Data storage encryption method, device, medium and product based on hardware password card

Abstract

The present invention provides a data storage encryption method based on a hardware password card, which can be applied to the fields of database technology and data security technology. The method comprises: in response to a data storage request of a user, determining the data to be stored and a first target data table from the data storage request; acquiring an encryption switch corresponding to the first target data table and an encryption algorithm for encrypting the data to be stored from a database table-level storage space; when the encryption switch is in an on state, acquiring storage location information of an encryption key in a hardware password card from table encryption data related to the first target data table; acquiring an encryption key based on the storage location information using the hardware password card; performing an encryption operation on the data to be stored based on the encryption algorithm, the encryption key and the encryption random value using the hardware password card to obtain encrypted data; reconstructing the storage location information of the encrypted data and the encryption key to obtain stored data.

Description

Technical Field

[0001] The present invention relates to the fields of database technology and data security technology, and in particular to a data storage encryption method, device, medium and product based on a hardware password card. Background Art

[0002] With the rapid construction and development of various information systems and data centers, the amount of sensitive business data has gradually increased, and the resulting data storage security issues have become increasingly prominent. Correspondingly, database storage encryption technology has also been continuously developing. Existing database storage encryption is mainly performed through encryption software, and the encryption key is managed through cloud services or local file systems.

[0003] Since the encryption efficiency of the software system is low and the encryption key is easily obtained improperly, it is difficult to meet the requirements of secure data storage. Summary of the invention

[0004] In view of the above problems, the present invention provides a data storage encryption method, device, medium and product based on a hardware password card.

[0005] According to a first aspect of the present invention, a data storage encryption method based on a hardware password card is provided, the method comprising: in response to a data storage request of a user, determining data to be stored and a first target data table from the data storage request; acquiring an encryption switch corresponding to the first target data table and an encryption algorithm for encrypting the data to be stored from a database table-level storage space; when the encryption switch is in an on state, acquiring storage location information of an encryption key in a hardware password card from table encryption data related to the first target data table; acquiring an encryption key based on the storage location information using the hardware password card; performing an encryption operation on the data to be stored based on the encryption algorithm, the encryption key and an encrypted random value using the hardware password card to obtain encrypted data; and reconstructing the storage location information of the encrypted data and the encryption key to obtain stored data.

[0006] The data to be stored is plain text data, and the first target data table is a storage space for the data to be stored. There is a mapping relationship between the encryption algorithm and the first target data table.

[0007] According to an embodiment of the present invention, obtaining storage location information of an encryption key in a hardware password card from table encryption data related to a first target data table includes: determining the table encryption data related to the first target data table from a predetermined storage space; parsing the table encryption data according to a preset parsing format to obtain a table encryption element set; and determining storage location information of the encryption key in the hardware password card from the table encryption element set.

[0008] According to an embodiment of the present invention, the method further includes: after creating the first target data table, determining an encryption algorithm for the first target data table; inputting the encryption algorithm and basic information of the first target data table into a password card, generating an encryption key for the first target data table, and storing the encryption key in the hardware password card to obtain storage location information; reconstructing the basic information of the first target data table and the storage location information of the encryption key of the first target data table to obtain table encryption data related to the first target data table.

[0009] The number of data to be stored is multiple.

[0010] According to an embodiment of the present invention, the method further includes: when the amount of data to be stored meets a preset amount threshold, sequentially writing the plurality of stored data to a disk used to store the first target data table.

[0011] According to an embodiment of the present invention, the method also includes: when the encryption algorithm of the data table is the same as the encryption algorithm of the first target data table, determining the storage location information of the encryption key of the first target data table as the storage location information of the encryption key of the data table; reconstructing the basic information of the data table and the storage location information of the encryption key of the first target data table to obtain the table encrypted data of the data table.

[0012] The data table is used to store other data to be stored.

[0013] According to an embodiment of the present invention, an encryption algorithm and basic information of a first target data table are input into a hardware password card, an encryption key of the first target data table is generated, and the encryption key is stored in the hardware password card, and obtaining the storage location information includes: based on the encryption algorithm, the basic information of the first target data table and identification information characterizing the storage of the encryption key in the hardware password card, the encryption key is generated using the hardware password card, and the storage location information of the encryption key is obtained through an encryption key generation interface of the hardware password card.

