Encryption method of in-memory database, database system and electronic device

Abstract

Embodiments of the present application provide a memory database encryption method, a database system and an electronic device. The method comprises: in response to an encryption function start request, encrypting a memory database and writing the encrypted memory database into a first persistent file, and encrypting real-time commands for the memory database and writing the encrypted real-time commands into a second persistent file; deleting a third persistent file to determine the first persistent file as a backup file of the memory database, and deleting a fourth persistent file, the third persistent file being a backup file that is not encrypted before the encryption function is started, and the fourth persistent file being a command log that is not encrypted before the encryption function is started, thereby achieving transparent encryption of the memory database and improving data security.

Description

Technical Field

[0001] This application relates to the field of databases, and more specifically, to encryption methods for in-memory databases, database systems, and electronic devices. Background Technology

[0002] Encrypting data at rest during data storage is called encryption at rest. Specifically, it means encrypting data before it is written to persistent storage and decrypting it after it is read from persistent storage. This ensures that all data stored on persistent storage is encrypted, preventing data theft and effectively improving data security. In the database field, encryption at rest is also known as transparent data encryption (TDE).

[0003] Currently, TDE functionality has become a standard feature of mainstream databases, but there is no publicly available implementation in the field of in-memory databases. When persisting data in in-memory databases, ensuring data security has become an urgent problem to be solved. Summary of the Invention

[0004] This application provides encryption methods, database systems, and electronic devices for in-memory databases to improve data security.

[0005] Firstly, this application provides an encryption method for an in-memory database, comprising:

[0006] In response to the encryption function enable request, the memory database is encrypted and the encrypted memory database is written to a first persistent file; and the real-time commands targeting the memory database are encrypted and the encrypted real-time commands are written to a second persistent file.

[0007] The third persistent file is deleted to identify the first persistent file as a backup file of the memory database, and the fourth persistent file is deleted. The third persistent file is an unencrypted backup file before the encryption function was enabled, and the fourth persistent file is an unencrypted command log before the encryption function was enabled.

[0008] Optionally, before encrypting the memory database and writing the encrypted memory database to a first persistent file, and before encrypting the real-time commands targeting the memory database and writing the encrypted real-time commands to a second persistent file, the method further includes:

[0009] Create a first persistent file and a second persistent file with encryption enabled.

[0010] Optionally, the newly created first persistent file and second persistent file with encryption enabled include:

[0011] Generate a first data key, which is used to encrypt the memory database;

[0012] The first data key is encrypted using the master key in the encryption function enable request;

[0013] Create an empty first persistent file and write the encrypted first data key into the header of the first persistent file;

[0014] Generate a second data key, which is used to encrypt real-time commands targeting the memory database;

[0015] The second data key is encrypted using the master key;

[0016] Create an empty second persistent file and write the encrypted second data key into the header of the second persistent file.

[0017] Optionally, encrypting the in-memory database includes:

[0018] Read the header of the first persistent file and use the master key to decrypt the encrypted first data key in the header of the first persistent file to obtain the first data key;

[0019] The memory database is encrypted using the first data key;

[0020] The encryption of real-time commands targeting the memory database includes:

[0021] Read the header of the second persistent file and use the master key to decrypt the encrypted second data key in the header of the second persistent file to obtain the second data key;

[0022] The second data key is used to encrypt real-time commands targeting the memory database.

[0023] Optionally, the target data key is a first data key, and the target data is a memory database; or, the target data key is a second data key, and the target data is a real-time command for the memory database.

[0024] Encrypting the target data using the target data key includes:

[0025] The target data is divided into one or more data blocks based on preset values;

[0026] Each data block of the target data is encrypted using the target data key and the encryption vector corresponding to each data block.

[0027] Optional, also includes:

[0028] In response to a read operation on the target location of a target persistent file, wherein the target persistent file is either the first persistent file or the second persistent file;

[0029] The target data block to which the target location belongs is decrypted using the target data key and the encryption vector corresponding to the target data block to which the target location belongs;

[0030] Read the data corresponding to the target position in the decrypted target data block.

[0031] Optional, also includes:

[0032] In response to a write operation on the target persistent file, the data to be written is divided into one or more data blocks based on a preset value. If the size of the data block before the writing position is less than the preset value, the size of the first data block to be written is the preset value minus the size of the data block before the writing position.

