A data migration method for encrypted databases

Abstract

This invention discloses a data migration method for an encrypted database. The method for storing vehicle data in an immutable manner includes the following steps: establishing a temporary database using a temporary server based on an old database; establishing an independent server and classifying and segmenting the data; encrypting and compressing ordinary files and sensitive data files; transmitting data via the web; receiving files, decompressing and decrypting them, and then integrating the files; comparing and providing feedback; and completing the database migration. This invention uses an encryption module to encrypt several sensitive data packets separately, avoiding data leakage and providing high security. By using a temporary server to establish the temporary database based on the old database, and switching the old server to the temporary server, server downtime for maintenance is avoided, reducing user churn and inconvenience. It also reduces the time wasted due to interruptions during file transfer, providing a safety net. Furthermore, setting up an independent server improves the data migration speed.

Description

Technical Field

[0001] This invention relates to a data migration method for databases, specifically a data migration method for encrypted databases, and belongs to the technical field of database data migration methods. Background Technology

[0002] A database is a "repository for organizing, storing, and managing data according to a data structure." It is a large, organized, shareable, and uniformly managed collection of data stored permanently in a computer. A database is a data repository with a large storage space, capable of holding millions or even hundreds of millions of data entries. However, databases do not store data arbitrarily; there are certain rules. Otherwise, query efficiency would be very low. Data comes from many sources, such as travel records, consumption records, browsed web pages, sent messages, etc. Besides text data, images, music, and sound are also considered data. With technological advancements, equipment needs to be upgraded, and databases also need to replace their storage units. Therefore, data migration from databases is necessary. However, existing data migration methods have the following drawbacks:

[0003] Existing data migration methods suffer from long downtime, during which the database becomes unusable, impacting user experience and causing economic losses. Furthermore, existing data migration methods are slow, susceptible to data leakage during transmission, and have poor security. Power outages or other unforeseen events can also lead to data loss during transmission, requiring significant time for retransmission. Summary of the Invention

[0004] The purpose of this invention is to provide a data migration method for encrypted databases in order to solve the above-mentioned problems.

[0005] This invention achieves the above objective through the following technical solution: a data migration method for an encrypted database, the data migration method for the encrypted database comprising the following steps:

[0006] (1) Use a temporary server to create a temporary database based on the old database. The old server is switched to run on the temporary server.

[0007] (2) Establish an independent server and use the data segmentation module to classify the data information in the old database. The data information in the old database is divided into ordinary files and sensitive data files. Sensitive keywords can be customized. Files other than the customized keywords are ordinary files. The sensitive data files and ordinary files are segmented to obtain several sensitive data packets and ordinary file packets. The data comparison module is used to generate a comparison directory.

[0008] (3) Use the encryption module to encrypt several sensitive data packets respectively, and then use the data compression module to compress the encrypted sensitive data packets into several sensitive data compressed packets.

[0009] (4) Send several sensitive data compressed packages and ordinary file packages to the storage unit in the new server via the web, use the decompression module to decompress the several sensitive data compressed packages, then use the decryption module to decrypt the decompressed sensitive data packages, and use the splicing module to splice the decrypted several sensitive data packages and ordinary file packages into an integrated file.

[0010] (5) Use the import module to import the complete file into the new database, and use the update module to import the temporary file in the temporary database into the new database to complete the data migration of the encrypted database.

[0011] Preferably, in step (1), the temporary server is connected to the old database in the old server via a local area network. During this process, temporary files generated are separated by time periods and then sent directly to the new server storage unit via the web.

[0012] Preferably, in step (2), after the independent server obtains the data from the old database, it stores it in the independent server storage unit, and the number of independent servers is adjustable.

[0013] Preferably, in step (2), the sensitive data file and the ordinary file are split using SQLDumpSplitter.

[0014] Preferably, the sensitive data in step (2) is desensitized using dynamic desensitization technology.

[0015] Preferably, in step (3), the encryption method for several sensitive data packets adopts the RSA public key encryption algorithm, and the RSA algorithm involves three parameters, n, e1, and e2;

[0016] Here, n is the product of two large prime numbers p and q, and the binary representation of n is the key length.

[0017] e1 and e2 are a pair of correlated values, where e1 is any value other than "0", and e1 is coprime with (p-1)*(q-1).

[0018] e2 satisfies (e2*e1)mod((p-1)*(q-1))=1.

[0019] n and e1, n and e2 are key pairs.

[0020] Preferably, in step (3), the compression method for compressing several sensitive data packets into several sensitive data compressed packets is run-length encoding. The run-length encoding obtains results of the same size based on the input string, as follows:

[0021] Input a string with a length greater than 0 and not exceeding 1000, consisting entirely of uppercase or lowercase letters.

