Database migration methods, apparatus, devices, and media based on lattice cryptography algorithms

Abstract

This disclosure provides a database migration method and apparatus based on lattice cryptography for a target database, applicable to the field of information security technology. The method includes: generating a public key and a private key based on lattice cryptography, the public key including two parameters A and b, where A is an m×n random matrix and b is an m-dimensional vector calculated based on A and the private key s; sending the public key to the source database; receiving a temporary table sent by the source database, wherein the temporary table stores encrypted data, each encrypted data including a pair of data u and v, wherein the pair of data u and v is obtained by encrypting the plaintext data x to be migrated from the source database using the public key based on the lattice cryptography algorithm; and decrypting the plaintext data x from each encrypted data using the private key s. This disclosure also provides a database migration method and apparatus based on lattice cryptography for a source database, as well as an electronic device, storage medium, and program product.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and specifically to a database migration method, apparatus, device, medium, and program product based on lattice cryptography algorithm. Background Technology

[0002] Database migration refers to the process of transferring data from one storage system or computing environment to another. Security during the migration process is extremely important. If the migration is attacked by cyberattacks or the migrated data is intercepted, it could lead to data breaches and other security risks. For example, when migrating a database using the backup and restore method, backup files need to be transported to the target database via network or physical media. Network transmission may pose security risks, while transmission via physical media is costly and still carries the possibility of data loss. If the data migration is attacked, it could lead to migration failure, data breaches, and other significant security risks. Summary of the Invention

[0003] In view of the above problems, this disclosure provides database migration methods, apparatus, devices, media and program products based on lattice cryptography algorithms that can improve the security and reliability of data transmission during database migration.

[0004] According to the first aspect of this disclosure, a database migration method based on lattice cryptography is provided, which can be applied to a target database. The method includes: generating a public key and a private key based on lattice cryptography, wherein the public key includes two parameters A and b, where A is an m×n random matrix, b = As + e, e is an m-dimensional error vector, and s is the private key corresponding to the public key, where s is an n-dimensional random vector; sending the public key to the source database; receiving a temporary table sent by the source database, wherein the temporary table stores encrypted data, each encrypted data including a pair of data u and v, wherein the pair of data u and v is obtained by encrypting plaintext data x to be migrated from the source database using the public key based on the lattice cryptography algorithm; and decrypting the plaintext data x from each encrypted data using the private key s.

[0005] According to an embodiment of this disclosure, the step of decrypting plaintext data x from each encrypted data using the private key s includes: first calculating w = v - us during decryption, and then calculating plaintext data x = w mod q, where q is the modulus selected by the target database when generating the public key and the private key based on the lattice cryptography algorithm.

[0006] According to embodiments of this disclosure, the generation of public and private keys based on the lattice cryptography algorithm includes:

[0007] Obtain basic parameters, including modulus q, dimension n, error distribution χ, and random matrix A; and calculate the public key and the private key based on the lattice cryptography algorithm based on the basic parameters, where e is a vector extracted from the error distribution χ in b = As + e.

[0008] According to an embodiment of this disclosure, the method further includes: receiving a table name correspondence table, wherein the table name correspondence table stores the naming rule correspondence between the table names of temporary tables sent externally by the source database and the table names of source tables stored in the source database; obtaining the table name of the temporary table; creating a target table with the same table name as the source table according to the naming rule correspondence in the table name correspondence table; and outputting the decrypted plaintext data to the target table.

[0009] According to an embodiment of this disclosure, the temporary table also stores table structure conversion information. The table structure conversion information includes the data structure conversion relationship when outputting data in each field of the source table to the same field in the target table. Therefore, outputting the decrypted plaintext data to the target table further includes: converting the data structure of the plaintext data according to the field where the decrypted plaintext data is located and the data structure conversion relationship, and outputting the conversion result to the target table.

[0010] A second aspect of this disclosure provides a database migration method based on lattice cryptography, which can be applied to the source database. The method includes: receiving a public key published by a target database, the public key being generated based on a lattice cryptography algorithm and including two parameters A and b, where A is an m×n random matrix and b is an m-dimensional vector; creating a temporary table corresponding to a source table; encrypting plaintext data x to be migrated in the source table using the public key based on the lattice cryptography algorithm to obtain encrypted data corresponding to the plaintext data x, wherein the encrypted data includes pairs of data u and v, where u = Ar, v = br + x, and r is a random vector selected by the source database; outputting the encrypted data to the temporary table; and after encrypting all plaintext data to be migrated in the source table and outputting it to the temporary table, sending the temporary table to the target database; wherein the target database stores a private key s corresponding to the public key, where b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector; the target database can decrypt the encrypted data using the private key s based on the lattice cryptography algorithm to obtain the plaintext data.

