WO2017020744A1 - 数据库连接建立方法及装置 - Google Patents

数据库连接建立方法及装置 Download PDF

Info

Publication number
WO2017020744A1
WO2017020744A1 PCT/CN2016/091523 CN2016091523W WO2017020744A1 WO 2017020744 A1 WO2017020744 A1 WO 2017020744A1 CN 2016091523 W CN2016091523 W CN 2016091523W WO 2017020744 A1 WO2017020744 A1 WO 2017020744A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
connection
super
proxy server
management system
Prior art date
Application number
PCT/CN2016/091523
Other languages
English (en)
French (fr)
Inventor
赵建伟
Original Assignee
阿里巴巴集团控股有限公司
赵建伟
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 赵建伟 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2017020744A1 publication Critical patent/WO2017020744A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/21—Design, administration or maintenance of databases
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services

Definitions

  • the present application belongs to the field of data processing technologies, and in particular, to a database connection establishment method and apparatus.
  • the database management system is used to establish, use and maintain the database, and the database is managed and controlled in a unified manner.
  • the user accesses the database through the database management system.
  • the user accesses the database through the database management system and needs to connect to the database management system.
  • the database connection also refers to the connection with the database management system.
  • the database management system first needs to perform user authentication.
  • the client provides user authentication information, including the user name and password, to implement the process of connecting the user to the database management system.
  • the user authentication process not only needs to provide user authentication information, but also needs to provide a unique address identifier of the client, so that the user authentication information and the client address identifier are used in the database.
  • the management system creates a user, only the clients identified by the address can be allowed to connect to the database management system.
  • the client directly connects to the database management system, but in order to facilitate management and control of the connection, the prior art also provides a proxy server (Proxy).
  • the way the database connection is established that is, the client first connects to the proxy server, sends the user authentication information to the proxy server, and the proxy server forwards the user authentication information to the database management system to establish a connection with the database management system, but this
  • the database connection method cannot authenticate the client address identifier, resulting in lower security. Because the database connection establishment method is adopted, the proxy server needs to be connected with the database management system, and the address identifier of the proxy server and the address identifier of the client may be It is not the same, user authentication will fail.
  • the technical problem to be solved by the present application is to provide a method and device for establishing a database connection, which not only ensures the security of the connection, but also facilitates the management and control of the connection.
  • a database connection establishment method including:
  • the proxy server uses the user authentication information of the super user and the address identifier of the proxy server to perform authentication in the database management system, and establishes a super user connection with the database management system;
  • the user authentication information of the ordinary user sent by the client and the identifier of the client to be authenticated are forwarded to the database management system by using the super user connection;
  • the database management system is triggered to convert the authority of the super user to the authority of the ordinary user after the normal user authentication is passed, so that the super user connection is converted into a common user connection.
  • the database management system includes a main library and a standby database
  • the proxy server uses the user authentication information of the super user and the address identifier of the proxy server to perform authentication in the database management system, and establishes and manages the database management system.
  • Superuser connections include:
  • the proxy server uses the user authentication information of the super user and the address identifier of the proxy server to perform authentication in the main library to establish a super user connection with the main library.
  • the method further includes:
  • the user authentication information of the super user and the address identifier of the proxy server are used for authentication in the standby database, and a super user connection with the standby database is established;
  • the triggering the standby database converts the authority of the super user connected to the standby database into the permission of the ordinary user, so that the super user connection established with the standby database is converted into a common user connection.
  • the user authentication information of the super user and the address identifier of the proxy server are pre-created.
  • a database connection establishment method includes:
  • the database management system authenticates the user authentication information of the super user sent by the proxy server and the address identifier of the proxy server;
  • the authority of the super user is converted into the authority of the ordinary user, so that the super user connection is converted into a normal user connection.
  • a database connection establishing device includes:
  • a first connection module configured to use the user authentication information of the super user, and the address identifier of the proxy server to perform authentication in the database management system, and establish a super user connection between the proxy server and the database management system;
  • a forwarding module configured to forward the user authentication information of the ordinary user sent by the client, and the identifier of the client to be authenticated, to the database management system by using the super user connection;
  • a first conversion module configured to trigger the database management system, after the normal user authentication is passed, converting the authority of the super user to the authority of the ordinary user, so that the super user connection is converted into a common user connection .
  • the database management system includes a main library and a standby database
  • the first connection module is specifically configured to:
  • the user authentication information of the super user and the address identifier of the proxy server are used to perform authentication in the main library of the database management system, and the super user connection of the proxy server with the main library of the database management system is established.
  • the method further comprises:
  • a second connection module configured to use the user authentication information of the super user and the address identifier of the proxy server to perform authentication in the standby database of the database management system when the primary library is abnormal, and establish the proxy The server is connected to the super user of the standby database;
  • a second conversion module configured to trigger the standby database to convert the authority of the super user connected to the standby database to the permission of the ordinary user, so that the super user connection established with the standby database is converted into an ordinary user connection.
  • a database connection establishing device includes:
  • a first authentication module configured to authenticate user authentication information of the super user sent by the proxy server, and an address identifier of the proxy server;
  • a third connection module configured to establish a super user connection with the proxy server after the super user authentication is passed;
  • a second authentication module configured to authenticate user authentication information of the ordinary user sent by the proxy server by using the super user connection, and an address identifier to be authenticated
  • a fourth connection module configured to convert, according to the triggering command of the proxy server, the authority of the super user to the authority of the ordinary user after the normal user authentication is passed, so that the super user connection is converted into Ordinary user connection.
  • the method further comprises:
  • a first pre-creation module configured to create the ordinary user by using user authentication information of a common user and a client address identifier of a common user;
  • the second pre-creation module is configured to create the super user by using user authentication information of the super user and a proxy server address identifier.
  • a super user connection between the proxy server and the database management system is established, and the user authentication information of the ordinary user and the address to be authenticated are forwarded to the database management system by using the connection of the super user, so that the database management system can authenticate the ordinary user accordingly. Since the address to be authenticated is provided by the client of the ordinary user, the ordinary user can pass the authentication on the premise that the user has been created. After the authentication is passed, the database management system can reduce the power of the super user and convert it to the rights of the ordinary user, so that the connection with the super user of the database management system becomes a common user connection, thereby realizing the common user through the proxy server.
  • a database connection allows database access. The embodiment of the present application not only facilitates the management and control of the connection, but also ensures the security of the connection.
  • FIG. 1 is a flowchart of an embodiment of a database connection establishment method according to an embodiment of the present application
  • FIG. 2 is a flowchart of still another embodiment of a database connection establishing method according to an embodiment of the present application
  • FIG. 3 is a flowchart of still another embodiment of a database connection establishment method according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of an embodiment of a database connection establishing apparatus according to an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of still another embodiment of a database connection establishing apparatus according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of still another embodiment of a database connection establishing apparatus according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an embodiment of a database connection establishment system according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of still another embodiment of a database connection establishment system according to an embodiment of the present application.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device.
  • computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.
  • FIG. 1 is a flowchart of an embodiment of a method for establishing a database connection according to an embodiment of the present disclosure. The method may include the following steps:
  • the proxy server uses the user authentication information of the super user and the address identifier of the proxy server to perform authentication in the database management system, and establishes a super user connection with the database management system.
  • the user authentication information of the ordinary user sent by the client and the identifier of the client to be authenticated are forwarded to the database management system by using the super user connection.
