Data processing method and device, electronic equipment and storage medium

Abstract

The invention provides a data processing method and device, electronic equipment and a storage medium. According to the application, for a scene in which the specific access subject requests to access the specific database, if the established bastion host container is available for the specific access subject to request to access the specific database, the established bastion host container is directly used to help the specific access subject to request to access the specific database; therefore, a new bastion host container can not be independently established for a specific access subject to request to access a specific database, for example, a new bastion host container can not be independently established for each specific database requested to access by the specific access subject, so that the establishment of excessive bastion host containers is avoided, and the access efficiency is improved. Therefore, system resources consumed for establishing the bastion host container can be saved, the maintenance workload for maintaining the bastion host container can be reduced, the maintenance cost for maintaining the bastion host container can be reduced, interaction between a specific access subject and excessive bastion host containers can be avoided, and the interaction burden is prevented from being increased.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, device, electronic device, and storage medium. Background Art

[0002] A bastion container is a comprehensive security architecture designed to protect databases from various internal and external threats. By integrating multiple security technologies and strategies, it builds a robust defense system around the database system, much like a solid fortress. Therefore, building a secure bastion container is crucial. Summary of the Invention

[0003] The present application provides a data processing method, device, electronic device, and storage medium.

[0004] In a first aspect, the present application provides a data processing method, which is applied to a bastion host container control system. The method includes:

[0005] receiving an access request from a specific access subject requesting access to a specific database among multiple databases;

[0006] In the established bastion host containers, find the specific bastion host container that has a communication connection with the specific database;

[0007] When a specific bastion host container is found, the specific database is accessed via the communication connection between the specific bastion host container and the specific database according to the access request;

[0008] or,

[0009] If the specific bastion host container is not found, a new bastion host container is established, a new communication connection is established between the new bastion host container and the specific database, and according to the access request, the specific database is accessed through the new communication connection between the new bastion host container and the specific database.

[0010] In an optional implementation, there are at least two specific databases; each established bastion host container has a communication connection with at least one database among the multiple databases;

[0011] Searching for a specific bastion host container that has a communication connection with a specific database in the established bastion host container includes:

[0012] In the established bastion host containers, search for candidate bastion host containers whose connected databases intersect with at least two specific databases.

[0013] Select a bastion host container from the latest found candidate bastion host containers;

[0014] Determine the remaining specific databases in the at least two specific databases except for the databases to which all selected result bastion host containers are respectively connected;

[0015] If the remaining specific database is not empty, search for an alternative bastion host container in the established bastion host container whose connected database has an intersection with the remaining specific database; return to the step of selecting a result bastion host container from the most recently found alternative bastion host container, and continue until the remaining specific database is empty, at which point the search for an alternative bastion host container ends;

[0016] Get a specific bastion host container based on all the selected result bastion host containers.

[0017] In an optional implementation, the number of the newly found candidate bastion host containers is more than two;

[0018] The step of selecting a result bastion host container from the most recently found candidate bastion host containers includes:

[0019] For any one of the at least two candidate bastion host containers found most recently, obtain the total idle amount of system resources of the candidate bastion host container, obtain the total number of idle communication connections between the candidate bastion host container and the database to which it is connected, obtain the total amount of system resources consumed by the candidate bastion host container to establish idle communication connections with the database to which it is connected, and obtain a comprehensive evaluation score for the candidate bastion host container based on the idle amount, the total number, and the total consumption.

[0020] The result bastion host container is obtained based on the candidate bastion host container with the highest comprehensive evaluation score among the at least two candidate bastion host containers found most recently.

[0021] In an optional implementation, the method further includes:

[0022] After receiving the access request, detecting whether the specific access subject has access rights to the specific database;

[0023] When the specific access subject has access rights to the specific database, the step of searching for a specific bastion host container having a communication connection with the specific database in the established bastion host container is performed.

[0024] In a second aspect, the present application provides a data processing device, which is applied to a bastion host container control system. The device includes:

[0025] A receiving module, configured to receive an access request from a specific access subject to access a specific database among the multiple databases;

[0026] A search module is used to search for a specific bastion host container that has a communication connection with a specific database in the established bastion host containers;

[0027] An access module is used to access a specific database via the communication connection between the specific bastion host container and the specific database according to the access request when a specific bastion host container is found;

[0028] or,

[0029] An establishment module is used to establish a new bastion host container when a specific bastion host container is not found, establish a new communication connection between the new bastion host container and the specific database, and access the specific database through the new communication connection between the new bastion host container and the specific database according to the access request.

[0030] In an optional implementation, there are at least two specific databases; each established bastion host container has a communication connection with at least one database among the multiple databases;

[0031] The search module includes:

[0032] A first search unit is configured to search, in the established bastion host containers, for a candidate bastion host container whose connected database has an intersection with at least two specific databases;

[0033] A selection unit is used to select a result bastion host container from the latest found candidate bastion host containers;

[0034] A determination unit is configured to determine, from the at least two specific databases, the remaining specific databases other than the databases to which all selected result bastion host containers are respectively connected;

[0035] The second search unit is configured to search, in the established bastion host container, for a candidate bastion host container whose connected database has an intersection with the remaining specific database when the remaining specific database is not empty; and return to the step of selecting a result bastion host container from the most recently found candidate bastion host container until the remaining specific database is empty, thereby terminating the search for the candidate bastion host container.