[0011] According to an embodiment of this disclosure, creating a temporary table corresponding to the source table includes: obtaining the capacity of the storage space in the source database used to store the temporary table; and creating the temporary table when the capacity of the storage space used to store the temporary table meets the requirements.

[0012] According to an embodiment of this disclosure, the method further includes: creating a table name relationship mapping table, wherein the table name relationship mapping table stores the naming rule correspondence between the table name of the temporary table and the table name of the source table; and sending the table name relationship mapping table to the target database.

[0013] According to an embodiment of this disclosure, before sending the temporary table to the target database, the method further includes: generating table structure conversion information when the source database and the target database are of different types, the table structure conversion information including data structure conversion relationships when outputting data in each field of the source table to the same field in the target table; and storing the table structure conversion information to the temporary table.

[0014] A third aspect of this disclosure provides a database migration apparatus based on a lattice cryptography algorithm, disposed at a target database. The apparatus includes a key calculation module, a key distribution module, a data receiving initialization module, and a data decryption module. The key calculation module generates a public key and a private key based on the lattice cryptography algorithm. The public key includes two parameters, A and b, where A is an m×n random matrix, b = As + e, e is an m-dimensional error vector, and s is the private key corresponding to the public key, where s is an n-dimensional random vector. The key distribution module sends the public key generated based on the lattice cryptography algorithm to the source database. The data receiving initialization module receives a temporary table sent by the source database, wherein the temporary table stores encrypted data. Each encrypted data pair includes data u and v, wherein the data pairs u and v are obtained by encrypting plaintext data x to be migrated from the source database using the public key based on the lattice cryptography algorithm. The data decryption module decrypts the plaintext data x from each encrypted data pair using the private key s.

[0015] A fourth aspect of this disclosure provides a database migration method based on a lattice cryptography algorithm, set in a source database. The apparatus includes a temporary table creation module, an encryption result generation module, a ciphertext storage module, and a ciphertext sending module. The temporary table creation module creates a temporary table corresponding to the source table. The encryption result generation module receives a public key published by the target database, the public key being generated based on a lattice cryptography algorithm and including two parameters A and b, where A is an m×n random matrix and b is an m-dimensional random vector; and encrypts the plaintext data x to be migrated in the source table using the public key based on the lattice cryptography algorithm to obtain encrypted data corresponding to the plaintext data x, wherein the encrypted data includes pairs of data u and v, where u = Ar, v = br + x, and r is a random vector selected by the source database. The ciphertext storage module outputs the encrypted data to the temporary table. The encrypted data sending module is used to encrypt all plaintext data to be migrated from the source table and output it to the temporary table, and then send the temporary table to the target database. The target database stores a private key s corresponding to the public key, where b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector. The target database can decrypt the encrypted data using the private key s based on the lattice cryptography algorithm to obtain the plaintext data.

[0016] A fifth aspect of this disclosure provides an electronic device. The electronic device includes: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the described method.

[0017] A sixth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0018] A seventh aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0019] The above-described one or more embodiments have the following advantages or beneficial effects: The embodiments disclosed herein can apply lattice cryptography algorithms to encrypt data during data migration. Even if data is intercepted during network transmission, due to the difficulty of the LWE problem, it is very difficult for an attacker to recover the plaintext data x from the encrypted data (u, v) even if they know the public key (A, b). Furthermore, due to the homomorphism of the LWE problem, even if addition or scalar multiplication operations are performed on the encrypted data (u, v) during data transmission, it will not affect the decryption result, effectively improving data security, preventing data decryption, and preventing data theft during database migration. Attached Figure Description

[0020] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 The illustration schematically depicts the system architecture of a database migration method, apparatus, device, medium, and program product based on lattice cryptography algorithms according to embodiments of the present disclosure;

[0022] Figure 2 The flowchart illustrates a database migration method based on lattice cryptography applied to a source database according to an embodiment of this disclosure.

[0023] Figure 3 The flowchart illustrates a database migration method based on lattice cryptography applied to a target database according to an embodiment of this disclosure.

[0024] Figure 4 This illustration schematically shows a flowchart of the key generation module generating a key in the target database in one embodiment of the present disclosure;

[0025] Figure 5 The illustration shows a flowchart of the data encryption module encrypting the data to be migrated in the source database in one embodiment of the present disclosure.

