Business data integrity encryption method and device, equipment and storage medium

Abstract

The invention provides a business data integrity encryption method and device, equipment and a storage medium. The method comprises the steps that database fields participating in integrity encryption are marked; the business processing layer processes data input by a user or generated by a system, carries out business data processing, carries out interception operation before SQL statement execution by utilizing a MyBatis interceptor, checks fields contained in SQL statements, splices all marked field data according to a predefined field splicing strategy, and carries out data processing on the spliced field data; performing encryption processing on the spliced field data through an encryption algorithm, and assigning a generated hash value to a corresponding field; and the database executes the modified SQL statement to complete data insertion or updating operation so as to ensure that the data stored in the database is completely encrypted data. According to the application, non-intrusive encryption and verification logic are realized through the MyBatis interceptor, and the security and maintainability of the system are improved.

Description

Technical Field

[0001] The present application belongs to the field of data encryption technology, and in particular, relates to a business data integrity encryption method, device, equipment and storage medium. Background Art

[0002] In most software development methods, the encryption and storage of permission data integrity is performed in the business logic phase: the business logic determines which encryption algorithm to use, and the encrypted ciphertext data is stored in the database in the business logic, etc. This method will invade the business logic, increase the code intrusion, and lead to difficulties in system maintenance, as well as complex and time-consuming system reconstruction or technology migration. Summary of the invention

[0003] In view of this, the present application aims to propose a business data integrity encryption method, device, equipment and storage medium to solve the problem of integrity encryption and encryption storage steps invading business logic.

[0004] To achieve the above purpose, the technical solution of this application is implemented as follows:

[0005] In a first aspect, the present application provides a method for encrypting business data integrity, including:

[0006] Mark the database fields involved in integrity encryption, where custom encryption annotations are used to modify and mark the corresponding fields;

[0007] The business processing layer processes the data input by users or generated by the system, and performs business data processing. It uses the MyBatis interceptor to intercept SQL statements before execution, checks the fields contained in the SQL statements, and splices all marked field data according to the predefined field splicing strategy. It also encrypts the spliced ​​field data through the encryption algorithm and assigns the generated hash value to the corresponding field.

[0008] The database executes the modified SQL statement to complete the data insertion or update operation to ensure that the data stored in the database is integrity encrypted data.

[0009] In a second aspect, based on the same inventive concept, the present application also provides a service data integrity encryption device, including:

[0010] A marking module is configured to mark the database fields involved in integrity encryption, wherein the encryption annotation is customized and the encryption annotation is used to modify and mark the corresponding fields;

[0011] The data processing module is configured as a business processing layer to process user input or system-generated data and perform business data processing. It uses the MyBatis interceptor to intercept SQL statements before execution, checks the fields contained in the SQL statements, and splices all marked field data according to the predefined field splicing strategy. It also encrypts the spliced ​​field data through an encryption algorithm and assigns the generated hash value to the corresponding field.

[0012] The execution module is configured to execute the modified SQL statement on the database to complete the data insertion or update operation to ensure that the data stored in the database is integrity encrypted data.

[0013] In a third aspect, based on the same inventive concept, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect is implemented.

[0014] In a fourth aspect, based on the same inventive concept, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in the first aspect.

[0015] Compared with the prior art, the service data integrity encryption method, device, equipment and storage medium described in this application have the following beneficial effects:

[0016] The business data integrity encryption method, device, equipment and storage medium described in the present application implement integrity encryption storage and integrity verification of permission data based on the MyBatis technical framework. The interceptor in the MyBatis framework can modify the business SQL. Based on this function, a custom interceptor is developed to implement overall encryption of business data when data is inserted or updated to the database, and inserted or updated into the hash value field of the specified record; the method ensures the confidentiality and integrity of the data, and implements non-intrusive encryption and verification logic through the MyBatis interceptor, thereby improving the security and maintainability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 This is a flow chart of the business data integrity encryption method described in an embodiment of the present application;

[0019] Figure 2This is a schematic diagram of the data encryption method described in an embodiment of the present application;

[0020] Figure 3 This is a schematic diagram of the structure of the service data integrity encryption device described in an embodiment of the present application;

[0021] Figure 4 This is a schematic diagram of the hardware structure of the electronic device described in the embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0023] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0024] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0025] See also Figure 1 and Figure 2 As shown, this embodiment provides a service data integrity encryption method, which specifically includes the following steps:

[0026] Step S101: Mark the database fields involved in integrity encryption, wherein a customized encryption annotation is used to modify and mark the corresponding fields.

