Database access method, apparatus, device, and storage medium

Abstract

The present disclosure provides a database access method and device, equipment and storage medium, relates to the technical field of computers, in particular to the field of cloud computing and cloud security computing. The specific implementation scheme is: a key encryption request is sent to a key server, wherein the key encryption request includes a local key; a target key from the key server is obtained, wherein the target key is obtained by encrypting the local key by the key server according to a key server key; in response to receiving a write request for a database, using a custom type converter corresponding to the database, the data to be written corresponding to the write request is encrypted according to the key, to obtain encrypted data, wherein the custom type converter is obtained by injecting encryption logic code and decryption logic code into a default type converter; and the encrypted data is written into the database.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to the fields of cloud computing and cloud security computing. Background Technology

[0002] With the popularization and development of the internet, more and more companies are using internet applications to provide services to users. Some internet applications require users to provide user information when providing services. This user information may include ID card numbers, mobile phone numbers, bank account numbers, facial recognition data, etc. For example, in public cloud scenarios, based on national regulatory requirements for computer resources, users need to provide identity information and facial recognition data for real-name authentication. Or, e-commerce platforms need to store users' names, addresses, and phone numbers for product delivery.

[0003] To ensure the security of user information, many companies have adopted encrypted storage methods. Therefore, how to encrypt and store data has become a pressing issue. Summary of the Invention

[0004] This disclosure provides a database access method, apparatus, device, storage medium, and program product.

[0005] According to one aspect of this disclosure, a method for accessing a database is provided, comprising: sending a key encryption request to a key server, wherein the key encryption request includes a local key; obtaining a target key from the key server, wherein the target key is obtained by the key server encrypting the local key based on the key server key; in response to receiving a write request for the database, encrypting data to be written corresponding to the write request using a custom type converter corresponding to the database, based on the key, to obtain encrypted data, wherein the custom type converter is obtained by injecting encryption logic code and decryption logic code into a default type converter; and writing the encrypted data into the database.

[0006] According to another aspect of this disclosure, a database access apparatus is provided, comprising: a sending module for sending a key encryption request to a key server, wherein the key encryption request includes a local key; an acquisition module for acquiring a target key from the key server, wherein the target key is obtained by the key server encrypting the local key according to a key server key; an encryption module for, in response to receiving a write request for the database, encrypting data to be written corresponding to the write request using a custom type converter corresponding to the database, according to the key, to obtain encrypted data, wherein the custom type converter is obtained by injecting encryption logic code and decryption logic code into a default type converter; and a writing module for writing the encrypted data into the database.

[0007] Another aspect of this disclosure provides an electronic device including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods shown in embodiments of this disclosure.

[0008] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to perform the methods shown in the embodiments of the present disclosure.

[0009] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instructions, characterized in that, when the computer program / instructions are executed by a processor, they implement the steps of the method shown in the embodiments of the present disclosure.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0012] Figure 1 The illustration schematically shows an exemplary system architecture for database access methods and apparatus applicable according to embodiments of the present disclosure;

[0013] Figure 2 A flowchart illustrating a database access method according to an embodiment of the present disclosure is shown schematically;

[0014] Figure 3A flowchart illustrating a database access method according to another embodiment of this disclosure is shown schematically;

[0015] Figure 4 A flowchart illustrating a database access method according to another embodiment of this disclosure is shown schematically;

[0016] Figure 5 A flowchart illustrating a method for determining a custom type converter according to an embodiment of the present disclosure is shown schematically;

[0017] Figure 6 A flowchart illustrating database access according to another embodiment of this disclosure is shown schematically;

[0018] Figure 7 A block diagram of a database access apparatus according to an embodiment of the present disclosure is shown schematically;

[0019] Figure 8 A block diagram of an example electronic device that can be used to implement embodiments of the present disclosure is illustrated schematically. Detailed Implementation

[0020] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0021] The following will combine Figure 1 The system architecture of the database access method and apparatus provided in this disclosure is described.

[0022] Figure 1 An exemplary system architecture 100, illustrating database access methods and apparatus applicable according to embodiments of this disclosure, is shown schematically. It should be noted that... Figure 1 The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0023] like Figure 1 As shown, the system architecture 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the terminal devices 101, 102, and 103 and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0024] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0025] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0026] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0027] It should be noted that the database access method provided in this embodiment can generally be executed by server 105. Correspondingly, the database access device provided in this embodiment can generally be located in server 105. The database access method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the database access device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0028] Server 105 can be a cloud server, also known as a cloud computing server or cloud host. It is a host product in the cloud computing service system, which solves the shortcomings of traditional physical hosts and VPS services ("Virtual Private Server", or simply "VPS"), such as high management difficulty and weak business scalability. Server 105 can also be a server for a distributed system or a server combined with blockchain.