[0026] Figure 6 The illustration shows a flowchart of the decryption and conversion module performing decryption and conversion on received encrypted data in the target database in one embodiment of the present disclosure.

[0027] Figure 7 A flowchart illustrating another embodiment of the database migration method based on lattice cryptography algorithm of this disclosure is shown schematically;

[0028] Figure 8 This schematically illustrates a structural block diagram of a database migration device based on lattice cryptography algorithm disposed in a source database according to an embodiment of the present disclosure;

[0029] Figure 9 This schematically illustrates a structural block diagram of a database migration apparatus based on a lattice cryptography algorithm, disposed on a target database, according to another embodiment of this disclosure; and

[0030] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a database migration method based on a lattice cryptography algorithm according to embodiments of the present disclosure. Detailed Implementation

[0031] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0032] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0034] The term "lattice-based cryptography" in this article refers to a lattice-based cryptographic algorithm, which is an asymmetric encryption algorithm constructed based on the lattice problem. It can encrypt and decrypt data and has homomorphism, that is, it can perform a certain degree of arithmetic operations on the ciphertext field without affecting the correctness of the operation results on the plaintext field.

[0035] Figure 1 The illustration schematically depicts the system architecture of a database migration method, apparatus, device, medium, and program product based on lattice cryptography algorithms according to embodiments of the present disclosure.

[0036] like Figure 1 As shown, the system architecture 100 may include a source database 001, a target database 002, and a data migration system 003.

[0037] The data migration system 003 may include a key generation module 1, a data encryption module 2, and a decryption and conversion module 3. The key generation module 1 and the decryption and conversion module 3 are located in the target database 002, while the data encryption module 2 is located in the source database 001.

[0038] The key generation module 1 can generate a public key and a private key according to the lattice cryptography algorithm and provide them to the target database 002. The administrator in the target database 002 keeps the private key and publishes the public key, for example, by sending the public key to the source database 001.

[0039] The key generation module 1 generates a public key with two parameters, A and b. Here, A is an m×n random matrix, b is an m-dimensional vector, b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector, where s is the private key corresponding to the public key (A, b).

[0040] After receiving the public key (A, b), data encryption module 2 encrypts the data to be migrated in source database 001. Source database 001 uses the public key to encrypt the data and stores the encrypted data in a temporary table. The encrypted data is homomorphic, meaning that arithmetic operations can be performed on the ciphertext domain without affecting the correctness of the results in the plaintext domain.

[0041] The decryption and conversion module 3 decrypts and converts the received data in the target database 002. Specifically, the target database 002 uses the private key s to decrypt the received encrypted data, adapts and converts the data format according to the structure and format of the target database 002, and stores the decrypted and converted data in the target database 002.

[0042] In this way, the embodiments disclosed herein can apply lattice cryptography algorithms for data encryption during data migration, thereby improving the security of data transmission. Furthermore, applying lattice cryptography algorithms for database data encryption is highly efficient, as they utilize efficient mathematical tools such as the Fast Fourier Transform for computation, improving the speed of encryption and decryption, thus ensuring both security and high efficiency during database migration.

[0043] Understandable. Figure 1 The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0044] It should be noted that the database migration method and apparatus based on lattice cryptography algorithm determined in the embodiments of this disclosure can be used in the financial field, or in any field other than the financial field. This disclosure does not limit the application field.

[0045] Figure 2 The flowchart illustrates a database migration method based on lattice cryptography applied to source database 001 according to an embodiment of this disclosure.

[0046] like Figure 2 As shown, according to an embodiment of this disclosure, the database migration method applied to the source database 001 may include operations S201 to S205. In system architecture 100, this method may be executed by the data encryption module 2.

[0047] First, in operation S201, the public key published by the target database is received. The public key is generated based on the lattice cryptography algorithm and includes two parameters, A and b, where A is an m×n random matrix and b is an m-dimensional random vector.

[0048] Then, in operation S202, a temporary table corresponding to the source table is created. The source table is the data table in the source database 001 that needs to be migrated. In one embodiment, before creating the temporary table, the capacity of the storage space in the source database 001 used to store the temporary table is obtained. When the capacity of the storage space used to store the temporary table meets the requirements, the temporary table is then created.

[0049] Next, in operation S203, the plaintext data x to be migrated in the source table is encrypted using the public key based on the lattice cryptography algorithm to obtain the encrypted data corresponding to the plaintext data x. The encrypted data includes pairs of data u and v, where u = Ar, v = br + x, and r is a random vector selected by the source database.

