Identity verification method, device and equipment for database access and storage medium

Abstract

The invention discloses an identity verification method and device for database access, equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: a first client sends a service request to a configuration server; the configuration server performs service authentication on the service request; if the service request passes the service authentication, the configuration server adopts a first private key to sign a communication address of the first client to obtain signature information; the configuration server sends access configuration information to the first client; the first client sends a database access request to a server of the first database according to the access configuration information; the server of the first database adopts the first public key to perform signature verification on the signature information; and if the information obtained through signature verification is matched with the communication address of the first client, the server of the first database determines that the first client passes identity verification. According to the method, the password is created for the legal communication address to access the database, and the security of the database is effectively enhanced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to an identity authentication method, apparatus, device, and storage medium for database access. Background Art

[0002] With the development of cloud computing, more and more companies are migrating their businesses to cloud computing technology platforms. Therefore, there is a need for businesses to securely access databases on cloud service platforms.

[0003] In related technologies, since the communication address assigned to a business is not fixed when it is deployed on a cloud computing technology platform, when the business accesses a database, a username and password are used for authentication, and the database can be accessed after the authentication is passed.

[0004] In related technologies, user names and passwords are easily leaked. If the user names and passwords are leaked, any host can illegally access the database, posing an extremely high risk of data leakage. Summary of the Invention

[0005] The present invention provides a database access authentication method, apparatus, device, and storage medium. The technical solutions provided by the present invention are as follows:

[0006] According to one aspect of an embodiment of the present application, a method for authentication of database access is provided, the method comprising:

[0007] receiving a database access request sent by a first client, the database access request being used to request access to a first database, the database access request including signature information, wherein the signature information is obtained by signing a communication address of the first client using a first private key corresponding to the first database; and if the service request sent by the first client passes service authentication, the configuration server sending access configuration information including the signature information to the first client, wherein the service authentication is used to verify the legitimacy of the service request;

[0008] Verifying the signature using the first public key corresponding to the first database;

[0009] If the information obtained by the signature verification matches the communication address of the first client, it is determined that the first client passes the identity authentication.

[0010] According to one aspect of an embodiment of the present application, a method for authentication of database access is provided, the method comprising:

[0011] receiving a service request sent by a first client, where the service request is used to instruct to initiate access to a first database;

[0012] Performing service authentication on the service request, wherein the service authentication is used to verify the legitimacy of the service request;

[0013] When the service request passes the service authentication, using the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information;

[0014] Access configuration information is sent to the first client, where the access configuration information includes the signature information. A database access request sent by the first client to the server of the first database according to the access configuration information includes the signature information, and the database access request is used to request access to the first database. When information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes identity authentication.

[0015] According to one aspect of an embodiment of the present application, a method for authentication of database access is provided, the method comprising:

[0016] Sending a service request to the configuration server, where the service request is used to instruct to initiate access to the first database;

[0017] receiving access configuration information sent by the configuration server, the access configuration information including signature information, wherein the access configuration information is sent when the service request passes service authentication, the service authentication being used to verify the legitimacy of the service request, and the signature information being obtained by signing the communication address of the first client using the first private key corresponding to the first database;

[0018] According to the access configuration information, a database access request is sent to the server of the first database, where the database access request is used to request access to the first database, and the database access request includes the signature information. When information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes identity authentication.

[0019] According to one aspect of an embodiment of the present application, a method for authentication of database access is provided, the method comprising:

[0020] The first client sends a service request to the configuration server, where the service request is used to instruct to initiate access to the first database;

[0021] The configuration server performs service authentication on the service request, where the service authentication is used to verify the legitimacy of the service request;

[0022] When the service request passes the service authentication, the configuration server uses the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information;

[0023] The configuration server sends access configuration information to the first client, where the access configuration information includes the signature information;

[0024] The first client sends a database access request to a server of the first database according to the access configuration information, wherein the database access request is used to request access to the first database and includes the signature information;

[0025] The server of the first database verifies the signature information using the first public key corresponding to the first database;

[0026] When the information obtained by the signature verification matches the communication address of the first client, the server of the first database determines that the first client passes the identity authentication.

[0027] According to one aspect of an embodiment of the present application, there is provided an identity authentication system for database access, the system comprising: a first client, a configuration server, and a server of a first database;

[0028] The first client is configured to send a service request to the configuration server, where the service request is used to instruct access to the first database;

[0029] The configuration server is used to perform service authentication on the service request, where the service authentication is used to verify the legitimacy of the service request;

[0030] When the service request passes the service authentication, the configuration server is further configured to use the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information;

[0031] The configuration server is further configured to send access configuration information to the first client, where the access configuration information includes the signature information;

[0032] The first client is further configured to send a database access request to a server of the first database according to the access configuration information, wherein the database access request is used to request access to the first database, and the database access request includes the signature information;

[0033] The server of the first database is configured to verify the signature information using a first public key corresponding to the first database;

[0034] In a case where the information obtained by signature verification matches the communication address of the first client, the server of the first database is further configured to determine that the first client passes identity authentication.

[0035] According to one aspect of an embodiment of the present application, a database access identity authentication device is provided, the device comprising:

[0036] an access request receiving module, configured to receive a database access request sent by a first client, the database access request being used to request access to a first database, the database access request including signature information, wherein the signature information is obtained by signing the communication address of the first client using a first private key corresponding to the first database; if the service request sent by the first client passes service authentication, the configuration server sends access configuration information including the signature information to the first client, wherein the service authentication is used to verify the legitimacy of the service request;

[0037] a signature information verification module, configured to verify the signature information using the first public key corresponding to the first database;

[0038] The identity authentication module is used to determine that the first client passes the identity authentication when the information obtained by the signature verification matches the communication address of the first client.

[0039] According to one aspect of an embodiment of the present application, a database access identity authentication device is provided, the device comprising:

[0040] A service request receiving module, configured to receive a service request sent by a first client, wherein the service request is used to instruct to initiate access to a first database;

[0041] A service authentication module, configured to perform service authentication on the service request, wherein the service authentication is used to verify the legitimacy of the service request;

[0042] a communication address signing module, configured to, when the service request passes the service authentication, use the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information;

[0043] A configuration information sending module is used to send access configuration information to the first client, where the access configuration information includes the signature information, wherein the database access request sent by the first client to the server of the first database according to the access configuration information includes the signature information, and the database access request is used to request access to the first database; when the information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes the identity authentication.

[0044] According to one aspect of an embodiment of the present application, a database access identity authentication device is provided, the device comprising:

[0045] A service request sending module, configured to send a service request to the configuration server, wherein the service request is used to instruct to initiate access to the first database;

[0046] a configuration information receiving module, configured to receive access configuration information sent by the configuration server, the access configuration information including signature information, wherein the access configuration information is sent when the service request passes service authentication, the service authentication being used to verify the legitimacy of the service request, and the signature information is obtained by signing the communication address of the first client using the first private key corresponding to the first database;

[0047] An access request sending module is used to send a database access request to the server of the first database according to the access configuration information, wherein the database access request is used to request access to the first database, and the database access request includes the signature information. When the signature information is verified using the first public key corresponding to the first database, and the information obtained matches the communication address of the first client, the first client passes the identity authentication.

