Data security protection method, device, electronic device and storage medium

Abstract

The present application provides a data security protection method, device, electronic device and storage medium. The method includes: obtaining the client's permission information and a first SQL statement, the first SQL statement including a statement type and a field, and the field including an encrypted field; if the statement type is a query type, querying from the target database based on the first SQL statement to obtain a query result, the query result including encrypted data corresponding to the encrypted field; processing the query result according to the permission information to obtain a target query result; and returning the target query result to the client. By processing the query result obtained by the SQL statement according to the obtained client permission information, data security access with different user permissions is achieved, providing a more secure data security protection method.

Description

Technical Field

[0001] The present application relates to the field of data security, and more specifically, to a data security protection method, device, electronic device, and storage medium. Background Art

[0002] With the advancement of information technology, people are paying more and more attention to information security. Once the private data stored in the database is leaked, the consequences will be unimaginable. Therefore, the requirements for database security protection are getting higher and higher.

[0003] Current security protection measures include database firewalls. Users can access the database through the firewall to prevent unauthorized operations, but some attackers can bypass the database firewall and directly connect to the database to obtain data, resulting in privacy data leakage. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a data security protection method, device, electronic device and storage medium to improve data security protection.

[0005] In a first aspect, an embodiment of the present application provides a data security protection method, including: obtaining the client's permission information and a first SQL statement, the first SQL statement including a statement type and a field, the field including an encrypted field; if the statement type is a query type, querying from a target database based on the first SQL statement to obtain a query result, the query result including encrypted data corresponding to the encrypted field; processing the query result according to the permission information to obtain a target query result; and returning the target query result to the client.

[0006] In an embodiment of the present application, by obtaining the client's permission information and the first SQL statement, it is determined that if the statement type is a query type, a query is performed from the target database based on the first SQL statement to obtain a query result. Since the field includes an encrypted field, the query result includes encrypted data corresponding to the encrypted field. The query result is then processed using the permission information to obtain the target query result, and finally the target query result is returned to the client. This enables the client to return the query result data according to the permission information when the query result contains encrypted data, providing a more secure data protection method and effectively preventing the leakage of data files.

[0007] Furthermore, the query result is processed according to the permission information to obtain the target query result, including: judging whether the client has viewing permission according to the permission information; if the client has the viewing permission, decrypting the encrypted data in the query result according to the key corresponding to the encrypted field to obtain the target query result; if the client does not have the viewing permission, using the query result as the target query result.

[0008] In an embodiment of the present application, whether the client has viewing permission can be determined through permission information. When the client has viewing permission, the encrypted data in the query result can be decrypted using the key corresponding to the encrypted field to obtain the target query result. When the client does not have viewing permission, the query result can be directly used as the target query result without any processing. The client determines whether to decrypt the query result based on the viewing permission, thereby enabling the client to view the plaintext result when it has permission and the ciphertext result when it does not have permission, thereby ensuring the security of the data.

[0009] Furthermore, the first SQL statement also includes the value corresponding to the encrypted field, and the method also includes: determining whether the value corresponding to the encrypted field in the first SQL statement meets the data type requirements of the encrypted field; if the value corresponding to the encrypted field does not meet the data type requirements, blocking the first SQL statement, obtaining blocking information, and sending the blocking information to the client.

[0010] In an embodiment of the present application, since the first SQL statement also includes the value corresponding to the encrypted field, it is first determined whether the value corresponding to the encrypted field in the first SQL statement meets the data type requirements of the encrypted field. If the value corresponding to the encrypted field does not meet the data type requirements, the first SQL statement is blocked and the blocking information is sent to the client, thereby realizing the data format verification process of the agent before database operations, avoiding invalid operations on the database.

[0011] Furthermore, querying from the target database based on the first SQL statement to obtain the query result includes: if the value corresponding to the encrypted field meets the data type requirement and the statement type is a query type, encrypting the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a second SQL statement; querying from the target database according to the second SQL statement to obtain the query result.

