Database authentication method and device

Abstract

The embodiment of the invention provides a database authentication method and device, and relates to the technical field of database security, in the method, a user state system table is set in a first relational database; the first relational database receives a login request sent by a first user; if the locking state of the first user in the user state system table is a locked state, sending a first login response to the first user; if the locking state of the first user in the user state system table is an unlocked state, authenticating the first user; if the authentication fails, the login failure frequency of the first user in the user state system table is smaller than the preset prompt frequency, and the common login identifier list of the first user comprises the current login identifier of the first user, outputting a login prompt character string of the first user in the user state system table; and when a second login request sent by the first user is received, authenticating the first user. According to the scheme, the security of the relational database can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database security, in particular to a database authentication method and device. BACKGROUND

[0002] PostgreSQL databases, MySQL databases and other relational databases provide a variety of authentication methods. When a user connects to a relational database, the server of the relational database uses the configured authentication method to authenticate the user, and the user can obtain a corresponding session after successfully passing the authentication.

[0003] When an attacker uses a brute force attack method to crack the user password and attempts to connect to the server of the relational database, it is crucial for the security of the relational database to effectively discover and handle authentication failure login attempts and make corresponding processing to prevent the brute force attack of the attacker. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a database authentication method and device to improve the security of relational databases. The specific technical solutions are as follows:

[0005] In a first aspect, the embodiments of the present application provide a database authentication method applied to a first relational database, wherein a user state system table is set in the first relational database, and the user state system table records a lock state, a number of login failures, a list of commonly used login identifiers and a login prompt string of a user; the method comprises:

[0006] receiving a first login request sent by a first user;

[0007] obtaining the lock state of the first user from the user state system table;

[0008] if the lock state of the first user is a locked state, sending a first login response to the first user, wherein the first login response indicates that the first user fails to log in and is locked, and the locked state indicates that the user is a potential brute force attacker;

[0009] if the lock state of the first user is an unlocked state, authenticating the first user, wherein the unlocked state indicates that the user is not a potential brute force attacker;

[0010] if the authentication fails, the number of login failures of the first user in the user state system table is less than a preset prompt number, and the current login identifier of the first user is included in the list of commonly used login identifiers of the first user, outputting the login prompt string of the first user in the user state system table;

[0011] authenticating the first user when receiving the second login request sent by the first user.

[0012] In some embodiments, the method further comprises:

[0013] sending a second login response to the first user when a preset condition is met, the second login response indicating that the first user fails to log in;

[0014] increasing, by a preset value, a number of login failures of the first user in the user state system table;

[0015] if the number of login failures of the first user after the increase by the preset value is greater than or equal to a maximum number of attempts, deleting a current login identifier of the first user from a list of frequently-used login identifiers of the first user, and updating a lock state of the first user in the user state system table to a locked state.

[0016] In some embodiments, the method further comprises:

[0017] if the authentication is successful, adding the current login identifier of the first user to the list of frequently-used login identifiers of the first user, and sending a third login response to the first user, the third login response indicating that the first user succeeds to log in;

[0018] clearing the number of login failures of the first user in the user state system table.

[0019] In some embodiments, the user state system table further records a last login failure time of a user.

[0020] The step of obtaining the lock state of the first user from the user state system table comprises:

[0021] obtaining, from the user state system table, a last login failure time and a lock state of the first user;

[0022] if the lock state of the first user is the locked state and a time length from the last login failure time of the first user to a current time is greater than or equal to a failure lock time length, updating the lock state of the first user in the user state system table to an unlocked state;

[0023] obtaining the updated lock state of the first user from the user state system table.

[0024] In some embodiments, the user state system table further records a last login failure time of a user; and before receiving the first login request sent by the first user, the method further comprises:

[0025] determining a time length from a last login failure time of the first user in the user state system table to a current time if the lock state of the first user is the locked state;

[0026] updating the lock state of the first user in the user state system table to the unlocked state if the determined time length is greater than or equal to the failure lock time length.

[0027] In some embodiments, the method further comprises:

[0028] extracting a preset number of characters from the updated user password to obtain a new login prompt string of the first user when detecting that the user password of the first user is updated;

[0029] updating the new login prompt string to the user state system table.

[0030] In a second aspect, an embodiment of the present application provides a database authentication device applied to a first relational database, wherein the first relational database is provided with a user state system table, and the user state system table records a lock state, a login failure number, a list of commonly used login identifiers and a login prompt string of a user; the device comprises an authentication module and a user module;

[0031] The authentication module is configured to receive a first login request sent by a first user.

[0032] The user module is configured to acquire the lock state of the first user from the user state system table.

[0033] The authentication module is further configured to send a first login response to the first user if the lock state of the first user is the locked state, wherein the first login response indicates that the first user fails to log in and is locked, and the locked state indicates that the user is a potential brute force attacker.

[0034] The authentication module is further configured to authenticate the first user if the lock state of the first user is the unlocked state, wherein the unlocked state indicates that the user is not a potential brute force attacker; output a login prompt string of the first user in the user state system table if authentication fails, the login failure number of the first user in the user state system table is less than a preset prompt number, and the list of commonly used login identifiers of the first user includes a current login identifier of the first user; and authenticate the first user when receiving a second login request sent by the first user.

[0035] In some embodiments, the authentication module is further configured to send a second login response to the first user when a preset condition is met, wherein the second login response indicates that the first user fails to log in.

[0036] The user module is further configured to increase the number of login failures of the first user in the user state system table by a preset value when a preset condition is met; and delete the current login identifier of the first user from the list of frequently used login identifiers of the first user and update the lock state of the first user in the user state system table to the locked state if the number of login failures of the first user after the increase is greater than or equal to the maximum number of attempts.

[0037] The preset condition includes any one of the following conditions:

[0038] The authentication fails after the first user is authenticated when the second login request sent by the first user is received.

[0039] The authentication fails after the first user is authenticated when the first user is in the unlocked state, but the number of login failures of the first user in the user state system table is greater than or equal to the preset prompt number, and / or the list of frequently used login identifiers of the first user does not include the current login identifier of the first user.

[0040] In some embodiments, the authentication module is further configured to send a third login response to the first user if the authentication is successful, the third login response indicating that the first user logs in successfully.

[0041] The user module is further configured to add the current login identifier of the first user to the list of frequently used login identifiers of the first user and clear the number of login failures of the first user in the user state system table.

[0042] In some embodiments, the user state system table further records the last login failure time of the user.

[0043] The user module is specifically configured to obtain the last login failure time and the lock state of the first user from the user state system table; update the lock state of the first user in the user state system table to the unlocked state if the lock state of the first user is the locked state and the time length from the last login failure time of the first user to the current time is greater than or equal to the failure lock time length; and obtain the updated lock state of the first user from the user state system table.

[0044] In some embodiments, the user state system table further records the last login failure time of the user.

[0045] The user module is further configured to, before receiving a first login request sent by a first user, if a lock state of the first user is a locked state, determine a time length from a last login failure time of the first user in the user state system table to a current time, and if the determined time length is greater than or equal to a failed lock time length, update the lock state of the first user in the user state system table to an unlocked state.