[0048] According to one aspect of an embodiment of the present application, a computer device is provided, comprising a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the above-mentioned authentication method for database access.

[0049] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is loaded and executed by a processor to implement the above-mentioned authentication method for database access.

[0050] According to one aspect of an embodiment of the present application, a computer program product is provided, which includes a computer program, and the computer program is loaded and executed by a processor to implement the above-mentioned authentication method for database access.

[0051] The technical solutions provided by the embodiments of the present application include at least the following beneficial effects:

[0052] The first client sends a service request to the configuration server, where the service request is used to indicate an access to the first database. The configuration server performs service authentication on the received service request to verify the legitimacy of the service request. If the service request passes the service authentication, the configuration server uses the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information. The configuration server uses the signature information as the password for accessing the first database and sends it to the first client. The first client sends the database access request carrying the signature information to the server of the first database. The server of the first database uses the corresponding first public key to verify the signature information. If the information obtained by verification matches the communication address of the first client, the first client passes the identity authentication and dynamically creates a password for each legal communication address. It is ensured that the password can only be used on the client corresponding to the communication address to access the database, effectively enhancing the security of the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a schematic diagram of an implementation environment for a solution provided by an embodiment of the present application;

[0054] Figure 2 This is a flowchart of an authentication method for database access provided by one embodiment of the present application;

[0055] Figure 3 This is a block diagram of an authentication device for database access provided by one embodiment of the present application;

[0056] Figure 4 is a block diagram of an identity verification device for database access provided by another embodiment of the present application;

[0057] Figure 5 is a block diagram of an identity verification device for database access provided by another embodiment of the present application;

[0058] Figure 6 This is a structural block diagram of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0060] Please refer to Figure 1 , which shows a schematic diagram of an implementation environment of a solution provided by an embodiment of the present application. The implementation environment may include: a terminal device 10, a database server 20 and a configuration server 30.

[0061] Terminal devices 10 include, but are not limited to, personal computers (PCs), cloud computing platform hosts, mobile phones, tablet computers, intelligent voice interaction devices, game consoles, wearable devices, multimedia playback devices, in-vehicle terminals, smart home appliances, AR (augmented reality) devices, VR (virtual reality) devices, and other electronic devices. Terminal device 10 can be a database client that requires remote access to a database, for example, a host deployed on a cloud platform.

[0062] The database server 20 is an electronic device used to store, manage, and provide database services, that is, a database server. For example, the database server 20 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, but is not limited to these.

[0063] Configuration server 30 is an electronic device used to centrally manage and store configurations related to accessing database server 20. For example, configuration server 30 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms, but is not limited to these.

[0064] Cloud computing refers to the delivery and usage model of IT infrastructure, enabling on-demand, scalable access to required resources over the internet. In a broader sense, cloud computing refers to the delivery and usage model of services, enabling on-demand, scalable access to required services over the internet. These services can be IT-related, software-related, internet-related, or other services. Cloud computing is the product of the convergence of traditional computer and network technologies, including grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0065] Cloud computing has rapidly grown, driven by the internet, real-time data streams, the diversification of connected devices, and the growing demand for search services, social networks, mobile commerce, and open collaboration. Unlike previous parallel and distributed computing approaches, the emergence of cloud computing will fundamentally revolutionize the entire internet and enterprise management model.

[0066] The terminal device 10, the database server 20 and the configuration server 30 can communicate with each other via a network, which can be a wired network or a wireless network.

[0067] Exemplarily, the business service deployed on the terminal device 10 has a need to access the database. The terminal device 10 sends a service request to the configuration server 30, requesting access to the database. The configuration server 30 performs service authentication on the terminal device 10. If the terminal device 10 passes the service authentication, the communication address of the terminal device 10 is signed to obtain signature information, and access configuration information is sent to the terminal device 10. The access configuration information carries the above-mentioned signature information. The terminal device 10 sends a database access request to the database server 20 according to the access configuration information. The database server 20 verifies the signature information. If the information obtained by verification matches the communication address of the terminal device 10, the terminal device 10 passes the identity authentication of the database server 20.

[0068] Below, the technical solution provided by this application will be introduced and explained through method embodiments.

[0069] Please refer to Figure 2 , which shows a flow chart of an authentication method for database access provided by an embodiment of the present application. This method can be applied to Figure 1In the implementation environment of the solution shown in FIG. , the method may include at least one of the following steps 210 to 270:

[0070] Step 210: The first client sends a service request to the configuration server, where the service request is used to instruct to initiate access to the first database.

[0071] Correspondingly, the configuration server receives a service request sent by the first client, where the service request is used to instruct to initiate access to the first database.

[0072] In some embodiments, the service is deployed on the first client, and when the first client processes the service, it needs to call data from the first database.

[0073] In some embodiments, a business refers to various tasks that a computer needs to process, such as training a large model, providing weather data to users, or providing electronic map data.

[0074] Exemplarily, the first client is a host of a cloud computing technology platform, and the image processing service is deployed on the first client. The image processing service includes the service of training an image processing model. When training the image processing model, it is necessary to call the data in the first database as training data.

[0075] In some embodiments, a service request refers to a demand for obtaining a specified service raised by a client when processing a business. In an embodiment of the present application, a service request refers to a demand for accessing a first database raised by a first client when processing a business.

[0076] In some embodiments, the first database refers to a database storing data required by the first client.

[0077] A database, in short, can be thought of as a digital filing cabinet—a place where electronic files are stored, allowing users to add, query, update, and delete data. A database is a collection of data stored in a specific way, shared by multiple users, with minimal redundancy, and independent of applications.

[0078] A database management system (DBMS) is a computer software system designed for managing databases, typically providing basic functions such as storage, retrieval, security, and backup. DBMSs can be categorized based on the database model they support, such as relational or Extensible Markup Language (XML); the type of computers they support, such as server clusters or mobile phones; the query language they use, such as Structured Query Language (SQL) or XQuery; performance priorities, such as maximum scale or maximum speed; or other classification methods. Regardless of the classification method used, some DBMSs are cross-category, for example, supporting multiple query languages simultaneously.

[0079] In some embodiments, the first database may be an open source database. Databases include relational databases and non-relational databases. A relational database is a database that uses a relational model to organize data, that is, it stores data in rows and columns. For example, open source relational databases include but are not limited to SQL Server, Oracle, MySQL, PostgreSQL, and other databases. A non-relational database is a distributed database that uses key-value pairs for storage. For example, open source non-relational databases include but are not limited to MongoDB, Redis, CouchDB, and other databases.