[0012] In an embodiment of the present application, the value corresponding to the encrypted field in the first SQL statement can be encrypted according to the encryption algorithm corresponding to the encrypted field, so that the first SQL statement can be rewritten to obtain a second SQL statement, and then a query is performed from the target database according to the second SQL statement to obtain a query result, thereby obtaining a query result corresponding to the encrypted query value by rewriting the SQL statement according to the encryption algorithm.

[0013] Furthermore, the method also includes: if the value corresponding to the encrypted field meets the data type requirements and the statement type is an operation type, judging whether the client has the corresponding operation permission based on the permission information, and the operation type includes insert, delete or update; when the client has the corresponding operation permission, encrypting the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a third SQL statement; using the third SQL statement to operate in the target database, obtain an operation result, and return the operation result to the client; when the client does not have the corresponding operation permission, blocking the first SQL statement, obtaining blocking information, and sending the blocking information to the client.

[0014] In an embodiment of the present application, the permission information can be used to determine whether the client has the operation permission corresponding to the operation type. If the client has the corresponding operation permission, the operation value corresponding to the encrypted field in the first SQL statement is encrypted according to the encryption algorithm corresponding to the encrypted field to obtain a third SQL statement, which can then be used to operate in the target database, obtain the operation result, and return the operation result to the client. If the client does not have the corresponding operation permission, the first SQL statement can be blocked, blocking information is generated, and the blocking information is returned to the client. In the case where the statement type is an operation type, the execution of different operation information is determined by the permission information, thereby achieving secure data operation and ensuring data security.

[0015] Furthermore, the field also includes a sensitive field. After obtaining the client's permission information and the first SQL statement, the method also includes: if the statement type is a query type and the client does not have viewing permission, rewriting the first SQL statement according to the sensitive algorithm corresponding to the sensitive field to obtain a fourth SQL statement; querying from the target database according to the fourth SQL statement to obtain a desensitized query result; and returning the desensitized query result to the client.

[0016] In an embodiment of the present application, since the fields include sensitive fields, when the statement type is a query type and the client does not have viewing permission, the SQL statement is rewritten according to the sensitive algorithm corresponding to the sensitive field to obtain a fourth SQL statement, and then a query is performed from the target database according to the fourth SQL statement to obtain a desensitized query result, and the desensitized query result is returned to the client. In the case where the statement type is a viewing type and the client does not have viewing permission, the SQL statement is rewritten using the sensitive algorithm corresponding to the sensitive data, and the rewritten SQL statement is sent to the database for query, thereby achieving desensitization of the sensitive data.

[0017] Furthermore, before obtaining the client's permission information and the first SQL statement, the method also includes: receiving a login request from the client; verifying the login request to obtain the client's user information; determining the client's permission information based on the user information, the permission information including viewing permission and operation permission for the target database.

[0018] In the embodiment of the present application, by receiving a login request from a client and performing verification based on the login request, the user information of the client is obtained, and then the client's permission information can be determined based on the user information. By verifying the client's login request, the client's permission information is obtained, ensuring that the client's permission information is correct.

[0019] Furthermore, the method also includes: adding data asset information of the database, the data asset information including database connection information, proxy IP and proxy port; configuring corresponding blacklist and whitelist, access time period and permission information for the database according to the data asset information; configuring encryption information and sensitive information in the database, the encryption information including encryption table, encryption field, encryption algorithm and key, and the sensitive information including sensitive field and sensitive algorithm.

[0020] In an embodiment of the present application, database configuration is achieved by adding data asset information to the database. This data asset information includes database connection information, proxy IP, and proxy port. Based on this data asset information, the database's corresponding blacklist and whitelist, access time period, and permission information can be configured. Table structures within the database can also be configured, including encryption information and sensitive information. Encryption information includes the configuration of encryption tables, encryption fields, encryption algorithms, and keys, while sensitive information includes the configuration of sensitive fields and sensitive algorithms. By adding data asset information, relevant database configuration can be achieved, thereby enabling client login request verification and access permission settings.

[0021] Furthermore, the method further includes: if the statement type is a table creation statement and the client has corresponding permission information, sending the first SQL statement to the target database to obtain an execution result; and returning the execution result to the client. If the statement type is a database deletion statement, blocking the first SQL statement, obtaining blocking information; and returning the blocking information to the client.

