Method and apparatus for managing a relational database

Abstract

This application provides one or more embodiments of a relational database management method and apparatus, applied to a server corresponding to the relational database. The method includes: obtaining at least one encryption algorithm specified by a data owner for at least some data fields in the relational database; wherein the at least one encryption algorithm supports ciphertext processing methods authorized by the data owner when performing ciphertext processing on data corresponding to the at least some data fields; obtaining data records submitted by the data owner to be written to the relational database; encrypting the data in the data records corresponding to the at least some data fields based on the at least one encryption algorithm; wherein the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields; and writing the encrypted data record into the relational database.

Description

Technical Field

[0001] One or more embodiments of this application relate to the field of distributed technology, and more particularly to a method and apparatus for managing relational databases. Background Technology

[0002] A relational database is a database that uses a relational model to organize data, typically storing data in rows and columns. In a relational database, a series of rows and columns of data is called a table, and a set of tables makes up the database. Generally, a row of data in a table is a record, and a column of data corresponds to a data field.

[0003] In relational databases, data often needs to be processed specifically based on actual usage requirements. For example, querying records where the value corresponding to a certain data field exceeds a certain threshold might involve incrementing the value of each record corresponding to that field by a specific value. Currently, most relational databases store data in plaintext to facilitate plaintext processing. In this case, both the service provider and the data user can easily access the plaintext data. However, the data owner may not want this plaintext access and desires to ensure the privacy and security of their data. Therefore, avoiding the direct storage of plaintext data in relational databases and ensuring their privacy and security has become a critical concern. Summary of the Invention

[0004] One or more embodiments of this application provide the following technical solutions:

[0005] This application provides a method for managing relational databases, applied to a server corresponding to the relational database, the method comprising:

[0006] The data owner obtains at least one encryption algorithm specified by the data owner for at least some data fields in the relational database; wherein the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when ciphertext processing is performed on data corresponding to the at least some data fields;

[0007] Obtain the data records submitted by the data owner to be written into the relational database; wherein the data records include the at least some of the data fields;

[0008] Based on the at least one encryption algorithm, the data corresponding to the at least some data fields in the data record are encrypted respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields;

[0009] The encrypted data record is written into the relational database.

[0010] This application also provides a data transfer method for a relational database, applied to a server corresponding to the relational database, the method comprising:

[0011] A data transfer task is obtained to transfer data records stored in a relational database of a data owner to a data user; wherein the data records include at least some data fields in the relational database;

[0012] In response to the data transfer task, at least one encryption algorithm specified by the data owner for the at least some data fields is obtained; wherein, the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when performing ciphertext processing on the data corresponding to the at least some data fields;

[0013] Based on the at least one encryption algorithm, the data corresponding to the at least some data fields in the data record are encrypted respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields;

[0014] The encrypted data record is transferred to the data user so that the data user can perform ciphertext processing on the data record based on the ciphertext processing method supported by the at least one encryption algorithm.

[0015] This application also provides a management device for a relational database, applied to a server corresponding to the relational database, the device comprising:

[0016] The first acquisition module acquires at least one encryption algorithm specified by the data owner for at least some data fields in the relational database; wherein, the at least one encryption algorithm supports ciphertext processing methods authorized by the data owner when performing ciphertext processing on data corresponding to the at least some data fields;

[0017] The second acquisition module acquires data records submitted by the data owner to be written into the relational database; wherein the data records include at least some of the data fields;

[0018] An encryption module, based on the at least one encryption algorithm, encrypts the data in the data record corresponding to the at least some data fields respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields;

[0019] The write module writes the encrypted data records into the relational database.

[0020] This application also provides a data transfer device for a relational database, applied to a server corresponding to the relational database, the device comprising:

[0021] The first acquisition module acquires a data transfer task that transfers data records stored in a relational database of the data owner to the data user; wherein the data records include at least some data fields in the relational database;

[0022] The second acquisition module, in response to the data transfer task, acquires at least one encryption algorithm specified by the data owner for the at least some data fields; wherein, the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when performing ciphertext processing on the data corresponding to the at least some data fields;

[0023] An encryption module, based on the at least one encryption algorithm, encrypts the data in the data record corresponding to the at least some data fields respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields;

[0024] The transfer module transfers the encrypted data record to the data user, so that the data user can perform ciphertext processing on the data record based on the ciphertext processing method supported by the at least one encryption algorithm.

[0025] This application also provides an electronic device, including:

[0026] processor;

[0027] Memory used to store processor-executable instructions;

[0028] The processor executes the executable instructions to implement the steps of the method as described in any of the preceding descriptions.

[0029] This application also provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method as described in any of the preceding claims.

[0030] In the above technical solution, for the data records submitted by the data owner to be written into the relational database, based on at least one encryption algorithm specified by the data owner for at least some fields in the relational database, the data corresponding to the at least some data fields in these data records can be encrypted respectively, so that the encrypted data records include at least one ciphertext corresponding to each data field in the at least some data fields, and the encrypted data records are written into the relational database.

