Data processing method and device, equipment and computer readable storage medium

Abstract

The application discloses a data processing method, device and equipment and a computer readable storage medium. The data processing method comprises the following steps: obtaining a first data processing statement for a target database generated by an application service, the target database comprising at least one encrypted field and a corresponding index field, and the target database storing ciphertext data for the at least one encrypted field; in the case that the first data processing statement comprises first field information corresponding to the first encrypted field, modifying the first field information in the first data processing statement to obtain a second data processing statement comprising second field information corresponding to the first index field; and executing the second data processing statement to process the ciphertext data corresponding to the first encrypted field according to the second field information in the target database. The embodiment of the application can reduce resource waste, reduce the risk of business code errors, reduce the impact on data processing performance, and effectively prevent DBA risks.

Description

Technical Field

[0001] This application belongs to the field of data storage technology, and in particular relates to a data processing method, apparatus, device and computer-readable storage medium. Background Technology

[0002] As users pay increasing attention to data security, more and more applications and services have the need to encrypt and store sensitive data.

[0003] Currently, common data processing methods related to encrypted data storage mainly include application encryption, proxy encryption, and tablespace encryption. However, all of these methods have various problems. For example, application encryption requires separate development and modification of the business code for each application service with encryption requirements, wasting human and material resources and increasing the risk of errors in the business code. Proxy encryption requires additional proxy nodes, which can impact data processing performance in scenarios with large data volumes and high concurrency. Tablespace encryption, because plaintext data is stored in memory at runtime, makes it difficult to prevent DBA (Distributed Backdoor Attacks) risks.

[0004] In summary, existing data processing methods related to encrypted storage suffer from problems such as wasted resources, high risk of errors in business code, impact on data processing performance, and difficulty in preventing DBA risks. Summary of the Invention

[0005] This application provides a data processing method, apparatus, device, and computer-readable storage medium, which can reduce resource waste, lower the risk of errors in business code, reduce the impact on data processing performance, and effectively prevent DBA risks.

[0006] In a first aspect, embodiments of this application provide a data processing method, the method comprising:

[0007] Obtain the first data processing statement generated by the application service for the target database, wherein the target database includes at least one encrypted field and its corresponding index field, and the target database stores ciphertext data for the at least one encrypted field.

[0008] If the first data processing statement contains first field information corresponding to the first encrypted field, the first field information in the first data processing statement is modified to obtain a second data processing statement containing second field information corresponding to the first index field, wherein the first encrypted field is any encrypted field among the at least one encrypted field, and the first index field is the index field corresponding to the first encrypted field.

[0009] The second data processing statement is executed to process the ciphertext data corresponding to the first encrypted field in the target database according to the second field information.

[0010] Secondly, embodiments of this application provide a data processing apparatus, the apparatus comprising:

[0011] The statement acquisition module is used to acquire the first data processing statement generated by the application service for the target database, wherein the target database includes at least one encrypted field and its corresponding index field, and the target database stores ciphertext data for the at least one encrypted field.

[0012] The statement modification module is used to modify the first field information in the first data processing statement when the first data processing statement contains first field information corresponding to the first encrypted field, so as to obtain a second data processing statement containing second field information corresponding to the first index field, wherein the first encrypted field is any encrypted field among the at least one encrypted field, and the first index field is an index field corresponding to the first encrypted field.

[0013] The statement execution module is used to execute the second data processing statement to process the ciphertext data corresponding to the first encrypted field in the target database according to the second field information.

[0014] Thirdly, embodiments of this application provide an electronic device, which includes: a processor and a memory storing computer program instructions;

[0015] When the processor executes the computer program instructions, it implements the steps of the data processing method as described in any embodiment of the first aspect.

[0016] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the steps of the data processing method as described in any embodiment of the first aspect.

[0017] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the steps of the data processing method as described in any embodiment of the first aspect.

[0018] The data processing method, apparatus, device, and computer-readable storage medium in this application intercept a first data processing statement generated by an application service targeting a target database and modify the field information corresponding to any encrypted field in the target database within the first data processing statement. Specifically, if the first data processing statement contains first field information corresponding to a first encrypted field, the first field information is modified to generate a second data processing statement containing second field information corresponding to a first index field. This allows the target database to store predefined encrypted fields in ciphertext without requiring code modification to the application service. The application service can also utilize the second field information of the first index field corresponding to the first encrypted field to process the ciphertext data corresponding to the first encrypted field, thus decoupling the data processing code from the application service's business code, reducing resource waste and lowering the risk of errors in the business code. Furthermore, since this application embodiment does not require the deployment of additional proxy nodes, the impact on data processing performance is reduced. Simultaneously, because the target database in this application embodiment stores ciphertext data for encrypted fields, DBA risks can be effectively prevented. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic flowchart of a data processing method provided in one embodiment of this application;

[0021] Figure 2 This is an architecture diagram applicable to the data processing method provided in this application;

[0022] Figure 3 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application;

[0023] Figure 4 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0024] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0025] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0026] To address the problems of the prior art, embodiments of this application provide a data processing method, apparatus, device, and computer-readable storage medium. This data processing method can be applied to scenarios involving the processing of encrypted stored data. The data processing method provided in this application embodiment is described below.

[0027] Figure 1 This is a schematic flowchart of a data processing method provided in one embodiment of this application. The data processing method can be executed by an application, which can be a terminal or server including one or more application services.

[0028] like Figure 1 As shown, this data processing method may specifically include the following steps:

[0029] S110. Obtain the first data processing statement for the target database generated by the application service. The target database includes at least one encrypted field and its corresponding index field. The target database stores ciphertext data for the at least one encrypted field.

[0030] S120. If the first data processing statement contains first field information corresponding to the first encrypted field, the first field information in the first data processing statement is modified to obtain a second data processing statement containing second field information corresponding to the first index field, wherein the first encrypted field is any encrypted field among at least one encrypted field, and the first index field is the index field corresponding to the first encrypted field.

[0031] S130. Execute the second data processing statement to process the ciphertext data corresponding to the first encrypted field in the target database according to the second field information.

[0032] Therefore, by intercepting the first data processing statement generated by the application service targeting the target database and modifying the field information corresponding to any encrypted field in the target database within the first data processing statement—that is, when the first data processing statement contains the first field information corresponding to the first encrypted field—the first field information is modified to generate a second data processing statement containing the second field information corresponding to the first index field. In this way, the target database can store predefined encrypted fields in ciphertext without requiring code modification to the application service. The application service can also use the second field information of the first index field corresponding to the first encrypted field to process the ciphertext data corresponding to the first encrypted field, thus decoupling the data processing code from the application service's business code, thereby reducing resource waste and lowering the risk of errors in the business code. Furthermore, since this embodiment does not require the deployment of additional proxy nodes, the impact on data processing performance is reduced. Simultaneously, since the target database in this embodiment stores ciphertext data for encrypted fields, DBA risks can be effectively prevented.

[0033] The specific implementation methods for each of the above steps are described below.

[0034] In some implementations, in S110, the application service can be any application service within an application system, where the application system may include multiple application services. Additionally, the target database can be any type of database capable of supporting data storage, such as an SQL (Structured Query Language) database. The target database may store one or more data tables, where at least one data table may store ciphertext data corresponding to one or more encrypted fields; that is, the target database stores ciphertext data for predefined encrypted fields.

[0035] The first data processing statement can be a statement used to perform CRUD operations on data in the target database. For example, if the target database is an SQL database, the first data processing statement can be an SQL statement. The first data processing statement can include statements of the types such as query statements, insert statements, update statements, and delete statements.

[0036] In addition, in some embodiments, prior to S110 above, the data processing method provided in this application embodiment may further include:

[0037] Set the first hook point for the database connection interface.

[0038] Based on this, the above-mentioned S110 may specifically include:

[0039] When the application service calls the database connection interface, the first hook point is intercepted, and the first data processing statement for the target database is obtained from the database connection interface through the first hook point.

[0040] Here, the database connection interface can be an interface used to connect to a database, such as the `prepareStatement` function in the `ConnectionImpl` class, or the `execute` function in the `StatementImpl` class. Additionally, the first hook point can be a hook point set using hook technology for functions related to the database connection interface. By setting hook points, specific functions can be intercepted, allowing the acquisition of function parameter information and the execution of custom code before and after function calls.