[0022] In an embodiment of the present application, when the statement type is a table creation statement and the client has corresponding permission information, the first SQL statement is sent to the target database to obtain an execution result. When the statement type is a database deletion statement, considering the security of the target database, the SQL statement will be directly blocked, thereby improving the security of the data and preventing accidental deletion.

[0023] In a second aspect, an embodiment of the present application provides a data security protection device, which includes: an acquisition module for acquiring the client's permission information and a first SQL statement, the first SQL statement including a statement type and a field, the field including an encrypted field; a query module for querying from a target database based on the first SQL statement if the statement type is a query type, and obtaining a query result, the query result including encrypted data corresponding to the encrypted field; a processing module for processing the query result according to the permission information to obtain a target query result; and a sending module for returning the target query result to the client.

[0024] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a bus, wherein the processor and the memory interact with each other via the bus;

[0025] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect by calling the program instructions.

[0026] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising:

[0027] The computer-readable storage medium stores computer instructions, which cause the computer to execute the method of the first aspect.

[0028] Other features and advantages of the present application will be described in the following description and, in part, will become apparent from the description or be understood by practicing the embodiments of the present application. The objectives and other advantages of the present application can be achieved and obtained through the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A flowchart of a data security protection method provided in an embodiment of the present application;

[0031] Figure 2 A schematic diagram of the structure of a data security protection device provided in an embodiment of the present application;

[0032] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0034] Figure 1 A data security protection method flow diagram provided in this application embodiment is as follows: Figure 1 As shown, this method can be applied to a server connected to a database. The server includes an agent and a management end. The agent is the outer layer of the database protection end. It protects the database based on the database firewall and can process data requests sent by the client according to the permission information, thereby providing data protection. The management end is used to implement database management functions, such as adding data assets, configuring rules, and data encryption. The method includes:

[0035] Step 101: Obtain the client's permission information and a first SQL statement, where the first SQL statement includes a statement type and fields, and the fields include encrypted fields.

[0036] In the specific implementation process, the client can be a terminal device for the user to log in, wherein the terminal device can be a smart phone, tablet computer, computer, personal digital assistant (PDA), etc. The present application does not limit the specific terminal device of the client. The permission information can be viewing permission and operation permission, such as viewing permission and operation permission for encrypted data. The present application does not limit the specific type of permission information. The first SQL statement is a statement sent by the client for accessing and operating the database, including a statement type and a field. The statement type can be a query statement or an operation statement. The query statement is used to query the data in the database. For example, the query statement can be: selectname from stu where id=1. The operation statement is used to perform related operations such as adding, deleting, and modifying the data in the database. The field is the column name of the database table structure. For example, in the student table, id and name are both column names. The field also includes an encrypted field. The encrypted field is an encrypted field in the encrypted table pre-configured in the database. The value stored in the encrypted field is stored in the database in ciphertext, which can effectively improve the security of the corresponding value of the encrypted field.

[0037] Step 102: If the statement type is a query type, query the target database based on the first SQL statement to obtain a query result, where the query result includes the encrypted data corresponding to the encrypted field.

[0038] In the specific implementation process, when the statement type is a query type, a query can be performed from the target database according to the first SQL statement to obtain the query result of the target database, and the field includes an encrypted field. The encrypted field is saved in the database in the form of ciphertext, and the query result includes the encrypted data corresponding to the encrypted field.

[0039] Step 103: Process the query result according to the permission information to obtain a target query result.

[0040] In the specific implementation process, the permission information can be information about whether the client has viewing permissions, and the processing method can be to decrypt the query results or directly release them, so that they can be displayed according to the client's permission information. For example, when the client has permission to view the encrypted data, the query results can be displayed as plaintext, and when the client does not have permission to view the encrypted data, the query results can be displayed as ciphertext. Even if some database attackers or high-level database administrators such as DBAs can bypass the proxy and directly log in to the database to view all data, they can view it regardless of whether they have permissions. However, since the data in the encrypted fields is stored in ciphertext in the database, the plaintext data cannot be obtained. Similarly, although attackers can obtain data through methods such as database dragging, only the unencrypted field data is plaintext data, and the encrypted field data is still ciphertext data, so data leakage will not occur.