[0080] Step 220: The configuration server performs service authentication on the first client. Service authentication is used to verify the legitimacy of the service request.

[0081] The configuration server is a server used to centrally manage and store configurations related to accessing the database, and stores information such as the database access address, communication address, user name and password used to access the database in the configuration server. Among them, the access address refers to the address information used to connect to the database, including at least one of the following information: host name, port number and database name, etc. The communication address is the address used by electronic devices for network communication. The user name used to access the database is used to uniquely identify a user in the database, and the password corresponding to the user name is information used to verify the identity of the user. In the present application, the password can be the communication address of the client signed by the first private key, or it can be a fixed string of characters set by the user.

[0082] In some embodiments, the communication address refers to an Internet Protocol Address (IP address).

[0083] Service authentication is a security mechanism used to verify whether a request is authorized to access a service or resource. This usually involves checking the requester's identity (such as username and password) and whether they have permission to access the requested resource.

[0084] Exemplarily, after the service deployed on the first client is started, the first client accesses the configuration server and sends a service request to the configuration server, and the configuration server performs service authentication on the service request.

[0085] In some embodiments, the configuration server obtains signature authentication information included in the service request, wherein the signature authentication information is obtained by the configuration server using a second key to sign the authentication information corresponding to the first client; the configuration server uses the second key to verify the signature authentication information to obtain the verified authentication information; if the verified authentication information is valid, the configuration server determines that the service request has passed the service authentication.

[0086] In some embodiments, the signature authentication information is obtained by the configuration server using the second key to sign the identity credentials submitted by the first client when authenticating the first client. The signature authentication information includes information such as user-related information, permission scope, and validity period. There are many methods for authenticating the first client, such as HTTP (Hypertext Transfer Protocol) basic authentication method, session-based authentication method, token-based authentication method, etc.

[0087] In some embodiments, after the first client is authenticated, the received signature authentication information is saved in the first client, and each time a service request is sent to the configuration server, the signature authentication information is carried in the service request; the configuration server uses the second key to verify the signature authentication information, judge the integrity and authenticity of the verified authentication information, and determine whether the verified authentication information is valid; if the verified authentication information is valid, the service request passes the service authentication; if the verified authentication information is invalid, the service request fails the authentication.

[0088] Exemplarily, the configuration server uses a token-based authentication method to authenticate the first client. The first client sends the user's relevant information to the configuration server. After the configuration server verifies the user's relevant information and confirms that the first client has passed the authentication, the configuration server uses the second key to sign the authentication information of the first client to obtain signed authentication information, and returns the signed authentication information to the first client. When the first client sends a service request to the configuration server, it carries the signed authentication information. The configuration server uses the second key to verify the signed authentication information, judge the integrity and authenticity of the verified authentication information, determine that the verified authentication information is valid, and the service request passes the service authentication.

[0089] It should be noted that the authentication method introduced above is only exemplary and explanatory, and other authentication methods can also be used for service authentication, which is not limited in this application.

[0090] In related technologies, the authentication mechanism of a database management system is based on three elements: IP address, user name, and corresponding password. When the IP address used by the client is fixed, the use of the above three elements can ensure the security of the database. However, when the IP address used by the client is not fixed, for example, when the business is deployed on a cloud computing technology platform, the host obtained is randomly assigned by the cloud computing technology platform. Therefore, the IP address assigned to each business is not fixed. At this time, the database cannot use the IP address for authentication and can only rely on the user name and the corresponding password for authentication. The user name and password can be easily obtained by business development or operation and maintenance. Once the user name and password are leaked, any host can illegally access the database, and the risk of data leakage is extremely high.

[0091] For example, taking the database management system MySQL as an example, MySQL's authentication mechanism is based on username, password and host name or IP address. MySQL can limit users to access only from specific host names or IP addresses. In the mysql.user table of the MySQL database, there is a "Host" field for storing allowed host names or IP addresses. Its value can be a specific host name, a specific IP address, an IP address range (IP address segment), or "%", which means any host. When a user tries to connect to the database, MySQL checks the username in the request and the client's IP address or host name to determine whether there is a matching record. If no matching record is found, the connection will be rejected; when a user tries to connect to a MySQL database, he needs to provide a username and password. The database management system verifies these credentials to confirm whether the user has access rights. MySQL uses a specific encryption algorithm (such as SHA-1, SHA-256, etc.) to hash the password provided by the user, and then compares the hash value with the hash value stored in the mysql.user table. If the hash values match, the password is correct and the authentication is successful. Otherwise, the connection will be rejected.

[0092] Based on the previous example, if the client's IP address is not fixed, the Host field needs to be set to "%". This means that the user can use any host name or IP address to connect to the database, which will lead to the following security risks:

[0093] 1. Exposure to attacks: When the Host field is set to "%", malicious users or attackers can try to connect to the database from anywhere. This increases the risk of being exposed to brute force, dictionary attacks, or other attack methods.

[0094] 2. Unauthorized access: Allowing access from any host may make it easier for internal employees or external entities to gain unauthorized access. This may lead to data leakage, data tampering, or other security issues.

[0095] 3. Difficulty in tracing and auditing: When users can access the database from anywhere, it becomes more difficult to trace and audit database activities. This may result in potential security issues not being discovered and resolved in a timely manner.

[0096] Through the above method, some illegal service requests are filtered out through service authentication, ensuring that the service requests that pass the service authentication are legitimate access sources, thereby improving the security of database access.

[0097] In step 230 , when the service request passes the service authentication, the configuration server uses the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information.

[0098] In some embodiments, the communication address of the first client is the IP address of the first client.

[0099] In some embodiments, the configuration server resolves the service request to obtain the communication address of the first client.

[0100] Exemplarily, the configuration server obtains the IP address of the first client by parsing the service request according to the HTTP protocol.

[0101] Asymmetric encryption is a type of cryptography algorithm. Examples include RSA (Rivest-Shamir-Adleman), the Digital Signature Algorithm (DSA), and Elliptic Curve Cryptography (ECC). Asymmetric encryption requires two keys: a public key (referred to as the public key) and a private key (referred to as the private key). Because encryption and decryption require two different keys, it is called asymmetric encryption. The public key can be made public and freely available; the private key cannot be made public and must be kept strictly confidential by the user.

[0102] A digital signature is a technology used to ensure the integrity and authentication of digital information. It is created and verified using an asymmetric encryption algorithm. The process of encrypting digital information with a private key is called signing, and the process of decrypting the encrypted digital information with the corresponding public key is called signature verification. If a user encrypts plaintext with their private key, anyone can decrypt the ciphertext with their public key. Since the private key is held only by the user, it can be confirmed that the document originated from that user. The public can verify the integrity of the data or document published by the user and whether it has been tampered with. The recipient can trust that the data and document indeed originated from the user. This is called a digital signature.

