A full-mode database cost transfer method, device, equipment and storage medium

Abstract

The application discloses a full-mesh database cost transfer method, device and equipment and a storage medium. The method comprises the following steps: obtaining an initial structured query language (SQL) statement; replacing constant data in the initial SQL statement with a constant mark to obtain a to-be-executed SQL statement; sending the to-be-executed SQL statement to a server and receiving statement analysis information returned by the server; sending response information comprising real data or encrypted data corresponding to the constant mark to the server according to the statement analysis information, so that the server executes the to-be-executed SQL statement. The method replaces the constant data in the initial SQL statement with the constant mark, sends the replaced SQL statement to the server, analyzes the SQL statement, and transfers the operation of determining whether the constant data needs to be encrypted to the server, so that the overall performance of the full-mesh database is improved by using the high hardware performance of the server.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of information security technology, and in particular to a method, apparatus, device and storage medium for transferring costs of a fully encrypted database. Background Technology

[0002] In a fully encrypted database, users can specify columns in a table as fully encrypted columns. Data in these columns exists in encrypted form throughout all stages of transmission, computation, and storage, significantly improving data security. A fully encrypted database divides the data lifecycle into trusted and untrusted domains. Trusted domains typically include database clients and upper-level user programs; data in trusted domains is considered secure and can be decrypted to expose plaintext information. Untrusted domains are usually the network transmission environment and the database server, including the server's memory and hard drive. Data in untrusted domains must exist in encrypted form throughout; otherwise, a privacy breach is considered to have occurred.

[0003] In most current database application scenarios, the database front-end in the trusted domain generally lacks robust hardware configurations such as computing power and memory capacity. Examples include web services that only provide data visualization functions and middleware that calls database interfaces. Conversely, the database server in the untrusted domain possesses superior hardware performance. However, a significant portion of the work in a fully encrypted database is performed on the database front-end. The parsing of SQL statements by the front-end causes it to consume substantial amounts of memory and time. Furthermore, the poor computing power of the front-end also leads to poor overall performance of the fully encrypted database. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and storage medium for cost transfer of fully dense databases, in order to solve the problem of poor overall performance of fully dense databases in the prior art.

[0005] According to one aspect of the present invention, a fully dense database cost transfer method is provided, applied to a database front-end, the method comprising:

[0006] Obtain the initial Structured Query Language (SQL) statement;

[0007] Replace the constant data in the initial SQL statement with constant markers to obtain the SQL statement to be executed;

[0008] The SQL statement to be executed is sent to the server, and the statement parsing information returned by the server is received.

[0009] Based on the statement parsing information, a response message including the real data or encrypted data corresponding to the constant marker is sent to the server so that the server executes the SQL statement to be executed.

[0010] According to another aspect of the present invention, a fully dense database cost transfer method is provided, applied to a server, the method comprising:

[0011] Receive the SQL statement to be executed sent by the database front-end; wherein, the constant data in the SQL statement to be executed is replaced with constant markers;

[0012] The SQL statement to be executed is parsed according to the fully encrypted metadata table to obtain statement parsing information, and the statement parsing information is sent to the database front end;

[0013] The system receives a response from the database frontend, which includes real or encrypted data corresponding to the constant marker, in order to execute the SQL statement to be executed.

[0014] According to another aspect of the present invention, a fully encrypted database cost transfer device is provided, applied to a database front-end, the device comprising:

[0015] The acquisition module is used to acquire the initial Structured Query Language (SQL) statement;

[0016] The replacement module is used to replace constant data in the initial SQL statement with constant markers to obtain the SQL statement to be executed.

[0017] The first receiving module is used to send the SQL statement to be executed to the server and receive the statement parsing information returned by the server.

[0018] The first sending module is used to send response information, including real data or encrypted data corresponding to the constant marker, to the server according to the statement parsing information, so that the server executes the SQL statement to be executed.

[0019] According to another aspect of the present invention, a fully encrypted database cost transfer apparatus is provided, applied to a server, the apparatus comprising:

[0020] The second receiving module is used to receive the SQL statement to be executed sent by the database front end; wherein, the constant data in the SQL statement to be executed is replaced with constant markers;

[0021] The second sending module is used to parse the SQL statement to be executed according to the fully encrypted metadata table to obtain statement parsing information, and send the statement parsing information to the database front end;

[0022] The execution module is used to receive response information returned by the database front-end, including real data or encrypted data corresponding to the constant marker, in order to execute the SQL statement to be executed.