[0041] Step 104: Return the target query to the client.

[0042] In the specific implementation process, the target query result can be the return data processed by the agent, which can be returned to the client for display through the network. This application does not limit the return method.

[0043] Based on the above embodiment, the query result is processed according to the permission information to obtain the target query result, including:

[0044] Determining whether the client has viewing permission according to the permission information;

[0045] If the viewing permission is granted, the encrypted data in the query result is decrypted according to the key corresponding to the encrypted field to obtain the target query result;

[0046] If the user does not have the viewing permission, the query result is used as the target query result.

[0047] In a specific implementation, the key can be the decryption method corresponding to the encrypted data in the database for the encrypted field, which is pre-configured in the database. Only after decryption using the key corresponding to the encrypted field can the actual data be viewed, thereby protecting the privacy of the data. If the client has viewing permission, the query result is decrypted using the key corresponding to the encrypted field, resulting in the plaintext query data. If the client does not have viewing permission, the query result is directly returned as the target query result, that is, the ciphertext query result is returned, without any data leakage.

[0048] Based on the above embodiment, the first SQL statement also includes a value corresponding to the encrypted field, and the method further includes:

[0049] Determine whether the value corresponding to the encrypted field in the first SQL statement meets the data type requirements of the encrypted field;

[0050] If the value corresponding to the encrypted field does not meet the data type requirement, the first SQL statement is blocked, blocking information is obtained, and the blocking information is sent to the client.

[0051] During the specific implementation process, when the value corresponding to the encrypted field is included in the first SQL statement, the proxy will verify the value of the field based on the field type. To ensure the correctness of the data, for example, when the inserted or updated value does not meet the requirements of the field type, the proxy will block the statement. An example is as follows: If a user with modification permission requests the statement update test.stu set name = 'zhaoqiansunli' where id = 1; where id is the primary key and name is the encrypted field, the field value type is varchar, and the maximum length of the data is 10, because the number of characters in 'zhaoqiansunli' is greater than 10, the statement does not meet the data type requirements of the corresponding field and is therefore blocked. The verification of string types mainly verifies the number of characters or the number of bytes occupied. Different databases have different data format requirements. This application does not limit the data type requirements of specific databases. Different verification methods are used for different data types. For example, for integer data, the main verification is whether the data exceeds the representation range of the type. For date or time types, the main verification is whether the data format meets the requirements and whether the content is legal. For example, the date type data 2001-12-32 is illegal. It can verify common data types such as integer, string, time, and date. The data type verification on the proxy side is performed according to the requirements of the proxy database for that type.

[0052] Based on the above embodiment, querying the target database based on the first SQL statement to obtain the query result includes:

[0053] If the value corresponding to the encrypted field meets the data type requirement and the statement type is a query type, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a second SQL statement;

[0054] Query the target database according to the second SQL statement to obtain a query result.

[0055] In the specific implementation process, when the statement type is a query statement, the value corresponding to the encrypted field in the first SQL statement is used as the query condition to match the target database. Therefore, the value corresponding to the encrypted field needs to be encrypted before it can be matched to the ciphertext query result in the encrypted table. Different encryption tables can correspond to different encryption algorithms. The encryption algorithm of the encrypted field in the same encryption table is the same. The encryption algorithm can be MD5 algorithm, SHA1 algorithm, DES encryption algorithm or SM4 national encryption algorithm. This application does not limit the type of encryption algorithm. For example, when the query statement is: query the personal information of Zhang San, and the name is saved as an encrypted field in the personal information table, the corresponding values of the field in the table structure are encrypted and saved. Therefore, during the query process, the SQL statement needs to be rewritten, and the value corresponding to the encrypted field is encrypted to obtain the rewritten SQL statement, and then the rewritten SQL statement is sent to the database for query, so that the query result can be obtained.

