A data table dynamic encryption and decryption method and system based on key escrow

Abstract

The present invention provides a data table dynamic encryption and decryption method and system based on key escrow. The method comprises the following steps: creating a key ring and a corresponding key name; defining an encryption UDF function and a decryption UDF function; calling the corresponding encryption UDF function, encrypting a data table to be encrypted and an algorithm key through the encryption UDF function, the key ring and the key name to obtain an encrypted ciphertext and a key ciphertext, and storing the key ciphertext in an algorithm key ciphertext database; decrypting the encrypted ciphertext through the corresponding decryption UDF function to obtain plaintext data. The present invention realizes intelligent key generation, encryption and persistent storage mechanism, and provides a new and better solution for data encryption in big data processing.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security and privacy protection, and specifically relates to a data table dynamic encryption and decryption method and system based on key hosting. Background Art

[0002] In today's digital age, data security and privacy protection have become critical issues. With the widespread application of big data technology, especially in large-scale data processing environments like Hive, it is particularly important to encrypt sensitive data to prevent unauthorized access and data leakage.

[0003] There are some limitations in the application of existing data encryption technology in Hive. Traditional encryption methods may lack a flexible key management mechanism, which makes it difficult to ensure the security and availability of keys. Moreover, the integration methods of many encryption algorithms are not convenient and efficient enough to meet the requirements of real-time and performance in large-scale data processing. In addition, in practical applications, users have higher autonomy and security requirements for the generation and management of encryption keys. However, current solutions often fail to provide a comprehensive solution that is convenient for user operation and ensures the secure custody and effective management of keys. For example, some encryption systems require users to manually manage complex key generation and storage processes, which increases the user's operational burden and the risk of error. Although other systems provide a certain degree of automation, they are insufficient in terms of key security and integration with existing systems (such as KMS systems).

[0004] In summary, the prior art has the following disadvantages:

[0005] 1. Complex key management. The application of existing data encryption technology in Hive usually makes key management more complex. Users need to manually handle key generation, storage, and update, which not only increases the difficulty of operation, but also easily leads to errors in key management, thus affecting data security.

[0006] 2. Risk of hard-coding keys. The existing Hive encryption UDF hard-codes the key in the function, which poses a great security risk. When writing SQL, users need to write the key in plain text, which is easy to be peeped and leaked, making the encrypted data at risk of illegal decryption. Moreover, hard-coded keys are difficult to update and manage flexibly, and cannot meet the need for regular key updates to enhance security.

[0007] 3. There is a lack of Hive encryption UDF types. Currently, there are limited types of encryption UDFs in Hive, and there is a lack of UDFs for format-preserving encryption and order-preserving encryption algorithms required for anonymization, which makes it difficult to meet the diverse needs of big data processing and privacy protection.

[0008] 4. Key group authorization problem. The encryption algorithm used by the existing encryption UDF in Hive has a significant flaw in key management, namely the lack of a mechanism for group authorization. This means that the current key authorization model cannot flexibly allocate key usage permissions based on different user groups or business needs. Summary of the invention

[0009] In order to solve the above technical problems, the present invention provides a data table dynamic encryption and decryption method and system based on key escrow, which are used to solve the technical problems in the prior art.

[0010] On the one hand, the present invention provides the following technical solution, a data table dynamic encryption and decryption method based on key escrow, comprising:

[0011] Create a key ring and the corresponding key name on the KMS key management service, create an authorized personnel table and add authorized personnel to the authorized personnel table;

[0012] Obtain an encryption algorithm and an algorithm key corresponding to the encryption algorithm, define an encryption UDF function and a decryption UDF function based on the encryption algorithm, and store the encryption UDF function and the decryption UDF function in a function library, wherein the encryption algorithm includes a format-preserving encryption algorithm and an order-preserving encryption algorithm;

[0013] Obtaining a data table to be encrypted and calling a corresponding encryption UDF function from the function library according to the data type of the data table to be encrypted, encrypting the data table to be encrypted and the algorithm key through the encryption UDF function, the key ring and the key name to obtain an encrypted ciphertext and a key ciphertext, and storing the key ciphertext in an algorithm key ciphertext database;

