Database access method based on middleware system and middleware system

Abstract

The embodiment of the invention relates to a database access method based on a middleware system and the middleware system. Initialization is firstly executed through data middleware, a database connection request of a service application is analyzed, a target database instance is determined, and an associated application end token is obtained. And the middleware requests a target database connection credential from the configuration center, and the configuration center sends an encryption credential after verifying the token. The middleware decrypts the credential, initiates connection establishment of the target database, encapsulates the target database into a data source after successful connection, and returns the data source to the business application; and the business application indirectly accesses the target database through an interface or an identifier provided by the datastore middleware. On the premise that database connection credentials are not directly exposed, the connection between the service application and the database is safely established.

Description

Technical Field

[0001] This invention relates to the field of information technology, and more specifically to a database access method, electronic device, computer-readable storage medium, and middleware system based on a middleware system. Background Technology

[0002] In the internet industry where microservice architecture is widely used, efficient and secure interaction between server-side programs and MySQL databases faces significant challenges. Traditional solutions require each service to hard-encode or configure database connection credentials (such as usernames and passwords) in plaintext in local configuration files, directly connecting to the MySQL database through program code, which poses a risk of sensitive information leakage. Summary of the Invention

[0003] To address the aforementioned technical issues, this invention provides a database access method and middleware system based on a middleware system. Through the datastore middleware and datastore configuration center, it securely establishes a connection between business applications and the database without directly exposing database connection credentials.

[0004] In a first aspect, embodiments of the present invention provide a database access method based on a middleware system. The middleware system includes a datastore middleware and a datastore configuration center, and the method includes:

[0005] The datastore middleware performs initialization;

[0006] The datastore middleware parses the database connection request of the business application, determines the target database instance corresponding to the database connection request, and obtains the application token configured in the business application and associated with the target database instance; the application token contains identity credentials for accessing the target database instance and access control information.

[0007] The datastore middleware sends a request to the datastore configuration center to obtain the target database connection credentials, and the request includes the application token.

[0008] The datastore configuration center performs validity verification and permission checks on the application token. If both validity verification and permission checks pass, the encrypted target database connection credentials are sent to the datastore middleware.

[0009] The datastore middleware converts the encrypted target database connection credentials into plaintext target database connection credentials, and uses the plaintext target database connection credentials to initiate a connection request to the target database.

[0010] After the datastore middleware successfully establishes a connection with the target database, it encapsulates the target database as a data source and returns it to the business application.

[0011] Business applications access the target database indirectly through interfaces or identifiers provided by the datastore middleware.

[0012] In one implementation, the datastore configuration center performs validity verification and permission checks on the application-side token, including:

[0013] Verify the validity of the application token's format and check if the application token is within its validity period;

[0014] Verify whether the identity information of the business application is within the allowed access service range for the target database instance bound to the application token, and confirm whether the business application has the permission to use the application token to obtain the target database connection credentials.

[0015] In one implementation, the datastore middleware converts the encrypted target database connection credentials into plaintext target database connection credentials, and uses the plaintext target database connection credentials to initiate a connection request to the target database, including:

[0016] The datastore middleware uses a key to convert encrypted target database connection credentials into plaintext target database connection credentials, and checks the integrity and format validity of the plaintext target database connection credentials.

[0017] After the datastore middleware passes the integrity and format validity checks of the plaintext target database connection credentials, it initiates a connection request to the target database using the plaintext target database connection credentials. After successfully establishing a connection with the target database, it verifies the availability of the connection.

[0018] In one implementation, the datastore middleware performs initialization, including:

[0019] The datastore middleware sends a request to the datastore configuration center to obtain the configuration file, which contains a list of tokens for the database instances that the business application needs to use.

[0020] The datastore middleware receives the configuration file returned by the datastore configuration center and sends an initialization request to the datastore configuration center to obtain the database configuration; the initialization request contains tokens from the token list;

[0021] The datastore middleware receives the encrypted database configuration returned by the datastore configuration center, converts the encrypted database configuration into plaintext database configuration, and checks the integrity and format validity of the plaintext database configuration.

[0022] After the datastore middleware passes the integrity and format validity checks of the plaintext database configuration, it initiates a connection request to the database using the plaintext database configuration, creates a database connection pool, and verifies the availability of each connection.

[0023] The datastore middleware sends an initialization completion notification to the business application.

[0024] Secondly, embodiments of the present invention provide a middleware system, the middleware system including a datastore middleware and a datastore configuration center;

[0025] The datastore middleware includes:

[0026] The initialization module is configured to perform initialization.

