A database encryption query processing method and confidential computing coprocessor

Abstract

The present invention discloses a database encryption query processing method and a confidential computing coprocessor. The method comprises: obtaining a connection establishment request from a client through a host machine, determining a user role and an encryption key used for interaction with the client according to the connection establishment request; obtaining encrypted query information from the client through the host machine, obtaining decrypted query information according to the encryption key and the encrypted query information; obtaining a database execution result of a local database according to the user role and the decrypted query information; generating an encrypted execution result according to the encryption key and the database execution result, and sending the encrypted execution result to the client through the host machine. The database of the present invention stores non-confidential data, the carrier of the database cannot be connected to the Internet, and the communication between the client and the database needs to be forwarded via the host machine. The communication between the carrier of the database, the host machine and the client is fully encrypted, which can accelerate the query while protecting the confidentiality of the data.

Description

Technical Field

[0001] The present invention relates to the field of trusted computing technology, and in particular to a database encryption query processing method and a confidential computing coprocessor. Background Art

[0002] A common method of data security protection is data encryption, where data is transmitted and stored in ciphertext form and then decrypted during calculation. Figure 2 As shown in the figure, the current mainstream technical solution is based on trusted hardware (trusted execution environment), and sensitive operations such as encryption and decryption are completed in trusted hardware. The engine file only stores ciphertext data, and the output data is also encrypted in the trusted environment and sent to the client. The user can decrypt the ciphertext on the client to obtain it. For example, in the GuassDB solution, expression parsing, data management, and index management are all completed in the trusted execution environment. The plaintext data cannot be peeped in the rich environment (REE), and even the administrator user (root user) cannot obtain the plaintext data through the engine file or memory. For example, in a fully encrypted database, data is stored in an encrypted form, and data storage, calculation, retrieval, and management are all completed in the ciphertext form, which can effectively protect data confidentiality and data integrity. However, since the data records and the corresponding indexes are encrypted, the index cannot be directly used to accelerate queries. Because the encryption operation changes the readability and structure of the data, the encrypted index cannot directly point to a specific data record like a plaintext index, which hinders the normal function of the index. In short, when both data and indexes are in an encrypted state, database queries become difficult.

[0003] Therefore, the existing technology still needs to be improved and developed. Summary of the invention

[0004] The technical problem to be solved by the present invention is that, in view of the above-mentioned defects of the prior art, a database encryption query processing method and a confidential computing coprocessor are provided, aiming to solve the problem in the prior art that, in order to protect the confidentiality of data, the storage and processing of data are completed in ciphertext form. When both the data and the index are in an encrypted state, it will make database query difficult.

[0005] The technical solution adopted by the present invention to solve the problem is as follows:

[0006] In a first aspect, an embodiment of the present invention provides a method for processing encrypted queries on a database, the method comprising:

[0007] Obtaining, through the host machine, a connection establishment request from the client, and determining, according to the connection establishment request, a user role of the client and an encryption key used for interacting with the client;

[0008] Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information;

[0009] According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data;

[0010] An encrypted execution result is generated according to the encryption key and the database execution result, and the encrypted execution result is sent to the client through the host machine.

[0011] In one embodiment, determining the user role of the client and the encryption key used for interacting with the client according to the connection establishment request includes:

[0012] Acquire connection parameters of the client according to the connection establishment request, and determine the user role according to the connection parameters;

[0013] The host obtains public key information from the client, and determines the encryption key according to the connection parameters and the public key information, wherein the encryption key includes the public key information and private key information.

[0014] In one implementation, obtaining the public key information from the client through the host includes:

[0015] Sending the certificate to be authenticated to the client through the host machine;

[0016] Obtaining, through the host machine, an authentication result sent back by the client based on the certificate to be authenticated, wherein the authentication result is used to reflect the result of the authentication service verifying the certificate to be authenticated;

[0017] The public key information is obtained according to the authentication result.

[0018] In one implementation, obtaining a database execution result of a local database according to the user role and the decrypted query information includes:

[0019] According to the user role and the decryption query information, determining whether the client has the execution authority corresponding to the decryption query information;

[0020] If the client has the execution authority corresponding to the decrypted query information, sending the query command in the decrypted query information to the local database;

[0021] Obtain the database execution result returned by the local database based on the query command.