[0050] Then, in operation S204, encrypted data is output to a temporary table. In one embodiment, when the source database 001 and the target database 002 are of different types, table structure conversion information can also be generated and stored in a temporary table. The table structure conversion information includes the data structure conversion relationship when data in each field of the source table is output to the same field in the target table.

[0051] Following operation S205, after encrypting all plaintext data to be migrated from the source table and outputting it to a temporary table, the temporary table is sent to the target database 002. The target database 002 stores a private key s corresponding to the public key, where b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector. The target database can decrypt the encrypted data using the private key s based on a lattice cryptography algorithm to obtain the plaintext data. In one embodiment, after decrypting the plaintext data, the structure or format of the plaintext data can be transformed according to the data structure transformation relationship stored in the temporary table before outputting it.

[0052] In some embodiments, after a temporary table is created in the source database 001, it can be named according to certain naming rules. The names of the temporary table and the corresponding source table can be mapped using these naming rules, and this mapping can be recorded in a table name mapping table. Thus, when the temporary table is sent to the target database 002 in operation S205, the table name mapping table can also be sent to the target database 002, allowing the target database 002 to set the name of the target table used for outputting plaintext data to be consistent with the name of the source table.

[0053] Figure 3The flowchart illustrates a database migration method based on lattice cryptography applied to target database 002 according to an embodiment of this disclosure.

[0054] like Figure 3 As shown, according to this embodiment, the database migration method applied to the target database 002 may include operations S301 to S304. In system architecture 100, this method can be executed by the key generation module 1 and the decryption conversion module 3.

[0055] First, in operation S301, a public key and a private key are generated based on the lattice cryptography algorithm. The public key includes two parameters, A and b, where A is an m×n random matrix, b = As + e, e is an m-dimensional error vector, and s is the private key corresponding to the public key, where s is an n-dimensional random vector.

[0056] Next, in operation S302, the public key (A, b) is sent to the source database.

[0057] Operations S301 and S302 described above can be performed by the key generation module 1. Operations S303 and S304 described below can be performed by the decryption and conversion module 3.

[0058] Specifically, in operation S303, a temporary table sent by the source database 001 is received. The temporary table stores encrypted data, and each encrypted data includes a pair of data u and v. The pair of data u and v is obtained by encrypting the plaintext data x to be migrated from the source database using a public key based on a lattice cryptography algorithm.

[0059] Next, in operation S304, the plaintext data x is decrypted from each encrypted data using the private key s. During decryption, w = v - us is first calculated, and then x = w mod q is calculated to obtain the plaintext data, where q is the modulus selected by the target database when generating the public and private keys based on the lattice cryptography algorithm.

[0060] In one embodiment, when the temporary table stores the table structure transformation information, after obtaining the plaintext data, the data structure transformation relationship can be queried from the table structure transformation relationship according to the field where the plaintext data is located, the data structure of the plaintext data can be transformed, and the transformation result can be output to the target table.

[0061] In one embodiment, if, in addition to the temporary table, a table name mapping table is also received, where the table name mapping table stores the naming rules between the temporary table names sent out by the source database and the source table names stored in the source database, then the name of the target table used to output plaintext data can be set according to this naming rule mapping, so that the target table can be named consistent with the source table in source database 001, achieving a seamless transition between the application and the database.

[0062] Figure 4 The illustration shows a flowchart of the key generation module 1 generating a key in the target database 002 in one embodiment of the present disclosure.

[0063] like Figure 4 As shown, according to this embodiment, the key generation module 1 may include a parameter generation module 11, a key calculation module 12, and a key distribution module 13.

[0064] Before performing database data migration, the parameter generation module 11 generates the following parameters: a modulus q, a dimension n, an error distribution χ, and a random matrix A∈Z^(m×n), where Z represents an integer. These parameters will then be passed to the key calculation module 12 to calculate the public and private keys.

[0065] Next, the key calculation module 12 calculates the public and private keys. The public and private keys are based on an asymmetric encryption algorithm constructed using lattice-based cryptography problems (such as the Learning With Errors (LWE) problem). Specifically, the key calculation module 12 receives the modulus q, dimension n, error distribution χ, and random matrix A generated by the parameter generation module 11. Then, the key calculation module 12 selects a random vector s ∈ Z^n and calculates b = As + e, where e ∈ χ^m is an error vector, and correspondingly b ∈ Z^m. After obtaining A, b, and s, the key calculation module 12 passes these three parameters to the key distribution module 13.

[0066] After the public and private keys are generated, the key distribution module 13 will notify the authenticated administrator to distribute (A, b) as the public key and store s as the private key.