[0036] The acquisition unit is used to obtain a specific bastion host container based on all the selected result bastion host containers.

[0037] In an optional implementation, the number of the newly found candidate bastion host containers is more than two;

[0038] The selection unit includes:

[0039] A first acquisition subunit is configured to obtain, for any one of the at least two candidate bastion host containers found most recently, a total idle amount of system resources of the candidate bastion host container, a total number of idle communication connections between the candidate bastion host container and a database connected thereto, and a total amount of system resource consumption required by the candidate bastion host container to establish idle communication connections between the database connected thereto, and obtain a comprehensive evaluation score of the candidate bastion host container based on the idle amount, the total number, and the total consumption;

[0040] The second acquisition subunit is configured to acquire a result bastion host container according to a candidate bastion host container with the highest comprehensive evaluation score among the at least two candidate bastion host containers found most recently.

[0041] In an optional implementation, the apparatus further includes:

[0042] A detection module, configured to detect whether a specific access subject has access rights to a specific database after receiving the access request;

[0043] The search module is further configured to search for a specific bastion host container having a communication connection with the specific database in the established bastion host containers when the specific access subject has access rights to the specific database.

[0044] In a third aspect, the present application shows an electronic device, which includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method described in any of the above aspects.

[0045] In a fourth aspect, the present application shows a non-temporary computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method described in any of the above aspects.

[0046] In a fifth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method as described in any one of the above aspects.

[0047] The technical solution provided by this application may have the following beneficial effects:

[0048] In the present application, an access request from a specific access subject to access a specific database among multiple databases is received. A specific bastion host container that has a communication connection with the specific database is searched for in the established bastion host containers. If the specific bastion host container is found, the specific database is accessed based on the access request via the communication connection between the specific bastion host container and the specific database. If the specific bastion host container is not found, a new bastion host container is established, a new communication connection is established between the new bastion host container and the specific database, and the specific database is accessed based on the access request via the new communication connection between the new bastion host container and the specific database.

[0049] Through the present application, for the scenario where a specific access subject requests access to a specific database, if an established bastion host container is available for the specific access subject's request to access the specific database, the established bastion host container is directly used to help the specific access subject request access to the specific database. A new bastion host container does not need to be established separately for the specific access subject's request to access the specific database. For example, a new bastion host container does not need to be established separately for each specific database that the specific access subject requests to access, thereby avoiding the establishment of too many bastion host containers, thereby saving system resources required to establish bastion host containers, reducing the maintenance workload of maintaining bastion host containers, reducing the maintenance cost of maintaining bastion host containers, and avoiding the specific access subject from interacting with too many bastion host containers, thereby avoiding increasing the interaction burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a flowchart of the steps of a data processing method of the present application.

[0051] Figure 2 It is a flowchart of the steps of a data processing method of the present application.

[0052] Figure 3 It is a flowchart of the steps of a data processing method of the present application.

[0053] Figure 4 This is a scenario diagram of this application.

[0054] Figure 5 This is a structural block diagram of a data processing device of the present application.

[0055] Figure 6 This is a block diagram of an electronic device of the present application.

[0056] Figure 7 This is a block diagram of an electronic device of the present application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0058] Before introducing the technical solution of this application, the technical terms that may be involved in this application are first explained.

[0059] Bastion host container: The main responsibility of the bastion host container is to perform identity authentication, authorization, auditing and other management tasks for internal and external users of the enterprise to ensure enterprise information security. It can incorporate all internal and external users of the enterprise into the same management system, and grant users different resources and environments according to different security levels and permissions. It also supports auditing and monitoring functions, records and monitors the operational behaviors of internal and external users, and ensures business security and compliance.

[0060] Database connection pool: When the program starts, it establishes sufficient database connections and groups them into a connection pool. The program dynamically allocates connections from the pool for application, use, and release. Since creating and disconnecting database connections is a time-consuming operation and poses a security risk to the database, creating multiple connections during program initialization and centrally managing them for program use ensures faster data read and write speeds and improves system security and reliability.

[0061] Specifically, refer to Figure 1 , shows a flowchart of the steps of a data processing method of the present application, which is applied to a bastion host container control system. The bastion host container control system is at least used to create, delete, and modify bastion host containers, etc., and establish / release communication connections between bastion host containers and databases, etc., wherein the method includes:

[0062] In step S101 , an access request from a specific access subject to access a specific database among multiple databases is received.

[0063] An access subject includes a user or a user group. A specific access subject is a user or a user group. A user is a single user, while a user group includes multiple users. Multiple databases are different databases. A specific database is at least one database among the multiple databases.

[0064] The access request can be sent directly to the bastion host container control system in a point-to-point manner by the access subject.

[0065] Alternatively, the access request can be forwarded by the access subject to the bastion container control system via other middleware.

[0066] Each database has its own identifier, and different databases have different identifiers. The database identifier includes the database name or ID (Identity Document), which is used to uniquely identify the database.