[0033] Each data block of the data to be written is encrypted using the target data key and the encryption vector corresponding to each data block of the data to be written, and the encrypted data is written to the target persistent file.

[0034] Optionally, generating the first data key includes:

[0035] The master key in the encryption function enable request is verified, and if the master key verification passes, the first data key is generated.

[0036] Optional, also includes:

[0037] If the master key verification passes, the master key is persistently stored so that it can be used for encryption again after the memory database restarts.

[0038] Secondly, this application provides a database system, including: a memory and a processor, the memory including RAM and a disk, the RAM including data of a memory database, and the disk being used for persistent storage of the memory database;

[0039] The memory is also used to store computer programs;

[0040] The processor is configured to execute a computer program stored in the memory, which, when executed, causes the processor to perform the method described in the first aspect.

[0041] Thirdly, this application provides an electronic device, including: a memory and a processor;

[0042] The memory is used to store computer programs;

[0043] The processor is configured to execute a computer program stored in the memory, wherein the computer program, when executed, causes the processor to perform the method described in the first aspect.

[0044] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the method described in the first aspect.

[0045] In the in-memory database encryption method, database system, and electronic device provided in this application, after receiving a request to enable encryption, the in-memory database encrypts and persists both the in-memory database and the real-time command. The encrypted persistent file replaces the previous persistent file, thereby achieving transparent encryption of the in-memory database. Furthermore, during the process of enabling transparent encryption, the in-memory database can respond normally to real-time commands without needing to be restarted, and will not affect user requests, thus achieving hot-start of the transparent encryption function. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart illustrating an encryption method for a memory database provided in an embodiment of this application;

[0048] Figure 2 This is a schematic diagram of an encryption algorithm provided in an embodiment of this application;

[0049] Figure 3 This is a schematic diagram of the structure of a persistent file provided in an embodiment of this application;

[0050] Figure 4 This is a schematic diagram of a process for creating an encrypted persistent file according to an embodiment of this application;

[0051] Figure 5 This is a schematic diagram of a process for opening an encrypted persistent file provided in an embodiment of this application;

[0052] Figure 6 This is a schematic diagram of an encrypted data block provided in an embodiment of this application;

[0053] Figure 7 This is a schematic diagram illustrating the replacement of a backup file for a memory database according to an embodiment of this application;

[0054] Figure 8 This is a schematic diagram illustrating the replacement of the command log of an in-memory database according to an embodiment of this application;

[0055] Figure 9 This is a schematic diagram of the structure of an encryption device for a memory database provided in an embodiment of this application;

[0056] Figure 10 This is a schematic block diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] An in-memory database is a database where all data is stored in memory. In the event of a server power outage or other failure, the memory occupied by the in-memory database is released, resulting in the complete loss of data. To ensure that the data in the in-memory database is not lost due to failure, it is necessary to perform persistence processing, storing the transient data in memory onto disk to form persistent files. These persistent files can then be used for data recovery. Improving the security of the data on disk during the persistence processing of in-memory databases is a problem that needs to be solved.

[0059] Therefore, this application provides an encryption method for an in-memory database. This method can achieve transparent encryption of the in-memory database, improve data security, and supports hot-enable transparent encryption. That is, during the process of enabling transparent encryption, the in-memory database can provide services normally without restarting and will not affect user requests.

[0060] The encryption method for the memory database provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0061] Figure 1 This is a flowchart illustrating an encryption method for a memory database provided in an embodiment of this application. Figure 1 As shown, the method includes:

[0062] S101. In response to the encryption function enable request, encrypt the memory database and write the encrypted memory database to a first persistent file, and encrypt the real-time command for the memory database and write the encrypted real-time command to a second persistent file.

[0063] In this embodiment, encryption can be enabled without service interruption while the in-memory database is running; this is called transparent encryption. Enabling encryption does not affect the database's external services. When a user requests to enable encryption, the in-memory database receives the request while operating normally and begins encryption processing. Optionally, this embodiment can provide an option to enable encryption via a user interface. During the operation of the in-memory database, the user can select to enable encryption through the user interface, thereby triggering an encryption enable request.

[0064] In-memory databases typically have two types of persistent files: periodic backup files, which store the full data of the in-memory database at a specific point in time; and a continuously growing command log, which stores real-time commands executed on the database, such as insert, modify, or delete commands. In practice, to prevent the command log from becoming too large, it can be split into multiple files. The backup files and command log together form the complete database. In case of restarts or failures, the backup files can be used to restore the database to its current state, and the command log can be used to recover commands executed on the database after that point, thus obtaining the restored in-memory database.