[0022] In one embodiment, the method further comprises:

[0023] If the client does not have the execution authority corresponding to the decryption query information, the processing of the decryption query information is stopped.

[0024] In one implementation, obtaining the database execution result returned by the local database based on the query command includes:

[0025] Determine whether the local database contains a query result corresponding to the query command;

[0026] If the query result does not exist, sending the query command to other hosts through a preset encrypted channel and the host machine;

[0027] Obtaining the query result returned by the database on the other host based on the query command through the encrypted channel and the host machine;

[0028] The database execution result is generated according to the query result.

[0029] In one embodiment, the method further comprises:

[0030] A persistent connection is established with the client according to the connection establishment request until a disconnection request sent by the client is obtained through the host machine, wherein the persistent connection contains the user role and the encryption key.

[0031] In a second aspect, an embodiment of the present invention further provides a confidential computing coprocessor, wherein the confidential computing coprocessor comprises:

[0032] Local database, used to store non-confidential data;

[0033] The access layer service is used to obtain a connection establishment request from a client through a host machine, and determine a user role of the client and an encryption key used for interacting with the client according to the connection establishment request;

[0034] Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information;

[0035] According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data;

[0036] An encrypted execution result is generated according to the encryption key and the database execution result, and the encrypted execution result is sent to the client through the host machine.

[0037] In a third aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the database encryption query processing method as described above is implemented.

[0038] In a fourth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the database encryption query processing method as described above is implemented.

[0039] Beneficial effects of the present invention: The embodiment of the present invention obtains the connection establishment request of the client through the host machine, determines the user role and the encryption key used for interaction with the client according to the connection establishment request; obtains the encrypted query information of the client through the host machine, and obtains the decrypted query information according to the encryption key and the encrypted query information; obtains the database execution result of the local database according to the user role and the decrypted query information; generates the encrypted execution result according to the encryption key and the database execution result, and sends the encrypted execution result to the client through the host machine. The database of the present invention stores non-confidential data, the carrier of the database cannot be connected to the Internet, and the communication between the client and the database needs to be forwarded through the host machine. The communication between the carrier of the database, the host machine and the client is fully encrypted, which can speed up the query while protecting the confidentiality of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flowchart of a database encryption query processing method provided by an embodiment of the present invention.

[0042] Figure 2 It is a schematic diagram of the principle of the existing data security protection method provided by an embodiment of the present invention.

[0043] Figure 3 This is a schematic diagram of the three-party interaction among the confidential computing coprocessor, the host machine and the client provided in an embodiment of the present invention.

[0044] Figure 4 It is a schematic diagram of a database cluster provided by an embodiment of the present invention.

[0045] Figure 5 It is a schematic diagram of the functional modules of the access layer service provided by the embodiment of the present invention.

[0046] Figure 6 This is a module schematic diagram of the confidential computing coprocessor provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present invention discloses a database encryption query processing method and a confidential computing coprocessor. In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0048] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0049] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0050] In view of the above-mentioned defects of the prior art, the present invention provides a method for processing encrypted queries of a database, the method comprising: obtaining a connection request of a client through a host machine, determining the user role of the client and the encryption key used for interaction with the client according to the connection request; obtaining the encrypted query information of the client through the host machine, and obtaining the decrypted query information according to the encryption key and the encrypted query information; obtaining the database execution result of the local database according to the user role and the decrypted query information, wherein the stored data of the local database is non-confidential data; generating an encrypted execution result according to the encryption key and the database execution result, and sending the encrypted execution result to the client through the host machine. The database of the present invention stores non-confidential data, the carrier of the database itself cannot be connected to the Internet, and the communication between the client and the database needs to be forwarded via the host machine. The communication between the carrier of the database, the host machine and the client is fully encrypted, which can accelerate the query while protecting the confidentiality of the data. The problem that the storage and processing of data in the prior art are completed in the form of ciphertext in order to protect the confidentiality of the data, and when the data and index are in an encrypted state, it will make the database query difficult is solved.