[0031] By employing the above method, the data stored in the relational database is encrypted, thereby ensuring the privacy and security of the data stored in the relational database; furthermore, since it supports direct ciphertext processing of the encrypted data in the relational database, specific operations on the data stored in the relational database can be executed normally. Attached Figure Description

[0032] Figure 1 This is a schematic diagram illustrating a relational database management system according to an exemplary embodiment of this application.

[0033] Figure 2 This is a flowchart illustrating a relational database management method according to an exemplary embodiment of this application.

[0034] Figure 3 This is a flowchart illustrating another method for managing a relational database, as shown in an exemplary embodiment of this application.

[0035] Figure 4 This is a schematic diagram illustrating another relational database management system according to an exemplary embodiment of this application.

[0036] Figure 5 This is a flowchart illustrating another method for managing a relational database, as shown in an exemplary embodiment of this application.

[0037] Figure 6 This is a schematic diagram of the hardware structure of a device shown in an exemplary embodiment of this application.

[0038] Figure 7 This is a block diagram illustrating a relational database management device according to an exemplary embodiment of this application.

[0039] Figure 8 This is a block diagram illustrating another relational database management apparatus according to an exemplary embodiment of this application. Detailed Implementation

[0040] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this application as detailed in the appended claims.

[0041] It should be noted that the steps of the corresponding methods in other embodiments are not necessarily performed in the order shown and described in this application. In some other embodiments, the methods may include more or fewer steps than those described in this application. Furthermore, a single step described in this application may be broken down into multiple steps in other embodiments; and multiple steps described in this application may be combined into a single step in other embodiments.

[0042] Before providing a detailed description of one or more embodiments of this application, a brief explanation of the application scenarios involved in one or more embodiments of this application will be given first.

[0043] A database system typically includes a database (DB), hardware, and software. A database is a large, organized, shareable, and centrally managed collection of data that is permanently stored in a computer. The data in the database is organized, described, and stored according to a specific mathematical model. Hardware comprises the various physical devices that make up the computer system, including external devices required for storage. The hardware configuration should meet the needs of the entire database system. Software can further include the operating system, the Database Management System (DBMS), and application programs. The DBMS is the core software of the database system. It operates with the support of the operating system and addresses how to scientifically organize and store data, and how to efficiently acquire and maintain data. Its main functions include: data definition, data manipulation, database operation and management, and database creation and maintenance.

[0044] In database systems, database management systems typically use storage engines to perform specific operations on the database. For example, on relational databases, they perform DDL (Data Definition Language) and DML (Data Manipulation Language) operations to enable reading and writing. A storage engine is the implementation method for how data is stored, how indexes are created, and how data is queried and updated. A database system usually supports multiple storage engines to meet the needs of different database application scenarios.

[0045] Data modification operations in a database system are typically performed in units of transactions. A transaction can include multiple data modification operations (including insert, update, and delete operations). During a transaction, for each data modification operation, the modified data is stored in memory, and a redo log is generated for that operation. This redo log includes information such as the disk storage address of the original data before the modification and the modified content. Subsequently, the redo log is written to a redo log file using a specific strategy. This redo log file is stored on disk, so if the database system crashes, data recovery can be performed based on the redo log file, thus ensuring data consistency.

[0046] A relational database system is a database system that includes relational databases. An index is a data structure that helps a relational database system retrieve data efficiently. In a relational database system, an index provides a pointer to data stored in a table that corresponds to a specific data field. Therefore, the index can be used to find that data, and then the corresponding pointer can be used to find the data record containing that data.

[0047] In related technologies, to ensure the privacy and security of data stored in relational databases, data written to the relational database can be encrypted, and the database stores this encrypted data. However, if the data owner or other data user authorized by the data owner needs to perform operations such as adding (corresponding to insert operations), updating, deleting, querying, sorting, or grouping by (grouping according to certain rules) on this data stored in the relational database, these operations may not be possible because they can usually only be compared directly with the encrypted text, and cannot be calculated using addition, subtraction, multiplication, division, or size comparison.

[0048] Take the data table in the relational database shown in Table 1 below as an example:

[0049] name salary employee1 100 employee2 200

[0050] Table 1

[0051] Assume the table name is temp, as shown in Table 1 above. The temp table includes two fields: name and salary. Furthermore, the temp table contains two records: in the first record, the data corresponding to the name field is employee1, and the data corresponding to the salary field is 100; in the second record, the data corresponding to the name field is employee2, and the data corresponding to the salary field is 200.

[0052] After encrypting the values ​​100 and 200 using the same encryption algorithm, we obtain the ciphertext "abcdefg" corresponding to the value 100 and the ciphertext "defghy" corresponding to the value 200. At this point, we can determine that these two ciphertexts are not identical, but we cannot determine their relative order. Therefore, for the data table `temp` as shown in Table 1 above, we can perform a query operation corresponding to the SQL statement `select * from temp`, which retrieves all data records (i.e., the first and second records) in the `temp` table. However, we cannot perform a query operation corresponding to the SQL statement `select * from temp where salary>100`, which retrieves the data record in the `temp` table whose value corresponding to the `salary` field is greater than 100 (i.e., the second record).

