CN114785498A - A kind of database password protection method, device and equipment - Google Patents

Abstract

The application discloses a method, a device and equipment for protecting database passwords, which comprise the following steps: acquiring an access password query request aiming at a target database, which is sent by an application service; querying an access password of the target database based on the access password query request; encrypting the access password to obtain an encrypted password; and returning the encrypted password to the application service so that the application service calls an encryption and decryption file generated in advance by the password service to decrypt the encrypted password to obtain the access password. Therefore, the password plaintext or the encrypted password ciphertext is prevented from being written into the application program or the configuration file and the environment variable which can be accessed by the application program, the encryption is carried out through the password service, the encryption and decryption file generated by the password service is used for decryption, the security of the database password can be improved, and data leakage is prevented.

Description

A kind of database password protection method, device and equipment

technical field

The present application relates to the technical field of databases, and in particular, to a method, device and device for password protection of a database.

Background technique

When the server program accesses the database, it usually needs to create a connection to interact with the database, and when creating a database connection, it needs to specify the URL, user name, password and other information to access the database. These information are usually written to the configuration readable by the application. In files, environment variables or application code fragments, when creating a database connection, a database access channel is established based on this information. However, this information is easily obtained by relevant developers, operation and maintenance personnel, or attackers, resulting in the leakage of database passwords, which in turn leads to the illegal acquisition of data stored in the database, resulting in serious data security incidents.

At present, in order to protect the database password, the existing solution is to encrypt the database password through some encryption technology and then write it into the configuration file or program code. When the application needs to establish a database connection, the encrypted ciphertext is read out. Then use the same secret key and the corresponding decryption algorithm to decrypt the plaintext database access password, and then access the database to establish a connection. However, in this scheme, the secret key and encryption algorithm used for encryption exist on the application server as part of the application or its accessible configuration files and environment variables. The attacker can still obtain the encryption key and encryption algorithm by analyzing the application program and its configuration files, environment variables, etc., and then obtain the database access password, which still has huge security risks.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present application is to provide a database password protection method, device, and device, which can improve the security of database passwords, thereby preventing data leakage. Its specific plan is as follows:

In the first aspect, the present application discloses a database password protection method, which is applied to a password service, including:

Obtain the access password query request sent by the application service for the target database;

Query the access password of the target database based on the access password query request;

Encrypting the access password to obtain an encrypted password;

Return the encrypted password to the application service, so that the application service invokes the encryption and decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password.

Optionally, also include:

generating a public-private key pair corresponding to the application service, and adding the private key in the public-private key pair to the encryption/decryption file;

Correspondingly, encrypting the access password to obtain the encrypted password includes:

Encrypt the access password by using the public key in the public-private key pair to obtain an encrypted password;

In addition, the application service is configured to call the private key in the encryption/decryption file to decrypt the encrypted password to obtain the access password.

Optionally, the access password query request carries a first ciphertext; the first ciphertext is a ciphertext obtained by encrypting the request data with the target key in the encryption/decryption file, and the request data includes the Identification information of the application service;

Correspondingly, querying the access password of the target database based on the access password query request includes:

Decrypt the first ciphertext using the target key to obtain first decrypted data;

Query the public key corresponding to the application service based on the identification information in the first decrypted data and the source IP address of the access password query request;

If the public key is queried, the access password of the target database is queried.

Optionally, the request data further includes a second ciphertext; the second ciphertext is a ciphertext obtained by encrypting specified information with the private key in the encryption/decryption file, and the specified information includes all the specified information. at least one of the identification information of the application service, the exit IP address for accessing the cryptographic service, and the random character string generated by the encryption and decryption files;

Correspondingly, if the public key is queried, it further includes:

Decrypt the second ciphertext using the public key to obtain second decrypted data;

Verifying the second decrypted data, and querying the access password of the target database if the second decrypted data passes the verification.