[0027] The parsing module is configured to parse database connection requests from business applications, determine the target database instance corresponding to the database connection request, and obtain an application token configured in the business application and associated with the target database instance; the application token contains identity credentials for accessing the target database instance and access control information.

[0028] The credential acquisition module is configured to send a target database connection credential acquisition request to the datastore configuration center, wherein the target database connection credential acquisition request includes the application token.

[0029] The connection module is configured to convert encrypted target database connection credentials into plaintext target database connection credentials and use the plaintext target database connection credentials to initiate a connection request to the target database.

[0030] The encapsulation module is configured to encapsulate the target database as a data source and return it to the business application after the datastore middleware successfully establishes a connection with the target database.

[0031] The datastore configuration center includes:

[0032] The verification module is configured to perform validity verification and permission checks on the application token. If both validity verification and permission checks pass, the encrypted target database connection credentials are sent to the datastore middleware.

[0033] In one implementation, the verification module includes:

[0034] The validity verification submodule is configured to verify the validity of the application token format and check whether the application token is within its validity period.

[0035] The permission verification submodule is configured to verify whether the identity information of the business application is within the allowed access service range for the target database instance bound to the application token, and to confirm whether the business application has the permission to use the application token to obtain the target database connection credentials.

[0036] In one embodiment, the connection module includes:

[0037] The connection credential decryption submodule is configured to convert the encrypted target database connection credential into a plaintext target database connection credential using a key, and to check the integrity and format validity of the plaintext target database connection credential.

[0038] The connection establishment submodule is configured to initiate a connection request to the target database using the plaintext target database connection credentials after the integrity and format validity checks of the plaintext target database connection credentials have passed, and to verify the availability of the connection after successfully establishing a connection with the target database.

[0039] In one implementation, the initialization module includes:

[0040] The configuration file request submodule is configured to send a request to the datastore configuration center to obtain a configuration file, which contains a list of tokens for the database instances that the business application needs to use.

[0041] The initialization request submodule is configured to receive the configuration file returned by the datastore configuration center and send an initialization request to the datastore configuration center to obtain the database configuration; the initialization request contains tokens from the token list;

[0042] The configuration decryption submodule is configured to receive encrypted database configuration returned by the datastore configuration center, convert the encrypted database configuration into plaintext database configuration, and check the integrity and format validity of the plaintext database configuration.

[0043] The database connection submodule is configured to initiate a connection request to the database using the plaintext database configuration after the integrity and format validity checks of the plaintext database configuration have passed, create a database connection pool, and verify the availability of each connection.

[0044] The notification submodule is configured to send an initialization completion notification to the business application.

[0045] Thirdly, the present invention provides an electronic device, the electronic device comprising:

[0046] At least one processor; and

[0047] A memory communicatively connected to the at least one processor; wherein,

[0048] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the database access method based on the middleware system described above.

[0049] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions that cause a processor to execute the above-described middleware system-based database access method.

[0050] In this embodiment of the invention, initialization is performed through a datastore middleware. The datastore middleware parses the database connection request from the business application, determines the target database instance corresponding to the database connection request, and obtains the application token configured in the business application and associated with the target database instance. The datastore middleware initiates a request to the datastore configuration center to obtain the target database connection credential. The datastore configuration center performs validity verification and permission verification on the application token. If both validity verification and permission verification pass, it sends the encrypted target database connection credential to the datastore middleware. The datastore middleware converts the encrypted target database connection credential into a plaintext target database connection credential and uses the plaintext target database connection credential to initiate a connection request to the target database. After successfully establishing a connection with the target database, the datastore middleware encapsulates the established target database as a data source and returns it to the business application. The business application indirectly accesses the target database through the interface or identifier provided by the datastore middleware. This achieves secure connection establishment between the business application and the database without directly exposing the database connection credential. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1This is a flowchart of a database access method based on a middleware system provided in Embodiment 1 of the present invention;

[0053] Figure 2 This is a schematic diagram of the structure of a middleware system provided in Embodiment 2 of the present invention;

[0054] Figure 3 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0055] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0056] Figure 1 This is a flowchart illustrating a database access method based on a middleware system according to Embodiment 1 of the present invention. The middleware system includes a datastore middleware and a datastore configuration center, such as... Figure 1 As shown, this embodiment may include the following steps:

[0057] Step 101: The datastore middleware performs initialization.

[0058] The datastore middleware performs initialization, aiming to build a stable, secure, and efficient interaction bridge between business applications and the database, laying a solid foundation for the smooth operation of subsequent business operations.