  • Trigger the database management system after the normal user authentication is passed, convert the authority of the super user to the authority of the ordinary user, so that the super user connection is converted into a common user connection.
  • the user authentication information may include a username and a password.
  • Superuser is a special user for system management, compared to ordinary users. Users have the highest authority, can perform system-wide configuration, maintenance, etc., and do a lot of things that ordinary users do not have permission to do; while ordinary users' permissions are generally a subset of super users, only with some of their permissions.
  • the embodiment of the present application is implemented based on the system architecture of the client, the proxy server, and the database management system, and the client establishes a connection with the proxy server, and forwards the authentication information through the proxy server to implement the connection with the database management system.
  • the traffic is via the proxy server, which facilitates connection management and control operations such as flow control, forwarding, and read-write control.
  • the address identifier to be authenticated in the embodiment of the present application refers to the address identifier of the client, and the client can use the address identifier of the client to request to create a user in the database management system, so that only the user created by the client having the address identifier is created. Only then can pass the certification.
  • the super user is created when the database management system is established, and the user authentication information of the super user and the address identifier of the proxy server are pre-created. Since the super user is a high-privileged user, the proxy server can obtain its user authentication information, thus making only the user authentication information The proxy server is able to establish a superuser connection with the database management system.
  • the proxy server can authenticate with the user authentication information of the super user, and the database management system determines that the user authentication information of the super user matches the user authentication information of the storage super user, and the address identifier of the proxy server that sends the authentication request and the stored super user The address identifier matches, and the super user level is authenticated, so that the proxy server can establish a super user connection with the database management system.
  • the ordinary user is requested by the client to use the user authentication information of the ordinary user and the address identifier of the client to request the database management system to be created. Therefore, only the device having the client address identifier is allowed to connect with the ordinary user of the database management system.
  • the ordinary user created by the client in the database management system may be inconsistent in the way that the address identifier of the client and the identifier of the proxy server are different.
  • the user authentication fails. Because the proxy server needs to establish a connection with the database management system and forward the user authentication information to the database management system, the database management system will know the address identifier of the proxy server, which is inconsistent with the address identifier of the client at the time of creation, which will result in user authentication. Failure, the proxy server could not connect to the database management system.
  • the super user connection between the proxy server and the database management system can be established first. After the super user connection is established between the proxy server and the database management system, the user authentication information of the ordinary user and the address to be authenticated can be forwarded. To the database management system, the database management system can obtain the user authentication information of the ordinary user and the address identifier to be authenticated, so that the ordinary user can be authenticated accordingly, and the ordinary user is provided because the address to be authenticated is provided by the client of the ordinary user. On the premise that has been created, it can be authenticated.
  • the database management system can reduce the power of the super user and convert it to the rights of the ordinary user, so that the super server connection between the proxy server and the database management system becomes a common user connection, thereby realizing the ordinary user through the proxy server.
  • Database access is achieved, which allows database access.
  • the database management system can be specifically a relational database management system, such as MySQL.
  • 192.168.0.2 is the address identifier of the proxy server.
  • My_user is the username and my_pass is the user password.
  • the proxy server can obtain my_user and my_pass, and use my_user and my_pass for authentication. Since the super user's creation address is 192.168.0.2, the my_user and my_pass provided by the proxy server will pass the authentication, so that it can be established. Connect to the superuser of the database management system.
  • the establishment of the super user connection may be established after the proxy server receives the authentication request of the ordinary user, that is, the user authentication information of the ordinary user and the address identifier to be authenticated, and the user authentication information of the ordinary user and the authentication to be authenticated.
  • the address identification is established before, and this application limits this.
  • the proxy server forwards the user authentication information of the ordinary user and the identifier to be authenticated to the database management system through the super user connection.
  • the user authentication information of the ordinary user and the address identifier to be authenticated may be carried in the triggering life.
  • the triggering command is used to trigger the database management system, and after the normal user authentication is passed, the authority of the super user is converted into the authority of the ordinary user.
  • the user authentication problem is solved.
  • the address identifier is unique, and a possible implementation manner, the address identifier may be an IP address (Internet Protocol Address).
  • the database management system usually adopts the deployment structure of the main library and the standby database, so that when the main library is abnormal, it can be switched to the standby database.
  • the connection of the proxy server is established to connect with the main library.
  • the proxy server needs to disconnect from the main library first, and then connect to the standby database, and the client will be aware of the abnormal connection between the proxy server and the database management system.
  • the proxy server uses the user authentication information of the super user, and the address identifier of the proxy server to perform authentication in the main database of the database management system, and establishes a super user connection with the main library of the database management system.
  • Trigger the primary library after the normal user authentication is passed, convert the authority of the super user to the permission of the ordinary user, so that the super user connection is converted into a normal user connection.
  • the proxy server when the main library is abnormal, the proxy server first establishes a super user connection with the standby database, and then converts the super user's permission into the normal user's permission, and the super user's connection becomes the ordinary user's connection. Then, you can cut off the connection with the main library, so that the proxy server can seamlessly switch to the standby database, so that the user can not detect the switch, which can avoid the problem of connection flash. Therefore, after the user successfully and securely establishes a connection with the main database of the database management system through the proxy server, the user can seamlessly switch to the standby database when the main library is abnormal, thereby avoiding the problem of disconnection of the connection and reducing the impact on the user. .
  • FIG. 3 is a flowchart of still another embodiment of a method for establishing a database connection according to an embodiment of the present disclosure. The method may include the following steps:
  • the database management system authenticates the user authentication information of the super user sent by the proxy server, and the address identifier of the proxy server.
  • the authority of the super user is converted into the authority of the ordinary user, so that the super user connection is converted into a normal user connection.
  • the address to be authenticated is an address identifier of the client that provides the user authentication information of the ordinary user connected to the proxy server, and has uniqueness and may be an IP address.
  • the super user is created by using the address identifier of the proxy server, and is a high-privileged user.
  • the proxy server can obtain the user authentication information of the super user.
  • the user authentication information and the to-be-authenticated address identifier of the common user can be carried in the trigger command, and the super user connection becomes the normal user connection by delegating the super user to the authority of the ordinary user.
  • the embodiment of the present application not only ensures the security of the database, but also facilitates the management and control of the connection.
  • FIG. 4 is a schematic structural diagram of an embodiment of a database connection establishing apparatus according to an embodiment of the present application, where the apparatus is specifically applied to a proxy server.
  • the device can include:
  • the first connection module 401 is configured to perform authentication in the database management system by using the user authentication information of the super user and the address identifier of the proxy server, and establish a super user connection between the proxy server and the database management system.
  • the forwarding module 402 is configured to forward the user authentication information of the ordinary user and the address identifier to be authenticated to the database management system by using the super user connection;
  • the first conversion module 403 is configured to trigger the database management system to convert the authority of the super user to the authority of the ordinary user after the normal user is authenticated, so that the super user connection is converted into a normal user connection.
  • the user authentication information may include a username and a password.
  • the super user connection between the proxy server and the database management system may be first established, and the authentication request of the ordinary user may be performed after the super server connection is established between the proxy server and the database management system, and the user authentication information of the ordinary user may be
  • the authentication address identifier is forwarded to the database management system through the super user connection, so that the database management system can obtain the user authentication information of the ordinary user and the address identifier to be authenticated, so that the common user can be authenticated accordingly, because the address to be authenticated is identified as an ordinary user.
  • the client is provided, so the ordinary user can be authenticated by the premise that has been created.
  • the database management system can reduce the power of the super user and convert it to the rights of the ordinary user, thereby connecting with the super user of the database management system to become a common user connection, thereby realizing the ordinary user to implement the database through the proxy server. Connect, you can access the database.