[0046] In some embodiments, the user module is further configured to, when detecting that a user password of the first user is updated, extract a preset number of characters from the updated user password to obtain a new login prompt string of the first user, and update the new login prompt string to the user state system table.

[0047] In a third aspect, an embodiment of the present application provides a relational database, including a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions capable of being executed by the processor, and the processor is prompted by the machine executable instructions to implement any of the above described methods.

[0048] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above described methods.

[0049] In a fifth aspect, an embodiment of the present application provides a computer program product containing instructions, which, when executed on a computer, cause the computer to perform any of the above described methods.

[0050] Embodiments of the present application have the following beneficial effects:

[0051] In the technical scheme provided by the embodiments of the present application, the first relational database is provided with a user state system table, the user state system table records a lock state, a login failure number, a list of commonly used login identifiers and a login prompt string of a user, and when a user is a potential brute force attacker, if the number of consecutive login failures of the user is greater than or equal to a maximum number of attempts, the lock state of the user is a locked state. Correspondingly, after receiving a login request of a user (such as a first user), if the lock state of the user is a locked state, the first relational database directly sends a login response indicating login failure and locking to the user. This effectively prevents brute force attacks and improves the security of the relational database.

[0052] In addition, if the lock state of the user is the unlocked state, the login failure times of the first user in the user state system table is less than the preset prompt times, and the current login identifier of the first user is included in the list of the commonly used login identifiers of the first user, the login prompt string of the user is outputted, so as to avoid the problem that the user password is too complex to cause input error, and the output of the login prompt string is determined by the three factors of the lock state, the login failure times and the commonly used login identifier, so as to improve the user friendliness of the relational database without obviously reducing the security of the relational database.

[0053] Of course, implementing any of the products or methods of the present application does not necessarily require achieving all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description only constitute some embodiments of the present application, and other embodiments can also be obtained by those skilled in the art based on these drawings.

[0055] Figure 1 The first flowchart of the database authentication method provided by the embodiments of the present application;

[0056] Figure 2 The second flowchart of the database authentication method provided by the embodiments of the present application;

[0057] Figure 3 The third flowchart of the database authentication method provided by the embodiments of the present application;

[0058] Figure 4 The fourth flowchart of the database authentication method provided by the embodiments of the present application;

[0059] Figure 5 The fifth flowchart of the database authentication method provided by the embodiments of the present application;

[0060] Figure 6 The structure diagram of the database authentication device provided by the embodiments of the present application;

[0061] Figure 7 The signaling diagram of the database authentication provided by the embodiments of the present application;

[0062] Figure 8 The structure diagram of the relational database provided by the embodiments of the present application. DETAILED DESCRIPTION

[0063] With reference to the drawings, the technical solutions in the embodiments of the present application will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art based on the present application shall fall within the scope of the present application.

[0064] For the convenience of understanding, the words appearing in the embodiments of the present application are explained below.

[0065] PostgreSQL database: an open source relational database system. After long-term development and continuous improvement, the PostgreSQL database has gained high reputation in the industry in terms of reliability, stability, data consistency, etc. At present, the PostgreSQL database can run on various mainstream operating systems such as Linux, Unix and Windows. The PostgreSQL database is a fully transactional secure database, fully supports foreign keys, joins, views, triggers and stored procedures, and supports the development of stored procedures in multiple languages. The PostgreSQL database supports many data types of the SQL:2008 standard, including integer, numeric, boolean, byte, character, date, time interval and time, and supports storing binary objects including pictures, sounds and videos.

[0066] Brute-force attack: also known as brute attack, exhaustive attack or brute force cracking. Brute-force attack is a method of password analysis, which mainly tests possible passwords one by one by software until the real password is found. For example, there are 10,000 combinations of four-digit passwords composed of Arabic numerals. When using the brute-force attack method to crack the four-digit password composed of Arabic numerals, at most 9999 attempts can find the correct password. In theory, except for the password with perfect security, any password can be cracked by using the brute-force attack method, and the technical component lies in how to shorten the trial and error time.

[0067] The relational database such as the PostgreSQL database, the MySQL database and the like provides various authentication modes such as a message-digest algorithm (MD5), an ident protocol authentication (ident), a trust authentication (trust) and the like. Among them, the password authentication mode such as MD5 is the most widely used authentication mode. When a user connects the relational database, the server of the relational database adopts the configured authentication mode to authenticate the user, and the user can obtain a corresponding session after successfully passing the authentication.

[0068] When an attacker adopts a brute force attack method to crack the user password and attempts to connect the server of the relational database, whether the server can effectively discover and handle the authentication failure login attempt and make corresponding processing to prevent the brute force attack of the attacker is crucial to the security of the relational database.

[0069] In order to improve the security of the relational database, the prior art provides an authentication method based on a credcheck plug-in. In the method, the credcheck plug-in is located in the PostgreSQL database. The credcheck plug-in establishes a hash table in the memory, and the hash table is used to store the login failure times of the user. After receiving the login request of the user connecting the PostgreSQL database, the credcheck plug-in checks whether the login failure times of the user in the hash table are greater than or equal to a preset number; if yes, a login failure response is returned to the user, and the user is refused to connect the relational database; if no, the user is authenticated; if the authentication fails, a login failure response is returned to the user, and the user is refused to connect the relational database, and the login failure times of the user in the hash table are increased by 1; if the authentication succeeds, a login success response is returned to the user, and the user is allowed to connect the relational database.

[0070] In the authentication method based on the credcheck plug-in, the established hash table is in the memory. When the PostgreSQL database is restarted, the stored data in the hash table will be lost. Therefore, after the PostgreSQL database is restarted, the credcheck plug-in needs to accumulate the login failure times of the user again, and cannot continuously handle the user with authentication failure, thereby threatening the security of the PostgreSQL database.

[0071] In addition, when the PostgreSQL database has a primary and standby database, the primary database does not synchronize the hash table established in the memory to the standby database. When the primary and standby switching occurs, since the standby database does not have the historical data recorded in the hash table, the credcheck plug-in needs to reaccumulate the login failure times of the user, and cannot continuously process the authentication failure user, further threatening the security of the PostgreSQL database.

[0072] In addition, in the authentication method based on the credcheck plug-in, the mechanism for preventing brute force attacks is relatively rough, and the user friendliness is poor.

[0073] To solve the above problems, the embodiment of the present application provides a database authentication method, as shown in the following Figure 1 The first relational database is provided with a user state system table, and the user state system table records the lock state, login failure times, a list of commonly used login identifiers, and a login prompt string of the user. The method comprises the following steps:

[0074] Step S101, receiving a first login request sent by a first user;

[0075] Step S102, obtaining the lock state of the first user from the user state system table;

[0076] Step S103, if the lock state of the first user is a locked state, sending a first login response to the first user, the first login response indicating that the first user fails to log in and is locked, and the locked state indicating that the user is a potential brute force attacker;

[0077] Step S104, if the lock state of the first user is an unlocked state, authenticating the first user, and the unlocked state indicating that the user is not a potential brute force attacker;

[0078] Step S105, if the authentication fails, the login failure times of the first user in the user state system table are less than a preset prompt times, and the current login identifier of the first user is included in the list of commonly used login identifiers of the first user, outputting the login prompt string of the first user in the user state system table;

[0079] Step S106, when receiving a second login request sent by the first user, authenticating the first user.