[0041] For example, by intercepting the hook point set in the prepareStatement or execute function, the SQL statement used as parameter information can be obtained from the prepareStatement or execute function and used as the first data processing statement.

[0042] In some implementations, in S120, the first data processing statement can be analyzed according to a preset analysis method to determine whether it contains field information corresponding to a predefined encrypted field. If it is determined that it contains field information corresponding to a predefined encrypted field, the first data processing statement is modified to generate a new data processing statement, i.e., a second data processing statement. Different analysis and modification methods can be used for different types of first data processing statements. Furthermore, modification methods include, but are not limited to, replacing the first field information or adding second field information based on the first field information.

[0043] In addition, the field information corresponding to the encrypted field may include at least one of the field name and field value, wherein the first field information may include at least one of the field name and field value corresponding to the first encrypted field, the second field information may include at least one of the field name and field value corresponding to the first index field, and the ciphertext data corresponding to the first encrypted field.

[0044] Based on this, in some implementations, when the first field information includes a field name corresponding to the first encrypted field, the second field information may include a field name corresponding to the first index field; when the first field information includes a field value corresponding to the first encrypted field, the second field information may include a field value corresponding to the first index field, or a field value corresponding to the first index field and ciphertext data corresponding to the first encrypted field, wherein the field value corresponding to the first index field is a hash value generated based on the field value corresponding to the first encrypted field.

[0045] Here, since the target database stores ciphertext data for encrypted fields, to facilitate retrieving the ciphertext data corresponding to a specific encrypted field from the target database, an index field corresponding to the encrypted field can be set in the target database. The value of this index field can be a hash value generated based on the field value (i.e., plaintext data) corresponding to the encrypted field. That is, the hash value corresponding to the plaintext data of the encrypted field is used as the index value of the ciphertext data of the encrypted field. For example, if the field value corresponding to a certain encrypted field is 'xxx', then the target database stores the ciphertext data Encrypt('xxx') for that encrypted field, and the value of the index field corresponding to that encrypted field can be HASH('xxx').

[0046] Based on this, when modifying the first data processing statement, the principle of modification can be to find the encrypted data corresponding to the first encrypted field through the field value of the first index field, and modify the field name and / or field value corresponding to the first encrypted field in the first data processing statement to obtain the second data processing statement, which includes at least the field name or field value corresponding to the first index field.

[0047] In some implementations, in S130, after modifying the first data processing statement into a second data processing statement, a preparedStatement pre-compiled object or a statement non-pre-compiled object can be constructed for the second data processing statement, and then the second data processing statement can be executed.

[0048] Since the second data processing statement contains second field information corresponding to the first index field, when the second data processing statement is executed, the ciphertext data corresponding to the first encrypted field can be found in the target database based on the second field information, and then the CRUD operations on the ciphertext data can be performed.

[0049] Based on this, the following sections will provide a detailed explanation of how to analyze and modify statements, taking into account various different types of statements.

[0050] In some embodiments of this application, where the first data processing statement includes a query statement, the data processing method provided in this application embodiment may further include, prior to the above-described S120, the following:

[0051] Iterate through at least one query field corresponding to the query statement;

[0052] Retrieve the field name and field alias of the query field;

[0053] Retrieve the table name and alias of the table to be queried, corresponding to the query statement;

[0054] Record the correspondence between field names, field aliases, table names, table aliases, and the database name of the target database;

[0055] Based on the correspondence, determine whether at least one query field contains an encrypted field.

[0056] Based on this, the aforementioned S120 may specifically include:

[0057] If a first encrypted field exists in at least one of the query fields, the information of the first field in the query statement is modified to obtain a second data processing statement containing the information of the second field corresponding to the first index field.

[0058] Here, the query statement can be, for example, a SELECT statement. A SELECT statement can consist of one or more simple SELECT statements. A simple statement can consist of a list of query fields, table name, query conditions, grouping conditions, and union query conditions.

[0059] For example, each query field in the query field list corresponding to the query statement can be traversed. This query field list may contain one or more query fields. For each query field, the field name and its corresponding field alias are obtained. Additionally, the table name of the data table to be queried in the query statement and its corresponding table alias are also required. In this way, by recording the correspondence between field names, field aliases, table names, table aliases, and the target database name, when determining whether there is first field information corresponding to the first encrypted field in the query statement, this correspondence can be used to compare the field name, table name, etc., of each query field with the predefined field names, table names, etc., of the encrypted fields, thereby determining whether the current query field belongs to the encrypted field.

[0060] It should be noted that each query statement can include one or more encrypted fields; that is, the number of encrypted fields can be one or more. If multiple encrypted fields exist, the field information corresponding to each encrypted field can be modified.

[0061] Based on this, in some implementations, the steps of obtaining the table name and table alias of the data table to be queried corresponding to the query statement may specifically include:

[0062] Determine the type of the data table to be queried corresponding to the query statement;

[0063] If the data table to be queried is a simple table type, obtain the table name and table alias of the data table to be queried.

[0064] Here, the type of the data table to be queried can include simple table type and join query type. If the type of the data table to be queried corresponding to the current query statement is simple table type, then the table name and table alias of the data table to be queried are directly obtained.

[0065] In other embodiments, when the type of the data table to be queried is a join query type, the data processing method provided in this application embodiment may further include:

[0066] Determine the left and right lookup tables from the data table to be queried;

[0067] If the left query table is a simple table and the query field is a field in the left query table, retrieve the table name and table alias of the left query table;

[0068] If the right query table is a simple table and the query field is a field in the right query table, retrieve the table name and table alias of the right query table.

[0069] Here, if the data table corresponding to the current query statement is a join query, the left and right query tables within that table can be determined first. For example, the table to the left of "LEFT JOIN" or "RIGHT JOIN" in the query statement can be the left query table, and correspondingly, the table to the right can be the right query table. For instance, if the query statement is "SELECT field_name1, field_name2,... FROM table_name1 LEFT JOIN table_name2…", then table1 is the left query table, and table2 is the right query table.

[0070] For example, if the left query table is a simple table type and the currently traversed query field is a field from the left query table, the table name and alias of the left query table can be obtained and used as the table name and alias for the entire query statement. Similarly, if the right query table is a simple table type and the currently traversed query field is a field from the right query table, the table name and alias of the right query table can be obtained and used as the table name and alias for the entire query statement.

[0071] In addition, in some embodiments, after the steps of obtaining the field name and field alias of the query field described above, the data processing method provided in this application embodiment may further include:

[0072] If the field alias is not empty, the field alias will be used as the key value.

[0073] If the field alias is empty, the field name will be used as the key value.

[0074] Here, the case where the field alias is empty can include cases where the field alias does not exist or the field alias has an empty value.

[0075] Since a field alias is the actual field name in the database, by setting the field alias as a key value when it is not empty, the application service can accurately find the corresponding data based on the actual field name of the query field in the target database when accessing the target database.

[0076] In addition, after determining the key value, the correspondence between the key value, field name, table name, and table alias can be recorded.

[0077] Furthermore, since the first data processing statement can also be composed of multiple query statements, in order to facilitate statement analysis and modification, in some embodiments, when the number of query statements included in the first data processing statement is multiple, before the above-mentioned step of traversing at least one query field corresponding to the query statement, the data processing method provided in this application embodiment may further include:

[0078] The first data processing statement is broken down into multiple query statements;

[0079] The steps described above for traversing at least one query field corresponding to a query statement include:

[0080] For each of the multiple query statements, iterate through at least one query field corresponding to the query statement.

[0081] For example, when the first data processing statement includes multiple query statements, the first data processing statement can be decomposed into multiple single query statements, and each single query statement can be traversed one by one for analysis and modification.

[0082] For example, if a subquery exists within the main query, the main query and the subquery can be broken down into two separate query statements, and each can be analyzed and modified as an independent single query statement.

[0083] Furthermore, in some implementations, when the query statement includes a conditional statement, the step of modifying the first field information in the query statement to obtain a second data processing statement containing second field information corresponding to the first index field may specifically include:

[0084] Replace the field name corresponding to the first encrypted field in the conditional statement with the field name corresponding to the first index field;

[0085] If the conditional statement contains a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain the field value corresponding to the first index field, and replace the field value corresponding to the first encrypted field in the conditional statement with the field value corresponding to the first index field.

[0086] Use the replaced conditional statement as the second data processing statement.