  • the embodiment of the present application not only facilitates the management and control of the connection, but also ensures the security.
  • the super user is created by using the super user's user authentication information and the proxy server's address identifier when the database management system is established. Since the super user is a high-privileged user, the proxy server can obtain its user authentication information, so that only the proxy server can The database management system establishes a superuser connection.
  • the user authentication information of the common user and the identifier of the to-be-authenticated address may be carried in the triggering command, where the triggering command is used to trigger the database management system, and after the normal user authentication is passed, the super user's permission is converted. Permissions for ordinary users. Thus, the user authentication problem is solved.
  • the address identifier is unique, a possible implementation manner, and the address identifier can be an IP address.
  • the database management system usually adopts the deployment structure of the main library and the standby database, so that when the main library is abnormal, it can be switched to the standby database.
  • the database management system includes a main library and a standby database, and the first connection module may be specifically configured to:
  • the user authentication information of the super user and the address identifier of the proxy server are used for authentication in the main database of the database management system, and a super user connection with the main library of the database management system is established.
  • FIG. 5 a schematic structural diagram of another embodiment of the database connection establishing apparatus provided in the embodiment of the present application may include:
  • the first connection module 501 is configured to perform authentication in the main database of the database management system by using the user authentication information of the super user and the address identifier of the proxy server, and establish a super user connection with the main library of the database management system;
  • the forwarding module 502 is configured to forward the user authentication information of the ordinary user and the address identifier to be authenticated to the main library by using the super user connection;
  • the first conversion module 503 is configured to trigger the main library, and after the normal user is authenticated, convert the authority of the super user to the authority of the ordinary user, so that the super user connection is converted into a normal user connection.
  • a second connection module 504 configured to utilize a user of the super user when the main library is abnormal
  • the authentication information, and the address identifier of the proxy server are authenticated in the standby database of the database management system, and a super user connection with the standby database is established.
  • a second conversion module 505 configured to trigger the standby database to convert the authority of the super user connected to the standby database to the authority of the ordinary user, so that the super user connection established with the standby database is converted into an ordinary User connection.
  • the proxy server when the main library is abnormal, the proxy server first establishes a super user connection with the standby database, and then converts the super user's permission into the normal user's permission, and the super user's connection becomes the ordinary user's connection. Then, you can cut off the connection with the main library, so that the proxy server can seamlessly switch to the standby database, so that the user can not detect the switch, so as to avoid the problem of flashing. Therefore, after the user successfully and securely establishes a connection with the main database of the database management system through the proxy server, the user can seamlessly switch to the standby database when the main library is abnormal, thereby avoiding the problem of disconnection of the connection and reducing the impact on the user. .
  • FIG. 6 is a schematic structural diagram of another embodiment of a database connection establishment apparatus according to an embodiment of the present disclosure.
  • the apparatus is specifically applied to a database management system, and may include:
  • the first authentication module 601 is configured to authenticate user authentication information of the super user sent by the proxy server, and an address identifier of the proxy server.
  • a third connection module 602 configured to establish a super user connection with the proxy server after the super user authentication is passed;
  • a second authentication module 603, configured to authenticate user authentication information of the ordinary user and the to-be-authenticated address identifier sent by the proxy server by using the super user connection;
  • the fourth connection module 604 is configured to convert, according to the triggering command of the proxy server, the authority of the super user to the authority of the ordinary user after the normal user authentication is passed, so that the super user connection is converted. Connect for regular users.
  • the address to be authenticated is an address identifier of the client that provides the user authentication information of the ordinary user connected to the proxy server, and has uniqueness and may be an IP address.
  • the super user is created by using the address identifier of the proxy server, and is a high-privileged user.
  • the proxy server can obtain the user authentication information of the super user.
  • the user authentication information and the to-be-authenticated address identifier of the common user can be carried in the trigger command, and the super user connection becomes the normal user connection by delegating the super user to the authority of the ordinary user.
  • the database management system needs to create super users as well as ordinary users, super users and ordinary users to authenticate.
  • the device can also include:
  • a first pre-creation module configured to create the ordinary user by using user authentication information of a common user and a client address identifier of a common user;
  • the second pre-creation module is configured to create the super user by using user authentication information of the super user and a proxy server address identifier.
  • the second pre-creation module creates a super user when the database management system is established.
  • the first pre-creation module may be to create a normal user when there is a normal user creation request.
  • the embodiment of the present application not only ensures the security of the database, but also facilitates the management and control of the connection.
  • the embodiment of the present application further provides a database connection establishment system.
  • the system may include a client 701, a proxy server 702, and a database management system 703.
  • the client 701 is configured to send user authentication information of an ordinary user to the proxy server 702.
  • the proxy server 702 is configured to perform authentication in a database management system by using user authentication information of the super user and an address identifier of the proxy server, and establish a super user connection with the database management system; and the client 701
  • the user authentication information of the sent ordinary user and the address identifier of the client 701 are sent to the database management system 703; the database management system 703 is triggered to authorize the super user after the ordinary user authentication is passed. Converting to the rights of the normal user causes the super user connection to be converted to a normal user connection.
  • the database management system 703 is configured to authenticate the user authentication information of the super user sent by the proxy server 702 and the address identifier of the proxy server 702; after the super user authentication is passed, establish the relationship with the proxy server 702. Superuser connection; to the agent
  • the server 702 performs authentication by using the user authentication information of the ordinary user and the address to be authenticated sent by the super user connection; according to the triggering command of the proxy server 702, after the ordinary user is authenticated, the super user is authorized. Converting to the rights of the normal user causes the super user connection to be converted to a normal user connection.
  • the database management system 703 may include a main library 801 and a standby database 802.
  • the proxy server 702 specifically uses the user authentication information of the super user and the address identifier of the proxy server 702 to perform authentication in the main library 801, establishes a super user connection with the main library 801, and sends the client 701.
  • the user authentication information of the ordinary user and the address identifier of the client 701 are sent to the main library 801; the main library 801 is triggered, and after the normal user authentication is passed, the authority of the super user is converted into the The rights of the ordinary user, so that the super user connection is converted into a normal user connection;
  • the standby database 801 converts the authority of the super user connected to the standby database into the authority of the ordinary user, so that the super user connection established with the standby database is converted into a normal user connection.
  • the main library 801 in the database management system is configured to authenticate the user authentication information of the super user sent by the proxy server 702 and the address identifier of the proxy server 702; after the super user authentication is passed, establish and cooperate a super user connection of the proxy server 702; authenticating the user authentication information of the ordinary user sent by the proxy server 702 through the super user connection and the address to be authenticated; according to the trigger command of the proxy server 702, After the normal user authentication is passed, the authority of the super user is converted into the authority of the ordinary user, so that the super user connection is converted into a normal user connection;
  • the standby database 802 in the database management system is configured to authenticate the user authentication information of the super user sent by the proxy server 702 and the address identifier of the proxy server 702; after the super user authentication is passed, establish a a super user connection of the proxy server 702; converting the authority of the super user to the normal according to a trigger command of the proxy server 702 The user's permissions cause the super user connection to be converted to a normal user connection.
  • the embodiment of the present application not only ensures the security of the database, but also facilitates the management and control of the connection, and also avoids the problem that the user connection is interrupted due to the switching between the active and standby databases.
  • first device if a first device is coupled to a second device, the first device can be directly electrically coupled to the second device, or electrically coupled indirectly through other devices or coupling means. Connected to the second device.
  • the description of the specification is intended to be illustrative of the preferred embodiments of the invention. The scope of protection of the application is subject to the definition of the appended claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种数据库连接建立方法及装置，所述方法包括：代理服务器利用超级用户的用户认证信息，以及所述代理服务器的地址标识在数据库管理系统中进行认证，建立与所述数据库管理系统的超级用户连接；将客户端发送的普通用户的用户认证信息以及所述客户端的待认证地址标识，通过所述超级用户连接转发至数据库管理系统；触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。本申请实施例既保证了安全性，同时方便了对连接的管理和控制。