[0053] This application proposes a technical solution for managing relational databases, enabling specific operations on the data stored in the relational database to be executed normally while ensuring the privacy and security of the data stored in the relational database. In this technical solution, for data records submitted by the data owner to be written into the relational database, based on at least one encryption algorithm specified by the data owner for at least some fields in the relational database, the data corresponding to these at least some data fields in each of these data records is encrypted, such that the encrypted data records include at least one ciphertext corresponding to each of the at least some data fields, and the encrypted data records are then written into the relational database.

[0054] In a specific implementation, for the data owner corresponding to the data stored in the relational database, the data owner can specify at least one encryption algorithm for at least some data fields in the relational database through a client corresponding to the data owner, so as to encrypt the data written to the relational database, and the relational database stores the ciphertext of the data.

[0055] It should be noted that the data owner can authorize the types of operations to be performed on the data corresponding to at least some of the aforementioned data fields, based on actual data usage needs; that is, authorize the processing method when processing the data corresponding to these at least some data fields. Since the relational database stores encrypted data, in this case, the at least one encryption algorithm can support the encrypted processing method authorized by the data owner when processing the encrypted data corresponding to these at least some data fields.

[0056] The data owner can submit data records to be written to the relational database. Specifically, the data owner can submit the data records to be written directly through a client corresponding to the data owner; or, the data owner can specify other devices to generate and send the data records to be written, and these other devices will send the data records to the server for writing after generating them.

[0057] Having obtained the aforementioned data records, the data corresponding to at least some of the aforementioned data fields can be encrypted using at least one of the aforementioned encryption algorithms, thereby obtaining at least one ciphertext corresponding to each data field in these at least some data fields. That is, the encrypted data record includes at least one ciphertext corresponding to each data field in these at least some data fields.

[0058] Once the encrypted data records are obtained, they can be written into the relational database.

[0059] By employing the above method, the data stored in the relational database is encrypted, thereby ensuring the privacy and security of the data stored in the relational database; furthermore, since it supports direct ciphertext processing of the encrypted data in the relational database, specific operations on the data stored in the relational database can be executed normally.

[0060] Please refer to Figure 1 , Figure 1 This is a schematic diagram illustrating a relational database management system according to an exemplary embodiment of this application.

[0061] In such Figure 1 The relational database management system shown may include a client and a relational database system. This relational database system may further include a relational database and a server corresponding to the database management system.

[0062] The client corresponding to the data owner can maintain the data stored in the relational database and perform data queries through the database management system. Similarly, the client corresponding to the data user authorized by the data owner can also maintain the data stored in the relational database and perform data queries through the database management system.

[0063] Please combine Figure 1 ,refer to Figure 2 , Figure 2 This is a flowchart illustrating a relational database management method according to an exemplary embodiment of this application.

[0064] The aforementioned management methods for relational databases can be applied to the server-side corresponding to that relational database. Specifically, the server-side can refer to the database management system within the relational database system.

[0065] The above-mentioned methods for managing relational databases may include the following steps:

[0066] Step 102: Obtain at least one encryption algorithm specified by the data owner for at least some data fields in the relational database; wherein, the at least one encryption algorithm supports the ciphertext processing method authorized by the data owner when performing ciphertext processing on data corresponding to the at least some data fields.

[0067] To ensure the security of the data stored in the relational database, typically only the data owner corresponding to this data is allowed to perform operations such as insert, update, and delete on the data stored in the relational database, because these operations will cause changes to the data itself stored in the relational database. However, the data owner and the data users authorized by the data owner are allowed to query the relational database.

[0068] In this embodiment, for the data owner corresponding to the data stored in the relational database, the data owner can specify at least one encryption algorithm for at least some data fields in the relational database through the client corresponding to the data owner, so as to encrypt the data written to the relational database and store the ciphertext of the data in the relational database.

[0069] It should be noted that the data owner can authorize the types of operations to be performed on the data corresponding to at least some of the aforementioned data fields, based on actual data usage needs; that is, authorize the processing method when processing the data corresponding to these at least some data fields. Since the relational database stores encrypted data, in this case, the at least one encryption algorithm can support the encrypted processing method authorized by the data owner when processing the encrypted data corresponding to these at least some data fields.

[0070] Specifically, the data owner may specify at least one encryption algorithm for each of the aforementioned at least some of the data fields. It should be noted that the at least one encryption algorithm specified by the data owner for different data fields may be the same or different in terms of type and number, and this application does not impose any restrictions in this regard. Correspondingly, the at least one encryption algorithm specified by the data owner for a certain field can support the ciphertext processing method authorized by the data owner when ciphertext processing is performed on the data corresponding to that field.

[0071] In practical applications, when the data owner creates a data table in the relational database that includes at least some of the data fields mentioned above using SQL statements, the data owner can specify at least one encryption algorithm for these data fields.

[0072] Taking the data table in the relational database shown in Table 1 above as an example, the data owner can create this data table in the relational database using SQL statements and authorize encryption processing method 1 for the data corresponding to the 'name' field, and both encryption methods 1 and 2 for the data corresponding to the 'salary' field. Assuming encryption algorithm 1 supports encryption processing method 1 and encryption algorithm 2 supports encryption processing method 2, the data owner can specify encryption algorithm 1 for the 'name' field and both encryption algorithms 1 and 2 for the 'salary' field.

