A data query method and device

Abstract

The application discloses a data query method and device, the method is executed by a data query server, and the method comprises the following steps: receiving a data query request of a business system through a preset interception interface, wherein the data query request carries table information of a target data table; determining whether sensitive information is contained in the target data table according to the table information of the target data table; in the case that the sensitive information is contained in the target data table, determining a request parameter type of the data query request; and performing encryption processing on the data query request according to the request parameter type of the data query request, so as to perform data query according to the data query request after the encryption processing, and obtain a data query result. The application intercepts the data query request through the preset interception interface and performs the encryption processing, so that the encryption processing logic is not required to be realized on the business side, the invasion degree on the business code and the development cost of the business system are reduced, and the query requirements in different query scenes are met.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data query method and apparatus. Background Technology

[0002] In the financial sector, various systems currently employ a common process of encrypting and decrypting sensitive information in data tables, such as transaction and user information, to ensure the security of data storage and retrieval.

[0003] When a business system needs to query other information related to sensitive information, it needs to encrypt the sensitive fields in the query conditions before querying.

[0004] However, the encryption processing logic mentioned above is usually written in the business code layer, which requires the front-end business system to modify the business code in order to implement it, resulting in high development costs for the business system. Summary of the Invention

[0005] This application provides a data query method and apparatus to reduce the development cost of business systems.

[0006] The embodiments of this application adopt the following technical solutions:

[0007] In a first aspect, embodiments of this application provide a data query method, executed by a data query server, wherein the method includes:

[0008] The system receives data query requests from business systems through a preset interception interface, wherein the data query requests carry table information of the target data table.

[0009] Based on the table information of the target data table, determine whether the target data table contains sensitive information;

[0010] If the target data table contains sensitive information, determine the request parameter type of the data query request;

[0011] Based on the request parameter type of the data query request, the data query request is encrypted, and the data query is performed based on the encrypted data query request to obtain the data query result.

[0012] Optionally, determining whether the target data table contains sensitive information based on the table information of the target data table includes:

[0013] Obtain the sensitive information configuration table, wherein the sensitive information configuration table stores table information of multiple data tables and sensitive field information of the data tables;

[0014] Match the table information of the target data table with the sensitive information configuration table;

[0015] If a match is successful, it is determined that the target data table contains sensitive information;

[0016] If a match fails, it is determined that the target data table does not contain sensitive information, and the data query request is directly passed to the data query interface for data query.

[0017] Optionally, after determining the request parameter type of the data query request, the method further includes:

[0018] Determine whether the request parameter type of the data query request is the target parameter type;

[0019] If the request parameter type of the data query request is a target parameter type, the data query request is encrypted according to the target parameter type.

[0020] If the request parameter type of the data query request is not the target parameter type, the data query request is directly passed to the data query interface so that the data query can be performed through the data query interface.

[0021] Optionally, encrypting the data query request according to the request parameter type of the data query request includes:

[0022] Based on the request parameter type of the data query request, determine whether the request parameters contain sensitive information;

[0023] If the request parameters contain sensitive information, the sensitive information contained in the request parameters shall be encrypted.

[0024] Optionally, the request parameter type is a single String, the data query request includes query conditions corresponding to the single String, and the encryption process for the data query request based on the request parameter type includes:

[0025] Determine the field attribute identifier in the query condition corresponding to a single String;

[0026] Match the field attribute identifier with the sensitive information in the target data table;

[0027] If a match is found, the single String string will be encrypted.

[0028] Optionally, the request parameter type is a List collection consisting of multiple String strings, the data query request includes query conditions corresponding to the List collection, and the encryption process for the data query request based on the request parameter type includes:

[0029] Determine the field attribute identifiers in the query conditions corresponding to the List collection;

[0030] Match the field attribute identifiers with the sensitive information in the target data table;

[0031] If a match is found, the multiple String strings in the List collection will be encrypted sequentially.

[0032] Optionally, the request parameter type is a HashMap collection, and the encryption process for the data query request based on the request parameter type includes:

[0033] Iterate through the keys in the HashMap collection;

[0034] Match the key with the sensitive information in the target data table;

[0035] If a match is successful, the value corresponding to the key will be encrypted.

