Data encryption upgrade method, device, medium and computer program product

Abstract

The present disclosure provides a data encryption upgrade method, comprising: constructing a new data table containing the target encryption parameters based on the target encryption parameters generated by the target encryption method, wherein the new data table also contains the attribute category and user code associated with the target encryption parameters; in response to the judgment result that the target user has a verification identifier, retrieving the actual category information of the target user to verify the target encryption parameters to obtain a verification result; and when the verification result is a verification failure, retrieving the original data table containing the actual category information to the client. The present disclosure also provides an electronic device, a storage medium, and a computer program product.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a data encryption upgrade method, electronic equipment, storage medium and computer program product. Background Art

[0002] User information is a vital business secret for enterprises. For individual users, the leakage of their sensitive information will bring bad experience or serious security risks in the future. Therefore, user information needs to be encrypted and stored to at least ensure the security of sensitive data in user information. With the development of current encryption methods, there will be a demand for upgrading and optimizing the original encryption method to further improve the encryption effect of user information, such as upgrading the traditional encryption method base64 to the encryption method AES-GCM that meets the company's standards.

[0003] However, in the process of upgrading the encryption method, the related technology usually directly adds a new token to the original user data table, and then sets the encrypted data field generated by the new encryption method in the new token to achieve the upgrade of the encryption method. However, since the user information that needs to optimize the encryption method has a large amount of data, if the table structure is adjusted one by one, it will increase the upgrade time and cause interference in the reading and writing of business data such as user information; in addition, if new tokens are added to each attribute parameter indiscriminately, it will undoubtedly cause a waste of resources; furthermore, if the newly added token has an encryption error, it cannot be rolled back to the original user data table, which will delay the business process. Based on this, the data encryption upgrade method proposed by the related technology cannot achieve a smooth upgrade of the data encryption method. Summary of the invention

[0004] The present disclosure provides a data encryption upgrade method, an electronic device, a storage medium, and a computer program product.

[0005] According to one aspect of the present disclosure, a method for upgrading data encryption is provided, which may include: based on target encryption parameters generated by a target encryption method, constructing a new data table containing the target encryption parameters, wherein the new data table also contains attribute categories and user codes associated with the target encryption parameters; in response to a judgment result that the target user has a verification identifier, retrieving the actual category information of the target user to verify the target encryption parameters to obtain a verification result; and when the verification result is a verification failure, retrieving the original data table containing the actual category information to the client.

[0006] In some embodiments, the target encryption parameters generated by the target encryption method are used to construct a new data table containing the target encryption parameters, including: in response to the attribute category to be upgraded in the upgrade instruction, retrieving the actual category information and its user code associated with the attribute category in the original data table of the target user; encrypting the actual category information using the target encryption method to generate the target encryption parameters; and integrating the target encryption parameters and its attribute category, as well as the user code, to construct the new data table.

[0007] In some embodiments, in response to the judgment result that the target user has a verification identification, the actual category information of the target user is retrieved to verify the target encryption parameters, including: when the target user has a verification identification, the actual category information of the target user is retrieved; the target encryption parameters of the target user are processed using a target decryption method to obtain a decryption result associated with the target encryption parameters; and the consistency between the actual category information and the decryption result is judged to complete the verification of the target encryption parameters.

[0008] In some embodiments, when the target user has a verification identification, the actual category information of the target user is retrieved, including: when the target user has a verification identification, determining the attribute category corresponding to the verification identification; retrieving the original encryption parameters associated with the attribute category in the original data table of the target user; and processing the original encryption parameters using the original decryption method to decrypt the actual category information corresponding to the original encryption parameters.

[0009] In some embodiments, before constructing a new data table containing the target encryption parameters based on the target encryption parameters generated by the target encryption method, it includes: decrypting the original encryption parameters corresponding to the attribute category in the original data table according to the attribute category indicated by the upgrade instruction to obtain the actual category information associated with the attribute category.