[0087] Here, a conditional statement can be a query statement that contains query conditions, such as a SELECT statement like "select field_name from table_name where...".

[0088] For example, if the conditional statement contains a field name corresponding to the first encrypted field, a field name corresponding to that field name can be created for the first index field, such as the original field name _hash, and the field name of the first encrypted field in the conditional statement can be replaced with the field name of the first index field. For instance, if the predefined encrypted field in the target database is usr_name, and the conditional statement contains the field name corresponding to the encrypted field usr_name, such as "select usr_id from t_user where usr_name=?", then the conditional statement can be modified to "select usr_id from t_user where usr_name_hash=?".

[0089] In other examples, if the conditional statement also contains a field value corresponding to the first encrypted field, then that field value can be hashed, and the field value corresponding to the first encrypted field in the conditional statement can be replaced with the calculated hash value, which is the field value corresponding to the first index field. For example, if the predefined encrypted field in the target database is usr_name, and the conditional statement contains the field name and field value corresponding to the encrypted field usr_name, such as "select usr_id from t_user where usr_name='XXX'", then the conditional statement can be modified to "select usr_id from t_user where usr_name_hash=hash('XXX')".

[0090] If the conditional statement contains multiple field values ​​corresponding to the first encrypted field, then each field value can be hashed separately, and each field value corresponding to the first encrypted field in the conditional statement can be replaced with the corresponding hash value. For example, if the predefined encrypted field in the target database is usr_name, and the conditional statement contains the field name and multiple field values ​​corresponding to the encrypted field usr_name, such as "select usr_id from t_user where usr_name in('XXX','FFF')", then the conditional statement can be modified to "select usr_id from t_user where usr_name_hash in(hash('XXX'),hash('FFF'))".

[0091] If the field value corresponding to the first encrypted field in the conditional statement comes from the subquery statement, then the field name corresponding to the first encrypted field in the conditional statement can be replaced with the field name of the first indexed field, and the field name in the subquery statement can also be replaced with the field name of the corresponding indexed field. For example, if the predefined encrypted fields in the target database are usr_name and name, and the conditional statement contains the field name corresponding to the encrypted field usr_name, and the subquery statement of the conditional statement contains the field name corresponding to the encrypted field name, such as "select usr_id from t_user where usr_name in(select name from t_app)", then the conditional statement can be modified to "select usr_id from t_user where usr_name_hash in(select name_hash from t_app)".

[0092] Furthermore, in some implementations, when the query statement includes a grouping statement, the step of modifying the first field information in the query statement to obtain a second data processing statement containing second field information corresponding to the first index field may specifically include:

[0093] Add the field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field in the grouping statement to obtain the second data processing statement.

[0094] Here, the grouping statement can be a query statement that includes grouping conditions, such as a SELECT statement like "select field_name from table_name group by...". Additionally, the position corresponding to the field name of the first encrypted field could be, for example, after the field name of the first encrypted field.

[0095] For example, if the grouping statement contains a field name corresponding to the first encrypted field, a field name for the first index field corresponding to that field name can be created, such as the original field name _hash, and the field name of the first index field can be added after the field name of the first encrypted field in the grouping statement.

[0096] For example, if the predefined encrypted field in the target database is name, and the grouping statement contains the field name corresponding to the encrypted field name, such as "select id,name from t_user group by id,name", then the field name of the first index field can be added to the end of the list of selected fields, and the field name of the first index field can be added to the grouping condition, such as changing it to "select id,name,name_hash from t_user group by id,name,name_hash".

[0097] Furthermore, in some implementations, when the query statement includes a union query statement, the step of modifying the first field information in the query statement to obtain a second data processing statement containing second field information corresponding to the first index field may specifically include:

[0098] Replace the field name corresponding to the first encrypted field in the join query statement with the field name corresponding to the first index field to obtain the second data processing statement.

[0099] Here, a join query statement can be a query statement that contains a join query condition. For example, a join query condition can be "on table_name1.field_name1 = table_name2.field_name2" in a SELECT statement.

[0100] For example, if the query conditions of the join query statement contain a field name corresponding to the first encrypted field, a field name of the first index field corresponding to that field name can be created, such as the original field name _sh, and the field name of the first encrypted field in the join query condition can be replaced with the field name of the first index field.

[0101] For example, if the predefined encrypted fields in the target database are a and b, and the query condition of the join statement includes the field names corresponding to the encrypted fields a and b, such as the query condition "on t1.a=t2.b", then the query condition can be modified to "on t1.a_sh=t2.b_sh".

[0102] Furthermore, in order to seamlessly decrypt the ciphertext data obtained after executing the query statement, in some implementations, the data processing method provided in this application embodiment may further include:

[0103] Set a second hook point for the data acquisition interface;

[0104] When the application service calls the data retrieval interface, the second hook is intercepted, and the data query results for the target database are obtained from the data retrieval interface through the second hook.

[0105] If the data query results contain ciphertext data corresponding to the second encrypted field, the ciphertext data corresponding to the second encrypted field is decrypted to obtain plaintext data.

[0106] Returns data query results containing plaintext data to the application service.

[0107] Here, the data retrieval interface can be an interface used to retrieve data from a database, such as the `get` series functions in the `ResultSetImp` class, like the `getString` function. Additionally, the second hook point can be a hook point set using Hook technology for functions related to the data retrieval interface. The second encrypted field can be any encrypted field from at least one predefined encrypted field in the target database; it can be the same encrypted field as the first encrypted field, or it can be a different encrypted field.

[0108] For example, by intercepting and setting hook points in the `get` function family, data query results can be obtained from these functions. Thus, if the data query results contain ciphertext data corresponding to any encrypted field, the ciphertext data can be decrypted, and the data query results containing the decrypted plaintext data can be returned to the application service.

[0109] In addition, in some embodiments of this application, where the first data processing statement includes an insert statement, the data processing method provided in this application embodiment may further include the following before S120:

[0110] Retrieve the table name, field name and value of the field to be inserted, and duplicate key information of the data table to be inserted corresponding to the insert statement;

[0111] Iterate through at least one field corresponding to the insert statement;

[0112] Based on the table name of the data table to be inserted and the field name of the field to be inserted, determine whether at least one of the fields to be inserted contains an encrypted field.

[0113] Based on this, the aforementioned S120 may specifically include:

[0114] If a first encrypted field exists in at least one of the insert fields, perform a hash calculation on the field value corresponding to the first encrypted field in the insert statement to obtain the field value corresponding to the first index field, and perform an encryption calculation on the field value corresponding to the first encrypted field to obtain the ciphertext data corresponding to the first encrypted field.

[0115] In the insert statement, add the field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field, and replace the field value corresponding to the first encrypted field in the insert statement with the ciphertext data corresponding to the first encrypted field and the field value corresponding to the first index field;

[0116] If the duplicate key information corresponding to the first encrypted field is included in the duplicate key information of the insert statement, add the information corresponding to the first index field to the duplicate key information of the insert statement.

[0117] Use the modified insert statement as the second data processing statement.

[0118] Here, the insert statement can be, for example, an INSERT statement. A simple INSERT statement can consist of the fields to be inserted, the table name, a list of values, and duplicate key information. The duplicate key information can be, for example, a duplicate key.

[0119] For example, information such as the table name, field list, value list, and duplicate key of the data table to be inserted can be obtained from the insert statement. The field list may include the field names of the fields to be inserted, and the value list may include the field values ​​of the fields to be inserted. If the field list is empty, the configuration file can obtain all fields of the data table to be inserted and update the field list accordingly.

[0120] Iterate through each inserted field listed in the field list, and determine whether each inserted field is a predefined encrypted field based on its field name and the table name. If an inserted field is a predefined first encrypted field, append the field name of the first index field to the field name corresponding to the first encrypted field in the insert statement, and replace the field value of the first encrypted field with its corresponding ciphertext data and hash value (i.e., the field value of the first index field). Additionally, add information corresponding to the first index field to the duplicate key information in the insert statement, such as the statement corresponding to `on duplicate Key`. This information includes, but is not limited to, the field name and field value.

[0121] For example, if the predefined encrypted field in the target database is 'name', and the insert statement contains the field name and field value corresponding to the encrypted field 'name', such as "INSERT INTO t(name)VALUES(XXX)on duplicate key UPDATE name=VALUES(name)", then the insert statement can be modified to "INSERT INTO t(name,name_hash)VALUES(Encrpyt('XXX'),HASH('XXX'))on duplicate key UPDATE name=VALUES(name),name_hash=VALUES(name_hash)".