[0056] Based on the above embodiment, the method further includes:

[0057] If the value corresponding to the encrypted field meets the data type requirement and the statement type is an operation type, determine whether the client has the corresponding operation permission based on the permission information, and the operation type includes insert, delete, or update;

[0058] When the client has the corresponding operation permission, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a third SQL statement;

[0059] Performing an operation in the target database using the third SQL statement to obtain an operation result, and returning the operation result to the client;

[0060] When the client does not have the corresponding operation authority, the first SQL statement is blocked, blocking information is obtained, and the blocking information is sent to the client.

[0061] In the specific implementation process, the operation type can be a basic database operation type, including insert, delete, or update. Different operation types correspond to different operation permissions. For example, client A may have the permission to add and modify the encrypted field name, but not the permission to delete name. If the operation type of the corresponding statement is delete, the SQL statement will be blocked, while the corresponding addition and modification types can perform related operations. Each client can also have different field operation permissions. This application does not limit the operation permissions of different fields of the client.

[0062] If the client has the corresponding operation permissions, the SQL statement is rewritten according to the encryption algorithm corresponding to the encrypted field. The operation is then performed in the target database to obtain the operation result. This operation result can be the result of the success or failure of the operation. For example, if the operation type is insert, if the insertion in the target database is successful, a successful insertion message is sent to the client; if it fails, a failed insertion message is sent. If the client does not have the corresponding operation permissions, the SQL statement is blocked and a blocking message is sent to the client. Take the following implementation as an example: If a user with increased permissions requests the statement "insert into test.stu(id,name,age)values(1,'zhao',13)", where "id" is the primary key, "name" and "age" are encrypted fields, and "zhao" and "13" are the values to be inserted. After encryption and rewriting, the SQL statement becomes insertinto test.stu(id,name,age)values(1,'ikIN7DdIk4aE','EiW1cjSE9ntQ'); where 'ikIN7DdIk4aE' and 'ikIN7DdIk4aE' are the encrypted values of 'zhao' and 13 respectively.

[0063] Based on the above embodiment, the field further includes a sensitive field. After obtaining the permission information of the client and the first SQL statement, the method further includes:

[0064] If the statement type is a query type and the client does not have viewing permission, rewrite the first SQL statement according to the sensitive algorithm corresponding to the sensitive field to obtain a fourth SQL statement;

[0065] Performing a query from the target database according to the fourth SQL statement to obtain a desensitized query result;

[0066] Return the desensitized query result to the client.

[0067] In the specific implementation process, sensitive fields can be some security data of customers. The real data can be modified for use through the database's desensitization algorithm, such as mobile phone numbers and card numbers. When the client does not have the permission to view the sensitive field information, the sensitive data can be desensitized. Different sensitive fields can be configured with different desensitization algorithms. The types of desensitization algorithms include blanking, masking or simulation. This application does not limit the types of desensitization algorithms. When the statement type is a query type and the client does not have the permission to view, the SQL statement can be rewritten according to the sensitive algorithm corresponding to the sensitive field, and then the rewritten SQL statement can be queried from the target database to obtain the desensitized query results. For example, the phone number is 10010001000, and the data after masking and desensitization is 100****1000.

[0068] Based on the above embodiment, before obtaining the client's permission information and the first SQL statement, the method further includes:

[0069] Receive the client's login request;

[0070] Verifying the login request and obtaining user information of the client;

[0071] The authority information of the client is determined according to the user information, where the authority information includes viewing authority and operation authority for the target database.

[0072] In the specific implementation process, the proxy acts as an agent for the database. When a user accesses the database, the request is first sent from the proxy to the database, and the database then returns the result to the proxy, which is then returned to the user. When receiving the user's login request, the proxy can obtain information such as the user name, IP address, port, time, and specific SQL statement through protocol parsing. The user request can be verified through the user name, IP address, port, and time, thereby obtaining the client's permission information. For example, the user name and IP address can be used to determine whether the user is an authorized user and the permission information the user has.

