A data processing method and system for relational database

Abstract

This application discloses a data processing method and system for a relational database. The method includes: when a standby database replays a transaction log (WAL) sent by a primary database, the standby database determines whether a target WAL exists in the WAL, wherein the target WAL carries the encryption status of a specified page in the primary database; and the standby database processes the specified page based on the determination result. This application solves the incompatibility issues introduced when achieving data consistency between primary and standby databases in related technologies, achieving the technical effect of achieving data consistency between primary and standby databases while ensuring compatibility.

Description

Technical Field

[0001] The present application relates to the field of data security, and specifically to a data processing method and system for a relational database. Background Art

[0002] In related technologies, the method for achieving synchronous replication of primary and standby databases mainly involves occupying a flag bit in the WAL log. However, flag bits are a very scarce resource. Randomly occupying them will, on the one hand, restrict the development of other functions in the future. On the other hand, if the occupied flag bit conflicts with the open source community, it will seriously affect the evolution of the product, especially conflicts that may affect the code of physical storage.

[0003] Therefore, no effective solutions have been proposed for the above-mentioned technical problems existing in the related technologies. Summary of the Invention

[0004] The embodiments of the present application provide a data processing method and system for a relational database, so as to at least solve the incompatibility problem introduced when achieving data consistency in a primary and standby database in the related art.

[0005] According to one aspect of the present application, a data processing method for a relational database is provided, comprising: when the standby database replays the transaction log WAL sent by the primary database, the standby database determines whether a target WAL exists in the WAL, wherein the target WAL carries the encryption status of a specified page in the primary database; and the standby database processes the specified page according to the determination result.

[0006] Optionally, the standby database processes the designated page according to the judgment result, including: encrypting the designated page when the standby database determines that the target WAL exists; and not processing the designated page when the standby database determines that the target WAL does not exist.

[0007] Optionally, the encrypted data of the same page includes relation-level data, and the relation-level data includes at least one of the following: table data and index data.

[0008] Optionally, the method further includes: the primary database obtaining encryption parameters in the table data and / or the index data; when the encryption parameters are obtained and the encryption parameters are in an enabled state, the primary database encrypts the table data and / or the index data, wherein the encrypted pages of the table data and / or the index data carry an encryption mark.

[0009] Optionally, the method further includes: when a page in the main database disk is read into the memory, the main database determines whether the page to be read carries the encryption mark; when the page to be read carries the encryption mark, the main database decrypts the page to be read.

[0010] Optionally, the encryption tag includes multiple encryption tags, and the multiple encryption tags are set by a user of the relational database according to the page content to be written.

[0011] Optionally, the encryption mark is set on a designated flag bit of the encrypted page.

[0012] Optionally, when there are pages in an unencrypted state in the primary database disk, the method further includes: obtaining the pages in the unencrypted state; marking the pages in the unencrypted state as dirty pages, so that the pages marked as dirty pages are read from the disk into the memory again; and rewriting from the memory to the disk for encryption.

[0013] Optionally, when there are unencrypted pages in the primary database disk, the method further includes: acquiring the unencrypted pages and locking the target table in the unencrypted pages; rebuilding a new table identical to the target table and encrypting the new table.

[0014] Optionally, the index includes: btree, hash, spgist, brin, gin, gist.

[0015] According to another aspect of the present application, a data processing system for a relational database is provided, comprising a primary database and a standby database, wherein the primary database comprises an encryption / decryption module and a state conversion module, and the standby database comprises a synchronization module, wherein the processing module is configured to execute the above-mentioned method to implement encryption / decryption of the primary database data; the state conversion module is configured to execute the above-mentioned method to implement state conversion of the primary database data; and the synchronization module is configured to execute the above-mentioned method to implement data synchronization processing between the primary database and the standby database.

[0016] According to another aspect of the present application, an electronic device is also provided, comprising a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the above-mentioned method steps.

[0017] According to another aspect of the present application, a readable storage medium is provided, on which computer instructions are stored, wherein the computer instructions implement the above method steps when executed by a processor.