[0122] In addition, in some other embodiments of this application, when the first data processing statement includes an update statement, the data processing method provided in this application embodiment may further include the following before S120:

[0123] Get the table name of the data table to be updated corresponding to the update statement, and the field name of the field to be updated;

[0124] Iterate through at least one updated field corresponding to the update statement;

[0125] Based on the table name of the data table to be updated and the field name of the updated field, determine whether at least one updated field contains an encrypted field.

[0126] Based on this, the aforementioned S120 may specifically include:

[0127] If a first encrypted field exists in at least one of the update fields, the information of the first field in the update statement is modified to obtain a second data processing statement containing the information of the second field corresponding to the first index field.

[0128] Here, the update statement can be, for example, an UPDATE statement.

[0129] For example, information such as the table name of the data table to be updated and the list of updated fields can be obtained from the update statement. The list of updated fields may include the field names of the updated fields. Each updated field listed in the field list is iterated over, and based on the field name and the table name, it is determined whether each updated field is a predefined encrypted field. If any predefined first encrypted field exists among the updated fields, the information of the first field corresponding to the first encrypted field in the update statement can be modified. The modification method can be determined based on the information contained in the update statement.

[0130] Based on this, in some implementations, when the update statement contains a field value corresponding to the first encrypted field, the step of modifying the first field information in the update statement to obtain a second data processing statement containing second field information corresponding to the first index field may specifically include:

[0131] Hash the field value corresponding to the first encrypted field in the update statement to obtain the field value corresponding to the first index field; and encrypt the field value corresponding to the first encrypted field in the update statement to obtain the ciphertext data corresponding to the first encrypted field.

[0132] In the update statement, at the position corresponding to the field name and field value of the first encrypted field, add the field name and field value corresponding to the first index field;

[0133] Replace the field value corresponding to the first encrypted field in the update statement with the ciphertext data corresponding to the first encrypted field.

[0134] For example, if an updated field is a predefined first encrypted field, and the update statement includes the field name and value of the first encrypted field, then the field name and value of the first index field can be appended after the field name and value of the first encrypted field in the update statement, and the field value of the first encrypted field can be replaced with its corresponding ciphertext data. The field value of the first index field can be a hash value obtained by hashing the field name corresponding to the first encrypted field in the update statement.

[0135] For example, if the predefined encrypted field in the target database is name, and the update statement contains the field name and field value corresponding to the encrypted field name, and the field value comes from other data tables, such as "UPDATE t set name='XXX'", then the update statement can be modified to "UPDATE t set name=Encrpyt('XXX'),name_hash=HASH('XXX')".

[0136] In other embodiments, when the update statement contains a field value corresponding to the first encrypted field, and the field value comes from a field value corresponding to the target field in a data table other than the data table to be updated, the step of modifying the first field information in the update statement to obtain a second data processing statement containing second field information corresponding to the first index field may specifically include:

[0137] In the update statement, at the position corresponding to the field name and field value of the first encrypted field, add the field name and field value corresponding to the first index field. The field value corresponding to the first index field is set to the field value of the target index field corresponding to the target field in other data tables.

[0138] For example, if an updated field is a predefined first encrypted field, and the update statement includes the field name and value of the first encrypted field, and the field value comes from the field value corresponding to the target field in another data table, then the field name and value corresponding to the first index field can be added after the field name and value corresponding to the first encrypted field in the update statement. The field value of the first index field can be set to the field value of the target index field corresponding to the target field in another data table.

[0139] For example, if the predefined encrypted field in the target database is name, and the update statement contains the field name and field value corresponding to the encrypted field name, such as "UPDATE t set t.name=t_b.name", then the update statement can be modified to "UPDATE t set t.name=t_b.name,t.name_hash=t_b.name_hash".

[0140] In other embodiments, when the update statement contains a field value corresponding to the first encrypted field, and the field value comes from a subquery statement, the step of modifying the first field information in the update statement to obtain a second data processing statement containing second field information corresponding to the first index field may specifically include:

[0141] In the update statement and subquery statement, add the field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field.

[0142] For example, if an updated field is a predefined first encrypted field, and the update statement contains the field name and field value of the first encrypted field, and the field value comes from a subquery statement in the update statement, then the field name corresponding to the first index field can be added after the field name corresponding to the first encrypted field in the update statement and the subquery statement.

[0143] For example, if the predefined encrypted field in the target database is name, and the update statement contains the field name and field value corresponding to the encrypted field name, with the field value coming from a subquery statement, such as "UPDATE t set name=(selectname from t_b)", then the update statement can be modified to "UPDATE t set(name,name_hash)=(selectname,name_hash)from t_b".

[0144] In addition, in some embodiments of this application, where the first data processing statement includes a deletion statement, the data processing method provided in this application embodiment may further include the following before S120:

[0145] Retrieve the query conditions in the delete statement;

[0146] Iterate through at least one condition field contained in the query conditions to determine whether an encrypted field exists in at least one condition field.

[0147] Based on this, the aforementioned S120 may specifically include:

[0148] If the first encrypted field exists in at least one of the condition fields, the field name corresponding to the first encrypted field in the delete statement will be replaced with the field name corresponding to the first index field;

[0149] If the deletion statement contains a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain the field value corresponding to the first index field, and replace the field value corresponding to the first encrypted field in the deletion statement with the field value corresponding to the first index field.

[0150] The replaced deletion statement is used as the second data processing statement.

[0151] Here, the delete statement can be used to delete data from the database; for example, it can be a DELETE statement.

[0152] For example, when analyzing a delete statement, the focus is primarily on its query conditions. Based on this, the query conditions in the delete statement can be obtained, which may include one or more condition fields. Each condition field listed in this field list is iterated over, and based on the field name and the table name of the data table it belongs to, it is determined whether each condition field is a predefined encrypted field.

[0153] If a certain condition field is a predefined first encrypted field, the field name corresponding to the first encrypted field in the query condition of the delete statement can be replaced with the field name corresponding to the first index field.

[0154] Additionally, if the field value corresponding to the first encrypted field in the query conditions is a single value, the field value corresponding to the first encrypted field in the query conditions of the delete statement will be replaced with its corresponding hash value (i.e., the field value of the first index field). For example, if the predefined encrypted field in the target database is name, and the delete statement contains the field name and field value corresponding to the encrypted field name, such as "DELETE from t where name='XXX'", then the insert statement can be modified to "DELETE from t where name_hash=HASH('XXX')".

[0155] If there are multiple field values ​​corresponding to the first encrypted field in the query conditions, each field value can be iterated over and replaced with its corresponding hash value. For example, if the predefined encrypted field in the target database is name, and the delete statement contains the field name and multiple field values ​​corresponding to the encrypted field name, such as "DELETE from t where name in('XXX1','XXX2')", then the insert statement can be modified to "DELETE from t where name_hash in(Hash('XXX1'),Hash('XXX2'))".

[0156] Furthermore, it should be noted that when the field value corresponding to the first encrypted field comes from a subquery statement, the subquery statement can also be modified in the same way described above. That is, replace the field name corresponding to the first encrypted field in both the delete statement and the subquery statement with the field name of the first index field. For example, if the predefined encrypted field in the target database is 'name', and the delete statement contains the field name and field value corresponding to the encrypted field 'name', and this field value comes from a subquery statement, then the insert statement can be modified to "DELETE from t where name_hash in(selectname_hash from t2 where id=XXX)".

[0157] Furthermore, the first data processing statement can be either a prepared statement or a non-prepared statement. Non-prepared statements can be directly modified as described above. However, for prepared statements, in addition to modifying the first data processing statement itself, the corresponding prepared parameters also need to be modified.

[0158] Based on this, in some embodiments of this application, when the first data processing statement is a statement corresponding to the pre-compiled method, after the above S120, the data processing method provided by the embodiments of this application may further include:

[0159] Retrieve the precompiled parameters corresponding to the first data processing statement;

[0160] If the parameter value corresponding to the precompiled parameter contains a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain the field value corresponding to the first index field, and modify the field value corresponding to the first encrypted field in the precompiled parameter to obtain the target precompiled parameter containing the field value corresponding to the first index field; and / or, perform an encryption calculation on the field value corresponding to the first encrypted field to obtain the ciphertext data corresponding to the first encrypted field, and modify the field value corresponding to the first encrypted field in the precompiled parameter to obtain the target precompiled parameter containing the ciphertext data corresponding to the first encrypted field;

[0161] Update the precompiled parameter index corresponding to the precompiled parameter to obtain the precompiled parameter index corresponding to the target precompiled parameter.