[0051] For example, the confidential computing coprocessor A is used as the carrier of database B. Client C needs to query the storage data of database B, then client C sends a connection request for database B to host D. Host D forwards the connection request to the confidential computing coprocessor A. Confidential computing coprocessor A determines that the user role of client C is an administrator based on the connection request. Client C obtains the public key of confidential coprocessor A from the result of remote authentication. Client C sends the temporarily generated public key to confidential coprocessor A. Client C generates an encryption key through the public key of confidential coprocessor A and its own private key. Confidential coprocessor A generates an encryption key through the public key of client C and its own private key. After client C obtains the encryption key, it packages the query statement and encrypts it with the encryption key to obtain encrypted query information, and sends the encrypted query information to host D, which is forwarded to confidential computing coprocessor A. Confidential computing coprocessor A uses the encryption key to decrypt the encrypted query information to obtain decrypted query information. Through the user role of administrator, the query operation corresponding to the decrypted query information is performed on database B. Since both query information and stored data are non-confidential data, the database execution results can be quickly obtained. For data confidentiality, the confidential computing coprocessor A will encrypt the database execution results with an encryption key and then send the encrypted execution results to the host machine D, which will forward them to the client C.

[0052] like Figure 1 As shown, the method specifically includes:

[0053] Step S100: obtaining a connection request from a client through a host machine, and determining a user role of the client and an encryption key used for interacting with the client according to the connection request.

[0054] Specifically, in order to ensure the confidentiality of database data, this embodiment limits the carrier of the database to communicate through the host machine. The host machine has a networking function for executing data forwarding between the database carrier and the client. The client can be any terminal device that needs to query the database. An application program interface for accessing the database is provided on the client. Taking a database as an example, when the client wants to access the database, a connection request is sent to the host machine corresponding to the database through the application program interface. After the host machine receives the connection request, it will forward the connection request to the carrier containing the database. The carrier of the database will determine the user role of the client through the received connection request and generate a temporary encryption key. Once the encryption key is generated, the subsequent communication between the carrier, the host machine and the client of the database will be encrypted using the encryption key. Through data encryption and network security protocols, the confidentiality and integrity of the data during network transmission and database operation can be ensured.

[0055] In one implementation, Figure 3 As shown, the application program interface for accessing the database set on the client is a JDBC driver or SDK.

[0056] Specifically, JDBC is an application program interface in the Java language that regulates how client programs access databases, and provides methods such as querying and updating data in the database. JDBC is divided into four categories: Type 1, open database connection (JDBC-ODBC bridge); Type 2, local application programming interface (API), partial Java driver; Type 3, network protocol, full Java driver; Type 4, local protocol, full Java driver. This embodiment adopts Type 3, that is, creating a custom JDBC driver based entirely on Java, which uses the network protocol to communicate with the server, and then the server parses the parameters and establishes a connection with the database.

[0057] In one implementation, determining the user role of the client and an encryption key used for interacting with the client according to the connection establishment request includes:

[0058] Acquire connection parameters of the client according to the connection establishment request, and determine the user role according to the connection parameters;

[0059] The host obtains public key information from the client, and determines the encryption key according to the connection parameters and the public key information, wherein the encryption key includes the public key information and private key information.

[0060] Specifically, after receiving the connection establishment request forwarded by the host machine, the connection parameters filled in by the client can be extracted from it. The connection parameters can reflect the user information of the client and the relevant information of the object to be accessed, so the user role of the client can be identified through the connection parameters, and the connection between the database and the client can be established through the connection parameters. In addition, the encryption key in this embodiment is actually a key pair composed of public key information and private key information. The public key is open to the public, and the private key is only retained by the two interacting parties to ensure the uniqueness and security of the encryption key. In order to generate an encryption key, the carrier of the database also needs to obtain public key information from the client via the host machine, and generate a temporary encryption key based on the connection parameters and public key information.

[0061] For example, the connection parameters may include a user certificate, which may reflect the user information of the client, such as the role category and the identity identification number (ID); the connection parameters may also include relevant information of the access object. Taking the database carrier as a confidential computing coprocessor (SPU) as an example, the relevant information of the access object includes the Internet Protocol address (SPU IP), port (SPU port), database name (DB name), and database password (DB password). A connection can be established with the database through the database name and database password. The encryption key may use the SM4 block cipher algorithm.