[0029] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0030] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and there is no violation of public order and good morals.

[0031] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0032] The following will combine Figure 2 The methods for accessing the database provided in this disclosure are described.

[0033] Figure 2 A flowchart illustrating a database access method according to an embodiment of this disclosure is shown schematically. This method can, for example, be performed by the server described above.

[0034] like Figure 2 As shown, the database access method 200 includes operation S210, sending a key encryption request to the key server.

[0035] According to embodiments of this disclosure, the key encryption request includes a local key. The local key can be pre-generated. For example, a random character generator can be used to generate a random string, which serves as the local key.

[0036] According to embodiments of this disclosure, the target key can be obtained by a key server encrypting a local key using the key server's key. For example, the key server can encrypt the local key using the key server's key based on a key encryption request to obtain the target key, and then send it to the server.

[0037] According to embodiments of this disclosure, for example, the domain name address of the key server can be obtained. Then, a key encryption request is sent to the domain name address. The domain name address of the key server can be pre-stored in a configuration file. Based on this, the domain name address of the key server can be obtained from the configuration file, for example. The domain name address may include, for example, an HTTPS (Hypertext Transfer Security Protocol) address.

[0038] Then, in operation S220, the target key is obtained from the key server.

[0039] In operation S230, in response to receiving a write request for the database, the custom type converter corresponding to the database is used to encrypt the data to be written corresponding to the write request according to the key, so as to obtain encrypted data.

[0040] According to embodiments of this disclosure, a custom type converter can be obtained by injecting encryption and decryption logic code into a default type converter. The default type converter can, for example, include a TypeHandler in the MyBatis framework, which is a persistence layer framework. For instance, the encryption logic code of the custom type converter can be executed to encrypt the data to be written corresponding to the write request based on a key, resulting in encrypted data. The write request can be used to request that the corresponding data to be written be written to the database.

[0041] According to embodiments of this disclosure, a custom type converter may be, for example, a class data type.

[0042] According to embodiments of this disclosure, for example, data to be written can be obtained from a Data Access Object (DAO). The DAO can be used to provide a common API (Application Programming Interface) for accessing data stored in different databases.

[0043] In operation S240, encrypted data is written to the database.

[0044] According to embodiments of this disclosure, encrypting data using a custom type converter before writing the data can improve the security of data in the database.

[0045] Figure 3 A flowchart illustrating a database access method according to another embodiment of this disclosure is shown schematically.

[0046] like Figure 3 As shown, the database access method 300 may also include operation S350, in response to receiving a read request for the database, reading the target encrypted data in the database corresponding to the read request.

[0047] According to embodiments of this disclosure, a read request can be used to request the reading of data from a database.

[0048] When operating the S360, a custom type converter corresponding to the database is used to decrypt the target encrypted data according to the key, and obtain the original data.

[0049] According to embodiments of this disclosure, for example, decryption logic code of a custom type converter can be executed to decrypt the target encrypted data according to the key to obtain the original data.

[0050] In operation S370, raw data is written to the data access object.

[0051] According to embodiments of this disclosure, for example, raw data can be written into a corresponding field in a data access object. Subsequently, the user can retrieve the requested raw data from the corresponding field in the data access object.

[0052] Figure 4 A flowchart illustrating a database access method according to another embodiment of this disclosure is shown schematically.

[0053] like Figure 4 As shown, the database access method 400 may also include, in operation S480, obtaining the login account, password, cloud key identifier, and local key.

[0054] According to embodiments of this disclosure, for example, a login account and password can be requested in advance from an authentication server. For example, a cloud key identifier can be obtained in advance from a key server. For example, a random character generator can be used to generate a random string as a local key.

[0055] According to embodiments of this disclosure, the authentication server and the key server can be the same server or different servers.

[0056] When operating the S490, authentication is performed based on the login account and password to obtain authentication information.

[0057] According to embodiments of this disclosure, for example, the login account and password can be sent to the authentication server, which then authenticates the server based on the login account and password. If the authentication is successful, authentication information is generated and returned to the server.

