Method and device for accessing database

Abstract

The present application relates to the field of data processing and provides a method and apparatus for accessing a database, which can ensure data security during user-database interaction and effectively reduce performance overhead. The method comprises: receiving an encrypted data calculation request from a database kernel, the encrypted data calculation request being used to request calculation of a user's encrypted data, the database kernel running in a non-secure execution environment; receiving encrypted data from the database kernel, the encrypted data being all encrypted data in the user's query request; responding to the encrypted data calculation request, decrypting and calculating the encrypted data to obtain a calculation result; encrypting the calculation result to obtain an encrypted calculation result; and sending the encrypted calculation result to the database kernel.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and more specifically, to a method and device for accessing a database. Background Art

[0002] As one of the important basic software, the security protection of databases has become a challenge that needs to be solved urgently. In order to prevent illegal programs and malicious administrators from tampering with or stealing users' sensitive data, the industry often encrypts data and stores sensitive data in ciphertext. However, when users operate on these sensitive data (such as queries), the ciphertext still needs to be decrypted in the corresponding computing platform, which means that at a certain runtime moment, the data still exists in plaintext in the memory of the computing platform, exposing the plaintext data to great security risks. In addition, the technical solution of performing operations on ciphertext based on cryptographic algorithms can only complete some operations such as equivalence queries and sorting, and the execution performance is generally poor. Therefore, there is an urgent need for a method to protect the security of users' sensitive data during interaction with the database. Summary of the Invention

[0003] The present application provides a method and device for accessing a database, which can ensure data security during the interaction between users and the database and effectively reduce performance overhead.

[0004] In a first aspect, a method for accessing a database is provided, which is executed in a trusted execution environment and includes: receiving an encrypted data calculation request sent by a database kernel, the encrypted data calculation request being used to request calculation of a user's encrypted data, the database kernel running in a non-secure execution environment; receiving encrypted data sent by the database kernel, the encrypted data being all encrypted data in the user query request; decrypting and calculating the encrypted data in response to the encrypted data calculation request to obtain a calculation result; encrypting the calculation result to obtain an encrypted calculation result; and sending the encrypted calculation result to the database kernel.

[0005] The method for accessing a database in an embodiment of the present application avoids frequent switching between the trusted execution environment and the non-secure execution environment when requesting and transmitting data by sending encrypted data to a module in a trusted execution environment, thereby reducing performance overhead; the encrypted data is sent to the module in the trusted execution environment before performing encrypted data calculations, so that during the encrypted data calculation process, there is no need to request data in the non-secure execution environment, thereby avoiding the disclosure of the access mode to the data during the execution process, and providing higher security.

[0006] In combination with the first aspect, in certain implementations of the first aspect, receiving encrypted data sent by a database kernel includes: receiving a data feature value sent by the database kernel, the data feature value being used to indicate the encrypted data; when the data feature value is not found in the cache record, sending first feedback to the database kernel; and receiving the encrypted data sent by the database kernel in response to the first feedback.

[0007] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: decrypting the encrypted data to obtain plaintext data; marking the plaintext data with a data feature value and storing the plaintext data; and adding the data feature value to a cache record.

[0008] In combination with the first aspect, in certain implementations of the first aspect, receiving encrypted data sent by a database kernel includes: receiving a data characteristic value sent by the database kernel, the data characteristic value being used to indicate the encrypted data; when the data characteristic value is queried in a cache record, sending second feedback to the database kernel; and obtaining plaintext data corresponding to the data characteristic value from stored plaintext data based on the data characteristic value, the plaintext data being data after decryption of the encrypted data.

[0009] The method for accessing the database in the embodiment of the present application decrypts the encrypted data and caches it in the TEE. When the calculation of the encrypted data needs to be performed again within a period of time, there is no need to transmit and decrypt the encrypted data again, which further reduces performance overhead.

[0010] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: receiving an identity authentication request forwarded by a database kernel, the identity authentication request being initiated by a database client, and the database client running in a non-secure execution environment; sending identity authentication information to the database kernel; receiving an encrypted data calculation request sent by the database kernel, the encrypted data calculation request being sent after authentication based on the identity authentication information is passed.

[0011] The method for accessing a database in an embodiment of the present application verifies the legitimacy of the trusted execution environment before data transmission, thereby preventing illegal programs or attackers from stealing user data by impersonating the trusted execution environment, thereby ensuring user data security.

[0012] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: receiving a user's data key forwarded by a database kernel, the data key being encrypted by an ECDH algorithm; generating a verification key, encryption and decryption keys, and an initial vector value based on the data key; receiving encrypted data sent by the database kernel; and verifying the integrity of each piece of data in the encrypted data based on the verification key.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the encrypted data is data that has passed integrity verification.

[0014] In combination with the first aspect, in certain implementations of the first aspect, the encrypted data is decrypted and calculated according to the encrypted data calculation request, including: decrypting each piece of data in the encrypted data according to the encryption and decryption keys and the initial vector value to obtain the plaintext data corresponding to each piece of data; calling the operator according to the encrypted data calculation request to calculate the plaintext data corresponding to each piece of data.

[0015] In combination with the first aspect, in some implementations of the first aspect, encrypting the calculation result includes: encrypting the calculation result according to encryption and decryption keys and the initial vector value.

[0016] The method for accessing a database in an embodiment of the present application can further ensure the security of user data by encrypting and decrypting data using a key derived from the user's data key.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the method further includes: setting a timer; based on the timer exceeding a first preset time or receiving an exit request initiated by the database client forwarded by the database kernel: clearing encrypted data, verification keys, encryption and decryption keys, and initial vector values.

[0018] In combination with the first aspect, in some implementations of the first aspect, the method further includes: utilizing an intermediate adaptation layer to connect to an underlying hardware platform.

[0019] In a second aspect, a method for accessing a database is provided, which is executed in a non-secure execution environment, including: sending an encrypted data calculation request to a ciphertext operation module, the encrypted data calculation request is used to request the calculation of the user's encrypted data, and the ciphertext operation module runs in a trusted execution environment; sending encrypted data to the ciphertext operation module, the encrypted data being all encrypted data in the user's query request; and receiving the encrypted calculation result sent by the ciphertext operation module.

[0020] In combination with the second aspect, in certain implementations of the second aspect, sending encrypted data to the ciphertext operation module includes: sending a data characteristic value to the ciphertext operation module, where the data characteristic value is used to indicate the encrypted data; receiving first feedback, where the first feedback indicates that the ciphertext operation module has not queried the data characteristic value in the cache record; and sending the encrypted data to the ciphertext operation module.

[0021] In combination with the second aspect, in certain implementations of the second aspect, sending encrypted data to the ciphertext operation module also includes: sending a data characteristic value to the ciphertext operation module, the data characteristic value is used to indicate the encrypted data; receiving second feedback, the second feedback indicating that the ciphertext operation module has queried the data characteristic value in the cache record.