[0067] Figure 5 The illustration shows a flowchart of the data encryption module 2 encrypting the data to be migrated in the source database 001 in one embodiment of the present disclosure.

[0068] like Figure 5 As shown, the data encryption module 2 may include a storage space calculation module 21, a temporary table creation module 22, an encryption result generation module 23, a table structure storage module 24, a table structure conversion module 25, a ciphertext storage module 26, and a ciphertext sending module 27. The data processing procedures of each module and their mutual calling relationships are detailed below.

[0069] Storage Space Calculation Module 21: This module is responsible for calculating whether the storage space for the temporary table meets the requirements. Only if the storage space meets the requirements will it proceed to the temporary table creation module; otherwise, it will return an error message. The determination of whether the requirements are met could be, for example, estimating the size of the temporary table based on the size of the source table, and then determining whether the storage space is greater than a certain multiple (e.g., 1.2 times) of the estimated temporary table size, thus providing a certain margin for the creation of the temporary table.

[0070] Temporary table creation module 22: Creates temporary tables corresponding to the source tables in the source database 001 where the data to be migrated is to be migrated. Each temporary table corresponds to the table name of the source table according to a certain naming rule, and a table name mapping table is established to store these mapping relationships, which facilitates related queries when the target database 002 restores the encrypted data later.

[0071] Encryption Result Generation Module 23: Specifically, the source database 001 treats each piece of data x to be migrated as plaintext and encrypts it using the public key (A, b). The encryption process is as follows: First, the source database 001 selects a random vector r ∈ χ^n and calculates the encrypted data: u = Ar and v = br + x. Then, it transmits the paired data u and v, along with the corresponding x, to the ciphertext storage module 26.

[0072] Table structure storage module 24: For different tables, the corresponding table structure needs to be stored. This module calls the table structure conversion module 25, passing in the table to be converted and the type of the target database 002. After receiving the table structure conversion information from the table structure conversion module 25, it calls the encrypted storage module 26 to store it in a temporary table.

[0073] Table Structure Conversion Module 25: For migrations between different databases, it is necessary to convert table structures into corresponding table structures, control information such as precision between different types, and output appropriate table structure conversion information. Specifically, the table structure conversion information can include the data structure conversion relationship when outputting data from each field in the source table to the corresponding field in the target database 002, such as the unit of measurement and the number of decimal places retained.

[0074] Ciphertext storage module 26: Receives the result (u, v) and the corresponding x obtained by encryption result generation module 23, and then uses (u, v) as encrypted data and stores it in a temporary table.

[0075] Encrypted data transmission module 27: After receiving connection confirmation from the target database 002, this module sends the encrypted data in the temporary table, its corresponding original table name, and table structure conversion information to the target database 002. Since there are multiple temporary tables, they can be sent to the target database 002 in table order. When the transmission of a temporary table is complete, a signal is sent to inform the target database 002 that the information for the current temporary table has been transmitted.

[0076] Due to the difficulty of the LWE problem, when a temporary table is sent from the source database 001 to the target database, even if the temporary table or its data is intercepted and the public key (A, b) is known, it is very difficult for an attacker to recover the plaintext data x from the encrypted data (u, v). Furthermore, due to the homomorphism of the LWE problem, performing addition or scalar multiplication on the encrypted data (u, v) will not affect the decryption result.

[0077] In this way, the embodiments of this disclosure can effectively improve data security during database migration, and even if the data is intercepted during network transmission, the original real data cannot be obtained.

[0078] Figure 6 The illustration shows a flowchart of the decryption and conversion module 3 performing decryption and conversion on received encrypted data in the target database 002 in one embodiment of the present disclosure.

[0079] like Figure 6 As shown, the decryption and conversion module 3 may include a connection establishment module 31, a data receiving initialization module 32, a data decryption module 33, and a format conversion module 34. The processing procedures and mutual calling relationships of each module are detailed below.

[0080] Connection establishment module 31: This module can establish a secure network connection between the source database 001 and the target database 002, and transmit encrypted data from the temporary table to the target database 002 through this connection. Because the data is encrypted, even if it is intercepted or tampered with during transmission, the confidentiality and integrity of the data will not be leaked or compromised.

[0081] Specifically, a secure channel can be established between the source database 001 and the target database 002 using the SSL / TLS protocol, and data can be transmitted through this channel. The SSL / TLS protocol can guarantee data integrity, confidentiality, and authentication during transmission.