Description

数据库连接建立方法及装置 技术领域
本申请属于数据处理技术领域，具体地说，涉及一种数据库连接建立方法及装置。
背景技术
数据库管理系统用于建立、使用和维护数据库，对数据库进行统一的管理和控制，用户通过数据库管理系统实现对数据库的访问。
用户通过数据库管理系统对数据库的访问，需要连接到数据库管理系统中，数据库连接也即是指与数据库管理系统的连接。数据库管理系统首先需要进行用户认证，用户认证是指按照数据库管理系统协议，客户端提供用户认证信息，主要包括用户名和密码，实现用户连接到数据库管理系统的过程。
为了保证连接安全性，在现有的一种数据库连接建立方式中，用户认证过程，不仅需要提供用户认证信息，还需要提供客户端的唯一地址标识，使得利用用户认证信息和客户端地址标识在数据库管理系统创建用户之后，只能允许该地址标识的客户端连接到数据库管理系统。
在上述现有的这种数据库连接方式中，是通过客户端直接连接到数据库管理系统中，但是为了方便对连接进行管理和控制，现有技术中还提供了一种通过代理服务器(Proxy)实现数据库连接建立的方式，也即客户端首先连接到代理服务器，将用户认证信息发送至代理服务器，代理服务器再将用户认证信息转发至数据库管理系统，以建立与数据库管理系统的连接，但是这种数据库连接方式，无法实现客户端地址标识的认证，导致安全性较低，因为如果采用这种数据库连接建立方式，代理服务器需要和数据库管理系统连接，而代理服务器的地址标识和客户端的地址标识可能是不一样的，用户认证就会失败。
发明内容
有鉴于此，本申请所要解决的技术问题是提供了一种数据库连接建立方法及装置，既保证了连接的安全性，同时方便了连接的管理和控制。
为了解决上述技术问题，本申请公开了一种数据库连接建立方法，包括：
代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在数据库管理系统中进行认证，建立与所述数据库管理系统的超级用户连接；
将客户端发送的普通用户的用户认证信息以及所述客户端的待认证地址标识，通过所述超级用户连接转发至所述数据库管理系统；
触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
优选地，所述数据库管理系统包括主库和备库，所述代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在数据库管理系统中进行认证，建立与所述数据库管理系统的超级用户连接包括：
代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在主库中进行认证，建立与所述主库的超级用户连接。
优选地，在将所述超级用户的权限转换为普通用户的权限，使得所述超级用户连接转换为普通用户连接之后，所述方法还包括：
在所述主库异常时，利用所述超级用户的用户认证信息，以及所述代理服务器的地址标识在所述备库中进行认证，建立与所述备库的超级用户连接；
触发所述备库将与所述备库连接的所述超级用户的权限转换为所述普通用户的权限，使得与所述备库建立的超级用户连接转换为普通用户连接。
优选地，所述超级用户为所述数据库管理系统建立时，利用超级用户的用户认证信息以及所述代理服务器的地址标识预先创建的。
一种数据库连接建立方法，包括：
数据库管理系统对代理服务器发送的超级用户的用户认证信息，以及所述代理服务器的地址标识进行认证；
在所述超级用户认证通过之后，建立与所述代理服务器的超级用户连接；
对所述代理服务器通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；
根据所述代理服务器的触发命令，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
一种数据库连接建立装置，包括：
第一连接模块，用于利用超级用户的用户认证信息，以及代理服务器的地址标识在数据库管理系统中进行认证，建立所述代理服务器与所述数据库管理系统的超级用户连接；
转发模块，用于将客户端发送的普通用户的用户认证信息以及所述客户端的待认证地址标识，通过所述超级用户连接转发至所述数据库管理系统；
第一转换模块，用于触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
优选地，所述数据库管理系统包括主库和备库，所述第一连接模块具体用于：
利用超级用户的用户认证信息以及代理服务器的地址标识，在数据库管理系统的主库中进行认证，建立所述代理服务器与所述数据库管理系统的主库的超级用户连接。
优选地，还包括：
第二连接模块，用于在所述主库异常时，利用所述超级用户的用户认证信息，以及所述代理服务器的地址标识在所述数据库管理系统的备库中进行认证，建立所述代理服务器与所述备库的超级用户连接；
第二转换模块，用于触发所述备库将与所述备库连接的所述超级用户的权限转换为所述普通用户的权限，使得与所述备库建立的超级用户连接转换为普通用户连接。
一种数据库连接建立装置，包括：
第一认证模块，用于对代理服务器发送的超级用户的用户认证信息，以及所述代理服务器的地址标识进行认证；
第三连接模块，用于在所述超级用户认证通过之后，建立与所述代理服务器的超级用户连接；
第二认证模块，用于对所述代理服务器通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；
第四连接模块，用于根据所述代理服务器的触发命令，在所述普通该用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
优选地，还包括：
第一预创建模块，用于利用普通用户的用户认证信息以及普通用户的客户端地址标识，创建所述普通用户；
第二预创建模块，用于利用超级用户的用户认证信息以及代理服务器地址标识，创建所述超级用户。
与现有技术相比，本申请可以获得包括以下技术效果：
首先建立代理服务器与数据库管理系统的超级用户连接，利用该超级用户的连接将普通用户的用户认证信息以及待认证地址标识转发至数据库管理系统，从而数据库管理系统可以据此对普通用户进行认证，由于待认证地址标识为普通用户的客户端提供的，因此普通用户在已创建的前提，即可以认证通过。认证通过之后，数据库管理系统可以将超级用户进行降权，将其转换为普通用户的权限，使得与数据库管理系统的超级用户连接即变为普通用户连接，从而实现了普通用户通过代理服务器实现的数据库连接，即可以进行数据库访问。本申请实施例既方便了对连接的管理和控制，同时还保证了连接的安全性。