[0023] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: at least one processor; and

[0024] A memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the fully dense database cost transfer method according to any embodiment of the present invention.

[0026] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the fully dense database cost transfer optimization method according to any embodiment of the present invention.

[0027] This invention discloses a cost transfer method, apparatus, device, and storage medium for a fully encrypted database. The method includes: obtaining an initial Structured Query Language (SQL) statement; replacing constant data in the initial SQL statement with constant markers to obtain an SQL statement to be executed; sending the SQL statement to be executed to a server and receiving statement parsing information returned by the server; and sending response information, including real data or encrypted data corresponding to the constant markers, to the server based on the statement parsing information, so that the server executes the SQL statement to be executed. This method, by replacing constant data in the initial SQL statement with constant markers and sending the replaced SQL statement to the server, analyzes the SQL statement to transfer the operation of determining whether the constant data needs to be encrypted to the server. This allows the higher hardware performance of the server to improve the overall performance of the fully encrypted database, solving the problem of poor overall performance of fully encrypted databases in the prior art.

[0028] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a flowchart illustrating a fully dense database cost transfer method provided in Embodiment 1 of the present invention;

[0031] Figure 2 This is a flowchart illustrating a fully dense database cost transfer method provided in Embodiment 2 of the present invention;

[0032] Figure 3 This is a schematic diagram of the structure of a fully dense database cost transfer device provided in Embodiment 3 of the present invention;

[0033] Figure 4 This is a schematic diagram of a fully dense database cost transfer device provided in Embodiment 4 of the present invention;

[0034] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention. It should be understood that the various steps described in the method embodiments of the present invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0036] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0037] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0038] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0039] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0040] Example 1

[0041] Figure 1 This is a flowchart illustrating a fully encrypted database cost transfer method provided in Embodiment 1 of the present invention. The method is applied to the database front-end, specifically applicable to situations where a fully encrypted database is accessed via SQL statements. The method can be executed by a fully encrypted database cost transfer device, which can be implemented by software and / or hardware and is generally integrated into an electronic device. In this embodiment, the electronic device includes, but is not limited to, devices such as the database front-end.

[0042] like Figure 1 As shown, the fully dense database cost transfer method provided in Embodiment 1 of the present invention includes the following steps:

[0043] S110. Obtain the initial Structured Query Language (SQL) statement.

[0044] Structured Query Language (SQL) can be a language used to manage relational database management systems. SQL encompasses data insertion, querying, updating, and deleting; database schema creation and modification; and data access control. Databases can be accessed and manipulated through SQL. The initial SQL statement can be any SQL statement that performs operations on the database. The initial SQL statement can be entered by the user or preset. This embodiment does not limit the type of the initial SQL statement; for example, it can be an insert statement, query statement, update statement, delete statement, or other statements.

[0045] In this embodiment, the database front-end can obtain the SQL statement input by the user and use it as the initial SQL statement. The database front-end can be a client that needs to use the database.

[0046] S120. Replace the constant data in the initial SQL statement with constant markers to obtain the SQL statement to be executed.

[0047] In this context, constant data can be quantities in the initial SQL statement that are assigned a specific meaning and cannot be changed. For example, if a data table includes two columns: name and age, when the initial SQL statement sets name = A and age = B, then A and B are constant data in the initial SQL statement. Constant markers can be labels applied to constant data. The type of constant marker can be set according to the actual situation, and this embodiment does not limit this. For example, a constant marker can be the symbol "?", which replaces constant data with the symbol "?". The SQL statement to be executed can be an SQL statement in which constant data is replaced with constant markers.

[0048] In this embodiment, after the database frontend obtains the initial SQL statement, it performs simple lexical analysis to identify all constant data in the initial SQL statement and replaces all constant data with constant markers to obtain the replaced SQL statement to be executed. For example, when a user queries the database frontend for the phone number of the person whose ID column value is 1369 and whose NAME column value is 'YUESONG' in the TBL table, the SQL statement is as follows:

[0049] SELECT PHONE FROM TBL WHERE ID=1369AND NAME='YUESONG';

[0050] The constant data includes the integer 1369 and the string 'YUESONG'. The database frontend can replace the above constant data with the constant marker "?". The SQL statement after the replacement is:

[0051] SELECT PHONE FROM TBL WHERE ID=? AND NAME=? ;

[0052] S130. Send the SQL statement to be executed to the server and receive the statement parsing information returned by the server.

[0053] The server is responsible for receiving requests from the frontend and processing the data sent to the frontend. Statement parsing information can be the information obtained after parsing the SQL statement to be executed. This information may include the tag number corresponding to constant tags and fully encrypted information.