[0059] In one implementation, the datastore middleware can be deployed integratedly, such as by embedding it as a dependency package into a business application, sharing the same process with the business application. The datastore middleware is activated each time the business application starts, triggering the initialization process.

[0060] Step 102: The datastore middleware parses the database connection request of the business application, determines the target database instance corresponding to the database connection request, and obtains the application token configured in the business application and associated with the target database instance; the application token contains identity credentials for accessing the target database instance and access control information.

[0061] Database connection requests from business applications implicitly specify "which database instance to access," such as the order database or the user database. By parsing the database connection requests from business applications, the target database instance corresponding to the request can be determined.

[0062] After determining the target database instance corresponding to the request, an application token strongly associated with the target database instance is obtained. This application token can be configured in the configuration file of the business application. The application token is not only the identity credential of the target database instance, but also carries access control information for the target database instance, such as the range of accessible database instances (e.g., specifying a cluster or a single instance), the types of services allowed to be associated (e.g., order services, user services, etc.), and operation boundaries (e.g., read-only, read-write, etc.).

[0063] The application token can be generated synchronously after the database administrator (DBA) completes the creation of the database instance, which can be a MySQL database.

[0064] Step 103: The datastore middleware sends a request to the datastore configuration center to obtain the target database connection credentials, which includes the application token.

[0065] In this step, the datastore middleware sends a request to the datastore configuration center to obtain the target database connection credentials, carrying the application-side token, such as by sending a request to the datastore configuration center via the HTTP protocol.

[0066] The datastore configuration center can record the mapping relationship between each application-side token and a specific database instance, as well as the connection credentials and access permissions corresponding to that instance. For example, in a read-write separated MySQL cluster, one token is used to access the master instance, and another token is used to access the slave instance. The configuration center will record the instance address, username, password, and other connection information corresponding to these two tokens, as well as the operations allowed to be performed by each (read and write are allowed on the master instance, and read is allowed only on the slave instance).

[0067] Step 104: The datastore configuration center performs validity verification and permission check on the application token. If both validity verification and permission check pass, the encrypted target database connection credentials are sent to the datastore middleware.

[0068] In this step, after receiving the target database connection credential acquisition request from the datastore middleware, the datastore configuration center performs dual verification of the application token's validity and permissions.

[0069] 1) Validity verification: Verify the validity of the application token format and check whether the application token is within its validity period.

[0070] 2) Permission verification: Verify whether the identity information of the business application (such as service name and IP) is within the allowed access service range for the target database instance bound to the application token, and confirm whether the business application has the permission to use the application token to obtain the target database connection credentials.

[0071] After both the legality verification and permission check are passed, the datastore configuration center encrypts the target database connection credentials (including sensitive metadata such as database connection address, account password, sharding rules, etc.) (e.g., using AES symmetric encryption or asymmetric encryption algorithm), and then returns the ciphertext, i.e. the encrypted target database connection credentials, to the datastore middleware.

[0072] Step 105: The datastore middleware converts the encrypted target database connection credentials into plaintext target database connection credentials, and uses the plaintext target database connection credentials to initiate a connection request to the target database.

[0073] In this step, after receiving the encrypted target database connection credentials, the datastore middleware decrypts the ciphertext using a pre-agreed key to restore the original target database connection credentials, i.e., the plaintext target database connection credentials. Then, it checks the integrity (e.g., whether required fields exist) and format validity (e.g., IP address validity, port range appropriateness) of the plaintext target database connection credentials. After the integrity and format validity checks of the plaintext target database connection credentials pass, it initiates a connection request to the target database using the plaintext target database connection credentials. After successfully establishing a connection with the target database, if a "connection created successfully" response is received from the database, the availability of the connection is verified, such as by executing a simple verification SQL (e.g., querying the database version). The success of the returned result confirms that: the network link is working properly, the account permissions are valid, and the database instance is in a normal service state.

[0074] Step 106: After the datastore middleware successfully establishes a connection with the target database, it encapsulates the target database as a data source and returns it to the business application.

[0075] In this step, after the datastore middleware successfully establishes a connection with the target database, the datastore middleware, based on the connection and pre-loaded database configuration (such as connection pool parameters, routing rules, permission policies, etc.), encapsulates a data source that includes capabilities such as connection management, SQL routing, and read / write separation, and returns a unified access interface (or identifier) ​​to the business application that can operate on the data source.