[0010] In some embodiments, after constructing a new data table containing the target encryption parameters based on the target encryption parameters generated by the target encryption method, it also includes: migrating the remaining data in the original data table of the target user to the new data table, wherein the target user is the user associated with the new data table.

[0011] In some embodiments, before the response to the judgment result that the target user has a verification identifier and the actual category information of the target user is retrieved to verify the target encryption parameters, it also includes: setting a preset number of dual-read users in a transition period, and setting the verification identifier for the dual-read user, wherein the verification identifier corresponds to the attribute category to be verified.

[0012] In some embodiments, when the verification result is a verification failure, after retrieving the original data table containing the actual category information to the client, the method further includes: deleting the original data table of the target user in response to the end time of the transition period.

[0013] In some embodiments, after the actual category information of the target user is retrieved to verify the target encryption parameters in response to the judgment result that the target user has a verification identifier, the further embodiment further includes: in response to the judgment result that the verification result is a successful verification, the target encryption parameters in the new data table are synchronized to the client as a read object.

[0014] In some embodiments, when the verification result is a verification failure, after retrieving the original data table containing the actual category information to the client, it includes: using the target encryption parameter in the new data table as abnormal data, and constructing an alarm message containing the abnormal data.

[0015] According to another aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data encryption upgrade method as described in any of the above embodiments is implemented.

[0016] According to another aspect of the present disclosure, a readable storage medium is provided, wherein the readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the data encryption upgrade method as described in any of the above embodiments.

[0017] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the data encryption upgrade method described in any of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings illustrate exemplary embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0019] Figure 1 A schematic diagram of an upgrade method for data encryption in related technology.

[0020] Figure 2 This is a flow chart of a method for upgrading data encryption according to an exemplary embodiment of the present disclosure.

[0021] Figure 3The figure is a schematic diagram of constructing a new data table according to an exemplary embodiment of the present disclosure.

[0022] Figures 4A to 4C They are schematic diagrams of data writing according to exemplary embodiments of the present disclosure.

[0023] Figure 5 It is a schematic diagram of the migration of the remaining data according to the exemplary embodiment of the present disclosure.

[0024] Figure 6 It is a schematic diagram of data reading according to an exemplary embodiment of the present disclosure.

[0025] Figure 7 A block diagram of a data encryption upgrade device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] The present disclosure is further described in detail below in conjunction with the accompanying drawings and implementations. It is understood that the specific implementations described herein are only used to explain the relevant content, rather than to limit the present disclosure. It should also be noted that, for ease of description, only the parts related to the present disclosure are shown in the accompanying drawings.

[0027] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present disclosure can be combined with each other. The technical solution of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0028] Unless otherwise specified, the exemplary embodiments / embodiments shown will be understood as providing exemplary features of various details of some ways in which the technical concept of the present disclosure can be implemented in practice. Therefore, unless otherwise specified, the features of the various embodiments / embodiments can be combined, separated, interchanged and / or rearranged without departing from the technical concept of the present disclosure.

[0029] The terms used herein are for the purpose of describing specific embodiments, rather than being restrictive. As used herein, unless the context clearly indicates otherwise, the singular forms "one (kind, person)" and "said (the)" are also intended to include plural forms. In addition, when the terms "comprise" and / or "include" and their variations are used in this specification, it is explained that there are stated features, integral bodies, steps, operations, parts, assemblies and / or their groups, but it is not excluded that there are or add one or more other features, integral bodies, steps, operations, parts, assemblies and / or their groups. It should also be noted that, as used herein, the terms "substantially", "approximately" and other similar terms are used as approximate terms and not as degree terms, so that they are used to explain the inherent deviations of the measured values, calculated values ​​and / or the values ​​provided that will be recognized by those of ordinary skill in the art.

[0030] Figure 1 A schematic diagram of an upgrade method for data encryption in related technology.