[0058] When operating the S4100, a key encryption request is generated based on the authentication information, cloud key identifier, and local key.

[0059] According to embodiments of this disclosure, for example, authentication information can be set in the request header of the key encryption request, and cloud key identifier and local key can be set in the request parameters.

[0060] According to another embodiment of this disclosure, for example, a local key can be encrypted, and then the encrypted local key can be sent to a cryptographic server via a key encryption request. The cryptographic server can decrypt the encrypted local key to obtain an unencrypted local key, then encrypt the local key using a cloud key to obtain a target key, and then encrypt the target key again, sending the encrypted target key back to the server. The server can decrypt the encrypted target key to obtain an unencrypted key. By encrypting both the local key and the target key, the security of the key during transmission can be improved.

[0061] To solve the problem of encrypted database storage, a key can be set. When data needs to be stored in the database, the plaintext data is encrypted using the key. The encrypted data is then stored in the database. When data needs to be retrieved, the encrypted data can be read from the database. Then, using the key, the encrypted data is decrypted to obtain the plaintext data.

[0062] In related technologies, the key is stored directly in plaintext in a configuration file. Decryption is performed by reading the key from the configuration file. Because the key is stored in plaintext, it is easily obtained, resulting in low key security. Even if the data in the database is encrypted, the key can be easily obtained, and the encrypted data in the database can be easily cracked, leading to low data security in the database.

[0063] According to embodiments of this disclosure, cloud keys are managed through a key server, and then the authentication and authorization mechanism of the authentication server ensures that the local key can only be encrypted after obtaining the authentication and authorization information, so as to obtain the key actually used. This avoids the problem of poor security caused by storing the plaintext of the key directly in the configuration file.

[0064] According to embodiments of this disclosure, a default type converter may include a parameter setting method (setParameter) and a result retrieval method (getResult). The parameter setting method can be used to write data to a specified field. The result retrieval method can be used to return the data written to the specified field.

[0065] Based on this, the following will combine Figure 5 The method for determining a custom type converter provided in this disclosure is described.

[0066] Figure 5 A flowchart illustrating a method for determining a custom type converter according to an embodiment of the present disclosure is shown schematically.

[0067] like Figure 5 As shown, the method 500 for determining a custom type converter includes, in operation S510, registering an encryption / decryption processor in the application framework.

[0068] According to embodiments of this disclosure, the application framework may include, for example, the Spring framework. The Spring framework is a J2EE (Java 2 Platform Enterprise Edition) application framework.

[0069] According to embodiments of this disclosure, an encryption / decryption processor can be used to implement encryption / decryption processing logic. The encryption / decryption processor may include encryption logic code and decryption logic code. The encryption logic code can be used to encrypt unencrypted data based on a target key. The decryption logic code is used to decrypt encrypted data based on the target key.

[0070] When operating the S520, the parameter setting method in the default type converter is configured to execute encryption logic code, and the result acquisition method in the default type converter is configured to execute decryption logic code, thus obtaining a custom type converter.

[0071] According to embodiments of this disclosure, a custom type converter is obtained by configuring a parameter setting method and a result acquisition method. This converter can be used to automatically encrypt plaintext data written to a database and decrypt encrypted data read from the database.

[0072] According to embodiments of this disclosure, for example, encryption logic code can be executed by calling a parameter setting method of a custom type converter to encrypt the data to be written according to the key, thereby obtaining encrypted data.

[0073] According to embodiments of this disclosure, for example, decryption logic code is executed by calling a result acquisition method of a custom type converter in order to decrypt the target encrypted data according to the key and obtain the original data.

[0074] According to embodiments of this disclosure, a custom type converter can be registered for the database, for example, in the persistence layer framework. By registering a custom type converter in the persistence layer framework, methods other than the custom type converter can call methods within that custom type converter.

[0075] According to embodiments of this disclosure, the server can connect to one or more databases, and the corresponding data processing objects can also be one or more. In this embodiment, for multiple data processing objects, custom annotations can be added to data processing objects that require data encryption and decryption, while data processing objects that do not require data encryption and decryption do not need to have custom annotations added. Custom annotations may include, for example, Spring AOP annotations, where AOP refers to a programming approach that dynamically inserts a piece of code into a specified method and location during program execution.

[0076] According to embodiments of this disclosure, for data processing objects with added custom annotations, the invoke methods of these data processing objects can be overridden so that the object wrapper of the data processing object is configured to call the result retrieval method of the custom type converter before writing the raw data to the data processing object.