[0162] Here, in the prepared statement mode, the prepared parameters corresponding to the first data processing statement also need to be modified. For example, for UPDATE and INSERT statements, when the inserted field needs to be encrypted, the hash value of that field value needs to be inserted as an index. This hash value can be used to provide precise queries. The earliest insert algorithm can be used here. The earliest insert means that the corresponding index field is inserted immediately after the encrypted field in the SQL statement. The field value corresponding to this index field is obtained by hashing the field value corresponding to the encrypted field in the SQL statement.

[0163] For example, if the predefined encrypted field in the target database is name, and the first data processing statement based on the pre-compilation method is "INSERT INTO t(name,id)VALUES(?,?)", then the first data processing statement can be modified to "INSERT INTO t(name,name_hash,id)VALUES(?,?,?)".

[0164] Based on the earliest insertion algorithm, the update methods for precompiled parameters and their corresponding precompiled parameter indices can include:

[0165] First, initialization is performed. The original pre-compiled parameter indices are 1, 2, 3, ..., and the counter is 0.

[0166] Secondly, iterate through the values ​​of each field in the precompiled parameters and calculate the precompiled parameter index of the modified second data processing statement according to different cases.

[0167] For example, when the first data processing statement is an insert statement: if the inserted field needs to be encrypted, the precompiled parameter index of the inserted field can be set to a counter + the original precompiled parameter index corresponding to the inserted field, and the precompiled parameter index of the index field corresponding to the inserted field can be set to a counter + the original precompiled parameter index corresponding to the inserted field + 1, with the counter incrementing by 1; if the inserted field does not need to be encrypted, the precompiled parameter index of the inserted field can be set to a counter + the original precompiled parameter index corresponding to the inserted field.

[0168] If the first data processing statement is of another type, the precompiled parameter index of the inserted field can be set to the counter plus the original precompiled parameter index corresponding to the inserted field.

[0169] Finally, when setting the values ​​of precompiled parameters, the precompiled parameter index can be updated, and the field values ​​of indexed fields can be set as needed.

[0170] For example, when the first data processing statement is an insert or update statement, if the inserted field needs to be encrypted, firstly, the original pre-compiled parameter value (i.e., the field value in the pre-compiled parameters corresponding to the first encrypted field) is hashed, and the pre-compiled parameter index of the index field corresponding to the inserted field obtained from the aforementioned calculation is obtained. The pre-compiled parameter value of the index field is then set as the hash value of the original pre-compiled parameter value. Next, the original pre-compiled parameter value (i.e., the field value in the pre-compiled parameters corresponding to the first encrypted field) is encrypted, and the pre-compiled parameter index of the inserted field obtained from the aforementioned calculation is obtained. The pre-compiled parameter value of the inserted field is then set as the ciphertext data corresponding to the original pre-compiled parameter value. If the inserted field does not need to be encrypted, the pre-compiled parameter index of the index field corresponding to the inserted field obtained from the aforementioned calculation is obtained, and the settings are made based on the updated pre-compiled parameter index and the original pre-compiled parameter value. In this way, the modified and updated target pre-compiled parameters can be obtained.

[0171] If the first data processing statement is a query or delete statement, and the inserted field needs to be encrypted, then the original precompiled parameter value (i.e., the field value in the precompiled parameters corresponding to the first encrypted field) is hashed, and the precompiled parameter index of the index field corresponding to the inserted field, obtained from the aforementioned calculation, is obtained. The precompiled parameter value of the index field is then set to the hash value of the original precompiled parameter value. If the inserted field does not need to be encrypted, then the precompiled parameter index of the index field corresponding to the inserted field, obtained from the aforementioned calculation, is obtained, and the settings are made based on the updated precompiled parameter index and the original precompiled parameter value. In this way, the modified and updated target precompiled parameters can be obtained.

[0172] Based on this, in some embodiments, before the step of obtaining the pre-compiled parameters corresponding to the first data processing statement, the data processing method provided in this application embodiment may further include:

[0173] Set a third hook for the precompiled parameter setting interface.

[0174] Based on this, the steps described above for obtaining the pre-compiled parameters corresponding to the first data processing statement may specifically include:

[0175] When the application service calls the pre-compiled parameter setting interface, the third hook is intercepted, and the pre-compiled parameters corresponding to the first data processing statement are obtained from the pre-compiled parameter setting interface through the third hook.

[0176] Here, the precompiled parameter setting interface can be an interface used to set precompiled parameters, such as the set functions in the ClientPreparedStatement class, including but not limited to setString and setInt functions. Additionally, the third hook point can be a hook point set using Hook technology for functions related to the precompiled parameter setting interface.

[0177] For example, by intercepting and setting Hook points in the set series of functions, precompiled parameters as parameter information can be obtained from the set series of functions, and then the parameter values ​​and parameter indexes of the precompiled parameters can be modified.

[0178] Therefore, in order to better describe the whole solution, some specific examples are given based on the above embodiments.

[0179] For example, taking the pre-compilation method as an example, the data processing method provided in this application embodiment can be applied to, for example, Figure 2 The encrypted storage architecture shown is illustrated. This architecture may include an application system 10, a database proxy server 20, and a database 30. The application system 10 may include multiple application services 11, and may also include an encryption component consisting of a statement interception and analysis module 12, a pre-compiled parameter processing module 13, and a real-time encryption / decryption module 14. The application services 11 can load this encryption component using JavaAgent or reference it as a Maven component at runtime. The following provides a detailed explanation of each module within the encryption component.

[0180] In this embodiment, the statement interception and analysis module 12 can intercept, analyze, and modify application SQL statements. For predefined encrypted fields, the statement interception and analysis module 12 can encrypt and hash the original field value corresponding to the encrypted field. The encryption process is used to protect the confidentiality of the data, and the hash process is used to provide a precise index for the encrypted ciphertext data for querying.

[0181] The pre-compiled parameter processing module 13 can revise and update the pre-compiled parameters. The encryption and hashing of the encrypted fields in the pre-compiled parameters are the same as above, and will not be repeated here.

[0182] The real-time encryption and decryption module 14 can encrypt data when storing data in predefined encryption fields and decrypt it when the query results contain ciphertext data corresponding to the predefined encryption fields.

[0183] For example, each application service 11 in application system 10 can perform CRUD operations on data in database 30 using query statements, insert statements, update statements, and delete statements. For predefined encrypted fields, application service 11 generates SQL statements by assigning plaintext data values. Through statement interception and analysis module 12, pre-compiled parameter processing module 13, and real-time encryption and decryption module 14, application service 24 can achieve seamless encrypted storage of data. That is, for predefined encrypted fields, the data ultimately stored in database 30 is encrypted data.

[0184] Therefore, since the application service 11 in this embodiment loads the encryption component using JavaAgent or references it as a Maven component, no code modification of the application service is required. This decouples the data processing code from the application service's business code, reducing resource waste and lowering the risk of errors in the business code. Furthermore, since no additional proxy node needs to be deployed in this embodiment, the impact on data processing performance is reduced. Simultaneously, since the database 30 in this embodiment stores encrypted data for encrypted fields, DBA risks can be effectively prevented.

[0185] It should be noted that the application scenarios described in the above embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0186] Based on the same inventive concept, this application also provides a data processing device. (Specifically combined with...) Figure 3 Please provide a detailed explanation.

[0187] Figure 3 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application.

[0188] like Figure 3 As shown, the data processing device 300 may include:

[0189] The statement acquisition module 301 is used to acquire a first data processing statement generated by the application service for a target database, wherein the target database includes at least one encrypted field and its corresponding index field, and the target database stores ciphertext data for the at least one encrypted field.

[0190] The statement modification module 302 is used to modify the first field information in the first data processing statement when the first data processing statement contains first field information corresponding to the first encrypted field, so as to obtain a second data processing statement containing second field information corresponding to the first index field, wherein the first encrypted field is any encrypted field among the at least one encrypted field, and the first index field is an index field corresponding to the first encrypted field.

[0191] The statement execution module 303 is used to execute the second data processing statement to process the ciphertext data corresponding to the first encrypted field in the target database according to the second field information.