[0018] In an embodiment of the present application, when the standby database replays the transaction log WAL sent by the primary database, the standby database determines whether the WAL contains a target WAL, wherein the target WAL carries the encryption status of the specified page in the primary database; the standby database processes the specified page based on the judgment result. In other words, the embodiment of the present application does not occupy a flag bit in each WAL log to control the encryption of the standby database page, but instead adds (or expands) a WAL log that carries the encryption status of the specified page in the primary database. In this way, when the standby database replays the WAL log sent by the primary database, it can process the specified page accordingly based on the content of the WAL log, thereby solving the incompatibility problem introduced when achieving data consistency between the primary and standby databases in the related art, and achieving the technical effect of achieving data consistency between the primary and standby databases while ensuring compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0020] Figure 1 This is a flow chart of a data processing method for a relational database according to an embodiment of the present application;

[0021] Figure 2 It is a structural diagram of a data processing system of a relational database according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] Example 1

[0025] The relational database service (RDS) provided in the embodiment of the present application is based on PostgreSQL (referred to as PG), wherein PostgreSQL is one of the classic large-scale relational databases in the open source database. It not only has the functions of a classic relational database, but is also constantly developing. The development of PostgreSQL has not only been affected by many external applications based on PostgreSQL, but also has developed more applications based on PostgreSQL, such as PostGIS (an important component in the GIS field). From a technical point of view, PostGIS is an extension (extension) of PostgreSQL, i.e., a plug-in. Plug-ins like PostGIS have been applied to varying degrees in computer-related fields, and have become the main feature of PostgreSQL's functional ductility. The functions of the PostgreSQL plug-in are not only reflected in the basic functions of data such as newly added complex data types and indexes, but these basic functions are also particularly needed in the GIS field, and the PostgreSQL plug-in can complete various advanced functions including distributed and heterogeneous data access, which makes the PostgreSQL database more than just a traditional classic relational database, and through the extended functions of the plug-in, it can fully meet the needs of today's Internet for big data applications.

[0026] In the above database architecture, there are generally a master database and a standby database. The standby database is a backup of the master database to improve data security. Generally, the standby database only performs read operations, while the master database is generally readable and writable. The master and standby databases are synchronized through logs. In this application scenario, this embodiment provides a data processing method for a relational database to achieve data synchronization between the master and standby databases, such as Figure 1 As shown, the method includes the following steps:

[0027] S102, when the standby database replays the transaction log WAL sent by the primary database, the standby database determines whether a target WAL exists in the WAL, wherein the target WAL carries the encryption status of the specified page in the primary database;

[0028] S104: The standby database processes the designated page according to the judgment result.

[0029] Through the above S102 to S104, a WAL log is added (or expanded), and the WAL log carries the encryption status of the specified page in the primary database. In this way, when the standby database replays the WAL log sent by the primary database, it can process the specified page accordingly according to the content of the WAL log, instead of occupying a flag bit in each WAL log to control the page encryption of the standby database. This solves the incompatibility problem introduced when achieving data consistency between the primary and standby databases in the related art, and achieves the technical effect of achieving data consistency between the primary and standby databases while ensuring compatibility.

[0030] It's important to note that the WAL log is a crucial component of Postgres, operating across all its functional modules. The vast majority of database actions are recorded in the WAL log. Because of this, the WAL log can be considered a record of database changes. This characteristic also makes the WAL log crucial in Postgres modules like database recovery, high availability, streaming replication, and logical replication.

[0031] The encryption of the above-mentioned master database is mainly transparent data encryption (TED). Among them, TDE prevents possible attackers from bypassing the database and reading sensitive information directly from the storage by performing static data encryption at the database layer. Applications and users that have passed database authentication can continue to transparently access application data (without changing the application code or configuration), while OS users who attempt to read sensitive data in tablespace files and criminals who attempt to read disk or backup information will not be allowed to access plaintext data. Transparent encryption means that the encryption and decryption operations of data are transparent to users, and support real-time I / O encryption and decryption of data files, encrypting data before writing to disk and decrypting it when reading from disk into memory. Most customers who have TDE needs do so to meet some industry regulatory data security standards. Therefore, the embodiment of the present application also provides TDE at the relational (table, index) level.

[0032] In addition, it should be noted that the above-mentioned pages can be fixed-length pages divided within the data file, and the default size is generally 8K. The above-mentioned primary database can set a target log for each page. For example, page 1 corresponds to target WAL1, and page 2 corresponds to target WAL2. In this way, when the standby database obtains target WAL1, page 1 is encrypted, and when WAL2 is obtained, page 2 is encrypted. Alternatively, the above-mentioned primary database can set a target WAL for multiple pages with an associated relationship. For example, page 1 and page 2 have a certain associated relationship, and page 1 and page 2 can be set to correspond to target WAL1. In this way, when the standby database obtains target WAL1, page 1 and page 2 are encrypted.