[0077] According to embodiments of this disclosure, based on annotation technology, custom type converters, object wrappers, and other database field processing utility classes can be configured. Only a small amount of code needs to be configured to automatically encrypt and decrypt specific database fields, reducing workload and improving development efficiency.

[0078] The following is for reference. Figure 6 The database access method described above will be further explained with reference to specific embodiments. Those skilled in the art will understand that the following example embodiments are only for understanding this disclosure, and this disclosure is not limited thereto.

[0079] Figure 6 A flowchart illustrating database access according to another embodiment of this disclosure is shown schematically.

[0080] exist Figure 6 The diagram shows how the password for the login account is obtained during operation S601.

[0081] According to embodiments of this disclosure, for example, an authentication server can be requested to obtain a login account Access Key and a password Secret Key. When accessing the password server, authentication using both the Access Key and Secret Key must first be performed. For example, each request authenticated using the Access Key and Secret Key can be recorded in an audit log.

[0082] In operation S602, obtain the domain name address and cloud key identifier used for key services.

[0083] According to embodiments of this disclosure, a key management service can be pre-activated, and a domain name address for accessing the key service can be obtained from a key server. The key server can create a key and obtain parameter information such as the key's cloud key identifier (e.g., ID). The plaintext string information of the key is generated by the key server. This key is hereinafter referred to as the cloud key. The cloud key can be used as a private key.

[0084] When operating S603, the login account, password, domain name address, and cloud key identifier are stored in the configuration file.

[0085] When operating S604, a local key is generated, stored in a configuration file, and the activation parameters for each local key are configured.

[0086] According to embodiments of this disclosure, for example, a 128-character string `openKey` can be generated as a local key using a random character generator. Additionally, the local key can be encrypted.

[0087] According to embodiments of this disclosure, multiple local keys can be available, and based on this, activation parameters for each local key can be configured in a configuration file. Activation parameters are used to identify whether an activation parameter is effective. A local key can be used as a public key.

[0088] When operating the S605, listen for key initialization events. Upon detecting a key initialization event, read the activation parameters of the local key from the configuration file. For local keys with activation parameters set to "activated," read the login account, password, domain name address, cloud key identifier, and encrypted local key from the configuration file.

[0089] Based on the scope of this disclosure, for example, a custom listener class named KeyInitializer can be implemented to implement the key loading function. This listener class implements the Spring framework interface ApplicationListener<ApplicationEnvironmentPreparedEvent>, where ApplicationListener is the Spring event mechanism, working in conjunction with the abstract class ApplicationEvent to complete the ApplicationContext's event mechanism. ApplicationEnvironmentPreparedEvent is a framework subclass that inherits from SpringApplicationEvent. Its purpose is to publish events when the Spring Application starts. These events are the methods of KeyInitializer, and the environment variable Environment can be used to read various environment variables.

[0090] Based on the number of disclosures, for example, the onApplicationEvent(ApplicationEnvironmentPreparedEvent event) method of the ApplicationListener interface can be overridden to read the parameter configuration of whether the local key Key is effective through the environment.resolvePlaceholders() method of Spring configuration file, such as key.enable: true.

[0091] When operating S606, based on the login account and authentication information, a signature is requested from the authentication server to obtain the signature authentication string.

[0092] According to the information disclosed herein, if the local key is valid, the Access Key & Secret Key, domain address, cloud key identifier, and local key openKey can be retrieved from the configuration file obtained through the `environment.resolvePlaceholders()` method in Spring's configuration file. The local key openKey can be pre-encrypted using base64. The domain address can be an HTTPS address.

[0093] Then, the Access Key and Secret Key can be signed to generate the signature authentication string "Authorization".

[0094] When operating S607, a key encryption request is initiated to the domain name address to obtain the encrypted target key.

[0095] Based on the scope of this disclosure, for example, a POST network request for key encryption can be initiated to a domain name address, with the request header set to Authorization and the request parameters set to a cloud key identifier and a local key openKey. Upon receiving the key encryption request, the cryptographic server encrypts the local key using the cloud key to obtain the target key. The target key can then be base64 encoded, and the encrypted target key is sent as the return value to the request initiator.

[0096] By operating S608, the encrypted target key is decrypted to obtain the target key.

[0097] Based on the quantity disclosed herein, for example, the return value can be base64 decrypted to obtain the unencrypted target key.

