Data processing method, device, system and storage medium for encrypted database

Abstract

The embodiments of this specification relate to the field of big data, and specifically disclose a data processing method, device, system and storage medium for an encrypted database, the method comprising: receiving an initial access statement sent by a client; the initial access statement comprises at least one field; in the case where the initial access statement is a newly added field, extracting encryption configuration information of each field in the initial access statement; the encryption configuration information at least comprises configuration information of whether data corresponding to the field needs to be encrypted and stored in the database; converting the initial access statement into a standard access statement that complies with the database access standard; encrypting and rewriting the standard access statement using the encryption configuration information of each field, and sending the encrypted and rewritten standard access statement to a management subsystem, so that the management subsystem creates data columns corresponding to each field in the database based on the encrypted and rewritten standard access statement, so as to improve the flexibility and efficiency of data encryption processing.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular, to a data processing method, device, system and storage medium for an encrypted database. Background Art

[0002] With the development of cloud technology, the productivity of enterprise users has been further liberated, allowing their own resources to focus more on business, reducing the manpower and financial expenses of underlying development and maintenance. However, it has also made people pay attention to the value hidden behind the data, resulting in an increase in malicious theft or destruction of data. In addition to malicious third-party attackers, curious or malicious administrators can also cause immeasurable damage to data stored in the cloud or data that users interact with the cloud.

[0003] First, in terms of network transmission, when the cloud interacts with users, data will inevitably be transmitted over the network. However, the widely used TCP / IP protocol is based on plain text, which makes the transmitted data at risk of being tampered with, intercepted, or replaced. As the value of data is increasingly recognized, various attacks are becoming more and more common, and a variety of preventive measures have also been developed. For example, relatively secure SSL protocols (Secure Sockets Layer (SSL) and HTTPS protocols (Hypertext Transfer Protocol Security) can be used to ensure the security of network transmission from the protocol perspective. Secondly, for the security of cloud data storage, only by meeting the three elements of database confidentiality, integrity, and availability can the security of data cloud storage be truly guaranteed. Confidentiality means that all users who can access the cloud to obtain data are users with corresponding permissions. Integrity means that although the data in the cloud database is invisible to third-party attackers, attackers cannot destroy the data through certain commands or operations. Availability means that at any time, as long as users need to query and operate data in the cloud database, they can get it in real time.

[0004] Since the beginning of the 21st century, both domestic and foreign security fields have begun to explore ciphertext databases, with the goal of retaining some information and relationships of the data in a ciphertext state, so that some operations can be performed without decrypting the data. Among them, the CryptDB encrypted database is one of the ciphertext databases. Although the CryptDB encrypted database can implement some operations without decrypting the data, when the data access volume is large, the complex SQL statement encryption and rewriting process will still consume a lot of resources, making the efficiency of database operations low. Summary of the invention

[0005] The purpose of the embodiments of this specification is to provide a method, device, system and storage medium for processing data in an encrypted database, which can improve the flexibility and efficiency of data processing in the encrypted database.

[0006] This specification provides a data processing method, device, system and storage medium for an encrypted database, which are implemented in the following ways:

[0007] A data processing method for an encrypted database is applied to an agent end of an encrypted database system, the method comprising: receiving an initial access statement sent by a client; the initial access statement comprises at least one field; in the case where the initial access statement is a newly added field, extracting encryption configuration information of each field in the initial access statement; the encryption configuration information at least comprises configuration information of whether data corresponding to the field needs to be encrypted and stored in the database; converting the initial access statement into a standard access statement that complies with the database access standard; encrypting and rewriting the standard access statement using the encryption configuration information of each field, and sending the encrypted and rewritten standard access statement to a management subsystem, so that the management subsystem creates data columns corresponding to each field in the database based on the encrypted and rewritten standard access statement.

[0008] In some other embodiments of the method provided by the embodiments of this specification, the extracting of encryption configuration information of each field in the initial access statement includes: constructing a length variable and an encryption variable for the initial access statement; extracting the number of fields included in the initial access statement as the value of the length variable; extracting the encryption configuration information corresponding to any field in the initial access statement as the value of the encryption variable corresponding to the corresponding field.

[0009] In some other embodiments of the method provided in the embodiments of this specification, rewriting the initial access statement into a standard access statement that complies with database access standards includes: deleting encryption configuration information in the initial access statement to obtain a standard access statement that complies with database access standards.

[0010] In some other embodiments of the method provided by the embodiments of this specification, the encryption configuration information also includes an encryption method for data corresponding to the field.