Optionally, the verifying the second decrypted data includes:

If the second decrypted data includes the identification information of the application service, then compare the identification information with the identification information in the first decrypted data, and if they are consistent, determine that the identification information passes the verification;

If the second decrypted data includes the egress IP address, compare the egress IP address with the source IP address of the access password query request, and if they are consistent, determine that the egress IP address passes the verification;

If the second decrypted data includes the random character string, it is judged whether the random character string is obtained for the first time, and if the random character string is obtained for the first time, it is judged that the random character string has passed the verification ;

When all items of the specified information in the second decrypted data pass the verification, it is determined that the second decrypted data passes the verification.

Optionally, after encrypting the access password to obtain the encrypted password, the method further includes:

Encrypt the encrypted password and the identification information of the application service with the target key to obtain a response ciphertext;

Return the response ciphertext to the application service, so that the application service calls the encryption/decryption file to decrypt the response ciphertext, and compares the decrypted identification information with the pre-stored identification information, if they are consistent , decrypt the encrypted password to obtain the access password.

Optionally, also include:

Get the encryption and decryption file generation request;

Determine whether the encryption/decryption file generation request is a local request, and if the encryption/decryption file generation request is a local request, generate the encryption/decryption file.

Optionally, also include:

The update password of the target database is determined periodically, and the current access password is modified to the update password.

In the second aspect, the present application discloses a database password protection device, which is applied to a password service, including:

The query request obtaining module is used to obtain the access password query request sent by the application service for the target database;

an access password query module for querying the access password of the target database based on the access password query request;

an access password encryption module for encrypting the access password to obtain an encrypted password;

An encrypted password return module, configured to return the encrypted password to the application service, so that the application service invokes an encryption and decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password.

In a third aspect, the present application discloses an electronic device, including a processor and a memory; wherein,

the memory for storing computer programs;

The processor is configured to execute the computer program to implement the aforementioned database password protection method.

In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, which implements the aforementioned database password protection method when the computer program is executed by a processor.

In a fifth aspect, the present application discloses a computer program product, which implements the aforementioned database password protection method when the computer program product is executed.

It can be seen that the present application first obtains the access password query request for the target database sent by the application service through the password service, then queries the access password of the target database based on the access password query request, and then encrypts the access password to obtain an encrypted password, and finally return the encrypted password to the application service, so that the application service invokes the encryption/decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password. That is, the present application processes the access password request of the application service to the target database through the password service. After the access password of the target database is queried, the password is encrypted to obtain the encrypted password, and the encrypted password is returned to the application service. The application service only calls Only the encryption and decryption files pre-generated by the password service can decrypt the encrypted password. In this way, it is avoided to write the password plaintext or encrypted password ciphertext into the application or its accessible configuration files and environment variables, and encrypt it through the password service. Decrypting the encrypted and decrypted files generated by the password service can improve the security of the database password and prevent data leakage.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only It is an embodiment of the present application. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without any creative effort.

Fig. 1 is a system architecture diagram adopted by a database password protection scheme disclosed by the application;

Fig. 2 is a kind of database password protection flow chart disclosed by the application;

3 is a schematic diagram of a specific encryption and decryption file generation disclosed in the application;

FIG. 4 is a flowchart of a specific database access password request disclosed by the application;

5 is a schematic diagram of a database password protection scheme disclosed in the application;

6 is a schematic structural diagram of a database password protection device disclosed in the application;

FIG. 7 is a structural diagram of an electronic device disclosed in this application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

At present, in order to protect the database password, the existing solution is to encrypt the database password through some encryption technology and then write it into the configuration file or program code. When the application needs to establish a database connection, the encrypted ciphertext is read out. Then use the same secret key and the corresponding decryption algorithm to decrypt the plaintext database access password, and then access the database to establish a connection. However, in this scheme, the secret key and encryption algorithm used for encryption exist on the application server as part of the application or its accessible configuration files and environment variables. The attacker can still obtain the encryption key and encryption algorithm by analyzing the application program and its configuration files, environment variables, etc., and then obtain the database access password, which still has huge security risks. Therefore, the present application provides a database password protection scheme, which can improve the security of the database password, thereby preventing data leakage.