[0031] like Figure 1 As shown, when dealing with the upgrade of data encryption, the related technology usually adds a new encryption parameter field token_new to the encryption parameters corresponding to each attribute category of the original user data table. Taking the user with user code ucid 100001 as an example, when the upgrade instruction only indicates to encrypt and upgrade the category information of the mobile phone category type="phone", the mailbox category type="email" under the user name will also be indiscriminately added with a new encryption parameter field token_new.

[0032] Among them, ucid represents the user code. Different users correspond to different user codes. According to the user code, the category information of the attribute category of the target user can be accurately retrieved; type represents the attribute category of the user, such as the mobile phone category phone, the mailbox category email, etc. The attribute category belongs to the user's personal sensitive information. Therefore, the category information corresponding to each attribute category needs to be encrypted and stored to ensure the user's privacy and security; the string corresponding to the encryption parameter token is the encryption result of the category information of the corresponding attribute category. Different encryption methods will produce different encryption results. For example, the token generated by the original encryption method base64 is "5B12DE8B65C844B8", and the token_new generated by the new encryption method AES-GCM is: "U2FsdGVkX1+42Y7qx7MmNnHpnxvL72BvmqwvvRX8LBA=". The encryption parameters are decrypted using the decryption method corresponding to each encryption method to obtain the category information corresponding to the user's attribute category. Of course, according to the result of obtaining the attribute categories of the user, the attribute categories are not limited to the aforementioned mobile phone number categories and email categories, and are not listed here one by one.

[0033] Obviously, when dealing with the upgrade of data encryption, the related technology will modify the table structure of the original user data table. In this way, if there is an upgrade error in the new user data table, it is impossible to roll back to the original version directly, and the program code needs to be rolled back synchronously. If the code is not rolled back in time, it will cause delays in reading user data tables and other related services.

[0034] Of course, when an upgrade instruction is received, the attribute category indicated by the upgrade instruction is not considered, and the category information of all attribute categories in the original user data table is indiscriminately encrypted and upgraded, which will cause blank fields to appear in the new encryption parameters corresponding to the attribute categories not indicated by the upgrade instruction, resulting in a waste of resources.

[0035] In addition, this indiscriminate encryption upgrade of all attribute categories in each user data table will also cause the table structure space of each user data table to increase, increasing the pressure on storage space; at the same time, it will also extend the upgrade time. During the longer upgrade period, the reading and writing operations of business data cannot be supported, which will affect the processing of related businesses and cause a decline in user experience.

[0036] The present disclosure proposes a data encryption upgrade method to solve the aforementioned problems existing in the related technology.

[0037] Figure 2 This is a flow chart of a method for upgrading data encryption according to an exemplary embodiment of the present disclosure. Figure 3 The figure is a schematic diagram of constructing a new data table according to an exemplary embodiment of the present disclosure. Figures 4A to 4C They are schematic diagrams of data writing according to exemplary embodiments of the present disclosure. Figure 5 It is a schematic diagram of the migration of the remaining data according to the exemplary embodiment of the present disclosure. Figure 6 This is a schematic diagram of data reading in an exemplary embodiment of the present disclosure. Figures 2 to 6 The data encryption upgrade method S100 is described in detail.

[0038] Step S102: construct a new data table containing target encryption parameters based on the target encryption parameters generated by the target encryption method.

[0039] The target encryption method refers to the encryption method indicated in the upgrade instruction. It is different from the original encryption method and is usually an upgrade or optimization of the original encryption method. Usually, the security performance of the encryption result generated by the target encryption method is higher than that of the original encryption method; or, the target encryption method is more suitable for the current encryption scenario and is more convenient in the encryption process. In short, the target encryption method is an upgrade result of the original encryption method.

[0040] The target encryption parameter is the encryption result of the actual category information using the target encryption parameter. It represents the actual category information corresponding to the corresponding attribute category, but is usually presented in the form of a string to keep the user information confidential. Different encryption methods will produce different encryption parameters. The target encryption parameter can be decrypted using the target decryption method corresponding to the target encryption method to obtain the actual category information.