[0014] The user's decryption requirement is obtained and it is determined whether the user is an authorized person in the authorized person table. If the user is an authorized person in the authorized person table, the encrypted ciphertext is decrypted by the corresponding decryption UDF function to obtain plaintext data.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: in view of the complex key management problem in the prior art, the present invention provides an automated and efficient key management mechanism, which eliminates the need for users to manually handle key generation, storage and update, reduces the difficulty of operation, and reduces key management errors caused by human operation, thereby significantly improving data security; in order to solve the security risks and insufficient flexibility caused by hard-coding of keys, the present invention designs a method for dynamically generating and obtaining keys at runtime, avoiding the appearance of plaintext keys in SQL written by users, preventing keys from being spied on and leaked, and supporting flexible key updates and management to meet the needs of regular updates to enhance security; in view of the current lack of Hive encryption UDF types, especially the lack of UDFs with format-preserving encryption and order-preserving encryption algorithms that cannot meet the diverse big data processing and privacy protection needs, the present invention is committed to developing and integrating more types of encryption UDFs, including but not limited to UDFs with format-preserving encryption and order-preserving encryption algorithms, to enrich the encryption functions in Hive and adapt to various complex data processing and privacy protection scenarios; for encryption UDFs in Hive The key lacks a group authorization mechanism. The present invention constructs a sophisticated key group authorization system that can flexibly and accurately allocate key usage permissions according to different user groups and business needs, ensure the security and flexibility of data access, and meet diverse business needs.

[0016] Preferably, in the step of defining an encryption UDF function and a decryption UDF function based on the encryption algorithm, and storing the encryption UDF function and the decryption UDF function in a function library, the encryption UDF function includes a UDF function for format-preserving encryption of plaintext data of String type, a UDF function for format-preserving encryption of plaintext data of Long type, a UDF function for order-preserving encryption of plaintext data of String type, a UDF function for order-preserving encryption of plaintext data of Long type, a UDF function for order-preserving encryption of plaintext data of Float type, and a UDF function for order-preserving encryption of plaintext data of Double type.

[0017] Preferably, in the step of defining an encryption UDF function and a decryption UDF function based on the encryption algorithm, and storing the encryption UDF function and the decryption UDF function in a function library, the decryption UDF function includes a UDF function for format-preserving decryption of plaintext data of String type, a UDF function for format-preserving decryption of plaintext data of Long type, a UDF function for order-preserving decryption of plaintext data of String type, a UDF function for order-preserving decryption of plaintext data of Long type, a UDF function for order-preserving decryption of plaintext data of Float type, and a UDF function for order-preserving decryption of plaintext data of Double type.

[0018] Preferably, the step of encrypting the data table to be encrypted and the algorithm key by using the encryption UDF function, the key ring and the key name to obtain the encrypted ciphertext and the key ciphertext includes:

[0019] Package the encrypted UDF function into a JAR file, upload the JAR file to an accessible directory of the Hive server, and add the JAR file to the Hive session;

[0020] Write an encrypted Hive SQL statement in the Hive command line interface and pass the data table field, the corresponding key ring and the corresponding key name of the data table to be encrypted into the encryption UDF function;

[0021] The encrypted Hive SQL statement is used to call the encrypted UDF function and the corresponding encryption algorithm to encrypt the data table to be encrypted, so as to obtain an encrypted ciphertext;

[0022] The algorithm key of the encryption algorithm is encrypted by using the key ring and the corresponding key name in the encryption UDF function to obtain a key ciphertext.

[0023] Preferably, the step of decrypting the encrypted ciphertext by a corresponding decryption UDF function to obtain plaintext data includes:

[0024] Write a decrypted Hive SQL statement in the Hive command line interface, and call the corresponding decrypted UDF function through the decrypted Hive SQL statement;

[0025] Retrieving the key ring and the corresponding key name passed in the corresponding encryption UDF function in the algorithm key ciphertext database through the decryption UDF function, and extracting the corresponding key ciphertext therefrom;

[0026] Decrypting the key ciphertext using the key ring and the corresponding key name to obtain a decrypted algorithm key;

[0027] The encrypted ciphertext is decrypted using the decrypted algorithm key to obtain plaintext data.