[0192] The data processing device 300 described above will be described in detail below:

[0193] In some embodiments, the data processing apparatus 300 may further include:

[0194] The first setting module is used to set the first hook point for the database connection interface before obtaining the first data processing statement for the target database generated by the application service;

[0195] The statement acquisition module 301 is specifically used for:

[0196] When the application service calls the database connection interface, the first hook is intercepted, and the first data processing statement for the target database is obtained from the database connection interface through the first hook.

[0197] In some embodiments, when the first field information includes a field name corresponding to the first encrypted field, the second field information includes a field name corresponding to the first index field;

[0198] When the first field information includes a field value corresponding to the first encrypted field, the second field information includes a field value corresponding to the first index field, or a field value corresponding to the first index field and ciphertext data corresponding to the first encrypted field, wherein the field value corresponding to the first index field is a hash value generated based on the field value corresponding to the first encrypted field.

[0199] In some embodiments, the first data processing statement includes a query statement;

[0200] The data processing device 300 may further include:

[0201] The first traversal module is used to traverse at least one query field corresponding to the query statement before modifying the first field information in the first data processing statement to obtain a second data processing statement containing the second field information corresponding to the first index field, when the first data processing statement contains the first field information corresponding to the first encrypted field.

[0202] The first acquisition module is used to acquire the field name and field alias of the query field;

[0203] The second acquisition module is used to acquire the table name and table alias of the data table to be queried corresponding to the query statement;

[0204] The relationship recording module is used to record the correspondence between the field name, the field alias, the table name, the table alias, and the database name of the target database;

[0205] The first determining module is used to determine whether an encrypted field exists in the at least one query field based on the correspondence relationship;

[0206] Statement modification module 302 may specifically include:

[0207] The first modification submodule is used to modify the first field information in the query statement when the first encrypted field exists in at least one query field, so as to obtain a second data processing statement containing second field information corresponding to the first index field.

[0208] In some embodiments, the second acquisition module includes:

[0209] The type determination submodule is used to determine the type of the data table to be queried corresponding to the query statement;

[0210] The first acquisition submodule is used to acquire the table name and table alias of the data table to be queried when the data table to be queried is of the simple table type.

[0211] In some embodiments, when the type of the data table to be queried is a join query type, the second acquisition module may further include:

[0212] The query table determination submodule is used to determine the left and right query tables from the data table to be queried.

[0213] The second acquisition submodule is used to acquire the table name and table alias of the left query table when the type of the left query table is a simple table type and the query field is a field in the left query table;

[0214] The third acquisition submodule is used to acquire the table name and table alias of the right query table when the type of the right query table is a simple table and the query field is a field in the right query table.

[0215] In some embodiments, the data processing apparatus 300 may further include:

[0216] The second determining module is used to determine the field alias as a key value when the field alias is not empty after obtaining the field name and field alias of the query field.

[0217] The third determining module is used to determine the field name as a key value when the field alias is empty.

[0218] In some embodiments, when the number of query statements included in the first data processing statement is multiple, the data processing device 300 may further include:

[0219] The statement decomposition module is used to decompose the first data processing statement into multiple query statements before traversing at least one query field corresponding to the query statement.

[0220] The first traversal module is specifically used for:

[0221] For each of the plurality of query statements, traverse at least one query field corresponding to the query statement.

[0222] In some embodiments, where the query statement includes a conditional statement, the first modification submodule may specifically include:

[0223] The first replacement unit is used to replace the field name corresponding to the first encrypted field in the conditional statement with the field name corresponding to the first index field.

[0224] The second replacement unit is used to perform a hash calculation on the field value corresponding to the first encrypted field when the conditional statement contains a field value corresponding to the first encrypted field, to obtain a field value corresponding to the first index field, and to replace the field value corresponding to the first encrypted field in the conditional statement with the field value corresponding to the first index field.

[0225] The first determining unit is used to use the replaced conditional statement as the second data processing statement.

[0226] In some embodiments, where the query statement includes a grouping statement, the first modification submodule may specifically include:

[0227] The first adding unit is used to add a field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field in the grouping statement, so as to obtain the second data processing statement.

[0228] In some embodiments, where the query statement includes a union query statement, the first modification submodule may specifically include:

[0229] The third replacement unit is used to replace the field name corresponding to the first encrypted field in the joint query statement with the field name corresponding to the first index field to obtain the second data processing statement.

[0230] In some embodiments, the data processing apparatus 300 may further include:

[0231] The second settings module is used to set the second hook point for the data acquisition interface;

[0232] The hook interception module is used to intercept the second hook when the application service calls the data acquisition interface, and obtain the data query results for the target database from the data acquisition interface through the second hook;

[0233] The data decryption module is used to decrypt the ciphertext data corresponding to the second encrypted field to obtain plaintext data when the data query result contains ciphertext data corresponding to the second encrypted field.

[0234] The result return module is used to return the data query result containing the plaintext data to the application service.

[0235] In some embodiments, the first data processing statement includes an insert statement;

[0236] When the first data processing statement includes first field information corresponding to the first encrypted field, the data processing device 300 may further include:

[0237] The third acquisition module is used to acquire the table name of the data table to be inserted, the field name and field value of the inserted field, and the duplicate key information of the data table to be inserted corresponding to the insertion statement before modifying the first field information in the first data processing statement to obtain the second data processing statement containing the second field information corresponding to the first index field.

[0238] The second traversal module is used to traverse at least one insertion field corresponding to the insertion statement;

[0239] The fourth determining module is used to determine whether there is an encrypted field in the at least one insert field based on the table name of the data table to be inserted and the field name of the insert field;

[0240] Statement modification module 302 may specifically include:

[0241] The first calculation submodule is configured to, when the first encrypted field exists in the at least one insertion field, perform a hash calculation on the field value corresponding to the first encrypted field in the insertion statement to obtain the field value corresponding to the first index field, and perform an encryption calculation on the field value corresponding to the first encrypted field to obtain the ciphertext data corresponding to the first encrypted field.

[0242] The first replacement submodule is used to add a field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field in the insertion statement, and replace the field value corresponding to the first encrypted field in the insertion statement with the ciphertext data corresponding to the first encrypted field and the field value corresponding to the first index field.

[0243] The first adding submodule is used to add information corresponding to the first index field to the duplicate key information of the insert statement when the duplicate key information corresponding to the insert statement includes information corresponding to the first encrypted field.

[0244] The first determining submodule is used to use the modified insertion statement as the second data processing statement.

[0245] In some embodiments, the first data processing statement includes an update statement;

[0246] When the first data processing statement includes first field information corresponding to the first encrypted field, the data processing device 300 may further include:

[0247] The fourth acquisition module is used to acquire the table name of the data table to be updated and the field name of the updated field before modifying the first field information in the first data processing statement to obtain the second data processing statement containing the second field information corresponding to the first index field.

[0248] The third traversal module is used to traverse at least one update field corresponding to the update statement;

[0249] The fifth determining module is used to determine whether there is an encrypted field in the at least one updated field based on the table name of the data table to be updated and the field name of the updated field;

[0250] Statement modification module 302 may specifically include:

[0251] The second modification submodule is used to modify the first field information in the update statement when the first encrypted field exists in the at least one update field, so as to obtain a second data processing statement containing second field information corresponding to the first index field.

[0252] In some embodiments, where the update statement includes a field value corresponding to the first encrypted field, the second modification submodule may specifically include:

[0253] The first calculation unit is used to perform hash calculation on the field value corresponding to the first encrypted field in the update statement to obtain the field value corresponding to the first index field, and to perform encryption calculation on the field value corresponding to the first encrypted field in the update statement to obtain ciphertext data corresponding to the first encrypted field.

[0254] The second adding unit is used to add the field name and field value corresponding to the first index field at the position in the update statement corresponding to the field name and field value of the first encrypted field;

[0255] The fourth replacement unit is used to replace the field value corresponding to the first encrypted field in the update statement with the ciphertext data corresponding to the first encrypted field.

[0256] In some embodiments, where the update statement includes a field value corresponding to the first encrypted field, and the field value comes from a field value corresponding to the target field in a data table other than the data table to be updated, the second modification submodule may specifically include:

[0257] The third adding unit is used to add a field name and field value corresponding to the first index field at the position corresponding to the field name and field value of the first encrypted field in the update statement, wherein the field value corresponding to the first index field is set to the field value of the target index field corresponding to the target field in the other data table.