[0014] According to an embodiment of the present invention, the method further includes: in response to a user's data query request, determining a data identifier of the data to be queried and a second target data table from the data query request; based on the data identifier of the data to be queried, obtaining the data to be queried from the second target data table; extracting storage location information of the decryption key, ciphertext data and a decryption random value from the data to be queried; obtaining the decryption key based on the storage location information of the decryption key using a hardware password card; and performing a decryption operation on the stored data based on a decryption algorithm, a decryption random value and a decryption key using the hardware password card to obtain the second target data.

[0015] According to an embodiment of the present invention, the second target data table is a storage space for data to be queried.

[0016] According to an embodiment of the present invention, the storage location information of the decryption key is the same as the storage location information of the encryption key, and the decryption random value is the same as the encryption random value.

[0017] A second aspect of the present invention provides a data storage encryption device based on a hardware password card, comprising: a first determination module, for responding to a data storage request of a user, and determining data to be stored and a first target data table from the data storage request.

[0018] According to an embodiment of the present invention, the data to be stored is plain text data, and the first target data table is a storage space for the data to be stored.

[0019] The first acquisition module is used to acquire, from the database table-level storage space, an encryption switch corresponding to the first target data table and an encryption algorithm used to encrypt the data to be stored.

[0020] There is a mapping relationship between the encryption algorithm and the first target data table.

[0021] The second acquisition module is used to acquire storage location information of the encryption key in the hardware password card from the table encryption data related to the first target data table when the encryption switch is in the on state.

[0022] The third acquisition module is used to acquire the encryption key based on the storage location information using the hardware password card.

[0023] The encryption module is used to use the hardware password card to perform encryption operations on the data to be stored based on the encryption algorithm, encryption key and encryption random value to obtain encrypted data.

[0024] The reconstruction module is used to reconstruct the storage location information of the encrypted data and the encryption key to obtain the stored data.

[0025] The third aspect of the present invention further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0026] The fourth aspect of the present invention further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0027] According to an embodiment of the present invention, the storage location information of the encryption key in the hardware password card is obtained from the table encryption data, rather than directly obtaining the encryption key, so that the security of the data storage encryption method based on the hardware password card can be improved. By inputting the storage location information, encryption algorithm, encryption random value and data to be stored into the hardware password card, the encrypted data is obtained. Compared with the encryption of the software encryption system, the encryption efficiency can be improved because the hardware password card does not require complex deployment. Obtaining the encryption key through the storage location information can ensure that the encryption key is not improperly obtained, thereby ensuring the security of the stored data. In addition, since the stored data is ciphertext data, the real data cannot be obtained when the stored data is improperly obtained. Through reconstruction, the location of the encryption key is included in the stored data. Therefore, when the stored data is subsequently changed and stored, the storage location information of the encryption key can be directly obtained through the stored data, thereby improving the processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0029] Figure 1 The invention shows an application scenario diagram of a data storage encryption method, device, and product based on a hardware password card according to an embodiment of the present invention.

[0030] Figure 2 A flow chart of a data storage encryption method based on a hardware password card according to an embodiment of the present invention is shown.

[0031] Figure 3 A flowchart of acquiring table encryption data related to a first target data table according to an embodiment of the present invention is shown.

[0032] Figure 4 A flowchart of acquiring second target data according to an embodiment of the present invention is shown.

[0033] Figure 5 A structural block diagram of a data storage encryption device based on a hardware password card according to an embodiment of the present invention is shown.

[0034] Figure 6 A block diagram of an electronic device suitable for implementing a data storage encryption method based on a hardware password card according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0035] Below, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of concepts of the present invention.

[0036] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0037] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0038] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0039] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, invention and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0040] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present invention provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0041] According to the embodiment of the present invention, the security of managing encryption keys through the local file system is low and can be easily obtained improperly. In addition, when managing encryption keys through cloud services, the deployment requirements are high and the reliance on cloud servers is strong, and it is impossible to achieve simple deployment of transparent encryption functions.

[0042] The embodiment of the present invention provides a data storage encryption method based on a hardware password card. In response to a data storage request of a user, the method determines the data to be stored and a first target data table from the data storage request; obtains an encryption switch corresponding to the first target data table and an encryption algorithm for encrypting the data to be stored from a database table-level storage space; when the encryption switch is in an on state, obtains storage location information of an encryption key in a hardware password card from table encryption data related to the first target data table; obtains the encryption key based on the storage location information using the hardware password card; performs an encryption operation on the data to be stored based on the encryption algorithm, the encryption key and the encrypted random value using the hardware password card to obtain encrypted data; and reconstructs the storage location information of the encrypted data and the encryption key to obtain stored data.

[0043] Figure 1 The invention shows an application scenario diagram of a data storage encryption method, device, and product based on a hardware password card according to an embodiment of the present invention.