[0082] Data receiving initialization module 32: This module can receive temporary tables and table name mapping tables sent from source database 001. Encrypted data and table structure conversion information can both be written in the temporary tables. The table name mapping table stores the naming rules between the table names of the temporary tables sent out by source database 001 and the table names of the source tables stored in source database 001. Data receiving initialization module 32 can call data decryption module 33 to decrypt the encrypted data.

[0083] Specifically, the data receiving initialization module 32 can first create a table (i.e., the target table) in the target database 002 that corresponds to the received temporary table, and name the target table with the table name of the source table corresponding to the temporary table. Then, the encrypted data is passed to the data decryption module 33, and the decrypted plaintext data is stored in the target table.

[0084] Data decryption module 33: The target database 002 uses the private key s to decrypt each received ciphertext (u, v). The decryption process is as follows: First, the target database 001 calculates w = v - us. Then, the target database calculates w mod q and treats the result as plaintext data x, where x ∈ Z. The decrypted plaintext data is then passed to the format conversion module 34.

[0085] Format conversion module 34: The target database 002 adapts and converts the data structure of x according to the corresponding table structure conversion information, and stores the conversion result in the target database. For example, if the target database uses MySQL, it can convert x into the corresponding data type, such as integer, floating-point number, string, etc., and insert it into the target table.

[0086] Figure 7 A flowchart illustrating a database migration method based on a lattice cryptography algorithm according to another embodiment of this disclosure is shown.

[0087] like Figure 7 As shown, combined with Figure 1 The method may include the following steps S1 to S8.

[0088] S1, the administrator selects the database to be migrated, determines the target database, starts this encryption system, and passes the relevant encryption parameters to the target database.

[0089] S2, in the target database, the key generation module generates a public key and a private key based on the relevant parameters passed by the administrator, and starts an anomaly monitoring program to record anomalies generated during this migration process and log the anomaly.

[0090] S3, the data encryption module in the source database 001 performs a storage space check. After passing the check, it starts creating temporary tables based on the source tables to be migrated.

[0091] S4. Select the data that needs to be encrypted from the source table in the source database 001, encrypt it, and store it in a temporary table.

[0092] S5, establish a network connection and communication between the source database 001 and the target database 002.

[0093] S6, after successful network communication and completion of temporary table data insertion, source database 001 sends encrypted data to target database 002. The data decryption module 3 of target database 002 decrypts the encrypted data.

[0094] S7, the target database 002 inserts the decrypted plaintext data into the target table after performing structural and format conversion according to the table structure conversion information.

[0095] S8. After all the encrypted data in the temporary tables has been decrypted and inserted, check the exception report to see if there are any exceptions in the migration process.

[0096] In this embodiment of the disclosure, lattice cryptography is used for data encryption and decryption during data migration, which can improve the security of data transmission. Furthermore, there are currently no known effective attack methods against lattice cryptography; therefore, encrypting data using lattice cryptography before transmission can significantly reduce the risk of information leakage during data migration and may even resist attacks from quantum computers.

[0097] Lattice cryptography is highly efficient for encrypting database data. It can utilize efficient mathematical tools such as the Fast Fourier Transform to perform calculations, thereby improving the speed of encryption and decryption. It is efficient while ensuring the security of database migration.

[0098] Figure 8 The diagram illustrates the structure of a database migration apparatus 800 based on a lattice cryptography algorithm, which is configured in a source database according to an embodiment of the present disclosure.

[0099] like Figure 8 As shown, the device 800 may include a temporary table creation module 22, an encryption result generation module 23, a ciphertext storage module 26, and a ciphertext sending module 27. The device 800 may be located in the source database 001.

[0100] The temporary table creation module 22 is used to create a temporary table corresponding to the source table.

[0101] The encryption result generation module 23 is used to: receive the public key published by the target database, which is generated based on the lattice cipher algorithm and includes two parameters, A and b, where A is an m×n random matrix and b is an m-dimensional random vector; and encrypt the plaintext data x to be migrated in the source table using the public key based on the lattice cipher algorithm to obtain the encrypted data corresponding to the plaintext data x, wherein the encrypted data includes pairs of data u and v, where u = Ar, v = br + x, and r is a random vector selected by the source database.

[0102] The encrypted storage module 26 is used to output encrypted data to a temporary table.

[0103] The ciphertext sending module 27 is used to encrypt all plaintext data to be migrated from the source table and output it to a temporary table, and then send the temporary table to the target database. The target database stores a private key s corresponding to the public key, where b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector. The target database can decrypt the encrypted data using the private key s based on the lattice cryptography algorithm to obtain the plaintext data.

