention discloses a data processing method, device and system and electronic equipment. The method comprises the steps that a data packet sent by a target object through a database tool of a client side is received, and the data packet at least comprises a query request, a query command and a requested database type; an API interface of the database management and control service is called, permission verification and security policy check are conducted on the data packet through the database management and control service, a verification result is obtained, permission verification is used for verifying whether the target object has the permission to use the database, and security policy check is used for verifying whether abnormal data exists in the data packet; and under the condition that the verification result indicates that the query command in the data packet is the command of the target type, the target object is verified through a client plug-in, and the client plug-in is installed in the client. According to the method and the device, the technical problem that monitoring of the query command only focuses on post auditing and lacks a real-time interception function in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the technical field of data security management, and more specifically, to a data processing method, device, system, and electronic device. Background Art

[0002] With the development of informatization, databases are increasingly used across various enterprises and organizations, and data security issues are becoming increasingly prominent. While related technologies employ tools like 4A bastion hosts to perform post-audits of database operations, some shortcomings remain.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a data processing method, device, system and electronic device to at least solve the technical problem that the monitoring of query commands in the related art only focuses on post-audit and lacks real-time interception function.

[0005] According to one aspect of an embodiment of the present application, a data processing method is provided, comprising: receiving a data packet sent by a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; calling an API interface of a database management service, and performing permission verification and a security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, verifying the target object through a client plug-in, wherein the client plug-in is installed in the client.

[0006] Optionally, the data packet is subjected to permission verification and security policy check through the database management and control service to obtain a verification result, including: parsing the data packet to obtain a first parsing result, wherein the first parsing result at least includes the query command, the requested database type, and the client information; performing permission verification and security policy check on the first parsing result through the database management and control service to obtain a verification result.

[0007] Optionally, after obtaining the verification result by performing permission verification and security policy check on the data packet through the database management and control service, the method further includes: when the verification result indicates that the query command in the data packet is a first-class command, repackaging the first parsing result into a target data packet that conforms to the database protocol of the requested database type, wherein the risk level of the first-class command is less than the risk level of the target-type command; forwarding the target data packet to the target database corresponding to the requested database type, and receiving the operation result fed back by the target database; and returning the operation result to the client.

[0008] Optionally, after obtaining the verification result by performing permission verification and security policy check on the data packet through the database management and control service, the method further includes: when the verification result indicates that the query command in the data packet is the first target command in the target type command, a secondary confirmation window is popped up to the client through the client plug-in, wherein, after the client plug-in receives the secondary confirmation result of the target object on the client, the secondary confirmation result is sent to the database management and control service for verification; after receiving the verification result returned by the database management and control service, the first parsing result is repackaged into a target data packet that conforms to the database protocol of the requested database type; the target data packet is forwarded to the target database corresponding to the requested database type, and the operation result feedback from the target database is received; and the operation result is returned to the client.

[0009] Optionally, after obtaining the verification result by performing permission verification and security policy check on the data packet through the database management and control service, the method further includes: when the verification result indicates that the query command in the data packet is the second target command in the target type command, popping up a text message verification code window to the client through the client plug-in, wherein after the client plug-in receives the text message verification code entered by the target object on the client, the text message verification code is sent to the database management and control service for verification, and the risk level of the second target command is higher than the risk level of the first target command; receiving the verification result returned by the database management and control service, and if the verification result is verification passed, repackaging the first parsing result into a target data packet that complies with the database protocol of the requested database type; forwarding the target data packet to the target database corresponding to the requested database type, and receiving the operation result fed back by the target database; returning the operation result to the client; and if the verification result is verification failure, sending a prompt message of operation failure to the client.

[0010] Optionally, after obtaining the verification result by performing permission verification and security policy check on the data packet through the database management service, the method further includes: if the verification result indicates that the query command in the data packet is a prohibited command, returning a prompt message to the client indicating that the operation is prohibited.

[0011] Optionally, the method also includes: obtaining login information of the target object when the target object logs in to the database tool, wherein the login information includes the user name, login time and IP address; verifying the login information, and if the login information verification is passed, receiving the data packet sent by the target object through the client database tool.

[0012] According to another aspect of an embodiment of the present application, a data processing device is also provided, including: a receiving module, used to receive a data packet sent by a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; a checking module, used to call an API interface of a database management service, and perform permission verification and security policy checking on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; a verification module, used to verify the target object through a client plug-in when the verification result indicates that the query command in the data packet is a command of the target type, wherein the client plug-in is installed in the client.

[0013] According to another aspect of the embodiment of the present application, a data processing system is also provided, including: a database proxy service, a client, a client plug-in and a database management service, wherein the database proxy service is used to receive a data packet sent by the target object through the database tool of the client, wherein the data packet includes at least a query request, a query command, and the requested database type; calling the API interface of the database management service, and performing permission verification and security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, the target object is verified through the client plug-in, wherein the client plug-in is installed in the client; the client is used to send a data packet to the database proxy service, and receive the operation result returned by the database proxy service.

[0014] According to another aspect of the embodiments of the present application, an electronic device is also provided, including: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: receiving a data packet sent by the target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; calling an API interface of a database management service, and performing permission verification and security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, the target object is verified through a client plug-in, wherein the client plug-in is installed in the client.

[0015] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned data processing method by running the computer program.

[0016] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned data processing method when executed by a processor.