[0022] According to a third aspect, a device for accessing a database is provided. The device is set in a trusted execution environment, and the device includes: a transceiver module for receiving an encrypted data calculation request sent by a database kernel, the encrypted data calculation request is used to request the calculation of the user's encrypted data; the transceiver module is also used to receive encrypted data sent by the database kernel, the encrypted data being all encrypted data in the user query request; an execution module, in response to the encrypted data calculation request, for decrypting and calculating the encrypted data to obtain a calculation result; the execution module is also used to encrypt the calculation result to obtain an encrypted calculation result; the transceiver module is also used to send the encrypted calculation result to the database kernel.

[0023] In combination with the third aspect, in certain implementations of the third aspect, the transceiver module receives encrypted data sent by the database kernel, including: the transceiver module is also used to receive data feature values ​​sent by the database kernel, and the data feature values ​​are used to indicate the encrypted data; when the execution module does not query the data feature values ​​in the cache record, the transceiver module is also used to send a first feedback to the database kernel; the transceiver module is also used to receive encrypted data sent by the database kernel in response to the first feedback.

[0024] In combination with the third aspect, in certain implementations of the third aspect, the execution module is also used to decrypt the encrypted data to obtain plaintext data; the execution module is also used to mark the plaintext data with a data characteristic value and store the plaintext data; the execution module is also used to add the data characteristic value to the cache record.

[0025] In combination with the third aspect, in certain implementations of the third aspect, the transceiver module receives encrypted data sent by the database kernel, and also includes: the transceiver module is also used to receive data characteristic values ​​sent by the database kernel, and the data characteristic values ​​are used to indicate the encrypted data; when the execution module queries the data characteristic values ​​in the cache record, the transceiver module is also used to send a second feedback to the database kernel; the transceiver module is also used to obtain the plaintext data corresponding to the data characteristic value from the stored plaintext data according to the data characteristic value, and the plaintext data is the data after decryption of the encrypted data.

[0026] In combination with the third aspect, in certain implementations of the third aspect, the transceiver module is also used to receive an identity authentication request forwarded by the database kernel, which is initiated by a database client, and the database client runs in a non-secure execution environment; the transceiver module is also used to send the identity authentication information to the database kernel; the transceiver module is also used to receive an encrypted data calculation request sent by the database kernel, which is sent after the identity authentication information is authenticated.

[0027] In combination with the third aspect, in certain implementations of the third aspect, the transceiver module is also used to receive the user's data key forwarded by the database kernel, and the data key is encrypted by the ECDH algorithm; the execution module is also used to generate a verification key, encryption and decryption keys and an initial vector value based on the data key; the transceiver module is also used to receive the encrypted data sent by the database kernel; the execution module is also used to verify the integrity of each piece of data in the encrypted data based on the verification key.

[0028] In combination with the third aspect, in certain implementations of the third aspect, the encrypted data is data that has passed integrity verification.

[0029] In combination with the third aspect, in certain implementations of the third aspect, the execution module decrypts and calculates the encrypted data according to the encrypted data calculation request, including: decrypting each piece of data in the encrypted data according to the encryption and decryption keys and the initial vector value to obtain the plaintext data corresponding to each piece of data; calling the operator according to the encrypted data calculation request to calculate the plaintext data corresponding to each piece of data.

[0030] In combination with the third aspect, in certain implementations of the third aspect, the execution module encrypts the calculation result, including: encrypting the calculation result according to the encryption and decryption keys and the initial vector value.

[0031] In combination with the third aspect, in certain implementations of the third aspect, the device further includes a timer, and based on the timer exceeding a first preset time or the transceiver module receiving an exit request initiated by the database client forwarded by the database kernel: the execution module is also used to clear the encrypted data, verification key, encryption and decryption keys and initial vector value.

[0032] In combination with the third aspect, in certain implementations of the third aspect, the transceiver module and the execution module are connected to the underlying hardware platform using an intermediate adaptation layer.

[0033] Since the intermediate adaptation layer module adapts to the programming interfaces provided by different TEEs, the functional modules in the TEE can be seamlessly migrated between different computing platforms, facilitating secondary development.

[0034] In a fourth aspect, a device for accessing a database is provided, which is set in a non-secure execution environment and includes: a transceiver module for sending an encrypted data calculation request to a ciphertext operation module, the encrypted data calculation request is used to request the calculation of the user's encrypted data. The ciphertext operation module runs in a trusted execution environment; the transceiver module is also used to send encrypted data to the ciphertext operation module, the encrypted data is all encrypted data in the user query request; the transceiver module is also used to receive the encrypted calculation result sent by the ciphertext operation module.

[0035] In combination with the fourth aspect, in certain implementations of the fourth aspect, the transceiver module sends encrypted data to the ciphertext operation module, specifically for: sending data characteristic values ​​to the ciphertext operation module, the data characteristic values ​​being used to indicate the encrypted data; receiving first feedback, the first feedback indicating that the ciphertext operation module has not found the data characteristic values ​​in the cache record; and sending encrypted data to the ciphertext operation module.

[0036] In combination with the fourth aspect, in certain implementations of the fourth aspect, the transceiver module sends encrypted data to the ciphertext operation module, specifically for: sending data characteristic values ​​to the ciphertext operation module, the data characteristic values ​​being used to indicate the encrypted data; and receiving second feedback, the second feedback indicating that the ciphertext operation module has queried the data characteristic values ​​in the cache record.

[0037] In the fifth aspect, a data processing device is provided, characterized in that it includes a database kernel deployed in a non-secure execution environment and a data processing module deployed in a trusted execution environment, and the data processing module is used to execute the method in any one of the implementation methods of the above-mentioned first and second aspects.

[0038] In the sixth aspect, a computer-readable storage medium is characterized in that it includes instructions; the instructions are used to implement the method in any one of the implementation methods of the first and second aspects above.

[0039] In a seventh aspect, a chip is provided, which obtains an instruction and executes the instruction to implement the method of accessing a database in any one of the implementations of the first and second aspects above.

[0040] Optionally, as an implementation, the chip includes a processor and a data interface, and the processor reads instructions stored in the memory through the data interface to execute the method for accessing the database in any one of the implementations of the first and second aspects above.

[0041] Optionally, as an implementation method, the chip may also include a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the method for accessing the database in any one of the implementation methods of the first and second aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the architecture of a computing device of the present application;

[0043] Figure 2 is a schematic block diagram of the system architecture of this application;

[0044] Figure 3 is a flowchart of the method for accessing a database of the present application;

[0045] Figure 4 This is a schematic flow chart of the method for accessing a database in the present application;

[0046] Figure 5 This is an architectural diagram of a specific application of the method for accessing a database of the present application;

[0047] Figure 6 This is a schematic block diagram of the identity authentication process in the method for accessing a database of the present application;

[0048] Figure 7 is a schematic block diagram of an exit process in the method for accessing a database of the present application;

[0049] Figure 8 It is a schematic block diagram of the device for accessing a database of the present application. DETAILED DESCRIPTION

[0050] In order to facilitate understanding of the technical solution of this application, a brief introduction to the concepts involved in this application is first given.