In the database password protection of the present application, the system framework adopted can be referred to as shown in FIG. 1 , which may specifically include: the second electronic device 101 , the first electronic device 102 , and the communication between the second electronic device 101 and the first electronic device 102 . The network 103 implements the communication connection. Wherein, both the first electronic device and the second electronic device may be terminal devices or servers or the like. For example, the first electronic device may be a server, running a cryptographic service, and the second electronic device may be a terminal device, running an application service. As shown in FIG. 1 , the second electronic device sends an access password query request for the target database to the first electronic device through the network, and the first electronic device returns response data to the second electronic device.

Referring to FIG. 2 , an embodiment of the present application discloses a database password protection method, which is applied to a password service, including:

Step S11: Obtain an access password query request sent by the application service for the target database.

In a specific implementation manner, the embodiment of the present application may first obtain the encryption and decryption file generation request; determine whether the encryption and decryption file generation request is a local request, and if the encryption and decryption file generation request is a local request, generate the encryption and decryption file generation request. Decrypt files.

It should be pointed out that the embodiment of the present application provides a database access password interface through a password service, and the application service can obtain the database access password based on the database access password interface. When generating an encryption and decryption file, it is also necessary to call the corresponding interface provided by the password service to generate an encryption and decryption file. In order to prevent attackers from generating encryption and decryption files by themselves to forge database access password interface requests, the password service restricts the interface for generating encryption and decryption files to only be accessed based on local requests. Application service maintainers can deploy the password service in the security domain and use the password service Manually execute the script on the deployed machine to generate the encryption and decryption files. In this way, the encryption and decryption files can only be generated on the machine where the password service is deployed, which improves the security.

Among them, the encryption and decryption file generation request carries the identification information of the application service and the export IP address for accessing the password service. The identification information can be the application service package name, and the export IP address is the IP address bound when the application service requests the password service. The password service determines that the encryption and decryption file generation request is a local request, and determines whether the identification information and the generated encryption and decryption file corresponding to the access password service exist. If not, the encryption and decryption file corresponding to the application service is generated. The encryption and decryption files are in one-to-one correspondence, and a public-private key pair corresponding to the application service is generated, and the private key in the public-private key pair is added to the encryption and decryption file. Then, the identification information of the application service, the exit IP address for accessing the cryptographic service, and the public key are stored in the cryptographic service database.

For example, as shown in FIG. 3 , an embodiment of the present application discloses a specific schematic diagram of generating an encryption and decryption file. When generating an encryption/decryption file, enter the application service package name of the application service and the exit IP address for accessing the password service. The encryption service determines whether the encryption/decryption file corresponding to the application service package name and IP address has been generated. Key pair, record the public key, the application service package name, and the exit IP address for accessing the cryptographic service in the cryptographic service database, then generate the encryption and decryption file code, attach the private key to the encryption and decryption file code, and then use code obfuscation The technology confuses the encryption and decryption code, and finally compiles it into a so file for output, which is called by the application service deployment to perform encryption and decryption operations requested by the encryption service interface. There is a one-to-one correspondence between encryption and decryption files and application service deployment instances. Only when the application service package name and the exit IP address for accessing the password service are consistent with those entered in the password service database, the correct encryption and decryption results can be obtained. And the encryption and decryption files only accept the input string to return the encryption or decryption result, and will not output any other information.

Step S12: query the access password of the target database based on the access password query request.

In a specific embodiment, the access password query request carries a first ciphertext; the first ciphertext is a ciphertext obtained by encrypting the request data with the target key in the encryption/decryption file, and the request data includes identification information of the application service; correspondingly, in this embodiment of the present application, the first ciphertext can be decrypted by using the target key to obtain first decrypted data; based on the identification information in the first decrypted data and The source IP address of the access password query request queries the public key corresponding to the application service; if the public key is queried, the access password of the target database is queried.

The target key can be a fixed key, and the fixed key can be modified regularly. And, if the public key cannot be queried, an error response is returned.

It should be pointed out that, in this embodiment of the present application, the public key corresponding to the application service may be queried based on the identification information in the first decrypted data and the source IP address of the access cipher query request in the cryptographic service database. It is the exit IP address for accessing the password service. It is queried by querying the identification information and the source IP address of the access password query request. If the same identification information and IP address are queried, the public key will be returned. Call the database access password interface on the specified machine, that is, the machine where the password service is located.