[0017] In an embodiment of the present application, a data packet is received from a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; an API interface of a database management service is called, and permission verification and a security policy check are performed on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, the target object is verified through a client plug-in, wherein the client plug-in is installed in the client, achieving the purpose of real-time monitoring and security management, thereby realizing the technical effect of enhancing security and improving operational compliance, and thus solving the technical problem in the related art that the monitoring of query commands only focuses on post-audit and lacks real-time interception function. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1is a hardware structure block diagram of a computer terminal for implementing a data processing method according to an embodiment of the present application;

[0020] Figure 2 is a flow chart of a data processing method according to an embodiment of the present application;

[0021] Figure 3 This is a deployment architecture diagram according to an embodiment of the present application;

[0022] Figure 4 is a data processing operation flow chart according to an embodiment of the present application;

[0023] Figure 5 is a structural diagram of a data processing device according to an embodiment of the present application;

[0024] Figure 6 It is a structural diagram of a data processing system according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject the automated decision results; if the user chooses to reject, the expert decision-making process will be entered.

[0028] First, some nouns or terms that appear in the process of explaining the embodiments of this application are subject to the following explanations:

[0029] Database Control Service, abbreviated as dbctrl, is used to identify, intercept, verify, and redact database operation permissions, as well as perform data redaction. It also provides an API for the database client agent service (Dbagent). dbctrl is responsible for issuing database agent information, identifying database operation permissions, intercepting illegal commands, logging operations, and performing data redaction. For risky and high-risk commands, it also notifies the client plug-in to pop up an interactive verification window.

[0030] Database client proxy service, abbreviated as Dbagent, implements underlying data processing capabilities such as connection proxy forwarding, data packet parsing and assembly for client database operations. It adapts to common relational database protocols (such as MySQL, PostgreSQL, and other general-purpose databases) and encapsulates and forwards data according to protocol standards. Dbagent is responsible for forwarding client SQL requests to the target database and returning query results.

[0031] Client-side interaction plug-in: This plug-in, also known as a client-side plug-in, needs to be installed on the user's computer and is responsible for handling user verification of risky and high-risk commands. By popping up an interactive dialog box on the client or performing SMS verification, the plug-in ensures user confirmation of operations, preventing unauthorized or risky database operations.

[0032] In related technologies, although tools such as 4A bastion host are used to perform post-audit of database operations, there are still some deficiencies, which are specifically manifested in the following aspects: 1. Users are required to log in to the web page through a verification code or a unified work number, and log in to the target database through the database tool provided by the web. The operation steps are one more step compared to directly connecting to the database, which is inconvenient to use; 2. Users can only use the database tools in the web portal and cannot choose the client according to their own habits. At the same time, these tools occupy 4A server resources. As the number of users increases, performance bottlenecks may occur, resulting in slower response speeds; 3. Monitoring of SQL commands only focuses on post-audit and lacks real-time interception functions; 4. There is no flexible and fine-grained permission control for databases and database accounts.

[0033] In order to solve the problems existing in the related art, the embodiment of the present application provides a data processing method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is explained below.

[0034] The data processing method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG1 shows a hardware structure block diagram of a computer terminal for implementing a data processing method. Figure 1 As shown, the computer terminal 10 may include one or more (illustrated by 102a, 102b, ..., 102n in the figure) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0035] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0036] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data processing method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned data processing method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0037] The transmission module 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission module 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission module 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0038] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0039] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0040] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a data processing method. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] Figure 2 is a flow chart of a data processing method according to an embodiment of the present application, such as Figure 2 As shown, the method includes the following steps:

[0042] Step S202: receiving a data packet sent by the target object through a database tool of a client, wherein the data packet at least includes a query request, a query command, and a requested database type.

[0043] In step S202, the execution entity can be a database client proxy service (Dbagent), and the target object can be an account, identity, or user. A query request is a statement in a data packet that the target object wishes to perform on the database. It can be the general intent of an SQL command, such as a query, insert, update, or delete. For example, a user initiates a query request through Navicat (the aforementioned database tool) to retrieve all records in a table. The query command is the SQL statement that specifically implements the query request, including the complete SQL syntax and operation parameters. For example, a query command can be a SQL statement such as "SELECT * FROM employees," which explicitly specifies the request to retrieve all records in all columns from the employees table. In a multi-database environment, since different databases (such as MySQL, PostgreSQL, and Oracle) have different communication protocols and data formats, the data packet must include information about the target database type (i.e., the database type of the request). This allows Dbagent to correctly parse the data packet based on the database type, construct a request compatible with the target database, and perform subsequent permission verification and command forwarding.

[0044] Step S204, call the API interface of the database management service, and perform permission verification and security policy check on the data packet through the database management service to obtain the verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet.

[0045] In step S204, after Dbagent parses the data packet and extracts key information (such as the query command and the requested database type), it initiates an API call to the database control service (dbctrl). The primary purpose of this API call is to allow dbctrl to perform permission verification and security policy checks on the upcoming database operation to confirm whether the operation is permitted and to ensure that the operation does not contain abnormal or high-risk data.

[0046] Before verification, the administrator needs to configure the database permission policy on the database management platform to implement the above verification process. The permission policy includes but is not limited to:

[0047] 1) User account: Assign a unique login account to each user, which will be used as the first half of the login user in the database tool;

[0048] 2) Database: Specify the database instances that users can access, ensuring that users can only access authorized databases;

[0049] 3) Database Account: Configure a specific account in the database for each user and set their permissions on different database instances. This account will serve as the second half of the login user in the database tool.