[0080] In the technical scheme provided by the embodiments of the present application, the first relational database is provided with a user state system table, the user state system table records a lock state, a login failure number, a list of commonly used login identifiers and a login prompt string of a user, and when a user is a potential brute force attacker, if the number of consecutive login failures of the user is greater than or equal to a maximum number of attempts, the lock state of the user is a locked state. Correspondingly, after receiving a login request of a user (for example, a first user), if the lock state of the user is a locked state, the first relational database directly sends a login response indicating that the login fails and the user is locked to the user. This effectively prevents brute force attacks and improves the security of the relational database.

[0081] In addition, if the lock state of the user is an unlocked state, if the number of login failures of the first user in the user state system table is less than a preset prompt number, and if the current login identifier of the first user is included in the list of commonly used login identifiers of the first user, the login prompt string of the user is output. In this way, the problem that a user password is too complex to be input incorrectly is avoided, and the output of the login prompt string is determined by the lock state, the number of login failures and the list of commonly used login identifiers. In the case of effectively preventing brute force attacks without significantly reducing the security of the relational database, the user friendliness of the relational database is improved.

[0082] In addition, the lock state of the user is recorded in the user state system table, the user state system table is stored in the table space of the first relational database as a system table, and the data will not be lost due to the restart of the first relational database. In the database restart, the technical scheme provided by the embodiments of the present application can effectively ensure the continuous processing of the user with authentication failure in the relational database, and further improves the security of the relational database.

[0083] In the scenario of the presence of a primary database and a standby database, the user state system table is synchronized between the primary database and the standby database by means of the stream replication mechanism of the primary database and the standby database. For example, the first relational database is used as the primary database, the second relational database is used as the standby database, and the first relational database synchronizes the user state system table to the second relational database by means of the stream replication mechanism. In this way, the user state system table with consistent information is recorded in the primary database and the standby database. When the primary-standby switchover occurs, the authentication processing results of the primary database and the standby database are necessarily consistent by means of the user state system table with consistent information. It can be seen that in the primary-standby switchover scenario, the technical scheme provided by the embodiments of the present application can effectively ensure the continuous processing of the user with authentication failure in the relational database, and further improves the security of the relational database.

[0084] In the embodiments of the present application, the first relational database can be any type of relational database, such as a PostgreSQL database, a MySQL database, and the like. The user status system table is used to store user status information. When the first relational database is a PostgreSQL database, the user status system table can be referred to as a pg_user_status system table.

[0085] The lock status of the user can be represented as status, and the type of the lock status of the user can be an integer of 8-bit binary, that is, int8.

[0086] The initial value of the login failure count of the user is 0. The login failure count can be represented as failedcount, and the type of the login failure count of the user can be an integer of 8-bit binary, that is, int8.

[0087] The list of commonly used login identifiers of the user includes one or more login identifiers when the user logs in successfully. The login identifier can include, but is not limited to, an Internet Protocol (IP) address, a Media Access Control (MAC) address, a login location (such as a certain city), a login time, and the like. The list of commonly used login identifiers can be represented as commonaddr, and the type of the list of commonly used login identifiers can be a text type, that is, text.

[0088] The login prompt string is a string composed of part of the characters in the user password and a general symbol. The positions of the part of the characters in the user password in the login prompt string are the same as the positions of the part of the characters in the user password in the user password. For example, the general symbol is *, the user password is 123456789, the part of the characters in the user password to form the login prompt string is 4, 7, and 8, and the login prompt string can be ***4**78*. To ensure security, the login prompt string can be stored in the user status system table after being encrypted.

[0089] In the embodiments of the present application, the user status system table also records the login failure count of the user. The correspondence between the user ID and the login failure count can be used for recording.

[0090] In some embodiments, when it is detected that the user password of the first user is updated, a preset number of characters are extracted from the updated user password to obtain a new login prompt string of the first user; and the new login prompt string is updated to the user status system table.

[0091] In the embodiments of the present application, the preset number can be set according to actual needs, for example, the preset number can be 0, 1, 2 or 3. The first user can modify the user password, and the first user sets the user password for the first time or updates the user password in the case of an existing user password. The first relational database can detect the user password of the first user in real time. When detecting that the user password of the first user is updated, the first relational database randomly extracts a preset number of characters from the updated user password to form a new login prompt string of the first user, and updates the login prompt string of the first user in the user state system table to the new login prompt string to adapt to subsequent database authentication.

[0092] When the user state system table records the lock state, the number of login failures, the list of commonly used login identifiers and the login prompt string of the user, the corresponding relationship between the user identifier (ID) and the user state information can be used for recording. The user ID can be represented as a role object identifier (Role Object ID, roloid), and the type of the user ID can be an object identifier (Object ID, oid) type.

[0093] In the embodiments of the present application, the lock state of the user can be a locked state, and the locked state indicates that the user is a potential brute force attacker, for example, the number of consecutive login failures of the user is greater than or equal to the maximum number of attempts. The lock state of the user can also be an unlocked state, and the unlocked state indicates that the user is not a potential brute force attacker, for example, the number of consecutive login failures of the user is less than the maximum number of attempts.

[0094] In the step S101, the first user can be any user, for example, the first user can be any user registered in the first relational database, or any user not registered in the first relational database, for example, a brute force attacker.

[0095] When the first user needs to connect the first relational database and log in to the first relational database, the first user sends a login request (i.e., a first login request) to the first relational database, and the first login request can include login information of the first user, such as a username and a user password. The first relational database (such as a server) receives the first login request sent by the first user.

[0096] In the step S102, the first relational database can obtain the login information of the first user from the first login request after receiving the first login request, and then obtain the lock state corresponding to the login information of the first user from the user state system table. For example, the login information of the first user includes the username of the first user, the first relational database obtains the user ID corresponding to the username of the first user, and obtains the lock state corresponding to the user ID from the user state system table as the lock state of the first user.

[0097] In step S103, after obtaining the lock state of the first user, if it is detected that the lock state of the first user is the locked state, it indicates that the first user is a potential brute force attacker, the first relational database rejects the first user to log in the first relational database, and sends a login response to the first user, such as a first login response, which indicates that the first user fails to log in and is locked.

[0098] The first user receives the first login response and knows that the authentication fails and is locked, that is, the first user cannot log in the first relational database temporarily, and thus will not attempt to log in the first relational database again, thereby reducing the risk of the first relational database being attacked by brute force.

[0099] In step S104, after obtaining the lock state of the first user, if it is detected that the lock state of the first user is the unlocked state, it indicates that the first user is not a potential brute force attacker, and the first relational database can use the login information of the first user carried in the first login request to authenticate the first user to determine whether the first user is a legal user and confirm the authority of the first user.

[0100] The preset prompt number can be set according to actual needs, for example, the preset prompt number can be 0, 1, 2, or 3, etc. The current login identifier of the first user can be obtained from the first login request.

