A data encryption method, system, device and medium based on metadata management

Abstract

The present invention relates to a data encryption method, system, device and medium based on metadata management, the method comprising the following steps: integrating a data encryption component when a business system is initialized, and intercepting a database driver through an encryption interface class. The component generates a database connection agent, automatically detects the fields to be encrypted in an SQL statement, encrypts them according to encryption configuration information, and replaces the corresponding fields in the original SQL. At the same time, the encryption interface class also intercepts the field mapping process of the database driver, and performs a decryption operation on the fields to be decrypted. In the query result set, the encryption interface class replaces the mapping value of the original encrypted field with the decrypted field value. The present invention not only strengthens the security of data in the storage and transmission links, but also does not require changes to the existing business logic, thereby ensuring the continuity and stability of business operations. Through intelligent encryption and decryption processing, the technology provides a transparent and efficient data security protection solution for the business system.

Description

Technical Field

[0001] The present invention relates to a data encryption method, system, equipment and medium based on metadata management, and belongs to the field of information technology security. Background Art

[0002] With the advent of the digital age, data has become a core asset of enterprises, and its security and privacy protection have become particularly important. Data leakage and illegal access will not only lead to economic losses, but may also damage corporate reputation and customer trust. Therefore, achieving real-time data encryption has become an important means to ensure data security. Traditional data encryption technology generally uses hard coding or interface methods to accept data transmitted by the business system and then return encrypted data. This approach greatly increases the complexity of the code and the difficulty of maintenance. During the system iteration process, the slightest carelessness will lead to problems in the overall operation of the business system. In addition, there is a lack of intuitive encryption configuration methods and encryption status feedback.

[0003] Prior art, such as the Chinese patent with patent number "CN108509805A", discloses a data encryption and decryption and desensitization operation engine and its working method. The method includes the following steps: SDK client, which is used to integrate into the business system to intercept SQL statements and determine whether they need to be rewritten according to the metadata configuration. SQL statements that do not need to be rewritten directly send requests to the database, and SQL statements that need to be rewritten request security services for rewriting; security services, which are used to obtain SQL statements that need to be rewritten, complete SQL statement rewriting according to metadata configuration, and return rewritten SQL statements to the SDK client. The SDK client calls the rewritten SQL statement to initiate a request to the database; database extension function, when processing requests involving desensitization processing, is used as an RPC client to call the operation component of the RPC operation service to return the result.

[0004] The problem with the above-mentioned prior art is that it relies on the integration of the SDK client, which means that the business system needs to introduce and configure the SDK client additionally, increasing the complexity and potential risks of system integration. Business system developers need to ensure the correct integration of the SDK client, as well as possible subsequent version updates and maintenance. All SQL statements need to be intercepted and judged by the SDK client, even SQL statements that do not need to be rewritten will go through this process, which may increase the system processing time and delay to a certain extent, and have a certain impact on system performance. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention proposes a data encryption method, system, device and medium based on metadata management.

[0006] The technical solution of the present invention is as follows:

[0007] In one aspect, the present invention provides a data encryption method based on metadata management, comprising the following steps:

[0008] Initialize the encryption component configuration class of the data encryption component based on the business system; the data encryption component also includes an encryption interface class and an SQL parsing tool; the encryption interface class of the data encryption component begins to intercept the database driver and generate a database connection proxy object; when an SQL statement is executed in the business system, the data encryption component encrypts the fields in the original SQL statement that are consistent with the fields to be encrypted in the database table encryption configuration information, and uses the encrypted fields to overwrite the fields to be encrypted in the original SQL statement;

[0009] When the SQL statement prepares field mapping, the field mapping logic of the database driver is intercepted according to the encryption interface class of the data encryption component, and the fields to be decrypted in the SQL statement are decrypted; after receiving the decrypted fields, the encryption interface class uses the decrypted fields to replace the mapping values ​​of the fields to be decrypted in the database driver query result set; the database driver then returns the SQL execution result to the business system.

[0010] As a preferred implementation, the specific process of initializing the encryption component configuration class of the data encryption component is as follows:

[0011] The business system reads the external configuration file, obtains the configuration channels including the remote configuration mode, the local database configuration mode and the file configuration mode from the external configuration file, and obtains the database table encryption configuration information including the name of the encryption table, whether the table is divided, the field to be encrypted, the encryption key, the encryption algorithm and whether fuzzy query is supported from the external configuration file;

[0012] Convert the database table encryption configuration information into an encryption component configuration class object. The conversion process is as follows:

[0013] If the configuration mode is file configuration mode, the encryption component configuration class of the data encryption component obtains encryption and decryption configuration information by reading information in an external configuration file; and assigns the encryption and decryption configuration information to the properties of the encryption component configuration class object of the data encryption component.