[0028] In a second aspect, the present invention provides the following technical solution: a data table dynamic encryption and decryption system based on key escrow, the system comprising:

[0029] A key creation module, used to create a key ring and a corresponding key name on the KMS key management service, and to create an authorized personnel table and add authorized personnel to the authorized personnel table;

[0030] A function definition module, used to obtain an encryption algorithm and an algorithm key corresponding to the encryption algorithm, define an encryption UDF function and a decryption UDF function based on the encryption algorithm, and store the encryption UDF function and the decryption UDF function in a function library, wherein the encryption algorithm includes a format-preserving encryption algorithm and an order-preserving encryption algorithm;

[0031] An encryption module, used to obtain a data table to be encrypted and call a corresponding encryption UDF function from the function library according to the data type of the data table to be encrypted, encrypt the data table to be encrypted and the algorithm key through the encryption UDF function, the key ring and the key name to obtain an encrypted ciphertext and a key ciphertext, and store the key ciphertext in an algorithm key ciphertext database;

[0032] The decryption module is used to obtain the user's decryption requirements and determine whether the user is an authorized person in the authorized person table. If the user is an authorized person in the authorized person table, the encrypted ciphertext is decrypted by the corresponding decryption UDF function to obtain plaintext data.

[0033] Preferably, the encryption module comprises:

[0034] A packaging submodule, used to package the encrypted UDF function into a JAR file, upload the JAR file to an accessible directory of the Hive server, and add the JAR file to the Hive session;

[0035] The input submodule is used to write encrypted Hive SQL statements in the Hive command line interface and input the data table fields, corresponding key rings and corresponding key names of the data table to be encrypted into the encryption UDF function;

[0036] A first encryption submodule, configured to encrypt the to-be-encrypted data table by calling the encryption UDF function and a corresponding encryption algorithm through the encrypted Hive SQL statement to obtain an encrypted ciphertext;

[0037] The second encryption submodule is used to encrypt the algorithm key of the encryption algorithm through the key ring and the corresponding key name in the encryption UDF function to obtain the key ciphertext.

[0038] Preferably, the decryption module comprises:

[0039] The calling submodule is used to write a decrypted Hive SQL statement in the Hive command line interface, and call the corresponding decryption UDF function through the decrypted Hive SQL statement;

[0040] A retrieval submodule, used to retrieve the key ring and the corresponding key name passed in the corresponding encryption UDF function in the algorithm key ciphertext database through the decryption UDF function, and extract the corresponding key ciphertext therefrom;

[0041] A first decryption submodule, used to decrypt the key ciphertext using the key ring and the corresponding key name to obtain a decrypted algorithm key;

[0042] The second decryption submodule is used to decrypt the encrypted ciphertext using the decrypted algorithm key to obtain plaintext data.

[0043] In a third aspect, the present invention provides the following technical solution: a computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the key-managed-based dynamic encryption and decryption method for data tables as described above when executing the computer program.

[0044] In a fourth aspect, the present invention provides the following technical solution: a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the data table dynamic encryption and decryption method based on key hosting as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 A flowchart of a data table dynamic encryption and decryption method based on key escrow provided in Embodiment 1 of the present invention;

[0047] Figure 2 A structural block diagram of a data table dynamic encryption and decryption system based on key escrow provided in Embodiment 2 of the present invention;

[0048] Figure 3 A schematic diagram of the hardware structure of a computer provided in another embodiment of the present invention.

[0049] The embodiments of the present invention will be further described below with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the embodiments of the present invention, and should not be construed as limiting the present invention.

[0051] Embodiment 1

[0052] In the first embodiment of the present invention, Figure 1 As shown, a data table dynamic encryption and decryption method based on key escrow includes:

[0053] S1. Create a key ring and a corresponding key name on the KMS key management service, create an authorized personnel table and add authorized personnel to the authorized personnel table;

[0054] Specifically, the key ring here is a KMS key ring, which is composed of several KMS keys. Users need to create a key ring and keys on the KMS key management service platform. The keys here are mainly AES encryption / decryption keys, which are in different formats from the format-preserving encryption algorithm keys and the order-preserving encryption algorithm keys. The AES algorithm key cannot be directly used for the format-preserving and order-preserving encryption algorithms. In addition, the KMS key ring applied for creation here is composed of one or more AES keys. A key ring plus a key name can uniquely identify a KMS encryption key, and the key is a symmetric key, so the encryption key and decryption key are the same. In the subsequent application of the format-preserving encryption algorithm and the order-preserving encryption algorithm, the KMS key will be used to encrypt the algorithm keys of the first two encryption algorithms and then store them. Only personnel or groups authorized by the KMS key have the authority to decrypt the algorithm key ciphertext, and then use the algorithm key to encrypt data or decrypt ciphertext.