[0065] Without encryption enabled, the backup files and command logs of the memory database contain unencrypted data. However, in this embodiment, after receiving a request to enable encryption, the memory database begins to encrypt itself. This includes encrypting the memory database to create a persistent backup file (the first persistent file) and encrypting real-time commands to create a persistent command log (the second persistent file). The encryption of the memory database and the encryption of real-time commands are performed simultaneously, and the encrypted backup of the memory database does not affect the memory database's response to real-time commands.

[0066] S102. Delete the third persistent file to identify the first persistent file as the backup file of the memory database, and delete the fourth persistent file. The third persistent file is the backup file that was not encrypted before the encryption function was enabled, and the fourth persistent file is the command log that was not encrypted before the encryption function was enabled.

[0067] Before encryption is enabled, the backup file of the in-memory database is an unencrypted third persistent file, and commands to the in-memory database before encryption is enabled are written to a fourth persistent file without encryption. In this embodiment, after generating the first and second persistent files, the first persistent file can replace the third persistent file as the backup file for the in-memory database. In practical applications, the third persistent file can be deleted, and the first persistent file can be renamed to correspond to the backup file name. The command logs from before encryption is enabled, i.e., the fourth persistent file, can be directly deleted. The fourth persistent file may include one or more persistent files. In this way, the persistent files of the in-memory database retain the first and second persistent files, and the encrypted data in the first and second persistent files can still form the complete data of the in-memory database. The in-memory database can be recovered using the first and second persistent files.

[0068] In the method of this application embodiment, after receiving the encryption function enable request, the memory database encrypts and persists the memory database and the real-time command respectively. The encrypted persistent file is used to replace the previous persistent file, thereby realizing transparent encryption of the memory database. Furthermore, during the process of enabling transparent encryption, the memory database can respond to the real-time command normally without restarting and without affecting user requests. This realizes hot-start of the transparent encryption function and improves data security.

[0069] The following section provides examples of the encryption algorithms, keys, and persistent files involved in the encryption method for the memory database in this application.

[0070] For example, this embodiment uses an envelope encryption algorithm to implement the encryption function, which involves two keys: a master key (master_key), which can be uploaded by the user or automatically generated by a Key Management Service (KMS); and a data key (data_key), which is randomly generated by a memory database each time a new file is encrypted. The lengths of the master key and data key are determined according to the actual situation, for example, 256 bits. In this embodiment, the encryption of the content in the persistent file uses the data key and the Advanced Encryption Standard (AES) AES Counter Mode (CTR) algorithm. This embodiment does not limit the algorithm. Simultaneously, the data key itself is encrypted using the master key and the AES Galois Message Authentication Code / Counter Mode (GCM) algorithm. The encrypted data key is stored in the header of the persistent file. Figure 2 The diagram illustrates how a master key is used to encrypt multiple data keys separately, and how different data keys are used to encrypt different persistent files.

[0071] Figure 3 This illustrates the structure of an encrypted persistent file, i.e., a persistent file with encryption enabled. For example... Figure 3 As shown, the encrypted persistent file includes a header and file content. The file content can be an encrypted in-memory database or encrypted real-time commands, and the file content size is the same as before encryption. The header of the persistent file contains the data key encrypted with the master key, and the data in the file content is the data encrypted using this data key. Optionally, the header of the persistent file may include encryption enable information ("TDE_ENABLED\n"), data key size (data_key_size), encrypted data key (encrypted data_key), initialization vector (iv1), tag, and iv2, etc. TDE_ENABLED indicates that encryption is enabled, iv1 is the start vector used when encrypting the data key using the AES_GCM algorithm, tag is the verification code used when encrypting the data key using the AES_GCM algorithm, and iv2 is the start vector used when encrypting the content of the persistent file using the AES_CTR algorithm. Optionally, the header size of the persistent file is 4kb, and the size of each piece of information is as follows: Figure 3 As shown above, in addition to the information illustrated above, the header of the persistent file may also include uninitialized reserved bytes for later expansion.

