Method and system for mysql proxy full-link encryption connection based on national secret algorithm

Abstract

The application discloses a MySQL proxy full-link encryption connection method and system based on a national secret algorithm, belongs to the technical field of databases, and aims to solve the technical problem of how to ensure full-link data encryption from a MySQL client initiating a query request to a server returning a response to the client based on the national secret algorithm. The MySQL client encrypts data in a request based on an SSL certificate and a client private key, and sends the encrypted request to a MySQL proxy server; the MySQL proxy server encrypts the decrypted data based on an SSL certificate and a server private key, and sends the re-encrypted data as a request to a MySQL server; the MySQL server sends encrypted response data to the MySQL client; and the MySQL proxy server encrypts the response data based on an SSL certificate and a server private key, and sends the encrypted response data to the MySQL client.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database, in particular to a MySQL proxy full-link encryption connection method and system based on a national cryptographic algorithm. BACKGROUND

[0002] With the rapid development of China's economy and the improvement of international status, information security and data security have become more important for China. Protecting information security not only relates to national security, but also involves the development of various fields such as economy, finance and military. In the network world, our personal information often exists in the form of data, such as name, address, phone number, bank account number, etc. If these sensitive information is attacked or stolen during transmission, it will bring us great loss and trouble. Therefore, ensuring the security of data transmission can effectively prevent personal information leakage and maintain personal privacy rights. As a cryptographic technology, national encryption has been fully verified in terms of security and reliability, which can effectively prevent information from being illegally stolen and tampered with, thereby protecting the national information security.

[0003] How to ensure the full-link data encryption based on the national cryptographic algorithm from the MySQL client initiating a query request to the server responding to the client is a technical problem to be solved. SUMMARY

[0004] The technical task of the present application is to provide a MySQL proxy full-link encryption connection method and system based on a national cryptographic algorithm to solve the technical problem of how to ensure the full-link data encryption based on the national cryptographic algorithm from the MySQL client initiating a query request to the server responding to the client.

[0005] In a first aspect, the present application provides a MySQL proxy full-link encryption connection method based on a national cryptographic algorithm, which is applied between a MySQL client, a MySQL proxy server and a MySQL server cluster. The method comprises the following steps:

[0006] The MySQL server master node generates SSL certificates and key files based on a national encryption algorithm. The key files include a client public-private key pair and a server public-private key pair. The SSL certificates and key files are distributed to backup nodes, slave nodes and MySQL proxy servers. The SSL certificates, the client public-private key pair and the server public key are sent to the MySQL client.

[0007] For the request to be initiated, the MySQL client encrypts the data in the request based on the SSL certificate and the client private key, and sends the encrypted request to the MySQL proxy server.

[0008] The MySQL proxy server receives the request sent by the MySQL client, decrypts the request, encrypts the decrypted data based on the SSL certificate and the server private key, and sends the re-encrypted data to the MySQL server as a request;

[0009] The MySQL server receives the request sent by the MySQL proxy server, decrypts the request, and sends response data to the MySQL proxy server;

[0010] The MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client.

[0011] Preferably, the request to be initiated includes a connection request, a write request, and a read request;

[0012] For the connection request, the MySQL proxy server sends the re-encrypted data to the MySQL server as a request;

[0013] For the write request, the MySQL proxy server sends the re-encrypted data to the MySQL server master node as a request;

[0014] For the read request, the MySQL proxy server sends the re-encrypted data to the MySQL server slave node and standby node as a request.

[0015] Preferably, the connection request includes authentication information and connection parameters of the MySQL client;

[0016] For the connection request to be initiated, the MySQL client encrypts the authentication information in the request based on the SSL certificate and the client private key, and sends the encrypted request to the MySQL proxy server;

[0017] The MySQL proxy server receives the request sent by the MySQL client, decrypts the request, and encrypts the decrypted authentication information based on the SSL certificate and the server private key, and sends the connection parameters and the re-encrypted authentication information to the MySQL server as a request;

[0018] The MySQL server receives the request sent by the MySQL proxy server, decrypts the request, and verifies based on the decrypted authentication information. If the verification is passed, the response data is sent to the MySQL proxy server;

[0019] The MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client.

