Database encryption method and system in the whole life cycle of information system

Abstract

The application discloses a database encryption method and system in the whole life cycle of an information system, and the method comprises the following steps: obtaining an application submitted by a terminal user of an application, wherein the application is a work order application for creating a database account and a password; according to the application, an encryption platform of a server provides different encryption modes according to different use scenarios; according to the selected encryption mode, a configuration center creates an account and a password for a specified database cluster, and pushes the account and the password to an application program; and the application program connects a database according to the account and the password. The application combines a configuration management platform and a decryption plug-in of the server, pushes the encrypted password to the configuration management platform, and further performs desensitization encryption on the configuration management platform; and the application can only be decrypted by the decryption plug-in in the terminal, and cannot obtain the plaintext password, so that the security of the database account and the password is better guaranteed, and data leakage is avoided.

Description

Technical Field

[0001] This invention relates to the field of information system encryption technology, specifically to a database encryption method and system for the entire lifecycle of an information system. Background Technology

[0002] In financial information systems, existing encryption methods cannot encrypt database account passwords throughout their entire lifecycle, posing a risk of account password leakage. When database administrators, information system administrators, and other relevant personnel contact or transmit account and password information, it is sent in plaintext at the application terminal. These personnel still have access to account and password information, failing to achieve the goal of preventing relevant personnel from accessing account and password information throughout the entire lifecycle, thus still posing a risk of leakage.

[0003] In view of the above, this application is hereby submitted. Summary of the Invention

[0004] The technical problem this invention aims to solve is that existing financial information systems cannot encrypt database account passwords throughout their entire lifecycle, posing a risk of password leakage and resulting in low database security. This invention provides a database encryption method and system that enables encryption throughout the entire lifecycle of an information system. This invention combines a server-side configuration management platform (encryption platform and configuration center) with a decryption plugin. The encrypted password is pushed to the configuration management platform and then undergoes de-identification encryption on the platform. Furthermore, the password can only be decrypted at the application terminal via the decryption plugin, preventing the acquisition of the plaintext password. This significantly enhances the security of database account passwords and prevents data leakage.

[0005] This invention is achieved through the following technical solution:

[0006] In a first aspect, the present invention provides a database encryption method throughout the entire lifecycle of an information system, the method comprising:

[0007] Obtain the application submitted by the application terminal user, which is a work order application to create a database account and password;

[0008] According to the application, the server-side encryption platform provides different encryption methods based on different usage scenarios; according to the selected encryption method, the configuration center creates an account and password for the specified database cluster and pushes the account and password to the application; the application connects to the database based on the account and password.

[0009] Furthermore, the method also includes:

[0010] Users of the application terminal can decrypt the database password using a decryption plugin and then establish a connection to the database using the decrypted password.

[0011] Furthermore, the encryption platform maintains a set of database metadata information, which describes three dimensions: cluster group, cluster, and database instance.

[0012] Furthermore, the server-side encryption platform provides different encryption methods based on different use cases, including:

[0013] For production environments, a contactless encryption method is provided;

[0014] For the testing environment, a platform encryption method is provided.

[0015] Furthermore, if the selected encryption method is contactless encryption, the following operations will be performed:

[0016] The operator's permissions are verified. Once the permissions are verified, the database cluster for which database account application and password encryption are required is selected, and the detailed information of the database cluster is obtained.

[0017] Based on the detailed information of the database cluster, fill in the application identifier, cluster name and environment of the encryption platform in the configuration center, and push the account and encryption password directly to the configuration center for access by relevant applications;

[0018] Depending on whether the encryption platform needs to access multiple databases, the account and password are pushed to the configuration items of the target application in the configuration center according to the multiple database rules.

[0019] Enter the suffix of the new database account name. The naming rule for the database account is cluster name + user-defined suffix. If the database account already exists in the database, prompt and re-enter the database account suffix.

[0020] Based on the entered database account, assign permissions to the database account; permissions include: CRUD operations, update, and delete; update only, no deletion; CRUD operations and function execution; all permissions; read-only; query and copy; CRUD operations; table creation and table deletion.

[0021] The encryption platform completes the creation of database accounts and passwords, encryption of database passwords, and push of database accounts and passwords to the configuration center.