[0055] In order to ensure data security, on the KMS key management platform, select the specified KMS key, and in the Key Authorization column of the KMS key details page, add authorized personnel or authorized groups to complete the KMS key authorization to individuals or groups. In addition, the authorized individuals or groups will receive a message notification informing them that a certain KMS key has been authorized.

[0056] S2, obtaining an encryption algorithm and an algorithm key corresponding to the encryption algorithm, defining an encryption UDF function and a decryption UDF function based on the encryption algorithm, and storing the encryption UDF function and the decryption UDF function in a function library, wherein the encryption algorithm includes a format-preserving encryption algorithm and an order-preserving encryption algorithm;

[0057] Specifically, in step S2, the encryption UDF function includes a UDF function for format-preserving encryption of plaintext data of String type, a UDF function for format-preserving encryption of plaintext data of Long type, a UDF function for order-preserving encryption of plaintext data of String type, a UDF function for order-preserving encryption of plaintext data of Long type, a UDF function for order-preserving encryption of plaintext data of Float type, and a UDF function for order-preserving encryption of plaintext data of Double type.

[0058] The decryption UDF function includes a UDF function for format-preserving decryption of plaintext data of String type, a UDF function for format-preserving decryption of plaintext data of Long type, a UDF function for order-preserving decryption of plaintext data of String type, a UDF function for order-preserving decryption of plaintext data of Long type, a UDF function for order-preserving decryption of plaintext data of Float type, and a UDF function for order-preserving decryption of plaintext data of Double type.

[0059] At the same time, for the encryption / decryption UDF functions in the above content, each function corresponds to a specific UDF class, which inherits the parent class org.apache.hadoop.hive.sql.exec.UDF and overrides the evaluate method of the parent class. In this method, the specific operation of encrypting / decrypting the input text is implemented and the encrypted ciphertext / decrypted plaintext is returned. When the UDF is used to write an SQL query statement, for the fields in the data table that use the UDF, during the query task execution process, the UDF encryption / decryption operation will be performed on the corresponding fields of each record in the data table on multiple instances in the cluster in multiple processes. The result returned by the query is the encrypted / decrypted data table query result information. Among them, UDF is specifically a user-defined function. In the database system (such as Hive), UDF allows users to define new functions according to their specific needs to expand the functions of the system built-in functions. org.apache.hadoop.hive.sql.exec.UDF represents the path of the Java class in Hive, and the evaluate method is the method name in the class.

[0060] For example, the specific implementation process of a UDF class for sequence-preserving encryption with an input data type of Long is as follows:

[0061] First, define a class for order-preserving encryption of Long type data. This class inherits the parent class, implements the class constructor, overrides the parent class's evaluate method, and defines some properties, including the instantiation object of the order-preserving encryption class and the algorithm key, KMS key ring, and key name. The class constructor receives three parameters, namely: field data, KMS key ring, and KMS key name. The constructor also completes the initialization of the encryption algorithm object, algorithm key, KMS key ring, and key.

[0062] Since the evaluate method in the UDF class will be executed on multiple instances in the cluster, and each instance calls the method concurrently by multiple processes, but for the same task, only one algorithm key needs to be initialized, so the singleton mode is used here. When obtaining the algorithm key, it will first determine whether the algorithm key of the current class is empty. If it is empty, the key generation method of the current order-preserving encryption algorithm object is called to initialize an algorithm key of the algorithm. If the algorithm key of the current class is not empty, the existing algorithm key is obtained. On the one hand, since the two types of encryption algorithms involved in this article are symmetric encryption algorithms, that is, the same key is used for encryption and decryption, in order to prevent the user's key from being lost or forgotten, this method helps the user complete the algorithm key storage work. On the other hand, since the algorithm key belongs to the user or group and is confidential information, when storing it persistently, it is necessary to consider that no one except the authorized personnel can obtain the algorithm key.