[0020] As preferred, the key management system in the MySQL server master node provides a certificate management service and a key management service, the certificate management service includes certificate generation, certificate storage, certificate distribution, certificate rotation, certificate backup and certificate recovery, and the key management service includes key generation, key storage, key distribution, key rotation, key backup and key recovery.

[0021] As preferred, the key management system in the MySQL server master node generates SSL certificates and key files through the openssl tool, and specifies the national secret encryption algorithm in the configuration file of the SSL certificate and the key file.

[0022] In a second aspect, the present application provides a MySQL full-link encryption connection system based on a national secret algorithm, which comprises a MySQL client, a MySQL proxy server and a MySQL server, and the MySQL server cluster nodes include a master node, a slave node and a backup node.

[0023] The MySQL server master node is configured to generate SSL certificates and key files based on a national secret encryption algorithm, the key files include a client public-private key pair and a server public-private key pair, the SSL certificates and the key files are distributed to the backup node, the slave node and the MySQL proxy server, and the SSL certificates, the client public-private key pair and the server public key are sent to the MySQL client.

[0024] For a request to be initiated, the MySQL client is configured to encrypt the data in the request based on the SSL certificate and the client private key, and send the encrypted request to the MySQL proxy server.

[0025] The MySQL proxy server is configured to decrypt the request sent by the MySQL client, and encrypt the decrypted data based on the SSL certificate and the server private key, and send the re-encrypted data as a request to the MySQL server.

[0026] The MySQL server is configured to decrypt the request sent by the MySQL proxy server, and send the response data to the MySQL proxy server.

[0027] The MySQL proxy server is configured to encrypt the response data based on the SSL certificate and the server private key, and send the encrypted response data to the MySQL client.

[0028] As preferred, the request to be initiated includes a connection request, a write request and a read request.

[0029] For the connection request, the MySQL proxy server is configured to send the re-encrypted data as a request to the MySQL server.

[0030] For write requests, the MySQL proxy server is used to send the re-encrypted data as a request to the MySQL server master node;

[0031] For read requests, the MySQL proxy server sends the re-encrypted data as a request to the MySQL server slave and standby nodes.

[0032] Preferably, the connection request includes the MySQL client's authentication information and connection parameters;

[0033] For any connection request to be initiated, the MySQL client encrypts the authentication information in the request based on the SSL certificate and the client's private key, and then sends the encrypted request to the MySQL proxy server.

[0034] The MySQL proxy server receives requests from MySQL, decrypts them, and encrypts the decrypted authentication information based on the SSL certificate and the server's private key. It then sends the connection parameters and the re-encrypted authentication information as a request to the MySQL server.

[0035] The MySQL server receives requests from the MySQL proxy server, decrypts them, verifies the authentication information based on the decrypted information, and sends the response data to the MySQL proxy server after successful verification.

[0036] The MySQL proxy server is used to encrypt response data based on SSL certificates and server private keys, and then send the encrypted response data to the MySQL client.

[0037] Preferably, the MySQL server master node is configured with a key management system, which provides certificate management services and key management services. The certificate management service includes certificate generation, certificate storage, certificate distribution, certificate rotation, certificate backup and certificate recovery, while the key management service includes key generation, key storage, key distribution, key rotation, key backup and key recovery.

[0038] As a preferred option, the key management system in the MySQL server master node generates SSL certificates and key files using the openssl tool, and specifies the Chinese national cryptographic algorithm in the configuration files of the SSL certificates and key files.

[0039] The MySQL proxy end-to-end encrypted connection method and system based on national cryptographic algorithms of the present invention have the following advantages: it realizes secure communication between the MySQL cluster master node and slave node, MySQL proxy and MySQL client, the encryption mechanism simplifies the configuration and management process, and provides reliable data transmission protection. Attached Figure Description

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0041] The present application will be further described below in conjunction with the drawings.

[0042] Figure 1 A data flow diagram from a MySQL client to a MySQL proxy server and then to a MySQL server in the MySQL proxy full-link encryption connection method based on the national secret algorithm of the embodiment 1;

[0043] Figure 2 An SSL certificate management and distribution diagram in the MySQL proxy full-link encryption connection method based on the national secret algorithm of the embodiment 1. DETAILED DESCRIPTION

[0044] The present application will be further described below in conjunction with the drawings and specific embodiments, so that those skilled in the art can better understand the present application and implement it. However, the embodiments are not limiting to the present application, and the technical features in the embodiments and the embodiments can be combined with each other without conflict.