[0051] Database kernel: Also known as the database engine, it is the core functional set that completes the database management system (DBMS)'s data operations. Generally, the database kernel consists of five parts: the parser, planner, optimizer, executor, and storage engine. The parser parses the structured query language (SQL) entered by the database user lexically and grammatically to determine the user's query intent; the planner generates the corresponding execution plan based on the parsed results of the statement; the optimizer optimizes the initially generated execution plan to efficiently complete the user's requested operations; the executor executes each operation step in the optimized execution plan according to the plan to obtain the results required by the user; the storage engine is responsible for reading, writing, and indexing functions in the above process, thereby providing input and output capabilities for other functional components.

[0052] Query request: one or a group of SQL statements entered by the user.

[0053] Operator: Also known as computing primitive, operator is the most basic and direct technical operation of data calculation, such as comparison operators (>, <, ≥, ≤), mathematical operators (+, -, %), logical relationship operations (and, or, not), etc.

[0054] Remote attestation: Trusted execution environments (TEEs) typically process sensitive and confidential data. In cloud computing and other application scenarios, when users request computing services within a TEE on a remote server, it's difficult to determine whether the service is running on a genuine, trusted (legitimate) computing platform or in an environment crafted by an attacker (illegal). To protect user confidential data and identify a genuine and trusted TEE environment, computing or service functions within the TEE can be proven legitimate to remote users through remote attestation, using a certificate chain signed by a key endorsed by the hardware platform (manufacturer).

[0055] Session ID: A way for a computer system (usually a server) to identify and track the actions of an individual user during any particular session.

[0056] RSA algorithm: One of the most widely used public key cryptography systems. RSA is the first letter of the surnames of the three proposers.

[0057] Key Derivation Function (HKDF): It is a fundamental component of a cryptographic system. Its goal is to obtain some initial key material and derive one or more highly secure keys from it.

[0058] The technical solution in this application will be described below with reference to the accompanying drawings.

[0059] Figure 1 1 is a schematic diagram of the architecture of a computing device 100 provided in an embodiment of the present application. The computing device 200 may be a server, a computer, or other device with computing capabilities. Figure 1 The computing device 100 shown includes at least one processor 110 and a memory 120 .

[0060] The processor 110 executes the instructions in the memory 120, causing the computing device 100 to implement the method for accessing a database provided in this application, such as implementing the steps performed by the apparatus for accessing a database. Alternatively, the processor 110 executes the instructions in the memory 120, causing the computing device 100 to implement the apparatus for accessing a database provided in this application, such as implementing the various functional modules included in the apparatus for accessing a database.

[0061] Optionally, the computing device 100 further includes a system bus, wherein the processor 110 and the memory 120 are respectively connected to the system bus. The processor 110 can access the memory 120 through the system bus. For example, the processor 110 can read and write data or execute code in the memory 120 through the system bus. The system bus is a peripheral component interconnect express (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus is divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 1 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0062] In one possible implementation, the processor 110 may be configured to interpret computer program instructions (or codes) and process data in the computer software, wherein the computer program instructions and the data in the computer software may be stored in the memory 120 or the cache 116 .

[0063] Optionally, the processor 110 may be an integrated circuit chip having signal processing capabilities. By way of example and not limitation, the processor 110 is a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The general-purpose processor is a microprocessor, etc. For example, the processor 110 is a central processing unit (CPU).

[0064] Optionally, each processor 110 includes at least one processing unit 112 and a memory control unit 114 .

[0065] Processing unit 112, also known as a core, is the most important component of a processor. Processing unit 112 is manufactured from single-crystal silicon using a specific production process. All processor calculations, command reception, command storage, and data processing are performed by the core. Each processing unit independently executes program instructions, leveraging parallel computing capabilities to accelerate program execution. Each processing unit has a fixed logical structure. For example, a processing unit includes logical units such as a level 1 cache, a level 2 cache, an execution unit, an instruction-level unit, and a bus interface.

[0066] In one implementation example, the memory control unit 114 is configured to control data exchange between the memory 120 and the processing unit 112. Specifically, the memory control unit 114 receives memory access requests from the processing unit 112 and controls access to the memory based on the memory access requests. By way of example and not limitation, the memory control unit is a device such as a memory management unit (MMU).

[0067] In one implementation example, each memory control unit 114 addresses the memory 120 via a system bus. An arbiter (not shown) is configured in the system bus to handle and coordinate competing accesses by multiple processing units 112 .

[0068] In an implementation example, the processing unit 112 and the memory control unit 114 are connected to each other via connection lines inside the chip, such as address lines, so as to achieve communication between the processing unit 112 and the memory control unit 114 .

[0069] Each processor 110 optionally includes a cache 116, which is a buffer for data exchange (called a cache). When a processing unit 112 needs to read data, it first searches the cache for the required data. If the data is found, the request is executed directly; otherwise, the request is searched from memory. Because cache runs much faster than memory, the cache helps the processing unit 112 run faster.

[0070] Memory 120 can provide runtime space for processes in computing device 100. For example, memory 120 stores computer programs (specifically, program code) used to generate processes. After the processor executes the computer program to generate a process, the processor allocates corresponding storage space for the process in memory 120. Furthermore, the aforementioned storage space further includes a text segment, an initialized data segment, a bit-initialized data segment, a stack segment, a heap segment, and so on. Memory 120 stores data generated during the execution of the process, such as intermediate data or process data, in the storage space corresponding to the aforementioned process.

[0071] Memory, also known as internal storage, is used to temporarily store data processed by processor 110 and data exchanged with external storage devices such as a hard disk. As long as the computer is running, processor 110 will load the data to be calculated into memory for calculation. Once the calculation is complete, processing unit 112 will transmit the result.

[0072] By way of example and not limitation, memory 120 is a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Non-volatile memories include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memories include random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DRRAM). It should be noted that the memory 120 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0073] The structure of the computing device 100 listed above is only an example description, and the present application is not limited thereto. The computing device 100 includes various hardware in the computing system in the prior art. For example, the computing device 100 also includes other memories besides the memory 120, such as disk storage, etc. It should be understood by those skilled in the art that the computing device 100 may also include other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the above-mentioned computing device 100 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the above-mentioned computing device 100 may also include only the devices necessary to implement the embodiments of the present application, and does not necessarily include Figure 1 All devices shown in .