当然，实施本申请的任一产品必不一定需要同时达到以上所述的所有技术效果。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是本申请实施例的一种数据库连接建立方法一个实施例的流程图；
图2是本申请实施例的一种数据库连接建立方法又一个实施例的流程图；
图3是本申请实施例的一种数据库连接建立方法又一个实施例的流程图；
图4是本申请实施例的一种数据库连接建立装置一个实施例的结构示意图；
图5是本申请实施例的一种数据库连接建立装置又一个实施例的结构示意图；
图6是本申请实施例的一种数据库连接建立装置又一个实施例的结构示意图；
图7是本申请实施例的一种数据库连接建立系统一个实施例的结构示意图；
图8是本申请实施例的一种数据库连接建立系统又一个实施例的结构示意图。
具体实施方式
以下将配合附图及实施例来详细说明本申请的实施方式，藉此对本申请如何应用技术手段来解决技术问题并达成技术功效的实现过程能充分理解并据以实施。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
图1为本申请实施例提供的一种数据库连接建立方法一个实施例的流程图，该方法可以包括以下几个步骤：
101：代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在数据库管理系统中进行认证，建立与数据库管理系统的超级用户连接。
102：将客户端发送的普通用户的用户认证信息以及所述客户端的待认证地址标识，通过所述超级用户连接转发至数据库管理系统。
103：触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为普通用户的权限，使得所述超级用户连接转换为普通用户连接。
其中，用户认证信息可以包括用户名和密码。
超级用户(Superuser)是一种用于进行系统管理的特殊用户，相比普通 用户来说，拥有最高权限，能够进行全系统的配置、维护等工作，做很多普通用户没有权限做的事情；而普通用户的权限一般是超级用户的子集，只具备其部分权限。
本申请实施例基于客户端、代理服务器以及数据库管理系统的系统架构实现，客户端与代理服务器建立连接，通过代理服务器转发认证信息，实现与数据库管理系统的连接。通过代理服务器，流量均经由代理服务器，可以方便实现流量控制、转发、读写控制等连接管理和控制操作。
本申请实施例中的待认证地址标识也即是指客户端的地址标识，客户端可以利用自身的地址标识在数据库管理系统中请求创建用户，从而使得只有具有该地址标识的该客户端创建的用户才可以认证通过。
超级用户是在数据库管理系统建立时，即创建的，利用超级用户的用户认证信息以及代理服务器的地址标识预先创建，由于超级用户为高权限用户，代理服务器可以获得其用户认证信息，因此使得只有代理服务器能够与数据库管理系统建立超级用户连接。
代理服务器可以利用超级用户的用户认证信息进行认证，数据库管理系统在确定超级用户的用户认证信息与存储超级用户的用户认证信息匹配，且发送认证请求的代理服务器的地址标识与存储的超级用户的地址标识匹配，超级用户级即认证通过，从而代理服务器可以与数据库管理系统建立超级用户连接。
而普通用户是由客户端，利用普通用户的用户认证信息以及客户端的地址标识，请求数据库管理系统创建的，因此只允许具有客户端地址标识的设备与数据库管理系统的普通用户连接。
在现有技术中，客户端在数据库管理系统创建的普通用户，由于客户端的地址标识与代理服务器的标识可能不一致，在通过代理服务器实现数据库连接建立的方式中，会导致用户认证失败。因为代理服务器需要先与数据库管理系统建立连接，将用户认证信息转发至数据库管理系统，数据库管理系统即会获知代理服务器的地址标识，其与创建时的客户端的地址标识不一致，即会导致用户认证失败，代理服务器也无法连接到数据库管理系统。
因此，为了方便对连接的管理和控制，同时保证安全性，本申请实施例 中，可以首先建立代理服务器与数据库管理系统的超级用户连接，对普通用户的认证请求，在代理服务器与数据库管理系统建立超级用户连接之后，可以将普通用户的用户认证信息以及待认证地址标识转发至数据库管理系统，从而数据库管理系统可以获得普通用户的用户认证信息以及待认证地址标识，从而可以据此对普通用户进行认证，由于待认证地址标识为普通用户的客户端提供的，因此普通用户在已创建的前提，即可以认证通过。认证通过之后，数据库管理系统可以将超级用户进行降权，将其转换为普通用户的权限，从而代理服务器与数据库管理系统的超级用户连接即变为普通用户连接，从而实现了普通用户通过代理服务器实现数据库连接，即可以进行数据库访问。
在一个实际应用中，该数据库管理系统可以具体为关系型数据库管理系统，例如MySQL。
在MySQL中，超级用户的创建，举例说明，可以采用如下命令格式：
Grant select on test.*to my_user@’192.168.0.2’identified by‘my_pass’
其中，192.168.0.2即为代理服务器的地址标识。my_user为用户名，my_pass为用户密码。
由于超级用户为高权限用户，代理服务器可以获得my_user以及my_pass，利用my_user以及my_pass进行认证，由于超级用户的创建地址为192.168.0.2，因此代理服务器提供的my_user以及my_pass即会认证通过，从而可以建立与数据库管理系统的超级用户连接。
其中，超级用户连接的建立可以是在代理服务器接收到普通用户的认证请求，即获得普通用户的用户认证信息以及待认证地址标识之后建立的，也可以在获得普通用户的用户认证信息以及待认证地址标识之前建立，本申请对此并进行限制。在超级用户连接建立之后，代理服务器再通过该超级用户连接，将普通用户的用户认证信息以及待认证地址标识转发至数据库管理系统。
其中，普通用户的用户认证信息以及待认证地址标识可以携带在触发命 令中，该触发命令即用于触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为普通用户的权限。从而即解决了用户认证问题。
另外，地址标识具有唯一性，一种可能的实现方式，该地址标识可以为IP地址(Internet Protocol Address)。
在实际应用中，数据库管理系统通常采用主库和备库的部署结构，以便于在主库异常时，可以切换至备库。
用户在认证时，代理服务器的连接均是建立的与主库的连接。
但是在主库和备库切换时，代理服务器需要先断开与主库的连接，再连接至备库，客户端即会感知到代理服务器与数据库管理系统连接中断的异常。
因此，在保证安全性以及方便对连接的管理和控制的前提下，为了避免连接中断的情况，作为又一个实施例，如图2所示，本申请实施例提供的数据库连接建立方法中，可以包括以下几个步骤：