[0027] Specifically, in this embodiment, during the database design phase or in the existing database model, specific tags are added to the fields that need to be encrypted for integrity, such as adding a specific suffix (such as _integrity) after the field name, or adding attributes to the database meta information to identify them. This application uses annotations to clearly specify which fields need to be encrypted for integrity, so that custom interceptors can easily read these configurations and identify the fields that need to be processed. In addition to annotations, you can also consider marking the fields that need to be encrypted through configuration files (such as XML or YAML) to enhance the flexibility of the solution, especially in scenarios where you do not want to modify the entity class.

[0028] Step S102, the business processing layer processes the data input by the user or generated by the system, and performs business data processing, uses the MyBatis interceptor to intercept the SQL statement before execution, checks the fields contained in the SQL statement, and splices all marked field data according to the predefined field splicing strategy, and encrypts the spliced ​​field data through the encryption algorithm, and assigns the generated hash value to the corresponding field (hash value field, such as data_hash).

[0029] Specifically, in this embodiment, the business logic layer processes data according to the normal process and performs insert or update operations through the Mapper interface of MyBatis. At this time, the data has not been encrypted and the hash value has not been generated. The MyBatis interceptor intercepts the operation before SQL execution, mainly intercepts the update and insert operations of the Executor, identifies whether the field marked for encryption is included, and splices the values ​​of these fields according to the predetermined splicing strategy (in this embodiment, the field values ​​to be encrypted are spliced ​​into strings in the order of field names, and are split using a specific separator | to avoid ambiguity in the spliced ​​data) to ensure consistency and repeatability.

[0030] This embodiment uses the AES-256 encryption algorithm to encrypt the concatenated string data to ensure the confidentiality of the data, uses the encrypted data as the input for hash value calculation, and performs hash calculation through the SHA-256 hash algorithm (this hash algorithm is used as the basis for integrity verification) to generate a hash value with a fixed length, and assigns the generated hash value to a specified field in the database record.

[0031] Step S103: The database executes the modified SQL statement to complete the data insertion or update operation to ensure that the data stored in the database is integrity encrypted data.

[0032] Specifically, in this embodiment, the generated hash value is added to the SQL statement to ensure that the hash value is updated or inserted into the corresponding field of the database. The modified SQL statement is executed through the database to complete the insertion or update of the data, ensuring that the data stored in the database is integrity encrypted data.

[0033] In some embodiments, it further comprises:

[0034] Use MyBatis interceptor to intercept data query operations, extract encrypted fields and corresponding hash value fields, re-splice field values ​​according to the splicing strategy during encryption, re-encrypt and calculate the hash value of the spliced ​​data, and compare it with the hash value stored in the database to verify the integrity of the data.

[0035] Specifically, in this embodiment, when data is retrieved, the hash value of the data may be recalculated and compared with the hash value stored in the database to verify the integrity of the data.

[0036] Furthermore, a MyBatis interceptor is developed to intercept data query operations and extract encrypted fields and corresponding hash value fields. It should be noted that before the data is returned to the business logic layer, the encrypted fields are decrypted to ensure that the business layer obtains usable plaintext data. The fields that need integrity verification are extracted from the query results, and the field values ​​are re-joined according to the splicing strategy during encryption. The joined data is encrypted and the hash value is calculated, and compared with the hash value stored in the database to verify the integrity of the data. If the verification fails, the interceptor can throw a custom exception to notify the business logic layer to handle the data integrity issue.

[0037] This step can automate the integrity verification process without manual intervention, improving the reliability and security of the system.

[0038] The method described in this embodiment implements the integrity encryption preservation and integrity verification of permission data based on the MyBatis technical framework. The interceptor in the MyBatis framework can modify the business SQL. Based on this function, a custom interceptor is developed to implement the overall encryption of business data when the data is inserted or updated to the database, and inserted or updated into the hash value field of the specified record. This method ensures the confidentiality and integrity of the data, and at the same time implements non-intrusive encryption and verification logic through the MyBatis interceptor, thereby improving the security and maintainability of the system.

