CN111683067A - A jdbc-based decoration mode and request screening method, system and readable storage medium - Google Patents

Abstract

The invention provides a jdbc-based decoration mode and request screening method, a system and a readable storage medium. Access information is extracted in advance and added to a judgment process queue; the access information is imported into a server through a Jdbc port; the server judges whether the current access information is compliant ; If it does not meet the rules, disconnect the communication connection between the access terminal and the database. No need to obtain switch permissions, safe and reliable. It can monitor sql execution at any time and block illegal operations in time. It can accurately monitor the context of SQL execution, and locate the user, program, and number of rows executed by SQL.

Description

A jdbc-based decoration mode and request screening method, system and readable storage medium

technical field

The present invention relates to the technical field of network communication transmission, in particular to a method, system, device and readable storage medium based on a jdbc decoration mode and request screening method.

Background technique

Based on SQL monitoring of network packets, the system captures data packets through switches, transmits packets through the network, analyzes the execution of database SQL, and analyzes the HTTP packets sent to the monitored middleware. The correlation reaches the monitoring data. function.

This monitoring method does not require intrusion into the program of the monitored middleware. There is no way to cheat based on network packet middleware. However, there are also certain shortcomings, such as the need to obtain switch permissions for complex deployment, which has a certain impact on network security. Different types of databases have different message structures and can only support limited centralized databases. Due to the complexity of network transmission data, the monitoring accuracy needs to be improved.

SUMMARY OF THE INVENTION

In order to overcome the deficiencies in the above-mentioned prior art, the present invention provides a jdbc-based decoration mode and a request screening method, the method comprising:

Extract access information and join the judgment process queue;

Import the access information into the server through the Jdbc port;

The server determines whether the current access information is compliant;

If it does not meet the rules, disconnect the communication connection between the access terminal and the database.

It should be further noted that the steps of extracting access information and adding it to the judgment process queue also include:

Before connecting to the database, the access terminal sends the requested database address port and identity information to the server through the Jdbc port;

The server verifies the identity information of the access terminal;

The identity information of the access terminal is matched with the database requested to be accessed, and whether the access rights are satisfied.

It should be further noted that the step server judging whether the current access information is compliant also includes:

Obtain user information, sql information, access time information and database operation function information in the access information;

Extract the access time information in the access information;

Judging whether the access time information meets the access time period requirement;

If the access time period requirement is met, it is then judged whether the user information meets the access authority information.

It should be further noted that, if the permission information is satisfied, the permission information and the database operation function information are matched to determine whether the database operation function information satisfies the access permission.

It should be further noted that, if the steps do not conform to the rules, the communication connection between the access terminal and the database is disconnected, and further includes:

Get the address and user information of the current access terminal, and update the address and user information in the blacklist.

The present invention also provides a jdbc-based decoration mode and request screening system, including: a server and a database;

The server is configured with a judgment process queue; the access information of the access terminal is received through the Jdbc port, and configured to the judgment process queue; the access information is called from the judgment process queue according to the preset order to judge whether the current access information is compliant;

If it is compliant, establish a communication connection between the access end and the database.

It should be further noted that the server is also used to configure the access time period of the database and configure different access time periods for different access rights of users.

It should be further noted that the server is also used to match the access terminal and access permission rules;

Filter the SQL access instructions in the access information, and match the SQL access instructions with the access authority rules to execute the SQL access instructions matched with the access authority rules.

It should be further noted that the server is configured with a blacklist, and the address information of the illegal access terminal is configured into the blacklist.

The present invention also provides a readable storage medium with a jdbc-based decoration mode and a request screening method, wherein the readable storage medium stores a computer program, the computer program is executed by a processor to realize the jdbc-based decoration mode and the request screening method. step.

As can be seen from the above technical solutions, the present invention has the following advantages:

The present invention extracts the access information in advance and joins the judgment process queue; imports the access information into the server through the Jdbc port; the server judges whether the current access information is compliant; No need to obtain switch permissions, safe and reliable. It can monitor sql execution at any time and block illegal operations in time. It can accurately monitor the context of SQL execution, and locate the user, program, and number of rows executed by SQL.

Description of drawings

In order to illustrate the technical solutions of the present invention more clearly, the accompanying drawings required in the description will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention, which are not relevant to ordinary skills in the art. As far as personnel are concerned, other drawings can also be obtained from these drawings on the premise of no creative work.

Figure 1 is a flowchart of the jdbc-based decoration mode and request screening method;

Figure 2 is a schematic diagram of a jdbc-based decoration mode and a request screening system.

Detailed ways

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. Interchangeability, the above description has generally described the components and steps of each example in terms of function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

The block diagrams shown in the figures are merely functional entities and do not necessarily necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices entity.

In the present invention, SQL is a structured query language (Structured Query Language), a special purpose programming language, a database query and programming language, used for accessing data and querying, updating and managing relational database systems.

Java Database Connectivity, (Java Database Connectivity, JDBC for short) is an application program interface in the Java language used to standardize how client programs access the database, providing methods such as querying and updating data in the database.

The present invention specifically relates to a jdbc-based decoration mode and a request screening method, as shown in FIG. 1 , the method includes:

In the method of the present invention, the server filters user information. It can intercept user access page, session (including login data) and other information.