Further, the request data also includes a second ciphertext; the second ciphertext is a ciphertext obtained by encrypting specified information with the private key in the encryption/decryption file, and the specified information includes the at least one of the identification information of the application service, the exit IP address for accessing the cryptographic service, and the random string generated by the encryption and decryption files; correspondingly, if the public key is queried, it also includes: using the The public key decrypts the second ciphertext to obtain second decrypted data; the second decrypted data is verified, and if the second decrypted data passes the verification, the access password of the target database is queried.

The verifying the second decrypted data includes: if the second decrypted data includes the identification information of the application service, verifying the identification information with the identification information in the first decrypted data If the comparison is consistent, it is determined that the identification information passes the verification; if the second decrypted data includes the exit IP address, the exit IP address is compared with the source IP address of the access password query request, If they are consistent, it is determined that the egress IP address has passed the verification; if the second decrypted data includes the random character string, it is determined whether the random character string is obtained for the first time, and if the random character string is obtained for the first time If the random string is a random string, it is determined that the random string has passed the verification; otherwise, it is determined that the random string has not passed the verification; when the specified information in the second decrypted data has passed the verification, it is determined that The second decrypted data passes the verification. And, if any one of the specified information in the second decrypted data fails the verification, it is determined that the second decrypted data fails the verification, and an error response is generated.

Step S13: Encrypt the access password to obtain an encrypted password.

In a specific implementation manner, the access password can be encrypted by using the public key in the public-private key pair to obtain the encrypted password.

Step S14: Return the encrypted password to the application service, so that the application service calls the encryption/decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password.

In a specific implementation manner, after encrypting the access password to obtain the encrypted password, the method further includes: encrypting the encrypted password and the identification information of the application service with a target key to obtain a response ciphertext Then the response ciphertext is returned to the application service, so that the application service calls the encryption and decryption file to decrypt the response ciphertext, and compares the identification information obtained by decryption with the pre-stored identification information, If they are consistent, decrypt the encrypted password to obtain the access password.

In addition, the encrypted and decrypted file decrypts the encrypted password by using the private key to obtain the access password.

For example, referring to FIG. 4 , FIG. 4 is a specific flow chart of requesting a password for database access disclosed in an embodiment of the present application. The encryption/decryption module in Fig. 4 is a functional module implemented based on the encryption/decryption file. The application service calls the encryption/decryption module to verify the service package name of the application service. If the verification is successful, a request string is generated as specified information, such as a request string It is {"pkg":"com.xxx","ip":"xxx.xxx.xxx.xx","rand":"dsfetjewotwerweutweojoooifjejlerk"}, where pkg represents the application service package name, and IP is the access password service The egress IP address, rand is a random string generated. Use the private key to encrypt the request string to obtain the cip parameter, that is, the second ciphertext, and then use the fixed key to encrypt the application service package name and the second ciphertext to generate the first ciphertext, and initiate a request based on the first ciphertext. If the verification fails, an invalid ciphertext is generated, and the invalid ciphertext and the application service package name are encrypted with a fixed key to initiate a request. The invalid ciphertext is the ciphertext obtained by encrypting the error identifier with the private key. After the cryptographic service receives the request, it first decrypts the request data with a fixed key, and obtains the request source IP address through the network layer, and queries the public key in the cryptographic service data according to the application service package name and the request source IP address. , then use the public key to decrypt the cip parameter, obtain the application service package name preset by the encryption and decryption module, access the exit IP address of the password service, a random string, and verify it. After passing, query the access password of the database. The key pair access password is encrypted, and then the encrypted password and the application package name are encrypted with the fixed key, and the response information is returned. The application service receives the response information, calls the encryption and decryption module to decrypt the response information, first uses the fixed key to decrypt, then Verify the application package name, decrypt it with the private key after the verification is successful, and output the access password of the database. If the cryptographic service receives the request and decrypts the invalid ciphertext with the fixed key, and then decrypts with the public key to obtain an error identifier, which cannot pass the verification, this embodiment of the present application can record the request source IP as a risky IP. That is, in this embodiment of the present application, the application service obtains the database access password by calling the password service interface, and the application server uses the password service to call the encryption/decryption module to encrypt the request data, and decrypt the response data returned by the password service interface. Thereby protecting the access password of the database.