[0039] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0040] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the embodiment of the present application also provides a business data integrity encryption device.

[0041] like Figure 3 As shown, the service data integrity encryption device includes:

[0042] The marking module 11 is configured to mark the database fields involved in integrity encryption, wherein the encryption annotation is customized and the encryption annotation is used to modify and mark the corresponding fields;

[0043] The data processing module 12 is configured as a business processing layer to process user input or system-generated data and perform business data processing, using the MyBatis interceptor to perform interception operations before the SQL statement is executed, checking the fields contained in the SQL statement, and splicing all marked field data according to the predefined field splicing strategy, and encrypting the spliced ​​field data through an encryption algorithm, and assigning the generated hash value to the corresponding field;

[0044] The execution module 13 is configured to execute the modified SQL statement in the database to complete the data insertion or update operation to ensure that the data stored in the database is integrity encrypted data.

[0045] For the convenience of description, the above devices are described in terms of functions and are divided into various modules. Of course, when implementing the embodiments of the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0046] The device of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0047] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in any of the above embodiments is implemented.

[0048] Figure 4A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0049] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0050] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0051] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0052] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0053] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0054] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0055] The electronic device of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0056] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in any of the above embodiments.

[0057] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0058] The computer instructions stored in the storage medium of the above embodiments are used to enable the computer to execute the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0059] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0060] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0061] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0062] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for encrypting business data integrity, characterized in that: include: Mark the database fields involved in integrity encryption, where custom encryption annotations are used to modify and mark the corresponding fields; The business processing layer processes the data input by users or generated by the system, and performs business data processing. It uses the MyBatis interceptor to intercept SQL statements before execution, checks the fields contained in the SQL statements, and splices all marked field data according to the predefined field splicing strategy. It also encrypts the spliced ​​field data through the encryption algorithm and assigns the generated hash value to the corresponding field. The database executes the modified SQL statement to complete the data insertion or update operation to ensure that the data stored in the database is integrity encrypted data.

2. The method according to claim 1, characterized in that The business processing layer processes the data input by the user or generated by the system, and performs business data processing, using the MyBatis interceptor to intercept the SQL statement before execution, and checks the fields contained in the SQL statement, including: Utilize the interceptor function provided by MyBatis to intercept related insert or update operations before SQL execution, check the fields contained in the SQL statement, and match them with the database fields marked as participating in integrity encryption to determine whether the marked database fields are included.

3. The method according to claim 1, characterized in that The field splicing strategy includes: Concatenate the field values ​​to be encrypted into a string in the order of the field names, and split the field values ​​by separators.

4. The method according to claim 2, characterized in that: The step of encrypting the concatenated field data by using an encryption algorithm and assigning the generated hash value to the corresponding field includes: The concatenated string data is encrypted by the AES-256 encryption algorithm, the encrypted data is used as the input of the hash value calculation, the hash calculation is performed by the SHA-256 hash algorithm to generate a hash value with a fixed length, and the generated hash value is assigned to the specified field in the database record.

5. The method according to claim 1, characterized in that Also includes: Use MyBatis interceptor to intercept data query operations, extract encrypted fields and corresponding hash value fields, re-splice field values ​​according to the splicing strategy during encryption, re-encrypt and calculate the hash value of the spliced ​​data, and compare it with the hash value stored in the database to verify the integrity of the data.

6. A service data integrity encryption device, characterized in that: include: A marking module is configured to mark the database fields involved in integrity encryption, wherein the encryption annotation is customized and the encryption annotation is used to modify and mark the corresponding fields; The data processing module is configured as a business processing layer to process user input or system-generated data and perform business data processing. It uses the MyBatis interceptor to intercept SQL statements before execution, checks the fields contained in the SQL statements, and splices all marked field data according to the predefined field splicing strategy. It also encrypts the spliced ​​field data through an encryption algorithm and assigns the generated hash value to the corresponding field. The execution module is configured to execute the modified SQL statement on the database to complete the data insertion or update operation to ensure that the data stored in the database is integrity encrypted data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium, characterized in that: in, The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 5.

Images