[0033] In an optional embodiment, the processing method of the above S104 may include: when the standby database determines that the target WAL exists, encrypting the specified page; when the standby database determines that the target WAL does not exist, not processing the specified page. For example, assuming that page 1 corresponds to target WAL1, and page 2 does not have a corresponding target WAL, the standby database encrypts page 1 and does not process page 2. The above encryption method can be an interface that calls the openssl cryptographic library, that is, inputting a string and outputting an encrypted string. Among them, openssl is an open source software library package on a computer network. The entire openssl software package can be roughly divided into three main functional parts: ssl protocol library, application program, and cryptographic algorithm library. Using C language as the development language gives openssl excellent cross-platform performance. Applications can use this package for secure communication, avoid eavesdropping, and confirm the identity of the other end of the connection.

[0034] The encrypted data on the same page mentioned above may include relation-level data, and the relation-level data includes at least one of the following: table data, index data. However, the related art uses cluster-level TDE, which has a large encryption granularity. Because the data encryption process consumes CPU resources, and not all data needs to be encrypted, there is a waste of CPU resources. It can only be enabled when the cluster is created. If an existing instance wants to enable TDE, it needs to create a new instance and then transfer the data, resulting in a poor user experience. The embodiment of the present application provides a table-level encryption function, which reduces the encryption granularity and improves CPU utilization. In addition, if sensitive data is used as an index, the security of the data in the index cannot be guaranteed. Therefore, the embodiment of the present application also provides index encryption to meet the user's requirements for data security.

[0035] The aforementioned indexes can include: btree, hash, spgist, brin, gin, and gist. Btree is a balanced search tree designed for external storage devices such as disks. Data in a btree structure allows the system to efficiently locate disk blocks containing data. Each node in a btree can contain a large amount of keyword information and branches, depending on the actual situation. Hash is implemented based on a hash table, and only queries that exactly match all columns of the index are valid. For each row of data, the storage engine calculates a hash code for all indexed columns, and the hash index stores all hash codes in the index, while also maintaining a pointer to each data row in the index table. spgist is suitable for structures where space is recursively partitioned into non-intersecting regions. This category includes quadtrees, k-dimensional trees (kD trees), and radix trees. brin can accelerate scans of very large tables without the maintenance overhead of traditional indexes like btrees. It works by maintaining database-wide "summary" data. gin is an "inverted index" suitable for data values ​​with multiple component values, such as arrays. An inverted index contains a separate entry for each component value, making it efficient for queries that test for the existence of a specific component value. Simply put, the gin index interface is often used for retrieval of multi-value columns, such as full-text retrieval types and array types; gist is a general search tree, which is an access method for a balanced tree structure. It serves as a basic template in the system and can be used to implement any index mode. btree and many other index modes can be implemented with gist. gist is a balanced tree data structure. The key is that the key is customizable. gist indexes are suitable for multidimensional data types and collection data types. Similar to btree indexes, they are also applicable to other data types. Compared with btree indexes, gist multi-field indexes will use index scans when any subset of the index fields is included in the query conditions, while btree indexes will only use index scans when the query conditions include the first index field.

[0036] Regarding how the above-mentioned master database implements encryption operations, the embodiment of the present application utilizes the fact that a table in PG itself has some parameters that can control the behavior of this table. The embodiment of the present application adds an encryption parameter to the table. If the encryption parameter is in the on state, the page of the table is encrypted, otherwise it is not encrypted. Specifically, in the process of the page from memory to disk, the master database obtains the encryption parameter in the table data and / or the index data; when the encryption parameter is obtained and the encryption parameter is in the on state, the master database encrypts the table data and / or the index data, wherein the encrypted page of the table data and / or the index data carries an encryption mark. For example, when a page is used for the first time, the master database sends a WAL log to notify the standby database that the page needs to be encrypted. The standby database sets an encryption mark for the page. After that, the page will remain encrypted, and the data consistency in physical storage between the master and standby databases is guaranteed.

[0037] After encrypting a page using the above encryption method, embodiments of the present application also provide a decryption method. Specifically, when a page from the main database disk is read into memory, the main database determines whether the page to be read carries the encryption tag. If the page to be read carries the encryption tag, the main database decrypts the page to be read. This decryption method improves the efficiency of reading pages from disk into memory.