[0011] In some other embodiments of the method provided by the embodiments of this specification, the fields in the initial access statement whose data needs to be encrypted and stored in the database are configured with encryption identifiers.

[0012] In some other embodiments of the method provided in the embodiments of this specification, the method further includes: for any field, after receiving an instruction of successful creation of a data column of the corresponding field fed back by the management subsystem, locally storing encryption configuration information corresponding to the corresponding field.

[0013] In some other embodiments of the method provided by the embodiments of this specification, the method also includes: when the initial access statement is to perform a specified operation on data stored in a database, extracting encryption configuration information corresponding to each field in the initial access statement from local storage; encrypting and rewriting the initial access statement based on the encryption configuration information, and sending the encrypted and rewritten initial access statement to a management subsystem; receiving the operation result of the management subsystem on the database using the encrypted and rewritten initial access statement, and feeding back the operation result to the client.

[0014] On the other hand, an embodiment of the present specification also provides a data processing device for an encrypted database, which is applied to an agent end of an encrypted database system, and the device includes: a statement receiving module, which is used to receive an initial access statement sent by a client; the initial access statement includes at least one field; an information extraction module, which is used to extract encryption configuration information of each field in the initial access statement when the initial access statement is a newly added field; the encryption configuration information at least includes configuration information on whether the data corresponding to the field needs to be encrypted and stored in the database; a statement conversion module, which is used to convert the initial access statement into a standard access statement that meets the database access standard; a statement rewriting module, which is used to encrypt and rewrite the standard access statement using the encryption configuration information of each field, and send the encrypted and rewritten standard access statement to the management subsystem, so that the management subsystem creates data columns corresponding to each field in the database based on the encrypted and rewritten standard access statement.

[0015] On the other hand, an embodiment of the present specification also provides an encrypted database system, wherein the system includes at least an agent end, and the agent end includes at least one processor and a memory for storing processor executable instructions, and when the instructions are executed by the processor, the steps of the method described in any one or more of the above embodiments are implemented.

[0016] On the other hand, an embodiment of the present specification provides a computer-readable storage medium having computer instructions stored thereon, and when the instructions are executed, the steps of the method described in any one or more of the above embodiments are implemented.

[0017] The data processing method, device, system and storage medium for an encrypted database provided by one or more embodiments of the present specification can improve the flexibility and efficiency of data encryption operations by dynamically configuring the encryption of each field, allowing users to freely choose which fields to encrypt and how to encrypt them as needed, thereby improving the flexibility and efficiency of data encryption operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0019] Figure 1 A schematic diagram of the system architecture of the encrypted database provided for this manual;

[0020] Figure 2 A schematic diagram of the implementation flow of the data processing method of the encrypted database provided in this specification;

[0021] Figure 3 This is a schematic diagram of the module structure of the data processing device for the encrypted database provided in this specification. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of the specification, not all of the embodiments. Based on one or more embodiments of the specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the embodiments of this specification.

[0023] The data processing method of the encrypted database may be an encrypted database system, and the system may include at least an agent and a management subsystem. Figure 1 As shown, for the CryptDB database, the proxy end may be a Proxy server, and the management subsystem may be a DBMS server.

[0024] like Figure 1 As shown in the figure, in the CryptDB system architecture, participants may include clients, proxies (Proxy servers), and management subsystems (DBMS servers). In the onion encryption processing of the CryptDB system, when the user's data processing request is to add a new field, that is, to create a table or field in the database, the CryptDB system selects all possible encrypted columns for creation according to the data type of the field by default. For example, a common table creation statement is:

[0025]

[0026] After receiving the above CREATE TABLE statement, the Proxy server will first encrypt and rewrite the statement. Usually, the Proxy server determines the encrypted onion model corresponding to each field based on the field type, and performs corresponding encryption rewriting processing on each field to form a rewritten CREATE TABLE statement. Accordingly, the rewritten CREATE TABLE statement can be executed normally by the DBMS server, and different encrypted columns are created for the corresponding fields in the database to store the encrypted data corresponding to each field in the corresponding encrypted columns, completing the encrypted storage of the database.