[0044] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0045] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0046] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0047] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0048] It should be noted that the data storage encryption method based on the hardware password card provided in the embodiment of the present invention can generally be executed by the server 105. Accordingly, the data storage encryption device based on the hardware password card provided in the embodiment of the present invention can generally be set in the server 105. The data storage encryption method based on the hardware password card provided in the embodiment of the present invention can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the data storage encryption device based on the hardware password card provided in the embodiment of the present invention can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0049] It should be understood that Figure 1 The number of the first terminal device, the second terminal device, the third terminal device, the network and the server in the embodiment is only for illustration. According to the implementation requirements, there may be any number of the first terminal device, the second terminal device, the third terminal device, the network and the server.

[0050] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The data storage encryption method based on the hardware password card of the embodiment of the invention is described in detail.

[0051] Figure 2 A flow chart of a data storage encryption method based on a hardware password card according to an embodiment of the present invention is shown.

[0052] like Figure 2 As shown, the data storage encryption based on the hardware password card of this embodiment includes operations S210 to S260.

[0053] In operation S210 , in response to a data storage request from a user, data to be stored and a first target data table are determined from the data storage request.

[0054] According to an embodiment of the present invention, the data to be stored is plain text data, and the first target data table is a storage space for the data to be stored.

[0055] According to an embodiment of the present invention, after receiving a data storage request from a user, the data storage request may be parsed according to a preset format to obtain a parsed data set, and the data to be stored and the first target data table may be screened from the parsed data set.

[0056] According to an embodiment of the present invention, the first target data table may be stored in a database, such as a common database or a distributed database.

[0057] In operation S220, an encryption switch corresponding to the first target data table and an encryption algorithm for encrypting data to be stored are acquired from the database table-level storage space.

[0058] According to an embodiment of the present invention, there is a mapping relationship between the encryption algorithm and the first target data table, and the encryption algorithm may be a symmetric encryption algorithm.

[0059] According to an embodiment of the present invention, the database table-level storage space may be a system table of a database table-level storage encryption engine.

[0060] According to an embodiment of the present invention, the first target data table may be an encrypted table. The first target data table may be created using a database table-level storage encryption engine. When creating the first target data table, basic information related to the first target data table may be created, and the basic information may be stored in a database table-level storage space. The basic information may include control information, an identifier, and the like. The control information may be, for example, an encryption switch and an encryption algorithm. The encryption algorithm may be specified as required. The database table-level storage space may be, for example, a table containing metadata related to a database. In the database table-level storage space, the control information may be stored in a storage space corresponding to a control parameter field (reloptions) of the database table-level storage space. The encryption switch may be a table-level transparent encryption switch.

[0061] In operation S230, when the encryption switch is turned on, storage location information of the encryption key in the hardware password card is obtained from table encryption data related to the first target data table.

[0062] According to an embodiment of the present invention, the state of the encryption switch of the first target data table can be obtained from the database table-level storage space. When creating the first target data table, a related function can be called to set the state of the encryption switch to the on state, indicating that the first target data table is an encrypted table.

[0063] According to an embodiment of the present invention, the encryption key and the storage location information of the encryption key in the hardware password card correspond one to one.

[0064] According to an embodiment of the present invention, the number of encryption keys stored in the hardware password card is within a preset threshold range. When the storage period of the encryption key is temporary storage, the preset threshold may be 100, and when the storage period of the encryption key is permanent storage, the preset threshold may be 1024.

[0065] According to an embodiment of the present invention, the table encryption data may be composed of control information of the first target data table and storage location information of the encryption key in the hardware password card in accordance with a preset composition format.

[0066] According to an embodiment of the present invention, the storage location information of the table encrypted data may be related to the storage location information of the first target data table. For example, the first target data table and the table encrypted data may be stored in a common database at the same time. When the first target data table and the table encrypted data may also be stored in multiple storage nodes of a distributed database at the same time, for each storage node, the storage location information of the encryption key included in the table encrypted data in the hardware password card may be different.

[0067] According to an embodiment of the present invention, when the first target data table is stored in a common database, a query statement can be used to query table encryption data from the common database, and the table encryption data can be parsed to obtain storage location information of the encryption key in the hardware password card.

[0068] According to an embodiment of the present invention, when the first target data table is stored in a storage node of a distributed database, query statements can be used to query table encryption data related to the first target data table from multiple storage nodes respectively, and the storage location information of the corresponding encryption key in the hardware password card can be obtained from the table encryption data of each storage node respectively.

[0069] In operation S240, the encryption key is acquired based on the storage location information using the hardware password card.