201：代理服务器利用超级用户的用户认证信息，以及所述代理服务器的地址标识在数据库管理系统的主库中进行认证，建立与数据库管理系统的主库的超级用户连接。
202：将普通用户的用户认证信息以及待认证地址标识，通过所述超级用户连接转发至所述主库。
203：触发所述主库，在所述普通用户认证通过之后，将所述超级用户的权限转换为普通用户的权限，使得所述超级用户连接转换为普通用户连接。
204：在所述主库异常时，利用所述超级用户的用户认证信息，以及所述代理服务器的地址标识在所述数据库管理系统的备库中进行认证，建立与所述备库的超级用户连接。
205：触发所述备库将与所述备库连接的所述超级用户的权限转换为所 述普通用户的权限，使得与所述备库建立的超级户连接转换为普通用户连接。
本申请实施例中，在主库异常时，代理服务器首先与备库建立一个超级用户连接，然后再将该超级用户的权限转换为普通用户的权限，超级用户的连接即变为普通用户的连接，然后可以再切断与主库的连接，使得代理服务器可以无缝切换到备库上，让用户感知不到切换，即可以避免连接闪断的问题。从而用户在通过代理服务器成功、安全的与数据库管理系统的主库建立连接之后，还可以在主库异常时，无缝切换至备库，避免了连接中断的问题，降低了对用户造成的影响。
图3为本申请实施例提供的一种数据库连接建立方法又一个实施例的流程图，该方法可以包括以下几个步骤：
301：数据库管理系统对代理服务器发送的超级用户的用户认证信息，以及所述代理服务器的地址标识进行认证。
302：在所述超级用户认证通过之后，建立与所述代理服务器的超级用户连接。
303：对所述代理服务器通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证。
304：根据所述代理服务器的触发命令，在所述普通该用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
其中，待认证地址标识为与代理服务器连接的提供普通用户的用户认证信息的客户端的地址标识，其具有唯一性，可以为IP地址。
超级用户为利用代理服务器的地址标识创建的，为高权限用户，代理服务器可以获知超级用户的用户认证信息。
其中，普通用户的用户认证信息以及待认证地址标识可以携带在触发命令中，通过将超级用户降权为普通用户的权限，使得超级用户连接即变为普通用户连接。
本申请实施例既保证了数据库的安全性，同时方便了连接的管理和控制。
图4为本申请实施例提供的一种数据库连接建立装置一个实施例的结构示意图，该装置具体应用于代理服务器中。
该装置可以包括：
第一连接模块401，用于利用超级用户的用户认证信息，以及代理服务器的地址标识在数据库管理系统中进行认证，建立所述代理服务器与所述数据库管理系统的超级用户连接。
认证成功之后，即与数据库管理系统建立了连接。
转发模块402，用于将普通用户的用户认证信息以及待认证地址标识，通过所述超级用户连接转发至数据库管理系统；
第一转换模块403，用于触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为普通用户的权限，使得所述超级用户连接转换为普通用户连接。
其中，用户认证信息可以包括用户名和密码。
本申请实施例中，可以首先建立代理服务器与数据库管理系统的超级用户连接，对普通用户的认证请求，在代理服务器与数据库管理系统建立超级用户连接之后，可以将普通用户的用户认证信息以及待认证地址标识通过该超级用户连接转发至数据库管理系统，从而数据库管理系统可以获得普通用户的用户认证信息以及待认证地址标识，从而可以据此对普通用户进行认证，由于待认证地址标识为普通用户的客户端提供的，因此普通用户在已创建的前提，即可以认证通过。认证通过之后，数据库管理系统可以将超级用户进行降权，将其转换为普通用户的权限，从而与数据库管理系统的超级用户连接即变为普通用户连接，从而实现了普通用户通过代理服务器实现数据库连接，即可以进行数据库访问。本申请实施例既方便了连接的管理和控制，同时保证了安全性。
超级用户是在数据库管理系统建立时，利用超级用户的用户认证信息以及代理服务器的地址标识创建的，由于超级用户为高权限用户，代理服务器可以获得其用户认证信息，因此使得只有代理服务器能够与数据库管理系统建立超级用户连接。
其中，普通用户的用户认证信息以及待认证地址标识可以携带在触发命令中，该触发命令即用于触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为普通用户的权限。从而即解决了用户认证问题。
另外，地址标识具有唯一性，一种可能的实现方式，该地址标识可以为IP地址。
在实际应用中，数据库管理系统通常采用主库和备库的部署结构，以便于在主库异常时，可以切换至备库。
因此在数据库管理系统包括主库和备库，所述第一连接模块可以具体用于：
利用超级用户的用户认证信息，以及代理服务器的地址标识在数据库管理系统的主库中进行认证，建立与所述数据库管理系统的主库的超级用户连接。
为了避免连接中断的情况，如图5所示，为本申请实施例提供的一种数据库连接建立装置又一个实施例的结构示意图，该装置可以包括：
第一连接模块501，用于利用超级用户的用户认证信息，以及代理服务器的地址标识在数据库管理系统的主库中进行认证，建立与所述数据库管理系统的主库的超级用户连接；
转发模块502，用于将普通用户的用户认证信息以及待认证地址标识，通过所述超级用户连接转发至所述主库；
第一转换模块503，用于触发所述主库，在所述普通用户认证通过之后，将所述超级用户的权限转换为普通用户的权限，使得所述超级用户连接转换为普通用户连接。
第二连接模块504，用于在所述主库异常时，利用所述超级用户的用户 认证信息，以及所述代理服务器的地址标识在所述数据库管理系统的备库中进行认证，建立与所述备库的超级用户连接.
第二转换模块505，用于触发所述备库将与所述备库连接的所述超级用户的权限转换为所述普通用户的权限，使得与所述备库建立的超级用户连接转换为普通用户连接。
本申请实施例中，在主库异常时，代理服务器首先与备库建立一个超级用户连接，然后再将该超级用户的权限转换为普通用户的权限，超级用户的连接即变为普通用户的连接，然后可以再切断与主库的连接，使得代理服务器可以无缝切换到备库上，让用户感知不到切换，即可以避免闪断的问题。从而用户在通过代理服务器成功、安全的与数据库管理系统的主库建立连接之后，还可以在主库异常时，无缝切换至备库，避免了连接中断的问题，降低了对用户造成的影响。
图6为本申请实施例提供的一种数据库连接建立装置又一个实施例的结构示意图，该装置具体应用于数据库管理系统中，可以包括：