[0101] If the authentication fails in step S104, the first relational database can detect whether the number of login failures of the first user in the user state system table is less than the preset prompt number, and whether the current login identifier of the first user is included in the list of common login identifiers of the first user. If the number of login failures of the first user in the user state system table is less than the preset prompt number, and the current login identifier of the first user is included in the list of common login identifiers of the first user, that is, the current login identifier of the first user is the common login identifier of the first user, the first relational database obtains the login prompt string of the first user from the user state system table and outputs the login prompt string.

[0102] In this way, the first user can input a login request (such as a second login request) to the first relational database again according to the login prompt string.

[0103] In step S106, the first relational database uses the login information of the first user carried in the second login request to authenticate the first user to determine whether the first user is a legal user and confirm the authority of the first user, etc. after receiving the second login request.

[0104] In some embodiments, as Figure 2As shown, a database authentication method is also provided, which can include the following steps:

[0105] Step S201, receiving a first login request sent by a first user;

[0106] Step S202, obtaining a lock state of the first user from a user state system table;

[0107] Step S203, if the lock state of the first user is a locked state, sending a first login response to the first user, the first login response indicating that the first user fails to log in and is locked, the locked state indicating that the user is a potential brute force attacker;

[0108] Step S204, if the lock state of the first user is an unlocked state, authenticating the first user, the unlocked state indicating that the user is not a potential brute force attacker;

[0109] Step S205, if the authentication fails and the number of login failures of the first user in the user state system table is less than a preset prompt number and the current login identifier of the first user is included in a commonly used login identifier list of the first user, outputting a login prompt string of the first user in the user state system table;

[0110] Step S206, authenticating the first user when receiving a second login request sent by the first user.

[0111] Steps S201-S206 are the same as steps S101-S106.

[0112] Step S207, sending a second login response to the first user when a preset condition is met, the second login response indicating that the first user fails to log in;

[0113] The preset condition includes any one of the following conditions:

[0114] The authentication fails after authenticating the first user when receiving a second login request sent by the first user;

[0115] The authentication fails after authenticating the first user when the lock state of the first user is the unlocked state, but the number of login failures of the first user in the user state system table is greater than or equal to the preset prompt number and / or the current login identifier of the first user is not included in the commonly used login identifier list of the first user.

[0116] In the embodiment of the application, in step S204, the first relational database authenticates the first user to obtain an authentication result; if the authentication result is authentication failure, it is indicated that the first user is an illegal user (such as a brute force attacker) when any one of the following conditions occurs, and a login response (such as a second login response) indicating login failure is sent to the first user.

[0117] Case 1, the number of login failures of the first user in the user state system table is greater than or equal to the preset prompt number;

[0118] Case 2, the list of commonly used login identifiers of the first user does not include the current login identifier of the first user.

[0119] In addition, in step S206, the first relational database authenticates the first user to obtain an authentication result; if the authentication result is authentication failure, it indicates that the first user is an illegal user (such as a brute force attacker), and then a login response indicating login failure, such as a second login response, is sent to the first user.

[0120] The first user receives the second login response and can know that the authentication login fails, and then can try to adjust the login information and resend the login request to log in to the first relational database to realize access to the first relational database.

[0121] Step S208, increasing the number of login failures of the first user in the user state system table by a preset value;

[0122] In the embodiment of the application, the preset value can be set according to actual needs, such as 1, 2, 3, etc.

[0123] When the first relational database sends the second login response to the first user, the user state system table can also be updated, such as obtaining the user ID corresponding to the username of the first user, obtaining the number of login failures corresponding to the user ID from the user state system table, and then increasing the number of login failures by a preset value.

[0124] In the embodiment of the application, the execution order of step S207 and step S208 is not limited.

[0125] Step S209, if the number of login failures of the first user after increasing the preset value is greater than or equal to the maximum number of attempts, the current login identifier of the first user is deleted from the list of commonly used login identifiers of the first user, and the lock state of the first user in the user state system table is updated to the locked state.

[0126] In the embodiment of the application, the maximum number of attempts is the maximum number of attempts to log in to the first relational database in the case of authentication failure, and the maximum number of attempts can be set according to actual needs, such as 5, 6, 7, etc.

[0127] After updating the login failure times of the first user in the user state system table, the first relational database can determine whether the updated login failure times of the first user (i.e., the login failure times after adding the preset value) are greater than or equal to the maximum number of attempts; if yes, i.e., the updated login failure times of the first user are greater than or equal to the maximum number of attempts, it indicates that the first user is a potential brute force attacker, and then step S209 is performed to update the user state system table, such as deleting the current login identifier of the first user from the list of commonly used login identifiers of the first user, and updating the lock state of the first user in the user state system table to the locked state.

[0128] In this way, when the login request of the first user is received again subsequently, the lock state obtained by the first relational database from the user state system table is the locked state, and then step S203 is performed to directly send the first login response to the first user, thereby rejecting the user to log in to the first relational database, and the login information carried in the login request will not be authenticated, thereby effectively preventing the risk of brute force attack.

[0129] After updating the login failure times of the first user in the user state system table, if the first relational database determines that the updated login failure times of the first user are less than the maximum number of attempts, it indicates that the first user is not a potential brute force attacker, and then the authentication processing procedure is ended, and the next login request is waited to be received.

[0130] In the technical scheme provided by the embodiments of the present application, the first relational database is configured with an authentication failure processing logic, such as sending a login response indicating login failure to the first user in the case of authentication failure, and accumulating the login failure times in the user state system table; when the login failure times are greater than or equal to the maximum number of attempts, updating the lock state of the user in the user state system table to the locked state, and deleting the current login identifier. Based on the authentication failure processing logic, potential brute force attack users can be identified in time, and the potential brute force attack users are locked, thereby further preventing the attacker from cracking the user password (such as a password) by using the brute force attack method, and improving the security of the relational database.

[0131] In some embodiments, the user state system table also records the login failure times of the user. In this case, as shown in Figure 3 The embodiments of the present application also provide a database authentication method, which can include the following steps:

[0132] Step S301, receiving a first login request sent by a first user;

[0133] Step S302, obtaining the lock state of the first user from the user state system table;

[0134] Step S303, if the lock state of the first user is the locked state, a first login response is sent to the first user, the first login response indicates that the first user fails to log in, and is locked, the locked state indicates that the user is a potential brute force attacker.

[0135] Step S304, if the lock state of the first user is the unlocked state, the first user is authenticated, the unlocked state indicates that the user is not a potential brute force attacker.

[0136] Step S305, if the authentication fails, the number of login failures of the first user in the user state system table is less than the preset prompt number, and the current login identifier of the first user is included in the commonly used login identifier list of the first user, a login prompt string of the first user in the user state system table is output.

[0137] Step S306, when the second login request sent by the first user is received, the first user is authenticated.

[0138] Steps S301 to S306 are the same as steps S101 to S106.

[0139] Step S307, if the authentication succeeds, the current login identifier of the first user is added to the commonly used login identifier list of the first user, a third login response is sent to the first user, the number of login failures of the first user in the user state system table is cleared, and the third login response indicates that the first user logs in successfully.