[0072] When new persistent files need to be generated, such as when periodically backing up an in-memory database or when generating new command log files, refer to... Figure 4 As shown, in a scenario where transparent encryption is enabled, the in-memory database generates a data key and a corresponding start vector, encrypts the data key using the master key, generates the information in the header of the aforementioned persistent file, creates an empty persistent file, and writes the header information into it, thereby completing the creation of a new persistent file with encryption enabled.

[0073] When you need to open a persistent file, refer to... Figure 5As shown, in the scenario where transparent encryption is enabled, the header of the persistent file is read, the encrypted data key in the header is decrypted using the master key, and the decrypted data key and the starting vector used when encrypting the content of the persistent file are stored in memory, thereby completing the operation of opening the persistent file. The data key and starting vector stored in memory can be used for subsequent decryption or encryption of the content of the persistent file. After closing the persistent file, the data key and starting vector in memory are also deleted accordingly.

[0074] In this embodiment of the application, a fixed-size method can be used when encrypting data, that is, the size of the data encrypted each time is a preset value, such as 16 bytes. For data to be written to the persistent file, the data can be divided into data blocks according to the preset value, and each data block can be encrypted. For example, Figure 6 As shown, data is encrypted in 16-byte blocks, each encrypted using a specific data key. The starting vector used for encryption can increment sequentially, from iv to iv5 as illustrated. Similarly, decryption is performed in 16-byte blocks. It's important to note that when dividing data into blocks according to a preset value, a smaller block may exist at the end. In this case, padding can be added to the end to form a block of the preset size. After encryption, the padding is discarded, and the remaining portion is written to the persistent file.

[0075] For encrypted persistent files, when you need to read a portion of their content, open the persistent file as described above, then decrypt and read according to the target location. Let's assume you are reading... Figure 6 The shaded area shown in the diagram is decrypted using the data key, the AES_CTR algorithm, and iv+2, iv+3, iv+4, and iv+5 respectively. Then, the corresponding shaded area is read according to the target position, which can be an offset position.

[0076] When writing new data to a persistent file that already contains file content, the persistent file is opened using the same method described above. The data to be written is divided into data blocks according to a preset value. Each data block is encrypted and then written to the specified writing position in the persistent file. It should be noted that if the data block size before the writing position is smaller than the preset value (i.e., the size of the last data block in the previous write was smaller than the preset value), then when dividing the data into blocks for this write, the size of the first data block to be written is the preset value minus the size of the data block size before the writing position, as shown below. Figure 6Assuming the data before the shaded area is data already stored in the persistent file, i.e., the data written previously, and the shaded area is the new data being written this time, since the data block before the shaded area is smaller than the preset value, the data to be written this time is divided into four data blocks as shown in the shaded area. The size of the first and last data blocks to be written this time is smaller than the preset value. During encryption, both of these data blocks need to be padded before encryption. After encryption, the padded part is discarded, and the remaining encrypted data is written to the persistent file.

[0077] In conjunction with the aforementioned encryption algorithm, the encryption method for the memory database in the embodiments of this application will be further described.

[0078] Optionally, in response to the encryption function activation request, the master key in the encryption function activation request is verified. This master key can be uploaded by the user or automatically generated using KMS. When triggering the encryption function activation request, the user can choose to customize the key or choose to automatically generate the key. If the master key verification passes, a first persistent file and a second persistent file for enabling encryption are created. Then, encrypted data can be written to the corresponding first and second persistent files. Optionally, if the master key verification passes, the master key is persistently stored so that encryption can be performed again using the master key after the in-memory database restarts.

[0079] Create a first persistent file and a second persistent file with encryption enabled, including: generating a first data key, which is used to encrypt the in-memory database; encrypting the first data key using the master key in the encryption enable request; creating an empty first persistent file and writing the encrypted first data key into the header of the first persistent file; generating a second data key, which is used to encrypt real-time commands targeting the in-memory database; encrypting the second data key using the master key; creating an empty second persistent file and writing the encrypted second data key into the header of the second persistent file.

[0080] After creating a first persistent file and a second persistent file with encryption enabled, the memory database is encrypted and written to the first persistent file. Similarly, real-time commands targeting the memory database are encrypted and written to the second persistent file. This process includes: reading the header of the first persistent file and decrypting the encrypted first data key in the header of the first persistent file using the master key to obtain the first data key; encrypting the memory database using the first data key and writing the encrypted memory database to the first persistent file; reading the header of the second persistent file and decrypting the encrypted second data key in the header of the second persistent file using the master key to obtain the second data key; and encrypting the real-time commands targeting the memory database using the second data key and writing the encrypted real-time commands to the second persistent file.