[0073] Based on the above embodiment, the method further includes:

[0074] Add database data asset information, including database connection information, proxy IP and proxy port;

[0075] Configure corresponding blacklist and whitelist, access time period and permission information for the database according to the data asset information;

[0076] Encrypted information and sensitive information are configured in the database, wherein the encrypted information includes an encryption table, an encryption field, an encryption algorithm and a key, and the sensitive information includes a sensitive field and a sensitive algorithm.

[0077] During the specific implementation process, the management end is mainly used to add data assets, configure rules, and encrypt data. For example, the client can add data assets through the management end. The so-called assets are the database-related information, proxy IP, and proxy port that you want to access. The database information includes database IP, port number, user name, password, database type and version, etc.; for example, data assets can be: add data assets, the content includes the database is MySQL database 192.168.1.1:3306, version 5.7, user is root, password is 123456, proxy IP is 192.168.2.2, and proxy port is 14000.

[0078] Configure blacklists and whitelists and custom rules, including the usernames and IP addresses that can access a specific asset, the time period during which the asset can be accessed, the tables that can be accessed, and the types of operations allowed. For example, a rule might grant database root users with IP addresses in the range 0.0.0.0 to 255.255.255.255 between 8:00 AM and 6:00 PM Monday to Friday the query permission for the test.stu table in that database, but not the add, delete, or modify permission for the table. For example, if the root user at 192.168.1.1:3306 accesses test.stu through a proxy at 10:00 AM on Monday, the rule matches and the user is authorized. If the root user accesses test.stu through a proxy at 8:00 PM on Monday, the rule fails and the user is unauthorized. If the root user deletes a record from test.stu through a proxy at 10:00 AM on Monday, the rule fails and the user is unauthorized.

[0079] Configure sensitive data types, desensitization algorithms, and tables requiring desensitization. Desensitization algorithms include blanking, masking, and emulation. Configure encryption tables, encrypted fields, encryption algorithms, and keys. For example, the national encryption algorithm SM4 is used. After configuration, data in the database that requires encryption is encrypted, converting the original plaintext data into ciphertext for storage (this is known as stock encryption). For example, if the SM4 algorithm is selected to encrypt the data in the age column of the test.stu table, for example, if the original plaintext data for age is 18, the encrypted data becomes a string of characters with no clear meaning, such as kSqRVeST9K7b.

[0080] Based on the above embodiment, the method further includes:

[0081] If the statement type is a table creation statement and the client has corresponding permission information, sending the first SQL statement to the target database to obtain an execution result;

[0082] The execution result is returned to the client.

[0083] If the statement type is a database deletion statement, block the first SQL statement and obtain blocking information;

[0084] The blocking information is returned to the client.

[0085] In specific implementations, statement types include not only the basic database operations described above, such as add, delete, modify, and query, but also statements for operations on database tables, such as table creation and deletion. If the statement is a table creation statement, if the client has the corresponding operation permissions, the table creation statement is allowed to proceed and sent to the target database for execution. However, if the statement is a deletion statement, to ensure database security, the deletion statement is directly blocked, and the blocking information is obtained and returned to the client. For example, if the user requests a statement to delete a column in a database table, such as alter tabletest.stu drop column name, where test.stu is an encrypted table and name is a column, the statement is blocked.

[0086] Figure 2 This is a schematic diagram of the structure of the data security protection device provided in the embodiment of the present application. The device can be a module, program segment or code on an electronic device. It should be understood that the device is similar to the above-mentioned Figure 1 The method embodiment corresponds to the embodiment that can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device can be found in the description above. To avoid repetition, detailed description is appropriately omitted here. The embodiment of the present application provides a data security protection device, which includes:

[0087] An acquisition module 201 is configured to acquire permission information of a client and a first SQL statement, wherein the first SQL statement includes a statement type and fields, wherein the fields include encrypted fields;

[0088] A query module 202 is configured to query the target database based on the first SQL statement to obtain a query result if the statement type is a query type, wherein the query result includes the encrypted data corresponding to the encrypted field;

[0089] The processing module 203 is used to process the query result according to the permission information to obtain a target query result;

[0090] The sending module 204 is configured to return the target query result to the client.