[0050] 4) Operation permissions: Assign precise operation permissions to database accounts, including operation risk levels (such as normal, risky, high-risk, and prohibited), SQL commands that require management (such as DELETE FROM), and control objects (such as database level and table level).

[0051] 5) Time limit: Configure operation permissions within a specific time period to restrict users from performing database operations during unauthorized time.

[0052] Permission verification verifies whether the target object (i.e., user) has the permissions to perform the database operations specified in the data package. By querying pre-configured permissions, dbctrl can check whether the user is authorized to access specific databases, tables, and columns, as well as execute specific SQL commands (such as SELECT, INSERT, UPDATE, and DELETE). For example, if the command in a data package is UPDATE employees SET salary = 50000 WHERE id = 123, permission verification will verify whether the user is authorized to perform the UPDATE operation and modify the salary field in the employees table. Security policy checking ensures that the data package does not contain any abnormal or high-risk data, such as SQL injection attacks or large-scale data deletion or modification. dbctrl analyzes the SQL commands in the data package to identify potential security risks, such as the invocation of high-risk SQL statements, access to sensitive data, or operations performed during non-business hours. Pre-defined security policies can prevent unauthorized access or damage to the database. For example, if the query command in the data packet attempts to access a table containing sensitive user information, or uses a complex query that may cause database performance problems, the security policy check will intercept and prevent the execution of the operation. After the permission check and security policy check are completed, dbctrl will return a verification result to indicate to Dbagent whether the database operation in the data packet is allowed to be executed. The verification result can include whether the permission verification is passed, whether there is a security risk, and the possible next steps (such as direct execution, requiring secondary confirmation, complete blocking, etc.). For example, the verification result shows that the user has the permission to execute the SELECT command but not the permission to execute the UPDATE command, or the user can access a specific table during normal working hours, but is blocked from access during non-working hours.

[0053] Through these verification steps, the entire system assesses the legality and security of database operations before they are executed, effectively preventing database security incidents and ensuring that data operations comply with corporate security policies and compliance requirements. Real-time verification at the time of operation requests provides immediate feedback and control, a more proactive and efficient approach compared to traditional post-audit methods.

[0054] Step S206 : When the verification result indicates that the query command in the data packet is a target type command, the target object is verified by the client plug-in, wherein the client plug-in is installed in the client.

[0055] In step S206, the target type of command refers to database operations with a certain risk level, such as large-scale data deletion, sensitive data access, and system configuration modification. After dbctrl completes permission verification and security policy checks, if it finds that the query command in the data packet falls into one of these risk categories, it will not directly allow execution, but will instead trigger a higher-level verification process. The client plug-in is a small application installed on the user's computer. It is tightly integrated with the client's database tools (such as Navicat) and can monitor and control database operation requests issued by users through these tools. When Dbagent receives a command from dbctrl that requires further verification, it will initiate an interactive verification request to the user through the client plug-in, such as a secondary confirmation window or SMS verification code verification. Verification through the client plug-in is intended to maintain the convenience of database operations while adding a real-time, user-participated management and control link. This not only greatly improves the security of database operations, but also effectively prevents data loss and system risks caused by misoperation or malicious operations, ensuring that all high-risk database operations are controlled and clearly authorized. The integration of client plug-ins makes this verification process non-invasive. Users can complete all necessary verification steps in the database client tools they are accustomed to using without switching to other interfaces or platforms. This greatly improves the user experience while ensuring the security and compliance of operations.

[0056] Through steps S202 to S206 above, the purpose of real-time monitoring and security control is achieved, thereby achieving the technical effect of enhancing security and improving operational compliance, and further resolving the technical problem that related technologies for monitoring query commands only focus on post-audit and lack real-time interception capabilities. The following is an explanation.

[0057] In step S204 of the above-mentioned data processing method, the data packet is subjected to permission verification and security policy check through the database management and control service to obtain a verification result, including: parsing the data packet to obtain a first parsing result, wherein the first parsing result at least includes the query command, the requested database type and the client information; performing permission verification and security policy check on the first parsing result through the database management and control service to obtain a verification result.

[0058] In some embodiments of the present application, when Dbagent receives a data packet sent by a client (such as a database tool like Navicat), it first parses the data packet. The purpose of parsing the data packet is to extract key information from the data packet and obtain a first parsing result. The first parsing result includes at least: the query command, the requested database type, and client information. The client information includes but is not limited to the client's IP address, user identity, etc. After parsing the data packet and obtaining the first parsing result, Dbagent uses dbctrl's API to perform permission verification and security policy checks on the first parsing result to obtain a verification result.

[0059] In step S204 of the above-mentioned data processing method, after obtaining the verification result by performing permission verification and security policy check on the data packet through the database management and control service, the method further includes: when the verification result indicates that the query command in the data packet is a first-class command, repackaging the first parsing result into a target data packet that conforms to the database protocol of the requested database type, wherein the risk level of the first-class command is less than the risk level of the target-type command; forwarding the target data packet to the target database corresponding to the requested database type, and receiving the operation result fed back by the target database; and returning the operation result to the client.

