A database batch encryption method and verification method

Abstract

The present invention relates to the technical field of data encryption, and specifically discloses a database batch encryption method and verification method, comprising randomly dividing an encrypted database into a plurality of sub-databases; sorting each sub-database and generating a serial number and filling it in a preset array; setting a plurality of characteristic coordinates in the preset array, adding an identifier of a first encryption algorithm to data in a sub-database whose serial number is at the characteristic coordinate, and adding an identifier corresponding to a second encryption algorithm to data in a sub-database whose serial number is not at the characteristic coordinate; recording the serial number of the sub-database and the coordinate of the serial number in the preset array; encrypting the sub-database whose serial number is at the characteristic coordinate by using the first encryption algorithm, and encrypting the sub-database whose serial number is not at the characteristic coordinate by using the second encryption algorithm; after the existence of theft, the stolen database can be discovered and evidence collected by using the sub-database where the same data is located, the corresponding coordinates of the sub-database and the encryption method.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a database batch encryption method and a verification method. Background Art

[0002] With the development of the Internet and big data, the security requirements for the corresponding databases are getting higher and higher, and the data encryption of the database is becoming more and more important. Data encryption refers to the conversion of plain text into cipher text through encryption algorithms and encryption keys, while decryption refers to the restoration of cipher text to plain text through decryption algorithms and decryption keys. Data encryption is still the most reliable way for computer systems to protect information. It uses cryptographic technology to encrypt information and achieve information concealment, thereby playing a role in protecting the security of information.

[0003] The prior art discloses a method and device for encrypting and decrypting database data, wherein the encryption method includes: caching data in data blocks; compressing the data blocks; and encrypting the compressed data blocks. Since the encryption is implemented in the database kernel, there is no need to explicitly call the encryption function, and the loading tool provided by the database can also be used for batch loading, thereby improving the performance of the database.

[0004] However, in the above technical solutions, the encryption of the database is targeted at individual data, lacks integrity and has a low degree of verifiability. Summary of the invention

[0005] The purpose of the present invention is to provide a database batch encryption method and verification method to solve the problem that the encryption of the database in the prior art is targeted at individual data, lacks integrity and has a low degree of verifiability, and can support the discovery and evidence collection when the database is stolen while ensuring the security of the database.

[0006] To this end, on one hand, the present invention provides a database batch encryption method, the database batch encryption method comprising:

[0007] Randomly divide the encrypted database into several sub-databases;

[0008] Sorting each of the sub-databases and generating a serial number, and filling the serial number of each of the sub-databases into a preset array;

[0009] A number of characteristic coordinates are set in the preset array, and the identifier of the first encryption algorithm is added to the data in the sub-database whose serial numbers are in the characteristic coordinates, and the identifier corresponding to the second encryption algorithm is added to the data in the sub-database whose serial numbers are not in the characteristic coordinates;

[0010] Record the serial number of the sub-database and the coordinates of the serial number in the preset array;

[0011] The sub-database whose serial number is at the characteristic coordinate is encrypted by the first encryption algorithm, and the sub-database whose serial number is not at the characteristic coordinate is encrypted by the second encryption algorithm.

[0012] As a preferred technical solution of the database batch encryption method, when sorting each of the sub-databases and generating serial numbers, the sorting follows the ascending order or descending order of the field value, timestamp or string length.

[0013] As a preferred technical solution of the database batch encryption method, when the data in the database is randomly divided into several sub-databases, the amount of data stored in each sub-database is the same or within a preset data amount range.

[0014] As a preferred technical solution for the database batch encryption method, the first encryption algorithm is the Salsa20 encryption algorithm, and the second encryption algorithm is the AES encryption algorithm.

[0015] As a preferred technical solution of the database batch encryption method, when the serial number of each sub-database is filled into the preset array, the number of coordinates of the preset array is greater than or equal to the number of sub-databases.