[0045] The present application provides a MySQL proxy full-link encryption connection method and system based on the national secret algorithm, which is used to solve the technical problem of how to ensure the full-link data encryption from the MySQL client initiating a query request to the server returning a response to the client based on the national secret algorithm.

[0046] Embodiment 1:

[0047] The present application provides a MySQL proxy full-link encryption connection method based on the national secret algorithm, which is applied between a MySQL client, a MySQL proxy server and a MySQL server. The MySQL server cluster nodes include a master node, a slave node and a backup node.

[0048] The method comprises the following steps:

[0049] S100, the master node of the MySQL server generates SSL certificates and key files based on the national secret encryption algorithm. The key files include a client public-private key pair and a server public-private key pair. The SSL certificates and the key files are distributed to the backup node, the slave node and the MySQL proxy server. The SSL certificates, the client public-private key pair and the server public key are sent to the MySQL client.

[0050] S200, for the request to be initiated, the MySQL client encrypts the data in the request based on the SSL certificate and the client private key, sends the encrypted request to the MySQL proxy server;

[0051] S300, the MySQL proxy server decrypts the request sent by the MySQL client after receiving it, encrypts the decrypted data based on the SSL certificate and the server private key, and sends the re-encrypted data as a request to the MySQL server;

[0052] S400, the MySQL server decrypts the request from the MySQL proxy server after receiving it, and sends the response data to the MySQL proxy server;

[0053] S500, the MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client.

[0054] In this embodiment, the request to be initiated includes a connection request, a write request and a read request. For the connection request, the MySQL proxy server sends the re-encrypted data as a request to the MySQL server. For the write request, the MySQL proxy server sends the re-encrypted data as a request to the master node of the MySQL server. For the read request, the MySQL proxy server sends the re-encrypted data as a request to the slave node and the standby node of the MySQL server.

[0055] Among them, the connection request includes the authentication information and connection parameters of the MySQL client; for the connection request to be initiated, the MySQL client encrypts the authentication information in the request based on the SSL certificate and the client private key, and sends the encrypted request to the MySQL proxy server; the MySQL proxy server decrypts the request sent by the MySQL client after receiving it, and encrypts the decrypted authentication information based on the SSL certificate and the server private key, and sends the connection parameters and the re-encrypted authentication information as a request to the MySQL server; the MySQL server decrypts the request from the MySQL proxy server after receiving it, and verifies based on the decrypted authentication information, and sends the response data to the MySQL proxy server after verification; the MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client.

[0056] MySQL proxy is a simple program that sits between the client and the MySQL server, monitoring, analyzing and changing their communication, managing and optimizing the requests and connections of the MySQL database. MySQL proxy can parse the SQL sent from the MySQL client, and then route the request to different MySQL cluster nodes according to the parsing result. For write requests, MySQL proxy will distribute them to the master node of the MySQL server cluster; for read requests, they will be distributed to the slave node and the standby node, which realizes the separation of read and write. In order to ensure that the MySQL proxy can establish SSL encrypted connections with the three nodes of the MySQL server cluster, we need to ensure that each node uses the same server certificate and key. In this way, when the MySQL proxy needs to communicate with a certain node, it can verify the identity of the other party by verifying the client certificate and key. In this way, not only can the security of data be guaranteed, but also the configuration and management process can be simplified.

[0057] The MySQL server master node is configured with a key management system, which provides certificate management services and key management services. The certificate management services include certificate generation, certificate storage, certificate distribution, certificate rotation, certificate backup and certificate recovery. The key management services include key generation, key storage, key distribution, key rotation, key backup and key recovery.

[0058] The key management system in the MySQL server master node generates SSL certificates and key files through the openssl tool, and specifies the SM encryption algorithm in the configuration file of the SSL certificate and key file.