[0258] In some embodiments, where the update statement includes a field value corresponding to the first encrypted field, and the field value comes from a subquery statement, the second modification submodule may specifically include:

[0259] The fourth adding unit is used to add the field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field in the update statement and the subquery statement, respectively.

[0260] In some embodiments, the first data processing statement includes a deletion statement;

[0261] When the first data processing statement includes first field information corresponding to the first encrypted field, the data processing device 300 may further include:

[0262] The fifth acquisition module is used to acquire the query conditions in the deletion statement before modifying the first field information in the first data processing statement to obtain the second data processing statement containing the second field information corresponding to the first index field.

[0263] The fourth traversal module is used to traverse at least one condition field contained in the query conditions and determine whether there is an encrypted field in the at least one condition field;

[0264] Statement modification module 302 may specifically include:

[0265] The second replacement submodule is used to replace the field name corresponding to the first encrypted field in the deletion statement with the field name corresponding to the first index field when the first encrypted field exists in the at least one condition field.

[0266] The third replacement submodule is used to perform a hash calculation on the field value corresponding to the first encrypted field when the deletion statement contains a field value corresponding to the first encrypted field, to obtain a field value corresponding to the first index field, and to replace the field value corresponding to the first encrypted field in the deletion statement with the field value corresponding to the first index field.

[0267] The second determining submodule is used to use the replaced deletion statement as the second data processing statement.

[0268] In some embodiments, when the first data processing statement is a statement corresponding to a pre-compiled method, the data processing device 300 may further include:

[0269] The sixth acquisition module is used to acquire the pre-compiled parameters corresponding to the first data processing statement after modifying the first field information in the first data processing statement to obtain a second data processing statement containing the second field information corresponding to the first index field.

[0270] The parameter modification module is configured to, when the parameter value corresponding to the precompiled parameter contains a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain a field value corresponding to the first index field, and modify the field value corresponding to the first encrypted field in the precompiled parameter to obtain a target precompiled parameter containing the field value corresponding to the first index field; and / or, perform an encryption calculation on the field value corresponding to the first encrypted field to obtain ciphertext data corresponding to the first encrypted field, and modify the field value corresponding to the first encrypted field in the precompiled parameter to obtain a target precompiled parameter containing ciphertext data corresponding to the first encrypted field;

[0271] The index update module is used to update the precompiled parameter index corresponding to the precompiled parameter to obtain the precompiled parameter index corresponding to the target precompiled parameter.

[0272] In some embodiments, the data processing apparatus 300 may further include:

[0273] The third setting module is used to set a third hook point for the pre-compiled parameter setting interface before obtaining the pre-compiled parameters corresponding to the first data processing statement;

[0274] The sixth acquisition module is specifically used for:

[0275] When the application service calls the pre-compiled parameter setting interface, the third hook is intercepted, and the pre-compiled parameters corresponding to the first data processing statement are obtained from the pre-compiled parameter setting interface through the third hook.

[0276] Therefore, by intercepting the first data processing statement generated by the application service targeting the target database and modifying the field information corresponding to any encrypted field in the target database within the first data processing statement—that is, when the first data processing statement contains the first field information corresponding to the first encrypted field—the first field information is modified to generate a second data processing statement containing the second field information corresponding to the first index field. In this way, the target database can store predefined encrypted fields in ciphertext without requiring code modification to the application service. The application service can also use the second field information of the first index field corresponding to the first encrypted field to process the ciphertext data corresponding to the first encrypted field, thus decoupling the data processing code from the application service's business code, thereby reducing resource waste and lowering the risk of errors in the business code. Furthermore, since this embodiment does not require the deployment of additional proxy nodes, the impact on data processing performance is reduced. Simultaneously, since the target database in this embodiment stores ciphertext data for encrypted fields, DBA risks can be effectively prevented.

[0277] Figure 4 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application.

[0278] Electronic device 400 may include processor 401 and memory 402 storing computer program instructions.

[0279] Specifically, the processor 401 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0280] Memory 402 may include mass storage for data or instructions. For example, and not limitingly, memory 402 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 402 may include removable or non-removable (or fixed) media. Where appropriate, memory 402 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 402 is non-volatile solid-state memory.

[0281] In certain embodiments, the memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Thus, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this application.

[0282] The processor 401 implements any of the data processing methods described in the above embodiments by reading and executing computer program instructions stored in the memory 402.

[0283] In some examples, electronic device 400 may also include communication interface 403 and bus 410. For example, Figure 4 As shown, the processor 401, memory 402, and communication interface 403 are connected through bus 410 and complete communication with each other.

[0284] The communication interface 403 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0285] Bus 410 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not as a limitation, bus 410 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 410 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0286] For example, the electronic device 400 can be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc.

[0287] The electronic device 400 can execute the data processing method in the embodiments of this application, thereby achieving the combination Figure 1 and Figure 3 The data processing methods and apparatus described.

[0288] Furthermore, in conjunction with the data processing methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the data processing methods in the above embodiments. Examples of computer-readable storage media include non-transitory computer-readable storage media, such as portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, etc.

[0289] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0290] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0291] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0292] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0293] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A data processing method, characterized by, include: Obtain the first data processing statement generated by the application service for the target database, wherein the target database includes at least one encrypted field and its corresponding index field, and the target database stores ciphertext data for the at least one encrypted field. If the first data processing statement contains first field information corresponding to the first encrypted field, the first field information in the first data processing statement is modified to obtain a second data processing statement containing second field information corresponding to the first index field, wherein the first encrypted field is any encrypted field among the at least one encrypted field, and the first index field is the index field corresponding to the first encrypted field. The second data processing statement is executed to process the ciphertext data corresponding to the first encrypted field in the target database according to the second field information; The first data processing statement includes an update statement; when the first data processing statement contains first field information corresponding to the first encrypted field, the first field information in the first data processing statement is modified to obtain a second data processing statement containing second field information corresponding to the first index field, including: If the first encrypted field exists in at least one update field corresponding to the update statement, the information of the first field in the update statement is modified to obtain a second data processing statement containing the information of the second field corresponding to the first index field. When the update statement contains a field value corresponding to the first encrypted field, and the field value comes from a field value corresponding to the target field in a data table other than the data table to be updated corresponding to the update statement, modifying the first field information in the update statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: In the update statement, at the position corresponding to the field name and field value of the first encrypted field, add the field name and field value corresponding to the first index field, wherein the field value corresponding to the first index field is set to the field value of the target index field corresponding to the target field in the other data table.

2. The method of claim 1, wherein, Before obtaining the first data processing statement for the target database generated by the application service, the method further includes: Set the first hook point for the database connection interface; The first data processing statement for the target database generated by the application service includes: When the application service calls the database connection interface, the first hook is intercepted, and the first data processing statement for the target database is obtained from the database connection interface through the first hook.

3. The method according to claim 1, characterized in that, If the first field information includes a field name corresponding to the first encrypted field, the second field information includes a field name corresponding to the first index field; When the first field information includes a field value corresponding to the first encrypted field, the second field information includes a field value corresponding to the first index field, or a field value corresponding to the first index field and ciphertext data corresponding to the first encrypted field, wherein the field value corresponding to the first index field is a hash value generated based on the field value corresponding to the first encrypted field.

4. The method according to claim 1, characterized in that, The first data processing statement includes a query statement; Before modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field, when the first data processing statement contains first field information corresponding to the first encrypted field, the method further includes: Iterate through at least one query field corresponding to the query statement; Retrieve the field name and field alias of the query field; Obtain the table name and table alias of the data table to be queried corresponding to the query statement; Record the correspondence between the field name, the field alias, the table name, the table alias, and the database name of the target database; Based on the correspondence, determine whether an encrypted field exists in the at least one query field; If the first data processing statement contains first field information corresponding to the first encrypted field, modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: If the first encrypted field exists in at least one of the query fields, the information of the first field in the query statement is modified to obtain a second data processing statement containing the second field information corresponding to the first index field.

5. The method according to claim 4, characterized in that, The step of obtaining the table name and table alias of the data table to be queried corresponding to the query statement includes: Determine the type of the data table to be queried corresponding to the query statement; If the type of the data table to be queried is a simple table, obtain the table name and table alias of the data table to be queried.