[0067] The access request carries the identifier of a specific database.

[0068] In step S102 , a specific bastion host container that has a communication connection with a specific database is searched among the established bastion host containers.

[0069] In this application, a bastion host container is established in advance, and the established bastion host container can be one or more.

[0070] For any established bastion host container, at least one communication connection is established between the bastion host container and at least one database among the multiple databases. The communication connection may include a TCP (Transmission Control Protocol) connection or a UDP (User Datagram Protocol) connection, so that data can be exchanged between the bastion host container and the at least one database through the at least one communication connection between the two.

[0071] Because the access request carries the identifier of a specific database, any bastion host container records the identifier of the database with which it has a communication connection.

[0072] In this way, if the identifier of the database with which a communication connection is established is recorded in a bastion host container, including the identifier of a specific database, then the bastion host container is a bastion host container with which a communication connection is established.

[0073] There may be one or more bastion host containers that have a communication connection with a specific database.

[0074] For example, if there is only one bastion host container among the established bastion host containers that has a communication connection with a specific database, then this one bastion host container can be determined as the specific bastion host container. Or, for another example, if there are more than two bastion host containers that have a communication connection with a specific database, then one of the two or more bastion host containers can be selected as the specific bastion host container. For example, a bastion host container can be randomly selected from the two or more bastion host containers and used as the specific bastion host container, or a bastion host container can be selected from the two or more bastion host containers according to other specific rules and used as the specific bastion host container.

[0075] This step can be referred to later. Figure 2 The embodiment shown will not be described in detail here.

[0076] When a specific bastion host container is found, in step S103 , the specific database is accessed according to the access request via the communication connection between the specific bastion host container and the specific database.

[0077] The access response information can then be returned to the specific access subject.

[0078] If there is an idle communication connection between a specific bastion host container and a specific database, the specific database can be accessed via the idle communication connection according to an access request.

[0079] Alternatively, if there is no idle communication connection between the specific bastion host container and the specific database, a new communication connection between the specific bastion host container and the specific database is established, that is, an idle communication connection, and the specific database can be accessed through the new communication connection according to the access request.

[0080] If the specific bastion host container is not found, in step S104, a new bastion host container is established, a new communication connection is established between the new bastion host container and the specific database, and the specific database is accessed through the new communication connection between the new bastion host container and the specific database according to the access request.

[0081] The access response information can then be returned to the specific access subject.

[0082] A new communication connection established between a bastion host container and a specific database is an idle communication connection.

[0083] In the present application, an access request from a specific access subject to access a specific database among multiple databases is received. A specific bastion host container that has a communication connection with the specific database is searched for in the established bastion host containers. If the specific bastion host container is found, the specific database is accessed based on the access request via the communication connection between the specific bastion host container and the specific database. If the specific bastion host container is not found, a new bastion host container is established, a new communication connection is established between the new bastion host container and the specific database, and the specific database is accessed based on the access request via the new communication connection between the new bastion host container and the specific database.

[0084] Through the present application, for the scenario where a specific access subject requests access to a specific database, if an established bastion host container is available for the specific access subject's request to access the specific database, the established bastion host container is directly used to help the specific access subject request access to the specific database. A new bastion host container does not need to be established separately for the specific access subject's request to access the specific database. For example, a new bastion host container does not need to be established separately for each specific database that the specific access subject requests to access, thereby avoiding the establishment of too many bastion host containers, thereby saving system resources required to establish bastion host containers, reducing the maintenance workload of maintaining bastion host containers, reducing the maintenance cost of maintaining bastion host containers, and avoiding the specific access subject from interacting with too many bastion host containers, thereby avoiding increasing the interaction burden.

[0085] In one embodiment of the present application, there are at least two specific databases. Each established bastion host container has a communication connection with at least one database in the multiple databases.

[0086] So, see Figure 2 , step S102 includes:

[0087] In step S201 , a candidate bastion host container is searched for in the established bastion host containers, whose connected databases have an intersection with at least two specific databases.

[0088] In this application, multiple bastion host containers have been established.

[0089] For example, the at least two specific databases are database a, database b, and database c.

[0090] If the databases connected to a bastion host container include database c, database d, and database e, then database c is the intersection of at least two specific databases and the databases connected to the bastion host container. The bastion host container can be a candidate bastion host container.

[0091] In step S202, a result bastion host container is selected from the most recently found candidate bastion host containers.

[0092] The most recently found candidate bastion host container may be the candidate bastion host container found in step S201, or the most recently found candidate bastion host container may be "a candidate bastion host container found in the established bastion host containers, whose connected database has an intersection with the remaining specific databases" in step S204.

[0093] In one embodiment, if the most recently found candidate bastion host container is one, then this candidate bastion host container is determined as the result bastion host container.

[0094] Alternatively, in another embodiment, if there are more than two candidate bastion host containers found recently, one candidate bastion host container is selected from the two or more candidate bastion host containers and used as a result bastion host container. For example, one candidate bastion host container is randomly selected from the two or more candidate bastion host containers and used as a result bastion host container, or one candidate bastion host container is selected from the two or more candidate bastion host containers according to a specific rule and used as a result bastion host container. The specific selection process can be found in the following example. Figure 3 The embodiment shown will not be described in detail here.