[0036] Optionally, the request parameter type is a specified query object, which includes a persistent layer object and / or a custom object. The step of encrypting the data query request according to the request parameter type includes:

[0037] Iterate through the field attribute identifiers in the specified query object and its parent class;

[0038] Match the field attribute identifier with the sensitive information in the target data table;

[0039] If a match is successful, the field value corresponding to the field attribute identifier will be encrypted.

[0040] Optionally, encrypting the data query request according to the request parameter type of the data query request includes:

[0041] Determine the data encryption strategy of the database containing the target data table;

[0042] The data query request is encrypted according to the data encryption strategy and the request parameter type of the data query request.

[0043] Secondly, embodiments of this application also provide a data query device applied to a data query server, wherein the device is used to implement any of the methods described above.

[0044] Thirdly, embodiments of this application also provide an electronic device, including:

[0045] Processor; and

[0046] A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform any of the methods described above.

[0047] Fourthly, embodiments of this application also provide a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform any of the methods described above.

[0048] The above-mentioned at least one technical solution adopted in the embodiments of this application can achieve the following beneficial effects: The data query method of the embodiments of this application is executed by a data query server. When performing a data query, it first receives a data query request from the business system through a preset interception interface, wherein the data query request carries table information of the target data table; then, based on the table information of the target data table, it is determined whether the target data table contains sensitive information; then, if the target data table contains sensitive information, the request parameter type of the data query request is determined; finally, based on the request parameter type of the data query request, the data query request is encrypted, and the data query is performed based on the encrypted data query request to obtain the data query result. The data query method of the embodiments of this application uses a preset interception interface to intercept the data query request initiated by the business system, and then performs encryption processing on the data query request. It does not require implementing encryption processing logic at the business code layer, reducing the intrusion into the business code and the development cost of the business system. In addition, the embodiments of this application perform different encryption processing for different types of query requests, meeting the query needs under different query scenarios. Attached Figure Description

[0049] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0050] Figure 1 This is a flowchart illustrating a data query method according to an embodiment of this application;

[0051] Figure 2 This is a schematic diagram of a data query process in an embodiment of this application;

[0052] Figure 3 This is a schematic diagram of the structure of a data query device according to an embodiment of this application;

[0053] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0056] The data query in this application can be based on sensitive fields in some data tables to retrieve other related information. For example, a business system can query which user owns a certain mobile phone number, in which case the mobile phone number can be considered a sensitive field. To ensure the security of data storage and retrieval, databases generally store encrypted versions of sensitive fields such as mobile phone numbers. Therefore, when a business system sends a query request containing a mobile phone number to the database, it needs to encrypt the mobile phone number carried in the query request using the same logic as the encrypted version of the mobile phone number stored in the database. Only in this way can the encrypted version of the mobile phone number be successfully matched with other user information corresponding to that mobile phone number in the database.

[0057] Currently, the encryption of sensitive information is often handled by the business system. This involves modifying the original business code so that when data queries are needed, the sensitive information is encrypted using the business system's built-in encryption logic. This encrypted information is then used as the query condition to be sent to the data storage layer, such as the Dao (Data Access Object) layer, for data retrieval. Alternatively, annotations can be added to objects of the entity class that are the query conditions in the Dao layer to create aspects, which are then handled uniformly using AOP (Aspect-Oriented Programming).

[0058] However, the above approach has at least the following problems:

[0059] 1) The encryption processing logic is highly coupled with the business code, resulting in a high degree of intrusion into the business code;

[0060] 2) The query conditions that can be processed uniformly are relatively simple and must conform to the entity annotation specification in order to be processed;

[0061] 3) The business system needs to check all query conditions and modify them before it can be connected, which results in high development costs.

[0062] Based on this, embodiments of this application provide a data query method, executed by a data query server, such as... Figure 1 The diagram shows a flowchart of a data query method according to an embodiment of this application. The method includes at least the following steps S110 to S140:

[0063] Step S110: Receive a data query request from the business system through a preset interception interface, wherein the data query request carries table information of the target data table.