[0027] For example, by default, three encrypted columns are usually created for the 'stu_sid' field, corresponding to the operations of equality, sorting, and addition. Accordingly, in the process of entering the data corresponding to the 'stu_sid' field into the database, the data corresponding to the 'stu_sid' field can be encrypted using the encryption algorithms corresponding to equality, sorting, and addition, and the encrypted data can be stored in the encrypted columns corresponding to equality, sorting, and addition to achieve encrypted storage of data. When the Proxy server receives an SQL statement for performing a sorting operation on the data in the 'stu_sid' field, the Proxy server can rewrite the SQL statement into an SQL statement for performing a sorting operation on the data in the sorting encrypted column, and send it to the DBMS server. The DBMS server can access the sorting encrypted column under the 'stu_sid' field based on the rewritten SQL statement, and perform sorting on the data under the sorting encrypted column, and then feed back the sorting result to the Proxy server, so that the Proxy server can feed back to the client. In the above manner, it is possible to perform a sorting operation on the encrypted data in the database without decryption, thereby improving the security of data access and transmission.

[0028] However, in actual use, the operation requirements corresponding to each field are usually different. For example, there is usually no data addition operation requirement for the "student campus card number" field, which makes the addition encryption column of this field a redundant column, and also makes the creation of the addition encryption column of this field and the data encryption storage operation redundant. With the increasing amount of data storage and processing, the above redundant storage and processing has caused a great waste of storage resources and processing resources of the database system.

[0029] Accordingly, this scenario example proposes a dynamic encryption strategy. When creating tables and fields, users can configure which fields need to be encrypted and the encryption method when initially writing SQL statements as needed. For ease of expression, the SQL statement initially written by the user can be used as the initial access statement. That is, encryption configuration information is set corresponding to each field in the initial access statement. The encryption configuration information may include at least whether the data corresponding to the field needs to be encrypted and stored in the database, the encryption method of the data corresponding to the field, etc. The encryption method may include operations such as equality, sorting, and addition to determine the encrypted columns that need to be constructed; or, the encryption method may also include the specific encryption algorithm used for each operation.

[0030] For example, the encryption onion model of the CryptDB database can usually include RND (random layer), DET (equivalue layer), OPE (sequential judgment layer), OPE-JOIN (sequential connection layer), Eq-JOIN (equivalue connection layer) and HOM (homomorphic encryption layer), SEARCH (text search layer), etc. Each encryption onion model can be used as an encryption method. For numerical data, RND can add the Blowfish algorithm with the initialization vector IV, and DET can use the Blowfish encryption algorithm. For character data, RND can use the AES encryption algorithm in CBC mode with the initialization vector v (i.e., the salt value), which can ensure the randomness of ciphertext encryption, that is, the ciphertexts of the same plaintext are different after encryption; DET can use the AES encryption algorithm in CMC mode (i.e., CBC mode with the initialization vectors all being 0) with the same initial vector, so the same plaintext is encrypted to obtain the same ciphertext. The algorithms corresponding to other layers can be configured as needed, and will not be described here.

[0031] For example, an encryption identifier can be added before the field that needs to be encrypted. If there is no such identifier, it means that the field is not encrypted. For example, in the above table creation statement, an enc identifier can be added for the field that needs to be encrypted. Correspondingly, part of the information in the above table creation statement can be changed to CREATETABLE STUDENT(age INT, enc idcard VARCHAR(18), enc nameVARCHAR(20), sex VARCHAR(1)), that is, the idcard and name fields are encrypted, and the age and sex fields are not encrypted. The encryption identifier can also include an operation identifier that identifies operations such as equality, sorting, and addition, as well as an algorithm identifier that identifies a specific encryption algorithm. Alternatively, different encryption identifiers can be configured for fields that need to be encrypted and fields that do not need to be encrypted.

[0032] After the above processing, the initial access statement received by the proxy is a non-standard SQL statement, and the proxy may not be able to correctly parse the initial access statement based on the existing processing method. In this scenario instance, the proxy can further configure an information extraction module and a statement conversion module to use the information extraction module to extract the encrypted configuration information of each field from the initial access statement, and use the statement conversion module to convert the initial access statement so that the converted access statement meets the database access standard. For ease of expression, the converted access statement can be described as a standard access statement.

[0033] For CryptDB database, the SQL statement sent by the client is usually intercepted by the Proxy server in the read_query() function of the Lua script, and then encrypted and rewritten before being handed over to the DBMS server for execution. But obviously, the initial access statement written using this scenario example is a non-standard SQL statement, and the Proxy server cannot parse it successfully using the existing method. In this scenario example, the initial access statement can be intercepted and parsed in the read_query() function of the Lua script to determine whether it is a new field statement. If not, the encryption rewrite is performed directly in the existing method. If it is a new field statement, two variables can be set, namely the length variable (bEnc) and the encryption variable (unsigned intlength), which are used to save the encryption status of each field in the new field statement. For example, if the i-th field needs to be encrypted, bEnct[i] = true, otherwise bEnct[i] = false. Length is used to save the number of fields contained in the initial access statement, that is, the length of the bEnc array.