[0022] Furthermore, if the selected encryption method is the platform's encryption method, the following operations will be performed:

[0023] Perform permission verification on the operator. Once the permission verification is successful, grant the authorization function: provide the database account and the permissions granted to that account. If the account already exists in the database, directly grant the permissions to the database; if the account does not exist, create the account in the database, set and encrypt the password for the account, and grant the permissions to the account.

[0024] To copy database accounts and passwords: Retrieve all database accounts from the source cluster, select the accounts to be copied to the target cluster, and submit copy authorization to the target cluster. This will copy the database accounts and passwords from the source cluster to the target cluster.

[0025] Push the database account and password to the configuration center.

[0026] Furthermore, the configuration center creates accounts and passwords for the specified database cluster, including:

[0027] A random password is generated using the database's built-in random password generation function, and a database account is constructed based on the suffix of the input database account.

[0028] The generated database password is encrypted using the national cryptographic encryption algorithm.

[0029] Retrieve all metadata information of the current cluster and construct a dictionary, which includes a dictionary name and dictionary values. The dictionary values ​​are the database instance details corresponding to the dictionary name.

[0030] Based on the constructed dictionary information, iterate through each instance in the database cluster, establish a connection with the current database instance, and perform the action of creating a user. Create a database account and password on the current database instance, and perform the authorization action to grant permissions to the newly created account.

[0031] Add the database account and encrypted database password to the configuration center by calling the HTTP interface provided by the configuration center.

[0032] Secondly, the present invention provides a database encryption system throughout the entire lifecycle of an information system. The system includes an application terminal and a server. The server includes an encryption platform, a configuration center, an application program, and a database. The application terminal connects to the encryption platform through a web front-end page. The encryption platform connects to the database. The encryption platform connects to the configuration center. The configuration center connects to the application program. The application program connects to the database.

[0033] The application terminal is used for users to submit applications, such as work orders to create database accounts and passwords; and to decrypt database passwords via a decryption plugin.

[0034] On the server side, based on the application, the encryption platform provides different encryption methods according to different usage scenarios; based on the selected encryption method, the configuration center creates an account and password for the specified database cluster and pushes the account and password to the application; the application connects to the database based on the account and password.

[0035] Thirdly, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the database encryption method described above throughout the entire lifecycle of an information system.

[0036] Fourthly, the present invention provides another computer-readable storage medium storing a computer program that, when executed by a processor, implements the database encryption method described above throughout the entire lifecycle of an information system.

[0037] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0038] This invention discloses a database encryption method and system throughout the entire lifecycle of an information system. This invention achieves database encryption throughout the entire lifecycle of the information system, reducing unnecessary system access to plaintext database account passwords and preventing staff from accessing plaintext database account passwords; effectively preventing the theft of database account passwords and improving database information security. Attached Figure Description

[0039] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0040] Figure 1 This is a flowchart of a database encryption method for the entire lifecycle of an information system according to the present invention.

[0041] Figure 2 This is a structural block diagram of a database encryption system throughout the entire lifecycle of an information system, as described in this invention.

[0042] Figure 3 This is an overall architecture diagram of a database encryption system throughout the entire lifecycle of an information system, as described in this invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0044] In the technical specifications for the protection of personal financial information, the sensitivity of personal financial information is divided into several levels from high to low. Financial institutions should follow the requirements of these specifications and design and implement security protection strategies covering the entire lifecycle of personal financial information. To prevent the theft of database accounts and the resulting leakage of personal financial information, this invention provides a database encryption method throughout the entire lifecycle of the information system. This method avoids contact or transmission of account information and passwords between database administrators, information system administrators, and other relevant personnel, thereby achieving the goal of preventing personnel from accessing account information and passwords, eliminating the data risks caused by account information and password leakage, and thus preventing the risk of database account and password leakage.

[0045] Example 1

[0046] like Figure 1 As shown, the present invention provides a database encryption method throughout the entire lifecycle of an information system, the method comprising:

[0047] Step 1: Obtain the application submitted by the application terminal user, which is a work order application to create a database account and password;

[0048] Step 2: Based on the application, the server-side encryption platform provides different encryption methods according to different usage scenarios; based on the selected encryption method, the configuration center creates an account and password for the specified database cluster and pushes the account and password to the application; the application connects to the database based on the account and password.

[0049] As a further implementation, the encryption platform maintains a set of database metadata information, which describes three dimensions: cluster group, cluster, and database instance.