Further, in this embodiment of the present application, the update password of the target database may be determined periodically, and the current access password is modified to the update password.

In a specific implementation, the password service can start a timed task, modify the access password of the application database regularly, and notify the relevant part of the application system after the password is modified that the modified password can only be obtained through the legitimate request password service interface, so that , even if the attacker obtains the access password of the application database, it will be invalid after a period of time, which improves the password security. In addition, before the scheduled task of dynamically modifying the password of the application database is started, the initial password can be specified.

Further, referring to FIG. 5 , an embodiment of the present application discloses a schematic diagram of a database password protection scheme. The database password protection solution provided by this application provides an application service with a database access password interface through a limited access database access password service, and the application service obtains the database access password based on the database access password interface for creating a database connection. In order to improve the security of the password, the database access password service will randomly change the access password of the database, and the application service will call the encryption and decryption module through the password service to encrypt the requested data and then call the database access password interface, and the data returned by the password interface service will be encrypted. After decryption, the access password of the database is obtained. The encryption/decryption module is a functional module implemented based on the encryption/decryption file, and the encryption/decryption file is a file generated by a cryptographic service.

It can be seen that the embodiment of the present application first obtains the access password query request for the target database sent by the application service through the password service, then queries the access password of the target database based on the access password query request, and then encrypts the access password, The encrypted password is obtained, and finally the encrypted password is returned to the application service, so that the application service invokes the encryption and decryption files pre-generated by the password service to decrypt the encrypted password to obtain the access password. That is, in this embodiment of the present application, the password service is used to process the access password request of the application service to the target database. After the access password of the target database is queried, the password is encrypted to obtain the encrypted password, and the encrypted password is returned to the application service. The encrypted password can only be decrypted by calling the encryption and decryption files pre-generated by the password service. In this way, it is avoided to write the password plaintext or encrypted password ciphertext into the application or its accessible configuration files and environment variables. Encryption, decrypting the encrypted and decrypted files generated by the password service can improve the security of the database password, thereby preventing data leakage.

Referring to FIG. 6 , an embodiment of the present application discloses a database password protection device, which is applied to a password service, including:

The query request obtaining module 11 is used to obtain the access password query request sent by the application service for the target database;

an access password query module 12, configured to query the access password of the target database based on the access password query request;

an access password encryption module 13, used for encrypting the access password to obtain an encrypted password;

The encrypted password returning module 14 is configured to return the encrypted password to the application service, so that the application service invokes an encryption and decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password.

It can be seen that the embodiment of the present application first obtains the access password query request for the target database sent by the application service through the password service, then queries the access password of the target database based on the access password query request, and then encrypts the access password, The encrypted password is obtained, and finally the encrypted password is returned to the application service, so that the application service invokes the encryption and decryption files pre-generated by the password service to decrypt the encrypted password to obtain the access password. That is, in this embodiment of the present application, the password service is used to process the access password request of the application service to the target database. After the access password of the target database is queried, the password is encrypted to obtain the encrypted password, and the encrypted password is returned to the application service. The encrypted password can only be decrypted by calling the encryption and decryption files pre-generated by the password service. In this way, it is avoided to write the password plaintext or encrypted password ciphertext into the application or its accessible configuration files and environment variables. Encryption, decrypting the encrypted and decrypted files generated by the password service can improve the security of the database password, thereby preventing data leakage.

Further, the device further includes an encryption/decryption file generation module, which is specifically used for: obtaining an encryption/decryption file generation request; judging whether the encryption/decryption file generation request is a local request, if the encryption/decryption file generation request is a local request, Then the encryption and decryption files are generated.