[0060] In some embodiments of the present application, after permissions verification and security policy checks, if the query command in the data packet is verified to be a first-class command (a low-risk command, such as a regular command), the Dbagent repackages the first parsed result (including the query command, the requested database type, and other necessary information) into a target data packet based on the verification result. The format of the target data packet complies with the communication protocol of the database type (such as MySQL, PostgreSQL, etc.) requested by the user. The Dbagent ensures that the information in the data packet is correctly formatted so that the target database can understand and respond. The repackaged target data packet is forwarded to the target database, where the target database is the actual database that the user is attempting to access through a database tool, i.e., a specific instance of the database type specified in the data packet. After receiving the database operation request forwarded by the Dbagent, the target database performs the corresponding operation based on the SQL command in the request. For example, if the command is a SELECT command, the database executes the query and returns the query result; if the command is an INSERT or UPDATE command, the database performs the data update operation and returns the operation status. The Dbagent is responsible for receiving the operation result returned by the target database and returning the result to the client (such as Navicat). If the operation is successful, the client will receive the expected query results or operation confirmation message; if the operation fails, the client will receive an error message indicating that the operation failed to complete. This process ensures that the client can receive feedback on the results of the database operation, maintaining the integrity of the operation process and smooth user interaction.

[0061] Through this series of steps, low-risk, first-category commands can be executed quickly and securely, without users having to worry about data security or operational compliance. The entire process runs seamlessly in the background, allowing users to focus on using database tools to perform necessary operations without having to worry about underlying security checks and protocol conversion details. This improves database security while maintaining operational convenience and a high-quality user experience.

[0062] In step S204 of the above-mentioned data processing method, after obtaining the verification result by performing permission verification and security policy check on the data packet through the database management and control service, the method further includes: when the verification result indicates that the query command in the data packet is the first target command in the target type command, a secondary confirmation window is popped up to the client through the client plug-in, wherein, after receiving the secondary confirmation result of the target object on the client side, the client plug-in sends the secondary confirmation result to the database management and control service for verification; after receiving the verification result returned by the database management and control service, the first parsing result is repackaged into a target data packet that conforms to the database protocol of the requested database type; the target data packet is forwarded to the target database corresponding to the requested database type, and the operation result fed back by the target database is received; and the operation result is returned to the client.

[0063] In some embodiments of the present application, when the query command in the data packet is verified to be the first target command (e.g., a risky command), Dbagent does not immediately execute the command. Instead, it displays a secondary confirmation window to the user's client software (e.g., a database tool like Navicat) through a client plug-in. This secondary confirmation window requires the user to reconfirm their intended operation to prevent incorrect or high-risk operations. After the user confirms the operation in the secondary confirmation window, the client plug-in receives the confirmation result, which can be a simple confirmation mark (e.g., "Y" for confirmation). The client plug-in then sends this secondary confirmation result back to the database control service to complete the final verification step. This interaction ensures that risky commands are only allowed to execute with the user's explicit consent. After receiving the secondary confirmation result from the client plug-in, dbctrl verifies its validity and legality. If the verification is successful, dbctrl returns a verification success signal; if the verification fails, it returns a verification failure signal, preventing further execution of the command. After the secondary confirmation and verification process is complete and the command is confirmed to be valid, Dbagent repackages the data packet into a target data packet based on the first parsing results (i.e., the query command, requested database type, and other information parsed from the data packet), ensuring that the target database can correctly understand and execute the command. Dbagent forwards the encapsulated target data packet to the specific target database instance. After the target database executes the command, it returns the operation results, including but not limited to the query results, update status, and error information. Dbagent is responsible for receiving the operation results and forwarding them to the client.

[0064] In step S204 of the above-mentioned data processing method, the data packet is subjected to permission verification and security policy check by the database management service. After obtaining the verification result, the method further includes: when the verification result indicates that the query command in the data packet is the second target command in the target type command, a text message verification code window is popped up to the client through the client plug-in, wherein after the client plug-in receives the text message verification code entered by the target object on the client, the text message verification code is sent to the database management service for verification, and the risk level of the second target command is higher than the risk level of the first target command; receiving the verification result returned by the database management service, and when the verification result is verification passed, repackaging the first parsing result into a target data packet that complies with the database protocol of the requested database type; forwarding the target data packet to the target database corresponding to the requested database type, and receiving the operation result fed back by the target database; returning the operation result to the client; and when the verification result is verification failure, sending a prompt message indicating that the operation failed to the client.

[0065] In some embodiments of the present application, the second target command is an operation with a higher risk level than the first target command, such as high-risk commands involving large-scale data modification or deletion of sensitive data. If the verification result indicates that the query command in the data packet is the second target command (e.g., a high-risk command), Dbagent does not directly execute the command. Instead, it uses the client plug-in to pop up a text message verification code window in the user's client software (e.g., a database tool). The text message verification code window requires the user to enter a previously received text message verification code. This additional security verification method confirms the legitimacy of the operation and prevents unauthorized high-risk operations. After the user enters the verification code in the text message verification code window, the client plug-in receives the verification code and sends it to the database management service for verification. This interactive process ensures that only when the user can provide the correct verification code can the command pass the verification phase, and the system will further determine whether the command can be executed. After dbctrl completes the verification of the verification code, it returns a verification result. If the verification result is successful, Dbagent repackages the data packet based on the first parsing result (i.e., key information such as the query command and the requested database type obtained from the data packet) to conform to the specific protocol of the target database, thereby obtaining the target data packet. Dbagent forwards the encapsulated target data packet to the target database to perform the corresponding operation. After executing the command, the target database will feedback the operation results to Dbagent. Dbagent is responsible for receiving the operation results and returning them to the client, allowing the user to view the operation execution status, such as query results, update status, or error information. If the verification result returned by dbctrl is verification failure, that is, the SMS verification code entered by the user is incorrect, Dbagent will not execute the query command and will send a message to the client indicating that the operation failed. This message notifies the user that the operation failed security verification, thereby preventing potentially high-risk operations from being executed and protecting the database from unauthorized modification or access.