[0091] Based on the above embodiment, the processing module 203 is specifically configured to:

[0092] Determining whether the client has viewing permission according to the permission information;

[0093] If the viewing permission is granted, the encrypted data in the query result is decrypted according to the key corresponding to the encrypted field to obtain the target query result;

[0094] If the user does not have the viewing permission, the query result is used as the target query result.

[0095] Based on the above embodiment, the first SQL statement further includes a query value corresponding to the encrypted field;

[0096] Based on the above embodiment, the query module 202 is specifically configured to:

[0097] Encrypt the query value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a second SQL statement;

[0098] Query the target database according to the second SQL statement to obtain a query result.

[0099] Based on the above embodiment, the first SQL statement further includes an operation value corresponding to the encrypted field;

[0100] Based on the above embodiment, the device further includes an operating module, which is used to:

[0101] If the statement type is an operation type, determining whether the client has the corresponding operation permission based on the permission information, the operation type includes adding, deleting or modifying;

[0102] If the client has the corresponding operation permission, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a third SQL statement, and use the third SQL statement to perform an operation in the target database to obtain an operation result;

[0103] Sending the operation result to the client;

[0104] If the client does not have the corresponding operation authority, blocking the first SQL statement and obtaining blocking information;

[0105] The blocking information is sent to the client.

[0106] Based on the above embodiment, the field further includes a sensitive field;

[0107] Based on the above embodiment, the device further includes a sensitive query module, which is used to:

[0108] If the statement type is a query type and the client does not have viewing permission, rewrite the first SQL statement according to the sensitive algorithm corresponding to the sensitive field to obtain a fourth SQL statement;

[0109] Performing a query from the target database according to the fourth SQL statement to obtain a desensitized query result;

[0110] Return the desensitized query result to the client.

[0111] Based on the above embodiment, the device further includes a login confirmation receiving module, which is configured to:

[0112] Receive the client's login request;

[0113] Verifying the login request and obtaining user information of the client;

[0114] The authority information of the client is determined according to the user information, where the authority information includes viewing authority and operation authority for the target database.

[0115] Based on the above embodiment, the device further includes a management module, which is used to:

[0116] Add database data asset information, including database connection information, proxy IP and proxy port;

[0117] Configure corresponding blacklist and whitelist, access time period and permission information for the database according to the data asset information;

[0118] Encrypted information and sensitive information are configured in the database, wherein the encrypted information includes an encryption table, an encryption field, an encryption algorithm and a key, and the sensitive information includes a sensitive field and a sensitive algorithm.

[0119] Based on the above embodiment, the device further includes a library table operation module for:

[0120] If the statement type is a table creation statement and the client has corresponding permission information, sending the first SQL statement to the target database to obtain an execution result;

[0121] The execution result is returned to the client.

[0122] If the statement type is a database deletion statement, block the first SQL statement and obtain blocking information;

[0123] The blocking information is returned to the client.

[0124] Figure 3 The physical structure diagram of the electronic device provided in the embodiment of the present application is as follows: Figure 3As shown, the electronic device includes: a processor (processor) 301, a memory (memory) 302 and a bus 303; wherein,

[0125] The processor 301 and the memory 302 interact with each other via the bus 303;

[0126] The processor 301 is configured to call program instructions in the memory 302 to execute the methods provided by the above method embodiments.

[0127] The processor 301 can be an integrated circuit chip with signal processing capabilities. The above-mentioned processor 301 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0128] The memory 302 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0129] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments.

[0130] This embodiment provides a computer-readable storage medium, which stores computer instructions. The computer instructions enable the computer to execute the methods provided by the above method embodiments.

[0131] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or interactive connection shown or discussed can be through some interactive interfaces, indirect coupling or interactive connection of devices or units, which can be electrical, mechanical or other forms.