[0038] The page may carry multiple encryption tags, which are set by the user of the relational database based on the content of the page to be written. For example, if the page content to be written is Content 1, the corresponding encryption tag is Tag 1, and if the page content to be written is Content 2, the corresponding encryption tag is Tag 2. In addition, the encryption tag can be set on a designated flag bit of the encrypted page.

[0039] A common scenario involves a user wanting to convert an existing, unencrypted table containing data to an encrypted one. However, existing techniques prevent conversion of initially unencrypted tables to encrypted tables due to limitations in key storage methods, which impacts user experience and increases storage space by 2.5%. Because the key information is stored alongside the table data, it is stored for each page, wasting storage space. Based on this, embodiments of the present application provide two state transition methods: Method 1: When an unencrypted page exists on the primary database disk, the unencrypted page is retrieved; the unencrypted page is marked as dirty, causing it to be re-read from disk into memory; and the encrypted data is re-written from memory to disk. This method does not require write access and conserves memory. It simply reads the page into memory, then marks it as dirty, causing it to be rewritten to disk to achieve the desired effect. Unlike typical database schema definition languages ​​(DDLs), which rewrite relationships through reconstruction, this method provides an in-place rewrite of relationships (including tables and indexes), enabling encryption / decryption state transitions without disabling write access. Method 2: When there is an unencrypted page in the primary database disk, the unencrypted page is obtained and the target table in the unencrypted page is locked; a new table identical to the target table is rebuilt and the new table is encrypted.

[0040] In summary, the embodiments of this application provide transparent data encryption at the relational (table, index) level, enabling encryption / decryption of tables or indexes individually. Furthermore, by expanding the WAL log type, synchronous encryption / decryption of data between primary and standby databases is achieved while ensuring compatibility. Furthermore, a method for rewriting relations in situ is provided, enabling encryption / decryption state transitions without disabling writes.

[0041] Example 2

[0042] In the above application scenario, a data processing system of a relational database is provided in this embodiment. Figure 2 As shown, it includes a primary database 22 and a standby database 24. The primary database includes a processing module 222 and a state conversion module 224. The standby database includes a synchronization module 242. The processing module 222 is used to implement encryption / decryption of the primary database data, and the state conversion module 224 implements data state conversion of the primary database; the synchronization module 242 is used to implement data synchronization processing between the primary database and the standby database.

[0043] Optionally, the synchronization module 242 is configured to determine whether a target WAL exists in the transaction log WAL sent by the primary database when the standby database replays the WAL, wherein the target WAL carries the encryption status of a specified page in the primary database; and process the specified page based on the determination result. The synchronization module 242 adds (or expands) a WAL log that carries the encryption status of a specified page in the primary database. Thus, when the standby database replays the WAL log sent by the primary database, it can process the specified page accordingly based on the content of the WAL log, rather than occupying a flag bit in each WAL log to control the encryption of the standby database page. This resolves the incompatibility issue introduced in related technologies when achieving data consistency between the primary and standby databases, achieving the technical effect of achieving data consistency between the primary and standby databases while ensuring compatibility.

[0044] It's important to note that the WAL log is a crucial component of Postgres, operating across all its functional modules. The vast majority of database actions are recorded in the WAL log. Because of this, the WAL log can be considered a record of database changes. This characteristic also makes the WAL log crucial in Postgres modules like database recovery, high availability, streaming replication, and logical replication.

[0045] The encryption of the above-mentioned master database is mainly transparent data encryption (TED). Among them, TDE prevents possible attackers from bypassing the database and reading sensitive information directly from the storage by performing static data encryption at the database layer. Applications and users that have passed database authentication can continue to transparently access application data (without changing the application code or configuration), while OS users who attempt to read sensitive data in tablespace files and criminals who attempt to read disk or backup information will not be allowed to access plaintext data. Transparent encryption means that the encryption and decryption operations of data are transparent to users, and support real-time I / O encryption and decryption of data files, encrypting data before writing to disk and decrypting it when reading from disk into memory. Most customers with TDE needs do so in order to meet some industry regulatory data security standards and support encrypted storage or other effectiveness protection measures for user data. Therefore, the embodiment of the present application also provides TDE at the relational (table, index) level.

[0046] In addition, it should be noted that the above-mentioned pages can be fixed-length pages divided within the data file, and the default size is generally 8K. The above-mentioned primary database can set a target log for each page. For example, page 1 corresponds to target WAL1, and page 2 corresponds to target WAL2. In this way, when the standby database obtains target WAL1, page 1 is encrypted, and when WAL2 is obtained, page 2 is encrypted. Alternatively, the above-mentioned primary database can set a target WAL for multiple pages with an associated relationship. For example, page 1 and page 2 have a certain associated relationship, and page 1 and page 2 can be set to correspond to target WAL1. In this way, when the standby database obtains target WAL1, page 1 and page 2 are encrypted.