[0095] In step S203, among the at least two specific databases, the remaining specific databases other than the databases to which all the selected result bastion host containers are respectively connected are determined.

[0096] For example, at least two specific databases are database a, database b, and database c. The database connected to the most recently selected bastion host container is database a, and the remaining specific databases are database b and database c.

[0097] When the remaining specific database is empty (ie, there is no remaining specific database), step S205 is directly executed.

[0098] Alternatively, when the remaining specific database is not empty, step S204 is executed.

[0099] If the remaining specific databases are not empty, in step S204, in the established bastion host container, search for an alternative bastion host container whose connected database has an intersection with the remaining specific databases, and then return to step S202: select a result bastion host container from the most recently found alternative bastion host container, until the remaining specific databases are empty, then end the search for alternative bastion host containers, and then execute step S205.

[0100] In step S205, a specific bastion host container is obtained based on all the selected result bastion host containers.

[0101] For example, all selected result bastion host containers are determined to be specific bastion host containers.

[0102] In another embodiment of the present application, the number of newly found candidate bastion host containers is more than two. Figure 3 , step S202 includes:

[0103] In step S301, for any one of the at least two candidate bastion host containers found most recently, obtain the total idle amount of system resources of the candidate bastion host container, obtain the total number of idle communication connections between the candidate bastion host container and the database connected to it, obtain the total amount of system resources consumed by the candidate bastion host container to create idle communication connections between the database connected to it, and obtain a comprehensive evaluation score of the candidate bastion host container based on the total idle amount, total number, and total consumption.

[0104] The above operation is performed similarly for each of the other candidate bastion host containers in the at least two candidate bastion host containers found most recently, thereby obtaining a comprehensive evaluation score for each candidate bastion host container.

[0105] In one embodiment of the present application, when obtaining the total idle amount of system resources of the candidate bastion host container, the idle amount of each type of system resources among multiple different types of system resources in the candidate bastion host container can be obtained.

[0106] The total amount of free system resources in the candidate bastion host container is then determined based on the free amounts of each type of system resource in the candidate bastion host container. For example, the free amounts of each type of system resource in the candidate bastion host container are weighted and summed to obtain the total amount of free system resources in the candidate bastion host container.

[0107] Each type of system resource has a weight coefficient. The weight coefficient of each type of system resource can be set in advance by technical personnel based on actual conditions. This application does not limit the specific value of the weight coefficient of each type of system resource.

[0108] The total amount of idle system resources of the candidate bastion host container can be obtained by weighting and summing the idle amounts of various types of system resources in the candidate bastion host container using the weight coefficients of the various types of system resources in the candidate bastion host container.

[0109] In one example, various types of system resources in a bastion host container include: CPU (Central Processing Unit) resources, memory resources, network resources, and disk resources.

[0110] The idle capacity of various types of system resources in the bastion host container includes idle CPU resources, idle memory resources, idle network resources, and idle disk resources.

[0111] CPU resources have weight coefficients, memory resources have weight coefficients, network resources have weight coefficients, and disk resources have weight coefficients.

[0112] For example, the weight coefficient of CPU resources may be 0.3, the weight coefficient of memory resources may be 0.3, the weight coefficient of network resources may be 0.2, and the weight coefficient of disk resources may be 0.2.

[0113] In another embodiment of the present application, when obtaining the total number of idle communication connections between the candidate bastion host container and the database connected to it, the number of idle communication connections between the candidate bastion host container and each of the multiple databases connected to it can be obtained.

[0114] Then, based on the number of idle communication connections between the candidate bastion host container and each of its connected databases, the total number of idle communication connections between the candidate bastion host container and its connected databases is determined. For example, the total number of idle communication connections between the candidate bastion host container and its connected databases can be obtained by taking a weighted sum of the number of idle communication connections between the candidate bastion host container and each of its connected databases.

[0115] For example, if the alternative bastion host container is connected to database a, database b, database c, and database d, then obtain the number of idle communication connections between the alternative bastion host container and database a, obtain the number of idle communication connections between the alternative bastion host container and database b, obtain the number of idle communication connections between the alternative bastion host container and database c, and obtain the number of idle communication connections between the alternative bastion host container and database d.

[0116] Each database has a weight coefficient. The weight coefficient of each database can be set in advance by technical personnel based on actual conditions. This application does not limit the specific value of the weight coefficient of each database.

[0117] For example, the weight coefficient of database a may be 0.3, the weight coefficient of database b may be 0.2, the weight coefficient of database c may be 0.4, the weight coefficient of database d may be 0.1, and so on.

[0118] For each database connected to the candidate bastion host container, the database has a weight coefficient. This weight coefficient can be used as the weight coefficient for the number of idle communication connections between the candidate bastion host container and the database. The same applies to each other database connected to the candidate bastion host container.

[0119] The total number of idle communication connections between the candidate bastion host container and the databases it is connected to can be obtained by weighting the number of idle communication connections between the candidate bastion host container and each database it is connected to by taking the weighted sum of the number of idle communication connections between the candidate bastion host container and each database it is connected to.