[0103] In some embodiments, the first private key is used to sign the communication address of the first client, and there is a first public key corresponding to the first private key, and the first public key is used to verify the signed communication address. In this application, the process of encrypting the communication address of the first client using the first private key is called signing, and the process of decrypting the signed communication address using the first public key is called verification.

[0104] In some embodiments, the service request includes service feature information, and the service feature information is used to indicate the service requirements of the first client.

[0105] The service feature information includes information indicating the first database accessed by the first client, for example, the environment to which the first client belongs, the data source to be accessed, and identification information of the first database.

[0106] In some embodiments, before executing step 230, at least one of the following steps needs to be executed:

[0107] Step 230 - 1 : The configuration server determines a first database and a first account that match the service requirements of the first client according to the service feature information.

[0108] In some embodiments, there is a correspondence between the service request, the first database, and the first account, and the configuration server matches the corresponding first database and first account for the service request based on the business feature information in the service request.

[0109] In some embodiments, the first client uses a first account to connect to the first database.

[0110] In step 230-2, the configuration server obtains second record data corresponding to the first database, where the second record data includes at least one account information, and each account information includes a set of corresponding account numbers and private keys.

[0111] The second record data is used to store information such as an account number and connection configuration corresponding to the database. In some embodiments, the configuration server searches the second record data for account information corresponding to the first account number based on the determined first database.

[0112] In some embodiments, the account included in each of the above account information can be indicated using an account identifier. For example, the account identifier can be the user name corresponding to the account, the serial number corresponding to the account, etc., which is not limited in this application.

[0113] In some embodiments, each database may correspond to multiple sets of accounts and private keys.

[0114] In step 230-3, the configuration server obtains the private key corresponding to the first account from the second record data to obtain the first private key.

[0115] In this way, the account and password used by the client to access the database are not stored in the client. Instead, the configuration server automatically matches the corresponding account for the service request sent by the client, which helps reduce the risk of information leakage such as account and password.

[0116] In some embodiments, the account information also includes plug-in indication information, which is used to indicate an authentication plug-in. The authentication plug-in is a plug-in supported by the first database for implementing identity authentication; the configuration server determines the encryption method corresponding to the first authentication plug-in based on the first plug-in indication information included in the account information to which the first account and the first private key belong, wherein the first authentication plug-in is the authentication plug-in indicated by the first plug-in indication information; the configuration server uses the first private key to sign the communication address of the first client based on the encryption method to obtain signature information.

[0117] The authentication plug-in is an independent module of the database server and can be loaded and unloaded according to demand. In some embodiments, the server of the first database includes a plug-in architecture, which is used to support different authentication methods.

[0118] In some embodiments, the plug-in architecture of the server of the first database includes built-in plug-ins and third-party plug-ins. A built-in plug-in refers to an authentication plug-in built into the database server. For example, the built-in plug-in can be at least one of the following plug-ins: mysql_native_password (password verification based on SHA-1 hash) and caching_sha2_password (password verification based on SHA-256 hash). A third-party plug-in is an authentication plug-in used to implement specific authentication requirements. For example, a third-party plug-in can be at least one of the following plug-ins: a Lightweight Directory Access Protocol (LDAP) plug-in can be used to integrate MySQL with an LDAP server, or a PAM plug-in can be used to integrate MySQL with the system's pluggable authentication modules (PAM) framework. Optionally, a third-party plug-in can also be a custom authentication plug-in created by a developer. For example, MySQL provides an application programming interface (API) and development tools so that developers can create custom authentication plug-ins and install the developed authentication plug-ins in the MySQL plug-in architecture to meet user needs.

[0119] In some embodiments, the plug-in indication information may be the name of the authentication plug-in, the serial number of the authentication plug-in, or other identification information used to indicate the authentication plug-in, which is not limited in this application.

[0120] In some embodiments, the encryption method corresponding to the authentication plug-in can be an asymmetric encryption algorithm, or it can be an encryption algorithm corresponding to the authentication plug-in designed by the developer, which is not limited in this application.

[0121] Exemplarily, the configuration server determines the corresponding first database and first account based on the business feature information of the service request, and determines the account information corresponding to the first account from the second record data corresponding to the first database. As shown in Table 1, the account information includes three fields, namely, user name, private key and plug-in indication information. The value of the private key field in the account information corresponding to the first account is determined as the first private key, and the encryption method corresponding to the plug-in indication information and the first private key are used to sign the communication address of the first client to obtain signature information.

[0122] Table 1 Description of keyword fields of account information

[0123] Field value illustrate user test_user username private_key {Private Key} Private Key plugin my_authentication Plugin Instructions

[0124] Through the above method, users can flexibly select authentication plug-ins for authentication according to their needs and application scenarios to meet various security requirements and strategies. It is also beneficial for the database server to connect with the existing authentication infrastructure.

[0125] Step 240: The configuration server sends access configuration information to the first client, where the access configuration information includes signature information.

[0126] Correspondingly, the corresponding first client receives the access configuration information sent by the configuration server.

[0127] In some embodiments, the configuration server determines access configuration information based on the account information and the signature information.

[0128] In some embodiments, the access configuration information also includes at least one of the following information: relevant information about the account, the communication address of the first database, the port number of the first database, and the indication information of the first database. The relevant information about the account refers to the user name corresponding to the account. The communication address of the first database refers to the IP address of the first database. The port number is a digital identifier used to represent processes and services, and is used to distinguish different applications or processes in the transport layer. In this embodiment, the port number of the first database is the port number used to indicate the database service, and the server of the first database handles connections and communications from the client at this port number. For example, the default port number of MySQL is 3306, the default port number of Oracle Database is 1521, the default port number of MongoDB is 27017, and the default port number of Redis is 6379. The indication information of the first database is used to indicate the first database, and can be expressed in the form of the name, serial number, etc. of the first database, which is not limited in this application.

[0129] In some embodiments, the configuration server obtains database record data, where the database record data includes at least one piece of database information, where the database information is used to store database-related information, and each piece of database information includes a database communication address and a database port number. In some embodiments, the configuration server queries the database record data for database information corresponding to the first database based on the determined first database.

[0130] In the above manner, the access configuration information for accessing the database is sent to the client, helping the client to determine and access the corresponding database.

[0131] In step 250 , the first client sends a database access request to the server of the first database according to the access configuration information. The database access request is used to request access to the first database, and the database access request includes signature information.

[0132] Correspondingly, the server of the first database receives the database access request sent by the first client.

[0133] In some embodiments, the database access request further includes a user name corresponding to the first account.

[0134] In some embodiments, the server of the first database parses the database access request to obtain the communication address of the first client.

[0135] Exemplarily, the server of the first database obtains the IP address of the first client by parsing the database access request according to the HTTP protocol.

[0136] In some embodiments, the database access request includes the first account number; before executing step 250, at least one of the following steps needs to be executed:

[0137] In step 250 - 1 , the server of the first database obtains first record data corresponding to the first database. The first record data includes at least one piece of record information, and each piece of record information includes a set of corresponding account numbers and public keys.