[0070] In operation S250, the hardware password card is used to perform an encryption operation on the data to be stored based on the encryption algorithm, the encryption key and the encryption random value to obtain encrypted data.

[0071] According to an embodiment of the present invention, the encryption algorithm may be a simplified message block cipher (SM) algorithm, specifically, an SM4 algorithm.

[0072] According to an embodiment of the present invention, control information of the first target data table can be obtained from a database table-level storage space storing the first target data table, and an encryption algorithm can be obtained from the control information.

[0073] According to an embodiment of the present invention, the encryption interface of the hardware password card can be called, and the storage location information can be transmitted to the hardware password card through the location parameter. The hardware password card searches for the corresponding encryption key according to the storage location information.

[0074] According to an embodiment of the present invention, the encrypted random value may be an initialization vector (IV) randomly generated based on an encryption algorithm.

[0075] According to an embodiment of the present invention, when calling the encryption interface, the identifier of the encryption algorithm, the data to be stored and the operation mode of the encryption operation can also be transmitted to the hardware password card at the same time. After obtaining the encryption key, the hardware password card can perform an encryption operation on the data to be stored to obtain encrypted data.

[0076] In operation S260, the storage location information of the encrypted data and the encryption key is reconstructed to obtain the stored data.

[0077] According to an embodiment of the present invention, the storage location information of encrypted data and encryption keys can be converted into the same data format as required, and the converted encrypted data and the storage location information of the converted encryption keys are merged according to a preset merge format to obtain storage data.

[0078] According to an embodiment of the present invention, the storage location information of the encryption key in the hardware password card is obtained from the table encryption data, rather than directly obtaining the encryption key, so that the security of the data storage encryption method based on the hardware password card can be improved. By inputting the storage location information, encryption algorithm, encryption random value and data to be stored into the hardware password card, the encrypted data is obtained. Compared with the encryption of the software encryption system, the encryption efficiency can be improved because the hardware password card does not require complex deployment. Obtaining the encryption key through the storage location information can ensure that the encryption key is not improperly obtained, thereby ensuring the security of the stored data. In addition, since the stored data is ciphertext data, the real data cannot be obtained when the stored data is improperly obtained. Through reconstruction, the location of the encryption key is included in the stored data. Therefore, when the stored data is subsequently changed and stored, the storage location information of the encryption key can be directly obtained from the stored data to improve the processing efficiency.

[0079] According to an embodiment of the present invention, obtaining storage location information of an encryption key in a hardware password card from table encryption data related to a first target data table includes: determining the table encryption data related to the first target data table from a predetermined storage space; parsing the table encryption data according to a preset parsing format to obtain a table encryption element set; and determining storage location information of the encryption key in the hardware password card from the table encryption element set.

[0080] According to an embodiment of the present invention, the predetermined storage space may be a storage space in a common database, or a storage space in a storage node storing the first target data table in a distributed database.

[0081] According to an embodiment of the present invention, a preset parsing format and table encryption data can be input into a data parsing function to obtain a table encryption element set. The table encryption element set includes storage location information of the encryption key in the hardware password card and control information of the first target data table. The storage location information of the encryption key in the hardware password card can be filtered from the table encryption element set.

[0082] Figure 3 A flowchart of acquiring table encryption data related to a first target data table according to an embodiment of the present invention is shown.

[0083] like Figure 3 As shown, obtaining table encrypted data related to the first target data table includes operations S310 to S330.

[0084] In operation S310, after creating a first target data table, an encryption algorithm of the first target data table is determined.

[0085] In operation S320, the encryption algorithm and basic information of the first target data table are input into the password card, an encryption key of the first target data table is generated, and the encryption key is stored in the hardware password card to obtain storage location information.

[0086] In operation S330, basic information of the first target data table and storage location information of the encryption key of the first target data table are reconstructed to obtain table encryption data related to the first target data table.

[0087] According to an embodiment of the present invention, a specific function may be called to obtain control information of the first target data table from the database table-level storage space, and the encryption algorithm of the first target data table may be obtained from the control information.

[0088] According to an embodiment of the present invention, after creating the first target data table, the key generation interface of the hardware password card can be called, and the identifier of the encryption algorithm, the basic information of the first target data and the setting parameters related to the encryption key are used as parameters of the key generation interface to generate an encryption key of a specified type and store it in the hardware password card.

[0089] According to an embodiment of the present invention, the storage location information can be set by a user or automatically set by a hardware password card. The basic information can include an identifier of the first target data table, control information, and the like.