[0054] In this embodiment, the database front-end can send the SQL statement to be executed to the server and receive the statement parsing information returned by the server. The statement parsing information can be used to determine whether constant data needs to be encrypted.

[0055] S140. Based on the statement parsing information, a response information including the real data or encrypted data corresponding to the constant marker is sent to the server so that the server executes the SQL statement to be executed.

[0056] The real data can be unencrypted, and the encrypted data can be encrypted. The response information can be information including constant data sent from the database front-end to the server.

[0057] In this embodiment, the database front-end determines whether the constant data corresponding to the constant marker needs to be encrypted by parsing the statement information. If encryption is required, the constant data is encrypted and added to the response information. If encryption is not required, the actual data of the constant data is directly added to the response information and the response information is sent to the server.

[0058] In one embodiment, sending response information, including real data or encrypted data corresponding to the constant marker, to the server based on the statement parsing information includes:

[0059] For each constant marker in the parsed statement information, determine whether the constant marker has corresponding fully encrypted information; if so, encrypt the real data corresponding to the constant marker according to the fully encrypted information to obtain encrypted data, and add the encrypted data corresponding to the constant marker and the marker number to the response information; if not, add the real data corresponding to the constant marker and the marker number to the response information; and send the response information to the server.

[0060] The fully encrypted information can be the encrypted information of table columns, which may include table identifier, column identifier, encryption key, encryption algorithm, etc. The table identifier can be a unique identifier of the table to which the constant data belongs, the column identifier can be a unique identifier of the column to which the constant data belongs, the encryption key can be the encryption key used, and the encryption algorithm can be the encryption algorithm used. The table identifier, column identifier, encryption key, and encryption algorithm can all be customized when creating the data table or in subsequent processes; this embodiment does not limit this. The tag number can be the number of a constant tag, which can be a number assigned on the server side.

[0061] In this embodiment, for each constant marker in the statement parsing information, the database frontend first determines whether there is corresponding fully encrypted information for that constant marker. If not, it obtains the real data corresponding to the current constant marker and adds the marker number of the current constant marker and the real data to the response information. If there is, it obtains the real data corresponding to the current constant marker, then encrypts the real data according to the fully encrypted information (encryption key, encryption algorithm), and adds the marker number of the current constant marker and the encrypted data to the response information. After all constant markers in the statement parsing information have been processed, the database frontend sends the response information to the server.

[0062] This invention provides a cost transfer method for a fully encrypted database, comprising: obtaining an initial Structured Query Language (SQL) statement; replacing constant data in the initial SQL statement with constant markers to obtain an SQL statement to be executed; sending the SQL statement to be executed to a server and receiving statement parsing information returned by the server; and sending response information, including real data or encrypted data corresponding to the constant markers, to the server according to the statement parsing information, so that the server executes the SQL statement to be executed. This method, by replacing constant data in the initial SQL statement with constant markers and sending the replaced SQL statement to the server, and by analyzing the SQL statement to transfer the operation of determining whether the constant data needs to be encrypted to the server, can utilize the higher hardware performance of the server to improve the overall performance of the fully encrypted database, thus solving the problem of poor overall performance of fully encrypted databases in the prior art.

[0063] Based on the above embodiments, modified embodiments of the above embodiments are proposed. It should be noted that, in order to keep the description brief, only the differences from the above embodiments are described in the modified embodiments.

[0064] In one embodiment, the method further includes:

[0065] Receive statement execution information returned by the server; determine whether the target column in the statement execution information includes fully encrypted information; if so, decrypt the column data corresponding to the target column according to the fully encrypted information in the statement execution information to obtain a plaintext result set.

[0066] The statement execution information can be the execution result of the SQL statement to be executed, queried with encrypted information. This information may include the target column identifier, column data, and fully encrypted information of the target column. The target column can be a column from the SQL statement execution result. The plaintext result set can be the decrypted statement execution information.

[0067] In this embodiment, after the database front-end receives the statement execution information, it can determine whether the target column includes fully encrypted information based on the statement execution information. If so, the target column needs to be decrypted before the real data can be obtained. The target column data can be decrypted through the fully encrypted information corresponding to the target column to obtain the final plaintext result set.

[0068] In one embodiment, the method further includes:

[0069] If the created data table includes a fully encrypted column, the fully encrypted information of the fully encrypted column is sent to the server.

[0070] Among them, the fully encrypted column can be the column that needs to be encrypted.