[0050] As a further implementation, the server-side encryption platform provides different encryption methods based on different use cases, including:

[0051] For production environments, a contactless encryption method is provided;

[0052] For the testing environment, a platform encryption method is provided.

[0053] The above technical solutions, generally speaking, are designed for production environments with strict requirements to ensure that database passwords are never exposed in plaintext. This necessitates encryption of database passwords and prevents human access throughout the entire lifecycle, thus providing a contactless encryption method. In testing environments, however, the obtained account and password are typically visible to the applicant. The goal is to decrypt the password to obtain its plaintext form, allowing access to the database backend. Simultaneously, the system should be able to flexibly push the account and password to the application, ensuring timely database connections.

[0054] As a further implementation, if the selected encryption method is contactless encryption, then the following steps are performed:

[0055] Perform permission verification on the operator, as only authorized personnel can operate the system; once the permission verification is successful, select the database cluster that requires database account application and password encryption, and obtain detailed information about the database cluster.

[0056] Based on the detailed information of the database cluster, fill in the application identifier, cluster name and environment of the encryption platform in the configuration center, and push the account and encryption password directly to the configuration center for access by relevant applications;

[0057] Depending on whether the encryption platform needs to access multiple databases, the username and password are pushed to the configuration items of the target application in the configuration center according to the multi-database rules. The system selects whether it's a multi-database scenario, and generates the database username and password keys accordingly. In the case of no multi-database access, the database username configuration item is named `spring.datasource.username`, and the database password configuration item is named `spring.datasource.password`. In the case of multiple databases, the database username configuration item is named `"spring.datasource." + cluster name + "".username"`, and the database password configuration item is named `"spring.datasource." + cluster name + "".password"`.

[0058] Enter the suffix of the new database account name. The naming rule for the database account is cluster name + user-defined suffix. If the database account already exists in the database, prompt and re-enter the database account suffix.

[0059] Based on the entered database account, assign permissions to the database account; permissions include the following: CRUD operations, update only, CRUD operations and function execution, all permissions, read only, query and copy, CRUD operations, table creation and table deletion.

[0060] Once the above information is prepared, the encryption platform will complete the creation of the database account and password, the encryption of the database password, and the push of the database account and password to the configuration center.

[0061] As a further implementation, if the selected encryption method is the platform encryption method, then the following operations are performed:

[0062] Perform permission verification on the operator. Once the permission verification is successful, grant the authorization function: provide the database account and the permissions granted to that account. If the account already exists in the database, directly grant the permissions to the database; if the account does not exist, create the account in the database, set and encrypt the password for the account, and grant the permissions to the account.

[0063] To copy database accounts and passwords: Retrieve all database accounts from the source cluster, select the accounts to be copied to the target cluster, and submit copy authorization to the target cluster. This will copy the database accounts and passwords from the source cluster to the target cluster.

[0064] Pushing the database account and password to the configuration center is similar to the contactless encryption method, but the difference is that the database account in the current cluster is selected and the corresponding password is pushed to the configuration center.

[0065] As a further implementation, the configuration center creates accounts and passwords for the specified database clusters, including:

[0066] A random password is generated using the database's built-in random password generation function. Simultaneously, a database account is constructed based on the suffix of the input database account. The system checks if the account exists in the database; if not, it proceeds to the next step. If the account already exists, the entire process ends, returning to step 2, and the operator is notified.

[0067] The generated database password is encrypted using the national cryptographic encryption algorithm.

[0068] Retrieve all metadata information of the current cluster and construct a dictionary, which includes a dictionary name and dictionary values. The dictionary name is "ip:port", and the dictionary values ​​are the database instance details corresponding to the dictionary name. If no details exist, the entire process ends and returns to step 2, and the operator is prompted.

[0069] Based on the constructed dictionary information, iterate through each instance in the database cluster, establish a connection with the current database instance, and perform the action of creating a user. Create a database account and password on the current database instance, and perform the authorization action to grant permissions to the newly created account.

[0070] The database username and encrypted database password are added to the configuration center by calling the HTTP interface provided by the configuration center. The request body (which contains data for network communication) must include the username and password attribute names and their corresponding values.

[0071] As a further implementation, after the data is pushed to the configuration center, development or application operations personnel can then publish the configuration in the console. Once published successfully, the application system can detect the changes in the database configuration in real time.

[0072] As a further implementation, the method also includes:

[0073] Users of the application terminal can decrypt the database password using a decryption plugin and then establish a connection to the database using the decrypted password.