[0059] The master node of the MySQL server cluster is responsible for generating SSL certificates, and uses a secure file transfer protocol (such as the scp command) to distribute these files to the slave nodes and standby nodes. The slave nodes and standby nodes need to receive and store these files in order to use them to establish secure connections in subsequent communications. As a specific implementation, the master node of the MySQL server cluster uses a key management system to simplify the distribution process of SSL certificates and private key files. The key management system is a tool for centralized management of keys, which can automatically distribute keys to different nodes or devices. By using the key management system, the master node can send the generated server certificate and private key file directly to the slave node and standby node without manually transferring the file.

[0060] In this embodiment, the MySQL client can directly access the MySQL server using SSL encryption or access the MySQL server through the MySQL proxy. In order to avoid the difference between the certificates used by the MySQL client to connect the MySQL server and the MySQL proxy, the SSL certificate and the key file generated by the MySQL server are distributed to the MySQL proxy server through the scp command.

[0061] The device key management system of the MySQL server generates certificates, and supports international algorithms such as AES128, AES256, SHA, SHA256, SHA384, and domestic encryption algorithms SM3 and SM4, so that the appropriate encryption algorithm can be selected according to the needs and national laws and regulations. The key management system uses the openssl tool to generate certificates and private keys, and can specify the domestic encryption algorithm in the configuration file openssl.cnf, such as the SM4 encryption algorithm:

[0062] attributes = sm4-id-alt-name:dn

[0063] The certificate generation process is as follows:

[0064] First, generate a 4096-bit RSA key: openssl genrsa -out ca.key 4096;

[0065] Further generate a server private key: openssl req -new -x509 -key ca.key -configopenssl.cnf -out server.crt -days 3650;

[0066] Further generate a client private key: openssl genrsa -out client.key 2048;

[0067] Fourth, generate a client certificate request: openssl req -new -key client.key -outclient.csr;

[0068] Finally generate the client certificate: openssl req -x509 -newkey rsa:2048 -nodes -keyout private_key.pem -out certificate.pem -subj " / C=CN / ST=SHANDONG / L=JiNan / O=Example Company / OU=IT Department / CN=example.com" -config openssl.cnf -extensions SAN+DNS:example.com.

[0069] A key management system is a software or hardware system that securely manages and stores the entire process of using keys. It provides a centralized and secure environment to generate, store, distribute, rotate, and revoke keys to ensure the confidentiality, integrity, and availability of keys. Key management systems usually include key generation, key storage, key distribution, key rotation, key backup and recovery, etc. functions to manage keys used in symmetric keys, asymmetric keys, digital certificates, and other encryption technologies. Upload the generated certificate and private key to the key management system to ensure that the certificate and private key are not on the ground and ensure security.

[0070] By managing certificates through the key management system, distribute them to the slave nodes and MySQL proxies of the MySQL cluster, ensure that the MySQL client, MySQL proxy, and MySQL server use the same set of certificates, simplify the configuration and management process. The MySQL client specifies the client certificate and private key to encrypt the request data and transmit it to the MySQL proxy. The MySQL proxy uses the certificate and private key to decrypt the request, analyze it, and then encrypt it and transmit it to the MySQL server, ensuring the encryption security of the request from the MySQL client to the MySQL proxy to the MySQL server. On the other hand, the MySQL server uses the same certificate and private key to encrypt the response data and returns the encrypted response data to the MySQL proxy. Then, the MySQL proxy returns the response data to the MySQL client. In this way, we can ensure the encryption security of the entire transmission process from the MySQL server to the MySQL proxy to the MySQL client. In summary, by generating SSL certificates using domestic encryption algorithms and managing certificates through the key management system, the present application realizes secure communication between the master node and the slave node of the MySQL cluster, MySQL proxy, and MySQL client. This encryption mechanism simplifies the configuration and management process and provides reliable data transmission protection.

[0071] Example 2:

[0072] The application discloses a MySQL full-link encryption connection system based on a national secret algorithm, which comprises a MySQL client, a MySQL proxy server and a MySQL server cluster.

[0073] The MySQL server master node is used for generating an SSL certificate and a key file based on a national secret encryption algorithm, the key file comprises a client public-private key pair and a server public-private key pair, the SSL certificate and the key file are distributed to backup nodes, slave nodes and the MySQL proxy server, and the SSL certificate, the client public-private key pair and the server public key are sent to the MySQL client.