[0071] In this embodiment, if the user specifies a column as a fully encrypted column when creating a data table, the database front-end can send the fully encrypted information of the fully encrypted column to the server, and the server can store the fully encrypted information in the fully encrypted metadata table.

[0072] For example, suppose a user creates a table named TBL in the database. This table contains three columns: ID, NAME, and PHONE. The ID and PHONE columns are specified as fully encrypted, using encryption keys CK1 and CK2 respectively. Both encryption keys correspond to the encryption algorithm EA. The table creation statement is as follows:

[0073] CREATE TABLE TBL(

[0074] ID INT FULL ENCRYPT WITH CK1,

[0075] NAME VARCHAR(20),

[0076] PHONE VARCHAR(20)FULL ENCRYPT WITH CK2 );

[0078] When the above data table is created, the server will save the fully encrypted information of the TBL table to the fully encrypted metadata table. After the data table is created, the fully encrypted metadata table will contain two records, as follows:

[0079] Table identifier TBL, column identifier ID, encryption key CK1, encryption algorithm EA;

[0080] Table identifier TBL, column identifier PHONE, encryption key CK2, encryption algorithm EA.

[0081] The table identifier can be set to a table number, and the column identifier can be set to a column number. Each object in the database has its own unique number, which can be used to directly locate the database object. The fully encrypted metadata table can also store basic information such as the data type of each column, which will not be elaborated here. In subsequent processes, the server can obtain the fully encrypted information of the table columns by querying the fully encrypted metadata table.

[0082] In existing fully encrypted databases, a significant amount of work is performed at the database front-end. The front-end first parses SQL statements (performing lexical, syntactic, and partial semantic analysis) to extract private data. This private data is then encrypted, resulting in a plaintext SQL statement that does not contain the private data. This encrypted statement is then sent to the database server in an untrusted domain for execution. The execution result, still encrypted, is transmitted back to the front-end via the untrusted domain. The front-end then decrypts the data to obtain the final plaintext private data. However, this method results in the database front-end program consuming a large amount of memory and time for SQL statement parsing. This embodiment addresses this by offloading as much of the fully encrypted work from the front-end as possible to a high-performance database server. Utilizing the server's powerful hardware configuration and computing capabilities, this reduces execution time and lowers the overhead for the database client and user programs, thereby improving overall performance.

[0083] Example 2

[0084] Figure 2 This is a flowchart illustrating a fully encrypted database cost transfer method according to Embodiment 2 of the present invention. This method is applied to a server, specifically applicable to the analysis and execution of SQL statements. The method can be executed by a fully encrypted database cost transfer device, which can be implemented in software and / or hardware and is generally integrated into an electronic device. In this embodiment, the electronic device includes, but is not limited to, a server. For details not covered in this embodiment, please refer to Embodiment 1.

[0085] like Figure 2 As shown, Embodiment 2 of the present invention provides a fully dense database cost transfer method, which includes the following steps:

[0086] S210, Receive the SQL statement to be executed sent by the database front end; wherein, the constant data in the SQL statement to be executed is replaced with constant markers.

[0087] The SQL statement to be executed can be an SQL statement in which constant data is replaced with constant markers. Constant data can be a quantity in the initial SQL statement that has been assigned a meaning and cannot be changed. Constant markers can be markings applied to constant data; the type of constant marker can be set according to the actual situation, and this embodiment does not limit this. For example, a constant marker can be the symbol "?", that is, constant data is replaced with the symbol "?".

[0088] In this embodiment, the server can receive SQL statements to be executed sent by the database frontend. For example, the SQL statement to be executed received by the server could be: SELECT PHONE FROM TBL WHERE ID=? AND NAME=?.

[0089] S220. Parse the SQL statement to be executed according to the fully encrypted metadata table to obtain statement parsing information, and send the statement parsing information to the database front end.

[0090] The fully encrypted metadata table can be a table that stores fully encrypted information. This fully encrypted information can be the encrypted information of table columns, and may include table identifiers, column identifiers, encryption keys, encryption algorithms, etc. The statement parsing information can be the information obtained after parsing the SQL statement to be executed. This information may include the tag number corresponding to the constant tag and the fully encrypted information.

[0091] In this embodiment, after receiving the SQL statement to be executed, the server can treat the constant markers as pseudo-data, parse the SQL according to the conventional process, and generate an execution plan. After the execution plan is generated, the server obtains the real data or encrypted data corresponding to the constant markers from the database frontend through the statement parsing information.