[0074] Specifically, the application retrieves the latest database username and password from the configuration center. The password is automatically intercepted by a plugin that the application terminal depends on. The plugin automatically decrypts the password before the connection is established and uses the decrypted password to establish a connection with the database.

[0075] In addition, after establishing a connection with the database, the application performs relevant CRUD operations on the database.

[0076] This invention achieves database encryption throughout the entire lifecycle of an information system, reducing unnecessary system access to plaintext production database account passwords and preventing staff from accessing them. This effectively prevents database account password theft and improves database information security. Furthermore, this invention provides visualization for database account password application, copying, and authorization; it also enables efficient and real-time modification of application system configurations.

[0077] Example 2

[0078] like Figure 2 As shown, the difference between this embodiment and Embodiment 1 is that this embodiment provides a database encryption system throughout the entire lifecycle of an information system. The system includes an application terminal and a server. The server includes an encryption platform, a configuration center, an application program, and a database. The application terminal connects to the encryption platform through a web front-end page. The encryption platform connects to the database. The encryption platform connects to the configuration center. The configuration center connects to the application program. The application program connects to the database.

[0079] The application terminal is used for users to submit applications, such as work orders to create database accounts and passwords; and to decrypt database passwords via a decryption plugin.

[0080] On the server side, based on the application, the encryption platform provides different encryption methods according to different usage scenarios; based on the selected encryption method, the configuration center creates an account and password for the specified database cluster and pushes the account and password to the application; the application connects to the database based on the account and password.

[0081] Figure 3This is an overall architecture diagram of a database encryption system throughout the entire lifecycle of an information system, as described in this invention. Figure 3 In this context, "user" refers to the user on the user terminal, "web-console" refers to the web front-end page, and "DB" refers to the database.

[0082] The execution process on the server side can be carried out according to the steps of the database encryption method in the entire life cycle of the information system described in Example 1, which will not be repeated in this example.

[0083] Meanwhile, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned database encryption method throughout the entire lifecycle of an information system.

[0084] Meanwhile, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned database encryption method throughout the entire lifecycle of an information system.

[0085] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0089] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A database encryption method in the full lifecycle of an information system, characterized by, The method comprises: Obtaining an application submitted by a terminal user, the application being a work order application for creating a database account and a password; According to the application, the encryption platform of the server provides different encryption modes according to different use scenarios; according to the selected encryption mode, the configuration center creates an account and a password for a specified database cluster, and pushes the account and the password to an application program; the application program establishes a database connection according to the account and the password. The encryption platform of the server provides different encryption modes according to different use scenarios, including: For a production environment, a non-contact encryption mode is provided; For a test environment, a platform encryption mode is provided; If the selected encryption mode is the non-contact encryption mode, the following operations are performed: The operator is subjected to permission verification, and when the permission verification is passed, a database cluster for which a database account application and password encryption are required is selected, and detailed information of the database cluster is obtained; According to the detailed information of the database cluster, an application identifier, a cluster name and a belonging environment of the encryption platform in the configuration center are filled in, and the account and the encrypted password are directly pushed to the configuration center and provided for related application access; According to whether the encryption platform needs to access multiple databases, the account and the password are pushed to the configuration item of the target application of the configuration center according to the multiple database rules; The suffix part of the new database account name is filled in, wherein the naming rule of the database account is cluster name + user-defined suffix; if the database account already exists in the database, the suffix of the database account is prompted and re-filled; According to the filled database account, the database account is assigned with permissions; the permissions include: adding, deleting, querying, modifying, being updateable and non-deletable, adding, deleting, querying and modifying, executing functions, all permissions, reading only, querying and copying, adding, deleting, querying and modifying, table creation and table deletion; The encryption platform completes the creation of the database account and the password, the encryption of the database password, and the pushing of the database account and the password to the configuration center; If the selected encryption mode is the platform encryption mode, the following operations are performed: The operator is subjected to permission verification, and when the permission verification is passed, an authorization function is performed: a database account and the permissions granted to the account are provided, if the account already exists in the database, the database is directly assigned with the permissions; if the account does not exist, the account is created in the database, and a password is set for the account and encrypted, and the account is assigned with the permissions; Database account and password replication is performed: all database accounts in a source cluster are pulled out, and a database account that needs to be replicated to a target cluster is selected and submitted to the target cluster for replication authorization, so as to realize the replication of the database account and the password from the source cluster to another target cluster; and The database account and the password are pushed to the configuration center.