[0074] For a request to be initiated, the MySQL client is used for encrypting data in the request based on the SSL certificate and the client private key, and the encrypted request is sent to the MySQL proxy server;

[0075] Correspondingly, the MySQL proxy server is used for decrypting the request sent by the MySQL client and encrypting the decrypted data based on the SSL certificate and the server private key, and the re-encrypted data is sent to the MySQL server as a request.

[0076] Correspondingly, the MySQL server is used for decrypting the request sent by the MySQL proxy server and sending response data to the MySQL proxy server.

[0077] Correspondingly, the MySQL proxy server is used for encrypting the response data based on the SSL certificate and the server private key, and the encrypted response data is sent to the MySQL client.

[0078] The request to be initiated comprises a connection request, a write request and a read request, for the connection request, the MySQL proxy server is used for sending the re-encrypted data to the MySQL server as a request, for the write request, the MySQL proxy server is used for sending the re-encrypted data to the MySQL server master node as a request, and for the read request, the MySQL proxy server is used for sending the re-encrypted data to the MySQL server slave node and the backup node as a request.

[0079] The authentication information and connection parameters of the MySQL client are included in the connection request; for the connection request to be initiated, the MySQL client encrypts the authentication information in the request based on the SSL certificate and the client private key, and sends the encrypted request to the MySQL proxy server; the MySQL proxy server decrypts the request sent by the MySQL after receiving it, and encrypts the decrypted authentication information based on the SSL certificate and the server private key, and sends the connection parameters and the re-encrypted authentication information as a request to the MySQL server; the MySQL server decrypts the request from the MySQL proxy server after receiving it, verifies based on the decrypted authentication information, and sends response data to the MySQL proxy server after verification; the MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client.

[0080] MySQL proxy is a simple program between the client and the MySQL server, which can monitor, analyze and change their communication, manage and optimize the requests and connections of the MySQL database. MySQL proxy can parse the SQL sent by the MySQL client, and then route the request to different MySQL cluster nodes according to the parsing result. For write requests, the MySQL proxy will distribute them to the master node of the MySQL server cluster; and for read requests, they will be distributed to the slave node and the standby node, which realizes the separation of read and write. In order to ensure that the MySQL proxy can establish an SSL encrypted connection with the three nodes of the MySQL server cluster, we need to ensure that each node uses the same server certificate and key. In this way, when the MySQL proxy needs to communicate with a node, it can confirm the identity of the other party by verifying the client certificate and key. In this way, not only the security of data can be guaranteed, but also the configuration and management process can be simplified.

[0081] The key management system is configured in the MySQL server master node, which provides certificate management services and key management services through the key management system. The certificate management services include certificate generation, certificate storage, certificate distribution, certificate rotation, certificate backup and certificate recovery, and the key management services include key generation, key storage, key distribution, key rotation, key backup and key recovery.

[0082] The key management system in the MySQL server master node generates SSL certificates and key files through the openssl tool, and specifies the national encryption algorithm in the configuration file of the SSL certificate and key file.

[0083] The master node of the MySQL server cluster is responsible for generating SSL certificates, and uses a secure file transfer protocol (such as the scp command) to distribute these files to the slave nodes and standby nodes. The slave nodes and standby nodes need to receive and store these files in order to use them to establish secure connections in subsequent communications. As a specific implementation, the master node of the MySQL server cluster uses a key management system to simplify the distribution process of SSL certificates and private key files. The key management system is a tool for centralized management of keys, which can automatically distribute keys to different nodes or devices. By using the key management system, the master node can send the generated server certificates and private key files directly to the slave nodes and standby nodes without manually transferring files.

[0084] In this embodiment, the MySQL client can access the MySQL server directly using SSL encryption, or access the MySQL server through the MySQL proxy. In order to avoid the use of different certificates by the MySQL client connecting to the MySQL server and the MySQL proxy, the SSL certificates and key files generated by the MySQL server are distributed to the MySQL proxy server through the scp command.