[0098] According to embodiments of this disclosure, if a network request is abnormal due to network jitter timeout or other abnormal requests, operation S607 is repeatedly retried until a return value containing the target key is successfully obtained.

[0099] According to embodiments of this disclosure, since the key is globally unique and cannot be modified or copied, the target key can be managed using a singleton pattern. For example, a singleton class `KeyStorage` can be created. `KeyStorage` has only one parameter, a `String key`, used to store the target key. Whether `KeyStorage` should be assigned a value can be determined by checking if `key` is empty; assignment is only allowed if `key` is empty. Therefore, the target key cannot be modified after generation, ensuring its correctness.

[0100] When operating S609, a custom type converter is generated based on the TypeHandler in the MyBatis framework, which is used to encrypt and decrypt database fields using the target key.

[0101] According to embodiments of this disclosure, a unified database field encryption / decryption logic processing class, `AesCipherProcessor`, can be implemented. This class can be registered as a Spring bean, for example, through the `@Service` annotation. The core of `AesCipherProcessor` consists of two methods: `getEncryptString` for plaintext encryption and `getOrginValue` for ciphertext decryption. In this embodiment, a prefix string, such as `decode_prefix_flag`, can be set. This prefix string can be added before the encrypted data to identify successfully encrypted data. For example, if the data "1234" is encrypted to "abcd", the prefix string "decode_prefix_flag_abcd" can be added before "abcd". In this embodiment, before data decryption, it can be checked whether the data prefix is ​​`decode_prefix_flag`. If it is, the decryption logic is executed; otherwise, it indicates that the data was not previously encrypted and cannot be decrypted, thereby preventing system crashes.

[0102] The decryption method is described below with reference to specific embodiments. For example, in this embodiment, for encrypted strings with the prefix `decode_prefix_flag`, the target key is obtained through the `getKey` method of the singleton class `KeyStorage`. The decryption logic can employ Java's Cipher encryption / decryption logic. The encryption method is similar: before encryption, it checks whether the data's prefix is ​​`decode_prefix_flag`. If it is, it indicates that the data has already been encrypted and cannot be encrypted again. Otherwise, the data is encrypted.

[0103] According to embodiments of this disclosure, a custom type converter, CommonAesCipperHandler, can be implemented. This custom type converter can be a class data type. This class can be registered as a Spring bean, for example, through the @Service annotation. This class can be obtained using the TypeHandler from the MyBatis framework. <t>Inject the encryption / decryption logic processing class, namely `aesCipherProcessor` of `AesCipherProcessor`, where `aesCipherProcessor` contains encryption and decryption methods. Then, override the `setParameter` and `getResult` methods of the `TypeHandler` interface. The rewritten `setParameter` can be used to call the encryption method `aesCipherProcessor.getEncryptString`, and the rewritten `getResult` can be used to call the decryption method `aesCipherProcessor.getOrginValue`.

[0104] According to embodiments of this disclosure, an enterprise service may connect to multiple different databases simultaneously (potentially hundreds), and each database may have fields that require encryption / decryption. Correspondingly, MyBatis can use multiple databases as data sources. Based on this, in this embodiment, CommonAesCipperHandler can be registered with each MyBatis data source. For example, a registration configuration class CommonTypeHandlerConfigureProcessor can be implemented, and then the four interfaces of CommonTypeHandlerConfigureProcessor—BeanPostProcessor, BeanFactoryAware, ApplicationContextAware, and Ordered—can be implemented, injecting the parameter CommonAesCipperHandler autoInjectTypeHandler into the class. Next, the getOrder method of the Ordered interface can be overridden to place the execution order of the registered configuration class last—Ordered.LOWEST_PRECEDENCE. The setApplicationContext method of ApplicationContextAware can be overridden, with the content this.context = applicationContext; The `setBeanFactory` method of the `BeanFactoryAware` interface is overridden, with the content `this.embeddedValueResolver = new EmbeddedValueResolver((ConfigurableBeanFactory)beanFactory);`. The core functionality lies in the `postProcessAfterInitialization` method of the `BeanPostProcessor` interface, which implements the processing logic after each bean injection.