2. The database encryption method in the full life cycle of an information system according to claim 1, wherein, The method further comprises: The user of the terminal only decrypts the password of the database through a decryption plug-in, and establishes a connection with the database through the decrypted password.

3. The database encryption method in the full life cycle of an information system according to claim 1, wherein, The encryption platform maintains a set of metadata information of the database, and the metadata information describes three dimensions of cluster groups, clusters and database instances.

4. The database encryption method in the full life cycle of an information system according to claim 1, wherein, The configuration center creates an account and a password for a specified database cluster, including: Generate a random password by using the built-in random password generation function of the database, and construct the database account according to the suffix of the incoming database account; The generated database password is encrypted by using the national encryption algorithm; Obtain all metadata information of the current cluster, construct a dictionary, wherein the dictionary includes the dictionary name and the value of the dictionary, and the value of the dictionary is the database instance details corresponding to the dictionary name; According to the constructed dictionary information, each instance in the database cluster is traversed, a connection with the current database instance is established, and the action of creating a user is executed, the database account and password are created on the current database instance, and the authorization action is executed to assign permissions to the created new account; The database account and the encrypted database password are added to the configuration center by calling the http interface provided by the configuration center.

5. A database encryption system in the full lifecycle of an information system, characterized by, The system comprises an application terminal and a server, wherein the server comprises an encryption platform, a configuration center, an application program and a database; the application terminal is connected to the encryption platform through a network front page, the encryption platform is connected to the database, the encryption platform is connected to the configuration center, the configuration center is connected to the application program, and the application program is connected to the database; The application terminal is used for submitting an application, and the application is a work order application for creating a database account and password; and the password of the database is decrypted by a decryption plug-in; The server is used for, according to the application, the encryption platform provides different encryption modes according to different use scenarios; according to the selected encryption mode, the configuration center creates an account and a password for a specified database cluster, and pushes the account and the password to the application program; The application program connects the database according to the account and the password; The encryption platform provides different encryption modes according to different use scenarios, including: For a production environment, a non-contact encryption mode is provided; For a test environment, a platform encryption mode is provided; If the selected encryption mode is the non-contact encryption mode, the following operations are performed: The operator is checked for permission, and when the permission check is passed, the database cluster for which the database account application and the password encryption are needed is selected, and the detailed information of the database cluster is obtained; According to the detailed information of the database cluster, the application identifier, the cluster name and the belonging environment of the encryption platform in the configuration center are filled in, and the account and the encrypted password are directly pushed to the configuration center and provided for related application access; According to whether the encryption platform needs to access multiple databases, the account and the password are pushed to the configuration item of the target application of the configuration center according to the multiple database rules; The suffix part of the new database account name is filled in, wherein the naming rule of the database account is cluster name+user-defined suffix; if the database account already exists in the database, a prompt is given and the suffix of the database account is re-filled; According to the filled-in database account, the database account is assigned with permissions; the permissions include: adding, deleting, querying, modifying, updateable, non-deletable, adding, deleting, querying, modifying and executing functions, all permissions, read-only, query replication, adding, deleting, querying, modifying, table creation and table deletion; The encryption platform completes the creation of the database account and the password, the encryption of the database password, and the pushing of the database account and the password to the configuration center. If the selected encryption mode is the platform encryption mode, the following operations are performed: The authority of the operator is checked, and when the authority check is passed, the authorization function is performed: the database account and the authority granted to the account are provided, if the account already exists in the database, the authority is directly assigned to the database; if the account does not exist, the account is created in the database, and the password of the account is set and encrypted, and the authority of the account is assigned; The database account and password replication is performed: all database accounts in the source cluster are pulled out, and the database accounts that need to be replicated to the target cluster are selected, and the authorization is submitted to the target cluster for replication, so as to copy the database account and password of the source cluster to another target cluster; and The database account and password are pushed to the configuration center.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the database encryption method in the whole life cycle of the information system according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, wherein the computer program comprises the following steps of: receiving a request for a resource from a client; determining whether the client is authorized to access the resource; and if the client is authorized to access the resource, providing the resource to the client. The computer program is executed by the processor to implement the database encryption method in the whole life cycle of the information system according to any one of claims 1 to 4.

Images