第一认证模块601，用于对代理服务器发送的超级用户的用户认证信息，以及所述代理服务器的地址标识进行认证；
第三连接模块602，用于在所述超级用户认证通过之后，建立与所述代理服务器的超级用户连接；
第二认证模块603，用于对所述代理服务器通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；
第四连接模块604，用于根据所述代理服务器的触发命令，在所述普通该用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
其中，待认证地址标识为与代理服务器连接的提供普通用户的用户认证信息的客户端的地址标识，其具有唯一性，可以为IP地址。
超级用户为利用代理服务器的地址标识创建的，为高权限用户，代理服务器可以获知超级用户的用户认证信息。
其中，普通用户的用户认证信息以及待认证地址标识可以携带在触发命令中，通过将超级用户降权为普通用户的权限，使得超级用户连接即变为普通用户连接。
数据库管理系统需要预先创建超级用户以及普通用户，超级用户以及普通用户才能进行认证。
因此该装置还可以包括：
第一预创建模块，用于利用普通用户的用户认证信息以及普通用户的客户端地址标识，创建所述普通用户；
第二预创建模块，用于利用超级用户的用户认证信息以及代理服务器地址标识，创建所述超级用户。
其中，第二预创建模块在所述数据库管理系统建立时，即创建出超级用户。第一预创建模块可以是在存在普通用户创建请求时，再创建普通用户。
本申请实施例既保证了数据库的安全性，同时方便了连接的管理和控制。
此外，本申请实施例还提供了一种数据库连接建立系统，如图7所示，该系统可以包括客户端701、代理服务器702以及数据库管理系统703。
所述客户端701，用于将普通用户的用户认证信息发送至所述代理服务器702。
所述代理服务器702，用于利用超级用户的用户认证信息以及所述代理服务器的地址标识，在数据库管理系统中进行认证，建立与所述数据库管理系统的超级用户连接；将所述客户端701发送的普通用户的用户认证信息以及所述客户端701的地址标识发送至所述数据库管理系统703；触发所述数据库管理系统703，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
所述数据库管理系统703，用于对代理服务器702发送的超级用户的用户认证信息，以及所述代理服务器702的地址标识进行认证；在所述超级用户认证通过之后，建立与所述代理服务器702的超级用户连接；对所述代理 服务器702通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；根据所述代理服务器702的触发命令，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
作为又一个实施例，如图8所示，所述数据库管理系统703可以包括主库801和备库802。
代理服务器702具体是利用超级用户的用户认证信息以及所述代理服务器702的地址标识，在主库801中进行认证，建立与所述主库801的超级用户连接；将所述客户端701发送的普通用户的用户认证信息以及所述客户端701的地址标识发送至所述主库801；触发所述主库801，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接；
在所述主库801异常时，利用所述超级用户的用户认证信息，以及所述代理服务器的地址标识在所述备库802中进行认证，建立与所述备库801的超级用户连接；触发所述备库801将与所述备库连接的所述超级用户的权限转换为所述普通用户的权限，使得与所述备库建立的超级用户连接转换为普通用户连接。
所述数据库管理系统中的主库801，用于对代理服务器702发送的超级用户的用户认证信息，以及所述代理服务器702的地址标识进行认证；在所述超级用户认证通过之后，建立与所述代理服务器702的超级用户连接；对所述代理服务器702通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；根据所述代理服务器702的触发命令，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接；
所述数据库管理系统中的备库802，用于对代理服务器702发送的超级用户的用户认证信息，以及所述代理服务器702的地址标识进行认证；在所述超级用户认证通过之后，建立与所述代理服务器702的超级用户连接；根据所述代理服务器702的触发命令，将所述超级用户的权限转换为所述普通 用户的权限，使得所述超级用户连接转换为普通用户连接。
本申请实施例既保证了数据库的安全性，同时方便了连接的管理和控制，还避免了主备库切换导致用户连接中断的问题。
如在说明书及权利要求当中使用了某些词汇来指称特定组件。本领域技术人员应可理解，硬件制造商可能会用不同名词来称呼同一个组件。本说明书及权利要求并不以名称的差异来作为区分组件的方式，而是以组件在功能上的差异来作为区分的准则。如在通篇说明书及权利要求当中所提及的“包含”为一开放式用语，故应解释成“包含但不限定于”。“大致”是指在可接收的误差范围内，本领域技术人员能够在一定误差范围内解决所述技术问题，基本达到所述技术效果。此外，“耦接”一词在此包含任何直接及间接的电性耦接手段。因此，若文中描述一第一装置耦接于一第二装置，则代表所述第一装置可直接电性耦接于所述第二装置，或通过其他装置或耦接手段间接地电性耦接至所述第二装置。说明书后续描述为实施本申请的较佳实施方式，然所述描述乃以说明本申请的一般原则为目的，并非用以限定本申请的范围。本申请的保护范围当视所附权利要求所界定者为准。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的商品或者系统不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种商品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的商品或者系统中还存在另外的相同要素。
上述说明示出并描述了本申请的若干优选实施例，但如前所述，应当理解本申请并非局限于本文所披露的形式，不应看作是对其他实施例的排除，而可用于各种其他组合、修改和环境，并能够在本文所述申请构想范围内，通过上述教导或相关领域的技术或知识进行改动。而本领域人员所进行的改动和变化不脱离本申请的精神和范围，则都应在本申请所附权利要求的保护范围内。