[0073] In one embodiment shown, the above-described ciphertext processing method may include ciphertext query and ciphertext calculation.

[0074] In one embodiment shown, the at least one encryption algorithm described above includes one or more combinations of the following: SM4 encryption algorithm, semi-homomorphic encryption algorithm, fully homomorphic encryption algorithm, and order-preserving encryption algorithm.

[0075] Among them, semi-homomorphic encryption algorithms can support addition and subtraction operations on ciphertext; fully homomorphic encryption algorithms can support addition, subtraction, multiplication, and division operations on ciphertext; order-preserving encryption algorithms can support comparison of the size of ciphertext; and SM4 encryption algorithms can support content matching of ciphertext.

[0076] Step 204: Obtain the data records submitted by the data owner to be written into the relational database; wherein the data records include the at least some of the data fields.

[0077] In this embodiment, the data owner can submit data records to be written to the relational database. Specifically, the data owner can submit the data records to be written directly through a client corresponding to the data owner; or, the data owner can specify other devices for generating and sending the data records to be written, and these other devices will send the data records to the server for writing after generating them.

[0078] It should be noted that the data record mentioned above may include at least some of the data fields mentioned above.

[0079] Step 206: Based on the at least one encryption algorithm, encrypt the data in the data record corresponding to the at least some data fields respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields.

[0080] In this embodiment, upon obtaining the aforementioned data records, the data corresponding to at least some of the data fields in these data records can be encrypted using at least one of the aforementioned encryption algorithms, thereby obtaining at least one ciphertext corresponding to each data field in these at least some data fields. That is, the encrypted data record includes at least one ciphertext corresponding to each data field in these at least some data fields.

[0081] Specifically, for a data field in the aforementioned data record that has been assigned an encryption algorithm, the data corresponding to that data field in these data records can be encrypted based on at least one encryption algorithm assigned to that data field, and the encrypted data record will include at least one ciphertext corresponding to that data field.

[0082] Continuing with the example of the relational database table shown in Table 1 above, for a data record to be written to this table, the data corresponding to the field 'name' in the record can be encrypted using encryption algorithm 1 to obtain ciphertext n1. Then, the data corresponding to the field 'salary' in the record can be encrypted using encryption algorithms 1 and 2 to obtain ciphertext s1 and ciphertext s2. Therefore, in the encrypted data record, the data corresponding to the field 'name' is ciphertext n1, and the data corresponding to the field 'salary' is ciphertext s1 and ciphertext s2. That is, at this point, the data table is no longer the data table used to store plaintext as shown in Table 1 above, but rather the data table used to store ciphertext as shown in Table 2 below.

[0083] name salary Ciphertext n1 Ciphertext s1, Ciphertext s2

[0084] Table 2

[0085] Step 208: Write the encrypted data record into the relational database.

[0086] In this embodiment, after obtaining the encrypted data records, these encrypted data records can be written into the relational database. Thus, the relational database stores ciphertext data, and because it supports direct ciphertext processing, specific operations on the data stored in the relational database can be executed normally.

[0087] Please combine Figure 1 and Figure 2 ,refer to Figure 3 , Figure 3 This is a flowchart illustrating another method for managing a relational database, as shown in an exemplary embodiment of this application.

[0088] The above-mentioned methods for managing relational databases may include the following steps:

[0089] Step 302: Obtain the encrypted processing instruction submitted by the client for the target data field in the target data record stored in the relational database; wherein, the encrypted processing instruction includes the target encrypted processing method when performing encrypted processing on the data corresponding to the target data field.

[0090] In this embodiment, the client can submit an encrypted processing instruction for a data field (referred to as the target data field) in a data record (referred to as the target data record) stored in the relational database. This encrypted processing instruction may include an encrypted processing method (referred to as the target encrypted processing method) for processing the data corresponding to the target data field.

[0091] In practical applications, the above-mentioned encrypted processing instructions can be SQL statements.

[0092] Taking the SQL statement `select * from temp where salary>100` as an example, this SQL statement means to query data records in the data table `temp` whose value corresponding to the field `salary` is greater than 100. Therefore, this SQL statement can be used as an encrypted processing instruction for the field `salary` in all data records stored in the relational database including the data table `temp`. That is, at this time, the target data records are all data records in the relational database, the target data field is the field `salary`, and the target encrypted processing method is the size comparison in encrypted calculation.

[0093] Taking the SQL statement `select * from temp where name = 'employee1'` as an example, this SQL statement means to query the data record in the data table `temp` whose string corresponding to the field `name` is 'employee1'. Therefore, this SQL statement can be used as an encrypted processing instruction for the field `name` in the data record stored in the relational database containing the data record whose string corresponding to the field `name` is 'employee1'. That is, at this time, the target data record is the data record in the relational database whose string corresponding to the field `name` is 'employee1', the target data field is the field `name`, and the target encrypted processing method is encrypted query.