[0120] Alternatively, in another embodiment of the present application, when obtaining the total number of idle communication connections between the alternative bastion host container and the database connected to it, for the intersection between the database connected to the alternative bastion host container and at least two specific databases, the number of idle communication connections between the alternative bastion host container and each specific database in the intersection is obtained.

[0121] Then, based on the number of idle communication connections between the candidate bastion host container and each specific database in the intersection, the total number of idle communication connections between the candidate bastion host container and the databases connected to it is determined.

[0122] For example, a weighted sum of the numbers of idle communication connections between the candidate bastion host container and each specific database in the intersection is performed to obtain the total number of idle communication connections between the candidate bastion host container and the databases connected to it.

[0123] For example, if the intersection of the database connected to the candidate bastion host container and at least two specific databases includes database a, database b, and database c, then the number of idle communication connections between the candidate bastion host container and database a, the number of idle communication connections between the candidate bastion host container and database b, and the number of idle communication connections between the candidate bastion host container and database c are obtained.

[0124] Each database has a weight coefficient. The weight coefficient of each database can be set in advance by technical personnel based on actual conditions. This application does not limit the specific value of the weight coefficient of each database.

[0125] For example, the weight coefficient of database a may be 0.3, the weight coefficient of database b may be 0.3, the weight coefficient of database c may be 0.4, and so on.

[0126] For any specific database in the intersection of the database connected to the candidate bastion host container and at least two specific databases, the specific database has a weight coefficient. This weight coefficient can be used as the weight coefficient for the number of idle communication connections between the candidate bastion host container and the specific database. The same applies to each other specific database in the intersection of the database connected to the candidate bastion host container and at least two specific databases.

[0127] The total number of idle communication connections between the candidate bastion host container and the databases connected to it can be obtained by weighting the number of idle communication connections between the candidate bastion host container and each specific database in the intersection and taking the weighted sum of the number of idle communication connections between the candidate bastion host container and each specific database in the intersection.

[0128] In another embodiment of the present application, when obtaining the total amount of system resources consumed by the candidate bastion host container to create idle communication connections between the database connected to the candidate bastion host container and at least two specific databases, a determination is made as to whether the number of idle communication connections between the candidate bastion host container and each specific database in the intersection is less than a value of 0. Among the specific databases in the intersection, a specific database is determined whose number of idle communication connections with the candidate bastion host container is less than a value of 0.

[0129] The total number of idle communication connections between the candidate bastion host container and the databases connected to it is determined based on the number of specific databases whose number is less than the value 0. For example, the total number of idle communication connections between the candidate bastion host container and the databases connected to it is determined based on the number of specific databases whose number is less than the value 0.

[0130] In another embodiment of the present application, when obtaining the comprehensive evaluation score of the alternative bastion host container based on the total idle amount, total amount, and total consumption, the sum of the total idle amount, total amount, and total consumption can be calculated and used as the comprehensive evaluation score of the alternative bastion host container.

[0131] In step S302, a result bastion host container is obtained based on the candidate bastion host container with the highest comprehensive evaluation score among the at least two candidate bastion host containers found most recently.

[0132] For example, the candidate bastion host container with the highest comprehensive evaluation score is determined as the result bastion host container.

[0133] In another embodiment of the present application, after receiving the access request, it may be detected whether the specific access subject has access rights to the specific database.

[0134] If the specific access subject has access rights to the specific database, step S102 is performed again: searching for a specific bastion host container that has a communication connection with the specific database in the established bastion host containers.

[0135] Alternatively, when the specific access subject does not have access rights to the specific database, feedback information is returned to the specific access subject, where the feedback information is used to indicate that the specific access subject does not have access rights to the specific database.

[0136] In one example, the specific access subject includes a specific user. Thus, when detecting whether the specific access subject has access rights to a specific database, the database identifier corresponding to the specific user's identifier can be searched for in the correspondence between the user's identifier and the identifier of the database to which the user has access rights. If the found database identifier includes the identifier of the specific database, it is determined that the specific user has access rights to the specific database. Alternatively, if the found database identifier does not include the identifier of the specific database, it is determined that the specific user does not have access rights to the specific database.

[0137] The correspondence between the user's identifier and the identifier of the database to which the user has access rights is set in advance, and each corresponding table item in the correspondence between the user's identifier and the identifier of the database to which the user has access rights is also set in advance.

[0138] According to actual needs, operations such as adding, deleting or modifying corresponding entries in the correspondence between the user's identification and the identification of the database to which the user has access rights can be performed.

[0139] In an example, the correspondence between the user ID and the ID of the database to which the user has access rights may be shown in the following table:

[0140]

[0141] Alternatively, in another example, the specific access subject includes a specific user group, which includes multiple users. Thus, when detecting whether the specific access subject has access rights to a specific database, the database identifier corresponding to the specific user group identifier can be searched for in the correspondence between the identifier of the user group and the identifier of the database to which the user group has access rights. If the found database identifier includes the identifier of the specific database, it is determined that the specific user group has access rights to the specific database. Alternatively, if the found database identifier does not include the identifier of the specific database, it is determined that the specific user group does not have access rights to the specific database.