[0062] In one implementation, obtaining the public key information from the client through the host includes:

[0063] Sending the certificate to be authenticated to the client through the host machine;

[0064] Obtaining, through the host machine, an authentication result sent back by the client based on the certificate to be authenticated, wherein the authentication result is used to reflect the result of the authentication service verifying the certificate to be authenticated;

[0065] The public key information is obtained according to the authentication result.

[0066] Specifically, the public key information in this embodiment is obtained through remote authentication of the authentication service, that is, the public key of the database carrier (confidential coprocessor A) mentioned above. Figure 3First, the certificate to be authenticated is sent to the host, which forwards it to the client. The client receives the certificate to be authenticated and establishes a connection with the authentication service (attestation service), such as a TLS connection. The client sends the certificate to be authenticated to the authentication service, which verifies the certificate to be authenticated and returns the authentication result, which includes the public key information. The client then sends the authentication result to the host, which forwards the authentication result and extracts the public key information from it.

[0067] Step S200: Obtain the encrypted query information of the client through the host machine, and obtain decrypted query information according to the encryption key and the encrypted query information.

[0068] Specifically, after the connection is established, the client will package the query information, encrypt it with the negotiated encryption key to generate encrypted query information, and then send the encrypted query information to the host. After receiving the encrypted query information, the host forwards it to the database carrier. The database carrier decrypts the encrypted query information based on the negotiated encryption key to obtain the decrypted query information. The decrypted query information is then parsed, thereby obtaining the client's query information under the condition of data transmission encryption.

[0069] For example, taking the case where the database carrier uses a confidential computing coprocessor, the client packages and encrypts the query information locally, and then sends the protocol package to the host, which forwards it to the confidential computing coprocessor. After receiving the protocol package, the confidential computing coprocessor uses the pre-negotiated encryption key to decrypt the query information (query statement) in the protocol package to obtain the decrypted query information, such as structured query language (SQL). After parsing the structured query language, the client's query information is obtained. Among them, SQL can be divided into two types: operating data and operating database tables. Operating data includes: selecting (select), inserting (insert), deleting (delete), updating (update), etc.; operating database tables include: dropping (drop), modifying (alter), etc.

[0070] Step S300: Obtain a database execution result of a local database according to the user role and the decryption query information, wherein the stored data of the local database is non-confidential data.

[0071] Specifically, the user role can reflect the size of the user's authority. Different user roles have different authorities, and thus the query scopes of the databases corresponding to different user roles are also different. This embodiment needs to combine the user role and the decrypted query information to jointly generate the database execution result, so as to better manage the access of clients with different user roles to the local database and improve the access security of the local database. In addition, in order to speed up the query, the local database stores data in a non-confidential form.

[0072] In one implementation, obtaining a database execution result of a local database according to the user role and the decrypted query information includes:

[0073] According to the user role and the decryption query information, determining whether the client has the execution authority corresponding to the decryption query information;

[0074] If the client has the execution authority corresponding to the decrypted query information, sending the query command in the decrypted query information to the local database;

[0075] Obtain the database execution result returned by the local database based on the query command.

[0076] Specifically, different user roles have different corresponding permissions. For example, the administrator role and the ordinary user role can operate the database tables and records created by this role, while the administrator role can operate the database tables and records created by this role, as well as the database tables created by other users. According to the user role of the current client, it is judged whether the decrypted query information sent by it exceeds its own execution permission. If it does not exceed, it means that the client has the execution permission corresponding to the decrypted query information. Then the query command in the decrypted query information is sent to the local database. The local database queries the stored data according to the query command to obtain the database execution result.

[0077] For example, take the case of using a confidential computing coprocessor as the carrier of the database. After the connection between the confidential computing coprocessor and the client is established, the client uses an encryption key to encrypt the SQL content to be queried, and sends the encrypted SQL content to the confidential computing coprocessor via the host. The confidential computing coprocessor decrypts and parses the received SQL content, and determines whether the client has execution permission based on the SQL content. If the client is an administrator (root user), it can execute SQL commands other than data queries on databases not created by this user; if the client is a normal user, it can only execute SQL commands on databases created by this user.

[0078] In one implementation, the method further includes:

[0079] If the client does not have the execution authority corresponding to the decryption query information, the processing of the decryption query information is stopped.