[0041] The new data table at least contains the attribute category that needs to upgrade the encryption method, the target encryption parameters after encrypting the attribute category, and the user code of the target user. In other words, compared with the related art, a new data table is constructed to store the result after encryption by the target encryption method, while avoiding the change of the table structure of the original data table. In this way, even if the new data table has an upgrade error, it can be rolled back to the original data table to retrieve the data, which will not cause delays or failures in reading user data.

[0042] The upgrade instruction is an upgrade signal for one or more attribute categories, and at least includes the attribute category corresponding to the category information that needs to be encrypted and upgraded and the target encryption method. Under the control of the upgrade instruction, the original data table with the attribute category is screened out, and a new data table is constructed based on the user code and attribute category in the original data table; at the same time, the category information of the attribute category is encrypted using the target encryption method in the upgrade instruction to generate the target encryption parameter.

[0043] refer to Figure 3 , the new data table includes the user code ucid. The ucid of the target user is 100001. Different users have different user codes. The user code is the unique identifier of the user, which is convenient for searching and managing the attribute category and other information of each user. The new data table also stores the attribute category type indicated by the upgrade instruction with encryption upgrade requirements, such as the mobile phone category phone. The attribute category is the user's private information. Its corresponding category information needs to be encrypted before it can be stored to ensure the security of the user's personal information; there may be multiple attribute categories according to the results of obtaining user information, but only the attribute category indicated by the upgrade instruction is stored in the initial stage of constructing the new data table. The new data table also includes the target encryption parameter generated by the target encryption method. The target encryption parameter is the encryption result of the category information, which is presented in the form of a string, such as "U2FsdGVkX1+42Y7qx7MmNnHpnxvL72BvmqwvvRX8LBA=":, and the corresponding category information can only be displayed after decryption. Compared with the encryption parameters "5B12DE8B65C844B8" in the original data table, the target encryption parameters are more difficult to crack, which improves the encryption effect of related category information.

[0044] Step S104, in response to the determination result that the target user has the verification identification, the actual category information of the target user is retrieved to verify the target encryption parameters to obtain a verification result.

[0045] The target user refers to the user associated with the category information indicated by the upgrade instruction that needs to be encrypted and upgraded. If the upgrade instruction is to encrypt and upgrade a certain category information of all users, the target user can be all users with this attribute category, and there is no limit on the number.

[0046] The verification mark is used to indicate that the target encryption parameters in the new data table can be retrieved when reading user information. Since the amount of data of the target users in the system is large, if the new data table is put into use at one time, a large range of data reading failures may occur, which will affect the reading business of user information. Therefore, the verification mark is set to read the new data table for some users to control the amount of reading of the new data table. In other words, only users with verification marks can retrieve the new data table; when reading, the accuracy of the new data table needs to be verified to ensure the consistency of the data. Of course, the number of users with verification marks gradually increases with the passage of transition time until all users with encryption upgrade operations are covered. When assigning verification marks to users, random or sequential user codes can be selected. For example, verification marks can be assigned to users whose last digits in the user code are "1" and "5". As the transition time increases, verification marks can be assigned to users whose last digits are "6" and "7" to increase the number of users who retrieve the new data table. Of course, other allocation methods can also be used, which are not limited here.

[0047] The actual category information is the real information of the attribute category of the target user for encryption upgrade. For example, if the attribute category is the mobile phone number category, then the actual category information is the actual mobile phone number of the target user. The actual category information can be obtained by decrypting the encryption parameters in the original data table. It is the basis for judging the accuracy of the decryption result of the target encryption parameter. When the decryption result of the target encryption parameter is consistent with the actual category information, it proves that the encryption effect of the target encryption parameter is stable and effective, and the corresponding new data table can be put into use as a read object.

[0048] The verification results are divided into at least two types: successful verification and failed verification. Successful verification indicates that the decryption result of the target encryption parameter is consistent with the actual category information, so the target encryption parameter in the new data table is used as the reading object; failed verification indicates that the target encryption parameter is blank, or its decryption result deviates from the actual category information, so manual repair is required, and the new data table cannot be used as a user data table, so the encryption parameter in the original data table is called as the reading object.