[0074] Since data in an open environment may be exposed to various attacks, the use of a trusted execution environment to process encrypted data at runtime has become a hot topic of current research. TEE is a secure area within the central processing unit (CPU), running in an independent environment and in parallel with the operating system. The CPU ensures that the confidentiality and integrity of the data in the TEE are protected. Trusted applications running in the TEE can access the full functionality of the device's main processor and memory, while hardware isolation protects TEE-related components from being affected by user-installed applications running in the main operating system. In short, the code and data running in the TEE are confidential and cannot be tampered with.

[0075] Currently, trusted execution environment-based database access methods primarily include database kernel-level protection, executor-level protection, and operator-level protection. Limited by current hardware conditions, TEEs impose numerous restrictions on the size and memory usage of applications running within them, making them incapable of running large, complex applications. Therefore, TEE-based database kernels must streamline their functionality. However, current database kernel-based isolation solutions suffer from large code size, a large trusted computing base (TCB), and difficulties in adequate testing and vulnerability patching. In contrast, executor-based isolation and secure operation solutions further streamline functionality and code. However, because executors must access data storage files from the non-secure domain, their input and output operations still incur significant overhead, and their design and implementation still face the challenge of securely decoupling the database engine. Operator-level TEE-based isolation securely isolates only data computation functions, minimizing code size and TCB. However, implementation requires frequent operations on each row of processed data, resulting in frequent switching between secure and non-secure domains and significant performance overhead. In addition, the above three database execution methods are mainly based on Intel SGX (softwareguard extension) technology, which is tightly coupled with the underlying hardware platform, and the technical solutions have poor portability.

[0076] Figure 2 A schematic block diagram of the system architecture of an embodiment of the present application is shown in FIG. Figure 2 As shown, the system architecture of the embodiment of the present application includes modules running in a rich execution environment (REE) and modules running in a TEE. The REE is a parallel operating environment with the TEE, with its own execution space. It has good openness and scalability, but it has many security risks and is vulnerable to attacks. The following introduces the system architecture of the embodiment of the present application.

[0077] The database kernel running in the REE includes, in addition to the parser, planner, optimizer, executor and storage engine described above, the system architecture of the embodiment of the present application also includes an authentication proxy module, which is responsible for assisting the database client in remote authentication with the identity authentication module in the TEE and forwarding communication data in the process. Since the TEE cannot directly communicate over the network, the remote authentication request is relayed through the authentication proxy module in the database kernel of the REE. Specifically, the authentication proxy module calls the corresponding ecall (enclave call) interface to request certificate information from the identity authentication module in the TEE. The identity authentication module performs an integrity check on the request data and then transmits the certificate information to the identity authentication proxy module, which is then sent to the client for signature verification. The ecall is a programming interface provided for a program in a non-secure execution environment to call a software function in a trusted execution environment. In the system architecture of the embodiment of the present application, the database kernel can be deployed on a physical machine (e.g., on a host operating system) or in a virtual machine (e.g., a cloud database), where the host hardware can use any mainstream instruction set architecture (ISA) platform, such as Intel x86, ARM, RISC-V, and other computing platforms.

[0078] The modules running in TEE include ciphertext operation module, identity authentication module and intermediate adaptation layer module.

[0079] The ciphertext operation module specifically includes an operator set submodule, a key management submodule, and a data cache submodule. The operator set submodule implements the computational primitives necessary for data computation, including comparison operators, bitwise operations, pattern matching, mathematical calculations, time and date processing, data type conversion, network address function operations, text retrieval operations, set operations, and statistical operations. The key management submodule is responsible for storing and managing user keys sent by the database client. It derives data verification keys, data encryption / decryption keys, and initialization vectors from these keys according to corresponding algorithms, and cleans up key information used in each session after the session ends. The data cache submodule is responsible for calculating the data characteristic value (HASHSUM) of the ciphertext data sent by the executor and decrypting it. If the HASHSUM value is not currently in the cache, the corresponding plaintext information is cached. The data cache submodule manages the plaintext data corresponding to the ciphertext data using a hash table. This establishes an index relationship between the "ciphertext data HASHSUM value" as the key and the corresponding plaintext data as the value. The HASHSUM value can be calculated using a public algorithm.

[0080] The identity authentication module is used to receive the database client authentication request forwarded by the authentication proxy module in the REE, thereby establishing a secure connection with the database client.

[0081] The intermediate adaptation layer module is used to decouple the ciphertext operation module and identity authentication module from the specific TEE hardware platform. The intermediate adaptation layer shields the different interfaces and capabilities of the underlying hardware platform, provides a unified interface for the ciphertext operation module and identity authentication module, and converts the relevant call interfaces to the programming interfaces provided by the target hardware platform according to the target hardware platform parameters specified in the configuration file, thereby achieving cross-platform portability of the entire system. The hardware platform can be Intel SGX, AMD SEV, ARM TrustZone, RISC-V Keystone, etc.

[0082] Figure 3 A flowchart of a method for accessing a database according to an embodiment of the present application is shown. Figure 3 As shown, it includes steps 301 to 305, wherein Figure 3 The method of accessing the database is executed in the trusted execution environment TEE, which can be specifically Figure 1 The computing devices shown are executed and are introduced below respectively.

[0083] S301, receiving an encrypted data calculation request sent by a database kernel, where the encrypted data calculation request is used to request calculation of encrypted data of a user, and the database kernel runs in a non-secure execution environment.

[0084] Specifically, the user sends a query request to the database client, where the query request may include the SQL statement entered by the user, the name of the encrypted data column, the operation of the encrypted data and related operation parameters, etc. The database client runs in a non-secure execution environment. The database client encrypts the part of the query request involving user confidential information to obtain encrypted data, and then the database client sends the query request (including unencrypted data and encrypted data) to the database kernel. After the database kernel receives the query request, the parser in the database kernel parses the query request, the planner generates the corresponding execution plan based on the parsing results, the optimizer optimizes the execution plan, and the executor executes according to the optimized execution plan. As for encrypted data, since the database kernel running in the REE cannot directly operate on the encrypted data, the database kernel needs to send an encrypted data calculation request to the TEE, that is, perform the calculation of the encrypted data in the TEE.

[0085] Here, "the database client runs in a non-secure execution environment" means that the database client can be in a local REE (i.e., on the computer where the database kernel runs) or in a REE on another computer. In this case, the database client and the database kernel can communicate directly over the network. It should be understood that this description applies to any situation in which the database client runs in a non-secure execution environment.

[0086] S302: Receive encrypted data sent by the database kernel, where the encrypted data is all encrypted data in the user query request.