[0016] As a preferred technical solution of the database batch encryption method, the serial numbers in the preset array are filled in a random manner, a serpentine manner, a row-by-row manner, or a column-by-column manner.

[0017] As a preferred technical solution for the database batch encryption method, when randomly dividing the data in the database into several sub-databases, a random number generation method is adopted, including generating a random number for each data and allocating the data to different sub-databases according to the value of the random number.

[0018] On the other hand, the present invention provides a verification method for batch encrypted databases, which is used to verify the encrypted databases encrypted by the above scheme, comprising:

[0019] Obtaining some identical data from the verification database and the encryption database;

[0020] Detect whether each of the identical data has an identifier, if not, the verification ends;

[0021] If each of the identical data at least partially has an identifier, obtaining a sub-database in the encrypted database where the identical data having the identifier is located;

[0022] Get the serial number of the sub-database where the same data with the identifier is located;

[0023] Filling the sequence number of the sub-database where the same data with the identifier is located in the preset array;

[0024] The coordinates corresponding to the serial number of the sub-database where the same data with the identifier is located are compared with each characteristic coordinate to determine whether the verification database has stolen the encrypted database as a whole.

[0025] As a preferred technical solution for the verification method of batch encryption of databases, the coordinates corresponding to the serial numbers of the sub-databases where the same data with the identifier is located are compared with each feature coordinate to determine whether the verification database has stolen the encrypted database as a whole, including: if the serial numbers of the sub-databases where the same data with the identifier is located are filled in the preset array, the distribution of the serial numbers after filling is the same as that of the sub-databases in the encrypted database and the identifiers match, only the feature coordinates are covered and the identifiers match, or only the feature coordinates are not covered and the identifiers match, it is determined that the verification database has stolen the encrypted database as a whole.

[0026] As a preferred technical solution for the verification method of batch encryption of databases, the verification method also includes: if each identical data in the verification database with the encrypted database only has an identifier corresponding to the first encryption algorithm or only has an identifier corresponding to the second encryption algorithm, it is determined that the verification database is obtained by decrypting the encrypted database using a single decryption method.

[0027] The beneficial effects of the present invention are:

[0028] The database batch encryption method provided by the present invention randomly divides the sub-database into several sub-databases, sorts and numbers each sub-database, and embeds an identifier corresponding to the encryption algorithm. On the one hand, the complexity and security of data encryption are improved through two encryption algorithms, which can increase the difficulty of the overall database being stolen. On the other hand, the present invention embeds the identifier corresponding to the encryption algorithm in the data, sorts the sub-databases, and distinguishes the encryption method of the sub-database corresponding to the feature coordinates. After the theft occurs, the stolen database can be discovered and evidence collected through the sub-database where the data is located, the corresponding coordinates of the sub-database, and the encryption method.

[0029] Furthermore, the verification method for batch encryption of databases provided by the present invention can accurately determine whether the verification database has stolen the encrypted database as a whole by filling the sub-database serial numbers of the same data with identifiers into a preset array and comparing them with the characteristic coordinates. The judgment can be made by simply comparing the coverage of the characteristic coordinates, which reduces the comparison scope and complexity. Through the multiple verification mechanisms of identifiers, serial number distribution and characteristic coordinates, the accuracy and reliability of the verification results can be effectively ensured. It is adaptable to different application scenarios and requirements, and the applicability of the verification method is enhanced. In addition, the setting of the identifier can quickly identify and determine the data obtained by a single decryption method, and promptly discover the overall theft of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 is a flow chart of a database batch encryption method in an embodiment of the present invention;

[0031] Figure 2 The present invention is a flowchart of a verification method for batch encryption of a database in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] In the description of the present invention, it should be noted that the orientations or positional relationships indicated by the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. Among them, the terms "first position" and "second position" are two different positions, and the first feature "above", "above" and "above" the second feature include the first feature being directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. The first feature "below", "below" and "below" the second feature include the first feature being directly below and obliquely below the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0034] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0035] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0036] See also Figure 1 As shown, the database batch encryption method provided by the present invention includes:

[0037] Step S1, randomly dividing the encrypted database into several sub-databases;

[0038] Step S2, sorting each sub-database and generating a serial number, and filling the serial number of each sub-database into a preset array;

[0039] Step S3, setting a number of characteristic coordinates in the preset array, adding an identifier of the first encryption algorithm to the data in the sub-database whose serial number is at the characteristic coordinates, and adding an identifier corresponding to the second encryption algorithm to the data in the sub-database whose serial number is not at the characteristic coordinates; the coordinates include the number of rows in the preset array and the number of columns in the preset array.

[0040] Step S4, recording the serial number of the sub-database and the coordinates of the serial number in the preset array;

[0041] Step S5, encrypting the sub-database whose serial number is at the characteristic coordinates by using the first encryption algorithm, and encrypting the sub-database whose serial number is not at the characteristic coordinates by using the second encryption algorithm.

[0042] In the above embodiment, by randomly dividing a sub-database into several sub-databases, sorting and numbering each sub-database, and embedding an identifier corresponding to the encryption algorithm, on the one hand, the complexity and security of data encryption are improved by two encryption algorithms, which can increase the difficulty of stealing the entire database. On the other hand, by embedding the identifier corresponding to the encryption algorithm in the data, sorting the sub-databases, and distinguishing the encryption method of the sub-database corresponding to the feature coordinates, after the theft occurs, the stolen database can be discovered and evidence collected through the sub-database where the data is located, the corresponding coordinates of the sub-database, and the encryption method.

[0043] In detail, the characteristic coordinates are preferably a plurality of coordinates adjacent to each other on both sides or diagonally on the preset array, and the characteristic coordinates are arranged on the preset array in a manner that can form a pattern of database features (such as model or name), providing a higher representation for the verification process.

[0044] In implementation, before encrypting the data, the identifier is first added to the data, and then the data containing the identifier is encrypted. During the decryption process, the decrypted data will contain the identifier, and the identifier can be directly extracted and verified from the decrypted data. The identifier can be prefixed to the data or mixed in the data, and its content ensures that the two identifiers can distinguish the encryption method.

[0045] Specifically, when sorting each sub-database and generating a serial number, the sorting follows the ascending or descending order of the field value, timestamp or string length. Exemplarily, the minimum field value in the data contained in each sub-database is obtained, and the sub-databases are sorted in sequence starting from the sub-database with the smallest field value according to the minimum field value of each sub-database. If there is a situation where the minimum field value of the sub-database is the same, the data with the smallest next field value of the remaining data in the database except the data corresponding to the minimum field value is compared until all sub-databases can be distinguished, and the ascending or descending order of the timestamp or string length is the same.

[0046] Specifically, when the data in the database is randomly divided into several sub-databases, the amount of data stored in each sub-database is the same or within a preset data volume range. This can avoid the waste of computing power caused by uneven distribution of data in the sub-databases, ensure the balanced storage of each sub-database, prevent overload of a single sub-database, and improve the load balancing of the system. In implementation, the preset data volume range needs to be reasonably set according to the database data storage and the number of sub-databases.

[0047] Specifically, the first encryption algorithm is the Salsa20 encryption algorithm, which is a stream encryption algorithm with a key length of 256 bits. The second encryption algorithm is the AES (Advanced Encryption Standard) encryption algorithm. The block length of AES is fixed at 128 bits, and the key length can be 128, 192 or 256 bits. Both methods have high security and can be clearly distinguished. Of course, the first encryption algorithm and the second encryption algorithm can also be set to other encryption algorithms with different decryption methods and higher security. In some embodiments, the first encryption algorithm and the second encryption algorithm can also be set to the same encryption algorithm with different key lengths.

[0048] Specifically, when the serial numbers of each sub-database are filled into the preset array, the number of coordinates of the preset array is greater than or equal to the number of sub-databases, so that the correspondence between the serial numbers and coordinates of the sub-databases can be supported while ensuring the integrity of the array.