[0104] The device 800 can perform reference Figure 2 The data migration method described herein can be found in the previous text and will not be repeated here.

[0105] Figure 9 The diagram illustrates a structural block diagram of a database migration apparatus 900 based on a lattice cryptography algorithm, which is set in a target database according to another embodiment of the present disclosure.

[0106] like Figure 9 As shown, the device 900 may include a key calculation module 12, a key distribution module 13, a data receiving initialization module 32, and a data decryption module 33. The device 900 may be installed in the target database 002.

[0107] The key calculation module 12 is used to generate public and private keys based on lattice cryptography algorithm. The public key includes two parameters A and b, where A is an m×n random matrix, b = As + e, e is an m-dimensional error vector, and s is the private key corresponding to the public key, where s is an n-dimensional random vector.

[0108] The key distribution module 13 is used to send the public key generated based on the lattice cryptography algorithm to the source database.

[0109] The data receiving initialization module 32 is used to receive a temporary table sent by the source database. The temporary table stores encrypted data, and each encrypted data includes a pair of data u and v. The pair of data u and v is obtained by encrypting the plaintext data x to be migrated from the source database using a public key based on a lattice cryptography algorithm.

[0110] The data decryption module 33 is used to decrypt plaintext data x from each encrypted data using the private key s.

[0111] The device 900 can perform reference Figure 3 The data migration method described herein can be found in the previous text and will not be repeated here.

[0112] According to embodiments of this disclosure, any multiple modules among the following modules—key generation module 1, parameter generation module 11, key calculation module 12, key distribution module 13, data encryption module 2, storage space calculation module 21, temporary table creation module 22, encryption result generation module 23, table structure storage module 24, table structure conversion module 25, ciphertext storage module 26, ciphertext sending module 27, decryption conversion module 3, connection establishment module 31, data reception initialization module 32, data decryption module 33, and format conversion module 34—can be merged into a single module without conflict, or any one of these modules can be split into multiple modules. Alternatively, in the absence of conflict, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in a single module. According to embodiments of this disclosure, at least one of the following modules can be implemented, at least partially, as hardware circuits, such as Field Programmable Gate Array (FPGA), Programmable Logic Array (PLA), System-on-a-Chip, System-on-a-Substrate, System-on-a-Package, Application-Specific Integrated Circuit (ASIC), or any other reasonable means of integrating or packaging circuits, or as hardware or firmware, or as any one of software, hardware, and firmware implementations, or any suitable combination thereof. Alternatively, at least one of the following modules can be implemented, at least partially, as a computer program module: key generation module 1, parameter generation module 11, key calculation module 12, key distribution module 13, data encryption module 2, storage space calculation module 21, temporary table creation module 22, encryption result generation module 23, table structure storage module 24, table structure conversion module 25, ciphertext storage module 26, ciphertext sending module 27, decryption conversion module 3, connection establishment module 31, data reception initialization module 32, data decryption module 33, and format conversion module 34. When the computer program module is run, it can perform the corresponding function.

[0113] Figure 10A block diagram schematically illustrates an electronic device suitable for implementing a database migration method based on a lattice cryptography algorithm according to embodiments of the present disclosure.

[0114] like Figure 10 As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0115] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that the programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0116] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0117] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0118] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0119] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0120] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0121] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0122] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0123] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0124] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0125] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0126] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A database migration method based on lattice cryptography algorithm, applied to a target database, wherein, The method includes: A public key and a private key are generated based on a lattice cryptography algorithm. The public key includes two parameters, A and b, where A is an m×n random matrix, b = As + e, e is an m-dimensional error vector, and s is the private key corresponding to the public key, where s is an n-dimensional random vector. Send the public key to the source database; The system receives a temporary table sent by the source database, wherein the temporary table stores encrypted data, each encrypted data pair including data u and v, wherein the data pairs u and v are obtained by encrypting the plaintext data x to be migrated from the source database using the public key based on the lattice cryptography algorithm; and The plaintext data x is decrypted from each encrypted data using the private key s.

2. The method according to claim 1, wherein, The step of decrypting plaintext data x from each encrypted data using the private key s includes: During decryption, first calculate w = v - us, then calculate the plaintext data x = w mod q; Where q is the modulus selected by the target database when generating the public key and the private key based on the lattice cryptography algorithm.

3. The method according to claim 1, wherein, The generation of public and private keys based on the lattice cryptography algorithm includes: Obtain the basic parameters, including the modulus q, dimension n, error distribution χ, and random matrix A; and Based on the aforementioned basic parameters, the public key and the private key are calculated using the aforementioned lattice cryptography algorithm, where e is a vector extracted from the error distribution χ in b = As + e.