[0092] In one embodiment, parsing the SQL statement to be executed based on the fully encrypted metadata table to obtain statement parsing information includes:

[0093] For each constant tag corresponding to a table column, query the fully encrypted metadata table to see if the table column is a fully encrypted column; if so, obtain the fully encrypted information corresponding to the table column, and add the tag number corresponding to the constant tag and the fully encrypted information to the statement parsing information; if not, add the tag number corresponding to the constant tag to the statement parsing information.

[0094] The table columns can be columns of the data table corresponding to constant markers. The fully encrypted columns can be the columns that need to be encrypted.

[0095] In this embodiment, during the parsing phase of the SQL statement to be executed, for each constant marker corresponding to a table column, the server can query the fully encrypted metadata table to determine whether the table column is a fully encrypted column. If so, the server obtains the corresponding fully encrypted information for that column and adds the current constant marker number (for example, the number of the first constant marker in the SQL statement to be executed can be 1, the number of the second constant marker can be 2, and so on) and the corresponding fully encrypted information to the statement parsing information; otherwise, the server directly adds the current constant marker number to the statement parsing information. After the SQL statement to be executed is parsed and an execution plan is generated, the server sends the statement parsing information to the database frontend.

[0096] S230. Receive the response information returned by the database front-end, which includes the real data or encrypted data corresponding to the constant marker, in order to execute the SQL statement to be executed.

[0097] The real data can be unencrypted, and the encrypted data can be encrypted. The response information can be information including constant data sent from the database front-end to the server.

[0098] In this embodiment, after receiving the response information sent by the database front-end, the server can replace the constant markers in the execution plan with the corresponding real data or encrypted data, and then execute the SQL statement to be executed according to the execution plan.

[0099] In one embodiment, receiving the response information returned by the database frontend, including the real data or encrypted data corresponding to the constant marker, to execute the SQL statement to be executed includes:

[0100] For each constant marker in the response information, the position corresponding to the constant marker is queried in the execution plan corresponding to the SQL statement to be executed according to the marker number; the constant marker in the position is replaced with the real data or encrypted data of the constant marker; after each constant marker in the response information has been processed, the SQL statement to be executed is executed according to the execution plan.

[0101] The execution plan can be the specific steps the database takes to execute SQL statements, such as whether to access data in the table through an index or a full table scan, the implementation method of join queries, and the order of joins.

[0102] In this embodiment, for each constant marker in the response information, the server locates the corresponding constant marker in the execution plan of the SQL statement to be executed based on its marker number, and replaces the constant marker with the corresponding real data or encrypted data in the response information. After all constant markers in the response information have been processed, the server can execute the SQL statement to be executed according to the execution plan.

[0103] This invention provides a cost transfer method for a fully encrypted database, comprising: receiving an SQL statement to be executed sent by a database frontend; wherein constant data in the SQL statement to be executed is replaced with constant markers; parsing the SQL statement to be executed according to a fully encrypted metadata table to obtain statement parsing information, and sending the statement parsing information to the database frontend; receiving response information returned by the database frontend including real data or encrypted data corresponding to the constant markers, to execute the SQL statement to be executed. This method parses the SQL statement to be executed sent by the database frontend using a fully encrypted metadata table, obtains statement parsing information, and sends the statement parsing information to the database frontend. This allows the operation of determining whether constant data needs to be encrypted to be transferred to the server, thereby utilizing the higher hardware performance of the server to improve the overall performance of the fully encrypted database and solving the problem of poor overall performance of fully encrypted databases in the prior art.

[0104] In one embodiment, after executing the SQL statement to be executed, the method further includes:

[0105] Obtain the execution result set of the SQL statement to be executed, the execution result set including the target column identifier and column data corresponding to the target column; for each target column in the execution result set, determine whether the target column is a fully encrypted column according to the fully encrypted metadata table; if yes, add the target column identifier, column data and fully encrypted information corresponding to the target column to the statement execution information; if no, add the target column identifier and column data to the statement execution information; send the statement execution information to the database front end.

[0106] The execution result set can be the execution result of the SQL statement to be executed. The statement execution information can be the execution result of the SQL statement to be executed after being queried with encrypted information.

[0107] In this embodiment, after executing the SQL statement to be executed, the server obtains an execution result set, which includes the target column identifier (e.g., PHONE) and the corresponding column data. For each target column in the execution result set, the server can query the fully encrypted metadata table to determine whether the current target column is a fully encrypted column. If it is, the server adds the current target column identifier, the target column data, and the corresponding fully encrypted information to the statement execution information; otherwise, it directly adds the current target column identifier and the target column data to the statement execution information. After all target columns have been processed, the server sends the statement execution information to the database frontend.