[0081] The encryption process for the file content described above is explained below. Encrypting the target data using the target data key includes: dividing the target data into one or more data blocks based on a preset value; encrypting each data block of the target data using the target data key and the encryption vector corresponding to each data block. The encryption vector is the aforementioned starting vector. Specifically, when dividing the target data into one or more data blocks, if the size of the last data block is smaller than the preset value, the last data block is padded before encryption, and the padded portion is discarded when writing the encrypted data to the target persistent file. The target data key is a first data key, the target data is a memory database, and the target persistent file is a first persistent file; or, the target data key is a second data key, the target data is a real-time command targeting the memory database, and the target persistent file is a second persistent file.

[0082] After the target persistent file is generated, read and write operations on the target persistent file will occur during the operation of the in-memory database. Optionally, in response to a read operation on the target location of the target persistent file, the target data block to which the target location belongs is decrypted using the target data key and the encryption vector corresponding to the target data block to which the target location belongs; the data corresponding to the target location in the decrypted target data block is then read.

[0083] Optionally, in response to a write operation on the target persistent file, the data to be written is divided into one or more data blocks based on a preset value. If the size of the data block before the writing position is less than the preset value, the size of the first data block of the data to be written is the preset value minus the size of the data block before the writing position. Each data block of the data to be written is encrypted using the target data key and the encryption vector corresponding to each data block of the data to be written, and the encrypted data is written to the target persistent file.

[0084] Combination Figure 7 and Figure 8 Here's an example. Before encryption is enabled, the backup file for the in-memory database is the third persistent file, named dump.rdb, which is the same name as the full backup file of the in-memory database. The command log is the fourth persistent file, consisting of three unencrypted files: appendonly.aof.1, appendonly.aof.2, and appendonly.aof.3. Before encryption is enabled, real-time commands are continuously written to appendonly.aof.3 without encryption. In response to the encryption activation request, a first persistent file, dump.rdb.bak, and a second persistent file, appendonly.aof.4, are simultaneously created with encryption enabled. The process of creating these persistent files follows the previously described embodiment: the memory database is encrypted and written to the first persistent file, dump.rdb.bak. Simultaneously, real-time commands generated during memory database operation are no longer written to appendonly.aof.3, but are instead encrypted and written to the second persistent file, appendonly.aof.4. Then, the third persistent file, dump.rdb, is deleted, and the first persistent file, dump.rdb.bak, is renamed to the name of the full backup file of the memory database, dump.rdb. Thus, the first persistent file becomes the backup file of the memory database. The unencrypted appendonly.aof.1, appendonly.aof.2, and appendonly.aof.3 are also deleted. Therefore, the backup file of the memory database is the encrypted first persistent file, dump.rdb, and the command log is the encrypted second persistent file, appendonly.aof.4; together, they form the complete data of the memory database. In this embodiment of the application, when the transparent encryption function is enabled, the encrypted persistent file is regenerated and the old persistent file is deleted, thereby realizing the hot-enabling of the transparent encryption function.

[0085] Figure 9 This is a schematic diagram of the structure of an encryption device for a memory database provided in an embodiment of this application. Figure 9 As shown, the encryption device 900 for the in-memory database includes:

[0086] The encryption module 901 is used to encrypt the memory database and write the encrypted memory database to a first persistent file in response to an encryption function enable request, and to encrypt real-time commands targeting the memory database and write the encrypted real-time commands to a second persistent file.

[0087] The deletion module 902 is used to delete the third persistent file to determine the first persistent file as a backup file of the memory database, and to delete the fourth persistent file. The third persistent file is an unencrypted backup file before the encryption function was enabled, and the fourth persistent file is an unencrypted command log before the encryption function was enabled.

[0088] Optionally, the encryption module 901 is used for:

[0089] Create a first persistent file and a second persistent file with encryption enabled.

[0090] Optionally, the encryption module 901 is used for:

[0091] Generate a first data key, which is used to encrypt the memory database;

[0092] The first data key is encrypted using the master key in the encryption function enable request;

[0093] Create an empty first persistent file and write the encrypted first data key into the header of the first persistent file;

[0094] Generate a second data key, which is used to encrypt real-time commands targeting the memory database;

[0095] The second data key is encrypted using the master key;

[0096] Create an empty second persistent file and write the encrypted second data key into the header of the second persistent file.