[0087] Since the calculation of encrypted data needs to be performed in the TEE, all encrypted data needs to be sent to the TEE. In the method of accessing the database in the embodiment of the present application, the way to send encrypted data to the TEE can be to send all the encrypted data to the TEE at once, or to send all the encrypted data to the TEE in multiple times until all the encrypted data is sent. After that, during the calculation process of the encrypted data, the modules in the TEE no longer request any data from the REE, avoiding frequent switching between the REE / TEE, and not leaking the access mode of the data during the calculation process, thus ensuring data security.

[0088] S303: In response to the encrypted data calculation request, decrypt and calculate all the encrypted data to obtain a calculation result.

[0089] After receiving all the encrypted data, all the encrypted data are decrypted to obtain the corresponding plaintext data, and then corresponding calculations are performed on the plaintext data according to the encrypted data calculation request to obtain the corresponding calculation results.

[0090] S304: Encrypt the calculation result to obtain an encrypted calculation result.

[0091] S305: Send the encrypted calculation result to the database kernel.

[0092] To ensure data security, after obtaining the calculation results, they are encrypted in the TEE and then sent to the database kernel. The database kernel then processes and caches the encrypted results as necessary, ending the current calculation process. Finally, the database kernel sends the processed results to the database client.

[0093] Optionally, in S302, before receiving all the encrypted data sent by the database kernel, the method for accessing the database in an embodiment of the present application further includes receiving a data feature value sent by the database kernel, wherein the data feature value is used to indicate the encrypted data, and is calculated by the database kernel based on all the encrypted data and corresponds to all the encrypted data. Then, the cache record is queried based on the data feature value, and multiple data feature values ​​are recorded in the cache record. If the data feature value can be queried, it means that the encrypted data corresponding to the data feature value has been cached in the TEE. If the data feature value is not queried in the cache record, a first feedback is sent to the database kernel, and the first feedback indicates that the data feature value is not queried in the cache record. After receiving the first feedback, the database kernel sends all the encrypted data corresponding to the data feature value to the TEE.

[0094] Optionally, after receiving all encrypted data sent by the database kernel, the database access method of an embodiment of the present application further includes decrypting all encrypted data to obtain corresponding plaintext data, marking the plaintext data with a data feature value, storing the plaintext data, and adding the data feature value to a cache record. In this way, within a certain period of time, when the database kernel again requests a calculation involving the encrypted data, the corresponding calculation can be performed directly based on the stored plaintext data, without having to request the encrypted data from the database kernel again or decrypt the encrypted data again, thereby saving overhead.

[0095] Optionally, upon receiving a data feature value sent by the database kernel, if the data feature value is found in a cache record, a second feedback is sent to the database kernel. This second feedback indicates that the data feature value was found in the cache record. This eliminates the need to request encrypted data from the database kernel. Instead, the corresponding plaintext data stored in the TEE is directly retrieved based on the data feature value, and then the corresponding calculation is performed on the plaintext data according to the encrypted data calculation request.

[0096] In order to ensure the security of data transmission, before receiving the encrypted data calculation request sent by the database kernel, the method for accessing the database in the embodiment of the present application also includes verifying the legitimacy of the TEE. Specifically, the database client initiates identity authentication. Since network communication cannot be performed directly in the TEE, the database client sends the identity authentication request to the database kernel, and then the database kernel forwards the identity authentication request to the TEE. After the relevant identity authentication module in the TEE receives the identity authentication request, it sends the certificate information to the database kernel, which is then forwarded to the database client by the database kernel. After the database client verifies the certificate of the TEE, the database client establishes a secure connection with the database kernel. At this time, the encrypted data calculation request sent by the database kernel is based on the identity authentication.

[0097] After the database client establishes a secure connection with the database kernel, it sends the user's data key to the database kernel. To ensure the security of the user's data key during transmission, the data key is encrypted using the Elliptic Curve Diffie-Hellman key exchange (ECDH) encryption parameters agreed upon between the database client and the relevant identity authentication module in the TEE. The database kernel forwards the data key to the relevant key management module in the TEE. The key management module generates a verification key, encryption and decryption keys, and an initial vector value based on the data key. These are used to verify and encrypt / decrypt data during subsequent data transmission. The key generation algorithm can be a key derivation algorithm such as HKDF. The functions of the generated verification key, encryption and decryption key, and initial vector value include: in the above S302, after receiving all the encrypted data sent by the database kernel, verifying the integrity of each piece of data in all the encrypted data according to the verification key; in the above 303, decrypting and calculating all the encrypted data according to the encrypted data calculation request, including decrypting each piece of data in all the encrypted data according to the encryption and decryption key and the initial vector value, and then calling the operator to calculate each piece of data in all the encrypted data according to the encrypted data calculation request; and in the above 304, encrypting the calculation result, that is, encrypting the calculation result according to the encryption and decryption key and the initial vector value.

[0098] Optionally, the method for accessing a database in an embodiment of the present application further includes setting a timer for the current database access. When the timer exceeds a first preset time or receives a logout request initiated by the database client and forwarded by the database kernel, all encrypted data, verification keys, encryption / decryption keys, and initialization vector values ​​are cleared.

[0099] Optionally, the method for accessing the database in an embodiment of the present application further includes connecting to the underlying hardware platform using an intermediate adaptation layer. The intermediate adaptation layer decouples other functional modules within the TEE from the underlying hardware platform, that is, these functional modules do not directly rely on the programming interface development provided by a specific hardware platform (such as Intel SGX or ARM TrustZone). Since the intermediate adaptation layer adapts to the programming interfaces provided by different TEEs, the functional modules developed based on a certain hardware platform can be seamlessly migrated between different computing platforms, simplifying secondary development.

[0100] Figure 3The method of accessing the database by sending all encrypted data to the module in the TEE avoids frequent switching between the TEE and REE when requesting and transmitting data, thus reducing performance overhead. By sending all encrypted data to the module in the TEE before performing encrypted data calculations, there is no need to request data from the REE during the encrypted data calculation process, thus avoiding the leakage of access patterns to REE-side data during execution and providing higher security. In addition, by decrypting the encrypted data and caching it in the TEE, it is possible to avoid retransmitting and decrypting the encrypted data when calculations related to the encrypted data need to be performed again within a period of time, further reducing performance overhead.

[0101] Figure 4 A schematic flow chart of the method for accessing a database of the present application is shown and is described in detail below.

[0102] 1. In the session ID s In the process of encryption, the user initiates a query request involving encrypted data to the database server through the database client. The query request includes the SQL statement entered by the user, the name of the encrypted data column, the operation of the encrypted data and related operation parameters, etc. The data entered by the user is plain text. The client uses the data encryption key to encrypt the data that needs to be encrypted in the plain text (such as the operation parameters), and then sends the query request to the database kernel.

[0103] 2. The database kernel parses the query request, generates an execution plan, and executes it. Specifically, the parser in the database kernel parses the query request, including information such as the operations, tables / views, and encrypted data column names. The planner generates an execution plan, and the optimizer optimizes the plan before sending it to the executor.