[0047] In an optional embodiment, the synchronization module 242 is also used to encrypt the specified page when the standby database determines that the target WAL exists; when the standby database determines that the target WAL does not exist, the specified page is not processed. For example, assuming that page 1 corresponds to target WAL1, and page 2 does not have a corresponding target WAL, the standby database encrypts page 1 and does not process page 2. The above encryption method can be an interface that calls the openssl cryptographic library, that is, inputs a string and outputs an encrypted string. Among them, openssl is an open source software library package on a computer network. The entire openssl software package can be roughly divided into three main functional parts: ssl protocol library, application program, and cryptographic algorithm library. Using C language as the development language gives openssl excellent cross-platform performance. Applications can use this package for secure communication, avoid eavesdropping, and confirm the identity of the other end of the connection.

[0048] The encrypted data on the same page mentioned above may include relation-level data, and the relation-level data includes at least one of the following: table data, index data. However, the related art uses cluster-level TDE, which has a large encryption granularity. Because the data encryption process consumes CPU resources, and not all data needs to be encrypted, there is a waste of CPU resources. It can only be enabled when the cluster is created. If an existing instance wants to enable TDE, it needs to create a new instance and then transfer the data, resulting in a poor user experience. The embodiment of the present application provides a table-level encryption function, which reduces the encryption granularity and improves CPU utilization. In addition, if sensitive data is used as an index, the security of the data in the index cannot be guaranteed. Therefore, the embodiment of the present application also provides index encryption to meet the user's requirements for data security.

[0049] The aforementioned indexes can include: btree, hash, spgist, brin, gin, and gist. Btree is a balanced search tree designed for external storage devices such as disks. Data in a btree structure allows the system to efficiently locate disk blocks containing data. Each node in a btree can contain a large amount of keyword information and branches, depending on the actual situation. Hash is implemented based on a hash table, and only queries that exactly match all columns of the index are valid. For each row of data, the storage engine calculates a hash code for all indexed columns, and the hash index stores all hash codes in the index, while also maintaining a pointer to each data row in the index table. spgist is suitable for structures where space is recursively partitioned into non-intersecting regions. This category includes quadtrees, k-dimensional trees (kD trees), and radix trees. brin can accelerate scans of very large tables without the maintenance overhead of traditional indexes like btrees. It works by maintaining database-wide "summary" data. gin is an "inverted index" suitable for data values ​​with multiple component values, such as arrays. An inverted index contains a separate entry for each component value, making it efficient for queries that test for the existence of a specific component value. Simply put, the gin index interface is often used for retrieval of multi-value columns, such as full-text retrieval types and array types; gist is a general search tree, which is an access method for a balanced tree structure. It serves as a basic template in the system and can be used to implement any index mode. btree and many other index modes can be implemented with gist. gist is a balanced tree data structure. The key is that the key is customizable. gist indexes are suitable for multidimensional data types and collection data types. Similar to btree indexes, they are also applicable to other data types. Compared with btree indexes, gist multi-field indexes will use index scans when any subset of the index fields is included in the query conditions, while btree indexes will only use index scans when the query conditions include the first index field.

[0050] Regarding how the above-mentioned master database implements encryption operations, the embodiment of the present application utilizes the fact that a table in PG itself has some parameters that can control the behavior of this table. The embodiment of the present application adds an encryption parameter to the table. If the encryption parameter is in the on state, the page of the table is encrypted, otherwise it is not encrypted. Specifically, in the process of the page from memory to disk, the above-mentioned processing module 222 is used to obtain the encryption parameter in the table data and / or the index data; when the encryption parameter is obtained and the encryption parameter is in the on state, the table data and / or the index data are encrypted, wherein the encrypted page of the table data and / or the index data carries an encryption mark. For example, when a page is used for the first time, the master database sends a WAL log to notify the standby database that the page needs to be encrypted. The standby database sets an encryption mark for the page. After that, the page will remain encrypted, and the data consistency in physical storage between the master and standby databases is guaranteed.

