Redis authority management method and system
Through the combination of configuration, proxy and verification modules, the problem of insufficient granularity in Redis permission control is solved, and refined management of IP, port and key is achieved, which improves system security and manageability. It is applicable to various Redis versions.
Patent Information
- Application Number
- CN202410307625.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-18
- Publication Date
- 2025-09-26
AI Technical Summary
The permission control of previous Redis versions lacks fine-grained permission control at the client IP, port, and key levels, resulting in insufficient security and manageability.
Provided is a Redis permission management method and system. Through the configuration module, the permissions of IP, port and Redis Key are pre-set. The proxy module parses and verifies the client request. The verification module performs permission verification. The execution module forwards the request and returns the result, thus realizing fine-grained permission control of Redis.
It implements fine-grained permission control over specific IPs, ports, and keys, improving system security and management controllability without requiring changes to client code, reducing system upgrade costs and complexity, and ensuring compatibility with legacy systems.
Smart Images
Figure CN120705852A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of database security technology, and in particular to a Redis authority management method and system. Background Art
[0002] Redis is a high-performance, open-source in-memory database widely used for key-value storage, providing fast read and write operations for distributed systems and web applications. Prior to Redis 6.0, permission control relied primarily on a basic password authentication mechanism, which restricted access to the entire database but lacked granular permission control at the client IP and port level, or at the key level. With the introduction of Redis 6.0 and subsequent versions, the Access Control List (ACL) feature empowers users with more powerful permission management capabilities, allowing the definition and management of users and roles, and the detailed configuration of execution permissions for different commands. This addresses previous deficiencies in fine-grained permission control and improves system security and manageability.
[0003] Prior to Redis 6.0, basic password authentication was primarily used to restrict access to the entire database. However, this approach lacked fine-grained permission control at the client IP and port level, as well as at the key level. This approach presented certain limitations and could potentially lead to security and permission management issues.
[0004] Although Redis 6.0 and its subsequent versions introduced the ACL feature to fill these deficiencies, many older systems still use versions prior to Redis 6.0, which means these systems still face challenges in permission control. Summary of the Invention
[0005] To overcome the above problems, the purpose of the present invention is to provide a Redis permission management method and system, which can improve the permission management capabilities of the old version of Redis database and enhance the security and manageability of the database.
[0006] The present invention is implemented by the following scheme: a Redis rights management method, the method comprising the following steps:
[0007] Step S1: Provide an administrator interface for pre-configuring the permission configuration information allowed for access, and add corresponding permission configuration according to the IP, port, and Redis Key;
[0008] Step S2: After the client requests a connection, the request is received and parsed, converted into a Redis command, and the parsed client IP and port and the Redis command are passed for permission verification;
[0009] Step S3: Obtain permission configuration information, perform permission verification based on the received Redis command and the client's IP and port, combined with the configuration information, and return the permission verification result to ensure that further request processing can be performed based on the verification result;
[0010] Step S4: After receiving the result of successful authority verification, the client's request is forwarded to the Redis server. The Redis server executes the corresponding command and forwards the execution result to the client.
[0011] Furthermore, step S1 also includes read and write control at the Redis Key level: the administrator interface allows the administrator to specify read and write operation permissions for a specified Key, ensuring that only authorized users can perform corresponding operations.
[0012] Furthermore, the permission configuration information includes the read and write permissions of IP, port and Redis Key.
[0013] Furthermore, the "passing the parsed client IP and port and Redis command for permission verification" is further: by comparing the currently obtained IP, port and Redis command with the pre-configured permission configuration information, if the permission is passed, the request is forwarded to the actual Redis server, and the response result of the Redis server is forwarded to the client; if the permission is insufficient, the corresponding permission error code is sent and a clear error message is provided.
[0014] Furthermore, the “receiving and parsing the request and converting it into a Redis command” is further as follows: receiving a bit stream request sent by the client, converting the bit stream into a string, and converting the parsed string into a Redis command by matching.