[0142] The correspondence between the user group identifier and the identifier of the database to which the user group has access rights is set in advance, and each corresponding table item in the correspondence between the user group identifier and the identifier of the database to which the user group has access rights is also set in advance.

[0143] According to actual needs, operations such as adding, deleting, or modifying corresponding entries in the correspondence between the identifiers of the user groups and the identifiers of the databases to which the user groups have access permissions may be performed.

[0144] For example, when a new user group is added, a bastion host container is established, a correspondence is established between the user group's identifier and the identifier of the database to which the user group has access permissions, the identifier of the database to which the user group has access permissions is determined, and a communication connection is established between the bastion host container and each database to which the user group has access permissions.

[0145] For example, when a new R&D group 3 is created, this user group has access to databases such as [MySQL 3], [PG3], and [Oracle2]. A bastion host container is established, and a communication connection is established between the bastion host container and the [MySQL 3] database, a communication connection is established between the bastion host container and the [PG3] database, and a communication connection is established between the bastion host container and the [Oracle2] database.

[0146] When the user group is deleted, the communication connections between the bastion host container and each database to which the user group has access permissions are released, and then the bastion host container is deleted.

[0147] When a database to which the user group has access permissions needs to be modified, the communication connection between the bastion host container and the database to which the user group no longer has access permissions is released, and a communication connection between the bastion host container and the database to which the user group has newly access permissions is established.

[0148] The corresponding relationship between the ID of the user group and the ID of the database to which the user group has access permissions can be shown in the following table:

[0149]

[0150] In one embodiment of the present application, there are at least two specific databases.

[0151] In this way, when detecting whether a specific access subject has access rights to a specific database, it may be detected separately whether the specific access subject has access rights to each of the at least two specific databases.

[0152] Accordingly, when the specific access subject does not have access rights to a second specific database among the at least two specific databases, feedback information is returned to the specific access subject, where the feedback information indicates that the specific access subject does not have access rights to the second specific database. The second specific database is at least one specific database among the at least two specific databases.

[0153] In another embodiment of the present application, there are at least two specific databases. The specific access subject has access rights to a first specific database among the at least two specific databases. The first specific database is different from the second specific database.

[0154] Thus, in step S102, when searching for a specific bastion host container having a communication connection with a specific database in the established bastion host containers, the specific bastion host container having a communication connection with the first specific database can be searched for in the established bastion host containers.

[0155] Accordingly, there are at least two specific databases. The specific access subject has access rights to a first specific database among the at least two specific databases. Thus, in step S104, when establishing a new communication connection between the new bastion host container and the specific database, a communication connection between the new bastion host container and the first specific database can be established.

[0156] In another embodiment of the present application, the access request is sent by the access subject to the proxy server and forwarded by the proxy server to the bastion host container control system. The proxy server is located on the logical link between the bastion host container control system and the access subject.

[0157] Alternatively, the access request is sent directly point-to-point by the access subject to the bastion container control system, and a proxy server is subsequently established on the logical link between the bastion container and the access subject.

[0158] The proxy server serves as a medium for interaction between the access subject and the bastion host container. A proxy server is created when the communication connection requested by the access request needs to interact with multiple bastion host containers.

[0159] For example, see Figure 4 Bastion host container C1 is connected to databases M1, M2, and O1. Bastion host container C2 is connected to databases M2 and O2. Bastion host container C3 is connected to databases P1, P2, and O2.

[0160] A specific access subject requests access to databases M1, M2, and O2.

[0161] Through the aforementioned embodiment, the selected specific bastion server containers include bastion server container C1 and bastion server container C3.

[0162] Create a proxy server on the logical link between the bastion host container C1 and the bastion host container C3 and a specific user.

[0163] The proxy server then receives a request from a specific access subject to access a specific database within the multiple databases. It searches the established bastion host containers for a specific bastion host container with a communication connection to the specific database and forwards the request to that bastion host container. This simplifies operations for each access subject by allowing them to focus solely on the interaction (details, etc.) with the proxy server and not on the interactions with individual bastion host containers.

[0164] In the scheme of the present application, it is possible to dynamically create and maintain a bastion host container based on the binary information consisting of user group information and database information, or based on the binary information consisting of user information and database information, and determine whether the user has the authority to access the database based on the database to which the user applies to access. Based on factors such as the usage of the system resources of the bastion host container, the status of the communication connection between the bastion host container and the database, and the system resource overhead of establishing the communication connection between the bastion host container and the database, an established suitable bastion host container or a new bastion host container is selected to strictly control the user's access rights.

[0165] By dynamically creating and maintaining bastion host containers through binary information consisting of user information and database information, it is possible to avoid grouping every user, reduce the number of groups, reduce the workload of group maintenance, and reduce the maintenance cost of groups.

[0166] Secondly, this application can create a proxy server (Proxy) on the selected bastion host container or on the logical link between the newly created bastion host container and the access subject, and shield the user's database connection details through the proxy server (Proxy).