[0066] In step S204 of the above data processing method, the data packet is subjected to permission verification and security policy check through the database management service. After obtaining the verification result, the method further includes: when the verification result indicates that the query command in the data packet is a prohibited command, a prompt message indicating that the operation is prohibited is returned to the client.

[0067] In some embodiments of the present application, a prohibited command is a database operation that is explicitly marked as not allowed to be executed based on the system security policy and permission configuration. When checking a data packet, dbctrl will compare these commands with a preset prohibited list to determine whether they are prohibited commands. If a query command is identified as a prohibited command, dbctrl will not allow Dbagent to forward the data packet to the target database. Instead, it will generate a prompt message indicating that the operation is prohibited and return this message to the client through Dbagent. After the client receives this message, it will be displayed on the user interface, clearly informing the user that the database operation it attempted to execute has been blocked by the system because the operation was marked as a prohibited command. This mechanism can effectively protect the database from unauthorized modifications and potential security threats.

[0068] In the above-mentioned data processing method, the method also includes: when the target object logs in to the database tool, obtaining the login information of the target object, wherein the login information includes the user name, login time and IP address; verifying the login information, and if the login information verification is passed, receiving the data packet sent by the target object through the client's database tool.

[0069] In some embodiments of the present application, in the database security access system, it is extremely important to ensure the information security and operation legitimacy of the user when logging into the database tool. Therefore, before the user attempts to log in and access the database through a database tool (such as Navicat), the system will perform a series of login information verification steps. For example, the user fills in the IP, proxy port and username and password of the proxy service in database tools such as Navicat. The username format is "user login account#database username", where the "#" symbol is used as a separator. When logging in, Dbagent will verify the permissions of the username, IP whitelist, login time, etc.

[0070] Specifically, when a target user (i.e., a user) attempts to log in to the database tool, Dbagent first intercepts the login request and extracts the user's login information, including username, login time, and IP address. The username is the user's unique identifier registered in the system; the IP address is the IP address of the network device used by the user to log in, which is used for IP whitelist verification to ensure that the login request originates from an authorized network environment. After obtaining the login information, Dbagent sends it to the database control service (dbctrl) for verification. This verification process includes username verification, permission verification, time limit verification, and IP whitelist verification. Username verification confirms that the username exists in the system and is a legitimate database user. Permission verification verifies whether the username has access to the database at a specific time, including authorization to access a specific database instance and perform specific operations. Time limit verification verifies that the user's current login time is within the permitted access time period according to pre-set policies. IP whitelist verification verifies that the user's IP address is on the database tool's IP whitelist to prevent unauthorized network devices from accessing the database. Only after the login information passes verification can the user send data packets through the database tool.

[0071] In order to better understand the data processing method of the embodiment of the present application, the following Figures 3 and 4 The above method is described, wherein: Figure 3 is a deployment architecture diagram according to an embodiment of the present application. Figure 4 This is a data processing operation flow chart according to an embodiment of the present application.

[0072] The data processing method in the embodiment of the present application can be Figure 3 As shown in the deployment architecture diagram, Figure 3 The main components of the database security access system and their interactions are shown, including the following components:

[0073] 1. Client Plug-in: This software plug-in is installed on the user's computer and is responsible for communicating with the Web Management Module and handling user authentication for risky and high-risk commands. It pops up a verification code input box when a high-risk command is executed, receives the verification code entered by the user, and sends it to DBctrl for verification.

[0074] 2. Web: The Web management module provides administrators with an interface for configuring and managing database proxy information, security policies, user information, database information (type, IP, port, proxy port), database operation permission configuration (prohibited, high-risk, risky commands), database permission configuration, database field desensitization configuration, database operation records, etc. Administrators can set database operation permissions and rules through the Web interface;

[0075] 3. DBctrl: The database control service module is responsible for performing real-time permission verification, command interception, and data desensitization. It receives requests from Dbagent, checks the legitimacy of database operations based on pre-set rules, intercepts illegal commands, records operation logs, and desensitizes sensitive data. DBctrl also provides an API for Dbagent to call, handling command auditing and control.

[0076] 4. Dbagent: Database client proxy service. It acts as a proxy for user database operation requests, receiving database operation requests from clients (such as Navicat, DBBeaver, etc.), parsing the SQL commands and related information in the requests, and performing preliminary permission verification. Dbagent forwards requests that comply with security policies to the target database, receives the database's response, and returns it to the client.

[0077] 5. Navicat and DBBeaver: These are database client tools used by users. Through these tools, users can send database operation requests to Dbagent, including SQL commands such as query, insert, and update;

[0078] 6.MySQL, PostgreSQL, teledb, and telepa: These are target databases (systems). They receive database operation requests forwarded by Dbagent, perform corresponding database operations, and then return the operation results to Dbagent.