[0015] A Redis rights management system, comprising a configuration module, a proxy module, a verification module, and an execution module;
[0016] The configuration module provides an administrator interface for pre-configuring the permission configuration information allowed to access, and adds corresponding permission configuration according to IP, port and Redis Key;
[0017] The proxy module: after the client requests a connection, it receives and parses the request, converts it into a Redis command, and passes the client IP and port obtained by parsing and the Redis command for permission verification;
[0018] The verification module obtains permission configuration information, performs permission verification based on the received Redis command and the client's IP and port in combination with the configuration information, and returns the result of the permission verification to ensure that further request processing can be performed based on the verification result;
[0019] The execution module: after receiving the result of successful permission verification, forwards the client's request to the Redis server, and the Redis server executes the corresponding command and forwards the execution result to the client.
[0020] Furthermore, the configuration module also includes read and write control at the Redis Key level: the administrator interface allows the administrator to specify the read and write operation permissions for the specified Key, ensuring that only authorized users can perform corresponding operations.
[0021] Furthermore, the permission configuration information includes the read and write permissions of IP, port and Redis Key.
[0022] Furthermore, the "passing the parsed client IP and port and Redis command for permission verification" is further: by comparing the currently obtained IP, port and Redis command with the pre-configured permission configuration information, if the permission is passed, the request is forwarded to the actual Redis server, and the response result of the Redis server is forwarded to the client; if the permission is insufficient, the corresponding permission error code is sent and a clear error message is provided.
[0023] Furthermore, the “receiving and parsing the request and converting it into a Redis command” is further as follows: receiving a bit stream request sent by the client, converting the bit stream into a string, and converting the parsed string into a Redis command by matching.
[0024] The beneficial effects of the present invention are: by adding permission configuration information, administrators can implement fine-grained permission control for read and write operations of specific IPs, ports, and Redis Keys, providing a more flexible and personalized permission management method. The proxy module and the verification module effectively prevent unauthorized access and improve the security of the system. While enhancing Redis permissions, the present invention does not need to modify the client's Redis driver code, and enhances Redis permissions through the deployment of the proxy module. This seamless integration method reduces the cost and complexity of system upgrades. Through fine-grained permission control, administrators can manage and monitor access to Redis more flexibly, improving the overall management controllability of the system. At the same time, the present invention is compatible with the use of old systems before Redis 6.0, ensuring effective management of permissions for these versions. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] Figure 1 It is a schematic flow chart of the method of the present invention.
[0026] Figure 2 It is a system principle block diagram of the present invention. DETAILED DESCRIPTION
[0027] The present invention will be further described below with reference to the accompanying drawings.
[0028] See also Figure 1 As shown, a Redis rights management method of the present invention comprises the following steps:
[0029] Step S1: Provide an administrator interface for pre-configuring the permission configuration information allowed for access, and add corresponding permission configuration according to the IP, port, and Redis Key;
[0030] Step S2: After the client requests a connection, the request is received and parsed, converted into a Redis command, and the parsed client IP and port and the Redis command are passed for permission verification;
[0031] Step S3: Obtain permission configuration information, perform permission verification based on the received Redis command and the client's IP and port, combined with the configuration information, and return the permission verification result to ensure that further request processing can be performed based on the verification result;
[0032] Step S4: After receiving the result of successful authority verification, the client's request is forwarded to the Redis server. The Redis server executes the corresponding command and forwards the execution result to the client.
[0033] The present invention will be further described below with reference to a specific embodiment:
[0034] A Redis permission management method,
[0035] 1. Provide an administrator interface for pre-configuring the access permission configuration information, and add corresponding permission configuration according to IP, port and Redis Key;
[0036] 1.1 also includes read and write control at the Redis Key level: the administrator interface allows administrators to specify read and write permissions for specified keys, ensuring that only authorized users can perform corresponding operations.
[0037] 1.2 Permission configuration information includes IP, port, and Redis Key read and write permissions.
[0038] 2. After the client requests a connection, it receives and parses the request, converts it into a Redis command, and passes the parsed client IP and port and the Redis command for permission verification.
[0039] 2.1 "Passing the parsed client IP and port, along with the Redis command, for permission verification" further includes the following: The currently obtained IP, port, and Redis command are compared with the pre-configured permission configuration information. If permission is granted, the request is forwarded to the actual Redis server, and the Redis server's response is forwarded to the client. If permission is insufficient, the corresponding permission error code is sent, providing a clear error message. If only the IP and its corresponding permission are specified, only the IP is verified; if the corresponding permissions for the IP and port are specified, both the IP and port are verified.