[0049] Specifically, the serial number filling method in the preset array is random filling, serpentine filling (i.e., from the first position of the first row / column to the last position of the first row / column to the last position of the second row / column and then to the first position of the second row / column), row-by-row filling or column-by-column filling. The preset array filling method is flexible, and the most appropriate filling method can be selected according to actual needs, which increases the flexibility of system design.

[0050] Specifically, when randomly dividing the data in the database into several sub-databases, a random number generation method is used, including generating a random number for each piece of data and allocating the data to different sub-databases according to the value of the random number.

[0051] See also Figure 2 As shown, this embodiment also provides a verification method for batch encryption of a database, which is used to verify an encrypted database encrypted by the above scheme, including:

[0052] Step SS1, obtaining some identical data of the verification database and the encryption database;

[0053] Step SS2, detect whether each identical data has an identifier, if not, the verification ends, that is, it is determined that the verification database has not stolen the encrypted database as a whole; in implementation, the identifier includes an identifier corresponding to the first encryption algorithm and an identifier corresponding to the second encryption algorithm, the same below.

[0054] Step SS3: If at least part of the identical data has an identifier, it indicates that there is a possibility of overall theft, and the sub-database where the identical data with the identifier is located in the encrypted database is obtained;

[0055] Step SS4, obtaining the serial number of the sub-database where the same data with the identifier is located;

[0056] Step SS5, filling the serial number of the sub-database where the same data with the identifier is located in the preset array. It can be understood that the above filling is performed according to the corresponding relationship between the coordinates and the serial number in the encryption process;

[0057] Step SS6, comparing the coordinates corresponding to the serial number of the sub-database where the same data with the identifier is located with each characteristic coordinate to determine whether the verification database has stolen the encrypted database as a whole.

[0058] Specifically, the coordinates corresponding to the serial number of the sub-database where the same data with an identifier is located are compared with each feature coordinate to determine whether the verification database has stolen the encrypted database as a whole, including: if the serial number of the sub-database where the same data with an identifier is located is filled in the preset array, the distribution of the serial numbers after filling is the same as that of each sub-database in the encrypted database and the identifier is consistent, only the feature coordinates are covered and the identifier is consistent, or only the feature coordinates are not covered and the identifier is consistent, it is determined that the verification database has stolen the encrypted database as a whole.

[0059] In detail, after the serial numbers of the sub-databases where the same data with the identifiers are located are filled in the preset array, the distribution of the serial numbers after filling is the same as that of the sub-databases in the encrypted database and the identifiers match, indicating that the verification database has simultaneously performed the decryption means corresponding to the first encryption method and the second encryption method on the encrypted data, and the verification database has stolen the encrypted database as a whole. After the serial numbers of the sub-databases where the same data with the identifiers are located are filled in the preset array, only the characteristic coordinates are covered and the identifiers match, indicating that the verification database has only performed the decryption means corresponding to the first encryption method on the encrypted data, and the verification database has stolen the encrypted database as a whole. After the serial numbers of the sub-databases where the same data with the identifiers are located are filled in the preset array, only the characteristic coordinates are not covered and the identifiers match, indicating that the verification database has only performed the decryption means corresponding to the second encryption method on the encrypted data, and the verification database has stolen the encrypted database as a whole.

[0060] Specifically, the verification method further includes: if each identical data in the verification database and the encrypted database only has an identifier corresponding to the first encryption algorithm or only has an identifier corresponding to the second encryption algorithm, determining that the verification database is obtained by decrypting the encrypted database using a single decryption method. It can be understood that the existence of identical data with identifiers in the verification database indicates that the verification database has stolen data.