[0063] When the key is initialized for the first time, the KMS key ring is used to encrypt the algorithm key and obtain the ciphertext of the algorithm key. The ciphertext algorithm key is then persistently stored in the algorithm key ciphertext data table. In the algorithm key ciphertext data table, each record in the table stores the encrypted algorithm key, the order-preserving algorithm name, the name of the KMS key ring, and the name of the KMS key, indicating that the key of this record is the algorithm key required by all authorized users under the key (KMS key ring, KMS key) when calling the order-preserving encryption algorithm. This method supports authorized users under the same KMS key to call the same encryption algorithm. Even if the encrypted data is different, the algorithm key used is the same, which well unifies the algorithm key management problem when the same encryption algorithm is used for the same group of people. When the user uses the current KMS key to call the order-preserving encryption algorithm for the first time, the program will search the algorithm key ciphertext data table to see if there is a record of the current KMS key ring and key name, and the algorithm name is order-preserving encryption. If so, it means that the key for the order-preserving encryption algorithm corresponding to the KMS key authorized user group has been generated. Then, the encrypted algorithm key is extracted from the retrieved record and decrypted using the KMS key to obtain the plaintext algorithm key inside the program.

[0064] S3, obtaining a data table to be encrypted and calling a corresponding encryption UDF function from the function library according to the data type of the data table to be encrypted, encrypting the data table to be encrypted and the algorithm key through the encryption UDF function, the key ring and the key name to obtain an encrypted ciphertext and a key ciphertext, and storing the key ciphertext in an algorithm key ciphertext database;

[0065] Wherein, the step S3 comprises:

[0066] S31, packaging the encrypted UDF function into a JAR file, uploading the JAR file to an accessible directory of the Hive server, and adding the JAR file to the Hive session;

[0067] Specifically, the encrypted UDF function can be packaged into a JAR file using the command line.

[0068] S32. Write an encrypted Hive SQL statement in the Hive command line interface and pass the data table field of the data table to be encrypted, the corresponding key ring and the corresponding key name into the encryption UDF function.

[0069] S33, calling the encryption UDF function and the corresponding encryption algorithm through the encrypted Hive SQL statement to encrypt the data table to be encrypted to obtain an encrypted ciphertext.

[0070] S34, encrypting the algorithm key of the encryption algorithm through the key ring and the corresponding key name in the encryption UDF function to obtain a key ciphertext;

[0071] Specifically, since the Hive system runs on a distributed computing framework (such as Hadoop), when an order-preserving encrypted query is performed on the fields of a large data table, Hive will divide the data in the data table into multiple partitions and distribute these partitions to multiple nodes in the cluster for parallel processing. The call to the evaluate method will encrypt the data locally allocated to the node in parallel on each node. The system will eventually merge and summarize the encryption processing results of each node and display them as query results, that is, the encrypted ciphertext will be displayed. Similarly, data decryption is similar. The final encrypted ciphertext can be displayed as a query result by encrypting the HiveSQL statement, and the displayed encrypted ciphertext can be used for sharing across business parts to perform data analysis while ensuring user information privacy.

[0072] S4. Obtain the user's decryption requirement and determine whether the user is an authorized person in the authorized person table. If the user is an authorized person in the authorized person table, decrypt the encrypted ciphertext through the corresponding decryption UDF function to obtain plaintext data.

[0073] Wherein, the step S4 comprises:

[0074] S41. Write a decrypted Hive SQL statement in the Hive command line interface, and call a corresponding decrypted UDF function through the decrypted Hive SQL statement.

[0075] S42: Using the decryption UDF function, the algorithm key ciphertext database is searched for the key ring and the corresponding key name passed in the corresponding encryption UDF function, and the corresponding key ciphertext is extracted therefrom.

[0076] S43: Decrypt the key ciphertext using the key ring and the corresponding key name to obtain a decrypted algorithm key.

[0077] S44, using the decrypted algorithm key to decrypt the encrypted ciphertext to obtain plaintext data;

[0078] Specifically, the plaintext data obtained after decryption is finally summarized and returned to the user's SQL query interface.