[0034] After the above processing is completed, the Proxy server can delete all enc identifiers in the initial access statement. At this point, a standard SQL statement is formed as a standard access statement. After the above processing is completed, the above CREATE TABLE statement becomes CREATE TABLE STUDENT(age INT, idcard VARCHAR(18), name VARCHAR(20), sexVARCHAR(1)), and the values ​​of the two variables length.4, bEnc[o]=false, BEnc[1]=true, BEnc[2]=true, bEnc[3]=false are obtained. Correspondingly, the Proxy server can use the extracted values ​​of the above length variables and the values ​​of the encryption variables corresponding to each field as the extracted encryption configuration information. By defining variables in the above manner, the encryption configuration information in the initial access statement can be extracted, which can make the extraction of the encryption configuration information more comprehensive and accurate, and also facilitate the subsequent accurate encryption processing.

[0035] The agent can use the encryption configuration information of each field to encrypt and rewrite the standard access statement, and send the encrypted and rewritten standard access statement to the management subsystem, so that the management subsystem creates data columns for each field in the database based on the encrypted and rewritten standard access statement. For ease of expression, the access statement corresponding to any field can be described as an access sub-statement corresponding to the corresponding field. Correspondingly, for the initial access statement, the access statement corresponding to any field can be described as the initial access sub-statement corresponding to the corresponding field; for the standard access statement, the access statement corresponding to any field can be described as the standard access sub-statement corresponding to the corresponding field.

[0036] For example, for the CryptDB database, the Proxy server can determine the value of the encryption variable corresponding to each field one by one. For fields that need to be encrypted, the corresponding encryption rewrite can be performed on the standard access sub-statement corresponding to the field according to the type of the field; or, if the field is also configured with an encryption method, the corresponding encryption rewrite can be performed on the standard access sub-statement corresponding to the field based on the encryption method corresponding to the field. For fields that do not need to be encrypted, encryption rewrite may not be performed. And determine whether the standard access sub-statements corresponding to each field in the standard access statement have all completed encryption rewrite based on the value of the length variable.

[0037] When it is determined that the encryption rewrite has been completed, the standard access statement obtained after the encryption rewrite can be sent to the DBMS server, so that the DBMS server accesses the database based on the standard access statement and creates data columns corresponding to each field. Accordingly, the data column can be an encrypted column or a plaintext data column. The type of encrypted column corresponding to a field can be determined according to the encryption method of the field. For example, if the encryption method corresponding to field A is addition and sorting, then encrypted columns corresponding to addition and sorting can be created for field A in the database. If field B does not have corresponding encryption configuration information, the data column created for field B is a plaintext data column.

[0038] In the above scenario example, by dynamically configuring the encryption of each field, users can freely choose which fields to encrypt and how to encrypt them according to their needs, which can make data encryption more flexible and efficient, and further improve the efficiency of encrypted database operations.

[0039] Based on the above scenario example, Figure 2 As shown, this specification also provides a data processing method for an encrypted database, which is applied to an agent end of an encrypted database system, and the method includes:

[0040] S20: receiving an initial access statement sent by the client; the initial access statement includes at least one field;

[0041] S22: When the initial access statement is a newly added field, extract encryption configuration information of each field in the initial access statement; the encryption configuration information at least includes configuration information of whether data corresponding to the field needs to be encrypted and stored in the database;

[0042] S24: converting the initial access statement into a standard access statement that complies with the database access standard;

[0043] S26: encrypt and rewrite the standard access statement using the encryption configuration information of each field, and send the encrypted and rewritten standard access statement to the management subsystem, so that the management subsystem creates data columns for each field in the database based on the encrypted and rewritten standard access statement.

[0044] By using the solution provided by the above embodiment, data encryption can be made more flexible, further reducing the waste of storage resources and processing resources of the database. At the same time, by adopting a configurable method of whether to encrypt a field and the encryption method, it is also possible to simply and conveniently implement the addition of encrypted columns when external requirements change, such as performing a separate encrypted column creation operation for a certain field, to meet the needs of actual applications.