[0064] Data querying involves information interaction between a business system and a data query service. The data query method in this embodiment can be executed by a data query server that provides the data query service. When performing a data query, an interceptor can be set up in the data query server. The entire processing flow in this embodiment can be implemented by this interceptor. The interceptor defines a preset interception interface for intercepting data query requests initiated by the business system. The preset interception interface can be implemented using the Interceptor interface provided by Mybatis. Of course, those skilled in the art can flexibly adopt other forms of interceptors according to actual needs, and no specific limitations are made here.

[0065] The aforementioned preset interception interface can receive data query requests from business systems. These requests will carry table information of the target data tables that the business system wants to query, such as information from user table A or transaction table B.

[0066] Based on the above interceptor, the business system can directly initiate data query requests in plaintext, eliminating the need for the business system to encrypt the data query requests, reducing the coupling between the encryption processing logic and the business code, and reducing the investment cost of the business system.

[0067] Step S120: Determine whether the target data table contains sensitive information based on the table information of the target data table.

[0068] After receiving a data query request, it is necessary to determine whether the data table that the business system wants to query contains sensitive information based on the table information of the target data table in the data query request. For example, the user table may contain user information such as username, user's mobile phone number and user's ID card number. Based on the actual business scenario, the mobile phone number and ID card number can be regarded as sensitive information in the user table.

[0069] Of course, some data tables may only contain non-sensitive information. If the target data table you want to query only contains non-sensitive information, then obviously there is no need for subsequent encryption processing, and you can query directly. Therefore, it is necessary to first determine whether the target data table to be queried contains sensitive information.

[0070] Step S130: If the target data table contains sensitive information, determine the request parameter type of the data query request.

[0071] If it is determined that the target data table to be queried contains sensitive information, then it is necessary to further determine the type of request parameters for the data query. The request parameters can be expressed in the form of query conditions, that is, what information to query based on what information, such as querying the username and ID number corresponding to the mobile phone number, etc.

[0072] In different query scenarios, the types of request parameters are different, which in turn leads to different forms of query conditions. Therefore, it is necessary to distinguish between different types of request parameters so that data query requests can be encrypted for different types of request parameters in order to cover as many query scenarios as possible.

[0073] Step S140: According to the request parameter type of the data query request, the data query request is encrypted, so as to perform data query based on the encrypted data query request and obtain the data query result.

[0074] After determining the request parameter type, different encryption processes can be applied to the data query request based on the different types of request parameters to obtain the encrypted data query request. Finally, the encrypted data query request is used to perform the data query, thereby obtaining the data query result.

[0075] The data query method in this application intercepts data query requests initiated by the business system using a preset interception interface, and then encrypts the data query requests. This eliminates the need to implement encryption logic at the business code level, reducing the intrusion into the business code and the development cost of the business system. Furthermore, this application embodiment employs different encryption methods for different types of query requests, meeting the query needs of various query scenarios.

[0076] In one embodiment of this application, determining whether the target data table contains sensitive information based on the table information of the target data table includes: obtaining a sensitive information configuration table, wherein the sensitive information configuration table stores table information of multiple data tables and sensitive field information in the data tables; matching the table information of the target data table with the sensitive information configuration table; if the match is successful, determining that the target data table contains sensitive information; if the match fails, determining that the target data table does not contain sensitive information.

[0077] In this embodiment of the application, when determining whether a target data table contains sensitive information, a sensitive information configuration table can be loaded first. This sensitive information configuration table stores table information of multiple data tables and sensitive information in these data tables, such as the table name of the data table, such as user table A, and sensitive fields in user table A, such as mobile phone number, ID card number, etc.

[0078] After obtaining the sensitive information configuration table, the table information of the target data table can be searched and matched against the sensitive information configuration table. If the table information of the target data table can be matched against the sensitive information configuration table, the match is successful, indicating that the target data table contains sensitive information. If the table information of the target data table cannot be matched against the sensitive information configuration table, the match fails, indicating that the target data table does not contain sensitive information.

[0079] This application embodiment utilizes the table information of the target data table carried in the data query request to achieve a preliminary judgment on whether the data query request needs to be encrypted without parsing the data query request, thus saving computing resources and improving data query efficiency.