[0049] Step S106, when the verification result is a verification failure, the original data table containing the actual category information is retrieved to the client.

[0050] The original data table contains the attribute category, user code and encryption parameters corresponding to the upgrade instruction, but the encryption parameters in the original data table are obtained through the original encryption method. The original data table is the user data table used in the user data reading business. It has been tested for encryption verification when it was built, so the encryption parameters it contains can stably decrypt the actual category information.

[0051] In some embodiments, the execution steps of step S102 are: in response to the attribute category to be upgraded in the upgrade instruction, retrieving the actual category information and its user code associated with the attribute category in the original data table of the target user; encrypting the actual category information using the target encryption method to generate target encryption parameters; and integrating the target encryption parameters and its attribute category, as well as the user code, to construct a new data table.

[0052] In other words, the attribute categories and user codes associated with the upgrade instructions in the original data table are migrated to a blank table, and the category information of the relevant attribute categories in the original data table is cracked, and the category information is encrypted using the target encryption method. The target encryption parameters obtained by encryption are written into the blank table, thereby obtaining a new data table containing user codes, attribute categories and their target encryption parameters.

[0053] In some embodiments, the execution steps of step S104 are: when a verification identifier exists for the target user, the actual category information of the target user is retrieved; the target encryption parameters of the target user are processed using a target decryption method to obtain a decryption result associated with the target encryption parameters; and the consistency between the actual category information and the decryption result is determined to complete the verification of the target encryption parameters.

[0054] That is to say, when the target user has a verification mark, the target encryption parameters in the target user's new data table will be retrieved for decryption, and the decryption result will be judged for consistency using the actual category information, and finally the verification result of successful or failed verification can be obtained. If there is no verification mark, the encryption parameters in the original data table of the user will be directly retrieved for decryption to obtain the actual category information.

[0055] The target encryption parameters are only verified for users with verification identification, which alleviates the computational pressure of simultaneous verification and avoids the possibility of read paralysis caused by large-scale upgrade problems.

[0056] The method for retrieving the actual category information of the target user is: when the target user has a verification identification, determine the attribute category corresponding to the verification identification; retrieve the original encryption parameters associated with the attribute category in the original data table of the target user; and use the original decryption method to process the original encryption parameters to decrypt the actual category information corresponding to the original encryption parameters.

[0057] In some implementations, before step S102, the method includes: decrypting original encryption parameters corresponding to the attribute category in the original data table according to the attribute category indicated by the upgrade instruction to obtain actual category information associated with the attribute category.

[0058] In some implementations, after obtaining the new data table, the original data table and the new data table may be written synchronously according to the actual changes in the user information. Figure 4A , Figure 4B and Figure 4C .

[0059] refer to Figure 4A If the category content of the attribute category indicated by the upgrade instruction in the user information is added, then the attribute category and the original encryption parameter field generated by the original encryption method are added to the original data table, and the attribute category and the target encryption parameter field generated by the target encryption method are added to the new data table. For example, if the attribute category type is added to the category information of the mobile phone number phone for the user with the user code ucid of 10001, then the encryption parameter token field "5B12DE8B65C844B8" is added to the original data table, and the attribute category type is added to the category information of the mobile phone number phone for the user with the user code ucid of 10001 in the new data table at the same time, then the target encryption parameter token field "U2FsdGVkX1+42Y7qx7MmNnHpnxvL72BvmqwvvRX8LBA=" is added to the new data table.

[0060] refer to Figure 4B If the category content of the attribute category indicated by the upgrade instruction in the user information is modified, then the original encryption parameter field generated by the original encryption method of the attribute category in the original data table is modified, and the target encryption parameter field corresponding to the attribute category is replaced in the new data table. For example, if the category information of the attribute category type is modified to the mobile phone number phone for the user with the user code ucid 10001, the encryption parameter token corresponding to the attribute category in the original data table can be adjusted to "6E23194F4D5EAF97", and the relevant target encryption parameter token is modified for the user with the user code ucid 10001 in the new data table at the same time, and the adjusted string is "U2FsdGVkX19vqVAhqQlwAkCnUeSVRubvoOW9amFdwjk=".