[0108] In one embodiment, the method further includes:

[0109] Receive the fully encrypted information of the fully encrypted column sent by the database front end; store the fully encrypted information in the fully encrypted metadata table.

[0110] In this embodiment, the server can update the fully encrypted metadata table maintained on the server based on the fully encrypted information of the fully encrypted column sent by the database front-end.

[0111] This embodiment uses a server to maintain all fully encrypted information in the current system. For an SQL statement to be executed, the database frontend performs only simple lexical analysis, replacing all constant data with constant markers, and then sends the SQL statement to the server. The server performs syntax and semantic analysis on the SQL statement and generates an execution plan. After the execution plan is generated, the server sends the constant markers and fully encrypted information to the database frontend to obtain the constant data. The database frontend encrypts the constant data that needs encryption and then sends all the constant data to the server. The server fills the execution plan with the constant data, executes the SQL statement to obtain the execution result, and sends the execution result and fully encrypted information back to the database frontend. The database frontend decrypts the execution result to obtain the final plaintext result. By transferring the syntax and semantic analysis of the SQL statement to the server, the overall performance of the fully encrypted database is greatly improved by utilizing the server's higher hardware performance, avoiding large memory consumption by the database frontend program. Simultaneously, the plaintext of the private data only appears in the trusted domain throughout the entire process, meeting the requirements of fully encrypted technology.

[0112] Example 3

[0113] Figure 3 This is a schematic diagram of a fully encrypted database cost transfer device provided in Embodiment 3 of the present invention. The device is applicable to situations where a fully encrypted database is accessed via SQL statements. The device can be implemented by software and / or hardware and is generally integrated on the database front end.

[0114] like Figure 3 As shown, the device includes:

[0115] Module 310 is used to obtain the initial Structured Query Language (SQL) statement;

[0116] Replacement module 320 is used to replace constant data in the initial SQL statement with constant markers to obtain the SQL statement to be executed;

[0117] The first receiving module 330 is used to send the SQL statement to be executed to the server and receive the statement parsing information returned by the server.

[0118] The first sending module 340 is used to send response information, including real data or encrypted data corresponding to the constant marker, to the server according to the statement parsing information, so that the server executes the SQL statement to be executed.

[0119] This embodiment provides a cost transfer device for a fully encrypted database. The device includes an acquisition module for acquiring an initial Structured Query Language (SQL) statement; a replacement module for replacing constant data in the initial SQL statement with constant markers to obtain an SQL statement to be executed; a first receiving module for sending the SQL statement to be executed to a server and receiving statement parsing information returned by the server; and a first sending module for sending response information, including real data or encrypted data corresponding to the constant markers, to the server based on the statement parsing information, so that the server executes the SQL statement to be executed. By replacing constant data in the initial SQL statement with constant markers and sending the replaced SQL statement to the server, the analysis of the SQL statement to determine whether the constant data needs to be encrypted is transferred to the server. This allows the higher hardware performance of the server to improve the overall performance of the fully encrypted database, solving the problem of poor overall performance of fully encrypted databases in the prior art.

[0120] Furthermore, the first transmitting module 340 includes:

[0121] For each constant marker in the parsed statement information, determine whether the constant marker has corresponding fully encrypted information;

[0122] If so, the real data corresponding to the constant mark is encrypted according to the full-state encryption information to obtain encrypted data, and the encrypted data corresponding to the constant mark and the mark number are added to the response information;

[0123] If not, add the actual data corresponding to the constant marker and the marker number to the response information;

[0124] The response information is sent to the server.

[0125] Furthermore, the device also includes:

[0126] Receive statement execution information returned by the server;

[0127] Determine whether the target column in the statement execution information includes fully encrypted information;

[0128] If so, the column data corresponding to the target column is decrypted according to the fully encrypted information in the statement execution information to obtain the plaintext result set.

[0129] Furthermore, the device also includes:

[0130] If the created data table includes a fully encrypted column, the fully encrypted information of the fully encrypted column is sent to the server.

[0131] The above-described fully dense database cost transfer device can execute the fully dense database cost transfer method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0132] Example 4

[0133] Figure 4 This is a schematic diagram of a fully encrypted database cost transfer device provided in Embodiment 4 of the present invention. The device is applicable to the analysis and execution of SQL statements. The device can be implemented by software and / or hardware and is generally integrated on a server.