[0140] In the embodiment of the application, if the authentication result obtained by authenticating the first user in step S304 or step S307 is authentication success, the first relational database can perform two operations in parallel: 1) sending a login response indicating login success to the first user, such as the third login response; 2) updating the user state system table, i.e. clearing the number of login failures of the first user in the user state system table and adding the current login identifier of the first user to the commonly used login identifier list of the first user.

[0141] In the technical scheme provided by the embodiment of the application, if the first user is authenticated successfully by the first relational database when the lock state of the first user is the unlocked state, it indicates that the first user is authenticated successfully within a limited number of times, the first user is not a potential brute force attacker, and the first user is allowed to log in to the first relational database, thereby ensuring that a legitimate user can normally access and log in to the first relational database.

[0142] In the embodiment of the application, the first relational database can only send the third login response to the first user when the authentication of the first user succeeds, and the number of login failures of the first user in the user state system table remains unchanged, which is not limited.

[0143] In some embodiments, the user state system table also records the last login failure time of the user, i.e., the time of the last authentication failure. The last login failure time can be denoted as lastfailtime, and the type of the last login failure time of the user can be time, i.e., timestamptz. In the embodiments of the present application, when the user state system table records the last login failure time of the user, the correspondence between the user ID and the last login failure time can be used for recording.

[0144] In this case, as shown in Figure 4 The embodiments of the present application also provide a database authentication method, which can include the following steps:

[0145] Step S401, receiving a first login request sent by a first user; the same as step S101.

[0146] Step S402, obtaining the last login failure time and the lock state of the first user from the user state system table;

[0147] After receiving the login request, the first relational database can obtain the login information of the first user from the login request, and then obtain the last login failure time and the lock state corresponding to the login information of the first user from the user state system table. For example, the user ID corresponding to the username of the first user is obtained, and the last login failure time and the lock state corresponding to the user ID are obtained from the user state system table, i.e., the last login failure time and the lock state of the first user.

[0148] Step S403, if the lock state of the first user is the locked state, and the time length from the last login failure time of the first user to the current time is greater than or equal to the failure lock time length, updating the lock state of the first user in the user state system table to the unlocked state;

[0149] In the embodiments of the present application, the failure lock time length can be a fixed time length, such as 10 minutes, 30 minutes, 1 hour, etc. The failure lock time length can be a variable time length, such as the first relational database storing the correspondence between the login failure number and the failure lock time length, querying the correspondence between the login failure number and the failure lock time length to determine the failure lock time length corresponding to the current login failure number of the first user, and then using the determined failure lock time length to execute step S403.

[0150] After obtaining the last login failure time and the lock state of the first user, the first relational database determines a duration from the last login failure time to a current time as a locked duration, judges whether the locked duration is greater than or equal to the failure lock duration, and judges whether the lock state of the first user is the locked state. If the lock state of the first user is the locked state and the locked duration is greater than or equal to the failure lock duration, step S403 is executed to update the user state system table, the lock state of the first user in the user state system table is updated to the unlocked state, and then steps S404-S405 are executed to obtain the updated lock state of the first user, i.e., the unlocked state, from the user state system table, and if the lock state of the first user is the locked state, a first login response is sent to the first user.

[0151] If the lock state of the first user is the unlocked state and / or the locked duration is less than the failure lock duration, the first relational database directly executes step S405 or step S406.

[0152] Step S404, obtaining the updated lock state of the first user from the user state system table.

[0153] Step S405, if the lock state of the first user is the locked state, a first login response is sent to the first user, the first login response indicates that the first user fails to log in and is locked, and the locked state indicates that the user is a potential brute force attacker.

[0154] Step S406, if the lock state of the first user is the unlocked state, the first user is authenticated, and the unlocked state indicates that the user is not a potential brute force attacker.

[0155] Step S407, if the authentication fails, the number of login failures of the first user in the user state system table is less than a preset prompt number, and the current login identifier of the first user is included in the commonly used login identifier list of the first user, a login prompt string of the first user in the user state system table is output.

[0156] Step S408, when receiving a second login request sent by the first user, the first user is authenticated.

[0157] Steps S405-S408 are the same as steps S103-S106.

[0158] In the embodiment of the present application, when the first relational database obtains that the lock state of the first user is the unlocked state, the unlocked state can be a state set when the number of login failures of the first user is less than the maximum number of attempts; the unlocked state can also be the updated lock state in step S404, that is, a state set when the number of login failures of the first user is greater than or equal to the maximum number of attempts, but the locked duration is greater than or equal to the failed lock duration.

[0159] When the first relational database obtains that the lock state of the first user is the unlocked state, the first user is authenticated. If the authentication is successful, the first relational database can send a third login response to the first user, clear the number of login failures of the first user in the user state system table, and also clear the last login failure time of the first user in the user state system table. If the authentication fails, the first relational database can send a third login response to the first user, increase the number of login failures of the first user in the user state system table by a preset value, and update the last login failure time of the first user in the user state system table to the current time.

[0160] In the technical solution provided by the embodiment of the present application, the first relational database is configured with an authentication failure processing logic, for example, when the lock state of the first user is the locked state, and the duration from the last login failure time of the first user to the current time is greater than or equal to the failed lock duration, the lock state of the user in the user state system table is updated to the unlocked state; otherwise, the lock state of the user in the user state system table is kept as the locked state. Based on the authentication failure processing logic, two parameters, the lock state and the failed lock duration, are used to control the authentication failure processing logic, which can identify potential brute force attack users in time and lock the potential brute force attack users, further preventing attackers from cracking user passwords (such as password passwords) by using brute force attack methods, and improving the security of the relational database.

[0161] In addition, in the embodiment of the present application, the first relational database will only decide whether to update the lock state after receiving the login request. In this case, the first relational database does not need to detect the lock state of each user in the user state system table in real time, reducing the burden of the first relational database.

[0162] In some embodiments, the user state system table also records the last login failure time of the user. In this case, as shown in Figure 5 The present application also provides a database authentication method, which can include the following steps:

[0163] Step S501, if the lock state of the first user is the locked state, determining the duration from the last login failure time of the first user in the user state system table to the current time;

[0164] Step S502, if the determined time length is greater than or equal to the failure locking time length, updating the locking state of the first user in the user state system table to the un-locked state.

[0165] In the embodiment of the present application, when the locking state of the first user is the un-locked state, the first relational database can not need to detect the time length from the last login failure time of the first user in the user state system table to the current time, i.e., the locked time length of the first user.

[0166] When the locking state of the first user is the locked state, the first relational database can detect the time length from the last login failure time of the first user in the user state system table to the current time, i.e., the locked time length, in real time.

[0167] If the determined time length, i.e., the locked time length, is greater than or equal to the failure locking time length, the first relational database executes step S502 to update the locking state of the first user in the user state system table to the un-locked state, and then executes step S503. Here, the first relational database keeps the login failure number of the first user in the user state system table unchanged.