[0104] 3. For operations involving encrypted data, the executor obtains all encrypted data involved in the operation through the storage engine and calculates the data characteristic value HASHSUM d , and then the executor calls the ecall interface to set the current timestamp T cur and HASHSUM d Transmitted to the data cache submodule in TEE.

[0105] 4. The data cache submodule queries the data cache record. If HASHSUM exists d The corresponding plaintext, the data cache submodule returns True to the database kernel, if HASHSUM does not exist d The corresponding plaintext will be returned to the database kernel. When the database kernel receives False, the executor in the database kernel calls the ecall interface to transfer all encrypted data to the ciphertext operation module. The data cache submodule uses the session ID s The user's data verification keym Verify the integrity of each piece of data, and then use the encryption / decryption key Key e and the initial vector value IV e Decrypt each piece of data, clear the ciphertext data and use HASHSUM d Mark these plaintext data and update the session ID s Corresponding data cache. Correspondingly, when the database kernel receives True, the corresponding encrypted data transmission, decryption and caching are not performed. Among them, the data verification key Key m , encryption / decryption key Key e and the initial vector value IV e See below for how to obtain Figure 4 Description.

[0106] 5. The executor calls the ecall interface to send the requested ciphertext calculation operation to the ciphertext operation module in the TEE. The ciphertext operation module obtains the HASHSUM through the data cache submodule in the TEE. d The corresponding plaintext data is then called on the corresponding operators one by one to perform the requested calculations.

[0107] 6. After the calculation is completed, the ciphertext operation module in TEE uses Key e and IV e Encrypt the calculation result, then call the ecall interface to return the encrypted calculation result to the database kernel, or call the ocall (out call) interface to transmit the calculation result to the executor, and finally reset the session ID s Timer id The ocall interface is a programming interface provided for programs in a trusted execution environment to call software functions in a non-secure execution environment. m , encryption / decryption key Key e and the initial vector value IV e See below for how to obtain Figure 4 Description.

[0108] 7. After receiving the encrypted calculation results from the ciphertext operation module, the executor performs necessary processing and caching, and then ends the current calculation round. Repeat steps 3 to 5 for other ciphertext operations.

[0109] 8. The executor returns the final encrypted calculation result to the client, and the client decrypts the encrypted calculation result and organizes the presentation.

[0110] Figure 5 The following is an architecture diagram showing a specific application of the method for accessing a database according to an embodiment of the present application. Figure 3 As shown, the database of the method for accessing a database in the present application can be a Gaussian database, and a secret database solution based on operator-level isolation is implemented based on the Kunpeng 920 computing platform. Kunpeng 920 is a processor designed and implemented based on the ARM aarch64 architecture, and provides a TEE environment based on ARM TrustZone technology. The Gaussian database kernel runs on the Euler OS operating system, and the ciphertext operation module, identity authentication module, and intermediate adaptation layer module are all located in the ARM TrustZone environment.

[0111] In order to safely and correctly query and calculate user confidential data, the database kernel executor needs to send the user confidential data to the ciphertext operation module running in the TEE when necessary, and the client also needs to send the saved user data key to the TEE for data encryption / decryption. For security reasons, before transmitting the above sensitive information, it is necessary to verify the legitimacy of the TEE to prevent illegal programs or attackers from stealing user data by impersonating the TEE. Therefore, the method for accessing the database in the embodiment of the present application uses an identity authentication module to realize the client's authentication of the TEE.

[0112] Figure 6 A schematic block diagram of the identity authentication process in the method for accessing a database in an embodiment of the present application is shown below. Figure 6 The identity authentication process in the method for accessing a database in an embodiment of the present application is introduced.

[0113] 1. Remote authentication is performed between the database client and the authentication module running in the TEE. The database client actively initiates the authentication request to the TEE. Since the module running in the TEE cannot directly communicate over the network, the authentication request is transferred through the authentication proxy module in the database kernel in the REE (see Figure 5 The authentication proxy module calls the corresponding ecall interface to request certificate information from the identity authentication module in the TEE. The identity authentication module performs an integrity check on the requested data and then transmits the certificate information to the identity authentication proxy module, which forwards it to the client for signature verification. After the identity certificate signature is verified, the client establishes a secure socket layer (SSL) connection with the database kernel.

[0114] 2. The database client and the identity authentication module in the TEE negotiate encryption parameters based on the Elliptic Curve Diffie-Hellman key Exchange (ECDH) mechanism, and encrypt the user key Key according to the negotiated ECDH encryption parameters. uEncryption is performed, and the ECDH encryption parameter negotiation request is also forwarded by the authentication proxy module calling the corresponding ecall interface. In order to ensure the security of ECDH encryption parameters during transmission, the identity authentication module and the client can use encryption methods such as RSA algorithm to encrypt before exchanging ECDH encryption parameters. After the negotiation is completed, the client will send the user ID s and the data key encrypted using the negotiated ECDH parameters u The data is transmitted to the authentication agent module, which calls the corresponding ecall interface to transmit the data to the key management submodule in the TEE.

[0115] 3. The key management submodule in TEE uses the above-agreed ECDH parameters to encrypt the encrypted data key Key u Decrypt and use a certain algorithm (such as HKDF) according to the data key Key u Derive the data verification key Key m , encryption / decryption key Key e and the initial vector value IV e , while recording the user ID s and the above Key m 、Key e IV e The corresponding relationship and clear the Key u Finally, the key management submodule is ID s Set the timer id The timer time can be pre-configured by the database administrator. It is worth noting that the key derivation method in this application can adopt any existing possible key derivation method, and this application does not limit it here.

[0116] After completing the above identity authentication steps, the key management submodule running in the TEE has obtained the user data verification and encryption / decryption keys. At this time, the user can initiate a ciphertext query request to the database kernel through the client. The ciphertext query request statement includes encrypted ciphertext operation parameters and plaintext query statements. The database kernel in the non-secure execution environment performs statement parsing, query plan generation, and query plan optimization. Finally, the executor in the database kernel executes the operations in the query plan. For operations involving encrypted data, the executor obtains all encrypted data at one time through the storage engine, and sends the encrypted data, encrypted operation parameters, and calculation type to the ciphertext operation module in the TEE. The specific process of encrypted data query calculation can be found in the above description. Figure 4 For the sake of brevity, the embodiments of the present application will not be described in detail here.

[0117] When the user obtains relevant ciphertext data query results and decides to actively exit, the method for accessing the database in an embodiment of the present application also includes the user closing the ciphertext query function or exiting the database connection, and the client actively initiating an exit phase operation to the database kernel. Figure 7 A schematic block diagram of the exit phase in the method for accessing a database described in this application is shown. Figure 7 As shown, if the user actively logs out, the client will log out and the user ID s The authentication proxy module is sent to the database kernel, and the authentication proxy module will exit the request and user ID s Forwarded to the ciphertext operation module in TEE, the ciphertext operation module clears the currently used key m 、Key e IV e and cached plaintext data. Optional, if the timer in the TEE id If the timeout is exceeded, the ciphertext operation module can also actively clear the currently used key Key m 、Key e IV e and cached plaintext data.