[0134] like Figure 4 As shown, the device includes:

[0135] The second receiving module 410 is used to receive the SQL statement to be executed sent by the database front end; wherein, the constant data in the SQL statement to be executed is replaced with constant markers;

[0136] The second sending module 420 is used to parse the SQL statement to be executed according to the fully encrypted metadata table to obtain statement parsing information, and send the statement parsing information to the database front end;

[0137] The execution module 430 is used to receive response information returned by the database front end, including real data or encrypted data corresponding to the constant marker, in order to execute the SQL statement to be executed.

[0138] This fourth embodiment provides a fully encrypted database cost transfer device. A second receiving module receives an SQL statement to be executed sent from a database frontend; wherein constant data in the SQL statement to be executed is replaced with constant markers. A second sending module parses the SQL statement to be executed according to a fully encrypted metadata table to obtain statement parsing information, and sends the statement parsing information to the database frontend. An execution module receives response information returned by the database frontend, including real data or encrypted data corresponding to the constant markers, to execute the SQL statement to be executed. By parsing the SQL statement to be executed sent from the database frontend using a fully encrypted metadata table to obtain statement parsing information and sending the statement parsing information to the database frontend, the operation of determining whether constant data needs to be encrypted can be transferred to the server. This utilizes the higher hardware performance of the server to improve the overall performance of the fully encrypted database, solving the problem of poor overall performance of fully encrypted databases in the prior art.

[0139] Furthermore, the second transmitting module 420 includes:

[0140] For each constant marker corresponding to a table column, query the fully encrypted metadata table to see if the table column is a fully encrypted column;

[0141] If so, obtain the fully encrypted information corresponding to the column in the table, and add the tag number corresponding to the constant tag and the fully encrypted information to the statement parsing information;

[0142] If not, add the tag number corresponding to the constant tag to the statement parsing information.

[0143] Furthermore, the execution module 430 includes:

[0144] For each constant marker in the response information, the position corresponding to the constant marker is queried in the execution plan corresponding to the SQL statement to be executed according to the marker number;

[0145] Replace the constant markers in the aforementioned locations with the actual data or encrypted data of the constant markers;

[0146] After each constant flag in the response information has been processed, the SQL statement to be executed is executed according to the execution plan.

[0147] Furthermore, following execution module 430, the following are also included:

[0148] Obtain the execution result set of the SQL statement to be executed, wherein the execution result set includes the target column identifier and column data corresponding to the target column;

[0149] For each target column in the execution result set, determine whether the target column is a fully encrypted column based on the fully encrypted metadata table;

[0150] If so, the target column identifier, column data, and fully encrypted information corresponding to the target column are added to the statement execution information;

[0151] If not, the target column identifier and column data are added to the statement execution information;

[0152] The statement execution information is sent to the database front end.

[0153] Furthermore, the device also includes:

[0154] Receive fully encrypted information of the fully encrypted column sent by the database front-end;

[0155] The fully encrypted information is stored in the fully encrypted metadata table.

[0156] The above-described fully dense database cost transfer device can execute the fully dense database cost transfer method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0157] Example 5

[0158] Figure 5 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device can be a database front-end or a server, and specifically can be various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0159] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0160] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0161] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the fully dense database cost transfer method.

[0162] In some embodiments, the fully encrypted database cost transfer method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the fully encrypted database cost transfer method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the fully encrypted database cost transfer method by any other suitable means (e.g., by means of firmware).

[0163] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0164] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0165] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0166] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0167] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0168] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0169] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0170] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A cost transfer method for a fully dense database, characterized in that, Applied to the database front end, the method includes: Obtain the initial Structured Query Language (SQL) statement; The constant data in the initial SQL statement is replaced with constant markers to obtain the SQL statement to be executed; the constant data is a quantity in the initial SQL statement that is assigned a certain meaning and cannot be changed, and the constant marker is a marker for the constant data; The SQL statement to be executed is sent to the server, and the statement parsing information returned by the server is received. The response information, including the real data or encrypted data corresponding to the constant marker, is sent to the server based on the statement parsing information, so that the server executes the SQL statement to be executed; the real data is unencrypted constant data.

2. The method according to claim 1, characterized in that, The step of sending response information, including real or encrypted data corresponding to the constant marker, to the server based on the statement parsing information includes: For each constant marker in the parsed statement information, determine whether the constant marker has corresponding fully encrypted information; If so, the real data corresponding to the constant mark is encrypted according to the full-state encryption information to obtain encrypted data, and the encrypted data corresponding to the constant mark and the mark number are added to the response information; If not, add the actual data corresponding to the constant marker and the marker number to the response information; The response information is sent to the server.