[0040] 2.2 “Receive and parse the request and convert it into a Redis command” further includes: receiving a bit stream request sent by the client, converting the bit stream into a string, and converting the parsed string into a Redis command through matching.
[0041] 3. Obtain permission configuration information, perform permission verification based on the received Redis command, the client's IP and port, and the configuration information, and return the permission verification result to ensure that further request processing can be performed based on the verification result.
[0042] 4. After receiving the result of successful permission verification, the client's request is forwarded to the Redis server. The Redis server executes the corresponding command and forwards the execution result to the client.
[0043] See also Figure 2 As shown, the present invention also provides a Redis rights management system, which includes a configuration module, a proxy module and a verification module;
[0044] The configuration module provides an administrator interface for pre-configuring the permission configuration information allowed to access, and adds corresponding permission configuration according to IP, port and Redis Key;
[0045] The configuration module also includes read and write control at the Redis Key level: the administrator interface allows administrators to specify read and write operation permissions for specified keys, ensuring that only authorized users can perform corresponding operations.
[0046] Permission configuration information includes IP, port, and Redis Key read and write permissions.
[0047] The proxy module: after the client requests a connection, it receives and parses the request, converts it into a Redis command, and passes the client IP and port obtained by parsing and the Redis command for permission verification.
[0048] "Passing the parsed client IP and port, along with the Redis command, for permission verification" is further described as follows: The currently obtained IP, port, and Redis command are compared with the pre-configured permission configuration information. If permission is granted, the request is forwarded to the actual Redis server, and the Redis server's response is forwarded to the client. If permission is insufficient, the corresponding permission error code is sent, providing clear error information. If only the IP and its corresponding permission are specified, the verification module will only verify the IP. If the configuration module specifies corresponding permissions for the IP and port, the verification module will verify both the IP and port.
[0049] "Receiving and parsing the request and converting it into a Redis command" is further as follows: receiving a bit stream request sent by the client, converting the bit stream into a string, and converting the parsed string into a Redis command through matching.
[0050] The verification module obtains permission configuration information, performs permission verification based on the received Redis command and the client's IP and port in combination with the configuration information, and returns the result of the permission verification to ensure that further request processing can be performed based on the verification result.
[0051] The execution module: after receiving the result of successful permission verification, forwards the client's request to the Redis server, and the Redis server executes the corresponding command and forwards the execution result to the client.
[0052] For example, the following two examples demonstrate the ability of the present invention to finely control Redis permissions.
[0053] 1. Control access to IP (positive example)
[0054] (1) The administrator configures the module to allow IP addresses in the range 192.168.1.1-192.168.1.10 to access all keys of the Redis server.
[0055] (2) The client connects to the proxy module and sends the Redis command GET exampleKey. The proxy module passes the client's IP, port, and Redis command to the verification module.
[0056] (3) The verification module obtains the IP address range configuration information from the configuration module, verifies that the client IP address 192.168.1.5 is within the allowed access range, and returns the result of permission approval to the proxy module.
[0057] (4) After receiving the successful permission verification result from the verification module, the proxy module forwards the client's request GETexampleKey to the Redis server. The Redis server executes the corresponding command and returns the execution result to the proxy module. Finally, the proxy module returns the execution result to the client, achieving precise control over IP access.
[0058] 2. Control access to keys (counterexample)
[0059] (1) The administrator did not specify the access control policy for a specific key in the configuration module.
[0060] (2) When the client connects to the proxy module and sends the Redis command GET exampleKey, the proxy module passes the client's IP, port, and Redis command to the verification module.
[0061] (3) The verification module fails to detect the specific control policy for the key in the configuration module, resulting in permission verification failure. In this case, the verification module returns the result of insufficient permission to the proxy module. After receiving the permission verification failure result from the verification module, the corresponding permission error code is sent to the client, providing clear error information. The client cannot access the sensitive key due to insufficient permission, ensuring data security.