[0079] The workflow of the entire system is as follows: The user sends a database operation request to Dbagent through the database client tool. Dbagent parses the SQL command in the request and performs a preliminary permission check. The request is sent to DBctrl for a deeper permission and policy check. If the command is legal, DBctrl will notify Dbagent and allow it to forward the operation request to the target database; if the command is risky, DBctrl will intercept the request and request additional verification from the user through the client plug-in. Dbagent forwards the request to the target database according to DBctrl's instructions and receives the database's response. Dbagent returns the database's response to the client tool for the user to view or operate. Throughout the process, DBctrl will record logs of all operations for auditing and management purposes.

[0080] Figure 4 This is a data processing operation flow chart that illustrates the entire process from the user initiating a database operation request to the system responding, involving key verification, permission checking, data processing, and feedback mechanisms. Figure 4 Explanation of the process:

[0081] 1. The administrator logs in to the Web management platform to configure the database proxy and security policy, and sends the configured database proxy configuration and security policy to the dbctrl database control service;

[0082] 2. After logging into the web management platform, the user initiates a database request to the dbctrl database management service in the form of a data packet. The user enters an SQL command through their database client tool (such as Navicat or SQL Workbench). For example, a user might initiate an SQL query through the Navicat client (e.g., SELECT * FROM users WHERE age>30). At this point, Navicat has already specified the database type (such as MySQL or PostgreSQL) during the connection process and encapsulates the SQL command into a data packet that complies with the target database protocol and sends it to the database proxy service port.

[0083] 3. Dbagent (database agent service) receives the request and parses the data packet: After the request is received by Dbagent, Dbagent is responsible for parsing the data packet and extracting key data such as SQL commands, target database information, and operation type;

[0084] 4. Request permission identification and security policy check: Dbagent sends the extracted SQL command information to dbctrl, which performs permission verification and security policy checks to determine whether the operation complies with preset rules and permissions.

[0085] 5. Verification (or authentication) results and instruction type processing: dbctrl classifies commands into common commands, risky commands, high-risk (or high-risk) commands, or prohibited commands based on the inspection results, and returns the corresponding processing instructions to Dbagent;

[0086] 6. Ordinary instruction processing: For ordinary instructions, Dbagent directly re-encapsulates the request data packet into a format that complies with the target database protocol, and then forwards it to the target database for execution. The target database returns the operation result, and Dbagent then returns the operation result as a query result to the client. Among them, if it is a prohibited instruction, a prompt indicating that the operation is prohibited is returned to the client. For example, after the target database returns the operation result, Dbagent receives the response data packet of the operation result and parses it. For example, for the MySQL protocol, Dbagent needs to parse the query result set or operation status information, and encapsulate the result into a response packet that complies with the MySQL protocol standard. Dbagent encapsulates the parsed response result (such as query results, operation status, etc.) and returns it to the client. After receiving the response packet, the client parses it according to the protocol and displays the query result or operation status on the user interface;

[0087] 7. Risky Instruction Processing: For risky instructions, Dbagent will, through the client plug-in, pop up a secondary confirmation window on the user interface, requesting the user to confirm their intended operation. After the user confirms, they enter a confirmation flag (such as "Y"). The client plug-in then sends the secondary confirmation result to dbctrl, which verifies the result and returns it to Dbagent. Once verification is successful, Dbagent will repackage the request and forward it to the target database for execution. Dbagent will then return the operation result received from the target database to the client as the query result.

[0088] 8. High-risk instruction processing: For high-risk instructions, Dbagent also uses the client plug-in to pop up a text message verification code window to the user. The user enters the verification code received, and the client plug-in sends the verification code to dbctrl for verification. If the verification code is correct (i.e., verification passes), Dbagent repackages the request and forwards it to the target database for execution. Dbagent returns the operation result received from the target database as the query result to the client; if the verification code is incorrect (i.e., verification fails), Dbagent will block the operation and send a prompt message to the client indicating the operation failed;

[0089] 9. Data Desensitization and Return Results: For operations involving sensitive data, dbctrl will perform data desensitization in the results returned to the client (such as user personal information, financial information, etc.) to ensure that sensitive data is not leaked. The desensitized data is encapsulated by Dbagent and returned to the client. Desensitization rules can be dynamically expanded based on business needs to support new sensitive fields and desensitization methods, ensuring that the system adapts to changing compliance requirements.

[0090] 10. Operation Logs: Regardless of the outcome of an operation, Dbagent and dbctrl record the operation process and results in the operation log. This log information is then sent to the audit system via the web management platform for audit and management, ensuring the traceability and compliance of all database operations. Log content includes: operation time, operating user, operation type (such as SELECT, UPDATE, etc.), requested SQL, permission verification results, desensitized information, and operation results.

[0091] pass Figure 4 The process shown here ensures database operation security while also ensuring operational convenience and a superior user experience. By introducing different confirmation and verification mechanisms for operations at different risk levels, database access risks are effectively controlled, while data desensitization ensures the security of sensitive information. Furthermore, operation logs provide a basis for subsequent audits and problem tracking.

[0092] The data processing method provided in the embodiment of the present application has the following beneficial effects: 1. Users do not need to log in to the 4A portal for identity authentication, and can directly perform database operations through their familiar database clients (such as Navicat, etc.), which simplifies the user's operation process and improves the user experience; 2. Compared with multiple jumps through the 4A portal, users can directly connect to the target database, reducing the operation steps and improving efficiency; 3. When users open the database client, they only occupy user terminal resources, but not platform resources, avoiding possible performance bottlenecks; 4. By combining multiple security strategies, the system can accurately control the database operation permissions of each user to ensure that only authorized operations can be performed. It supports any combination of users, resources, resource accounts, and operation permissions to achieve more refined permission management; 5. The system uses a real-time verification mechanism to ensure that database operations are not affected by malicious commands or unauthorized operations; 6. During the operation, sensitive data will be desensitized to protect user privacy and avoid data leakage.