[0079] The first embodiment of the present invention provides a data table dynamic encryption and decryption method based on key escrow. In view of the complex key management problem in the prior art, the present invention provides an automated and efficient key management mechanism, which eliminates the need for users to manually handle key generation, storage and update, reduces the difficulty of operation, and reduces key management errors caused by human operation, thereby significantly improving data security. In order to solve the security risks and insufficient flexibility caused by hard coding of keys, the present invention designs a method for dynamically generating and obtaining keys at runtime to avoid the appearance of plaintext keys in SQL written by users, prevent keys from being spied on and leaked, and support flexible key updates and management to meet the needs of regular updates to enhance security. In view of the current lack of Hive encryption UDF types, especially the lack of UDFs with format-preserving encryption and order-preserving encryption algorithms that cannot meet the diverse big data processing and privacy protection needs, the present invention is committed to developing and integrating more types of encryption UDFs, including but not limited to UDFs with format-preserving encryption and order-preserving encryption algorithms, to enrich the encryption functions in Hive and adapt to various complex data processing and privacy protection scenarios. The key lacks a group authorization mechanism. The present invention constructs a sophisticated key group authorization system that can flexibly and accurately allocate key usage permissions according to different user groups and business needs, ensure the security and flexibility of data access, and meet diverse business needs.

[0080] Embodiment 2

[0081] like Figure 2 As shown, in the second embodiment of the present invention, a data table dynamic encryption and decryption system based on key escrow is provided, and the system includes:

[0082] The key creation module 1 is used to create a key ring and a corresponding key name on the KMS key management service, and to create an authorized personnel table and add authorized personnel to the authorized personnel table;

[0083] Function definition module 2, used to obtain an encryption algorithm and an algorithm key corresponding to the encryption algorithm, define an encryption UDF function and a decryption UDF function based on the encryption algorithm, and store the encryption UDF function and the decryption UDF function in a function library, wherein the encryption algorithm includes a format-preserving encryption algorithm and an order-preserving encryption algorithm;

[0084] The encryption module 3 is used to obtain the data table to be encrypted and call the corresponding encryption UDF function from the function library according to the data type of the data table to be encrypted, encrypt the data table to be encrypted and the algorithm key through the encryption UDF function, the key ring and the key name to obtain the encrypted ciphertext and the key ciphertext, and store the key ciphertext in the algorithm key ciphertext database;

[0085] The decryption module 4 is used to obtain the user's decryption requirements and determine whether the user is an authorized person in the authorized person table. If the user is an authorized person in the authorized person table, the encrypted ciphertext is decrypted through the corresponding decryption UDF function to obtain plaintext data.

[0086] Wherein, the encryption module 3 includes:

[0087] A packaging submodule, used to package the encrypted UDF function into a JAR file, upload the JAR file to an accessible directory of the Hive server, and add the JAR file to the Hive session;

[0088] The input submodule is used to write encrypted Hive SQL statements in the Hive command line interface and input the data table fields, corresponding key rings and corresponding key names of the data table to be encrypted into the encryption UDF function;

[0089] A first encryption submodule, configured to encrypt the to-be-encrypted data table by calling the encryption UDF function and a corresponding encryption algorithm through the encrypted Hive SQL statement to obtain an encrypted ciphertext;

[0090] The second encryption submodule is used to encrypt the algorithm key of the encryption algorithm through the key ring and the corresponding key name in the encryption UDF function to obtain the key ciphertext.

[0091] Wherein, the decryption module 4 includes:

[0092] The calling submodule is used to write a decrypted Hive SQL statement in the Hive command line interface, and call the corresponding decryption UDF function through the decrypted Hive SQL statement;

[0093] A retrieval submodule, used to retrieve the key ring and the corresponding key name passed in the corresponding encryption UDF function in the algorithm key ciphertext database through the decryption UDF function, and extract the corresponding key ciphertext therefrom;

[0094] A first decryption submodule, used to decrypt the key ciphertext using the key ring and the corresponding key name to obtain a decrypted algorithm key;

[0095] The second decryption submodule is used to decrypt the encrypted ciphertext using the decrypted algorithm key to obtain plaintext data.

[0096] In some other embodiments of the present invention, the embodiments of the present invention provide the following technical solution: a computer, comprising a memory 102, a processor 101, and a computer program stored in the memory 102 and executable on the processor 101, wherein the processor 101 implements the key-escrow-based data table dynamic encryption and decryption method as described above when executing the computer program.