[0105] According to embodiments of this disclosure, the generic postprocessing method `postProcessAfterInitialization` can be overridden based on `CommonTypeHandlerConfigureProcessor` to register the `CommonAesCipperHandler` type converter to the type converter of each MyBatis connection source. For example, the method `SqlSessionFactory.class.isAssignableFrom(bean.getClass)` can be used to determine whether the Bean currently injected into Spring is a MyBatis database connection source. If so, it is converted to `sqlSessionFactory` and registered in two steps. The first step, `sqlSessionFactory.getConfiguration().getTypeAliasRegistry().registerAlias("commonAesCipper", AopUtils.getTargetClass(autoInjectTypeHandler))`, adds a mapping relationship between the class name and the type conversion processing class to the `TYPE_ALIASES` collection of the data source. The `commonAesCipper` registered here will be used later. The second step is to implement Spring's AOP object type automatic converter, sqlSessionFactory.getConfiguration().getTypeHandlerRegistry().register(autoInjectTypeHandler); this step adds a corresponding type converter for the String parameter.

[0106] SQL statements in the MyBatis framework can be edited using XML files. If a database table field is named `register_phone` and the corresponding DAO field is named `registerPhone`, then the INSERT and UPDATE statements can be written as `register_phone = #{registerPhone, typeHandler = commonAesCipper}`. If the input `registerPhone` is plaintext, MyBatis will automatically call the `setParameter` method of the type converter `commonAesCipper` when processing INSERT and UPDATE statements, thus automatically encrypting the plaintext information.

[0107] When operating S610, by customizing Spring AOP annotations and configuration field settings, data can be automatically decrypted when reading data from the database.

[0108] According to embodiments of this disclosure, a custom Spring AOP annotation, such as SensitiveAble, can be implemented. This annotation can be placed on the DAO and used to automatically encrypt data when assigning values ​​to data retrieved from the database. The SensitiveAble annotation can be augmented with two annotations: @Target(ElementType.TYPE) and @Retention(RetentionPolicy.RUNTIME). @Target specifies the scope of the object the annotation modifies, while @Retention specifies the annotation's lifecycle.

[0109] According to embodiments of this disclosure, the ObjectWrapperFactory interface technology in the MyBatis framework can be used. The object is, for example, a DAO. ObjectWrapperFactory includes two methods: hasWrapperFor and getWrapperFor. hasWrapperFor is used to determine if a wrapper exists, and getWrapperFor can be used to retrieve the wrapper's processing class, implementing the functionality of the SensitiveAble annotation. For example, a custom class SensitiveObjectWrapperFactory can be defined, with a new property Map<Class<?>, Boolean> sensAnotation used to record whether each class has the SensitiveAble annotation. This class implements the ObjectWrapperFactory interface and overrides the boolean hasWrapperFor(Object object) method to identify whether each bean has corresponding wrapper processing logic. It determines whether the current class has the SensitiveAble annotation by checking AnnotationUtils.isAnnotationDeclaredLocally(SensitiveAble.class, objClass), and maintains the resulting boolean value in sensAnotation.

[0110] According to embodiments of this disclosure, the `getWrapperFor` method for retrieving the wrapper handler class can be overridden in `SensitiveObjectWrapperFactory`. Its core is to determine if the current object has a wrapper using `hasWrapperFor`, and if so, return the corresponding wrapper handler class. The `InvocationHandler` interface can be implemented using `RealInvocationHandler`, and the specific processing logic of the wrapper can be implemented by overriding the `invoke` method (`@Override`). The main purpose of the `ObjectWrapper getWrapperFor(MetaObject metaObject, Object object)` method is to return an `ObjectWrapper`. This requires three checks: First, if `object instanceof Map`, then `objectWrapper = new MapWrapper(metaObject, (Map)object)`; second, if `object instanceof Collection`, then `objectWrapper = new CollectionWrapper(metaObject, (Collection)object)`; otherwise, `objectWrapper = new BeanWrapper(metaObject, object)`; finally, `return(ObjectWrapper)Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(), new Class[]{ObjectWrapper.class}, new RealInvocationHandler())`.