[0076] Step 107: Business applications indirectly access the target database through interfaces or identifiers provided by the datastore middleware.

[0077] Since the datastore middleware has already encapsulated a data source with capabilities such as connection management, SQL routing, and read / write separation based on the connection and pre-loaded database configuration (such as connection pool parameters, routing rules, and permission policies), business applications can indirectly perform query and write operations on the target database through the unified access interface or identifier of the data source.

[0078] In one implementation, step 101 includes the following sub-steps:

[0079] In sub-step 1011, the datastore middleware sends a request to the datastore configuration center to obtain the configuration file, which contains a list of tokens for the database instances that the business application needs to use.

[0080] Once the datastore middleware is activated, it can send a request to the datastore configuration center via the HTTP protocol, explicitly specifying the configuration file containing the list of tokens for the database instances that the business application needs to obtain, such as the datastore.yaml configuration file.

[0081] In sub-step 1012, the datastore middleware receives the configuration file returned by the datastore configuration center and sends an initialization request to the datastore configuration center to obtain the database configuration; the initialization request includes tokens from the token list.

[0082] After receiving the configuration file, the datastore middleware parses it and extracts the list of tokens it contains, such as mysql_datastoresampledb_generic_01. Each token in the list serves as a unique identifier for the database and does not contain sensitive information. The datastore middleware then filters the list to select the target token that matches the database to be initialized and sends an initialization request to the datastore configuration center. This request can be sent via HTTP, with the target token included in the request header or body. The initialization request also explicitly specifies the database configuration to be obtained (encrypted connection credentials, instance-level routing rules, permission policies, etc.).

[0083] In sub-step 1013, the datastore middleware receives the encrypted database configuration returned by the datastore configuration center, converts the encrypted database configuration into plaintext database configuration, and checks the integrity and format validity of the plaintext database configuration.

[0084] After receiving the initialization request, the datastore configuration center encrypts the database configuration (such as using AES symmetric encryption or asymmetric encryption algorithms), and then returns the ciphertext, i.e. the encrypted database configuration, to the datastore middleware.

[0085] After receiving the encrypted database configuration, the datastore middleware decrypts the ciphertext using a pre-agreed key to restore the original database configuration, i.e., the plaintext database configuration. It then checks the integrity and format validity of the plaintext database configuration, confirming that the configuration has not been tampered with and that key fields are complete and valid, ultimately ensuring the integrity and security of the plaintext database configuration.

[0086] In sub-step 1014, after the datastore middleware passes the integrity and format validity checks of the plaintext database configuration, it initiates a connection request to the database using the plaintext database configuration, creates a database connection pool, and verifies the availability of each connection.

[0087] After the integrity and format validity checks of the plaintext database configuration pass, the datastore middleware initiates a connection request to the database using the plaintext database configuration. After successfully establishing a connection with the database, if a "connection created successfully" response is received from the database, the availability of the connection is verified. For example, a simple verification SQL (such as SELECT 1) is executed, and the success of the returned result confirms that the network link is working properly and the TCP connection has been stably established.

[0088] Sub-step 1015: The datastore middleware sends an initialization completion notification to the business application.

[0089] This embodiment performs initialization through the datastore middleware. The datastore middleware parses the database connection request from the business application, determines the target database instance corresponding to the database connection request, and obtains the application token configured in the business application and associated with the target database instance. The datastore middleware initiates a request to the datastore configuration center to obtain the target database connection credential. The datastore configuration center performs validity verification and permission checks on the application token. If both validity verification and permission checks pass, it sends the encrypted target database connection credential to the datastore middleware. The datastore middleware converts the encrypted target database connection credential into a plaintext target database connection credential and uses the plaintext target database connection credential to initiate a connection request to the target database. After successfully establishing a connection with the target database, the datastore middleware encapsulates the established target database as a data source and returns it to the business application. The business application indirectly accesses the target database through the interface or identifier provided by the datastore middleware. This achieves secure connection establishment between the business application and the database without directly exposing the database connection credential.

[0090] Figure 2 This is a schematic diagram of the structure of a middleware system provided in Embodiment 2 of the present invention. Figure 2 As shown, the middleware system includes a datastore middleware 20 and a datastore configuration center 21.

[0091] The datastore middleware 20 includes:

[0092] Initialization module 201 is configured to perform initialization.

[0093] The parsing module 202 is configured to parse the database connection request of the business application, determine the target database instance corresponding to the database connection request, and obtain the application token configured in the business application and associated with the target database instance; the application token contains identity credentials for accessing the target database instance and access control information.