[0080] Specifically, if the user role of the client does not match the query information sent by it, it means that the client does not have the execution authority corresponding to the decrypted query information. In order to ensure the access security of the local database, the processing of the decrypted query information can be stopped, and a prompt message of no access authority can be returned to the client.

[0081] In one implementation, the obtaining the database execution result returned by the local database based on the query command includes:

[0082] Determine whether the local database contains a query result corresponding to the query command;

[0083] If the query result does not exist, sending the query command to other hosts through a preset encrypted channel and the host machine;

[0084] Obtaining the query result returned by the database on the other host based on the query command through the encrypted channel and the host machine;

[0085] The database execution result is generated according to the query result.

[0086] Specifically, Figure 4 As shown, in this embodiment, the database can exist in the form of a cluster, that is, multiple hosts are connected together to form a unified system to provide higher availability, reliability and scalability. Taking the case where the database carrier uses a confidential computing coprocessor as an example, for each host in the cluster, the host is connected to at least one confidential computing coprocessor, and the confidential computing coprocessor contains at least one database. Each confidential computing coprocessor can communicate with each other through its own host machine and work together to interact with the data of the database. In the actual application scenario, for the database currently accessed by the client, that is, the local database, if the query result required by the client cannot be queried in the local database, the confidential computing coprocessor sends the query command to the confidential computing coprocessor on other hosts through the host machine. After receiving the query command, the confidential computing coprocessor on the other host queries its own database according to the query command, and then sends the query result back to the confidential computing coprocessor, which returns the query result to the client through the host machine. In order to ensure the confidentiality of the data, the communication between the confidential computing coprocessors of different hosts will be carried out through a pre-established encrypted channel.

[0087] Step S400: Generate an encrypted execution result according to the encryption key and the database execution result, and send the encrypted execution result to the client through the host machine.

[0088] Specifically, in order to ensure the confidentiality of the data, after obtaining the data execution result, it is necessary to use an encryption key to encrypt the data execution result to obtain an encrypted execution result. The encrypted execution result is then sent to the host machine, which forwards it to the client. After the client receives the encrypted execution result, it uses the encryption key to decrypt it and obtain the database information it wants to query.

[0089] In one implementation, the method further includes:

[0090] A persistent connection is established with the client according to the connection establishment request until a disconnection request sent by the client is obtained through the host machine, wherein the persistent connection contains the user role and the encryption key.

[0091] Specifically, take the example of using a confidential computing coprocessor as the carrier of the database. A long connection is used between the confidential computing coprocessor and the client. The interface used to access data on the client (such as JDBC connection) will maintain the long connection. The long connection will record the current client's user role, encryption key and other user information. When the client needs to access the database again, it can continue to use the long connection, thereby omitting user role verification, encryption key generation and other links, and improving access efficiency. When the confidential computing coprocessor receives a disconnect request sent by the client, it obtains the long connection and disconnects the local database from the client by disconnecting the long connection.

[0092] In one implementation, the carrier of the local database adopts a confidential computing coprocessor.

[0093] Specifically, the confidential computing coprocessor (SPU) can provide a new hardware trusted computing execution environment, which has both a software platform and a hardware structure. This embodiment uses the confidential computing coprocessor as the carrier of the database, and the confidential computing coprocessor can run security applications for confidential computing to ensure the data confidentiality of the client accessing the database. For each database, the database is a local database for the confidential computing coprocessor where it is located.

[0094] For example, Figure 3 , 5As shown, the confidential computing coprocessor can set up an access layer service to execute the database encryption query processing methods provided by the above methods. The access layer service is responsible for connecting with the client and the local database to enable the client to access the local database. The functions of the access layer service include but are not limited to: SQL parsing, permission verification, connection management, and encryption / decryption of data.

[0095] The advantages of the present invention are:

[0096] 1. High security: Full-link data protection, from the client to the database, whether it is storage, transmission or calculation, the data is always encrypted. Remote authentication and encrypted query processing of the database can be realized to ensure the security of data during transmission and processing.

[0097] 2. High performance: It provides a fully confidential database implementation method that takes into account both security and performance. Through SPU-optimized database operations, it provides a performance experience similar to that of traditional databases, while ensuring confidential data processing. It can resolve the contradiction between data security and computing performance in existing technologies, reduce business intrusion, and provide data security protection throughout the entire life cycle.