[0093] Figure 5 is a structural diagram of a data processing device according to an embodiment of the present application, such as Figure 5 As shown, the device includes:

[0094] The receiving module 40 is configured to receive a data packet sent by a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type;

[0095] The checking module 42 is used to call the API interface of the database control service and perform permission verification and security policy check on the data packet through the database control service to obtain a verification result. The permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is any abnormal data in the data packet;

[0096] The verification module 44 is configured to verify the target object through a client plug-in when the verification result indicates that the query command in the data packet is a target type command, wherein the client plug-in is installed in the client.

[0097] In the inspection module in the above-mentioned data processing device, the inspection module is also used to parse the data packet to obtain a first parsing result, wherein the first parsing result at least includes the query command, the requested database type and the client information; the first parsing result is subjected to permission verification and security policy inspection through the database management service to obtain a verification result.

[0098] The above-mentioned data processing device also includes a processing module 46, which is used to repackage the first parsing result into a target data packet that complies with the database protocol of the requested database type when the verification result indicates that the query command in the data packet is a first-class command, wherein the risk level of the first-class command is lower than the risk level of the target-type command; forward the target data packet to the target database corresponding to the requested database type, and receive the operation result fed back by the target database; and return the operation result to the client.

[0099] In the processing module in the above-mentioned data processing device, the processing module is also used to pop up a secondary confirmation window to the client through the client plug-in when the verification result indicates that the query command in the data packet is the first target command in the target type command, wherein after the client plug-in receives the secondary confirmation result of the target object on the client, it sends the secondary confirmation result to the database management service for verification; after receiving the verification result returned by the database management service, the first parsing result is re-encapsulated into a target data packet that conforms to the database protocol of the requested database type; the target data packet is forwarded to the target database corresponding to the requested database type, and the operation result feedback from the target database is received; and the operation result is returned to the client.

[0100] In the processing module in the above-mentioned data processing device, the processing module is also used to pop up a text message verification code window to the client through the client plug-in when the verification result indicates that the query command in the data packet is the second target command in the target type command, wherein after the client plug-in receives the text message verification code entered by the target object on the client, the text message verification code is sent to the database management service for verification, and the risk level of the second target command is higher than the risk level of the first target command; receive the verification result returned by the database management service, and if the verification result is verification passed, re-encapsulate the first parsing result into a target data packet that conforms to the database protocol of the requested database type; forward the target data packet to the target database corresponding to the requested database type, and receive the operation result feedback from the target database; return the operation result to the client; if the verification result is verification failure, send a prompt message of operation failure to the client.

[0101] In the processing module in the above data processing device, the processing module is further configured to return a prompt message indicating that the operation is prohibited to the client when the verification result indicates that the query command in the data packet is a prohibited command.

[0102] In the receiving module in the above-mentioned data processing device, the receiving module is also used to obtain the login information of the target object when the target object logs in to the database tool, wherein the login information includes the user name, login time and IP address; verify the login information, and if the login information verification is passed, receive the data packet sent by the target object through the client's database tool.

[0103] It should be noted that Figure 5 The data processing device shown is used to perform Figure 2 The data processing method shown, therefore the relevant explanations in the above data processing method are also applicable to the data processing device, and will not be repeated here.

[0104] Figure 6 is a structural diagram of a data processing system according to an embodiment of the present application, such as Figure 6 As shown, the data processing system 58 includes: a database proxy service 50, a client 52, a client plug-in 54 and a database management service 56, wherein the database proxy service is used to receive a data packet sent by the target object through the database tool of the client, wherein the data packet includes at least a query request, a query command, and the requested database type; calling the API interface of the database management service, and performing permission verification and security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, the target object is verified through the client plug-in, wherein the client plug-in is installed in the client; the client is used to send a data packet to the database proxy service and receive the operation result returned by the database proxy service.

[0105] It should be noted that Figure 6 The data processing system shown is used to perform Figure 2 The data processing method shown, therefore the relevant explanations in the above data processing method are also applicable to the data processing system and will not be repeated here.

[0106] An embodiment of the present application also provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute program instructions to implement the following functions: receiving a data packet sent by the target object through the database tool of the client, wherein the data packet includes at least a query request, a query command, and a requested database type; calling the API interface of the database management service, and performing permission verification and security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, the target object is verified through the client plug-in, wherein the client plug-in is installed in the client.

[0107] It should be noted that the above electronic equipment is used to perform Figure 2 The data processing method shown, therefore the relevant explanations in the above data processing method are also applicable to the electronic device and will not be repeated here.

[0108] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following data processing method by running the computer program: receiving a data packet sent by the target object through the database tool of the client, wherein the data packet includes at least a query request, a query command, and a requested database type; calling the API interface of the database management service, and performing permission verification and security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, verifying the target object through the client plug-in, wherein the client plug-in is installed in the client.

[0109] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The data processing method shown, therefore the relevant explanations in the above data processing method are also applicable to the non-volatile storage medium, and will not be repeated here.