[0045] In some other embodiments, extracting the encryption configuration information of each field in the initial access statement may include:

[0046] Constructing a length variable and an encryption variable for the initial access statement;

[0047] Extracting the number of fields included in the initial access statement as the value of the length variable;

[0048] The encryption configuration information corresponding to any field in the initial access statement is extracted as the value of the encryption variable corresponding to the corresponding field.

[0049] Correspondingly, the agent can encrypt and rewrite the standard access sub-statement corresponding to the corresponding field based on the value of the encryption variable corresponding to the field, and after the encryption and rewriting of the statement of each field is determined based on the value of the length variable, the encrypted and rewritten standard access statement is sent to the management subsystem.

[0050] In some other embodiments, the encryption configuration information may further include an encryption method for data corresponding to the field, and the proxy may encrypt and rewrite the standard access sub-statement corresponding to the corresponding field based on the encryption method for the field.

[0051] In some other embodiments, rewriting the initial access statement into a standard access statement that complies with the database access standard may include: deleting the encryption configuration information in the initial access statement to obtain a standard access statement that complies with the database access standard.

[0052] In some other embodiments, the fields in the initial access statement whose data needs to be encrypted and stored in the database are configured with encryption identifiers.

[0053] In some other embodiments, for any field, after receiving the instruction of successful creation of the data column corresponding to the corresponding field fed back by the management subsystem, the agent can store the encryption configuration information corresponding to the corresponding field locally. Accordingly, in the case where the initial access statement is to perform a specified operation on the data stored in the database, the agent can extract the encryption configuration information corresponding to each field in the initial access statement from the local storage. The specified operation may include data entry, sorting, addition, etc. The agent can encrypt and rewrite the initial access statement based on the extracted encryption configuration information. For example, the agent can encrypt and rewrite the initial access sub-statement corresponding to the corresponding field based on the encryption configuration information corresponding to any field. After completing the rewriting of the initial access sub-statements corresponding to each field in the initial access statement, the agent can send the encrypted and rewritten initial access statement to the management subsystem. The management subsystem can use the encrypted and rewritten initial access statement to perform operations on the database, and feed back the operation results to the agent. Accordingly, the agent can receive the operation results of the database using the encrypted and rewritten initial access statement fed back by the management subsystem, and feed back the operation results to the client.

[0054] By storing the encryption configuration information locally, the encryption rewriting of statements can be made more accurate and efficient when operating the encrypted data of the encrypted database, thereby further improving the efficiency of the encrypted database operation.

[0055] Based on the above encrypted database data processing method, the present specification also provides an encrypted database data processing device. Figure 3 As shown, the device may include: a statement receiving module 30, used to receive an initial access statement sent by a client; the initial access statement includes at least one field; an information extraction module 32, used to extract encryption configuration information of each field in the initial access statement when the initial access statement is a newly added field; the encryption configuration information at least includes configuration information on whether the data corresponding to the field needs to be encrypted and stored in the database; a statement conversion module 34, used to convert the initial access statement into a standard access statement that meets the database access standard; a statement rewriting module 36, used to encrypt and rewrite the standard access statement using the encryption configuration information of each field, and send the encrypted and rewritten standard access statement to the management subsystem, so that the management subsystem creates data columns corresponding to each field in the database based on the encrypted and rewritten standard access statement.

[0056] It should be noted that the above-mentioned device may also include other implementations according to the description of the above-mentioned embodiment. The specific implementation methods may refer to the description of the relevant method embodiments, which will not be described one by one here.

[0057] Based on the data processing method of the above-mentioned encrypted database, an embodiment of this specification also provides an encrypted database system, the system at least includes an agent end, the agent end includes at least one processor and a memory for storing processor executable instructions, and when the instructions are executed by the processor, the steps of the method described in any one or more of the above-mentioned embodiments are implemented.

[0058] This specification also provides a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed, the steps of the method described in any one or more of the above embodiments are implemented. The storage medium may include a physical device for storing information, which is usually to digitize the information and then store it in a medium using electrical, magnetic or optical methods. The storage medium may include: devices that store information using electrical energy, such as various types of memories, such as RAM, ROM, etc.; devices that store information using magnetic energy, such as hard disks, floppy disks, magnetic tapes, magnetic core memories, bubble memories, and U disks; devices that store information optically, such as CDs or DVDs. Of course, there are other types of readable storage media, such as quantum memories, graphene memories, and so on.