[0080] If the initial assessment determines that encryption is necessary, the sensitive information of the target data table can be further filtered from the sensitive configuration information based on the table information of the target data table. This serves as the basis for further determining whether the data query request needs to be encrypted, greatly narrowing the comparison range and further improving the data query efficiency.

[0081] In one embodiment of this application, after determining that the target data table does not contain the sensitive information, the method further includes: directly passing the data query request to the data query interface so as to perform data query through the data query interface.

[0082] Based on the above embodiments, if the target data table that the business system wants to query does not involve sensitive information, then obviously there is no need to encrypt the data query request. Therefore, the data query request can be directly passed to the subsequent data query interface, so as to realize the data query and obtain the data query result through the data query interface.

[0083] In one embodiment of this application, after determining the request parameter type of the data query request, the method further includes: determining whether the request parameter type of the data query request is a target parameter type; if the request parameter type of the data query request is a target parameter type, encrypting the data query request according to the target parameter type; if the request parameter type of the data query request is not a target parameter type, directly transmitting the data query request to a data query interface for data query through the data query interface.

[0084] In determining the type of request parameters, this embodiment first parses the data query request to obtain the request parameter type, and then determines whether the request parameter type is the target parameter type. Here, the target parameter type can be understood as the request parameter type that needs to be encrypted in the data query request. Because in actual query scenarios, not all types of request parameters need to be or can be encrypted, this embodiment first determines whether the parsed request parameter type needs to be or can be encrypted. If it is, then the data query request is encrypted; if not, then the data query request is allowed to proceed directly.

[0085] In one embodiment of this application, encrypting the data query request according to the request parameter type of the data query request includes: determining whether the request parameters contain sensitive information according to the request parameter type of the data query request; and encrypting the sensitive information contained in the request parameters if the request parameters contain sensitive information.

[0086] Based on the aforementioned embodiments, if the target data table that the business system wants to query contains sensitive information, it only indicates that the parameter information transmitted in the data query request may be information that needs to be encrypted, but it does not necessarily mean that encryption is required.

[0087] For example, suppose a business system wants to query the mobile phone number corresponding to username x1 in user table A. First, it's certain that user table A, as the target data table, contains sensitive information such as mobile phone numbers and ID card numbers. Therefore, when querying relevant information in user table A, it might be necessary to encrypt the data query request. However, further judgment is needed. Since the query condition initiated by the business system is to find the mobile phone number corresponding to username x1, and username x1 in the query condition is non-sensitive information, it's clear that encrypting the non-sensitive information, username x1, in the query condition is unnecessary for the data query request.

[0088] Based on this, the embodiments of this application can further determine whether the request parameters in the data query request contain sensitive information. Here, it mainly refers to whether the query conditions targeted by the request parameters contain sensitive information. Since different types of request parameters have different specific manifestations, the corresponding judgment strategy can be adopted according to the request parameter type determined in the aforementioned embodiments to determine whether the request parameters contain sensitive information. If they contain sensitive information, the sensitive information in the request parameters can be encrypted. If they do not contain sensitive information, the data query request can be directly allowed.

[0089] In one embodiment of this application, the request parameter type is a single String, the data query request includes query conditions corresponding to the single String, and the step of encrypting the data query request according to the request parameter type includes: determining the field attribute identifier in the query conditions corresponding to the single String; matching the field attribute identifier with sensitive information in the target data table; and encrypting the single String if the match is successful.

[0090] The request parameter type in this application embodiment can be a single String type, that is, there is one and only one String in the request parameter. For example, if the request parameter is to query the username based on the mobile phone number xxx, then the mobile phone number xxx can be regarded as a single String.

[0091] For a single String request parameter, when performing encryption, you can first determine the field attribute identifier, such as the field name, that corresponds to the String in the query conditions. Then, match this field name with sensitive information, such as sensitive field names, in the target data table. If it can be found in the sensitive information of the target data table, it means that the field corresponding to the single String in the request parameter is a sensitive field and needs to be encrypted. Therefore, you can encrypt the single String, such as a mobile phone number xxx, or you can directly encrypt the request parameter, since the request parameter only contains a single String.