[0098] 3. Powerful functions: Supports all database features, without sacrificing any original database functions to use a fully encrypted database.

[0099] 4. Good compatibility: It is compatible with various types of databases, and users can migrate to a fully encrypted database without modifying existing database applications.

[0100] 5. Scalability: Supports cluster deployment to meet the elastic expansion needs of the business.

[0101] Based on the above embodiments, the present invention also provides a confidential computing coprocessor, such as Figure 6 As shown, the confidential computing coprocessor includes:

[0102] Local database 01, used to store non-confidential data;

[0103] The access layer service 02 is used to obtain a connection establishment request from a client through a host machine, and determine a user role of the client and an encryption key used for interacting with the client according to the connection establishment request;

[0104] Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information;

[0105] According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data;

[0106] An encrypted execution result is generated according to the encryption key and the database execution result, and the encrypted execution result is sent to the client through the host machine.

[0107] In one implementation, a long connection is used between the access layer service and the client, and a connection pool is used to manage the connection between the access layer service and the local database.

[0108] In one implementation, the confidential computing coprocessor further includes:

[0109] A network management service is used to expose the port of the access layer service on the host machine to enable communication with the client and to support network communication with the database of the confidential computing coprocessor on other hosts.

[0110] Based on the above embodiments, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the database encryption query processing method provided by the above methods, the method includes:

[0111] Obtaining, through the host machine, a connection establishment request from the client, and determining, according to the connection establishment request, a user role of the client and an encryption key used for interacting with the client;

[0112] Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information;

[0113] According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data;

[0114] An encrypted execution result is generated according to the encryption key and the database execution result, and the encrypted execution result is sent to the client through the host machine.

[0115] Based on the above embodiments, the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for processing database encrypted queries provided by the above methods is implemented. The method includes:

[0116] Obtaining, through the host machine, a connection establishment request from the client, and determining, according to the connection establishment request, a user role of the client and an encryption key used for interacting with the client;

[0117] Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information;

[0118] According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data;

[0119] An encrypted execution result is generated according to the encryption key and the database execution result, and the encrypted execution result is sent to the client through the host machine.

[0120] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0122] In summary, the present invention discloses a database encryption query processing method and a confidential computing coprocessor. The method comprises: obtaining a connection establishment request from a client through a host machine, determining the user role of the client and the encryption key used for interaction with the client according to the connection establishment request; obtaining the encrypted query information of the client through the host machine, and obtaining the decrypted query information according to the encryption key and the encrypted query information; obtaining the database execution result of the local database according to the user role and the decrypted query information, wherein the stored data of the local database is non-confidential data; generating an encrypted execution result according to the encryption key and the database execution result, and sending the encrypted execution result to the client through the host machine. The database of the present invention stores non-confidential data, the carrier of the database itself cannot be connected to the Internet, and the communication between the client and the database needs to be forwarded via the host machine. The communication between the carrier of the database, the host machine and the client is fully encrypted, which can accelerate the query while protecting the confidentiality of the data. It solves the problem in the prior art that in order to protect the confidentiality of the data, the storage and processing of the data are completed in the form of ciphertext, and when the data and index are in an encrypted state, it will make the database query difficult.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A database encrypted query processing method, characterized in that: The method comprises: Obtaining, through the host machine, a connection establishment request from the client, and determining, according to the connection establishment request, a user role of the client and an encryption key used for interacting with the client; Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information; According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data; Generate an encrypted execution result according to the encryption key and the database execution result, and send the encrypted execution result to the client through the host machine; The determining, according to the connection establishment request, the user role of the client and the encryption key used for interaction with the client comprises: Acquire connection parameters of the client according to the connection establishment request, and determine the user role according to the connection parameters; Obtaining public key information from the client through the host machine, and determining the encryption key according to the connection parameters and the public key information, wherein the encryption key includes the public key information and private key information; The obtaining the public key information from the client through the host machine includes: Sending the certificate to be authenticated to the client through the host machine; Obtaining, through the host machine, an authentication result sent back by the client based on the certificate to be authenticated, wherein the authentication result is used to reflect the result of the authentication service verifying the certificate to be authenticated; Acquire the public key information according to the authentication result; The obtaining, according to the user role and the decrypted query information, a database execution result of the local database includes: According to the user role and the decryption query information, determining whether the client has the execution authority corresponding to the decryption query information; If the client has the execution authority corresponding to the decrypted query information, sending the query command in the decrypted query information to the local database; Obtaining the database execution result returned by the local database based on the query command; The obtaining the database execution result returned by the local database based on the query command includes: Determine whether the local database contains a query result corresponding to the query command; If the query result does not exist, sending the query command to other hosts through a preset encrypted channel and the host machine; Obtaining the query result returned by the database on the other host based on the query command through the encrypted channel and the host machine; Generate the database execution result according to the query result; The carrier of the local database adopts a confidential computing coprocessor and communicates through the host machine; the host machine has a networking function, which is used to execute data forwarding between the database carrier and the client; the confidential computing coprocessor specifically includes: an access layer service, which is used to execute the database encryption query processing method; a network management service, which is used to expose the port of the access layer service on the host machine to realize communication with the client, and support network communication with the database of the confidential computing coprocessor on other hosts; the confidential computing coprocessor provides a new hardware trusted computing execution environment, and has a software platform and hardware structure, which can run security applications for confidential computing to ensure the confidentiality of data in the process of client accessing the database.