[0022] The output is a single line representing the compression result, in the following format:

[0023] (A,3)(B,4)(C,1)(B,2).

[0024] Each pair of parentheses contains uppercase characters and the number of times each character is repeated, without any spaces.

[0025] Preferably, in step (4), the data comparison module is used to compare the directory and check whether the integrated files are complete. If there is incomplete data, data feedback is given. The data feedback is sent to the independent server via the web. The independent server resends the missing files based on the data feedback.

[0026] Preferably, the decryption algorithm in step (4) includes: Let A be plaintext and B be ciphertext, then: A = B^e1 mod n; B = A^e2 mod n.

[0027] e1 and e2 can be used interchangeably, that is:

[0028] A=B^e2 mod n; B=A^e1 mod.

[0029] Preferably, after step (5) uses the update module to import the temporary files in the temporary database into the new database, the temporary server will switch to work as the new server.

[0030] The beneficial effects of this invention are:

[0031] 1. This invention uses an encryption module to encrypt several sensitive data packets separately, avoiding data leakage and providing high security. By using a temporary server to establish a temporary database based on the old database, and switching the old server to the temporary server, server downtime for maintenance is avoided, user churn is reduced, and inconvenience to users is avoided.

[0032] 2. This invention divides sensitive data files and ordinary files into several sensitive data packets and ordinary file packets. Later, a splicing module is used to splice the decrypted sensitive data packets and ordinary file packets into an integrated file, which reduces the waste of transmission time caused by interruptions during file transmission. It is a precautionary measure. At the same time, setting up an independent server improves the data migration speed. Attached Figure Description

[0033] Figure 1 This is a flowchart of the migration method of the present invention;

[0034] Figure 2 This is a flowchart of the method for migrating ordinary files according to the present invention;

[0035] Figure 3 This is a flowchart of the method for migrating sensitive documents according to the present invention. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Example 1:

[0038] Please see Figure 2 A data migration method for an encrypted database, the data migration method for the encrypted database includes the following steps:

[0039] (1) Use a temporary server to create a temporary database based on the old database, and switch the old server to run on the temporary server.

[0040] (2) Establish an independent server, split the ordinary files into several ordinary file packages, and use the data comparison module to generate a comparison directory.

[0041] (3) Send several ordinary file packages to the storage unit in the new server via the web, and use the splicing module to splice the several ordinary file packages into an integrated file.

[0042] (4) Use the import module to import the complete file into the new database, and use the update module to import the temporary file in the temporary database into the new database to complete the data migration of the encrypted database.

[0043] Specifically, in step (1), the temporary server is connected to the old database in the old server via a local area network. During this process, temporary files generated are separated by time periods and then sent directly to the new server storage unit via the web.

[0044] Specifically, in step (2), after the independent server obtains the data from the old database, it stores it in the independent server storage unit, and the number of independent servers is adjustable.

[0045] Specifically, in step (2), the data splitting method for ordinary files is SQLDumpSplitter. SQLDumpSplitter can solve the problem of excessively large SQL files. It can split a large SQL file into several SQL files of a specified size, and then import them into phpMyAdmin in batches. This can avoid the problem of timeout caused by excessively large files. SQLDumpSplitter can automatically separate the structure statement and the data statement, so there is no need to worry about splitting errors.

[0046] Specifically, in step (3), the data comparison module is used to compare the directory and check whether the integrated files are complete. If there is incomplete data, data feedback is given. The data feedback is sent to the independent server via the web. The independent server resends the missing files based on the data feedback.

[0047] Specifically, after step (4) uses the update module to import the temporary files in the temporary database into the new database, the temporary server will switch to work as the new server.

[0048] The above describes the migration methods for ordinary files in a database.

[0049] Example 2:

[0050] Please see Figure 3 A data migration method for an encrypted database, the data migration method for the encrypted database includes the following steps:

[0051] (1) Use a temporary server to create a temporary database based on the old database, and switch the old server to run on the temporary server.

[0052] (2) Establish an independent server, segment the sensitive data files to obtain several sensitive data packets, and use the data comparison module to generate a comparison directory. Sensitive data refers to data that may cause serious harm to society or individuals if leaked, including personal privacy data such as name, ID number, address, telephone number, bank account, email, password, medical information, educational background, etc. It also includes data that is not suitable for enterprises or social organizations to publish, such as the business situation of enterprises, the network structure of enterprises, IP address list, etc.

[0053] (3) Use the encryption module to encrypt several sensitive data packets respectively, and then use the data compression module to compress the encrypted sensitive data packets into several sensitive data compressed packets.