3. The method according to claim 1, characterized in that, The method further includes: Receive statement execution information returned by the server; Determine whether the target column in the statement execution information includes fully encrypted information; If so, the column data corresponding to the target column is decrypted according to the fully encrypted information in the statement execution information to obtain the plaintext result set.

4. The method according to claim 1, characterized in that, The method further includes: If the created data table includes a fully encrypted column, the fully encrypted information of the fully encrypted column is sent to the server.

5. A cost transfer method for a fully dense database, characterized in that, Applied to a server, the method includes: Receive an SQL statement to be executed sent from the database front end; wherein, constant data in the SQL statement to be executed is replaced with constant markers; the constant data is a quantity in the initial SQL statement that is assigned a certain meaning and cannot be changed, and the constant marker is a marker for the constant data; The SQL statement to be executed is parsed according to the fully encrypted metadata table to obtain statement parsing information, and the statement parsing information is sent to the database front end; The system receives a response from the database frontend, which includes either real or encrypted data corresponding to the constant marker, to execute the SQL statement to be executed; the real data is unencrypted constant data.

6. The method according to claim 5, characterized in that, The step of parsing the SQL statement to be executed based on the fully encrypted metadata table to obtain statement parsing information includes: For each constant marker corresponding to a table column, query the fully encrypted metadata table to see if the table column is a fully encrypted column; If so, obtain the fully encrypted information corresponding to the column in the table, and add the tag number corresponding to the constant tag and the fully encrypted information to the statement parsing information; If not, add the tag number corresponding to the constant tag to the statement parsing information.

7. The method according to claim 6, characterized in that, The step of receiving the response information returned by the database frontend, including the real data or encrypted data corresponding to the constant marker, to execute the SQL statement to be executed includes: For each constant marker in the response information, the position corresponding to the constant marker is queried in the execution plan corresponding to the SQL statement to be executed according to the marker number; Replace the constant markers in the aforementioned locations with the actual data or encrypted data of the constant markers; After each constant flag in the response information has been processed, the SQL statement to be executed is executed according to the execution plan.

8. The method according to claim 5, characterized in that, After executing the SQL statement to be executed, the following is also included: Obtain the execution result set of the SQL statement to be executed, wherein the execution result set includes the target column identifier and column data corresponding to the target column; For each target column in the execution result set, determine whether the target column is a fully encrypted column based on the fully encrypted metadata table; If so, the target column identifier, column data, and fully encrypted information corresponding to the target column are added to the statement execution information; If not, the target column identifier and column data are added to the statement execution information; The statement execution information is sent to the database front end.

9. The method according to claim 5, characterized in that, The method further includes: Receive fully encrypted information of the fully encrypted column sent by the database front-end; The fully encrypted information is stored in the fully encrypted metadata table.

10. A cost transfer device for a fully dense database, characterized in that, The device, applied to the front end of a database, includes: The acquisition module is used to acquire the initial Structured Query Language (SQL) statement; The replacement module is used to replace constant data in the initial SQL statement with constant markers to obtain the SQL statement to be executed; the constant data is a quantity in the initial SQL statement that is assigned a certain meaning and cannot be changed, and the constant marker is a marker for the constant data; The first receiving module is used to send the SQL statement to be executed to the server and receive the statement parsing information returned by the server. The first sending module is used to send response information, including real data or encrypted data corresponding to the constant marker, to the server according to the statement parsing information, so that the server executes the SQL statement to be executed; the real data is unencrypted constant data.

11. A cost transfer device for a fully dense database, characterized in that, Applied to a server, the device includes: The second receiving module is used to receive the SQL statement to be executed sent by the database front end; wherein, the constant data in the SQL statement to be executed is replaced with constant markers; the constant data is a quantity in the initial SQL statement that is assigned a certain meaning and cannot be changed, and the constant marker is a marker for the constant data; The second sending module is used to parse the SQL statement to be executed according to the fully encrypted metadata table to obtain statement parsing information, and send the statement parsing information to the database front end; The execution module is used to receive response information returned by the database front-end, including real data or encrypted data corresponding to the constant marker, in order to execute the SQL statement to be executed; the real data is unencrypted constant data.

12. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, which enables the at least one processor to perform the full-dense database cost transfer method according to any one of claims 1-4 or 5-9.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the fully encrypted database cost transfer method according to any one of claims 1-4 or 5-9.

Images