[0094] In one embodiment shown, the client may include a client corresponding to the data owner and / or a client corresponding to a data user authorized by the data owner, and this application does not limit this.

[0095] In practical applications, the at least one encryption algorithm specified by the data owner can provide an asymmetric encryption mode, using the data owner's private key for encryption and the data owner's public key for decryption. In this case, the data owner can authorize the data user with their public key and publish the authorization record to the blockchain for storage, facilitating subsequent traceability.

[0096] In one embodiment, the client can submit an encrypted processing instruction for the target data record stored in the relational database. In this case, the server can parse the encrypted processing instruction and, based on the parsing result, break it down into encrypted processing instructions corresponding to each target data field in the target data record.

[0097] Taking the SQL statement `select salary+100 from temp where salary>100` as an example, this SQL statement means to query data records in the data table `temp` whose corresponding value for the `salary` field is greater than 100, and then increment the corresponding value of the `salary` field in these data records by 100. Therefore, by parsing this encrypted processing instruction, it can be broken down into: first, performing a size comparison in encrypted calculation on the `salary` field in all data records stored in the relational database including the data table `temp` to determine the data records whose corresponding value for the `salary` field is greater than 100; then, performing an addition operation in encrypted calculation on the `salary` field in these data records to increment the corresponding value of the `salary` field by 100.

[0098] Step 304: In response to the ciphertext processing instruction, determine the target encryption algorithm that supports the target ciphertext processing method, and read the target ciphertext encrypted using the target encryption algorithm from at least one ciphertext corresponding to the target data field in the target data record.

[0099] In this embodiment, upon receiving the aforementioned ciphertext processing instruction, in response to the ciphertext processing instruction, an encryption algorithm that supports the aforementioned target ciphertext processing method (referred to as the target encryption algorithm) can be determined, and ciphertext encrypted using the target encryption algorithm (referred to as the target ciphertext) can be read from at least one ciphertext corresponding to the target data field in the aforementioned target data record.

[0100] Continuing with the example of the data table in the relational database shown in Table 2 above, assuming that the target data record is the first data record in the data table, the target data field is the field salary, and the target encryption algorithm is encryption algorithm 2, then the ciphertext s2 encrypted using encryption algorithm 2 can be read from this data record, that is, the target ciphertext is ciphertext s2 at this time.

[0101] In one embodiment shown, ciphertext encrypted using different encryption algorithms can have different data types. For example, ciphertext encrypted using semi-homomorphic and fully homomorphic encryption algorithms can have a string data type, while ciphertext encrypted using order-preserving encryption algorithms can have a bigint data type, and so on. In this case, based on the correspondence between encryption algorithms and ciphertext data types, ciphertext with a data type corresponding to the target encryption algorithm can be read from at least one ciphertext record corresponding to the target data field in the target data record and used as the target ciphertext.

[0102] Step 306: Execute the ciphertext processing instruction and process the target ciphertext according to the target ciphertext processing method.

[0103] In this embodiment, upon reading the target ciphertext, the aforementioned ciphertext processing instructions can be further executed to process the target ciphertext according to the aforementioned target ciphertext processing method.

[0104] In one embodiment shown, when the target ciphertext processing method is ciphertext query, the target encryption algorithm can be the SM4 encryption algorithm.

[0105] In the aforementioned relational database, for a data field specified with the SM4 encryption algorithm, the data corresponding to that data field in the data record to be written can be encrypted using the SM4 encryption algorithm. Subsequently, the encryption feature corresponding to that data can be determined, and this encryption feature can be concatenated with the encrypted data. Thus, the concatenated data can be used as a ciphertext corresponding to that data field in the data record to be written.

[0106] In practical applications, using the same encryption algorithm with different keys to encrypt the same data will result in different encrypted data, but the corresponding encryption features should be the same. Therefore, for a given data, the encryption features can be determined in the following two ways: 1. Use the parts of the plaintext of the data that are not related to user privacy as the encryption features, such as special symbols in the plaintext or the first N characters of the plaintext; 2. Use the commonalities in the encrypted data obtained by encrypting the same data with the same encryption algorithm but different keys as the encryption features, such as consecutive identical characters in the encrypted data.

[0107] Specifically, in order to easily distinguish between the encrypted feature and the encrypted data, the length and content of the encrypted feature can be concatenated with the length and content of the encrypted data.

[0108] For example, assuming the data corresponding to the aforementioned data field in a data record to be written is X, X can be encrypted using the SM4 encryption algorithm to obtain ciphertext X0. Subsequently, a portion of X or a portion of X0 can be used as the encryption feature M corresponding to that data. The length and content of M are then concatenated with the length and content of X0. The resulting concatenated data can then be used as a ciphertext corresponding to that data field in the data record, as shown in Table 3 below.