Claims (10)

  1. 一种数据库连接建立方法，其特征在于，包括：
    代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在数据库管理系统中进行认证，建立与所述数据库管理系统的超级用户连接；
    将客户端发送的普通用户的用户认证信息以及所述客户端的待认证地址标识，通过所述超级用户连接转发至所述数据库管理系统；
    触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
  2. 如权利要求1所述的方法，其特征在于，所述数据库管理系统包括主库和备库，所述代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在数据库管理系统中进行认证，建立与所述数据库管理系统的超级用户连接包括：
    代理服务器利用超级用户的用户认证信息以及所述代理服务器的地址标识，在主库中进行认证，建立与所述主库的超级用户连接。
  3. 如权利要求2所述的方法，其特征在于，在将所述超级用户的权限转换为普通用户的权限，使得所述超级用户连接转换为普通用户连接之后，所述方法还包括：
    在所述主库异常时，利用所述超级用户的用户认证信息，以及所述代理服务器的地址标识在所述备库中进行认证，建立与所述备库的超级用户连接；
    触发所述备库将与所述备库连接的所述超级用户的权限转换为所述普通用户的权限，使得与所述备库建立的超级用户连接转换为普通用户连接。
  4. 如权利要求1～3任一项所述的方法，其特征在于，所述超级用户为所述数据库管理系统建立时，利用超级用户的用户认证信息以及所述代理服务器的地址标识预先创建的。
  5. 一种数据库连接建立方法，其特征在于，包括：
    数据库管理系统对代理服务器发送的超级用户的用户认证信息，以及所述代理服务器的地址标识进行认证；
    在所述超级用户认证通过之后，建立与所述代理服务器的超级用户连接；
    对所述代理服务器通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；
    根据所述代理服务器的触发命令，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
  6. 一种数据库连接建立装置，其特征在于，包括：
    第一连接模块，用于利用超级用户的用户认证信息，以及代理服务器的地址标识在数据库管理系统中进行认证，建立所述代理服务器与所述数据库管理系统的超级用户连接；
    转发模块，用于将客户端发送的普通用户的用户认证信息以及所述客户端的待认证地址标识，通过所述超级用户连接转发至所述数据库管理系统；
    第一转换模块，用于触发所述数据库管理系统，在所述普通用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
  7. 如权利要求6所述的装置，其特征在于，所述数据库管理系统包括主库和备库，所述第一连接模块具体用于：
    利用超级用户的用户认证信息以及代理服务器的地址标识，在数据库管理系统的主库中进行认证，建立所述代理服务器与所述数据库管理系统的主库的超级用户连接。
  8. 如权利要求7所述的装置，其特征在于，还包括：
    第二连接模块，用于在所述主库异常时，利用所述超级用户的用户认证信息，以及所述代理服务器的地址标识在所述数据库管理系统的备库中进行认证，建立所述代理服务器与所述备库的超级用户连接；
    第二转换模块，用于触发所述备库将与所述备库连接的所述超级用户的 权限转换为所述普通用户的权限，使得与所述备库建立的超级用户连接转换为普通用户连接。
  9. 一种数据库连接建立装置，其特征在于，包括：
    第一认证模块，用于对代理服务器发送的超级用户的用户认证信息，以及所述代理服务器的地址标识进行认证；
    第三连接模块，用于在所述超级用户认证通过之后，建立与所述代理服务器的超级用户连接；
    第二认证模块，用于对所述代理服务器通过所述超级用户连接发送的普通用户的用户认证信息以及待认证地址标识进行认证；
    第四连接模块，用于根据所述代理服务器的触发命令，在所述普通该用户认证通过之后，将所述超级用户的权限转换为所述普通用户的权限，使得所述超级用户连接转换为普通用户连接。
  10. 如权利要求9所述的装置，其特征在于，还包括：
    第一预创建模块，用于利用普通用户的用户认证信息以及普通用户的客户端地址标识，创建所述普通用户；
    第二预创建模块，用于利用超级用户的用户认证信息以及代理服务器地址标识，创建所述超级用户。
PCT/CN2016/091523 2015-08-06 2016-07-25 数据库连接建立方法及装置 WO2017020744A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510477780.3A CN106445946B (zh) 2015-08-06 2015-08-06 数据库连接建立方法及装置
CN201510477780.3 2015-08-06

Publications (1)

Publication Number Publication Date
WO2017020744A1 true WO2017020744A1 (zh) 2017-02-09

Family

ID=57942438

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/091523 WO2017020744A1 (zh) 2015-08-06 2016-07-25 数据库连接建立方法及装置

Country Status (2)

Country Link
CN (1) CN106445946B (zh)
WO (1) WO2017020744A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114329371A (zh) * 2021-12-31 2022-04-12 杭州电子科技大学 数据库用户权限管理模块

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030135505A1 (en) * 2002-01-15 2003-07-17 International Business Machines Corporation Edge deployed database proxy driver
CN101739422A (zh) * 2008-11-05 2010-06-16 深圳市守望网络技术有限公司 基于数据库协议代理的前置式数据库访问控制方法和系统
CN101848245A (zh) * 2010-02-05 2010-09-29 南京德讯信息系统有限公司 基于ssl/xml的数据库访问代理方法及系统
CN103310161A (zh) * 2012-03-14 2013-09-18 北京海泰方圆科技有限公司 一种用于数据库系统的防护方法及系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100476828C (zh) * 2007-04-28 2009-04-08 华中科技大学 基于访问控制的安全搜索引擎系统
CN201690475U (zh) * 2010-05-13 2010-12-29 中国工商银行股份有限公司 一种企业局域网中的应用服务器访问系统
CN103500202B (zh) * 2013-09-29 2017-02-01 中国船舶重工集团公司第七0九研究所 一种轻量级数据库的安全保护方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030135505A1 (en) * 2002-01-15 2003-07-17 International Business Machines Corporation Edge deployed database proxy driver
CN101739422A (zh) * 2008-11-05 2010-06-16 深圳市守望网络技术有限公司 基于数据库协议代理的前置式数据库访问控制方法和系统
CN101848245A (zh) * 2010-02-05 2010-09-29 南京德讯信息系统有限公司 基于ssl/xml的数据库访问代理方法及系统
CN103310161A (zh) * 2012-03-14 2013-09-18 北京海泰方圆科技有限公司 一种用于数据库系统的防护方法及系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114329371A (zh) * 2021-12-31 2022-04-12 杭州电子科技大学 数据库用户权限管理模块
CN114329371B (zh) * 2021-12-31 2023-10-13 杭州电子科技大学 数据库用户权限管理模块

Also Published As

Publication number Publication date
CN106445946A (zh) 2017-02-22
CN106445946B (zh) 2019-10-08

Similar Documents

Publication Publication Date Title
US10949526B2 (en) User device authentication
US8752150B2 (en) System and method for information handling system multi-level authentication for backup services
US20190173871A1 (en) Using application level authentication for network login
WO2018095416A1 (zh) 信息处理方法、装置及系统
US9594922B1 (en) Non-persistent shared authentication tokens in a cluster of nodes
US9712398B2 (en) Authenticating connections and program identity in a messaging system
US10360237B2 (en) Secure data replication
TW201629805A (zh) 讀寫分離的方法、系統和資料庫代理伺服器
US10360366B1 (en) Systems and methods for providing two-factor authentication with an enterprise gateway when an authentication server is unavailable
EP3815329B1 (en) Registration of the same domain with different cloud services networks
US20220123950A1 (en) Multi-party cloud authenticator
US11949681B2 (en) Authentication and authorization for cloud file system
US20200065502A1 (en) Securely accessing offline data with indirect communication
CN103152351A (zh) 网络设备、ad 域单点登录的方法及系统
WO2017020744A1 (zh) 数据库连接建立方法及装置
US20140007197A1 (en) Delegation within a computing environment
EP2805447B1 (en) Integrating server applications with multiple authentication providers
WO2020038106A1 (zh) 一种bmc的管理方法、管理系统及相关装置
US10785213B2 (en) Continuous authentication
WO2017020720A1 (zh) 一种数据访问的方法及设备
US20240022558A1 (en) Networking device credential information reset system
US11424997B2 (en) Secured network management domain access system
JP7507186B2 (ja) ネットワークシステムおよびシングルサインオンの処理方法
US12052288B2 (en) Fallback segmentation security
KR20190018799A (ko) 에이전트 기반 접근제어 관리 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16832232

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16832232

Country of ref document: EP

Kind code of ref document: A1