[0168] If the determined time length, i.e., the locked time length, is less than the failure locking time length, the first relational database keeps the locking state of the first user in the user state system table as the locked state, and then executes step S503. Here, the first relational database also keeps the login failure number of the first user in the user state system table unchanged.

[0169] Step S503, receiving the first login request sent by the first user;

[0170] Step S504, obtaining the locking state of the first user from the user state system table;

[0171] Step S505, if the locking state of the first user is the locked state, sending the first login response to the first user, the first login response indicating that the first user fails to log in and is locked, the locked state indicating that the user is a potential brute force attacker.

[0172] Step S506, if the locking state of the first user is the un-locked state, authenticating the first user, the un-locked state indicating that the user is not a potential brute force attacker;

[0173] Step S507, if the authentication fails, the login failure number of the first user in the user state system table is less than the preset prompt number, and the current login identifier of the first user is included in the commonly used login identifier list of the first user, outputting the login prompt string of the first user in the user state system table.

[0174] Step S508, when receiving the second login request sent by the first user, authenticating the first user.

[0175] Steps S503-S508 are the same as steps S101-S106.

[0176] In the technical solution provided by the embodiments of the present application, the first relational database is configured with an authentication failure processing logic. For example, if the lock state of the first user is the locked state, and the time length from the last login failure time of the first user to the current time is greater than or equal to the failure lock time length, the lock state of the user in the user state system table is updated to the unlocked state; otherwise, the lock state of the user in the user state system table is kept as the locked state. Based on the authentication failure processing logic, the lock state and the failure lock time length are used as two parameters to control the authentication failure processing logic, so that the potential brute force attack user can be identified in time and locked, and the security of the relational database is further improved.

[0177] In addition, in the embodiments of the present application, when the lock state of the first user is the unlocked state, the first relational database detects the locked time length of the first user in real time, and then decides whether to update the lock state. After receiving the login request, the first relational database can directly execute the authentication failure processing logic according to the lock state in the user state system table, without deciding whether to update the lock state. This improves the authentication failure processing efficiency of the first relational database.

[0178] Corresponding to the above-mentioned database authentication method, the embodiments of the present application also provide a database authentication device, as shown in Figure 6 applied to the first relational database, the first relational database is provided with a user state system table, and the user state system table records the lock state, the login failure number, the list of frequently used login identifiers, and the login prompt string of the user; the device comprises an authentication module and a user module;

[0179] The authentication module 601 is configured to receive a first login request sent by a first user.

[0180] The user module 602 is configured to obtain the lock state of the first user from the user state system table.

[0181] The authentication module 601 is further configured to send a first login response to the first user if the lock state of the first user is the locked state, the first login response indicating that the first user fails to log in and is locked, and the locked state indicating that the user is a potential brute force attacker.

[0182] The authentication module 601 is further configured to, if the lock state of the first user is an unlocked state, authenticate the first user, the unlocked state indicating that the user is not a potential brute force attacker; if the authentication fails, and the number of login failures of the first user in the user state system table is less than a preset prompt number, and the current login identifier of the first user is included in the frequently-used login identifier list of the first user, output a login prompt string of the first user in the user state system table; and when receiving a second login request sent by the first user, authenticate the first user.

[0183] In some embodiments, the authentication module 601 is further configured to, when a preset condition is met, send a second login response to the first user, the second login response indicating that the login of the first user fails.

[0184] The user module 602 is further configured to, when the preset condition is met, increase the number of login failures of the first user in the user state system table by a preset value; if the number of login failures of the first user after the increase is greater than or equal to a maximum attempt number, delete the current login identifier of the first user from the frequently-used login identifier list of the first user, and update the lock state of the first user in the user state system table to a locked state.

[0185] The preset condition includes any one of the following conditions:

[0186] When the second login request sent by the first user is received, the authentication of the first user fails after the authentication.

[0187] When the lock state of the first user is the unlocked state, the authentication of the first user fails after the authentication, but the number of login failures of the first user in the user state system table is greater than or equal to the preset prompt number, and / or the current login identifier of the first user is not included in the frequently-used login identifier list of the first user.

[0188] In some embodiments, the authentication module 601 is further configured to, if the authentication succeeds, send a third login response to the first user, the third login response indicating that the login of the first user succeeds.

[0189] The user module 602 is further configured to add the current login identifier of the first user to the frequently-used login identifier list of the first user, and clear the number of login failures of the first user in the user state system table.

[0190] In some embodiments, the user state system table further records a last login failure time of the user.

[0191] The user module 602 is specifically configured to acquire the last login failure time and the lock state of the first user from the user state system table; if the lock state of the first user is the locked state, and the time length from the last login failure time of the first user to the current time is greater than or equal to the failure lock time length, the lock state of the first user in the user state system table is updated to the unlocked state; and the updated lock state of the first user is acquired from the user state system table.

[0192] In some embodiments, the user state system table further records the last login failure time of the user.

[0193] The user module 602 is further configured to, before receiving the first login request sent by the first user, if the lock state of the first user is the locked state, determine the time length from the last login failure time of the first user in the user state system table to the current time; if the determined time length is greater than or equal to the failure lock time length, update the lock state of the first user in the user state system table to the unlocked state.

[0194] In some embodiments, the user module 602 is further configured to, when detecting that the user password of the first user is updated, extract a preset number of characters from the updated user password to obtain a new login prompt string of the first user; and update the new login prompt string to the user state system table.

[0195] In some embodiments, the user module 602 is further configured to synchronize the user state system table to the second relational database.

[0196] In the technical scheme provided by the embodiments of the present application, the user state system table is arranged in the first relational database, the user state system table records the lock state of the user, and when a user is a potential brute force attacker, if the number of consecutive login failures of the user is greater than or equal to the maximum number of attempts, the lock state of the user is the locked state. Correspondingly, after receiving a login request of a user (such as the first user), if the lock state of the user is the locked state, the first relational database directly sends a login response indicating that the login fails and is locked to the user. This effectively prevents brute force attacks and improves the security of the relational database.

[0197] The database authentication method and device provided by the embodiments of the present application will be described in detail below in combination with the database authentication signaling diagram shown in Figure 7 Figure 7 ​The relational database shown is a PostgreSQL database. The PostgreSQL database is configured with an authentication (auth) module and a user (user) module, and the PostgreSQL database is configured with a user status system table and three Grand Unified Configuration (GUC) parameters.

[0198] The user status system table is named a pg_user_satus system table and includes information as shown in Table 1.

[0199] Table 1

[0200] The three GUC parameters include a maximum number of attempts (such as login_failed_max_times), a failed lock duration (such as login_failed_lock_interval), and a number of login prompt characters (such as password_tint_char_num). In an embodiment of the present application, the maximum number of attempts can be 6, the failed lock duration is 1 hour, the number of login prompt characters is 3, the login address is login, and the login identifier is an example. In addition, the preset value is 1, that is, the number of login failures is increased by 1 each time the authentication fails; and the preset prompt number is 1, that is, the number of times of outputting the login prompt string is 1.

[0201] Figure 7 The database authentication process shown can include the following steps:

[0202] In step S701, user 0 sends a login request to the PostgreSQL database. The login request includes login information of user 0, such as username 0 and user password 0.