[0061] refer to Figure 4CIf the category content of the attribute category indicated by the upgrade instruction in the user information is deleted, then the attribute category, encryption parameters and user code in the original data table are deleted; synchronously, the attribute category, target encryption parameters and user code in the new data table are deleted.

[0062] In some implementations, after step S102, the method further includes: migrating the remaining data in the original data table of the target user to the new data table, wherein the target user is the user associated with the new data table.

[0063] Since the original data table may involve multiple attribute categories and their encryption parameters, but the content migrated to the new data table in the above steps is only the part indicated in the upgrade instruction, after the new data table is built, the other parts of the original data table can be regarded as the remaining data and migrated to the new data table to achieve the consistency of the remaining data in the new data table and the original data table. Ultimately, the difference between the new data table and the original data table is only reflected in the encryption parameter part of the attribute category indicated by the upgrade instruction, and the other parts remain consistent, which ensures the content integrity of the new data table and provides support for the subsequent deletion of the original data table.

[0064] refer to Figure 5 , the “…” in the original data table and the new data table omits the content of the remaining data. Through data migration, the remaining data in the original data table is copied to the new data table, and the corresponding position and content remain unchanged, which is convenient for user data reading.

[0065] In some implementations, before step S104, the method further includes: setting a preset number of dual-reading users in the transition period, and setting verification flags for the dual-reading users, wherein the verification flags correspond to the attribute categories to be verified.

[0066] The transition period is essentially a verification period for the new data table. After the new data table is constructed, the stability of the target encryption method cannot be guaranteed. Therefore, by setting a transition period, room for rollback is provided for the situation where there is encryption or decryption offset in the new data table, thereby ensuring the reliability of reading user information.

[0067] A dual-read user refers to a user who needs to verify the new data table through the verification identification method. A dual-read user usually needs to read the new data table and the original data table of the user to determine the consistency of the target encryption parameters in the new data table and the actual category information mapped in the original data table. The remaining users without verification identification only read their original data tables.

[0068] refer to Figure 6For dual-read users with verification identification, when querying sensitive data such as the user's attribute category type of mobile phone number, it is necessary to read the original data table and the new data table to decrypt the encryption parameters indicated by the verification identification in the original data table and the new data table respectively, obtain the actual category information corresponding to the original data table and the decryption result of the new data table, and compare the two. If the mobile phone number of the user with user code 10001 in the original data table and the new data table is consistent, then it is proved that the new data table is available, and the data in the new data table can be returned to the client; otherwise, the data in the original data table is returned to the client, and the relevant personnel are prompted to perform error calibration.

[0069] In some implementations, after step S106, the method includes: deleting the original data table of the target user in response to the end time of the transition period.

[0070] When the transition period ends one week later, the original data table of the target user is deleted. At this time, the verification identification of each user is also cancelled, and the new data table is read uniformly. In this way, the storage space occupied by the original data table can be released, which has the advantage of saving storage space compared to adding token_new to the original data table.

[0071] In some implementations, after step S104, the method further includes: in response to a judgment result that the verification result is successful, synchronizing the target encryption parameters in the new data table as a read object to the client.

[0072] In some implementations, after step S106, the method further includes: using the target encryption parameters in the new data table as abnormal data, and constructing alarm information containing the abnormal data.

[0073] By sending alarm information to administrators and other relevant staff, relevant personnel can be more efficient in promptly investigating the causes of abnormal data, thereby accelerating the popularization of target encryption methods and the introduction of new data tables.

[0074] The data encryption upgrade method proposed in the present disclosure avoids structural adjustments to the original data table by constructing a new data table, ensures the timeliness of rollback, and provides the possibility of simultaneous upgrade of the encryption method and reading of user information. In addition, by setting a transition period and setting a verification mark for the user, a smooth transition between the old and new data tables is ensured, avoiding errors in data reading caused by directly investing in the new data table; of course, after the new data table is fully put into use, deleting the original data table will avoid space occupation caused by the encryption method upgrade.