[0061] In the above embodiment, by filling the sub-database serial number of the same data with an identifier into a preset array and comparing it with the characteristic coordinates, it is possible to accurately determine whether the verification database has stolen the encrypted database as a whole. The determination can be made by simply comparing the coverage of the characteristic coordinates, which reduces the comparison scope and complexity. Through the multiple verification mechanisms of identifiers, serial number distribution and characteristic coordinates, the accuracy and reliability of the verification results can be effectively ensured. It is adaptable to different application scenarios and needs, and the applicability of the verification method is enhanced. In addition, the setting of the identifier can quickly identify and determine the data obtained by a single decryption method, and promptly discover the behavior of incomplete decryption and tampering of the data.

[0062] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A method for batch encryption of a database, characterized in that: include: Randomly divide the encrypted database into several sub-databases; Sorting each of the sub-databases and generating a serial number, and filling the serial number of each of the sub-databases into a preset array; A number of characteristic coordinates are set in the preset array, and the identifier of the first encryption algorithm is added to the data in the sub-database whose serial numbers are in the characteristic coordinates, and the identifier corresponding to the second encryption algorithm is added to the data in the sub-database whose serial numbers are not in the characteristic coordinates; Record the serial number of the sub-database and the coordinates of the serial number in the preset array; The sub-database whose serial number is at the characteristic coordinate is encrypted by the first encryption algorithm, and the sub-database whose serial number is not at the characteristic coordinate is encrypted by the second encryption algorithm.

2. The method for batch encryption of databases according to claim 1, characterized in that: When the sub-databases are sorted and serial numbers are generated, the sorting follows the ascending order or descending order of the field value, time stamp or character string length.

3. The method for batch encryption of databases according to claim 2, characterized in that: When the encrypted database is randomly divided into a plurality of sub-databases, the amount of data stored in each sub-database is the same or within a preset data amount range.

4. The method for batch encryption of databases according to claim 3, characterized in that: The first encryption algorithm is the Salsa20 encryption algorithm, and the second encryption algorithm is the AES encryption algorithm.

5. The method for batch encryption of databases according to claim 4, characterized in that: When the serial numbers of the sub-databases are filled into the preset array, the number of coordinates of the preset array is greater than or equal to the number of the sub-databases.

6. The method for batch encryption of databases according to claim 5, characterized in that: The serial numbers are filled in the preset array in a random manner, a serpentine manner, a row-by-row manner, or a column-by-column manner.

7. The method for batch encryption of databases according to claim 6, characterized in that: When randomly dividing the encrypted database into several sub-databases, a random number generation method is adopted, including generating a random number for each piece of data and allocating the data to different sub-databases according to the value of the random number.

8. A verification method applied to the database batch encryption method according to any one of claims 1 to 7, characterized in that: include: Obtaining some identical data from the verification database and the encryption database; Detect whether each of the identical data has an identifier, if not, the verification ends; If each of the identical data at least partially has an identifier, obtaining a sub-database in the encrypted database where the identical data having the identifier is located; Get the serial number of the sub-database where the same data with the identifier is located; Filling the sequence number of the sub-database where the same data with the identifier is located in the preset array; The coordinates corresponding to the serial number of the sub-database where the same data with the identifier is located are compared with each characteristic coordinate to determine whether the verification database has stolen the encrypted database as a whole.

9. The verification method according to claim 8, characterized in that: The method of comparing the coordinates corresponding to the serial number of the sub-database where the same data with the identifier is located with each feature coordinate to determine whether the verification database has stolen the encrypted database as a whole includes: if the serial number of the sub-database where the same data with the identifier is located is filled in the preset array, the distribution of the serial numbers after filling is the same as that of the sub-databases in the encrypted database and the identifiers match, only the feature coordinates are covered and the identifiers match, or only the feature coordinates are not covered and the identifiers match, it is determined that the verification database has stolen the encrypted database as a whole.

10. The verification method according to claim 9, characterized in that: The verification method further includes: if each identical data in the verification database with the encrypted database has only an identifier corresponding to the first encryption algorithm or only has an identifier corresponding to the second encryption algorithm, determining that the verification database is obtained by decrypting the encrypted database using a single decryption method.

Images