[0054] (4) Send several sensitive data compressed packages to the storage unit in the new server via the web, use the decompression module to decompress the several sensitive data compressed packages, then use the decryption module to decrypt the decompressed sensitive data packets, and use the splicing module to splice the decrypted several sensitive data packets into an integrated file.

[0055] (5) Use the import module to import the complete file into the new database, and use the update module to import the temporary file in the temporary database into the new database to complete the data migration of the encrypted database.

[0056] Specifically, in step (1), the temporary server is connected to the old database in the old server via a local area network. During this process, temporary files generated are separated by time periods and then sent directly to the new server storage unit via the web.

[0057] Specifically, in step (2), after the independent server obtains the data from the old database, it stores it in the independent server storage unit, and the number of independent servers is adjustable.

[0058] Specifically, in step (2), the sensitive data file and the ordinary file are split using SQLDumpSplitter. SQLDumpSplitter can solve the problem of excessively large SQL files. It can split a large SQL file into several SQL files of a specified size, and then import them into phpMyAdmin in batches. This can avoid the problem of timeout caused by excessively large files. SQLDumpSplitter can automatically separate the structure statement and the data statement, so there is no need to worry about splitting errors.

[0059] Specifically, the sensitive data in step (2) is processed using dynamic desensitization technology. Dynamic desensitization is a professional data desensitization technology that extracts, whitens, and dynamically masks sensitive data. Data desensitization includes static desensitization and dynamic desensitization. Dynamic desensitization configures real-time data desensitization rules for users with different identities and permissions. The technical principle of dynamic desensitization is to complete the desensitization of sensitive data without changing the original data in the database by using SQL rewriting technology. Dynamic desensitization technology has become a necessary channel connecting the data center and external users, and it can shield, cover, and transform sensitive data to effectively prevent the leakage of sensitive data.

[0060] Specifically, in step (3), the encryption method for several sensitive data packets adopts the RSA public key encryption algorithm. The RSA algorithm involves three parameters: n, e1, and e2.

[0061] Here, n is the product of two large prime numbers p and q, and the binary representation of n is the key length.

[0062] e1 and e2 are a pair of correlated values, e1 is any value, and e1 is coprime with (p-1)*(q-1).

[0063] e2 satisfies (e2*e1)mod((p-1)*(q-1))=1.

[0064] (n and e1), (n and e2) are key pairs.

[0065] For example: take p = 3, q ​​= 11;

[0066] Then n = pq = 33;

[0067] f(n) = (p-1)(q-1) = 20. Among 1 to 20, e is coprime to 20. We can choose e = 3 (or other values).

[0068] d*3≡1mod 20;

[0069] Let d = 7 (d can also be 27, etc.);

[0070] The public key KU is e, n: 3,33;

[0071] Private key KR is d, n: 7, 33;

[0072] The original text (11.5.25) is encrypted:

[0073] 113 mod 33 = 11;

[0074] 53 mod 33 = 26;

[0075] 253 mod 33 = 16;

[0076] Decrypting 11, 26, 16:

[0077] 117 mod 33 = 11;

[0078] 267 mod 33 = 5;

[0079] 167 mod 33 = 25.

[0080] Specifically, in step (3), the compression method for compressing several sensitive data packets into several sensitive data compressed packets is run-length encoding. The run-length encoding obtains results of the same size based on the input string, as follows:

[0081] Input a string with a length greater than 0 and not exceeding 1000, consisting entirely of uppercase or lowercase letters.

[0082] The output is a single line representing the compression result, in the following format:

[0083] (A,3)(B,4)(C,1)(B,2)

[0084] Each pair of parentheses contains a character (all uppercase) and the number of times it is repeated, without any spaces.

[0085] Sample input: aAABBbBCCCaaaaa.

[0086] Sample output: (A,3)(B,4)(C,3)(A,5).

[0087] Specifically, in step (4), the data comparison module is used to compare the directory and check whether the integrated files are complete. If there is incomplete data, data feedback is given. The data feedback is sent to the independent server via the web. The independent server resends the missing files based on the data feedback.

[0088] Specifically, the decryption algorithm in step (4) includes: Let A be plaintext and B be ciphertext, then: A = B^e1 mod n; B = A^e2 mod n.

[0089] e1 and e2 can be used interchangeably, that is:

[0090] A=B^e2 mod n; B=A^e1 mod.

[0091] Specifically, after step (5) uses the update module to import the temporary files in the temporary database into the new database, the temporary server will switch to work as the new server.

[0092] The above are methods for migrating sensitive files in a database.