[0075] Figure 7 A block diagram of a data encryption upgrade device according to an exemplary embodiment of the present disclosure.

[0076] like Figure 7 As shown, the present disclosure proposes a data encryption upgrade device 1000, including: a new data table construction module, used to construct a new data table containing the target encryption parameters based on the target encryption parameters generated by the target encryption method, wherein the new data table also contains the attribute categories and user codes associated with the target encryption parameters; a verification module, used to, in response to a judgment result that the target user has a verification identifier, retrieve the actual category information of the target user to verify the target encryption parameters to obtain a verification result; and a rollback module, used to retrieve the original data table containing the actual category information to the client when the verification result is a verification failure.

[0077] In some embodiments of the present disclosure, an upgrade operator may perform a data encryption upgrade operation through a client (eg, a computer device, a mobile phone device, etc.) based on a data encryption upgrade device configured on, for example, a server.

[0078] The various modules in the data encryption upgrade device 1000 are configured to execute the various steps of the data encryption upgrade method. The principles and execution steps thereof may be referred to above and will not be described in detail here.

[0079] The device 1000 may include corresponding modules for executing each or several steps in the above flowchart. Therefore, each step or several steps in the above flowchart may be executed by the corresponding module, and the device may include one or more modules in these modules. The module may be one or more hardware modules specially configured to execute the corresponding steps, or implemented by a processor configured to execute the corresponding steps, or stored in a computer-readable medium for implementation by a processor, or implemented by some combination.

[0080] The hardware structure can be implemented using a bus architecture. The bus architecture can include any number of interconnecting buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus 1100 connects various circuits including one or more processors 1200, memory 1300, and / or hardware modules together. The bus 1100 can also connect various other circuits 1400 such as peripherals, voltage regulators, power management circuits, external antennas, etc.

[0081] The bus 1100 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Component (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the figure only uses one connecting line, but does not mean that there is only one bus or one type of bus.

[0082] The data encryption upgrade device proposed in the present disclosure avoids structural adjustments to the original data table by constructing a new data table, ensures the timeliness of rollback, and provides the possibility of synchronous upgrade of the encryption method and reading of user information. In addition, by setting a transition period and setting a verification mark for the user, a smooth transition between the old and new data tables is ensured, avoiding errors in data reading caused by directly investing in the new data table; of course, after the new data table is fully put into use, deleting the original data table will avoid space occupation caused by the encryption method upgrade.

[0083] Any process or method description in the flowchart or otherwise described herein can be understood as a module, fragment or portion of a code representing one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present disclosure includes other implementations, in which the functions may not be performed in the order shown or discussed, including performing the functions in a substantially simultaneous manner or in a reverse order according to the functions involved, which should be understood by a person skilled in the art of the present disclosure. The processor performs the various methods and processes described above. For example, the method implementation in the present disclosure can be implemented as a software program, which is tangibly contained in a machine-readable medium, such as a memory. In some embodiments, part or all of the software program can be loaded and / or installed via a memory and / or a communication interface. When the software program is loaded into the memory and executed by the processor, one or more steps in the method described above can be performed. Alternatively, in other embodiments, the processor can be configured to perform one of the above methods in any other appropriate manner (e.g., by means of firmware).

[0084] The logic and / or steps represented in the flowchart or otherwise described herein may be embodied in any readable storage medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch instructions from and execute instructions on an instruction execution system, apparatus, or device), or in combination with such instruction execution systems, apparatuses, or devices.

[0085] For the purposes of this specification, a "readable storage medium" may be any device that can contain, store, communicate, propagate or transmit a program for use with or in conjunction with an instruction execution system, device or apparatus. More specific examples of readable storage media (a non-exhaustive list) include the following: an electrical connection with one or more wirings (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), a fiber optic device, and a portable read-only memory (CDROM). In addition, the readable storage medium may even be paper or other suitable medium on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a memory.