[0092] In one embodiment of this application, the request parameter type is a List collection consisting of multiple String strings, and the data query request includes query conditions corresponding to the List collection. The step of encrypting the data query request according to the request parameter type of the data query request includes: determining the field attribute identifier in the query conditions corresponding to the List collection; matching the field attribute identifier with sensitive information in the target data table; and, if the match is successful, encrypting the multiple String strings in the List collection sequentially.

[0093] The request parameter type in this application embodiment can also be a List collection composed of multiple String strings. That is, the request parameters contain multiple String strings. For example, if the request parameter is to query the username based on mobile phone number xxx, mobile phone number yyy, mobile phone number zzz, etc., then mobile phone number xxx, mobile phone number yyy, and mobile phone number zzz can each be regarded as a String string, thus forming a List. <string>gather.

[0094] For request parameters of type List collection, when performing encryption, the field attribute identifiers in the query conditions of the List collection can be determined first. Specifically, one List collection corresponds to one query condition, and since a List collection includes multiple String strings, the field attribute identifiers in the query conditions corresponding to the List collection are usually named in the form of "field name + s".

[0095] After identifying the field attribute identifiers in the query conditions of the List collection, these identifiers can be matched with sensitive information in the target data table. Specifically, this involves determining whether the field attribute identifiers in the query conditions of the List collection are in the form of "sensitive field name + s". If so, it means that the request parameters of the List collection type contain sensitive information. In this case, multiple String strings in the List collection can be encrypted sequentially.

[0096] In one embodiment of this application, the request parameter type is a HashMap collection, and the step of encrypting the data query request according to the request parameter type of the data query request includes: traversing the keys in the HashMap collection; matching the keys with sensitive information in the target data table; and encrypting the value corresponding to the key if the match is successful.

[0097] The request parameter type in this application embodiment can also be in the form of a HashMap collection. The Map collection class is used to store element pairs (called "keys" and "values"), where each key maps to a value. HashMap is one of the most commonly used Map collections. It stores data based on the hashCode value of the key, and its value can be directly obtained based on the key, which has a very fast access speed.

[0098] For request parameters of HashMap collection type, when performing encryption processing, you can first traverse all the keys in the HashMap collection, and then match each key with sensitive information such as sensitive field names in the target data table. If the key can be found in the sensitive information of the target data table, it means that the value corresponding to the key is sensitive information. At this time, you can directly encrypt the value corresponding to the key.

[0099] It should be noted that List <string>Both List and HashMap can be viewed as collections consisting of multiple elements. The main difference between them is that List... <string>This is mainly for String type elements, which are of a single type, such as multiple phone numbers in the example above. HashMap stores elements in the form of key=value, and does not require the elements to be of completely consistent type. For example, it can include elements of different types such as phone numbers and usernames.

[0100] This results in the following for List <string>In general, its collection either contains sensitive information or does not contain sensitive information, therefore it can only exist in the entire List. <string>In a typical scenario, all elements in a collection may be encrypted or none may be encrypted. However, in a HashMap, some keys may be sensitive fields while others may be non-sensitive fields. Therefore, it is possible to encrypt only the values ​​corresponding to some sensitive keys.

[0101] In one embodiment of this application, the request parameter type is a specified query object, which includes a persistent layer object and / or a custom object. The step of encrypting the data query request according to the request parameter type includes: traversing the field attribute identifiers in the specified query object and its parent class; matching the field attribute identifiers with sensitive information in the target data table; and encrypting the field value corresponding to the field attribute identifier if a match is successful.

[0102] The request parameter type in this application embodiment can also be some specified query objects, such as persistent layer objects or custom objects. For these types of specified query objects, during encryption processing, the field attribute identifiers, such as field names, in the persistent layer objects or custom objects, as well as the field attribute identifiers in the parent classes of these objects (excluding Object objects), can be traversed first. Then, these field attribute identifiers are matched with sensitive information, such as sensitive field names, in the target data table. If the field attribute identifier can be matched in the sensitive information of the target data table, it means that the field corresponding to the field attribute identifier is a sensitive field, and therefore the field value corresponding to the field can be encrypted.

[0103] It should be noted that the sensitive information in the target data table in the above embodiments can be directly filtered out from the sensitive configuration information table, or it can be directly matched in the sensitive configuration information table.