[0118] Compared with the existing method of accessing the database, the method of accessing the database in the embodiment of the present application can significantly reduce the switching overhead of TEE and REE by sending all the ciphertext data to the ciphertext operation module in TEE before calculation, and the ciphertext operation module decrypts all the ciphertext data. For example, assuming that there are 10,000 rows of records in the data table to be queried, and each row of records contains 128 bytes of ciphertext data, then according to calculations, it can be seen that the existing method of accessing the database requires 20,000 times to switch between TEE and REE, that is, for each piece of data, it is necessary to call the calculation function of TEE from REE, and switch back to REE after obtaining the calculation result, so that each piece of data needs to be switched twice; assuming that the upper limit of a single data transmission between REE and TEE is 128KB, the method of accessing the database in the embodiment of the present application calls TEE from REE 128*10000 / (128K)=10 times, and switches back to REE after obtaining the calculation result, a total of 20 times, which significantly reduces the switching overhead compared to the 20,000 times of the prior art.

[0119] Furthermore, the database access method of the present invention significantly reduces data decryption overhead by decrypting and caching ciphertext data. For example, an existing database access method takes m to decrypt 128 bytes of data each time, requiring 10,000 m for each decryption. Subsequent decryption of the same data requires the same decryption time. However, the database access method of the present invention only requires 10,000 m for the first decryption, and subsequent decryption of the same data does not require further decryption.

[0120] Figure 8 This is a schematic block diagram of a device 800 for accessing a database provided in an embodiment of the present application. The device 800 for accessing a database can execute Figure 3 、 4 To avoid repetition, the steps of the method for accessing a database in 6 and 7 are not described in detail here. The device for accessing a database 800 includes a transceiver module 810 and an execution module 820, which are briefly introduced below.

[0121] The transceiver module 810 is configured to receive an encrypted data calculation request sent by the database kernel. The encrypted data calculation request is used to request calculation of the user's encrypted data. The database kernel runs in a non-secure execution environment.

[0122] The transceiver module 810 is also used to receive encrypted data sent by the database kernel. The encrypted data is all the encrypted data in the user query request;

[0123] The execution module 820 is configured to decrypt and calculate the encrypted data in response to the encrypted data calculation request to obtain a calculation result.

[0124] The execution module 820 is further configured to encrypt the calculation result to obtain an encrypted calculation result.

[0125] The transceiver module 810 is further configured to send the encrypted calculation result to the database kernel.

[0126] Optionally, the transceiver module 810 receives encrypted data sent by the database kernel, including: the transceiver module 810 is further configured to receive a data characteristic value sent by the database kernel. The data characteristic value indicates the encrypted data; when the execution module does not find the data characteristic value in the cache record, the transceiver module is further configured to send a first feedback to the database kernel; and the transceiver module is further configured to receive the encrypted data sent by the database kernel in response to the first feedback.

[0127] Optionally, the execution module 820 is further used to decrypt the encrypted data to obtain plaintext data; the execution module 820 is further used to mark the plaintext data with a data feature value and store the plaintext data; the execution module 820 is further used to add the data feature value to the cache record.

[0128] Optionally, the transceiver module 810 receives encrypted data sent by the database kernel, and also includes: the transceiver module 810 is also used to receive data characteristic values ​​sent by the database kernel, and the data characteristic values ​​are used to indicate encrypted data; when the execution module queries the data characteristic values ​​in the cache record, the transceiver module 810 is also used to send a second feedback to the database kernel; the transceiver module 810 is also used to obtain plaintext data corresponding to the data characteristic values ​​from the stored plaintext data according to the data characteristic values, and the plaintext data is the data after decryption of the encrypted data.

[0129] Optionally, the transceiver module 810 is also used to receive an identity authentication request forwarded by the database kernel, which is initiated by the database client and the database client runs in a non-secure execution environment; the transceiver module 810 is also used to send the identity authentication information to the database kernel; the transceiver module 810 is also used to receive an encrypted data calculation request sent by the database kernel, which is sent after the identity authentication information is authenticated.

[0130] Optionally, the transceiver module 810 is also used to receive the user's data key forwarded by the database kernel, and the data key is encrypted by the ECDH algorithm; the execution module 820 is also used to generate a verification key, encryption and decryption keys and an initial vector value based on the data key; the transceiver module is also used to receive encrypted data sent by the database kernel; the execution module is also used to verify the integrity of each piece of data in the encrypted data based on the verification key.

[0131] Optionally, after the transceiver module 810 receives the encrypted data sent by the database kernel, the encrypted data is data that passes the integrity check.

[0132] Optionally, the execution module 820 decrypts and calculates the encrypted data according to the encrypted data calculation request, including: decrypting each piece of data in the encrypted data according to the encryption and decryption keys and the initial vector value; calling the operator to calculate each piece of data in the encrypted data according to the encrypted data calculation request.

[0133] Optionally, the execution module 820 encrypts the calculation result, including: encrypting the calculation result according to the encryption and decryption keys and the initial vector value.

[0134] Optionally, the device also includes a timer, based on the timer exceeding a first preset time or the transceiver module 810 receiving an exit request initiated by the database client forwarded by the database kernel: the execution module 820 is also used to clear encrypted data, verification keys, encryption and decryption keys and initial vector values.

[0135] Optionally, the transceiver module 810 and the execution module 820 in the device are connected to the underlying hardware platform using an intermediate adaptation layer.

[0136] The embodiment of the present application also provides a data processing device, which can be a hardware device such as a server, or a software device. The data processing device includes a database kernel deployed in a non-secure execution environment and a data processing module deployed in a trusted execution environment. The data processing module is used to execute the following Figure 3 、 4 , 6, and 7.

[0137] The embodiment of the present application also provides a computer-readable storage medium, including instructions; the instructions are used to implement the following Figure 3 、 4 , 6, and 7.

[0138] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0139] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0141] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0142] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0143] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0144] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for accessing a database, characterized in that: The method is performed in a trusted execution environment and includes: receiving an encrypted data calculation request sent by a database kernel, the encrypted data calculation request being used to request calculation of encrypted data of a user, the database kernel running in a non-secure execution environment; receiving encrypted data sent by the database kernel, wherein the encrypted data is all encrypted data in the user query request; In response to the encrypted data calculation request, decrypting and calculating the encrypted data to obtain a calculation result; Encrypting the calculation result to obtain an encrypted calculation result; The encrypted calculation result is sent to the database kernel.