[0138] The first record data is used to store information such as an account number and connection configuration for accessing the first database. In some embodiments, the server of the first database obtains corresponding record information in the first record data based on the username of the first account and the IP address of the first client.

[0139] In some embodiments, the recorded information also includes source IP information.

[0140] In some embodiments, the value of the source IP information in the record information is set to a first wildcard, which indicates that all clients are allowed to access the corresponding database.

[0141] Optionally, after creating an account, the configuration server can further restrict the clients allowed to access the corresponding database by adding the client's IP address to the record information.

[0142] In step 250 - 2 , the server of the first database obtains the public key corresponding to the first account from the first record data to obtain the first public key.

[0143] In some embodiments, the public key corresponding to the first account is a string used for identity authentication.

[0144] In step 260 , the server of the first database uses the first public key corresponding to the first database to verify the signature information.

[0145] In some embodiments, the record information also includes plug-in indication information, which is used to indicate an authentication plug-in. The authentication plug-in is a plug-in supported by the first database for implementing identity authentication; based on the first plug-in indication information included in the record information to which the first account and the first public key belong, the first authentication plug-in is called, and the first authentication plug-in is the authentication plug-in indicated by the first plug-in indication information; the signature information is verified using the first public key through the first authentication plug-in.

[0146] In some embodiments, the first authentication plug-in is pre-installed and configured on the server of the first database when the first account is created on the first database.

[0147] Exemplarily, the server of the first database determines the account record corresponding to the first account from the first record data corresponding to the first database based on the database access request, as shown in Table 2. The record information includes four fields, namely the source IP, user name, public key and plug-in indication information. The value of the public key field in the record information corresponding to the first account is determined as the first public key, and the first identity authentication plug-in indicated by the plug-in indication information is called. The signature information in the database access request is verified using the first public key to obtain the signature information after verification. The value of the source IP field is the first wildcard "%", which means that any client with a service request that passes service authentication can access the first database.

[0148] Table 2 Description of the keyword fields of record information

[0149] Field value illustrate Host ％ Source IP User test_user username Plugin my_authentication Plugin Instructions Authentication_string {Public Key} Public Key

[0150] Through the above method, the first database obtains the corresponding public key according to the database access request to verify the signature information in the database access request, ensuring that the signature information can only be verified using the public key corresponding to the private key used for signing, thereby improving the security of the database.

[0151] In some embodiments, the server of the first database compares the information obtained by signature verification with the communication address of the first client through the first identity authentication plug-in.

[0152] In some embodiments, if the information obtained by signature verification is the same as the communication address of the first client, the first client passes identity authentication; if the information obtained by signature verification is different from the communication address of the first client, the first client fails identity authentication.

[0153] Because the communication address is an IP address, each client's IP address is difficult to forge. This is because IP addresses are based on the TCP / IP protocol. When a client establishes a communication connection with a configuration server or database server, it must go through a three-way handshake. During this handshake, the TCP / IP protocol stack verifies the source IP address. If a client forges an IP address, the handshake message will be sent to the wrong address, and the three-way handshake process will fail. Therefore, a client with a forged IP address cannot establish a valid TCP connection with the configuration server or database server.

[0154] Through the above method, the client uses the signature information and the account username to connect to the database, compares the signed information with the client's communication address, and determines whether the current client is consistent with the client that obtained the signature information through service authentication to verify the client's identity, thereby strengthening the security of the database server.

[0155] Step 270: When the information obtained by the signature verification matches the communication address of the first client, the server of the first database determines that the first client has passed the identity authentication.

[0156] In some embodiments, when the server of the first database determines that the first client passes the identity authentication, the server of the first database sends identity authentication information to the first client.

[0157] In some embodiments, the first client accesses the first database according to demand.

[0158] To sum up, the technical solution provided by the embodiment of the present application is that the first client sends a service request to the configuration server, where the service request is used to indicate an access to the first database. The configuration server performs service authentication on the received service request to verify the legitimacy of the service request. When the service request passes the service authentication, the configuration server uses the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information. The configuration server uses the signature information as the password for accessing the first database and sends it to the first client. The first client sends the database access request carrying the signature information to the server of the first database. The server of the first database uses the corresponding first public key to verify the signature information. If the information obtained by verification matches the communication address of the first client, the first client passes the identity authentication and dynamically creates a password for each legal communication address. It also ensures that the password can only be used on the client corresponding to the communication address to access the database, effectively enhancing the security of the database.

[0159] The following describes a process for creating a first account for connecting to and accessing the first database.

[0160] The business developer initiates the process of creating the account corresponding to the database on the configuration server.

[0161] In some embodiments, a service developer registers a service on a configuration server, where the service includes a requirement to access the first database.

[0162] In some embodiments, the configuration server generates a key pair corresponding to the first account, the key pair includes a set of corresponding private keys and public keys, wherein the private key corresponding to the first account is the first private key, and the public key corresponding to the first account is the first public key; the configuration server adds the first account information to the second record data, the first account information includes the first account and the first private key; the configuration server sends the first record information to the server of the first database, and the first record information includes the first account and the first public key.

[0163] In some embodiments, the first record information further includes first plug-in indication information, where the first plug-in indication information is used to indicate the first identity authentication plug-in.

[0164] In some embodiments, the configuration server uses an asymmetric encryption algorithm to generate a key pair corresponding to the first account.

[0165] Through the above method, a corresponding account is created for a specified business in the configuration server, so that different accounts can be created according to different needs to access the database.

[0166] In some embodiments, the server of the first database receives first record information sent by the configuration server, where the first record information includes a first account and a first public key; the server of the first database adds the first record information to the first record data.

[0167] In some embodiments, after receiving the first record information sent by the configuration server, the server of the first database executes the authorization statement; the server of the first database creates an account corresponding to the first record information. For example, if the server of the first database is a MySQL server, after receiving the first record information, the MySQL server executes the following authorization SQL statement:

[0168] CREATE USER'test_user'@'%'IDENTIFIED WITH my_authentication AS'{Public Key}';

[0169] The meaning of this SQL statement is to create an account named test_user, allow it to connect to the MySQL server from any host (%), and use a custom authentication plug-in named my_authentication for authentication; at the same time, add the first record information corresponding to the account in the first record data.

[0170] In some embodiments, when creating the first account, the server of the first database installs the first identity authentication plug-in indicated by the first plug-in indication information.

[0171] Exemplarily, a business developer registers business A on the configuration server, business A needs to access the first database, the configuration server creates a first account corresponding to business A, uses the RSA encryption algorithm to generate a key pair corresponding to the first account, adds the first account information corresponding to the first account in the second record data, the first account information includes the first account and the first private key in the key pair, the configuration server sends the first record information to the server of the first database, the first record information includes the first account and the first public key in the key pair, after the server of the first database receives the first record information, executes the authorization SQL statement, creates the first account on the server of the first database and adds the first record information in the first record data, and installs the first authentication plug-in indicated by the first plug-in indication information.