[0203] In step S702, the auth module sends a state acquisition request to the user module.

[0204] In step S702, after receiving the login request, the auth module starts to detect the user state, that is, sends a state acquisition request to the user module. The state acquisition request can include the username 0 in the login request or the user ID 0 corresponding to the username 0.

[0205] In step S703, the user module acquires user state information of user 0 from the pg_user_satus system table and updates the lock state of user 0. The user state information of user 0 can include a lock state, a last login failure time, a login prompt string, and the like.

[0206] In step S703, the user module, after receiving the state acquisition request, runs a function for querying the lock state of the user (such as the CheckUserStatusIfLocked( ) function), queries the pg_user_satus system table, and obtains the lock state 0 and the last login failure time 0 corresponding to the user ID 0. If the lock state 0 is a locked state, and the time length from the last login failure time 0 to the current time is greater than or equal to the failure lock time length, the lock state 0 in the pg_user_satus system table is updated to an unlocked state. Otherwise, that is, the lock state 0 is an unlocked state, and / or the time length from the last login failure time 0 to the current time is less than the failure lock time length, the lock state 0 is not updated.

[0207] In step S704, the user module sends the queried user state information to the auth module.

[0208] In step S704, the lock state 0 queried by the user module can be the unlocked state updated in step S703, or the original lock state 0 in step S703 (that is, the lock state 0 that is not updated).

[0209] Through steps S702-S704, the CheckUserStatusIfLocked( ) function of the user module is called by the auth module to query the user state information. If the lock state 0 is a locked state, step S705 is executed; if the lock state 0 is an unlocked state, step S706 is executed.

[0210] In step S705, the auth module returns a response (such as a first login response) of “login failure, user is locked” to the user 0.

[0211] In step S706, the auth module authenticates the user 0.

[0212] In the embodiment of the present application, the pg_user_satus system table records a login prompt string including three characters in the password of the user 0 and a common login address of the user 0. The login prompt string is stored in the pg_user_satus system table after encryption to improve security.

[0213] In step S706, the auth module can acquire the authentication method matching the login information of user 0, and then call the corresponding authentication function (such as CheckXxAuth() function) to authenticate user 0. If the authentication fails, and the current login address of user 0 is the usual login address of user 0, and user 0 is authenticated for the first time, the auth module executes step S707; if the authentication fails, but the current login address of user 0 is not the usual login address of user 0, or user 0 is not authenticated for the first time, the auth module executes step S710 and step S712; if the authentication succeeds, the auth module executes step S713 and step S715.

[0214] In step S707, the auth module sends the login prompt string of user 0 to user 0.

[0215] The auth module reads the login prompt string of user 0 from the pg_user_satus system table, decrypts the login prompt string of user 0, and sends it to user 0.

[0216] In step S708, user 0 sends a login request to the PostgreSQL database. The login request includes the login information of user 0, such as username 0 and user password 0.

[0217] In step S708, the login information included in the login request is the login information input by user 0 according to the login prompt string.

[0218] In step S709, the auth module authenticates user 0.

[0219] In step S709, the auth module can acquire the authentication method matching the login information of user 0, and then call the corresponding authentication function (such as CheckXxAuth() function) to authenticate user 0. If the authentication fails, steps S710 and S712 are executed; if the authentication succeeds, the auth module executes steps S713 and S715.

[0220] In step S710, the auth module sends a failure update request to the user module. The failure update request indicates that user 0 fails to authenticate, and requests to update the pg_user_satus system table.

[0221] In step S711, the user module increments the login failure times of user 0 in the pg_user_satus system table by 1, and updates the lock state 0 and the usual login address.

[0222] In step S711, the user module can call a user status setting function based on login failure (such as the SetUserStatus OnLoginFailed( ) function), add 1 to the number of login failures of user 0 in the pg_user_satus system table, and determine whether the number of login failures after adding 1 is greater than or equal to the maximum number of attempts; if greater than or equal to the maximum number of attempts, update the lock state 0 to the locked state, and delete the current login address of user 0 in the pg_user_satus system table; if less than the maximum number of attempts, refuse to update the lock state 0.

[0223] In step S712, the auth module returns a response of "login failure" to user 0 (such as the second login response).

[0224] In the embodiments of the present application, the execution order of step S710 and step S712 is not limited.

[0225] Through steps S707-S712, the auth module calls the SetUserStatus OnLoginFailed( ) function of the user module, and the number of failures is added by 1 and the lock state 0 is updated.

[0226] In step S713, the auth module sends a successful update request to the user module. The successful update request indicates that the authentication of user 0 is successful, and requests to update the pg_user_satus system table.

[0227] In step S714, the user module clears the number of login failures of user 0 in the pg_user_satus system table, and updates the frequently used login address.

[0228] In step S714, the user module can call a try to unlock function based on login success (such as the TryToUnlockOnLoginSuccess( ) function), clear the number of login failures of user 0 in the pg_user_satus system table, and add the current login address of user 0 (i.e. the frequently used login address) in the pg_user_satus system table.

[0229] In step S715, the auth module returns a response of "login success" to user 0 (such as the third login response).

[0230] In the embodiments of the present application, the execution order of step S713 and step S715 is not limited.

[0231] Through steps S713-S715, the auth module calls the TryToUnlockOnLoginSuccess( ) function of the user module, and the number of failures is cleared.

[0232] The technical scheme provided by the embodiments of the present application solves the problem that a relational database such as a PostgreSQL database lacks an authentication failure processing function, and ensures that the authentication failure processing mechanism is not destroyed or interrupted after database restart or master-slave switchover, so as to continuously process authentication failure cases, enhance the security of the database system, guarantee the continuity of the database security policy, and prevent an attacker from performing a brute force attack on the database.

[0233] In addition, the technical scheme provided by the embodiments of the present application realizes user password fragment prompting, that is, for a user who logs in using a common login address, when the user fails to authenticate for a preset number of times, the user is prompted for a user password fragment and is allowed to input the user password again. This implementation can cope with the scenario that the user password of the database is complex and easy to be misinput, brings convenience to the user without significantly reducing the security, and improves the user friendliness of the database system.

[0234] Corresponding to the above-mentioned database authentication method, the embodiments of the present application also provide a relational database, as shown in the following formula (I): Figure 8 The relational database includes a processor 801 and a machine readable storage medium 802, the machine readable storage medium 802 stores machine executable instructions capable of being executed by the processor 801, and the processor 801 is prompted by the machine executable instructions to implement any of the above-mentioned database authentication methods.

[0235] The machine readable storage medium can include a random access memory (RAM) and can also include a non-volatile memory (NVM), for example, at least one disk memory. Optionally, the machine readable storage medium can also be at least one storage device located away from the aforementioned processor.

[0236] The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0237] In a further embodiment provided in the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the above database authentication methods.

[0238] In a further embodiment provided in the present application, a computer program product containing instructions, which, when executed on a computer, cause the computer to perform any of the above database authentication methods.

[0239] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media (for example, DVD), or semiconductor media (for example, Solid State Disk (SSD)) and the like.