[0132] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0133] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0134] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0135] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A data security protection method, characterized in that: include: Obtaining permission information and a first SQL statement of the client, where the first SQL statement includes a statement type and fields, wherein the fields include encrypted fields; If the statement type is a query type, query the target database based on the first SQL statement to obtain a query result, where the query result includes the encrypted data corresponding to the encrypted field; Processing the query result according to the permission information to obtain a target query result; Returning the target query result to the client; The first SQL statement also includes a value corresponding to the encrypted field, and the method further includes: Determining whether the value corresponding to the encrypted field in the first SQL statement meets the data type requirements of the encrypted field, wherein the data type requirements include verification of integer type, string type, time type, and date type; If the value corresponding to the encrypted field does not meet the data type requirement, blocking the first SQL statement, obtaining blocking information, and sending the blocking information to the client; The querying the target database based on the first SQL statement to obtain the query result includes: If the value corresponding to the encrypted field meets the data type requirement and the statement type is a query type, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a second SQL statement; querying the target database according to the second SQL statement to obtain a query result; If the value corresponding to the encrypted field meets the data type requirement and the statement type is an operation type, determine whether the client has the corresponding operation permission based on the permission information, and the operation type includes insert, delete, or update; When the client has the corresponding operation permission, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a third SQL statement; Performing an operation in the target database using the third SQL statement to obtain an operation result, and returning the operation result to the client; When the client does not have the corresponding operation authority, the first SQL statement is blocked, blocking information is obtained, and the blocking information is sent to the client.

2. The method according to claim 1, characterized in that The processing of the query result according to the permission information to obtain a target query result includes: Determining whether the client has viewing permission according to the permission information; If the viewing permission is granted, the encrypted data in the query result is decrypted according to the key corresponding to the encrypted field to obtain the target query result; If the user does not have the viewing permission, the query result is used as the target query result.

3. The method according to claim 1, characterized in that Before obtaining the client's permission information and the first SQL statement, the method further includes: Receive the client's login request; Verifying the login request and obtaining user information of the client; The authority information of the client is determined according to the user information, where the authority information includes viewing authority and operation authority for the target database.

4. The method according to claim 1, wherein The method further comprises: Add database data asset information, including database connection information, proxy IP and proxy port; Configure corresponding blacklist and whitelist, access time period and permission information for the database according to the data asset information; Encrypted information and sensitive information are configured in the database, wherein the encrypted information includes an encryption table, an encryption field, an encryption algorithm and a key, and the sensitive information includes a sensitive field and a sensitive algorithm.

5. A data security protection device, characterized in that: include: An acquisition module, configured to acquire permission information of a client and a first SQL statement, wherein the first SQL statement includes a statement type and fields, wherein the fields include encrypted fields; a query module configured to, if the statement type is a query type, query the target database based on the first SQL statement to obtain a query result, wherein the query result includes the encrypted data corresponding to the encrypted field; A processing module, configured to process the query result according to the permission information to obtain a target query result; A sending module, configured to return the target query result to the client; The first SQL statement also includes a value corresponding to the encrypted field, and the device further includes: a judgment module, configured to judge whether the value corresponding to the encrypted field in the first SQL statement meets the data type requirement of the encrypted field, wherein the data type requirement includes verification of integer, string, time, and date types; if the value corresponding to the encrypted field does not meet the data type requirement, block the first SQL statement, obtain blocking information, and send the blocking information to the client; The query module is further configured to, if the value corresponding to the encrypted field meets the data type requirement and the statement type is a query type, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a second SQL statement; and query the target database according to the second SQL statement to obtain a query result; The query module is also used to determine whether the client has the corresponding operation permission according to the permission information if the value corresponding to the encrypted field meets the data type requirement and the statement type is an operation type, and the operation type includes insert, delete or update; when the client has the corresponding operation permission, encrypt the value corresponding to the encrypted field in the first SQL statement according to the encryption algorithm corresponding to the encrypted field to obtain a third SQL statement; use the third SQL statement to operate in the target database, obtain the operation result, and return the operation result to the client; when the client does not have the corresponding operation permission, block the first SQL statement, obtain blocking information, and send the blocking information to the client.

6. An electronic device, characterized in that: include: processor, memory, and bus, wherein, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor can execute the method according to any one of claims 1 to 4 by calling the program instructions.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which, when executed by a computer, enable the computer to perform the method according to any one of claims 1 to 4.

Images