[0085] The device for generating certificates by the MySQL server is a key management system, which supports not only common international algorithms such as AES128, AES256, SHA, SHA256, and SHA384, but also domestic encryption algorithms such as SM3 and SM4. The appropriate encryption algorithm can be selected according to the needs and national laws and regulations. The key management system uses the openssl tool to generate certificates and private keys, and can specify the national encryption algorithm in its configuration file openssl.cnf, such as the SM4 encryption algorithm:

[0086] attributes = sm4-id-alt-name:dn

[0087] The certificate generation process is as follows:

[0088] First, generate a 4096-bit RSA key: openssl genrsa -out ca.key 4096;

[0089] Further generate a server private key: openssl req -new -x509 -key ca.key -config openssl.cnf -out server.crt -days 3650;

[0090] Further generate a client private key: openssl genrsa -out client.key 2048;

[0091] Fourth step, generate client certificate request: openssl req -new -key client.key -out client.csr;

[0092] Finally, generate client certificate: openssl req -x509 -newkey rsa:2048 -nodes -keyout private_key.pem -out certificate.pem -subj " / C=CN / ST=SHANDONG / L=JiNan / O=Example Company / OU=IT Department / CN=example.com" -config openssl.cnf -extensions SAN+DNS:example.com.

[0093] Key management system is a software or hardware system for securely managing and storing the entire process of using keys. It provides a centralized, secure environment to generate, store, distribute, rotate and revoke keys to ensure the confidentiality, integrity and availability of keys. Key management system usually includes key generation, key storage, key distribution, key rotation, key backup and recovery functions, etc. for managing keys used in symmetric key, asymmetric key, digital certificate and other encryption technologies. Upload the generated certificate and private key to the key management system to realize the off-ground certificate and private key and ensure security.

[0094] The certificate is managed by the key management system and distributed to the slave nodes and MySQL agents of the MySQL cluster, so that the same set of certificates is used by the MySQL client, the MySQL agent and the MySQL server, and the configuration and management process is simplified. The MySQL client specifies the client certificate and private key to encrypt the request data, which is transmitted to the MySQL agent. The MySQL agent uses the certificate and private key to decrypt the request, analyzes the decrypted request and transmits the encrypted response data to the MySQL server, so that the encryption security of the request initiated from the MySQL client to the MySQL agent and the MySQL server is ensured. On the other hand, the MySQL server uses the same certificate and private key to encrypt the response data, and returns the encrypted response data to the MySQL agent. Then, the MySQL agent returns the response data to the MySQL client. In this way, the encryption security of the entire transmission process from the response data returned by the MySQL server to the MySQL agent and then to the MySQL client is ensured. In summary, by generating the SSL certificate by using the domestic encryption algorithm and managing the certificate by the key management system, the secure communication between the master node and the slave node of the MySQL cluster, the MySQL agent and the MySQL client is realized. The encryption mechanism simplifies the configuration and management process and provides reliable data transmission protection.

[0095] The application is described in detail above by means of the drawings and preferred embodiments, but the application is not limited to these disclosed embodiments, and those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the application, and these embodiments are also within the protection scope of the application.

Claims

1. A MySQL proxy full-link encryption connection method based on a national secret algorithm, characterized in that, The method is applied to a MySQL client, a MySQL proxy server and a MySQL server cluster, the MySQL server cluster nodes include a master node, a slave node and a backup node, and the method comprises the following steps: The MySQL server master node generates an SSL certificate and a key file based on a national secret encryption algorithm, the key file includes a client public and private key pair and a server public and private key pair, the SSL certificate and the key file are distributed to the backup node, the slave node and the MySQL proxy server, the SSL certificate, the client public and private key pair and the server public key are sent to the MySQL client; For a request to be initiated, the MySQL client encrypts the data in the request based on the SSL certificate and the client private key, and sends the encrypted request to the MySQL proxy server; The MySQL proxy server decrypts the request sent by the MySQL client after receiving the request, and encrypts the decrypted data based on the SSL certificate and the server private key, and sends the re-encrypted data as a request to the MySQL server; The MySQL server decrypts the request of the MySQL proxy server after receiving the request, and sends response data to the MySQL proxy server; The MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client; The request to be initiated includes a connection request, a write request and a read request; For the connection request, the MySQL proxy server sends the re-encrypted data as a request to the MySQL server; For the write request, the MySQL proxy server sends the re-encrypted data as a request to the MySQL server master node; For the read request, the MySQL proxy server sends the re-encrypted data as a request to the MySQL server slave node and the backup node; The connection request includes authentication information and connection parameters of the MySQL client; For the connection request to be initiated, the MySQL client encrypts the authentication information in the request based on the SSL certificate and the client private key, and sends the encrypted request to the MySQL proxy server; The MySQL proxy server decrypts the request sent by the MySQL client after receiving the request, and encrypts the decrypted authentication information based on the SSL certificate and the server private key, and sends the connection parameters and the re-encrypted authentication information as a request to the MySQL server; The MySQL server decrypts the request of the MySQL proxy server after receiving the request, and verifies based on the decrypted authentication information, and sends response data to the MySQL proxy server after verification; The MySQL proxy server encrypts the response data based on the SSL certificate and the server private key, and sends the encrypted response data to the MySQL client.