[0111] According to embodiments of this disclosure, RealInvocationHandler is a custom processing class whose core processing logic is to override the method Object invoke(Object proxy, Method method, Object[] args). Therefore, when executing a method in the DAO, the name of the method is obtained, and it is determined whether the name is "set", i.e., "set".equals(method.getName()). If it is, it is marked that the current method assigns the value from the database to the set method in the DAO. At this time, the name of the field to be written to the DAO is obtained through (PropertyTokenizer)args[0].getName(), such as registerPhone. However, many parameters do not need to be automatically decrypted. In this case, a variable can be set for the fields that need to be automatically decrypted in the configuration file, such as Spring's application.properties, for example, kms.columns = registerPhone. By reading the variable, the name of the field that needs to be automatically decrypted is obtained and compared with the name of the field to be written. If they match, it means that automatic decryption is required. At this time, the decryption method realValue = aesCipherProcessor.getOrginValue((String)args[1]) is called to decrypt the data read from the database and obtain the plaintext information. Then, the real plaintext information is copied to the field in the DAO, such as registerPhone, through the method realObjectWrapper.set(prop, realValue).

[0112] When reading encrypted data from a database, the relevant technology requires decryption code. If multiple encrypted data are involved, decryption code needs to be written for each data item. Similarly, plaintext data input by the user also requires multiple encryption code writes before being stored in the database. This results in a heavy workload for developers, low encryption / decryption efficiency, and poor maintainability.

[0113] According to embodiments of this disclosure, based on Spring's AOP annotation monitoring technology, MyBatis's TypeHandler type processing interface technology, and MyBatis's ObjectWrapperFactory technology, the source of key acquisition can be flexibly configured. If it is a public cloud key management service, the key can be obtained from the enterprise service program through a network request when the enterprise application service starts. By configuring a database field processing utility class, specific database fields can be automatically encrypted and decrypted. This can be done with a small amount of code configuration, eliminating the need to write a large amount of repetitive database field encryption and decryption processing logic, which greatly improves development efficiency.

[0114] The following will combine Figure 7 The access device for the database provided in this disclosure is described.

[0115] Figure 7 A block diagram of a database access apparatus according to an embodiment of the present disclosure is shown schematically.

[0116] like Figure 7 As shown, the database access device 700 includes a sending module 710, an acquisition module 720, an encryption module 730, and a writing module 740.

[0117] The sending module 710 is used to send a key encryption request to the key server, wherein the key encryption request includes a local key.

[0118] The acquisition module 720 is used to acquire the target key from the key server, wherein the target key is obtained by the key server encrypting the local key according to the key server key.

[0119] The encryption module 730 is used to respond to a received write request for the database by using a custom type converter corresponding to the database and encrypting the data to be written corresponding to the write request according to the key to obtain encrypted data. The custom type converter is obtained by injecting encryption logic code and decryption logic code into the default type converter.

[0120] The write module 740 is used to write encrypted data to the database.

[0121] According to embodiments of this disclosure, the above apparatus may further include a reading module for reading target encrypted data corresponding to the reading request in response to receiving a read request for the database; a decryption module for decrypting the target encrypted data according to a key using a custom type converter corresponding to the database to obtain the original data; and an assignment module for writing the original data into a data access object.

[0122] According to embodiments of this disclosure, a default type converter may include, for example, a parameter setting method and a result acquisition method. The apparatus may also include: a first registration module for registering an encryption / decryption processor in an application framework, wherein the encryption / decryption processor includes encryption logic code and decryption logic code; and a configuration module for configuring the parameter setting method in the default type converter to execute the encryption logic code and configuring the result acquisition method in the default type converter to execute the decryption logic code, thereby obtaining a custom type converter.

[0123] According to embodiments of this disclosure, the encryption module may include: a first calling submodule, configured to execute encryption logic code by calling a parameter setting method of a custom type converter, so as to encrypt the data to be written according to the key, thereby obtaining encrypted data.

[0124] According to embodiments of this disclosure, the decryption module may include: a second calling submodule, configured to execute decryption logic code by calling a result acquisition method of a custom type converter, so as to decrypt the target encrypted data according to the key and obtain the original data.

[0125] According to embodiments of this disclosure, the above apparatus may further include an annotation module for adding custom annotations to a data processing object; and a rewrite module for rewriting the reference method of a data processing object for which custom annotations have been added, so as to configure the object wrapper of the data processing object to call the result acquisition method of the custom type converter before writing the original data to the data processing object.

[0126] According to embodiments of this disclosure, the above apparatus may further include a second registration module for registering a custom type converter for the database in the persistence layer framework.

[0127] According to embodiments of this disclosure, the above-mentioned apparatus may further include an information acquisition module for acquiring a login account, password, cloud key identifier, and local key; an authentication module for performing authentication based on the login account and password to obtain authentication information; and a request generation module for generating a key encryption request based on the authentication information, cloud key identifier, and local key.