[0109] M (length) M (Content) X0 (length) X0 (content)

[0110] Table 3

[0111] Correspondingly, when performing a ciphertext query on the aforementioned target ciphertext encrypted using the SM4 encryption algorithm, the data to be queried in the ciphertext processing instruction can first be encrypted using the SM4 algorithm, and the encryption features corresponding to the data to be queried can be determined. Subsequently, a Bloom filter can be used to determine whether there is an encryption feature in the target ciphertext that corresponds to the data to be queried. If so, it can be further determined whether the encrypted data to be queried matches the encrypted data in the target ciphertext. In this way, a preliminary screening can be performed using a Bloom filter before precise matching of the ciphertext, thereby reducing the amount of ciphertext matching data and improving the efficiency of ciphertext matching.

[0112] Furthermore, in order to reduce the probability of the ciphertext being deciphered, when concatenating the above-mentioned encryption features with the encrypted data, a random variable can be generated according to a preset rule, and the encryption features, the encrypted data, and the random variable can be concatenated.

[0113] The above rule can be to generate a random variable of a preset length, and then, based on the parity of the second character in the English alphabet, append the random variable to the odd or even position in the encrypted data.

[0114] Accordingly, when determining whether the encrypted query data matches the encrypted data included in the target ciphertext, the random variables can be removed according to the above rules, and then it can be determined whether the encrypted query data matches the encrypted data included in the target ciphertext.

[0115] In the above technical solution, for the data records submitted by the data owner to be written into the relational database, based on at least one encryption algorithm specified by the data owner for at least some fields in the relational database, the data corresponding to the at least some data fields in these data records can be encrypted respectively, so that the encrypted data records include at least one ciphertext corresponding to each data field in the at least some data fields, and the encrypted data records are written into the relational database.

[0116] By employing the above method, the data stored in the relational database is encrypted, thereby ensuring the privacy and security of the data stored in the relational database; furthermore, since it supports direct ciphertext processing of the encrypted data in the relational database, specific operations on the data stored in the relational database can be executed normally.

[0117] Please refer to Figure 4 , Figure 4 This is a schematic diagram illustrating another relational database management system according to an exemplary embodiment of this application.

[0118] In such Figure 4 The relational database management system shown may include a client and a relational database system. This relational database system may further include a relational database and a server corresponding to the database management system.

[0119] In this scenario, the client corresponding to the data owner can maintain the data stored in the relational database it accesses through the database management system, and also perform data queries against that relational database. Similarly, the client corresponding to the data user can maintain the data stored in the relational database it accesses through the database management system, and also perform data queries against that relational database. In this case, the data owner can authorize the transfer of data records stored in its relational database to the data user's relational database, so that the data user can use these data records.

[0120] Please combine Figure 4 ,refer to Figure 5 , Figure 5 This is a flowchart illustrating another method for managing a relational database, as shown in an exemplary embodiment of this application.

[0121] The aforementioned management methods for relational databases can be applied to the server-side of the relational database corresponding to the data owner.

[0122] The above-mentioned methods for managing relational databases may include the following steps:

[0123] Step 502: Obtain a data transfer task that transfers data records stored in the relational database of the data owner to the data user; wherein the data records include at least some data fields in the relational database.

[0124] Step 504: In response to the data transfer task, obtain at least one encryption algorithm specified by the data owner for the at least part of the data fields; wherein the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when performing ciphertext processing on the data corresponding to the at least part of the data fields.

[0125] Step 506: Based on the at least one encryption algorithm, encrypt the data in the data record corresponding to the at least some data fields respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields.

[0126] Step 508: Transfer the encrypted data record to the data user so that the data user can perform ciphertext processing on the data record based on the ciphertext processing method supported by the at least one encryption algorithm.

[0127] In this embodiment, if it is known that data records stored in the relational database of the data owner are being transferred to the data user, the data owner can first specify at least one encryption algorithm for at least some data fields in the relational database to encrypt the data written to the relational database, and the relational database can then store the ciphertext of this data.

[0128] It should be noted that the data owner can authorize the types of operations to be performed on the data corresponding to at least some of the aforementioned data fields, based on actual data usage needs; that is, authorize the processing method when processing the data corresponding to these at least some data fields. Since the relational database stores encrypted data, in this case, the at least one encryption algorithm can support the encrypted processing method authorized by the data owner when processing the encrypted data corresponding to these at least some data fields.

[0129] For the aforementioned data records to be transferred, the data corresponding to at least some of the aforementioned data fields can be encrypted using at least one of the aforementioned encryption algorithms, thereby obtaining at least one ciphertext corresponding to each data field in these at least some data fields. That is, the encrypted data record includes at least one ciphertext corresponding to each data field in these at least some data fields.

[0130] Once the encrypted data records are obtained, they can be transferred to the data user. Specifically, these encrypted records can be transferred to the data user's relational database. This ensures that the relational database stores the encrypted data, and because it supports direct ciphertext processing, specific operations on the data stored in the relational database can be performed normally. In other words, the data user can perform ciphertext processing on these encrypted data records based on ciphertext processing methods supported by at least one of the aforementioned encryption algorithms.

[0131] like Figure 5 For specific implementation details of other parts in the illustrated embodiments, please refer to, for example, Figure 4 The embodiments shown are not described in detail here.

[0132] In the above technical solution, for data records that need to be transferred from the relational database of the data owner to the data user, the data corresponding to the at least some data fields in these data records can be encrypted based on at least one encryption algorithm specified by the data owner for at least some fields in the relational database, so that the encrypted data records include at least one ciphertext corresponding to each data field in the at least some data fields, and the encrypted data records can be transferred to the data user.