4. The method according to claim 1, wherein, The method further includes: The table name relationship correspondence table is received. The table name relationship correspondence table stores the naming rules of the table names of the temporary tables sent out by the source database and the table names of the source tables stored in the source database. Read the name of the temporary table; Based on the naming rules in the table name correspondence table, create a target table with the same name as the source table; and The decrypted plaintext data is output to the target table.

5. The method according to claim 4, wherein, The temporary table also stores table structure transformation information, which includes the data structure transformation relationship when outputting data from each field in the source table to the same field in the target table. Therefore, outputting the decrypted plaintext data to the target table further includes: Based on the fields containing the decrypted plaintext data and the data structure transformation relationship, the data structure of the plaintext data is transformed, and the transformation result is output to the target table.

6. A database migration method based on lattice cryptography algorithm, applied to the source database, wherein, The method includes: Receive the public key published by the target database. The public key is generated based on the lattice cryptography algorithm and includes two parameters, A and b, where A is an m×n random matrix and b is an m-dimensional vector. Create a temporary table corresponding to the source table; Based on the lattice cryptography algorithm, the public key is used to encrypt the plaintext data x to be migrated in the source table to obtain encrypted data corresponding to the plaintext data x. The encrypted data includes pairs of data u and v, where u = Ar, v = br + x, and r is a random vector selected by the source database. Output the encrypted data to the temporary table; and After encrypting all plaintext data to be migrated from the source table and outputting it to the temporary table, the temporary table is sent to the target database. The target database stores a private key s corresponding to the public key, where b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector. The target database can decrypt the encrypted data using the private key s based on the lattice cryptography algorithm to obtain the plaintext data.

7. The method according to claim 6, wherein, The creation of the temporary table corresponding to the source table includes: Obtain the storage capacity of the source database used to store the temporary table; and The temporary table is created when the storage space used to store it meets the requirements.

8. The method according to claim 6, wherein, The method further includes: Create a table mapping table, which stores the naming rules corresponding to the names of the temporary tables and the names of the source tables; and Send the table corresponding to the table name relationship to the target database.

9. The method according to claim 6, wherein, Before sending the temporary table to the target database, the method further includes: When the source database and the target database are of different types, table structure conversion information is generated. This information includes the data structure conversion relationship when outputting data from each field in the source table to the same field in the target table; and... Store the table structure transformation information in the temporary table.

10. A database migration device based on lattice cryptography algorithm, installed in the target database, wherein, The device includes: The key calculation module is used to generate a public key and a private key based on the lattice cryptography algorithm. The public key includes two parameters, A and b, where A is an m×n random matrix, b = As + e, e is an m-dimensional error vector, and s is the private key corresponding to the public key, where s is an n-dimensional random vector. The key distribution module is used to send the public key to the source database; A data receiving initialization module is used to receive a temporary table sent by the source database, wherein the temporary table stores encrypted data, and each encrypted data includes a pair of data u and v, wherein the pair of data u and v is obtained by encrypting the plaintext data x to be migrated from the source database using the public key based on the lattice cryptography algorithm; and The data decryption module is used to decrypt plaintext data x from each encrypted data using the private key s.

11. A database migration device based on lattice cryptography algorithm, installed at the source database, wherein, The device includes: The temporary table creation module is used to create a temporary table corresponding to the source table; The encryption result generation module is used for: Receive the public key published by the target database. This public key is generated based on a lattice cryptography algorithm and includes two parameters, A and b, where A is an m×n random matrix and b is an m-dimensional random vector; and Based on the lattice cryptography algorithm, the public key is used to encrypt the plaintext data x to be migrated in the source table to obtain encrypted data corresponding to the plaintext data x. The encrypted data includes pairs of data u and v, where u = Ar, v = br + x, and r is a random vector selected by the source database. The encrypted storage module is used to output the encrypted data to the temporary table; The encrypted data transmission module is used to encrypt all plaintext data to be migrated from the source table and output it to the temporary table, and then send the temporary table to the target database. The target database stores a private key s corresponding to the public key, where b = As + e, e is an m-dimensional error vector, and s is an n-dimensional random vector. The target database can decrypt the encrypted data using the private key s based on the lattice cryptography algorithm to obtain the plaintext data.

12. An electronic device, comprising: One or more processors; Memory, used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 9.

13. A computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the method of any one of claims 1 to 9.

14. A computer program product comprising computer program instructions that, when executed by a processor, implement the method of any one of claims 1 to 9.

Images