[0090] According to an embodiment of the present invention, the storage period of the encryption key can be set by setting parameters related to the encryption key. The storage period can be, for example, temporary storage or permanent storage. When the storage period is permanent storage, the storage location of the encryption key in the hardware password card can be automatically set by the hardware password card or can be set by the user.

[0091] According to an embodiment of the present invention, the basic information of the first target data table and the storage location information of the encryption key of the first target data table may be reconstructed according to a preset reconstruction format to obtain table encrypted data.

[0092] According to an embodiment of the present invention, the number of data to be stored is multiple.

[0093] According to an embodiment of the present invention, the method may further include the following operation: when the amount of data to be stored meets a preset amount threshold, sequentially writing the plurality of stored data to a disk used to store the first target data table.

[0094] According to an embodiment of the present invention, the stored data may be stored in a table file of the first target data table in sequence, and when the amount of stored data meets a preset amount threshold, the stored data in the table file may be written to the disk in sequence.

[0095] According to an embodiment of the present invention, by flushing storage data of a preset quantity threshold rather than a single storage data to a disk, computing resources used for flushing can be saved.

[0096] According to an embodiment of the present invention, the method may further include the following operations: when the encryption algorithm of the data table is the same as the encryption algorithm of the first target data table, determining the storage location information of the encryption key of the first target data table as the storage location information of the encryption key of the data table; reconstructing the basic information of the data table and the storage location information of the encryption key of the first target data table to obtain the table encrypted data of the data table.

[0097] The data table is used to store other data to be stored.

[0098] According to an embodiment of the present invention, the basic information of the data table and the storage location information of the encryption key of the first target data table are reconstructed to obtain the table encrypted data of the data table, which may be the same as the basic information of the first target data table and the storage location information of the encryption key of the first target data table are reconstructed to obtain the table encrypted data of the first target data table.

[0099] According to an embodiment of the present invention, when the storage location information of the encryption key of the first target data table and the storage location information of the encryption key of the data table are the same, the encryption key at the same position in the hardware password card can perform encryption operations on different data tables, thereby improving the applicability of the method of the present invention.

[0100] According to an embodiment of the present invention, when the disk used to store the first target data table is a disk of a storage node of a distributed database, when the number of encryption keys stored in the hardware password card is a preset threshold, and the number of storage nodes and computing nodes of the distributed database is n, the method of the present invention can use the hardware password card to process the first target data table with the number being the preset threshold divided by n.

[0101] According to an embodiment of the present invention, inputting an encryption algorithm and basic information of a first target data table into a hardware password card, generating an encryption key of the first target data table, and storing the encryption key in the hardware password card to obtain storage location information may include the following operations: based on the encryption algorithm, the basic information of the first target data table and identification information characterizing the storage of the encryption key in the hardware password card, generating an encryption key using the hardware password card, and obtaining the storage location information of the encryption key through an encryption key generation interface of the hardware password card.

[0102] According to an embodiment of the present invention, the basic information of the first target data table may include an identifier of the first target data table, storage location information of the first target data table, etc. The identification information characterizing the storage of the encryption key in the hardware password card may include a storage period and an object for setting the storage location information. The storage period may be temporary storage or permanent storage, and the object for setting the storage location information may be a user or a hardware password card. The encryption key generation interface may be a symmetric key generation interface.

[0103] According to an embodiment of the present invention, the basic information of the first target data table, the identifier of the encryption algorithm, and the identifier information representing the storage of the encryption key in the hardware password card can be input into the encryption key generation interface of the hardware password card, and the hardware password card generates the encryption key. The hardware stores the encryption key in the corresponding storage space according to the identifier information representing the storage of the encryption key in the hardware password card. After storing the encryption key, the hardware password card transmits the storage location information of the encryption key using the transmission parameters in the encryption key generation interface.

[0104] Figure 4 A flowchart of acquiring second target data according to an embodiment of the present invention is shown.

[0105] like Figure 4 As shown, the obtaining of the second target data in this embodiment includes operations S410 to S450.

[0106] In operation S410, in response to a data query request from a user, a data identifier of the data to be queried and a second target data table are determined from the data query request.

[0107] According to an embodiment of the present invention, the second target data table is a storage space for data to be queried.

[0108] According to an embodiment of the present invention, a parsing function may be used to parse a data query request to obtain a data identifier of the data to be queried and a second target data table.

[0109] According to an embodiment of the present invention, the data identifier may be, for example, a storage identifier of the data to be queried.

[0110] In operation S420, based on the data identifier of the data to be queried, the data to be queried is acquired from the second target data table.