[0104] In one embodiment of this application, encrypting the data query request according to the request parameter type of the data query request includes: determining the data encryption strategy of the database where the target data table is located; and encrypting the data query request according to the data encryption strategy and the request parameter type of the data query request.

[0105] As mentioned above, databases typically store sensitive information in encrypted form, meaning the data stores the encrypted form of the sensitive information. Therefore, in this application embodiment, when encrypting sensitive information in a data query request, the same encryption algorithm as the database can be used to encrypt the sensitive information. This ensures that the final encrypted ciphertext form is consistent for the same sensitive information, thereby enabling successful querying of other related information corresponding to the encrypted sensitive information in the database.

[0106] For ease of understanding of the various embodiments of this application, such as Figure 2 The diagram illustrates a data query process according to an embodiment of this application. First, the business system initiates a data query request. The interceptor in the data query server intercepts the data query request. Then, it loads a sensitive information configuration table into the local cache and matches the table information of the target data table carried in the data query request against the sensitive information configuration table to determine whether the target data table contains sensitive information. If the target data table contains sensitive information, the request parameter type in the data query request is further determined.

[0107] If the request parameter type is a single String, then the field attribute identifier in the query condition corresponding to the single String is determined, and then the field attribute identifier is matched with the sensitive information in the target data table. If the match is successful, the single String is encrypted.

[0108] If the request parameter type is a List collection, then determine the field attribute identifier in the query conditions corresponding to the List collection, and then match the field attribute identifier with the sensitive information in the target data table. If the match is successful, then encrypt the multiple String strings in the List collection in turn.

[0109] If the request parameter type is a HashMap collection, then the keys in the HashMap collection are traversed, and the keys are matched with the sensitive information in the target data table. Finally, the value corresponding to the successfully matched key is encrypted.

[0110] If the request parameter type is in the form of other specified query objects, such as persistent layer objects or custom objects, first iterate through the field attribute identifiers in the persistent layer objects or custom objects, as well as the field attribute identifiers in the parent classes of these objects (excluding Object objects). Then, match the field attribute identifiers with the sensitive information in the target data table. Finally, encrypt the field values ​​corresponding to the successfully matched field attribute identifiers.

[0111] After encrypting the data query request, the encrypted data query request is passed to the data query interface to perform the data query and obtain the data query result.

[0112] In summary, the data query method of this application has achieved at least the following technical effects:

[0113] 1) By implementing pre-processing functionality for general query conditions through custom interceptors, the workload of business-side code modification for querying using plaintext sensitive fields is reduced;

[0114] 2) Reduced the coupling between encryption processing logic and business code;

[0115] 3) It covers the query needs of most query scenarios.

[0116] This application embodiment also provides a data query device 300, applied to a data query server, such as... Figure 3 The diagram shows a data query device according to an embodiment of this application. The device 300 includes: a receiving unit 310, a first determining unit 320, a second determining unit 330, and a first encryption unit 340, wherein:

[0117] The receiving unit 310 is used to receive a data query request from the business system through a preset interception interface, wherein the data query request carries table information of the target data table.

[0118] The first determining unit 320 is used to determine whether the target data table contains sensitive information based on the table information of the target data table;

[0119] The second determining unit 330 is used to determine the request parameter type of the data query request when the target data table contains sensitive information.

[0120] The first encryption unit 340 is used to encrypt the data query request according to the request parameter type of the data query request, so as to perform data query based on the encrypted data query request and obtain the data query result.

[0121] In one embodiment of this application, the first determining unit 320 is specifically configured to: obtain a sensitive information configuration table, wherein the sensitive information configuration table stores table information of multiple data tables and sensitive field information in the data tables; match the table information of the target data table with the sensitive information configuration table; if the match is successful, determine that the target data table contains sensitive information; if the match fails, determine that the target data table does not contain sensitive information, and directly pass the data query request to the data query interface for data query through the data query interface.

[0122] In one embodiment of this application, the apparatus further includes: a third determining unit, configured to determine whether the request parameter type of the data query request is a target parameter type; a second encryption unit, configured to encrypt the data query request according to the target parameter type when the request parameter type of the data query request is a target parameter type; and a second input unit, configured to directly input the data query request into a data query interface when the request parameter type of the data query request is not a target parameter type, so as to perform data query through the data query interface.