Moreover, the encryption/decryption generation module is further configured to generate a public/private key pair corresponding to the application service, and add the private key in the public/private key pair to the encryption/decryption file;

Correspondingly, the access password encryption module 13 is specifically configured to encrypt the access password by using the public key in the public-private key pair to obtain an encrypted password; and the application service is used to call the encryption/decryption file in the The private key decrypts the encrypted password to obtain the access password.

Further, the access password query request carries the first ciphertext; the first ciphertext is the ciphertext obtained by encrypting the request data with the target key in the encryption/decryption file, and the request data includes the application identifying information for the service;

Correspondingly, the access password query module 12 includes:

a first decryption module, configured to decrypt the first ciphertext by using the target key to obtain the first decrypted data;

a public key query module, configured to query the public key corresponding to the application service based on the identification information in the first decrypted data and the source IP address of the access password query request;

The password query module is configured to query the access password of the target database if the public key is queried.

Further, the request data also includes a second ciphertext; the second ciphertext is a ciphertext obtained by encrypting specified information with the private key in the encryption/decryption file, and the specified information includes the At least one of the identification information of the application service, the exit IP address for accessing the password service, and the random string generated by the encryption and decryption files;

Correspondingly, the password query module further includes:

a second decryption module, configured to decrypt the second ciphertext by using the public key to obtain second decrypted data if the public key query module finds the public key;

A decrypted data verification module, configured to verify the second decrypted data, and query the access password of the target database if the second decrypted data passes the verification.

Further, the decrypted data verification module is specifically used for:

If the second decrypted data includes the identification information of the application service, then compare the identification information with the identification information in the first decrypted data, and if they are consistent, determine that the identification information passes the verification;

If the second decrypted data includes the egress IP address, compare the egress IP address with the source IP address of the access password query request, and if they are consistent, determine that the egress IP address passes the verification;

If the second decrypted data includes the random character string, it is judged whether the random character string is obtained for the first time, and if the random character string is obtained for the first time, it is judged that the random character string has passed the verification ;

When all items of the specified information in the second decrypted data pass the verification, it is determined that the second decrypted data passes the verification.

Further, the device also includes:

an encryption module, configured to encrypt the encrypted password and the identification information of the application service by using the target key to obtain a response ciphertext;

Correspondingly, the encryption password return module 14 is specifically configured to return the response ciphertext to the application service, so that the application service calls the encryption/decryption file to decrypt the response ciphertext, and decrypts the obtained ciphertext. The identification information is compared with the pre-stored identification information, and if they are consistent, the encrypted password is decrypted to obtain the access password.

In addition, the device further includes an access password update module, configured to periodically determine the update password of the target database, and modify the current access password to the update password.

Referring to FIG. 7 , an embodiment of the present application discloses an electronic device 20, including a processor 21 and a memory 22; wherein, the memory 22 is used to save a computer program; the processor 21 is used to execute the A computer program, the database password protection method disclosed in the foregoing embodiments.

For the specific process of the above database password protection method, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

In addition, the memory 22, as a carrier for resource storage, may be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the storage method may be short-term storage or permanent storage.

In addition, the electronic device 20 further includes a power supply 23, a communication interface 24, an input and output interface 25, and a communication bus 26; wherein, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the The communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, which is not specifically limited here; the The input and output interface 25 is used for acquiring external input data or outputting data to the external world, and its specific interface type can be selected according to specific application needs, which is not specifically limited here.

Further, the embodiments of the present application also disclose a computer-readable storage medium for storing a computer program, wherein the computer program implements the database password protection method disclosed in the foregoing embodiments when the computer program is executed by a processor.

For the specific process of the above database password protection method, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

The embodiments of the present application also disclose a computer program product, which implements the database password protection method disclosed in the foregoing embodiments when the computer program product is executed.

For the specific process of the above database password protection method, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant part can be referred to the description of the method.

The steps of a method or algorithm described in conjunction with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. A software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other known form of storage medium.

A database password protection method, device and device provided by the present application have been described in detail above. The principles and implementations of the present application are described with specific examples. The method of the application and its core idea; at the same time, for those skilled in the art, according to the idea of the application, there will be changes in the specific implementation and application scope. In summary, the content of this description should not be understood to limit this application.