[0167] In addition, this application can automatically identify sensitive information based on the returned results and perform desensitization operations, thereby strengthening the authentication capabilities and security audits of personnel when maintaining and operating sensitive data, and improving security.

[0168] It should be noted that for the method embodiments, for simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions involved are not necessarily required by this application.

[0169] Reference Figure 5 , shows a data processing device of the present application, applied to a bastion host container control system, the device comprising:

[0170] The receiving module 11 is configured to receive an access request from a specific access subject to access a specific database among multiple databases;

[0171] A search module 12 is configured to search for a specific bastion host container that has a communication connection with a specific database in the established bastion host containers;

[0172] Access module 13 is used to access the specific database via the communication connection between the specific bastion host container and the specific database according to the access request when the specific bastion host container is found;

[0173] or,

[0174] Establishing module 14 is used to establish a new bastion host container when the specific bastion host container is not found, establish a new communication connection between the new bastion host container and the specific database, and access the specific database through the new communication connection between the new bastion host container and the specific database according to the access request.

[0175] In an optional implementation, there are at least two specific databases; each established bastion host container has a communication connection with at least one database among the multiple databases;

[0176] The search module includes:

[0177] A first search unit is configured to search, in the established bastion host containers, for a candidate bastion host container whose connected database has an intersection with at least two specific databases;

[0178] A selection unit is used to select a result bastion host container from the latest found candidate bastion host containers;

[0179] A determination unit is configured to determine, from the at least two specific databases, the remaining specific databases other than the databases to which all selected result bastion host containers are respectively connected;

[0180] The second search unit is configured to search, in the established bastion host container, for a candidate bastion host container whose connected database has an intersection with the remaining specific database when the remaining specific database is not empty; and return to the step of selecting a result bastion host container from the most recently found candidate bastion host container until the remaining specific database is empty, thereby terminating the search for the candidate bastion host container.

[0181] The acquisition unit is used to obtain a specific bastion host container based on all the selected result bastion host containers.

[0182] In an optional implementation, the number of the newly found candidate bastion host containers is more than two;

[0183] The selection unit includes:

[0184] A first acquisition subunit is configured to obtain, for any one of the at least two candidate bastion host containers found most recently, a total idle amount of system resources of the candidate bastion host container, a total number of idle communication connections between the candidate bastion host container and a database connected thereto, and a total amount of system resource consumption required by the candidate bastion host container to establish idle communication connections with the database connected thereto; and obtain a comprehensive evaluation score for the candidate bastion host container based on the idle amount, the total number, and the total consumption.

[0185] The second acquisition subunit is configured to acquire a result bastion host container according to a candidate bastion host container with the highest comprehensive evaluation score among the at least two candidate bastion host containers found most recently.

[0186] In an optional implementation, the apparatus further includes:

[0187] A detection module, configured to detect whether a specific access subject has access rights to a specific database after receiving the access request;

[0188] The search module is further configured to search for a specific bastion host container having a communication connection with the specific database in the established bastion host containers when the specific access subject has access rights to the specific database.

[0189] In the present application, an access request from a specific access subject to access a specific database among multiple databases is received. A specific bastion host container that has a communication connection with the specific database is searched for in the established bastion host containers. If the specific bastion host container is found, the specific database is accessed based on the access request via the communication connection between the specific bastion host container and the specific database. If the specific bastion host container is not found, a new bastion host container is established, a new communication connection is established between the new bastion host container and the specific database, and the specific database is accessed based on the access request via the new communication connection between the new bastion host container and the specific database.

[0190] Through the present application, for the scenario where a specific access subject requests access to a specific database, if an established bastion host container is available for the specific access subject's request to access the specific database, the established bastion host container is directly used to help the specific access subject request access to the specific database. A new bastion host container does not need to be established separately for the specific access subject's request to access the specific database. For example, a new bastion host container does not need to be established separately for each specific database that the specific access subject requests to access, thereby avoiding the establishment of too many bastion host containers, thereby saving system resources required to establish bastion host containers, reducing the maintenance workload of maintaining bastion host containers, reducing the maintenance cost of maintaining bastion host containers, and avoiding the specific access subject from interacting with too many bastion host containers, thereby avoiding increasing the interaction burden.

[0191] Optionally, an embodiment of the present application also provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and runnable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0192] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the various processes of the above-described method embodiments are implemented and the same technical effects are achieved. To avoid repetition, the details are not described here. The computer-readable storage medium may be, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0193] Figure 6 8 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0194] Reference Figure 6 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0195] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operation, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 802 may include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.

[0196] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0197] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0198] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor can not only sense the boundaries of the touch or slide action, but also monitor the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0199] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), which is configured to receive external audio signals when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0200] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as a keyboard, click wheel, buttons, etc. These buttons may include but are not limited to: a home button, volume buttons, a start button, and a lock button.

[0201] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can monitor the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800. The sensor assembly 814 can also monitor the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of user contact with the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to monitor the presence of nearby objects without any physical contact. The sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0202] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, an operator network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0203] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0204] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by the processor 820 of the electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0205] Figure 7 1 is a block diagram of an electronic device 1900 shown in the present application. For example, the electronic device 1900 can be provided as a server.