[0111] According to an embodiment of the present invention, the data to be queried can be obtained from a corresponding storage location in the second target data table according to the storage identifier.

[0112] In operation S430, storage location information of the decryption key, ciphertext data, and a decryption random value are extracted from the data to be queried.

[0113] According to an embodiment of the present invention, the storage location information of the decryption key is the same as the storage location information of the encryption key, and the decryption random value is the same as the encryption random value.

[0114] According to an embodiment of the present invention, the query data may be deconstructed according to a preset parsing structure to obtain an element set, and the storage location information of the decryption key, the ciphertext data and the decryption random value may be determined from the element set.

[0115] In operation S440, the decryption key is acquired based on the storage location information of the decryption key using the hardware password card.

[0116] In operation S450, the hardware password card is used to perform a decryption operation on the stored data based on a decryption algorithm, a decryption random value, and a decryption key to obtain second target data.

[0117] According to an embodiment of the present invention, the decryption algorithm may be the same as the encryption algorithm.

[0118] According to an embodiment of the present invention, control information of the second target data table may also be acquired from the element set, and a decryption algorithm may be extracted from the control information.

[0119] According to an embodiment of the present invention, the decryption interface of the hardware password card can be called, the storage location information is transmitted to the hardware password card through the location parameter, and the hardware password card searches for the corresponding decryption key according to the storage location information. The decryption interface can be a symmetric decryption interface.

[0120] According to an embodiment of the present invention, when calling the decryption interface, the identifier of the decryption algorithm, the ciphertext data and the operation mode of the decryption operation can also be transmitted to the hardware password card at the same time. After obtaining the decryption key, the hardware password card can perform a decryption operation on the ciphertext data to obtain the second target data.

[0121] According to an embodiment of the present invention, when updating or deleting data in a data table, a specific function can be called to search for information related to the data table from a buffer. When the relevant information of the data table does not exist in the buffer, the relevant information of the data table needs to be obtained from the disk storing the data table.

[0122] Based on the above data storage encryption method based on hardware password card, the present invention also provides a data storage encryption device based on hardware password card. Figure 5 The device is described in detail.

[0123] Figure 5 A structural block diagram of a data storage encryption device based on a hardware password card according to an embodiment of the present invention is shown.

[0124] like Figure 5As shown, the data storage encryption device based on the hardware password card of this embodiment includes a first determination module 510 , a first acquisition module 520 , a second acquisition module 530 , a third acquisition module 540 , an encryption module 550 and a reconstruction module 560 .

[0125] The first determining module 510 is configured to determine the data to be stored and the first target data table from the data storage request in response to a data storage request from a user.

[0126] According to an embodiment of the present invention, the data to be stored is plain text data, and the first target data table is a storage space for the data to be stored.

[0127] The first acquisition module 520 is used to acquire, from the database table-level storage space, an encryption switch corresponding to the first target data table and an encryption algorithm used to encrypt the data to be stored.

[0128] According to an embodiment of the present invention, there is a mapping relationship between the encryption algorithm and the first target data table.

[0129] The second acquisition module 530 is used to acquire storage location information of the encryption key in the hardware password card from the table encryption data related to the first target data table when the encryption switch is turned on.

[0130] The third acquisition module 540 is used to acquire the encryption key based on the storage location information using the hardware password card.

[0131] The encryption module 550 is used to perform encryption operation on the data to be stored based on the encryption algorithm, encryption key and encryption random value using the hardware password card to obtain encrypted data.

[0132] The reconstruction module 560 is used to reconstruct the storage location information of the encrypted data and the encryption key to obtain the stored data.

[0133] According to an embodiment of the present invention, the first acquisition module includes a first determination unit, a parsing unit and a second determination unit.

[0134] The first determining unit is used to determine the table encryption data related to the first target data table from the predetermined storage space.

[0135] The parsing unit is used to parse the table encryption data according to a preset parsing format to obtain a table encryption element set.

[0136] The second determining unit is used to determine the storage location information of the encryption key in the hardware password card from the table encryption element set.

[0137] According to an embodiment of the present invention, the device further includes: a second determination module, an input module, and a reconstruction module.

[0138] The second determination module is used to determine the encryption algorithm of the first target data table after creating the first target data table.

[0139] The input module is used to input the encryption algorithm and basic information of the first target data table into the password card, generate the encryption key of the first target data table, and store the encryption key in the hardware password card to obtain storage location information.

[0140] The first reconstruction module is used to reconstruct the basic information of the first target data table and the storage location information of the encryption key of the first target data table to obtain table encryption data related to the first target data table.