Claims (11)

1. a database password protection method, is characterized in that, is applied to password service, comprises: Obtain the access password query request sent by the application service for the target database; Query the access password of the target database based on the access password query request; Encrypting the access password to obtain an encrypted password; Return the encrypted password to the application service, so that the application service invokes the encryption and decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password. 2. database password protection method according to claim 1, is characterized in that, also comprises: generating a public-private key pair corresponding to the application service, and adding the private key in the public-private key pair to the encryption/decryption file; Correspondingly, encrypting the access password to obtain the encrypted password includes: Encrypt the access password by using the public key in the public-private key pair to obtain an encrypted password; In addition, the application service is configured to call the private key in the encryption/decryption file to decrypt the encrypted password to obtain the access password. 3. The database password protection method according to claim 2, wherein the access password query request carries a first ciphertext; the first ciphertext is a request for using the target key in the encryption and decryption file The ciphertext obtained by data encryption, and the request data includes the identification information of the application service; Correspondingly, querying the access password of the target database based on the access password query request includes: Decrypt the first ciphertext using the target key to obtain first decrypted data; Query the public key corresponding to the application service based on the identification information in the first decrypted data and the source IP address of the access password query request; If the public key is queried, the access password of the target database is queried. 4. The database password protection method according to claim 3, wherein the request data further comprises a second ciphertext; the second ciphertext is specified by using the private key in the encryption/decryption file The ciphertext obtained by encrypting the information, the specified information includes at least one of the identification information of the application service, the exit IP address for accessing the cipher service, and a random character string generated by the encryption and decryption file; Correspondingly, if the public key is queried, it further includes: Decrypt the second ciphertext using the public key to obtain second decrypted data; Verifying the second decrypted data, and querying the access password of the target database if the second decrypted data passes the verification. 5. The database password protection method according to claim 4, wherein the verifying the second decrypted data comprises: If the second decrypted data includes the identification information of the application service, then compare the identification information with the identification information in the first decrypted data, and if they are consistent, determine that the identification information passes the verification; If the second decrypted data includes the egress IP address, compare the egress IP address with the source IP address of the access password query request, and if they are consistent, determine that the egress IP address passes the verification; If the second decrypted data includes the random character string, it is judged whether the random character string is obtained for the first time, and if the random character string is obtained for the first time, it is judged that the random character string has passed the verification ; When all items of the specified information in the second decrypted data pass the verification, it is determined that the second decrypted data passes the verification. 6. database password protection method according to claim 3, is characterized in that, after described access password is encrypted, after obtaining encrypted password, also comprises: Encrypt the encrypted password and the identification information of the application service with the target key to obtain a response ciphertext; Return the response ciphertext to the application service, so that the application service calls the encryption/decryption file to decrypt the response ciphertext, and compares the decrypted identification information with the pre-stored identification information, if they are consistent , decrypt the encrypted password to obtain the access password. 7. database password protection method according to claim 1, is characterized in that, also comprises: Get the encryption and decryption file generation request; Determine whether the encryption/decryption file generation request is a local request, and if the encryption/decryption file generation request is a local request, generate the encryption/decryption file. 8. The database password protection method according to any one of claims 1 to 7, further comprising: The update password of the target database is determined periodically, and the current access password is modified to the update password. 9. A database password protection device, characterized in that, applied to a password service, comprising: The query request obtaining module is used to obtain the access password query request sent by the application service for the target database; an access password query module for querying the access password of the target database based on the access password query request; an access password encryption module for encrypting the access password to obtain an encrypted password; An encrypted password return module, configured to return the encrypted password to the application service, so that the application service invokes an encryption and decryption file pre-generated by the password service to decrypt the encrypted password to obtain the access password. 10. An electronic device, comprising a processor and a memory; wherein, the memory for storing computer programs; The processor is configured to execute the computer program to implement the database password protection method according to any one of claims 1 to 8. 11. A computer-readable storage medium, characterized in that it is used for storing a computer program, wherein when the computer program is executed by a processor, the database password protection method according to any one of claims 1 to 8 is implemented.

Images