[0206] Reference Figure 7 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described method.

[0207] The electronic device 1900 may further include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0208] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0209] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0210] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

[0211] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of this application can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0212] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0213] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0214] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0215] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0216] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0217] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A data processing method, characterized in that: The method comprises: receiving an access request from a specific access subject requesting access to a specific database among multiple databases; In the established bastion host containers, find the specific bastion host container that has a communication connection with the specific database; When a specific bastion host container is found, the specific database is accessed via the communication connection between the specific bastion host container and the specific database according to the access request; or, If the specific bastion host container is not found, a new bastion host container is established, a new communication connection is established between the new bastion host container and the specific database, and according to the access request, the specific database is accessed through the new communication connection between the new bastion host container and the specific database.

2. The method according to claim 1, characterized in that There are at least two specific databases; each established bastion host container has a communication connection with at least one database among the multiple databases; Searching for a specific bastion host container that has a communication connection with a specific database in the established bastion host container includes: In the established bastion host containers, search for candidate bastion host containers whose connected databases intersect with at least two specific databases. Select a bastion host container from the latest found candidate bastion host containers; Determine the remaining specific databases in the at least two specific databases except for the databases to which all selected result bastion host containers are respectively connected; If the remaining specific database is not empty, search for an alternative bastion host container in the established bastion host container whose connected database has an intersection with the remaining specific database; return to the step of selecting a result bastion host container from the most recently found alternative bastion host container, and continue until the remaining specific database is empty, at which point the search for an alternative bastion host container ends; Get a specific bastion host container based on all the selected result bastion host containers.

3. The method according to claim 2, characterized in that There are two or more newly found candidate bastion host containers; The step of selecting a result bastion host container from the most recently found candidate bastion host containers includes: For any one of the at least two candidate bastion host containers found most recently, obtain the total idle amount of system resources of the candidate bastion host container, obtain the total number of idle communication connections between the candidate bastion host container and the database to which it is connected, obtain the total amount of system resources consumed by the candidate bastion host container to establish idle communication connections with the database to which it is connected, and obtain a comprehensive evaluation score for the candidate bastion host container based on the idle amount, the total number, and the total consumption. The result bastion host container is obtained based on the candidate bastion host container with the highest comprehensive evaluation score among the at least two candidate bastion host containers found most recently.

4. The method according to claim 1, wherein The method further comprises: After receiving the access request, detecting whether the specific access subject has access rights to the specific database; When the specific access subject has access rights to the specific database, the step of searching for a specific bastion host container having a communication connection with the specific database in the established bastion host container is performed.

5. A data processing device, characterized in that: The device comprises: A receiving module, configured to receive an access request from a specific access subject to access a specific database among the multiple databases; A search module is used to search for a specific bastion host container that has a communication connection with a specific database in the established bastion host containers; An access module is used to access a specific database via the communication connection between the specific bastion host container and the specific database according to the access request when a specific bastion host container is found; or, An establishment module is used to establish a new bastion host container when a specific bastion host container is not found, establish a new communication connection between the new bastion host container and the specific database, and access the specific database through the new communication connection between the new bastion host container and the specific database according to the access request.

6. The device according to claim 5, characterized in that There are at least two specific databases; each established bastion host container has a communication connection with at least one database among the multiple databases; The search module includes: A first search unit is configured to search, in the established bastion host containers, for a candidate bastion host container whose connected database has an intersection with at least two specific databases; A selection unit is used to select a result bastion host container from the latest found candidate bastion host containers; A determination unit is configured to determine, from the at least two specific databases, the remaining specific databases other than the databases to which all selected result bastion host containers are respectively connected; The second search unit is configured to search, in the established bastion host container, for a candidate bastion host container whose connected database has an intersection with the remaining specific database when the remaining specific database is not empty; and return to the step of selecting a result bastion host container from the most recently found candidate bastion host container until the remaining specific database is empty, thereby terminating the search for the candidate bastion host container. The acquisition unit is used to obtain a specific bastion host container based on all the selected result bastion host containers.

7. The device according to claim 6, characterized in that There are two or more newly found candidate bastion host containers; The selection unit includes: A first acquisition subunit is configured to obtain, for any one of the at least two candidate bastion host containers found most recently, a total idle amount of system resources of the candidate bastion host container, a total number of idle communication connections between the candidate bastion host container and a database connected thereto, and a total amount of system resource consumption required by the candidate bastion host container to establish idle communication connections between the database connected thereto, and obtain a comprehensive evaluation score of the candidate bastion host container based on the idle amount, the total number, and the total consumption; The second acquisition subunit is configured to acquire a result bastion host container according to a candidate bastion host container with the highest comprehensive evaluation score among the at least two candidate bastion host containers found most recently.

8. The device according to claim 5, characterized in that The device further comprises: A detection module, configured to detect whether a specific access subject has access rights to a specific database after receiving the access request; The search module is further configured to search for a specific bastion host container having a communication connection with the specific database in the established bastion host containers when the specific access subject has access rights to the specific database.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 1 to 4 when executed by the processor.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which implements the method according to any one of claims 1 to 4 when executed by a processor.

Images