6. The method according to claim 5, characterized in that, When the type of the data table to be queried is a join query type, the method further includes: Determine the left and right lookup tables from the data table to be queried; If the type of the left query table is a simple table and the query field is a field in the left query table, obtain the table name and table alias of the left query table; If the right query table is of type simple table and the query field is a field in the right query table, obtain the table name and table alias of the right query table.

7. The method according to claim 4, characterized in that, After obtaining the field name and field alias of the query field, the method further includes: If the field alias is not empty, the field alias will be determined as the key value; If the field alias is empty, the field name will be determined as the key value.

8. The method according to claim 4, characterized in that, When the first data processing statement includes multiple query statements, the method further includes the following steps before traversing at least one query field corresponding to each query statement: The first data processing statement is decomposed into multiple query statements; The step of traversing at least one query field corresponding to the query statement includes: For each of the plurality of query statements, traverse at least one query field corresponding to the query statement.

9. The method according to claim 4, characterized in that, When the query statement includes a conditional statement, modifying the first field information in the query statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: Replace the field name corresponding to the first encrypted field in the conditional statement with the field name corresponding to the first index field; If the conditional statement contains a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain the field value corresponding to the first index field, and replace the field value corresponding to the first encrypted field in the conditional statement with the field value corresponding to the first index field. The replaced conditional statement is used as the second data processing statement.

10. The method according to claim 4, characterized in that, When the query statement includes a grouping statement, modifying the first field information in the query statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: Add the field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field in the grouping statement to obtain the second data processing statement.

11. The method according to claim 4, characterized in that, When the query statement includes a union query statement, modifying the first field information in the query statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: The second data processing statement is obtained by replacing the field name corresponding to the first encrypted field in the combined query statement with the field name corresponding to the first index field.

12. The method according to claim 4, characterized in that, The method further includes: Set a second hook point for the data acquisition interface; When the application service calls the data acquisition interface, the second hook is intercepted, and the data query results for the target database are obtained from the data acquisition interface through the second hook. If the data query result contains ciphertext data corresponding to the second encrypted field, the ciphertext data corresponding to the second encrypted field is decrypted to obtain plaintext data. Return the data query result containing the plaintext data to the application service.

13. The method according to claim 1, characterized in that, The first data processing statement includes an insert statement; Before modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field, when the first data processing statement contains first field information corresponding to the first encrypted field, the method further includes: Obtain the table name of the data table to be inserted, the field name and field value of the inserted field, and the duplicate key information corresponding to the insert statement; Iterate through at least one insertion field corresponding to the insertion statement; Based on the table name of the data table to be inserted and the field name of the inserted field, determine whether there is an encrypted field in the at least one inserted field; If the first data processing statement contains first field information corresponding to the first encrypted field, modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: If the first encrypted field exists in at least one of the insertion fields, perform a hash calculation on the field value corresponding to the first encrypted field in the insertion statement to obtain the field value corresponding to the first index field, and perform an encryption calculation on the field value corresponding to the first encrypted field to obtain the ciphertext data corresponding to the first encrypted field. In the insert statement, add a field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field, and replace the field value corresponding to the first encrypted field in the insert statement with the ciphertext data corresponding to the first encrypted field and the field value corresponding to the first index field; If the duplicate key information corresponding to the insert statement includes information corresponding to the first encrypted field, then add information corresponding to the first index field to the duplicate key information of the insert statement. The modified insert statement is used as the second data processing statement.

14. The method according to claim 1, characterized in that, Before modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field, when the first data processing statement contains first field information corresponding to the first encrypted field, the method further includes: Obtain the table name of the data table to be updated corresponding to the update statement, and the field name of the field to be updated; Iterate through at least one updated field corresponding to the update statement; Based on the table name of the data table to be updated and the field name of the updated field, determine whether there is an encrypted field in the at least one updated field.

15. The method according to claim 14, characterized in that, When the update statement contains a field value corresponding to the first encrypted field, modifying the first field information in the update statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: Hash the field value corresponding to the first encrypted field in the update statement to obtain the field value corresponding to the first index field, and encrypt the field value corresponding to the first encrypted field in the update statement to obtain the ciphertext data corresponding to the first encrypted field. In the update statement, at the positions corresponding to the field name and field value of the first encrypted field, add the field name and field value corresponding to the first index field; Replace the field value corresponding to the first encrypted field in the update statement with the ciphertext data corresponding to the first encrypted field.

16. The method according to claim 1, characterized in that, When the update statement contains a field value corresponding to the first encrypted field, and the field value comes from a subquery statement, modifying the first field information in the update statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: In the update statement and the subquery statement, add the field name corresponding to the first index field at the position corresponding to the field name of the first encrypted field.

17. The method according to claim 1, characterized in that, The first data processing statement includes a deletion statement; Before modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field, when the first data processing statement contains first field information corresponding to the first encrypted field, the method further includes: Retrieve the query conditions from the deletion statement; Iterate through at least one condition field included in the query conditions to determine whether there is an encrypted field among the at least one condition field; If the first data processing statement contains first field information corresponding to the first encrypted field, modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field includes: If the first encrypted field exists in at least one of the condition fields, the field name corresponding to the first encrypted field in the deletion statement is replaced with the field name corresponding to the first index field; If the deletion statement contains a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain the field value corresponding to the first index field, and replace the field value corresponding to the first encrypted field in the deletion statement with the field value corresponding to the first index field. The replaced deletion statement is used as the second data processing statement.

18. The method according to claim 1, characterized in that, When the first data processing statement is a statement corresponding to the pre-compiled method, after modifying the first field information in the first data processing statement to obtain a second data processing statement containing second field information corresponding to the first index field, the method further includes: Obtain the pre-compiled parameters corresponding to the first data processing statement; If the parameter value corresponding to the precompiled parameter includes a field value corresponding to the first encrypted field, perform a hash calculation on the field value corresponding to the first encrypted field to obtain a field value corresponding to the first index field, and modify the field value corresponding to the first encrypted field in the precompiled parameter to obtain a target precompiled parameter containing the field value corresponding to the first index field; and / or, perform an encryption calculation on the field value corresponding to the first encrypted field to obtain ciphertext data corresponding to the first encrypted field, and modify the field value corresponding to the first encrypted field in the precompiled parameter to obtain a target precompiled parameter containing ciphertext data corresponding to the first encrypted field; Update the precompiled parameter index corresponding to the precompiled parameter to obtain the precompiled parameter index corresponding to the target precompiled parameter.

19. The method according to claim 18, characterized in that, Before obtaining the pre-compiled parameters corresponding to the first data processing statement, the method further includes: Set the third hook for the precompiled parameter setting interface; The step of obtaining the pre-compiled parameters corresponding to the first data processing statement includes: When the application service calls the pre-compiled parameter setting interface, the third hook is intercepted, and the pre-compiled parameters corresponding to the first data processing statement are obtained from the pre-compiled parameter setting interface through the third hook.

20. A data processing apparatus, characterized in that, include: The statement acquisition module is used to acquire the first data processing statement generated by the application service for the target database, wherein the target database includes at least one encrypted field and its corresponding index field, and the target database stores ciphertext data for the at least one encrypted field. The statement modification module is used to modify the first field information in the first data processing statement when the first data processing statement contains first field information corresponding to the first encrypted field, so as to obtain a second data processing statement containing second field information corresponding to the first index field, wherein the first encrypted field is any encrypted field among the at least one encrypted field, and the first index field is an index field corresponding to the first encrypted field. The statement execution module is used to execute the second data processing statement to process the ciphertext data corresponding to the first encrypted field in the target database according to the second field information; The statement modification module is used to modify the first field information in the update statement when the first data processing statement includes an update statement and the first encrypted field exists in at least one update field corresponding to the update statement, so as to obtain a second data processing statement containing second field information corresponding to the first index field. The statement modification module is further configured to, when the update statement includes a field value corresponding to the first encrypted field, and the field value comes from a field value corresponding to the target field in another data table besides the data table to be updated corresponding to the update statement, and to add a field name and field value corresponding to the first index field at the position corresponding to the field name and field value of the first encrypted field in the update statement, wherein the field value corresponding to the first index field is set to the field value of the target index field corresponding to the target field in the other data table.

21. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the steps of the data processing method as described in any one of claims 1-19.

22. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the steps of the data processing method as described in any one of claims 1-19.

Images