2. The method for processing database encrypted queries according to claim 1, characterized in that: The method further comprises: If the client does not have the execution authority corresponding to the decryption query information, the processing of the decryption query information is stopped.

3. The method for processing database encrypted queries according to claim 1, characterized in that: The method further comprises: A persistent connection is established with the client according to the connection establishment request until a disconnection request sent by the client is obtained through the host machine, wherein the persistent connection contains the user role and the encryption key.

4. A confidential computing coprocessor, characterized in that: The confidential computing coprocessor comprises: Local database, used to store non-confidential data; The access layer service is used to obtain a connection establishment request from a client through a host machine, and determine a user role of the client and an encryption key used for interacting with the client according to the connection establishment request; Obtaining the encrypted query information of the client through the host machine, and obtaining decrypted query information according to the encryption key and the encrypted query information; According to the user role and the decryption query information, obtaining a database execution result of a local database, wherein the stored data of the local database is non-confidential data; Generate an encrypted execution result according to the encryption key and the database execution result, and send the encrypted execution result to the client through the host machine; The determining, according to the connection establishment request, the user role of the client and the encryption key used for interaction with the client comprises: Acquire connection parameters of the client according to the connection establishment request, and determine the user role according to the connection parameters; Obtaining public key information from the client through the host machine, and determining the encryption key according to the connection parameters and the public key information, wherein the encryption key includes the public key information and private key information; The obtaining the public key information from the client through the host machine includes: Sending the certificate to be authenticated to the client through the host machine; Obtaining, through the host machine, an authentication result sent back by the client based on the certificate to be authenticated, wherein the authentication result is used to reflect the result of the authentication service verifying the certificate to be authenticated; Acquire the public key information according to the authentication result; The obtaining, according to the user role and the decrypted query information, a database execution result of the local database includes: According to the user role and the decryption query information, determining whether the client has the execution authority corresponding to the decryption query information; If the client has the execution authority corresponding to the decrypted query information, sending the query command in the decrypted query information to the local database; Obtaining the database execution result returned by the local database based on the query command; The obtaining the database execution result returned by the local database based on the query command includes: Determine whether the local database contains a query result corresponding to the query command; If the query result does not exist, sending the query command to other hosts through a preset encrypted channel and the host machine; Obtaining the query result returned by the database on the other host based on the query command through the encrypted channel and the host machine; Generate the database execution result according to the query result; The confidential computing coprocessor also includes: a network management service for exposing the port of the access layer service on the host machine to achieve communication with the client, and to support network communication with the database of the confidential computing coprocessor on other hosts; the confidential computing coprocessor provides a new hardware trusted computing execution environment, which has a software platform and hardware structure, and can run secure applications for confidential computing to ensure the confidentiality of data in the process of client accessing the database.

5. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for processing database encrypted queries is implemented.

6. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for processing database encrypted queries is implemented.

Images