[0172] Through the above method, an account corresponding to the configuration server is created on the database server, and the corresponding access configuration information can be obtained from the configuration server to access the database.

[0173] The following are device embodiments of the present application, which can be used to implement the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0174] Please refer to Figure 3 , which shows a block diagram of a database access authentication device provided by an embodiment of the present application. The device has the function of implementing the above-mentioned database access authentication method, and the function can be implemented by hardware or by hardware executing corresponding software. The device can be the database server 20 described above, or it can be set in the database server 20. Figure 3 As shown, the apparatus 300 may include an access request receiving module 310 , a signature information verification module 320 , and an identity authentication module 330 .

[0175] The access request receiving module 310 is used to receive a database access request sent by a first client, where the database access request is used to request access to a first database. The database access request includes signature information, where the signature information is obtained by signing the communication address of the first client using the first private key corresponding to the first database. When the service request sent by the first client passes the service authentication, the configuration server sends access configuration information including the signature information to the first client, where the service authentication is used to verify the legitimacy of the service request.

[0176] The signature information verification module 320 is configured to verify the signature information using the first public key corresponding to the first database.

[0177] The identity authentication module 330 is configured to determine that the first client has passed the identity authentication if the information obtained by the signature verification matches the communication address of the first client.

[0178] In some embodiments, the database access request includes a first account; the device 300 further includes a first record data acquisition module and a first public key acquisition module (in Figure 3 not shown).

[0179] The first record data acquisition module is used to obtain first record data corresponding to the first database, where the first record data includes at least one piece of record information, and each piece of record information includes a set of corresponding account numbers and public keys.

[0180] The first public key acquisition module is used to obtain the public key corresponding to the first account from the first record data to obtain the first public key.

[0181] In some embodiments, the record information also includes plug-in indication information, and the plug-in indication information is used to indicate an authentication plug-in, and the authentication plug-in is a plug-in supported by the first database for implementing identity authentication; the signature information verification module 320 is used to call the first authentication plug-in based on the first plug-in indication information included in the record information to which the first account and the first public key belong, and the first authentication plug-in is the authentication plug-in indicated by the first plug-in indication information; and the signature information is verified using the first public key through the first authentication plug-in.

[0182] In some embodiments, the signature information verification module 320 is further configured to compare the information obtained by the verification with the communication address of the first client through the first identity authentication plug-in.

[0183] In some embodiments, the apparatus 300 further includes a record information receiving module and a record information adding module (in Figure 3 not shown).

[0184] The record information receiving module is used to receive first record information sent by the configuration server, where the first record information includes the first account and the first public key.

[0185] A record information adding module is used to add the first record information to the first record data.

[0186] To sum up, the technical solution provided by the embodiment of the present application is that the server of the first database receives the database access request sent by the first client, uses the first public key corresponding to the first database to verify the signature information, and when the information obtained by verification matches the communication address of the first client, it is determined that the first client has passed the identity authentication, ensuring that the password created for the legitimate communication address can only be used on the corresponding client to access the database, thereby enhancing the security of the database.

[0187] Please refer to Figure 4 , which shows a block diagram of an authentication device for database access provided by another embodiment of the present application. The device has the function of implementing the authentication method for database access described above, and the function can be implemented by hardware or by hardware executing corresponding software. The device can be the configuration server 30 described above, or it can be set in the configuration server 30. Figure 4 As shown, the apparatus 400 may include a service request receiving module 410 , a service authentication module 420 , a communication address signing module 430 and a configuration information sending module 440 .

[0188] The service request receiving module 410 is configured to receive a service request sent by a first client, where the service request is used to instruct access to a first database.

[0189] The service authentication module 420 is used to perform service authentication on the service request, and the service authentication is used to verify the legitimacy of the service request.

[0190] The communication address signing module 430 is configured to, when the service request passes the service authentication, use the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information.

[0191] The configuration information sending module 440 is used to send access configuration information to the first client, where the access configuration information includes the signature information. The database access request sent by the first client to the server of the first database according to the access configuration information includes the signature information, and the database access request is used to request access to the first database. When the information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes the identity authentication.

[0192] In some embodiments, the service request includes service feature information, and the service feature information is used to indicate the service requirements of the first client; the device 400 further includes a service matching module, a second record data acquisition module and a first private key acquisition module (in Figure 4not shown).

[0193] A service matching module is used to determine the first database and the first account that match the service requirements of the first client according to the service feature information.

[0194] The second record data acquisition module is used to obtain second record data corresponding to the first database, where the second record data includes at least one account information, and each account information includes a set of corresponding account numbers and private keys.

[0195] The first private key acquisition module is configured to acquire the private key corresponding to the first account from the second record data to obtain the first private key.

[0196] In some embodiments, the account information also includes plug-in indication information, and the plug-in indication information is used to indicate an authentication plug-in, and the authentication plug-in is a plug-in supported by the first database for implementing identity authentication; the communication address signature module 430 is used to determine the signature method corresponding to the first authentication plug-in based on the first plug-in indication information included in the account information to which the first account and the first private key belong, wherein the first authentication plug-in is the authentication plug-in indicated by the first plug-in indication information; based on the signature method, the communication address of the first client is signed using the first private key to obtain the signature information.

[0197] In some embodiments, the device 400 further includes a key pair generation module, a first account information adding module, and a first record information sending module (in Figure 4 not shown).

[0198] A key pair generation module is used to generate a key pair corresponding to the first account, where the key pair includes a set of corresponding private keys and public keys, wherein the private key corresponding to the first account is the first private key, and the public key corresponding to the first account is the first public key.

[0199] The first account information adding module is configured to add the first account information to the second record data, where the first account information includes the first account and the first private key.

[0200] The first record information sending module is used to send first record information to the server of the first database, where the first record information includes the first account and the first public key.

[0201] In some embodiments, the service authentication module 420 is used to obtain signature authentication information included in the service request, wherein the signature authentication information is obtained by signing the authentication information corresponding to the first client using a second key; the signature authentication information is verified using the second key to obtain the verified authentication information; if the verified authentication information is valid, it is determined that the service request has passed the service authentication.

[0202] To sum up, the technical solution provided by the embodiment of the present application is to configure the server to receive a service request sent by the first client, perform service authentication on the service request, and verify the legitimacy of the service request. When the service request passes the service authentication, the first private key corresponding to the first database is used to sign the communication address of the first client to obtain signature information, and access configuration information carrying the signature information is sent to the first client, thereby filtering out clients from illegal sources through service authentication, dynamically creating a password for the communication address of each legitimate client, and improving the security of the database.