[0097] Optionally, the encryption module 901 is used for:

[0098] Read the header of the first persistent file and use the master key to decrypt the encrypted first data key in the header of the first persistent file to obtain the first data key;

[0099] The memory database is encrypted using the first data key;

[0100] Encryption module 901 is used for:

[0101] Read the header of the second persistent file and use the master key to decrypt the encrypted second data key in the header of the second persistent file to obtain the second data key;

[0102] The second data key is used to encrypt real-time commands targeting the memory database.

[0103] Optionally, the target data key is a first data key, and the target data is a memory database; or, the target data key is a second data key, and the target data is a real-time command for the memory database.

[0104] Encryption module 901 is used for:

[0105] The target data is divided into one or more data blocks based on preset values;

[0106] Each data block of the target data is encrypted using the target data key and the encryption vector corresponding to each data block.

[0107] Optionally, the encryption module 901 is used for:

[0108] In response to a read operation on the target location of a target persistent file, wherein the target persistent file is either the first persistent file or the second persistent file;

[0109] The target data block to which the target location belongs is decrypted using the target data key and the encryption vector corresponding to the target data block to which the target location belongs;

[0110] Read the data corresponding to the target position in the decrypted target data block.

[0111] Optionally, the encryption module 901 is used for:

[0112] In response to a write operation on the target persistent file, the data to be written is divided into one or more data blocks based on a preset value. If the size of the data block before the writing position is less than the preset value, the size of the first data block to be written is the preset value minus the size of the data block before the writing position.

[0113] Each data block of the data to be written is encrypted using the target data key and the encryption vector corresponding to each data block of the data to be written, and the encrypted data is written to the target persistent file.

[0114] Optionally, the encryption module 901 is used for:

[0115] The master key in the encryption function enable request is verified, and if the master key verification passes, the first data key is generated.

[0116] Optionally, the encryption module 901 is used for:

[0117] If the master key verification passes, the master key is persistently stored so that it can be used for encryption again after the memory database restarts.

[0118] The encryption device for the memory database provided in this application embodiment can be used to execute the encryption method for the memory database in the foregoing embodiment. Its implementation principle and technical effect are similar, and will not be repeated here.

[0119] Figure 10 This is a schematic block diagram of the electronic device provided in an embodiment of this application. Figure 10 As shown, the electronic device 1000 may include at least one processor 1001 for implementing the encryption method for the memory database provided in the embodiments of this application.

[0120] Optionally, the electronic device 1000 further includes at least one memory 1002 for storing program instructions and / or data. The memory 1002 is coupled to the processor 1001. The coupling in this embodiment is an indirect coupling or communication connection between devices, units, or modules, and can be electrical, mechanical, or other forms, used for information exchange between devices, units, or modules. The processor 1001 may operate in conjunction with the memory 1002. The processor 1001 may execute program instructions stored in the memory 1002. At least one of the at least one memory may be included in the processor.

[0121] Optionally, the electronic device 1000 further includes a communication interface 1003 for communicating with other devices via a transmission medium, thereby enabling the electronic device 1000 to communicate with other devices. The communication interface 1003 may be, for example, a transceiver, interface, bus, circuit, or a device capable of transmitting and receiving functions. The processor 1001 can utilize the communication interface 1003 to transmit and receive data and / or information, and to implement the methods provided in the embodiments of this application. For details, please refer to the detailed descriptions in the preceding embodiments; further elaboration is not repeated here.

[0122] This application embodiment does not limit the specific connection medium between the processor 1001, memory 1002, and communication interface 1003. This application embodiment... Figure 10 The processor 1001, memory 1002, and communication interface 1003 are connected via bus 1004. Bus 1004 is... Figure 10 The connections between other components are shown in thick lines only and are not intended to be limiting. This bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0123] It should be understood that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method embodiments can be completed by the integrated logic circuitry in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0124] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0125] This application also provides a database system, including: a memory and a processor, the memory including RAM and a disk, the RAM including data of the in-memory database, and the disk used for persistent storage of the in-memory database;

[0126] Memory is also used to store computer programs;

[0127] The processor is used to execute a computer program stored in memory, which, when running, causes the processor to perform the methods as described in any of the embodiments.

[0128] This application also provides a computer-readable storage medium storing a computer program (also referred to as code or instructions). When the computer program is run, it causes the computer to perform the methods as described in any of the foregoing embodiments.