[0086] It should be understood that the various parts of the present disclosure can be implemented in hardware, software, or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented in software stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0087] A person skilled in the art may understand that all or part of the steps of implementing the above-mentioned implementation method may be completed by instructing related hardware through a program, and the program may be stored in a readable storage medium, which, when executed, includes one or a combination of the steps of the implementation method.

[0088] In addition, each functional unit in each embodiment of the present disclosure may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a readable storage medium. The storage medium may be a read-only memory, a disk or an optical disk, etc.

[0089] Those skilled in the art should understand that the above embodiments are only for the purpose of clearly illustrating the present disclosure, and are not intended to limit the scope of the present disclosure. For those skilled in the art, other changes or modifications may be made based on the above disclosure, and these changes or modifications are still within the scope of the present disclosure.

Claims

1. A data encryption upgrade method, characterized in that: include: Based on the target encryption parameters generated by the target encryption method, construct a new data table containing the target encryption parameters, wherein the new data table also contains attribute categories and user codes associated with the target encryption parameters; A preset number of dual-read users are set in the transition period, and a verification identifier is set for the dual-read users. In response to the judgment result that the target user has the verification identifier, the actual category information of the target user is retrieved to verify the target encryption parameter to obtain a verification result; wherein the target user refers to the user associated with the category information indicated by the upgrade instruction that needs to be encrypted and upgraded, and the verification identifier is used to indicate the indicator identifier of the target encryption parameter in the new data table when reading the user information, and the verification identifier corresponds to the attribute category to be verified; the number of dual-read users with the verification identifier gradually increases as the transition time goes by until all users with encryption upgrade operations are covered; When the verification result is a verification failure, the original data table containing the actual category information is retrieved to the client; when the verification result is a verification success, the target encryption parameter in the new data table is used as a read object and synchronized to the client; and In response to the end of the transition period, the original data table of the target user is deleted, wherein the transition period is a verification period for the new data table; The constructing of a new data table including the target encryption parameters based on the target encryption parameters generated by the target encryption method comprises: in response to the attribute category to be upgraded in the upgrade instruction, retrieving the actual category information and the user code associated with the attribute category in the original data table of the target user; encrypting the actual category information using the target encryption method to generate the target encryption parameters; and integrating the target encryption parameters and the attribute category and the user code to construct the new data table; Wherein, after constructing a new data table containing the target encryption parameters based on the target encryption parameters generated by the target encryption method, it also includes: migrating the remaining data in the original data table of the target user to the new data table, wherein the target user is the user associated with the new data table.

2. The data encryption upgrade method according to claim 1, characterized in that: The step of retrieving the actual category information of the target user to verify the target encryption parameter in response to the determination result that the target user has the verification identifier includes: When the target user has a verification identifier, retrieve the actual category information of the target user; Processing the target encryption parameters of the target user using a target decryption method to obtain a decryption result associated with the target encryption parameters; and The consistency between the actual category information and the decryption result is determined to complete the verification of the target encryption parameters.

3. The data encryption upgrade method according to claim 2, characterized in that: When the target user has a verification identifier, retrieving the actual category information of the target user includes: When the target user has a verification identifier, determining the attribute category corresponding to the verification identifier; Retrieving original encryption parameters associated with the attribute category from the original data table of the target user; and The original encryption parameters are processed using an original decryption method to decrypt the actual category information corresponding to the original encryption parameters.

4. The data encryption upgrade method according to claim 1, characterized in that: When the verification result is a verification failure, after retrieving the original data table containing the actual category information to the client, it includes: using the target encryption parameter in the new data table as abnormal data, and constructing an alarm message containing the abnormal data.

5. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data encryption upgrade method according to any one of claims 1 to 4 is implemented.

6. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the data encryption upgrade method according to any one of claims 1 to 4.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data encryption upgrade method according to any one of claims 1 to 4 is implemented.

Images