2. The method according to claim 1, characterized in that The receiving of encrypted data sent by the database kernel includes: receiving a data characteristic value sent by the database kernel, wherein the data characteristic value is used to indicate the encrypted data; When the data feature value is not found in the cache record, sending a first feedback to the database kernel; The encrypted data sent by the database kernel in response to the first feedback is received.

3. The method according to claim 2, characterized in that The method further comprises: Decrypting the encrypted data to obtain plaintext data; Marking the plaintext data with the data characteristic value and storing the plaintext data; The data characteristic value is added to the cache record.

4. The method according to claim 1, wherein The receiving of encrypted data sent by the database kernel includes: receiving a data characteristic value sent by the database kernel, wherein the data characteristic value is used to indicate the encrypted data; When the data feature value is found in the cache record, sending a second feedback to the database kernel; Obtain plaintext data corresponding to the data characteristic value from stored plaintext data according to the data characteristic value, wherein the plaintext data is data obtained by decrypting the encrypted data.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: receiving an identity authentication request forwarded by the database kernel, where the identity authentication request is initiated by a database client running in a non-secure execution environment; Sending the identity authentication information to the database kernel; An encrypted data calculation request sent by the database kernel is received, where the encrypted data calculation request is sent after the identity authentication information is authenticated.

6. The method according to claim 5, characterized in that The method further comprises: Receive the user's data key forwarded by the database kernel, where the data key is encrypted using the ECDH algorithm; generating a verification key, encryption and decryption keys, and an initial vector value based on the data key; Receiving encrypted data sent by the database kernel; The integrity of each piece of data in the encrypted data is verified according to the verification key.

7. The method according to claim 6, characterized in that The encrypted data is data that has passed the integrity check.

8. The method according to claim 6 or 7, characterized in that The decrypting and calculating the encrypted data according to the encrypted data calculation request includes: Decrypting each piece of data in the encrypted data according to the encryption and decryption keys and the initial vector value to obtain plaintext data corresponding to each piece of data; One or more operators are called according to the encrypted data calculation request to calculate the plaintext data corresponding to each piece of data.

9. The method according to claim 6 or 7, characterized in that The encrypting the calculation result includes: The calculation result is encrypted according to the encryption and decryption keys and the initial vector value.

10. The method according to claim 6 or 7, characterized in that The method further comprises: Set a timer; Based on the timer exceeding a first preset time or receiving an exit request initiated by the database client forwarded by the database kernel: clearing the encrypted data, the verification key, the encryption and decryption keys, and the initial vector value.

11. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Use the intermediate adaptation layer to connect to the underlying hardware platform.

12. A device for accessing a database, characterized in that: The device is set in a trusted execution environment, and the device includes: a transceiver module, configured to receive an encrypted data calculation request sent by a database kernel, wherein the encrypted data calculation request is used to request calculation of encrypted data of a user, and the database kernel runs in a non-secure execution environment; The transceiver module is further configured to receive encrypted data sent by the database kernel, wherein the encrypted data is all encrypted data in the user query request; an execution module, responsive to the encrypted data calculation request, for decrypting and calculating the encrypted data to obtain a calculation result; The execution module is further configured to encrypt the calculation result to obtain an encrypted calculation result; The transceiver module is further configured to send the encrypted calculation result to the database kernel.

13. The device according to claim 12, characterized in that The transceiver module receives the encrypted data sent by the database kernel, including: The transceiver module is further configured to receive a data characteristic value sent by the database kernel, wherein the data characteristic value is used to indicate the encrypted data; When the data feature value is not found in the cache record, the transceiver module is further configured to send a first feedback to the database kernel; The transceiver module is further configured to receive the encrypted data sent by the database kernel in response to the first feedback.

14. The device according to claim 13, characterized in that The execution module is further configured to: Decrypting the encrypted data to obtain plaintext data; Marking the plaintext data with the data characteristic value and storing the plaintext data; The data characteristic value is added to the cache record.

15. The device according to claim 12, characterized in that The transceiver module receives the encrypted data sent by the database kernel, including: The transceiver module is further configured to receive a data characteristic value sent by the database kernel, wherein the data characteristic value is used to indicate the encrypted data; When the data feature value is found in the cache record, the transceiver module is further configured to send a second feedback to the database kernel; The transceiver module is further configured to obtain plaintext data corresponding to the data characteristic value from stored plaintext data according to the data characteristic value, wherein the plaintext data is data obtained by decrypting the encrypted data.

16. The device according to any one of claims 12 to 15, characterized in that The transceiver module is further configured to receive an identity authentication request forwarded by the database kernel, wherein the identity authentication request is initiated by a database client, and the database client runs in a non-secure execution environment; The transceiver module is further configured to send the identity authentication information to the database kernel; The transceiver module is further configured to receive an encrypted data calculation request sent by the database kernel, wherein the encrypted data calculation request is sent after the identity authentication information is authenticated.

17. The device according to claim 16, characterized in that The transceiver module is further configured to receive the user's data key forwarded by the database kernel, wherein the data key is encrypted using an ECDH algorithm; The execution module is further configured to generate a verification key, encryption and decryption keys, and an initial vector value based on the data key; The transceiver module is also used to receive encrypted data sent by the database kernel; The execution module is further configured to verify the integrity of each piece of data in the encrypted data according to the verification key.

18. The device according to claim 17, characterized in that The encrypted data is data that has passed the integrity check.

19. The device according to claim 17 or 18, characterized in that The execution module decrypts and calculates the encrypted data according to the encrypted data calculation request, including: Decrypting each piece of data in the encrypted data according to the encryption and decryption keys and the initial vector value to obtain plaintext data corresponding to each piece of data; The operator is called according to the encrypted data calculation request to calculate the plaintext data corresponding to each piece of data.

20. The device according to claim 17 or 18, characterized in that The execution module encrypts the calculation result, including: The calculation result is encrypted according to the encryption and decryption keys and the initial vector value.

21. The device according to claim 17 or 18, characterized in that The device further includes a timer, and based on the timer exceeding a first preset time or the transceiver module receiving an exit request initiated by the database client and forwarded by the database kernel: The execution module is further configured to clear the encrypted data, the verification key, the encryption and decryption keys, and the initial vector value.

22. The device according to any one of claims 12 to 15, characterized in that The transceiver module and the execution module are connected to the underlying hardware platform using an intermediate adaptation layer.

23. A data processing device, characterized in that: The method comprises a database kernel deployed in a non-secure execution environment and a data processing module deployed in a trusted execution environment, wherein the data processing module is used to execute the method according to any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that The method comprises instructions for implementing the method according to any one of claims 1 to 11.

25. A chip, characterized in that: The chip is installed in a communication device, and the chip includes a processor and a data interface. When the processor reads instructions through the data interface and runs, the communication device executes the method according to any one of claims 1 to 11.

Images