[0123] In one embodiment of this application, the first encryption unit 340 is specifically used to: determine whether the request parameters contain sensitive information according to the request parameter type of the data query request; and, if the request parameters contain sensitive information, encrypt the sensitive information contained in the request parameters.

[0124] In one embodiment of this application, the request parameter type is a single String, and the data query request includes query conditions corresponding to the single String. The first encryption unit 340 is specifically used to: determine the field attribute identifier in the query conditions corresponding to the single String; match the field attribute identifier with sensitive information in the target data table; and encrypt the single String if the match is successful.

[0125] In one embodiment of this application, the request parameter type is a List collection consisting of multiple String strings, and the data query request includes query conditions corresponding to the List collection. The first encryption unit 340 is specifically used to include: determining the field attribute identifier in the query conditions corresponding to the List collection; matching the field attribute identifier with sensitive information in the target data table; and, if the match is successful, encrypting the multiple String strings in the List collection sequentially.

[0126] In one embodiment of this application, the request parameter type is a HashMap collection, and the first encryption unit 340 is specifically used to: traverse the keys in the HashMap collection; match the keys with sensitive information in the target data table; and, if the match is successful, encrypt the value corresponding to the key.

[0127] In one embodiment of this application, the request parameter type is a specified query object, which includes a persistent layer object and / or a custom object. The first encryption unit 340 is specifically used to: traverse the field attribute identifiers in the specified query object and its parent class; match the field attribute identifiers with sensitive information in the target data table; and, if the match is successful, encrypt the field value corresponding to the field attribute identifier.

[0128] In one embodiment of this application, the first encryption unit 340 is specifically used to: determine the data encryption strategy of the database where the target data table is located; and encrypt the data query request according to the data encryption strategy and the request parameter type of the data query request.

[0129] It is understood that the above-mentioned data query device can implement each step of the data query method executed by the data query server provided in the foregoing embodiments. The relevant explanations of the data query method are applicable to the data query device and will not be repeated here.

[0130] Figure 4 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 4 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0131] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0132] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0133] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a data query mechanism at the logical level. The processor executes the program stored in memory and specifically performs the following operations:

[0134] The system receives data query requests from business systems through a preset interception interface, wherein the data query requests carry table information of the target data table.

[0135] Based on the table information of the target data table, determine whether the target data table contains sensitive information;

[0136] If the target data table contains sensitive information, determine the request parameter type of the data query request;

[0137] Based on the request parameter type of the data query request, the data query request is encrypted, and the data query is performed based on the encrypted data query request to obtain the data query result.

[0138] The above is as stated in this application. Figure 1 The data query device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0139] The electronic device can also perform Figure 1 The method executed by the data query device, and the implementation of the data query device in... Figure 1 The functions of the embodiments shown are not described again in this application.

[0140] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform... Figure 1 The method executed by the data query device in the illustrated embodiment is specifically used to perform:

[0141] The system receives data query requests from business systems through a preset interception interface, wherein the data query requests carry table information of the target data table.

[0142] Based on the table information of the target data table, determine whether the target data table contains sensitive information;

[0143] If the target data table contains sensitive information, determine the request parameter type of the data query request;

[0144] Based on the request parameter type of the data query request, the data query request is encrypted, and the data query is performed based on the encrypted data query request to obtain the data query result.

[0145] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0146] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0147] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0148] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0149] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0150] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0151] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0152] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0153] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0154] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.< / string> < / string> < / string> < / string> < / string>