[0133] By using the above method, the data is transferred to the data user in encrypted form, thus ensuring the privacy and security of the transferred data; furthermore, since it supports direct ciphertext processing of this data, specific operations on this data can be performed normally.

[0134] Please refer to Figure 6 , Figure 6 This is a schematic diagram of the hardware structure of a device shown in an exemplary embodiment of this application.

[0135] like Figure 6 As shown, at the hardware level, the aforementioned device includes a processor 602, an internal bus 604, a network interface 606, memory 608, and non-volatile memory 610, and may also include other hardware required for services. One or more embodiments of this application can be implemented in software, for example, the processor 602 reads the corresponding computer program from the non-volatile memory 610 into memory 608 and then runs it. Of course, in addition to software implementation, one or more embodiments of this application do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to each logic module, but can also be hardware or logic devices.

[0136] Please refer to Figure 7 , Figure 7 This is a block diagram illustrating a relational database management device according to an exemplary embodiment of this application.

[0137] The aforementioned relational database management device can be applied to, for example... Figure 6 The device shown is used to implement the technical solution of this application. This device serves as a server corresponding to a relational database. The device includes:

[0138] The first acquisition module 702 acquires at least one encryption algorithm specified by the data owner for at least some data fields in the relational database; wherein, the at least one encryption algorithm supports the ciphertext processing method authorized by the data owner when performing ciphertext processing on data corresponding to the at least some data fields;

[0139] The second acquisition module 704 acquires the data record submitted by the data owner to be written into the relational database; wherein the data record includes the at least some of the data fields;

[0140] The encryption module 706 encrypts the data in the data record corresponding to the at least some data fields based on the at least one encryption algorithm; wherein the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields;

[0141] The writing module 708 writes the encrypted data record into the relational database.

[0142] Please refer to Figure 8 , Figure 8 This is a block diagram illustrating another relational database management apparatus according to an exemplary embodiment of this application.

[0143] The aforementioned relational database management device can be applied to, for example... Figure 6 The device shown is used to implement the technical solution of this application. This device serves as a server corresponding to a relational database. The device includes:

[0144] The first acquisition module 802 acquires a data transfer task that transfers data records stored in a relational database of the data owner to the data user; wherein the data records include at least some data fields in the relational database;

[0145] The second acquisition module 804, in response to the data transfer task, acquires at least one encryption algorithm specified by the data owner for the at least part of the data fields; wherein, the at least one encryption algorithm supports the ciphertext processing method authorized by the data owner when performing ciphertext processing on the data corresponding to the at least part of the data fields;

[0146] The encryption module 806 encrypts the data in the data record corresponding to the at least some data fields based on the at least one encryption algorithm; wherein the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields;

[0147] The transfer module 808 transfers the encrypted data record to the data user, so that the data user can perform ciphertext processing on the data record based on the ciphertext processing method supported by the at least one encryption algorithm.

[0148] The apparatus embodiments are basically the same as the method embodiments, so relevant details can be found in the description of the method embodiments.

[0149] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the technical solution of this application according to actual needs.

[0150] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0151] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0152] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0153] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0154] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0155] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0156] The terminology used in one or more embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the scope of one or more embodiments of this application. The singular forms “a,” “the,” and “the” used in one or more embodiments of this application and in the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0157] It should be understood that although the terms first, second, third, etc., may be used to describe various information in one or more embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of one or more embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0158] The above description is merely a preferred embodiment of one or more embodiments of this application and is not intended to limit the scope of one or more embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments of this application should be included within the protection scope of one or more embodiments of this application.

Claims

1. A method for managing a relational database, applied to a server corresponding to the relational database, the method comprising: The data owner obtains at least one encryption algorithm specified by the data owner for at least some data fields in the relational database; wherein the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when ciphertext processing is performed on data corresponding to the at least some data fields; Obtain the data records submitted by the data owner to be written into the relational database; wherein the data records include the at least some of the data fields; Based on the at least one encryption algorithm, the data corresponding to the at least some data fields in the data record are encrypted respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields; The encrypted data record is written into the relational database, and in response to the ciphertext processing instruction for at least a portion of the data fields contained in the data record, the at least one ciphertext is processed according to the ciphertext processing method supported by the at least one encryption algorithm.

2. The method according to claim 1, further comprising: Obtain the encrypted processing instruction submitted by the client for the target data field in the target data record stored in the relational database; wherein, the encrypted processing instruction includes the target encrypted processing method when performing encrypted processing on the data corresponding to the target data field; In response to the ciphertext processing instruction, a target encryption algorithm that supports the target ciphertext processing method is determined, and the target ciphertext encrypted using the target encryption algorithm is read from at least one ciphertext corresponding to the target data field in the target data record; Execute the ciphertext processing instruction to process the target ciphertext according to the target ciphertext processing method.