[0110] An embodiment of the present application further provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the data processing method in each embodiment of the present application.

[0111] The embodiments of the present application also provide a computer program, which, when executed by a processor, implements the steps of the data processing method in each embodiment of the present application.

[0112] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0113] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0114] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0115] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0116] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0118] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: include: Receiving a data packet sent by a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; Calling an API interface of a database management and control service, and performing a permission check and a security policy check on the data packet through the database management and control service to obtain a verification result, wherein the permission check is used to verify whether the target object has permission to use the database, and the security policy check is used to verify whether there is any abnormal data in the data packet; In a case where the verification result indicates that the query command in the data packet is a target-type command, the target object is verified by a client plug-in, wherein the client plug-in is installed in the client.

2. The method according to claim 1, characterized in that The database management and control service performs permission verification and security policy checks on the data packet to obtain verification results, including: Parsing the data packet to obtain a first parsing result, wherein the first parsing result at least includes the query command, the requested database type, and client information; The database management and control service performs permission verification and security policy check on the first parsing result to obtain the verification result.

3. The method according to claim 2, characterized in that After obtaining the verification result, the method further includes: performing permission verification and security policy inspection on the data packet through the database management and control service; If the verification result indicates that the query command in the data packet is a first-category command, repackaging the first parsing result into a target data packet that complies with a database protocol of the requested database type, wherein the risk level of the first-category command is lower than the risk level of the target-type command; Forwarding the target data packet to a target database corresponding to the requested database type, and receiving an operation result fed back by the target database; The operation result is returned to the client.

4. The method according to claim 2, characterized in that After obtaining the verification result, the method further includes: performing permission verification and security policy inspection on the data packet through the database management and control service; If the verification result indicates that the query command in the data packet is the first target command among commands of the target type, a secondary confirmation window is popped up to the client through the client plug-in, wherein, after receiving the secondary confirmation result of the target object on the client, the client plug-in sends the secondary confirmation result to the database management service for verification; After receiving the verification result returned by the database management and control service, repackaging the first parsing result into a target data packet of a database protocol that complies with the requested database type; Forwarding the target data packet to a target database corresponding to the requested database type, and receiving an operation result fed back by the target database; The operation result is returned to the client.

5. The method according to claim 2, characterized in that After obtaining the verification result, the method further includes: performing permission verification and security policy inspection on the data packet through the database management and control service; If the verification result indicates that the query command in the data packet is a second target command among commands of the target type, a text message verification code window is popped up on the client through the client plug-in, wherein after receiving the text message verification code input by the target object on the client, the client plug-in sends the text message verification code to the database management and control service for verification, and the risk level of the second target command is higher than the risk level of the first target command; receiving a verification result returned by the database management and control service, and if the verification result is a passed verification, repackaging the first parsing result into a target data packet of a database protocol that complies with the requested database type; Forwarding the target data packet to a target database corresponding to the requested database type, and receiving an operation result fed back by the target database; Returning the operation result to the client; When the verification result is a verification failure, a prompt message indicating that the operation failed is sent to the client.

6. The method according to claim 2, characterized in that After obtaining the verification result, the method further includes: performing permission verification and security policy inspection on the data packet through the database management and control service; When the verification result indicates that the query command in the data packet is a prohibition command, a prompt message indicating that the operation is prohibited is returned to the client.

7. The method according to claim 1, characterized in that The method further comprises: When the target object logs into the database tool, obtaining the target object's login information, wherein the login information includes a user name, login time, and IP address; Verify the login information, and if the login information is verified, receive a data packet sent by the target object through the database tool of the client.

8. A data processing device, characterized in that: include: A receiving module, configured to receive a data packet sent by a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; a check module, configured to call an API interface of a database management and control service, and perform a permission check and a security policy check on the data packet through the database management and control service to obtain a verification result, wherein the permission check is used to verify whether the target object has permission to use the database, and the security policy check is used to verify whether there is any abnormal data in the data packet; A verification module is used to verify the target object through a client plug-in when the verification result indicates that the query command in the data packet is a target type command, wherein the client plug-in is installed in the client.

9. A data processing system, characterized in that: include: Database proxy services, clients, client plug-ins, and database management and control services, including: The database proxy service is used to receive a data packet sent by a target object through a database tool of the client, wherein the data packet includes at least a query request, a query command, and a requested database type; call the API interface of the database management service, and perform permission verification and security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; if the verification result indicates that the query command in the data packet is a command of the target type, verify the target object through the client plug-in, wherein the client plug-in is installed in the client; The client is used to send the data packet to the database proxy service and receive the operation result returned by the database proxy service.

10. An electronic device, characterized in that: include: a memory for storing program instructions; A processor, connected to the memory, is used to execute program instructions that implement the following functions: receiving a data packet sent by a target object through a database tool of a client, wherein the data packet includes at least a query request, a query command, and a requested database type; calling an API interface of a database management service, and performing permission verification and a security policy check on the data packet through the database management service to obtain a verification result, wherein the permission verification is used to verify whether the target object has the permission to use the database, and the security policy check is used to verify whether there is abnormal data in the data packet; when the verification result indicates that the query command in the data packet is a command of the target type, verifying the target object through a client plug-in, wherein the client plug-in is installed in the client.

11. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the data processing method according to any one of claims 1 to 7 by running the computer program.

12. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the data processing method according to any one of claims 1 to 7 is implemented.

Images