[0203] Please refer to Figure 5 , which shows a block diagram of an authentication device for database access provided by another embodiment of the present application. The device has the function of implementing the authentication method for database access described above, and the function can be implemented by hardware or by hardware executing corresponding software. The device can be the terminal device 10 described above, or it can be set in the terminal device 10. Figure 5 As shown, the apparatus 500 may include a service request sending module 510 , a configuration information receiving module 520 and an access request sending module 530 .

[0204] The service request sending module 510 is configured to send a service request to the configuration server, where the service request is used to instruct to initiate access to the first database.

[0205] The configuration information receiving module 520 is used to receive access configuration information sent by the configuration server, wherein the access configuration information includes signature information, wherein the access configuration information is sent when the service request passes service authentication, and the service authentication is used to verify the legitimacy of the information. The signature information is obtained by signing the communication address of the first client using the first private key corresponding to the first database.

[0206] An access request sending module 530 is configured to send a database access request to the server of the first database based on the access configuration information. The database access request is used to request access to the first database. The database access request includes the signature information. When the signature information is verified using the first public key corresponding to the first database, and the information obtained matches the communication address of the first client, the first client passes the identity authentication.

[0207] In some embodiments, the service request includes business feature information, which is used to indicate the business requirements of the first client. The first private key is a private key corresponding to the first account obtained from the second record data corresponding to the first database based on the business feature information. The second record data includes at least one account information, and each account information includes a set of corresponding account numbers and private keys.

[0208] In some embodiments, the database access request includes a first account, the first public key is a public key corresponding to the first account obtained from the first record data corresponding to the first database, the first record data includes at least one record information, and each record information includes a set of corresponding account numbers and public keys.

[0209] To sum up, the technical solution provided by the embodiment of the present application is that the first client sends a service request to the configuration server to request access to the first database, receives access configuration information sent by the configuration server, and sends a database access request to the first database server based on the access configuration information. The database access request is used to request access to the first database. The database access request includes signature information. When the signature information is verified using the first public key corresponding to the first database, and the information obtained matches the communication address of the first client, the first client passes identity authentication and obtains the access configuration information for accessing the first database from the configuration server. The first database is accessed with the access configuration information, and there is no need to save the account used to access the first database in the first client, which reduces the possibility of account leakage and improves the security of the database.

[0210] It should be noted that the apparatus provided in the above embodiments, when implementing its functions, is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0211] An identity authentication system for database access, the system comprising: a first client, a configuration server, and a server of a first database;

[0212] The first client is configured to send a service request to the configuration server, where the service request is used to instruct access to the first database;

[0213] The configuration server is used to perform service authentication on the service request, where the service authentication is used to verify the legitimacy of the service request;

[0214] When the service request passes the service authentication, the configuration server is further configured to use the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information;

[0215] The configuration server is further configured to send access configuration information to the first client, where the access configuration information includes the signature information;

[0216] The first client is further configured to send a database access request to a server of the first database according to the access configuration information, wherein the database access request is used to request access to the first database, and the database access request includes the signature information;

[0217] The server of the first database is configured to verify the signature information using a first public key corresponding to the first database;

[0218] In a case where the information obtained by signature verification matches the communication address of the first client, the server of the first database is further configured to determine that the first client passes identity authentication.

[0219] For other steps performed by the first client, the configuration server, and the server of the first database, please refer to the above embodiments and will not be described again here.

[0220] Please refer to Figure 6 , which shows a block diagram of a computer device 600 provided in one embodiment of the present application. The computer device 600 may be Figure 1 The terminal device 10 in the implementation environment shown can also be Figure 1 The server 20 in the implementation environment shown can also be Figure 1 The configuration server 30 in the illustrated implementation environment is used to implement the authentication method for database access provided in the above embodiment. Specifically:

[0221] Typically, the computer device 600 includes a processor 610 and a memory 620 .

[0222] The processor 610 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. The processor 610 may be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 610 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 610 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 610 may also include an AI processor for processing computing operations related to machine learning.

[0223] Memory 620 may include one or more computer-readable storage media, which may be non-transitory. Memory 620 may also include high-speed random access memory and non-volatile memory, such as one or more magnetic disk storage devices or flash memory storage devices. In some embodiments, the non-transitory computer-readable storage media in memory 620 is used to store a computer program, which is configured to be executed by one or more processors to implement the above-mentioned database access authentication method.

[0224] Those skilled in the art will understand that Figure 6 The structure shown in the figure does not constitute a limitation on the computer device 600, and the computer device 600 may include more or fewer components than shown in the figure, or combine some components, or adopt a different arrangement of components.

[0225] In an exemplary embodiment, a computer-readable storage medium is further provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the computer program implements the above-mentioned authentication method for database access. Optionally, the computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a solid-state drive (SSD), or an optical disk. Among them, the random access memory may include a resistance random access memory (ReRAM) and a dynamic random access memory (DRAM).

[0226] In an exemplary embodiment, a computer program product is also provided, comprising a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the aforementioned database access authentication method.

[0227] It should be noted that the collection and processing of relevant data (such as images, etc.) in this application should be strictly in accordance with the requirements of relevant national laws and regulations when applied in practice, and the informed consent or separate consent of the personal information subject should be obtained. Subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the personal information subject.

[0228] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application do not limit this.

[0229] The above description is merely an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A database access authentication method, characterized in that: The method comprises: receiving a database access request sent by a first client, the database access request being used to request access to a first database, the database access request including signature information, wherein the signature information is obtained by signing a communication address of the first client using a first private key corresponding to the first database; and if the service request sent by the first client passes service authentication, the configuration server sending access configuration information including the signature information to the first client, wherein the service authentication is used to verify the legitimacy of the service request; Verifying the signature using the first public key corresponding to the first database; If the information obtained by the signature verification matches the communication address of the first client, it is determined that the first client passes the identity authentication.

2. The method according to claim 1, characterized in that The database access request includes a first account; the method further includes: Obtaining first record data corresponding to the first database, where the first record data includes at least one piece of record information, and each piece of record information includes a set of corresponding account numbers and public keys; Obtain a public key corresponding to the first account from the first record data to obtain the first public key.

3. The method according to claim 2, characterized in that The record information further includes plug-in indication information, where the plug-in indication information is used to indicate an identity authentication plug-in, where the identity authentication plug-in is a plug-in supported by the first database and used to implement identity authentication; The verifying the signature information by using the first public key corresponding to the first database includes: Based on first plug-in indication information included in the record information to which the first account and the first public key belong, calling a first authentication plug-in, the first authentication plug-in being the authentication plug-in indicated by the first plug-in indication information; The signature information is verified using the first public key through the first identity authentication plug-in.

4. The method according to claim 3, characterized in that After verifying the signature information using the first public key through the first identity authentication plug-in, the method further includes: The first identity verification plug-in compares the information obtained by the signature verification with the communication address of the first client.

5. The method according to claim 2, characterized in that The method further comprises: Receive first record information sent by a configuration server, where the first record information includes the first account and the first public key; The first record information is added to the first record data.