[0129] The terms “unit”, “module”, etc., used in this specification may be used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution.

[0130] Those skilled in the art will recognize that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. In the several embodiments provided in this application, it should be understood that the disclosed apparatus, devices, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for example, the division of units is merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0131] The unit described as a separate component may or may not be physically separate. The component shown as a unit may or may not be a physical unit; that is, it may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0133] In the above embodiments, the functions of each functional unit can be implemented entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. This computer program product includes one or more computer instructions (programs). When the computer program instructions (programs) are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0134] If this function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0135] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for encrypting an in-memory database, characterized in that, include: In response to the encryption function enable request, the memory database is encrypted and the encrypted memory database is written to a first persistent file; and the real-time commands targeting the memory database are encrypted and the encrypted real-time commands are written to a second persistent file. The third persistent file is deleted to identify the first persistent file as a backup file of the memory database, and the fourth persistent file is deleted. The third persistent file is an unencrypted backup file before the encryption function was enabled, and the fourth persistent file is an unencrypted command log before the encryption function was enabled.

2. The method according to claim 1, characterized in that, Before encrypting the memory database and writing the encrypted memory database to a first persistent file, and before encrypting the real-time commands targeting the memory database and writing the encrypted real-time commands to a second persistent file, the method further includes: Create a first persistent file and a second persistent file with encryption enabled.

3. The method according to claim 2, characterized in that, The newly created first persistent file and second persistent file with encryption enabled include: Generate a first data key, which is used to encrypt the memory database; The first data key is encrypted using the master key in the encryption function enable request; Create an empty first persistent file and write the encrypted first data key into the header of the first persistent file; Generate a second data key, which is used to encrypt real-time commands targeting the memory database; The second data key is encrypted using the master key; Create an empty second persistent file and write the encrypted second data key into the header of the second persistent file.

4. The method according to claim 3, characterized in that, The encryption of the memory database includes: Read the header of the first persistent file and use the master key to decrypt the encrypted first data key in the header of the first persistent file to obtain the first data key; The memory database is encrypted using the first data key; The encryption of real-time commands targeting the memory database includes: Read the header of the second persistent file and use the master key to decrypt the encrypted second data key in the header of the second persistent file to obtain the second data key; The second data key is used to encrypt real-time commands targeting the memory database.

5. The method according to claim 3, characterized in that, The target data key is a first data key, and the target data is a memory database; or, the target data key is a second data key, and the target data is a real-time command targeting the memory database. Encrypting the target data using the target data key includes: The target data is divided into one or more data blocks based on preset values; Each data block of the target data is encrypted using the target data key and the encryption vector corresponding to each data block.

6. The method according to claim 5, characterized in that, Also includes: In response to a read operation on the target location of a target persistent file, wherein the target persistent file is either the first persistent file or the second persistent file; The target data block to which the target location belongs is decrypted using the target data key and the encryption vector corresponding to the target data block to which the target location belongs; Read the data corresponding to the target position in the decrypted target data block.

7. The method according to claim 5, characterized in that, Also includes: In response to a write operation on the target persistent file, the data to be written is divided into one or more data blocks based on a preset value. If the size of the data block before the writing position is less than the preset value, the size of the first data block to be written is the preset value minus the size of the data block before the writing position. Each data block of the data to be written is encrypted using the target data key and the encryption vector corresponding to each data block of the data to be written, and the encrypted data is written to the target persistent file.

8. The method according to claim 3, characterized in that, The generation of the first data key includes: The master key in the encryption function enable request is verified, and if the master key verification passes, the first data key is generated.

9. The method according to claim 5, characterized in that, Also includes: If the master key verification passes, the master key is persistently stored so that it can be used for encryption again after the memory database restarts.

10. A database system, characterized in that, include: The storage and processor, wherein the storage includes memory and a disk, the memory includes data in a memory database, and the disk is used for persistent storage of the memory database; The memory is also used to store computer programs; The processor is configured to execute a computer program stored in the memory, wherein the computer program, when executed, causes the processor to perform the method described in any one of claims 1-9.

11. An electronic device, characterized in that, include: Memory and processor; The memory is used to store computer programs; The processor is configured to execute a computer program stored in the memory, wherein the computer program, when executed, causes the processor to perform the method described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to perform the method as described in any one of claims 1-9.

Images