[0093] Example 3:

[0094] Please see Figure 1 A data migration method for an encrypted database, the data migration method for the encrypted database includes the following steps:

[0095] (1) Use a temporary server to create a temporary database based on the old database, and switch the old server to run on the temporary server.

[0096] (2) Establish an independent server and use the data segmentation module to classify the data information in the old database. The data information in the old database is classified into ordinary files and sensitive data files. The sensitive data files and ordinary files are segmented to obtain several sensitive data packets and ordinary file packets. The data comparison module is used to generate a comparison directory. Sensitive data refers to data that may cause serious harm to society or individuals if leaked. It includes personal privacy data, such as name, ID number, address, telephone number, bank account, email, password, medical information, educational background, etc. It also includes data that is not suitable for enterprises or social organizations to publish, such as the business situation of enterprises, the network structure of enterprises, IP address list, etc.

[0097] (3) Use the encryption module to encrypt several sensitive data packets respectively, and then use the data compression module to compress the encrypted sensitive data packets into several sensitive data compressed packets.

[0098] (4) Send several sensitive data compressed packages and ordinary file packages to the storage unit in the new server via the web, use the decompression module to decompress the several sensitive data compressed packages, then use the decryption module to decrypt the decompressed sensitive data packages, and use the splicing module to splice the decrypted several sensitive data packages and ordinary file packages into an integrated file.

[0099] (5) Use the import module to import the complete file into the new database, and use the update module to import the temporary file in the temporary database into the new database to complete the data migration of the encrypted database.

[0100] Specifically, in step (1), the temporary server is connected to the old database in the old server via a local area network. During this process, temporary files generated are separated by time periods and then sent directly to the new server storage unit via the web.

[0101] Specifically, in step (2), after the independent server obtains the data from the old database, it stores it in the independent server storage unit, and the number of independent servers is adjustable.

[0102] Specifically, in step (2), the sensitive data file and the ordinary file are split using SQLDumpSplitter. SQLDumpSplitter can solve the problem of excessively large SQL files. It can split a large SQL file into several SQL files of a specified size, and then import them into phpMyAdmin in batches. This can avoid the problem of timeout caused by excessively large files. SQLDumpSplitter can automatically separate the structure statement and the data statement, so there is no need to worry about splitting errors.

[0103] Specifically, the sensitive data in step (2) is processed using dynamic desensitization technology. Dynamic desensitization is a professional data desensitization technology that extracts, whitens, and dynamically masks sensitive data. Data desensitization includes static desensitization and dynamic desensitization. Dynamic desensitization configures real-time data desensitization rules for users with different identities and permissions. The technical principle of dynamic desensitization is to complete the desensitization of sensitive data without changing the original data in the database by using SQL rewriting technology. Dynamic desensitization technology has become a necessary channel connecting the data center and external users, and it can shield, cover, and transform sensitive data to effectively prevent the leakage of sensitive data.

[0104] Specifically, in step (3), the encryption method for several sensitive data packets adopts the RSA public key encryption algorithm. The RSA algorithm involves three parameters: n, e1, and e2.

[0105] Here, n is the product of two large prime numbers p and q, and the binary representation of n is the key length.

[0106] e1 and e2 are a pair of correlated values, e1 is any value, and e1 is coprime with (p-1)*(q-1).

[0107] e2 satisfies (e2*e1)mod((p-1)*(q-1))=1.

[0108] (n and e1), (n and e2) are key pairs.

[0109] For example: take p = 3, q ​​= 11;

[0110] Then n = pq = 33;

[0111] f(n) = (p-1)(q-1) = 20. Among 1 to 20, e is coprime to 20. We can choose e = 3 (or other values).

[0112] d*3≡1mod 20;

[0113] Let d = 7 (d can also be 27, etc.);

[0114] The public key KU is e, n: 3,33;

[0115] Private key KR is d, n: 7, 33;

[0116] The original text (11.5.25) is encrypted:

[0117] 113 mod 33 = 11;

[0118] 53 mod 33 = 26;

[0119] 253 mod 33 = 16;

[0120] Decrypting 11, 26, 16:

[0121] 117 mod 33 = 11;

[0122] 267 mod 33 = 5;

[0123] 167 mod 33 = 25.

[0124] Specifically, in step (3), the compression method for compressing several sensitive data packets into several sensitive data compressed packets is run-length encoding. The run-length encoding obtains results of the same size based on the input string, as follows:

[0125] Input a string with a length greater than 0 and not exceeding 1000, consisting entirely of uppercase or lowercase letters.