3. The method according to claim 2, wherein obtaining the encrypted processing instruction submitted by the client for the target data field in the target data record stored in the relational database includes: Receive encrypted processing instructions submitted by the client for target data records stored in the relational database; The encrypted processing instruction is parsed, and based on the parsing result, the encrypted processing instruction is split into encrypted processing instructions corresponding to each target data field in the target data record.

4. The method according to claim 2, wherein the target ciphertext processing method is ciphertext query; and the target encryption algorithm is the SM4 encryption algorithm; The target ciphertext is obtained by encrypting the data corresponding to the target data field in the target data record using the SM4 encryption algorithm, including: The data corresponding to the target data field in the target data record is encrypted based on the SM4 encryption algorithm, and the encryption feature corresponding to the data is determined. The encryption feature is concatenated with the encrypted data to obtain the target ciphertext; The read target ciphertext is processed according to the target ciphertext processing method, including: The ciphertext processing instruction is encrypted using the SM4 algorithm, and the encryption feature corresponding to the ciphertext is determined. Based on the Bloom filter, determine whether there is an encryption feature in the target ciphertext that corresponds to the data to be queried; If so, further determine whether the encrypted data to be queried matches the target ciphertext.

5. The method according to claim 4, wherein concatenating the encryption feature with the encrypted data to obtain the target ciphertext comprises: According to preset rules, random variables are generated, and the encryption features, the encrypted data, and the random variables are concatenated to obtain the target ciphertext; The step of determining whether the encrypted data to be queried matches the target ciphertext includes: According to the rules, the random variable is removed from the target ciphertext, and it is determined whether the encrypted query data matches the target ciphertext.

6. The method according to claim 2, wherein the ciphertext encrypted using different encryption algorithms has different data types; Reading the target ciphertext encrypted using the target encryption algorithm from at least one ciphertext record corresponding to the target data field in the target data record includes: Based on the correspondence between encryption algorithms and ciphertext data types, target ciphertext whose data type corresponds to the target encryption algorithm is read from at least one ciphertext record in the target data record that corresponds to the target data field.

7. The method according to claim 2, wherein the client includes a client corresponding to the data owner, and / or a client corresponding to a data user authorized by the data owner.

8. The method according to claim 1, wherein the ciphertext processing method includes ciphertext query and ciphertext calculation.

9. The method according to claim 1, wherein the at least one encryption algorithm comprises one or more combinations of the following: SM4 encryption algorithm, semi-homomorphic encryption algorithm, fully homomorphic encryption algorithm, and order-preserving encryption algorithm.

10. A data transfer method for a relational database, applied to a server corresponding to the relational database, the method comprising: A data transfer task is obtained to transfer data records stored in a relational database of a data owner to a data user; wherein the data records include at least some data fields in the relational database; In response to the data transfer task, at least one encryption algorithm specified by the data owner for the at least some data fields is obtained; wherein, the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when ciphertext processing is performed on the data corresponding to the at least some data fields; Based on the at least one encryption algorithm, the data corresponding to the at least some data fields in the data record are encrypted respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields; The encrypted data record is transferred to the data user, and in response to the ciphertext processing instruction submitted by the data user for at least some of the data fields contained in the data record, the at least one ciphertext is processed based on the ciphertext processing method supported by the at least one encryption algorithm.

11. A management device for a relational database, applied to a server corresponding to the relational database, the device comprising: The first acquisition module acquires at least one encryption algorithm specified by the data owner for at least some data fields in the relational database; wherein, the at least one encryption algorithm supports the ciphertext processing method authorized by the data owner when performing ciphertext processing on data corresponding to the at least some data fields; The second acquisition module acquires data records submitted by the data owner to be written into the relational database; wherein the data records include at least some of the data fields; An encryption module, based on the at least one encryption algorithm, encrypts the data in the data record corresponding to the at least some data fields respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields; The writing module writes the encrypted data record into the relational database, and in response to the ciphertext processing instruction for at least some of the data fields contained in the data record, processes the at least one ciphertext according to the ciphertext processing method supported by the at least one encryption algorithm.

12. A data transfer device for a relational database, applied to a server corresponding to the relational database, the device comprising: The first acquisition module acquires a data transfer task that transfers data records stored in a relational database of the data owner to the data user; wherein the data records include at least some data fields in the relational database; The second acquisition module, in response to the data transfer task, acquires at least one encryption algorithm specified by the data owner for the at least some data fields; wherein, the at least one encryption algorithm supports a ciphertext processing method authorized by the data owner when performing ciphertext processing on the data corresponding to the at least some data fields; An encryption module, based on the at least one encryption algorithm, encrypts the data in the data record corresponding to the at least some data fields respectively; wherein, the encrypted data record includes at least one ciphertext corresponding to each data field in the at least some data fields; The transfer module transfers the encrypted data record to the data user and, in response to the ciphertext processing instruction submitted by the data user for at least some of the data fields contained in the data record, performs ciphertext processing on the at least one ciphertext based on the ciphertext processing method supported by the at least one encryption algorithm.

13. An electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1-10 by executing the executable instructions.

14. A computer-readable storage medium having stored thereon computer instructions that, when executed by a processor, implement the method as described in any one of claims 1-10.

Images