2. The MySQL proxy connection method based on the national secret algorithm according to claim 1, characterized in that, The key management system is configured in the MySQL server master node, and the key management system provides a certificate management service and a key management service, the certificate management service includes certificate generation, certificate storage, certificate distribution, certificate rotation, certificate backup and certificate recovery, and the key management service includes key generation, key storage, key distribution, key rotation, key backup and key recovery.

3. The MySQL proxy connection method based on the national secret algorithm according to claim 2, characterized in that, The key management system in the MySQL server master node generates SSL certificates and key files through the openssl tool, and specifies the national secret encryption algorithm in the configuration file of the SSL certificate and the key file.

4. A MySQL full-link encryption connection system based on a national secret algorithm, characterized in that, The MySQL client, the MySQL proxy server and the MySQL server are included, and the MySQL server cluster node includes a master node, a slave node and a backup node. The MySQL server master node is configured to generate SSL certificates and key files based on the national secret encryption algorithm, the key file includes a client public-private key pair and a server public-private key pair, the SSL certificates and the key file are distributed to the backup node, the slave node and the MySQL proxy server, the SSL certificates, the client public-private key pair and the server public key are sent to the MySQL client; For the request to be initiated, the MySQL client is configured to encrypt the data in the request based on the SSL certificate and the client private key, and send the encrypted request to the MySQL proxy server; The MySQL proxy server is configured to decrypt the request sent by the MySQL client after receiving the request, and encrypt the decrypted data based on the SSL certificate and the server private key, and send the encrypted data as a request to the MySQL server; The MySQL server is configured to decrypt the request sent by the MySQL proxy server after receiving the request, and send the response data to the MySQL proxy server; The MySQL proxy server is configured to encrypt the response data based on the SSL certificate and the server private key, and send the encrypted response data to the MySQL client; The request to be initiated includes a connection request, a write request and a read request; For the connection request, the MySQL proxy server is configured to send the encrypted data as a request to the MySQL server; For the write request, the MySQL proxy server is configured to send the encrypted data as a request to the MySQL server master node; For the read request, the MySQL proxy server is configured to send the encrypted data as a request to the MySQL server slave node and the backup node; The connection request includes authentication information and connection parameters of the MySQL client; For the connection request to be initiated, the MySQL client is configured to encrypt the authentication information in the request based on the SSL certificate and the client private key, and send the encrypted request to the MySQL proxy server; The MySQL proxy server is configured to decrypt the request sent by the MySQL client after receiving the request, and encrypt the decrypted authentication information based on the SSL certificate and the server private key, and send the connection parameters and the encrypted authentication information as a request to the MySQL server. The MySQL server is configured to receive a request from the MySQL proxy server, decrypt the request, verify the decrypted authentication information, and send response data to the MySQL proxy server if the verification is successful; The MySQL proxy server is configured to encrypt the response data based on the SSL certificate and the server private key, and send the encrypted response data to the MySQL client.

5. The MySQL full-link encryption connection system based on the SM algorithm according to claim 4, characterized in that, The key management system is configured in the MySQL server master node to provide certificate management services and key management services, including certificate generation, certificate storage, certificate distribution, certificate rotation, certificate backup, and certificate recovery, and key generation, key storage, key distribution, key rotation, key backup, and key recovery.

6. The MySQL full-link encryption connection system based on the SM algorithm according to claim 5, characterized in that, The key management system in the MySQL server master node generates SSL certificates and key files using the openssl tool, and specifies the SM encryption algorithm in the configuration file of the SSL certificate and key file.

Images