6. A database access authentication method, characterized in that: The method comprises: receiving a service request sent by a first client, where the service request is used to instruct to initiate access to a first database; Performing service authentication on the service request, wherein the service authentication is used to verify the legitimacy of the service request; When the service request passes the service authentication, using the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information; Access configuration information is sent to the first client, where the access configuration information includes the signature information. A database access request sent by the first client to the server of the first database according to the access configuration information includes the signature information, and the database access request is used to request access to the first database. When information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes identity authentication.

7. The method according to claim 6, characterized in that The service request includes service feature information, where the service feature information is used to indicate the service requirements of the first client. The method further includes: Determining, based on the service feature information, the first database and the first account that match the service requirements of the first client; Obtaining second record data corresponding to the first database, where the second record data includes at least one piece of account information, and each piece of account information includes a set of corresponding account numbers and private keys; Obtain the private key corresponding to the first account from the second record data to obtain the first private key.

8. The method according to claim 7, characterized in that The account information further includes plug-in indication information, where the plug-in indication information is used to indicate an identity authentication plug-in, where the identity authentication plug-in is a plug-in supported by the first database and used to implement identity authentication; The step of using the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information includes: Determining, based on first plug-in indication information included in the account information to which the first account and the first private key belong, a signature method corresponding to a first identity authentication plug-in, wherein the first identity authentication plug-in is the identity authentication plug-in indicated by the first plug-in indication information; The communication address of the first client is signed using the first private key based on the signature method to obtain the signature information.

9. The method according to claim 7, characterized in that The method further comprises: Generate a key pair corresponding to the first account, the key pair including a set of corresponding private keys and public keys, wherein the private key corresponding to the first account is the first private key, and the public key corresponding to the first account is the first public key; Adding first account information to the second record data, where the first account information includes the first account and the first private key; Sending first record information to a server of the first database, where the first record information includes the first account and the first public key.

10. The method according to claim 6, characterized in that The performing service authentication on the service request includes: Obtaining signature authentication information included in the service request, wherein the signature authentication information is obtained by signing authentication information corresponding to the first client using a second key; Using the second key, verifying the signature authentication information to obtain verified authentication information; If the authentication information after the signature verification is valid, it is determined that the service request passes the service authentication.

11. A database access identity authentication method, characterized in that: The method comprises: Sending a service request to the configuration server, where the service request is used to instruct to initiate access to the first database; receiving access configuration information sent by the configuration server, the access configuration information including signature information, wherein the access configuration information is sent when the service request passes service authentication, the service authentication being used to verify the legitimacy of the service request, and the signature information being obtained by signing the communication address of the first client using the first private key corresponding to the first database; According to the access configuration information, a database access request is sent to the server of the first database, where the database access request is used to request access to the first database, and the database access request includes the signature information. When information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes identity authentication.

12. The method according to claim 11, characterized in that The service request includes business feature information, where the business feature information is used to indicate the business requirements of the first client. The first private key is a private key corresponding to the first account obtained from second record data corresponding to the first database based on the business feature information. The second record data includes at least one piece of account information, and each piece of account information includes a set of corresponding account numbers and private keys.

13. The method according to claim 11, characterized in that The database access request includes a first account number, the first public key is a public key corresponding to the first account number obtained from first record data corresponding to the first database, the first record data includes at least one record information, and each record information includes a set of corresponding account numbers and public keys.

14. A database access identity authentication method, characterized in that: The method comprises: The first client sends a service request to the configuration server, where the service request is used to instruct to initiate access to the first database; The configuration server performs service authentication on the service request, where the service authentication is used to verify the legitimacy of the service request; When the service request passes the service authentication, the configuration server uses the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information; The configuration server sends access configuration information to the first client, where the access configuration information includes the signature information; The first client sends a database access request to a server of the first database according to the access configuration information, wherein the database access request is used to request access to the first database and includes the signature information; The server of the first database verifies the signature information using the first public key corresponding to the first database; When the information obtained by the signature verification matches the communication address of the first client, the server of the first database determines that the first client passes the identity authentication.

15. An identity authentication device for database access, characterized in that: The device comprises: an access request receiving module, configured to receive a database access request sent by a first client, the database access request being used to request access to a first database, the database access request including signature information, wherein the signature information is obtained by signing the communication address of the first client using a first private key corresponding to the first database; if the service request sent by the first client passes service authentication, the configuration server sends access configuration information including the signature information to the first client, wherein the service authentication is used to verify the legitimacy of the service request; a signature information verification module, configured to verify the signature information using the first public key corresponding to the first database; The identity authentication module is used to determine that the first client passes the identity authentication when the information obtained by the signature verification matches the communication address of the first client.

16. An identity authentication device for database access, characterized in that: The device comprises: A service request receiving module, configured to receive a service request sent by a first client, wherein the service request is used to instruct to initiate access to a first database; A service authentication module, configured to perform service authentication on the service request, wherein the service authentication is used to verify the legitimacy of the service request; a communication address signing module, configured to, when the service request passes the service authentication, use the first private key corresponding to the first database to sign the communication address of the first client to obtain signature information; A configuration information sending module is used to send access configuration information to the first client, where the access configuration information includes the signature information, wherein the database access request sent by the first client to the server of the first database according to the access configuration information includes the signature information, and the database access request is used to request access to the first database; when the information obtained by verifying the signature information using the first public key corresponding to the first database matches the communication address of the first client, the first client passes the identity authentication.

17. An identity authentication device for database access, characterized in that: The device comprises: A service request sending module, configured to send a service request to the configuration server, wherein the service request is used to instruct to initiate access to the first database; a configuration information receiving module, configured to receive access configuration information sent by the configuration server, the access configuration information including signature information, wherein the access configuration information is sent when the service request passes service authentication, the service authentication being used to verify the legitimacy of the service request, and the signature information is obtained by signing the communication address of the first client using the first private key corresponding to the first database; An access request sending module is used to send a database access request to the server of the first database according to the access configuration information, wherein the database access request is used to request access to the first database, and the database access request includes the signature information. When the signature information is verified using the first public key corresponding to the first database, and the information obtained matches the communication address of the first client, the first client passes the identity authentication.

18. A computer device, characterized in that: The computer device includes a processor and a memory, wherein a computer program is stored in the memory, and the computer program is loaded and executed by the processor to implement the method according to any one of claims 1 to 5, or the method according to any one of claims 6 to 10, or the method according to any one of claims 11 to 13.

19. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which is used to be executed by a processor to implement the method according to any one of claims 1 to 5, or the method according to any one of claims 6 to 10, or the method according to any one of claims 11 to 13.

20. A computer program product, characterized in that The computer program product comprises a computer program, which is loaded and executed by a processor to implement the method according to any one of claims 1 to 5, or the method according to any one of claims 6 to 10, or the method according to any one of claims 11 to 13.

Images