[0240] It should be noted that, in this document, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0241] Various embodiments are described with reference to the related drawings. Identical or similar elements in various embodiments are referred to with identical reference numerals. Each embodiment describes a difference from other embodiments. In particular, the device, relational database, storage medium, and program product embodiments are described simply because they are substantially similar to the method embodiments, and the relevant parts are described with reference to the method embodiment descriptions.

[0242] The above description is merely illustrative of the application, and is not intended to limit the scope of the application. Any modification, equivalent replacement, improvement, and the like made within the spirit and principle of the application shall fall within the scope of the application.

Claims

1. A database authentication method, characterized by, The method is applied to a first relational database, wherein a user state system table is arranged in the first relational database, and the user state system table records a lock state, a login failure number, a list of frequently used login identifiers and a login prompt string of a user; the method comprises the following steps: receiving a first login request sent by a first user; obtaining the lock state of the first user from the user state system table; if the lock state of the first user is a locked state, sending a first login response to the first user, wherein the first login response indicates that the first user fails to log in and is locked, and the locked state indicates that the user is a potential brute force attacker; if the lock state of the first user is an unlocked state, authenticating the first user, wherein the unlocked state indicates that the user is not a potential brute force attacker; if the authentication fails, the login failure number of the first user in the user state system table is less than a preset prompt number, and the current login identifier of the first user is included in the list of frequently used login identifiers of the first user, outputting the login prompt string of the first user in the user state system table; when receiving a second login request sent by the first user, authenticating the first user.

2. The method of claim 1, wherein, The method further comprises the following steps: when a preset condition is met, sending a second login response to the first user, wherein the second login response indicates that the first user fails to log in; increasing the login failure number of the first user in the user state system table by a preset value; if the login failure number of the first user after the preset value is increased is greater than or equal to a maximum attempt number, deleting the current login identifier of the first user from the list of frequently used login identifiers of the first user, and updating the lock state of the first user in the user state system table to the locked state; the preset condition comprises any one of the following conditions: after authenticating the first user when receiving the second login request sent by the first user, the authentication fails; when the lock state of the first user is the unlocked state, after authenticating the first user, the authentication fails, but the login failure number of the first user in the user state system table is greater than or equal to the preset prompt number, and / or the list of frequently used login identifiers of the first user does not include the current login identifier of the first user.

3. The method of claim 1, wherein, The method further comprises the following steps: if the authentication succeeds, adding the current login identifier of the first user to the list of frequently used login identifiers of the first user, and sending a third login response to the first user, wherein the third login response indicates that the first user successfully logs in; clearing the login failure number of the first user in the user state system table.

4. The method according to any one of claims 1 to 3, characterized in that, The user state system table further records a last login failure time of a user; the step of obtaining the lock state of the first user from the user state system table comprises the following steps: obtaining the last login failure time and the lock state of the first user from the user state system table; if the lock state of the first user is the locked state, and a time length from the last login failure time of the first user to a current time is greater than or equal to a failure locking time length, updating the lock state of the first user in the user state system table to the unlocked state; obtaining the updated lock state of the first user from the user state system table.

5. The method according to any one of claims 1 to 3, characterized in that, The user state system table also records a last login failure time of a user; before receiving the first login request sent by the first user, the method further comprises: if the lock state of the first user is the locked state, determining a time length from the last login failure time of the first user in the user state system table to a current time; if the determined time length is greater than or equal to the failure locking time length, updating the lock state of the first user in the user state system table to the unlocked state.

6. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: when detecting that the user password of the first user is updated, extracting a preset number of characters from the updated user password to obtain a new login prompt string of the first user; updating the new login prompt string to the user state system table.

7. A database authentication apparatus characterized by comprising: The method is applied to a first relational database, and the first relational database is provided with a user state system table, the user state system table records a lock state, a login failure number, a commonly used login identifier list and a login prompt string of a user; the device comprises an authentication module and a user module; The authentication module is configured to receive a first login request sent by a first user. The user module is configured to obtain the lock state of the first user from the user state system table. The authentication module is further configured to send a first login response to the first user if the lock state of the first user is the locked state, the first login response indicates that the first user fails to log in and is locked, and the locked state indicates that the user is a potential brute force attacker. The authentication module is further configured to authenticate the first user if the lock state of the first user is the unlocked state, the unlocked state indicates that the user is not a potential brute force attacker, output a login prompt string of the first user in the user state system table if the authentication fails, the login failure number of the first user in the user state system table is less than a preset prompt number, and the current login identifier of the first user is included in the commonly used login identifier list of the first user, and authenticate the first user when receiving a second login request sent by the first user.

8. The apparatus of claim 7, wherein, The authentication module is further configured to send a second login response to the first user when a preset condition is met, the second login response indicates that the first user fails to log in. The user module is further configured to increase the number of login failures of the first user in the user state system table by a preset value when a preset condition is met; and delete the current login identifier of the first user from the frequently-used login identifier list of the first user and update the lock state of the first user in the user state system table to the locked state if the number of login failures of the first user after the increase is greater than or equal to the maximum number of attempts. The preset condition includes any one of the following conditions: authenticating the first user after receiving the second login request sent by the first user, and failing in the authentication; authenticating the first user when the lock state of the first user is the unlocked state, and failing in the authentication, but the number of login failures of the first user in the user state system table is greater than or equal to the preset prompt number, and / or the frequently-used login identifier list of the first user does not include the current login identifier of the first user.

9. The apparatus of claim 7, wherein The authentication module is further configured to send a third login response to the first user if the authentication succeeds, the third login response indicating that the first user logs in successfully. The user module is further configured to add the current login identifier of the first user to the frequently-used login identifier list of the first user and clear the number of login failures of the first user in the user state system table.

10. The device of any of claims 7-9, wherein, The user state system table further records a last login failure time of a user; The user module is specifically configured to acquire the last login failure time and the lock state of the first user from the user state system table; update the lock state of the first user in the user state system table to the unlocked state if the lock state of the first user is the locked state and the time length from the last login failure time of the first user to the current time is greater than or equal to a failure locking time length; and acquire the updated lock state of the first user from the user state system table.

11. The device of any of claims 7-9, wherein, The user state system table further records a last login failure time of a user; The user module is further configured to acquire the time length from the last login failure time of the first user to the current time from the user state system table before receiving the first login request sent by the first user if the lock state of the first user is the locked state. The user module is further configured to update the lock state of the first user in the user state system table to the unlocked state if the acquired time length is greater than or equal to the failure locking time length.

12. The apparatus of any one of claims 7-9, wherein The user module is further configured to extract a preset number of characters from an updated user password to obtain a new login prompt string of the first user when detecting that the user password of the first user is updated; and update the new login prompt string to the user state system table.

13. A relational database, characterized by A computer program product comprising a processor and a machine readable storage medium storing machine executable instructions executable by the processor, the processor caused by the machine executable instructions to implement the method steps of any of claims 1-6.

14. A computer-readable storage medium, characterized in that, A computer program product comprising a processor and a machine readable storage medium storing machine executable instructions executable by the processor, the processor caused by the machine executable instructions to implement the method steps of any of claims 1-6.

Images