[0051] After encrypting a page using the above encryption method, the present embodiment also provides a decryption method. Specifically, when a page from the main database disk is read into memory, the processing module 222 is further configured to determine whether the page to be read carries the encryption tag; if the page to be read carries the encryption tag, the page to be read is decrypted. This processing module 222 improves the efficiency of reading pages from the disk into memory.

[0052] The page may carry multiple encryption tags, which are set by the user of the relational database based on the content of the page to be written. For example, if the page content to be written is Content 1, the corresponding encryption tag is Tag 1, and if the page content to be written is Content 2, the corresponding encryption tag is Tag 2. In addition, the encryption tag can be set on a designated flag bit of the encrypted page.

[0053] A common scenario involves a user wanting to convert an existing, non-encrypted table with existing data into an encrypted table. However, existing technologies prevent conversion of initially non-encrypted tables into encrypted tables due to limitations in key storage methods, which impacts user experience and increases storage space by 2.5%. Because the key information is stored alongside the table data, it is stored for each page, wasting storage space. To address this, the state conversion module 224 is also configured to retrieve non-encrypted pages from the primary database disk when they exist; mark the non-encrypted pages as dirty, causing them to be read back from disk into memory; and then rewrite them from memory to disk for encryption. This state conversion module 224 eliminates the need for write-blocking and conserves memory. It simply reads the pages into memory, marks them as dirty, and writes them back to disk to convert existing data. Unlike conventional database schema definition languages ​​(DDLs), which rewrite relationships through reconstruction, this module provides an in-place rewrite of relationships (including tables and indexes), enabling encryption / decryption state conversion without write-blocking. The state conversion module 224 is further configured to obtain a non-encrypted page when one exists in the primary database disk, lock the target table in the non-encrypted page, and rebuild a new table identical to the target table and encrypt the new table.

[0054] In summary, the embodiments of this application provide transparent data encryption at the relational (table, index) level, enabling encryption / decryption of tables or indexes individually. Furthermore, by expanding the WAL log type, synchronous encryption / decryption of data between primary and standby databases is achieved while ensuring compatibility. Furthermore, a method for rewriting relations in situ is provided, enabling encryption / decryption state transitions without disabling writes.

[0055] Example 3

[0056] An embodiment of the present invention further provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the steps of any one of the above methods.

[0057] Example 4

[0058] An embodiment of the present invention further provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the steps of any of the above methods are implemented.

[0059] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0060] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0061] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0062] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0063] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0064] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data processing method for a relational database, characterized in that: include: When the standby database replays the transaction log WAL sent by the primary database, the standby database determines whether a target WAL exists in the WAL, wherein the target WAL carries the encryption status of a specified page in the primary database; the encrypted data of the specified page includes relation-level data, and the relation-level data includes at least one of the following: table data and index data; The standby database processes the designated page according to the judgment result; The main database obtains encryption parameters in the table data and / or the index data; When the encryption parameter is obtained and the encryption parameter is in an on state, the primary database encrypts the table data and / or the index data, wherein the encrypted pages of the table data and / or the index data carry an encryption mark; When there are unencrypted pages on the primary database disk, select one of the following two methods:

1. Obtain the non-encrypted page; mark the non-encrypted page as a dirty page, so that the page marked as a dirty page is re-read from the disk into the memory; re-write from the memory to the disk for encryption; or, Second, obtaining the non-encrypted page and locking the target table in the non-encrypted page; recreating a new table identical to the target table and encrypting the new table.

2. The method according to claim 1, characterized in that The standby database processes the designated page according to the judgment result, including: When the standby database determines that the target WAL exists, encrypting the designated page; When the standby database determines that the target WAL does not exist, the designated page is not processed.

3. The method according to claim 1, characterized in that The method further comprises: When a page in the primary database disk is read into the memory, the primary database determines whether the page to be read carries the encryption tag; When the page to be read carries the encryption mark, the main database decrypts the page to be read.

4. The method according to claim 3, characterized in that The encryption tags include a plurality of tags, and the plurality of encryption tags are set by a user of the relational database according to the content of the page to be written.

5. The method according to claim 4, characterized in that The encryption mark is set on the designated flag position of the encrypted page.

6. The method according to claim 1, characterized in that The index includes: btree, hash, spgist, brin, gin, or gist.

7. An electronic device comprising a memory and a processor; wherein: The memory is configured to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps according to any one of claims 1 to 6.

8. A readable storage medium having computer instructions stored thereon, wherein: When the computer instructions are executed by a processor, the method steps according to any one of claims 1 to 6 are implemented.

Images