[0059] It should be noted that the embodiments of this specification are not limited to the situations that must comply with the standard data model / template or the embodiments of this specification. Certain industry standards or slightly modified implementation plans based on the implementation described in the custom method or the embodiment can also achieve the same, equivalent or similar, or predictable implementation effects after deformation of the above-mentioned embodiments. The embodiments obtained by using these modified or deformed data acquisition, storage, judgment, processing methods, etc. can still fall within the scope of the optional implementation plans of this specification.

[0060] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0061] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A data processing method for an encrypted database, characterized in that: Applied to the proxy end of the encrypted database system, the method comprises: Receiving an initial access statement sent by a client; the initial access statement includes at least one field; In the case where the initial access statement is a newly added field, extracting encryption configuration information of each field in the initial access statement; the encryption configuration information at least includes configuration information of whether data corresponding to the field needs to be encrypted and stored in the database; Converting the initial access statement into a standard access statement that complies with the database access standard; Encrypt and rewrite the standard access statement using the encryption configuration information of each field, and send the encrypted and rewritten standard access statement to the management subsystem, so that the management subsystem creates a data column corresponding to each field in the database based on the encrypted and rewritten standard access statement; The step of extracting the encryption configuration information of each field in the initial access statement includes: constructing a length variable and an encryption variable for the initial access statement; extracting the number of fields included in the initial access statement as the value of the length variable; extracting the encryption configuration information corresponding to any field in the initial access statement as the value of the encryption variable corresponding to the corresponding field; The standard access statement is encrypted and rewritten using the encryption configuration information of each field, including: determining the value of the encrypted variable corresponding to each field one by one, and performing corresponding encryption rewriting on the standard access sub-statement corresponding to the field according to the type of the field; or, if an encryption method is configured corresponding to the field, performing corresponding encryption rewriting on the standard access sub-statement corresponding to the field based on the encryption method corresponding to the field.

2. The method according to claim 1, characterized in that The step of rewriting the initial access statement into a standard access statement that complies with the database access standard includes: The encrypted configuration information in the initial access statement is deleted to obtain a standard access statement that meets the database access standard.

3. The method according to claim 1, characterized in that: The encryption configuration information also includes an encryption method for data corresponding to the field.

4. The method according to claim 1, characterized in that The fields in the initial access statement where data needs to be encrypted and stored in the database are configured with encryption identifiers.

5. The method according to claim 1, characterized in that The method further comprises: For any field, after receiving an instruction from the management subsystem indicating that the data column of the corresponding field is successfully created, the encryption configuration information corresponding to the corresponding field is stored locally.

6. The method according to claim 5, characterized in that The method further comprises: In the case where the initial access statement is to perform a specified operation on data stored in the database, extracting encryption configuration information corresponding to each field in the initial access statement from the local storage; Encrypting and rewriting the initial access statement based on the encryption configuration information, and sending the encrypted and rewritten initial access statement to the management subsystem; The operation result of the management subsystem on the database using the encrypted rewritten initial access statement is received, and the operation result is fed back to the client.

7. A data processing device for an encrypted database, characterized in that: The device is applied to the proxy end of the encrypted database system, and comprises: A statement receiving module, used for receiving an initial access statement sent by a client; the initial access statement includes at least one field; An information extraction module, used to extract encryption configuration information of each field in the initial access statement when the initial access statement is a newly added field; the encryption configuration information at least includes configuration information of whether data corresponding to the field needs to be encrypted and stored in the database; A statement conversion module, used for converting the initial access statement into a standard access statement that complies with the database access standard; A statement rewriting module, used to encrypt and rewrite the standard access statement using the encryption configuration information of each field, and send the encrypted and rewritten standard access statement to the management subsystem, so that the management subsystem creates a data column corresponding to each field in the database based on the encrypted and rewritten standard access statement; The information extraction module is specifically used to: construct a length variable and an encryption variable for the initial access statement; extract the number of fields contained in the initial access statement as the value of the length variable; extract the encryption configuration information corresponding to any field in the initial access statement as the value of the encryption variable corresponding to the corresponding field; The statement rewriting module is specifically used to: determine the value of the encrypted variable corresponding to each field one by one, and perform corresponding encryption rewriting on the standard access sub-statement corresponding to the field according to the type of the field; or, if the field is configured with an encryption method, perform corresponding encryption rewriting on the standard access sub-statement corresponding to the field based on the encryption method corresponding to the field.

8. An encrypted database system, characterized in that: The system at least includes an agent end, and the agent end includes at least one processor and a memory for storing processor-executable instructions. When the instructions are executed by the processor, the steps of the method described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instructions are executed, the steps of the method according to any one of claims 1 to 6 are implemented.

Images