[0094] The credential acquisition module 203 is configured to initiate a target database connection credential acquisition request to the datastore configuration center, wherein the target database connection credential acquisition request includes the application token.

[0095] Connection module 204 is configured to convert encrypted target database connection credentials into plaintext target database connection credentials and use the plaintext target database connection credentials to initiate a connection request to the target database.

[0096] Encapsulation module 205 is configured to encapsulate the target database as a data source and return it to the business application after the datastore middleware successfully establishes a connection with the target database.

[0097] The datastore configuration center 21 includes:

[0098] The verification module 211 is configured to perform validity verification and permission check on the application token. If both validity verification and permission check pass, the encrypted target database connection credentials are sent to the datastore middleware.

[0099] In one embodiment, the verification module 211 includes:

[0100] The validity verification submodule is configured to verify the validity of the application token format and check whether the application token is within its validity period.

[0101] The permission verification submodule is configured to verify whether the identity information of the business application is within the allowed access service range for the target database instance bound to the application token, and to confirm whether the business application has the permission to use the application token to obtain the target database connection credentials.

[0102] In one embodiment, the connection module 204 includes:

[0103] The connection credential decryption submodule is configured to convert encrypted target database connection credentials into plaintext target database connection credentials using a key, and to check the integrity and format validity of the plaintext target database connection credentials.

[0104] The connection establishment submodule is configured to initiate a connection request to the target database using the plaintext target database connection credentials after the integrity and format validity checks of the plaintext target database connection credentials have passed, and to verify the availability of the connection after successfully establishing a connection with the target database.

[0105] In one embodiment, the initialization module 201 includes:

[0106] The configuration file request submodule is configured to send a request to the datastore configuration center to obtain a configuration file, which contains a list of tokens for the database instances that the business application needs to use.

[0107] The initialization request submodule is configured to receive the configuration file returned by the datastore configuration center and send an initialization request to the datastore configuration center to obtain the database configuration; the initialization request contains tokens from the token list.

[0108] The configuration decryption submodule is configured to receive encrypted database configurations returned by the datastore configuration center, convert the encrypted database configurations into plaintext database configurations, and check the integrity and format validity of the plaintext database configurations.

[0109] The database connection submodule is configured to initiate a connection request to the database using the plaintext database configuration after the integrity and format validity checks of the plaintext database configuration have passed, create a database connection pool, and verify the availability of each connection.

[0110] The notification submodule is configured to send an initialization completion notification to the business application.

[0111] Figure 3 A schematic diagram of an electronic device 30 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0112] like Figure 3 As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory (ROM) 32 or a random access memory (RAM) 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the ROM 32 or loaded from storage unit 38 into the RAM 33. The RAM 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, ROM 32, and RAM 33 are interconnected via a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0113] Multiple components in electronic device 30 are connected to I / O interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0114] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 31 performs the various methods and processes described above, such as database access methods based on middleware systems.

[0115] In some embodiments, the middleware-based database access method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 30 via ROM 32 and / or communication unit 39. When the computer program is loaded into RAM 33 and executed by processor 31, one or more steps of the middleware-based database access method described above can be performed. Alternatively, in other embodiments, processor 31 can be configured to perform the middleware-based database access method by any other suitable means (e.g., by means of firmware).

[0116] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0117] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0118] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0119] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0120] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0121] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0122] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0123] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A database access method based on a middleware system, characterized by, The middleware system comprises datastore middleware and a datastore configuration center, and the method comprises: The datastore middleware performs initialization; The datastore middleware parses a database connection request of a business application, determines a target database instance corresponding to the database connection request, and acquires an application-side token configured in the business application and associated with the target database instance; the application-side token comprises identity credentials and permission control information for accessing the target database instance; The datastore middleware initiates a target database connection credential acquisition request to the datastore configuration center, wherein the target database connection credential acquisition request comprises the application-side token; The datastore configuration center performs legal verification and permission check on the application-side token, and if the legal verification and the permission check are both passed, sends encrypted target database connection credentials to the datastore middleware; The datastore middleware converts the encrypted target database connection credentials into plaintext target database connection credentials, and initiates a connection request to the target database by using the plaintext target database connection credentials; After the datastore middleware and the target database successfully establish a connection, the datastore middleware encapsulates the connected target database as a data source and returns the data source to the business application; The business application indirectly accesses the target database through an interface or an identifier provided by the datastore middleware.