[0128] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0129] Figure 8 A block diagram schematically illustrates an example electronic device 800 that can be used to implement embodiments of the present disclosure. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0130] like Figure 8 As shown, device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of device 800. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0131] Multiple components in device 800 are connected to I / O interface 805, including: input unit 806, such as keyboard, mouse, etc.; output unit 807, such as various types of monitors, speakers, etc.; storage unit 808, such as disk, optical disk, etc.; and communication unit 809, such as network card, modem, wireless transceiver, etc. Communication unit 809 allows device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0132] The computing unit 801 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as database access methods. For example, in some embodiments, the database access methods may be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the database access methods described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform database access methods by any other suitable means (e.g., by means of firmware).

[0133] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0134] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0135] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0136] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0137] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0138] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

[0139] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0140] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.< / t>

Claims

1. A database access method, comprising: Send a key encryption request to the key server, wherein the key encryption request includes a local key; Obtain a target key from the key server, wherein the target key is obtained by the key server encrypting the local key based on the key server key; In response to receiving a write request for a database, a custom type converter corresponding to the database is used to encrypt the data to be written corresponding to the write request according to the target key, resulting in encrypted data. The custom type converter is obtained by injecting encryption and decryption logic code into a default type converter. Write the encrypted data into the database; The method further includes: in response to receiving a read request for the database, reading target encrypted data corresponding to the read request from the database; using a custom type converter corresponding to the database, decrypting the target encrypted data according to the target key to obtain the original data; and writing the original data into a data access object; The method further includes: obtaining a login account, password, cloud key identifier, and local key; performing authentication based on the login account and password to obtain authentication information; and generating the key encryption request based on the authentication information, the cloud key identifier, and the local key. The method further includes: adding custom annotations to the data processing object; and for the data processing object with added custom annotations, rewriting the reference method of the data processing object so that the object wrapper of the data processing object is configured to call the result acquisition method of the custom type converter and execute the decryption logic code before writing the original data into the data processing object.

2. The method according to claim 1, wherein, The default type converter includes a parameter setting method and a result acquisition method, the method further including: Register an encryption / decryption processor in the application framework, wherein the encryption / decryption processor includes encryption logic code and decryption logic code; and Configure the parameter setting method in the default type converter to execute the encryption logic code, and configure the result acquisition method in the default type converter to execute the decryption logic code, to obtain the custom type converter.

3. The method according to claim 2, wherein, The step of using a custom type converter corresponding to the database to encrypt the data to be written corresponding to the write request according to the target key to obtain encrypted data includes: The encryption logic code is executed by calling the parameter setting method of the custom type converter to encrypt the data to be written according to the target key, thereby obtaining the encrypted data.

4. The method according to claim 2, wherein, The step of using a custom type converter corresponding to the database to decrypt the target encrypted data according to the target key to obtain the original data includes: The decryption logic code is executed by calling the result acquisition method of the custom type converter, so as to decrypt the target encrypted data according to the target key and obtain the original data.

5. The method according to claim 1, further comprising: Register the custom type converter for the database in the persistence layer framework.

6. A database access device, comprising: A sending module is used to send a key encryption request to a key server, wherein the key encryption request includes a local key; The acquisition module is used to acquire a target key from the key server, wherein the target key is obtained by the key server encrypting the local key according to the key server key; An encryption module, in response to receiving a write request for a database, encrypts the data to be written corresponding to the write request using a custom type converter corresponding to the database and according to the target key, to obtain encrypted data. The custom type converter is obtained by injecting encryption and decryption logic code into a default type converter. A writing module is used to write the encrypted data into the database; A reading module is used to read target encrypted data corresponding to the reading request in the database in response to receiving a read request for the database; a decryption module is used to decrypt the target encrypted data according to the target key using a custom type converter corresponding to the database to obtain the original data; and an assignment module is used to write the original data into a data access object. The information acquisition module is used to acquire the login account, password, cloud key identifier, and local key; the authentication module is used to perform authentication based on the login account and password to obtain authentication information; and the request generation module is used to generate the key encryption request based on the authentication information, the cloud key identifier, and the local key. The annotation module is used to add custom annotations to data processing objects; The rewrite module is used to rewrite the reference method of a data processing object that has been annotated with a custom annotation, so that the object wrapper of the data processing object is configured to call the result acquisition method of the custom type converter and execute the decryption logic code before writing the original data to the data processing object.

7. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

8. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1-5.

Images