S101, extract the access information and join the judgment process queue;

In this step, before connecting to the database, the access terminal sends the database address port and identity information of the requested access to the server through the Jdbc port; the server verifies the identity information of the access terminal; matches the identity information of the access terminal with the database requested to be accessed, Whether the access rights are satisfied.

S102, import the access information into the server through the Jdbc port;

S103, the server judges whether the current access information is compliant;

Specifically, obtaining user information, sql information, access time information and database operation function information in the access information; extracting the access time information in the access information; judging whether the access time information meets the access time period requirement;

If the access time period requirement is met, it is then judged whether the user information meets the access authority information.

If the permission information is satisfied, the permission information is matched with the database operation function information to determine whether the database operation function information satisfies the access permission.

S104, if the rules are not met, the communication connection between the access terminal and the database is disconnected.

Get the address and user information of the current access terminal, and update the address and user information in the blacklist.

Based on the above method, the present invention also provides a jdbc-based decoration mode and request screening system, as shown in FIG. 2 , including: a server 1 and a database 2;

The server is configured with a judgment process queue; the access information of the access terminal 3 is received through the Jdbc port, and configured to the judgment process queue; the access information is called from the judgment process queue according to the preset order to judge whether the current access information is compliant; The terminal establishes a communication connection with the database.

The server uses the decoration mode to write a new jdbc program to wrap the native jdbc. It mainly decorates the main class methods such as Driver, Connection, PreparedStatement, and Statement. Contact the server before and after the sql call to transmit user information, sql information, and function call information to the monitoring server, which can also interrupt illegal operations and play a control role.

The server is also used to configure the access time period of the database and configure different access time periods for different access rights of users.

Match the access terminal and the access authority rules; filter the SQL access instructions in the access information, and match the SQL access instructions with the access authority rules to execute the SQL access instructions that match the access authority rules.

The server configures a blacklist, and configures the address information of the illegal access terminals into the blacklist.

The server can also access the server based on the Jdbc probe to determine whether the current application is available.

Further 301 When the dirve is registered for the first time, the monitored system requests the real database address port from the server.

302 When calling drive, the decorated drive intercepts the connect method and asks the server whether the monitored system can execute sql

302 The server responds and returns the monitored system information

303 If the server disables the monitored link, it directly throws an exception to end the execution

The jdbc probe combines SQL information and user information before native jdbc executes SQL and sends it to the server for storage.

The server judges whether the current SQL is compliant

If it does not conform to the rules, throw an exception directly to interrupt the operation

If it is compliant, submit the SQL information to the native driver for execution.

There is no need to obtain switch permissions here, which is safe and reliable. It can monitor sql execution at any time and block illegal operations in time. It can accurately monitor the context of sql execution, locate the user, program, and number of lines executed by sql

Based on the above method and system, the present invention also provides a readable storage medium with a jdbc-based decoration mode and a request screening method. The readable storage medium stores a computer program, and the computer program is executed by a processor to realize the jdbc-based decoration mode. Steps with request filter method.

The readable storage medium with the jdbc-based decoration mode and the request filtering method may adopt any combination of one or more readable mediums. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

The above description of the disclosed embodiments enables any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (10)

1. a method based on jdbc decoration pattern and request screening, is characterized in that, method comprises: Extract access information and join the judgment process queue; Import the access information into the server through the Jdbc port; The server determines whether the current access information is compliant; If it does not meet the rules, disconnect the communication connection between the access terminal and the database. 2. The method according to claim 1, wherein The steps of extracting access information and adding it to the judgment process queue also include: Before connecting to the database, the access terminal sends the requested database address port and identity information to the server through the Jdbc port; The server verifies the identity information of the access terminal; The identity information of the access terminal is matched with the database requested to be accessed, and whether the access rights are satisfied. 3. The method according to claim 1, wherein Step The server determines whether the current access information is compliant and includes: Obtain user information, sql information, access time information and database operation function information in the access information; Extract the access time information in the access information; Judging whether the access time information meets the access time period requirement; If the access time period requirement is met, it is then judged whether the user information meets the access authority information. 4. The method of claim 3, wherein If the permission information is satisfied, the permission information is matched with the database operation function information to determine whether the database operation function information satisfies the access permission. 5. The method of claim 3, wherein The steps of disconnecting the communication connection between the access terminal and the database if it does not conform to the rules also include: Get the address and user information of the current access terminal, and update the address and user information in the blacklist. 6. A system based on jdbc decoration mode and request screening, characterized in that, comprising: a server and a database; The server is configured with a judgment process queue; the access information of the access terminal is received through the Jdbc port, and configured to the judgment process queue; the access information is called from the judgment process queue according to the preset order to judge whether the current access information is compliant; If it is compliant, establish a communication connection between the access end and the database. 7. The system of claim 6, wherein: The server is also used to configure the access time period of the database and configure different access time periods for users with different access rights. 8. The system of claim 6, wherein: The server is also used to match the access terminal and access permission rules; Filter the SQL access instructions in the access information, and match the SQL access instructions with the access authority rules to execute the SQL access instructions matched with the access authority rules. 9. The system of claim 6, wherein The server configures a blacklist, and configures the address information of the illegal access terminals into the blacklist. 10. A readable storage medium with a jdbc-based decoration mode and a request screening method, characterized in that, a computer program is stored on the readable storage medium, and the computer program is executed by the processor to achieve any of claims 1 to 5. One of the described steps based on the jdbc decoration pattern and request filtering method.

Images