[0097] Specifically, the processor 101 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiment of the present invention.

[0098] Among them, the memory 102 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 102 may include a hard disk drive (HDD), a floppy disk drive, a solid state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 102 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 102 may be inside or outside the data processing device. In a specific embodiment, the memory 102 is a non-volatile memory. In a specific embodiment, the memory 102 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM) or a flash memory (FLASH), or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0099] The memory 102 may be used to store or cache various data files that need to be processed and / or used for communication, as well as possible computer program instructions executed by the processor 101 .

[0100] The processor 101 implements the above-mentioned data table dynamic encryption and decryption method based on key escrow by reading and executing computer program instructions stored in the memory 102.

[0101] In some embodiments, the computer may further include a communication interface 103 and a bus 100. Figure 3 As shown, the processor 101, the memory 102, and the communication interface 103 are connected via a bus 100 and communicate with each other.

[0102] The communication interface 103 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present invention. The communication interface 103 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0103] The bus 100 includes hardware, software or both, and couples the components of the computer device to each other. The bus 100 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 100 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 100 may include one or more buses. Although embodiments of the present invention describe and illustrate a particular bus, the present invention contemplates any suitable bus or interconnect.

[0104] The computer can execute the data table dynamic encryption and decryption method based on key escrow based on the key escrow of the present invention based on the data table dynamic encryption and decryption system acquired, thereby realizing the data table dynamic encryption and decryption based on key escrow.

[0105] In some further embodiments of the present invention, in combination with the above-mentioned data table dynamic encryption and decryption method based on key escrow, the embodiments of the present invention provide the following technical solutions: a storage medium having a computer program stored thereon, and the computer program implements the above-mentioned data table dynamic encryption and decryption method based on key escrow when executed by a processor.

[0106] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0107] More specific examples of readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0108] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0109] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0110] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A data table dynamic encryption and decryption method based on key escrow, characterized in that: include: Create a key ring and the corresponding key name on the KMS key management service, create an authorized personnel table and add authorized personnel to the authorized personnel table; Obtain an encryption algorithm and an algorithm key corresponding to the encryption algorithm, define an encryption UDF function and a decryption UDF function based on the encryption algorithm, and store the encryption UDF function and the decryption UDF function in a function library, wherein the encryption algorithm includes a format-preserving encryption algorithm and an order-preserving encryption algorithm; Obtaining a data table to be encrypted and calling a corresponding encryption UDF function from the function library according to the data type of the data table to be encrypted, encrypting the data table to be encrypted and the algorithm key through the encryption UDF function, the key ring and the key name to obtain an encrypted ciphertext and a key ciphertext, and storing the key ciphertext in an algorithm key ciphertext database; Obtain the user's decryption requirement and determine whether the user is an authorized person in the authorized person table. If the user is an authorized person in the authorized person table, decrypt the encrypted ciphertext through the corresponding decryption UDF function to obtain plaintext data; The step of encrypting the data table to be encrypted and the algorithm key by using the encryption UDF function, the key ring and the key name to obtain the encrypted ciphertext and the key ciphertext includes: Package the encrypted UDF function into a JAR file, upload the JAR file to an accessible directory of the Hive server, and add the JAR file to the Hive session; Write an encrypted Hive SQL statement in the Hive command line interface and pass the data table field, the corresponding key ring and the corresponding key name of the data table to be encrypted into the encryption UDF function; The encrypted Hive SQL statement is used to call the encrypted UDF function and the corresponding encryption algorithm to encrypt the data table to be encrypted, so as to obtain an encrypted ciphertext; Encrypting the algorithm key of the encryption algorithm by using the key ring and the corresponding key name in the encryption UDF function to obtain a key ciphertext; The step of decrypting the encrypted ciphertext by using the corresponding decryption UDF function to obtain plaintext data includes: Write a decrypted Hive SQL statement in the Hive command line interface, and call the corresponding decrypted UDF function through the decrypted Hive SQL statement; Retrieving the key ring and the corresponding key name passed in the corresponding encryption UDF function in the algorithm key ciphertext database through the decryption UDF function, and extracting the corresponding key ciphertext therefrom; Decrypting the key ciphertext using the key ring and the corresponding key name to obtain a decrypted algorithm key; The encrypted ciphertext is decrypted using the decrypted algorithm key to obtain plaintext data.