2. The method of claim 1, wherein, The legal verification and the permission check on the application-side token by the datastore configuration center comprise: Verifying the format legality of the application-side token, and checking whether the application-side token is within a valid period; Checking whether identity information of the business application is within an allowed access service range of the target database instance bound by the application-side token, and confirming whether the business application has the permission to acquire the target database connection credentials by using the application-side token.

3. The method of claim 1, wherein, The datastore middleware converts the encrypted target database connection credentials into plaintext target database connection credentials, and initiates a connection request to the target database by using the plaintext target database connection credentials, comprising: The datastore middleware converts the encrypted target database connection credentials into plaintext target database connection credentials by using a key, checks the integrity and the format legality of the plaintext target database connection credentials; After the integrity and the format legality of the plaintext target database connection credentials are checked, the datastore middleware initiates a connection request to the target database by using the plaintext target database connection credentials, and verifies the availability of the connection after successfully establishing the connection with the target database.

4. The method of claim 1, wherein, The datastore middleware performs initialization, comprising: The datastore middleware initiates a request for acquiring a configuration file to the datastore configuration center, wherein the configuration file comprises a token list of database instances required by the business application; The datastore middleware receives the configuration file returned by the datastore configuration center, and initiates an initialization request to the datastore configuration center to obtain database configuration; the initialization request contains a token of the token list; The datastore middleware receives the encrypted database configuration returned by the datastore configuration center, converts the encrypted database configuration into plaintext database configuration, and checks the integrity and format legality of the plaintext database configuration; After the integrity and format legality of the plaintext database configuration are checked, the datastore middleware initiates a connection request to the database using the plaintext database configuration, creates a database connection pool, and verifies the availability of each connection; The datastore middleware sends an initialization completion notification to the business application.

5. A middleware system, characterized by The datastore middleware and the datastore configuration center are included; The datastore middleware includes: An initialization module configured to perform initialization; A parsing module configured to parse a database connection request of the business application, determine a target database instance corresponding to the database connection request, and obtain an application-side token associated with the target database instance and configured in the business application; the application-side token contains identity credentials for accessing the target database instance and permission control information; A credential acquisition module configured to initiate a target database connection credential acquisition request to the datastore configuration center, the target database connection credential acquisition request containing the application-side token; A connection module configured to convert the encrypted target database connection credential into plaintext target database connection credential, and initiate a connection request to the target database using the plaintext target database connection credential; An encapsulation module configured to encapsulate the connected target database as a data source and return it to the business application after the datastore middleware and the target database successfully establish a connection; The datastore configuration center includes: A verification module configured to perform legal verification and permission check on the application-side token, and if both the legal verification and the permission check pass, send the encrypted target database connection credential to the datastore middleware.

6. The middleware system of claim 5, wherein, The verification module includes: A legal verification submodule configured to verify the format legality of the application-side token, and check whether the application-side token is within a valid period; A permission check submodule configured to check whether the identity information of the business application is within the allowed access service range of the target database instance bound by the application-side token, and confirm whether the business application has the permission to use the application-side token to obtain the target database connection credential.

7. The middleware system of claim 5, wherein, The connection module includes: A connection credential decryption submodule configured to convert the encrypted target database connection credential into plaintext target database connection credential through a key, and check the integrity and format legality of the plaintext target database connection credential; The connection establishment submodule is configured to initiate a connection request to the target database by using the plaintext target database connection credential after passing the integrity and format legality check of the plaintext target database connection credential, and verify the availability of the connection after successfully establishing the connection with the target database.

8. The middleware system of claim 5, wherein, The initialization module includes: The configuration file request submodule is configured to initiate a request to the datastore configuration center to obtain a configuration file, and the configuration file contains a token list of database instances required by the business application; The initialization request submodule is configured to receive the configuration file returned by the datastore configuration center, and initiate an initialization request to the datastore configuration center to obtain a database configuration, and the initialization request contains a token of the token list; The configuration decryption submodule is configured to receive the encrypted database configuration returned by the datastore configuration center, convert the encrypted database configuration into plaintext database configuration, and check the integrity and format legality of the plaintext database configuration; The database connection submodule is configured to initiate a connection request to the database by using the plaintext database configuration after passing the integrity and format legality check of the plaintext database configuration, create a database connection pool, and verify the availability of each connection; The notification submodule is configured to send an initialization completion notification to the business application.

9. An electronic device, comprising: The electronic device includes: At least one processor; and The memory is in communication connection with the at least one processor; wherein The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the database access method based on the middleware system in any one of claims 1-4.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to execute the database access method based on the middleware system in any one of claims 1-4 when executed.

Images