[0126] The output is a single line representing the compression result, in the following format:

[0127] (A,3)(B,4)(C,1)(B,2)

[0128] Each pair of parentheses contains a character (all uppercase) and the number of times it is repeated, without any spaces.

[0129] Sample input: aAABBbBCCCaaaaa.

[0130] Sample output: (A,3)(B,4)(C,3)(A,5).

[0131] Specifically, in step (4), the data comparison module is used to compare the directory and check whether the integrated files are complete. If there is incomplete data, data feedback is given. The data feedback is sent to the independent server via the web. The independent server resends the missing files based on the data feedback.

[0132] Specifically, the decryption algorithm in step (4) includes: Let A be plaintext and B be ciphertext, then: A = B^e1 mod n; B = A^e2 mod n.

[0133] e1 and e2 can be used interchangeably, that is:

[0134] A=B^e2 mod n; B=A^e1 mod.

[0135] Specifically, after step (5) uses the update module to import the temporary files in the temporary database into the new database, the temporary server will switch to work as the new server.

[0136] The above are the methods for migrating ordinary files and sensitive files in the database.

[0137] In the description of the invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention.

[0138] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of the invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0139] In this invention, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components, unless otherwise expressly limited. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0140] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0141] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A data migration method for an encrypted database, characterized in that: The data migration method for the encrypted database includes the following steps: (1) Use a temporary server to create a temporary database based on the old database, and switch the old server to run on the temporary server; (2) Establish an independent server and use the data segmentation module to classify the data information in the old database. The data information in the old database is classified into ordinary files and sensitive data files. The sensitive data files and ordinary files are segmented to obtain several sensitive data packets and ordinary file packets. The data comparison module is used to generate a comparison directory. (3) Use an encryption module to encrypt several sensitive data packets respectively, and then use a data compression module to compress the encrypted several sensitive data packets into several sensitive data compressed packets. The encryption method of the several sensitive data packets adopts the RSA public key encryption algorithm. The RSA algorithm involves three parameters, n, e1, and e2. Where n is the product of two large prime numbers p and q, and the binary representation of n is the key length; e1 and e2 are a pair of correlated values, e1 is any value, and e1 is coprime with (p-1)*(q-1); e2 satisfies (e2*e1)mod((p-1)*(q-1))=1; n and e1, n and e2 are key pairs; The compression method used to compress several sensitive data packets into several sensitive data compressed packets is run-length encoding. The run-length encoding method, based on the input string, yields results of equal size, as detailed below: Input a string with a length greater than 0 and not exceeding 1000, consisting entirely of uppercase or lowercase letters; The output is a single line representing the compression result, in the following format: (A,3)(B,4)(C,1)(B,2); Each pair of parentheses contains uppercase characters and the number of times they are repeated, without any spaces; (4) Send several sensitive data compressed packages and ordinary file packages to the storage unit in the new server via the web, use the decompression module to decompress the several sensitive data compressed packages, then use the decryption module to decrypt the decompressed sensitive data packages, and use the splicing module to splice the decrypted several sensitive data packages and ordinary file packages into an integrated file; (5) Use the import module to import the complete file into the new database, and use the update module to import the temporary file in the temporary database into the new database to complete the data migration of the encrypted database.

2. The data migration method for an encrypted database according to claim 1, characterized in that: In step (1), the temporary server is connected to the old database on the old server via a local area network. Temporary files generated during this process are separated by time periods and then sent directly to the new server storage unit via the web.

3. The data migration method for an encrypted database according to claim 1, characterized in that: In step (2), after the independent server obtains the data from the old database, it stores it in the independent server storage unit, and the number of independent servers is adjustable.

4. The data migration method for an encrypted database according to claim 1, characterized in that: In step (2), the sensitive data file and the ordinary file are split using SQLDumpSplitter.

5. A data migration method for an encrypted database according to claim 1, characterized in that: The sensitive data in step (2) is desensitized using dynamic desensitization technology.

6. A data migration method for an encrypted database according to claim 1, characterized in that: In step (4), the data comparison module is used to compare the directory and check whether the integrated files are complete. If there is incomplete data, data feedback is given. The data feedback is sent to the independent server via the web. The independent server resends the missing files based on the data feedback.

7. A data migration method for an encrypted database according to claim 1, characterized in that: The decryption algorithm in step (4) includes: Let A be plaintext and B be ciphertext, then: A = B^e1 mod n; B = A^e2 mod n; e1 and e2 can be used interchangeably, that is: A=B^e2 mod n; B=A^e1 mod.

8. A data migration method for an encrypted database according to claim 1, characterized in that: After step (5) uses the update module to import the temporary files in the temporary database into the new database, the temporary server will switch to work as the new server.

Images