[0062] In short, by configuring specific permission configuration information that allows access, administrators can implement fine-grained permission control for specific IP address ranges, specific port ranges, and read and write operations of specific keys, providing a more flexible and personalized permission management method. The proxy module and the verification module effectively prevent unauthorized access and improve the security of the system. While enhancing Redis permissions, the present invention does not need to modify the client's Redis driver code, and enhances Redis permissions through the deployment of the proxy module. This seamless integration method reduces the cost and complexity of system upgrades. Through detailed permission control, administrators can manage and monitor access to Redis more flexibly, improving the overall management controllability of the system. At the same time, the present invention is compatible with the use of old systems before Redis 6.0, ensuring effective management of permissions for these versions.
[0063] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made according to the scope of the patent application of the present invention should fall within the scope of the present invention.
Claims
1. A Redis rights management method, characterized in that: The method comprises the following steps: Step S1: Provide an administrator interface for pre-configuring the permission configuration information allowed for access, and add corresponding permission configuration according to the IP, port, and Redis Key; Step S2: After the client requests a connection, the request is received and parsed, converted into a Redis command, and the parsed client IP and port and the Redis command are passed for permission verification; Step S3: Obtain permission configuration information, perform permission verification based on the received Redis command and the client's IP and port, combined with the configuration information, and return the permission verification result to ensure that further request processing can be performed based on the verification result; Step S4: After receiving the result of successful authority verification, the client's request is forwarded to the Redis server. The Redis server executes the corresponding command and forwards the execution result to the client.
2. A Redis rights management method according to claim 1, characterized in that: The step S1 also includes read and write control at the Redis Key level: the administrator interface allows the administrator to specify the read and write operation permissions for the specified Key, ensuring that only authorized users can perform corresponding operations.
3. A Redis rights management method according to claim 1, characterized in that: The permission configuration information includes the read and write permissions of IP, port and Redis Key.
4. A Redis rights management method according to claim 1, characterized in that: The "passing the parsed client IP and port and Redis command for permission verification" is further: by comparing the currently obtained IP, port and Redis command with the pre-configured permission configuration information, if the permission is passed, forwarding the request to the actual Redis server, and forwarding the response result of the Redis server to the client; If the permission is insufficient, the corresponding permission error code will be sent and a clear error message will be provided.
5. A Redis rights management method according to claim 1, characterized in that: The "receiving and parsing the request and converting it into a Redis command" further includes: receiving a bit stream request sent by the client, converting the bit stream into a string, and converting the parsed string into a Redis command by matching.
6. A Redis rights management system, characterized by: The system includes a configuration module, an agent module, a verification module and an execution module; The configuration module provides an administrator interface for pre-configuring the permission configuration information allowed to access, and adds corresponding permission configuration according to IP, port and Redis Key; The proxy module: after the client requests a connection, it receives and parses the request, converts it into a Redis command, and passes the client IP and port obtained by parsing and the Redis command for permission verification; The verification module obtains permission configuration information, performs permission verification based on the received Redis command and the client's IP and port in combination with the configuration information, and returns the result of the permission verification to ensure that further request processing can be performed based on the verification result; The execution module: after receiving the result of successful permission verification, forwards the client's request to the Redis server, and the Redis server executes the corresponding command and forwards the execution result to the client.
7. A Redis rights management system according to claim 6, characterized in that: The configuration module also includes read and write control at the Redis Key level: the administrator interface allows the administrator to specify the read and write operation permissions for the specified Key, ensuring that only authorized users can perform the corresponding operations.
8. A Redis rights management system according to claim 6, characterized in that: The permission configuration information includes the read and write permissions of IP, port and Redis Key.
9. A Redis rights management system according to claim 6, characterized in that:
4. The "passing the parsed client IP and port and Redis command for permission verification" further includes: comparing the currently obtained IP, port, and Redis command with the pre-configured permission configuration information. If the permission is granted, the request is forwarded to the actual Redis server, and the response result of the Redis server is forwarded to the client; If the permission is insufficient, the corresponding permission error code will be sent and a clear error message will be provided.
10. A Redis rights management system according to claim 6, characterized in that: The "receiving and parsing the request and converting it into a Redis command" further includes: receiving a bit stream request sent by the client, converting the bit stream into a string, and converting the parsed string into a Redis command by matching.