2. The data table dynamic encryption and decryption method based on key escrow according to claim 1 is characterized in that: In the step of defining an encryption UDF function and a decryption UDF function based on the encryption algorithm, and storing the encryption UDF function and the decryption UDF function in a function library, the encryption UDF function includes a UDF function for format-preserving encryption of plaintext data of a String type, a UDF function for format-preserving encryption of plaintext data of a Long type, a UDF function for order-preserving encryption of plaintext data of a String type, a UDF function for order-preserving encryption of plaintext data of a Long type, a UDF function for order-preserving encryption of plaintext data of a Float type, and a UDF function for order-preserving encryption of plaintext data of a Double type.

3. The data table dynamic encryption and decryption method based on key escrow according to claim 1 is characterized in that: In the step of defining an encryption UDF function and a decryption UDF function based on the encryption algorithm, and storing the encryption UDF function and the decryption UDF function in a function library, the decryption UDF function includes a UDF function for format-preserving decryption of plaintext data of a String type, a UDF function for format-preserving decryption of plaintext data of a Long type, a UDF function for sequence-preserving decryption of plaintext data of a String type, a UDF function for sequence-preserving decryption of plaintext data of a Long type, a UDF function for sequence-preserving decryption of plaintext data of a Float type, and a UDF function for sequence-preserving decryption of plaintext data of a Double type.

4. A data table dynamic encryption and decryption system based on key escrow, characterized in that: The system comprises: A key creation module, used to create a key ring and a corresponding key name on the KMS key management service, and to create an authorized personnel table and add authorized personnel to the authorized personnel table; A function definition module, used to obtain an encryption algorithm and an algorithm key corresponding to the encryption algorithm, define an encryption UDF function and a decryption UDF function based on the encryption algorithm, and store the encryption UDF function and the decryption UDF function in a function library, wherein the encryption algorithm includes a format-preserving encryption algorithm and an order-preserving encryption algorithm; An encryption module, used to obtain a data table to be encrypted and call a corresponding encryption UDF function from the function library according to the data type of the data table to be encrypted, encrypt the data table to be encrypted and the algorithm key through the encryption UDF function, the key ring and the key name to obtain an encrypted ciphertext and a key ciphertext, and store the key ciphertext in an algorithm key ciphertext database; A decryption module is used to obtain the user's decryption requirements and determine whether the user is an authorized person in the authorized person table. If the user is an authorized person in the authorized person table, the encrypted ciphertext is decrypted by a corresponding decryption UDF function to obtain plaintext data; The encryption module comprises: A packaging submodule, used to package the encrypted UDF function into a JAR file, upload the JAR file to an accessible directory of the Hive server, and add the JAR file to the Hive session; The input submodule is used to write encrypted Hive SQL statements in the Hive command line interface and input the data table fields, corresponding key rings and corresponding key names of the data table to be encrypted into the encryption UDF function; A first encryption submodule, configured to encrypt the to-be-encrypted data table by calling the encryption UDF function and the corresponding encryption algorithm through the encrypted Hive SQL statement to obtain an encrypted ciphertext; A second encryption submodule, used to encrypt the algorithm key of the encryption algorithm through the key ring and the corresponding key name in the encryption UDF function to obtain a key ciphertext; The decryption module comprises: The calling submodule is used to write a decrypted Hive SQL statement in the Hive command line interface, and call the corresponding decryption UDF function through the decrypted Hive SQL statement; A retrieval submodule, used to retrieve the key ring and the corresponding key name passed in the corresponding encryption UDF function in the algorithm key ciphertext database through the decryption UDF function, and extract the corresponding key ciphertext therefrom; A first decryption submodule, used to decrypt the key ciphertext using the key ring and the corresponding key name to obtain a decrypted algorithm key; The second decryption submodule is used to decrypt the encrypted ciphertext using the decrypted algorithm key to obtain plaintext data.

5. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for dynamic encryption and decryption of a data table based on key escrow as described in any one of claims 1 to 3 is implemented.

6. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the method for dynamic encryption and decryption of a data table based on key escrow as described in any one of claims 1 to 3 is implemented.

Images