[0141] According to an embodiment of the present invention, the number of data to be stored is multiple.

[0142] According to an embodiment of the present invention, the device further includes: a plate placement module.

[0143] The disk placement module is used to sequentially place multiple stored data on the disk used to store the first target data table when the amount of data to be stored meets a preset amount threshold.

[0144] According to an embodiment of the present invention, the device further includes: a third determination module and a second reconstruction module.

[0145] The third determining module is used to determine the storage location information of the encryption key of the first target data table as the storage location information of the encryption key of the data table when the encryption algorithm of the data table is the same as the encryption algorithm of the first target data table.

[0146] The second reconstruction module is used to reconstruct the basic information of the data table and the storage location information of the encryption key of the first target data table to obtain the table encryption data of the data table.

[0147] The data table is used to store other data to be stored.

[0148] According to an embodiment of the present invention, the encryption algorithm comprises a symmetric encryption algorithm.

[0149] According to an embodiment of the present invention, the device may further include a fourth determining module, a fourth acquiring module, an extracting module, a fifth acquiring module and a decrypting module.

[0150] The fourth determining module is used to determine the data identifier of the to-be-queried data and the second target data table from the data query request in response to the user's data query request.

[0151] According to an embodiment of the present invention, the second target data table is a storage space for data to be queried.

[0152] The fourth acquisition module is used to acquire the data to be queried from the second target data table based on the data identifier of the data to be queried.

[0153] The extraction module is used to extract the storage location information of the decryption key, the ciphertext data and the decryption random value from the data to be queried.

[0154] According to an embodiment of the present invention, the storage location information of the decryption key is the same as the storage location information of the encryption key, and the decryption random value is the same as the encryption random value.

[0155] The fifth acquisition module is used to acquire the decryption key based on the storage location information of the decryption key using the hardware password card.

[0156] The decryption module is used to use the hardware password card to perform a decryption operation on the stored data based on the decryption algorithm, the decryption random value and the decryption key to obtain the second target data.

[0157] According to an embodiment of the present invention, any multiple modules among the first determination module 510, the first acquisition module 520, the second acquisition module 530, the third acquisition module 540, the encryption module 550 and the reconstruction module 560 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the first determination module 510, the first acquisition module 520, the second acquisition module 530, the third acquisition module 540, the encryption module 550 and the reconstruction module 560 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the first determination module 510, the first acquisition module 520, the second acquisition module 530, the third acquisition module 540, the encryption module 550 and the reconstruction module 560 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0158] According to an embodiment of the present invention, the program code for executing the computer program provided by the embodiment of the present invention can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, such as Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0159] Figure 6 A block diagram of an electronic device suitable for implementing a data storage encryption method based on a hardware password card according to an embodiment of the present disclosure is schematically shown.

[0160] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0161] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0162] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0163] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0164] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0165] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the data storage encryption method based on the hardware password card provided by the embodiment of the present disclosure.

[0166] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0167] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0168] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0169] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0170] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present invention may be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features described in the various embodiments of the present invention may be combined and / or combined in various ways. All of these combinations and / or combinations fall within the scope of the present invention.

[0171] The embodiments of the present invention are described above. However, these embodiments are only for the purpose of illustration, and are not intended to limit the scope of the present invention. Although each embodiment is described above, it does not mean that the measures in each embodiment cannot be used in combination advantageously. Without departing from the scope of the present invention, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present invention.

Claims

1. A data storage encryption method based on a hardware password card, characterized in that: The method comprises: In response to a data storage request from a user, determining data to be stored and a first target data table from the data storage request, wherein the data to be stored is plaintext data, and the first target data table is a storage space to be stored for the data to be stored; Acquire, from a database table-level storage space, an encryption switch corresponding to the first target data table and an encryption algorithm for encrypting the data to be stored, wherein a mapping relationship exists between the encryption algorithm and the first target data table; When the encryption switch is in the on state, obtaining storage location information of the encryption key in the hardware password card from table encryption data related to the first target data table; Obtaining the encryption key using the hardware password card based on the storage location information; Using the hardware password card to perform an encryption operation on the data to be stored based on the encryption algorithm, the encryption key and the encrypted random value to obtain encrypted data; Reconstructing the storage location information of the encrypted data and the encryption key to obtain stored data; The step of obtaining the storage location information of the encryption key in the hardware password card from the table encryption data related to the first target data table includes: determining the table encrypted data related to the first target data table from a predetermined storage space; Parsing the table encrypted data according to a preset parsing format to obtain a table encrypted element set; Determining storage location information of the encryption key in the hardware password card from the table encryption element set; The method further comprises: In response to a data query request from a user, determining a data identifier of the data to be queried and a second target data table from the data query request, wherein the second target data table is a storage space for the data to be queried; Based on the data identifier of the data to be queried, acquiring the data to be queried from the second target data table; Extracting storage location information of a decryption key, ciphertext data, and a decryption random value from the data to be queried, wherein the storage location information of the decryption key is the same as the storage location information of the encryption key, and the decryption random value is the same as the encryption random value; Obtaining the decryption key using the hardware password card based on the storage location information of the decryption key; The hardware password card is used to perform a decryption operation on the stored data based on a decryption algorithm, the decryption random value and the decryption key to obtain second target data.