Claims

1. A data query method, performed by a data query server, wherein, The method comprises: receiving a data query request of a business system through a preset interception interface, wherein the data query request carries table information of a target data table; determining whether the target data table contains sensitive information according to the table information of the target data table; in the case where the target data table contains sensitive information, determining a request parameter type of the data query request; according to the request parameter type of the data query request, performing encryption processing on the data query request to perform data query according to the data query request after encryption processing, and obtaining a data query result; the encryption processing on the data query request according to the request parameter type of the data query request comprises: determining whether the request parameter contains sensitive information according to the request parameter type of the data query request; in the case where the request parameter contains sensitive information, performing encryption processing on the sensitive information contained in the request parameter; the request parameter type is one of a single String string, a List set composed of multiple String strings, a HashMap set, and a specified query object; the determination of whether the target data table contains sensitive information according to the table information of the target data table comprises: obtaining a sensitive information configuration table, wherein the sensitive information configuration table stores table information of multiple data tables and sensitive field information in the data tables; matching the table information of the target data table with the sensitive information configuration table; in the case of successful matching, it is determined that the target data table contains sensitive information, and based on the table information of the target data table, the sensitive information in the target data table is filtered out from the sensitive information configuration table; in the case of failed matching, it is determined that the target data table does not contain sensitive information, and the data query request is directly transmitted to a data query interface to perform data query through the data query interface.

2. The method of claim 1, wherein, after determining the request parameter type of the data query request, the method further comprises: determining whether the request parameter type of the data query request is a target parameter type; in the case where the request parameter type of the data query request is the target parameter type, performing encryption processing on the data query request according to the target parameter type; in the case where the request parameter type of the data query request is a non-target parameter type, directly transmitting the data query request to a data query interface to perform data query through the data query interface.

3. The method of claim 1, wherein, the request parameter type is a single String string, the data query request includes a query condition corresponding to the single String string, and the encryption processing on the data query request according to the request parameter type of the data query request comprises: determining a field attribute identifier in the query condition corresponding to the single String string; matching the field attribute identifier with sensitive information in the target data table; in the case of successful matching, performing encryption processing on the single String string.

4. The method of claim 1, wherein, The request parameter type is a List set composed of multiple String strings, the data query request includes a query condition corresponding to the List set, and the encryption processing of the data query request according to the request parameter type of the data query request includes: Determining a field attribute identifier in the query condition corresponding to the List set; Matching the field attribute identifier with sensitive information in the target data table; In the case of successful matching, the multiple String strings in the List set are sequentially encrypted.

5. The method of claim 1, wherein, The request parameter type is a HashMap set, and the encryption processing of the data query request according to the request parameter type of the data query request includes: Traversing a key in the HashMap set; Matching the key with sensitive information in the target data table; In the case of successful matching, the value corresponding to the key is encrypted.

6. The method of claim 1, wherein, The request parameter type is a specified query object, the specified query object includes a persistence layer object and / or a custom object, and the encryption processing of the data query request according to the request parameter type of the data query request includes: Traversing a field attribute identifier in the specified query object and a parent class of the specified query object; Matching the field attribute identifier with sensitive information in the target data table; In the case of successful matching, the field value corresponding to the field attribute identifier is encrypted.

7. The method of claim 1, wherein, The encryption processing of the data query request according to the request parameter type of the data query request includes: Determining a data encryption policy of a database where the target data table is located; According to the data encryption policy and the request parameter type of the data query request, the data query request is encrypted.

8. A data query apparatus applied to a data query server, wherein, The apparatus includes: A receiving unit configured to receive a data query request of a business system through a preset interception interface, wherein the data query request carries table information of a target data table; A first determining unit configured to determine whether the target data table contains sensitive information according to the table information of the target data table; A second determining unit configured to determine a request parameter type of the data query request in the case that the target data table contains sensitive information; A first encryption unit configured to encrypt the data query request according to the request parameter type of the data query request, so as to perform data query according to the encrypted data query request and obtain a data query result; The first encryption unit is specifically configured to: Determine whether the request parameter contains sensitive information according to the request parameter type of the data query request; In the case that the request parameter contains sensitive information, encrypt the sensitive information contained in the request parameter; The request parameter type is one of a single String string, a List set composed of multiple String strings, a HashMap set, and a specified query object; The first determining unit is specifically configured to: Obtaining a sensitive information configuration table, wherein table information of a plurality of data tables and sensitive field information in the data tables are stored in the sensitive information configuration table; Matching the table information of the target data table with the sensitive information configuration table; In the case of successful matching, it is determined that the target data table contains sensitive information, and the sensitive information in the target data table is screened out from the sensitive information configuration table based on the table information of the target data table; In the case of failed matching, it is determined that the target data table does not contain sensitive information, and the data query request is directly transmitted to a data query interface for data query through the data query interface.

Images