2. The method according to claim 1, characterized in that The method further comprises: After creating the first target data table, determining an encryption algorithm for the first target data table; Inputting the encryption algorithm and basic information of the first target data table into the hardware password card, generating an encryption key for the first target data table, and storing the encryption key in the hardware password card to obtain storage location information; The basic information of the first target data table and the storage location information of the encryption key of the first target data table are reconstructed to obtain table encryption data related to the first target data table.

3. The method according to claim 1, characterized in that The number of the data to be stored is multiple, and the method further includes: When the amount of the data to be stored meets a preset amount threshold, the plurality of stored data are sequentially written to the disk used to store the first target data table.

4. The method according to claim 2, characterized in that The method further comprises: When the encryption algorithm of the data table is the same as the encryption algorithm of the first target data table, determining the storage location information of the encryption key of the first target data table as the storage location information of the encryption key of the data table, wherein the data table is used to store other data to be stored; The basic information of the data table and the storage location information of the encryption key of the first target data table are reconstructed to obtain table encrypted data of the data table.

5. The method according to claim 2, characterized in that The step of inputting the encryption algorithm and basic information of the first target data table into the hardware password card, generating an encryption key for the first target data table, storing the encryption key in the hardware password card, and obtaining storage location information includes: Based on the encryption algorithm, basic information of the first target data table and identification information representing the encryption key stored in the hardware password card, an encryption key is generated using the hardware password card, and the storage location information of the encryption key is obtained through the encryption key generation interface of the hardware password card.

6. A data storage encryption device based on a hardware password card, characterized in that: The device comprises: a first determining module, configured to determine, in response to a data storage request from a user, data to be stored and a first target data table from the data storage request, wherein the data to be stored is plaintext data and the first target data table is a storage space to be stored for the data to be stored; a first acquisition module, configured to acquire, from a database table-level storage space, an encryption switch corresponding to the first target data table and an encryption algorithm for encrypting the data to be stored, wherein a mapping relationship exists between the encryption algorithm and the first target data table; a second acquisition module, configured to acquire storage location information of the encryption key in the hardware password card from table encryption data related to the first target data table when the encryption switch is in an on state; A third acquisition module is configured to acquire the encryption key based on the storage location information using the hardware password card; An encryption module, configured to perform an encryption operation on the data to be stored using the hardware password card based on an encryption algorithm, the encryption key and an encrypted random value to obtain encrypted data; A reconstruction module, configured to reconstruct the storage location information of the encrypted data and the encryption key to obtain stored data; Wherein, the first acquisition module includes a first determination unit, a parsing unit and a second determination unit; a first determining unit, configured to determine the table encrypted data related to the first target data table from a predetermined storage space; a parsing unit, configured to parse the table encrypted data according to a preset parsing format to obtain a table encrypted element set; A second determining unit is configured to determine storage location information of the encryption key in the hardware password card from the table encryption element set; The apparatus further includes a fourth determination module, a fourth acquisition module, an extraction module, a fifth acquisition module, and a decryption module; A fourth determining module is configured to determine, in response to a user's data query request, a data identifier of the data to be queried and a second target data table from the data query request, wherein the second target data table is a storage space for the data to be queried; A fourth acquisition module, configured to acquire the data to be queried from the second target data table based on the data identifier of the data to be queried; an extraction module, configured to extract storage location information of a decryption key, ciphertext data, and a decryption random value from the data to be queried, wherein the storage location information of the decryption key is the same as the storage location information of the encryption key, and the decryption random value is the same as the encryption random value; a fifth acquisition module, configured to acquire the decryption key using the hardware password card based on the storage location information of the decryption key; The decryption module is used to use the hardware password card to perform a decryption operation on the stored data based on a decryption algorithm, the decryption random value and the decryption key to obtain second target data.

7. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images