[0014] As a preferred implementation, the specific steps of the data encryption component encrypting the SQL statement are:

[0015] The encryption interface class in the data encryption component calls the SQL parsing tool to parse out the condition column, database table name, and operation column in the SQL statement;

[0016] The encryption interface class calls the encryption component configuration class object in the data encryption component, and uses a hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name parsed from the SQL statement;

[0017] When the SQL statement is precompiled, the database driver starts to assign values ​​to the parameters in the SQL statement. The encryption interface class searches the database table encryption configuration information for the name of the currently assigned parameter to see if the field to be encrypted is consistent with the parameter.

[0018] If they are consistent, the encryption key and encryption algorithm in the database table encryption configuration information are used to encrypt the parameter;

[0019] Among them, the encryption and decryption algorithm implementation interface is provided, using the AES algorithm or SM4 algorithm for encryption;

[0020] The data encryption component passes the encryption key and encryption algorithm in the database table encryption configuration information to the encryption algorithm enumeration class, and the encryption algorithm enumeration class initializes the specific encryption and decryption algorithm implementation class according to the algorithm name;

[0021] The specific encryption process of the AES algorithm is as follows:

[0022] The AES algorithm implementation class creates an encryptor object; decodes the encryption key into a byte array, uses the decoded byte array to create an AES algorithm key object, and declares a byte array to store the encrypted data;

[0023] Initialize a byte array as vector IV, and use the key byte array and vector IV to initialize the encryptor object; convert the parameters to be encrypted into a UTF-8 byte stream for encryption, and obtain the encrypted ciphertext byte array;

[0024] Combine the vector IV and the ciphertext byte array and use them to perform Base64 encoding to obtain a Base64-encoded ciphertext string;

[0025] According to the information in the database table encryption configuration information whether fuzzy query is supported, if yes, the specific fuzzy query processing steps are as follows:

[0026] Call the fuzzy query encryption method, which uses the SALSA20 algorithm to encode the original value of the ciphertext string;

[0027] The encoding process is:

[0028] Declare a string variable and assign the ciphertext string to the string variable. Start traversing the string variable from the first character, and take each traversed character as a base point to intercept a substring with a length of the preset value M. If the character of the current base point + M is the terminator, the traversal ends. Use SALSA20 encoding to encode each string, and concatenate the strings according to the string generation order to obtain the fuzzy query feature string.

[0029] The fuzzy query feature string and the ciphertext string are concatenated together using a segmentation mark, and the concatenated string is used to overwrite the parameters that need to be encrypted in the original SQL statement;

[0030] If it is not, the ciphertext string is directly used to overwrite the parameters that need to be encrypted in the original SQL statement.

[0031] As a preferred implementation, the specific process of decrypting the parameters to be decrypted in the SQL statement is as follows:

[0032] Use the hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name, and pass the parameters to be decrypted and the encryption configuration information to the decryption service;

[0033] The decryption service instantiates the decryption implementation class according to the AES algorithm. The specific decryption steps are:

[0034] Determine whether there is a fuzzy query feature string in the data returned by executing SQL. If so, use the segmentation mark to remove the fuzzy query feature string to obtain the ciphertext string;

[0035] Create a decryption container object, use Base64 decoding on the parameters to be decrypted, and decode the encryption key into a key byte array;

[0036] Initialize a byte array as vector IV, use the key byte array and vector IV to initialize the decryption container object, use the decryption container object to decrypt the decoded ciphertext data, and convert the decrypted byte array into a string using UTF-8 encoding;

[0037] If the decryption is successful, the decrypted result is used to overwrite the data in the result set; if the decryption fails, the undecrypted original data is returned.

[0038] On the other hand, the present invention also provides a data encryption system based on metadata management, comprising:

[0039] The data encryption component initialization module initializes the encryption component configuration class of the data encryption component based on the business system; wherein the data encryption component also includes an encryption interface class and an SQL parsing tool; in the data encryption module, the encryption interface class of the data encryption component begins to intercept the database driver and generate a database connection proxy object; when an SQL statement is executed in the business system, the data encryption component encrypts the fields in the original SQL statement that are consistent with the fields to be encrypted in the database table encryption configuration information, and uses the encrypted fields to overwrite the fields to be encrypted in the original SQL statement;

[0040] The data decryption module intercepts the field mapping logic of the database driver according to the encryption interface class of the data encryption component when the SQL statement prepares the field mapping, and decrypts the fields to be decrypted in the SQL statement; after the encryption interface class receives the decrypted fields, it uses the decrypted fields to replace the mapping values ​​of the fields to be decrypted in the database driver query result set; the database driver then returns the SQL execution results to the business system.

[0041] On the other hand, the present invention further provides an electronic device having a computer program stored thereon, wherein when the computer program is executed by a processor, the data encryption method based on metadata management as described in any embodiment of the present invention is implemented.

[0042] On the other hand, the present invention also provides a computer-readable medium for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement a data encryption method based on metadata management as described in any embodiment of the present invention.

[0043] The present invention has the following beneficial effects:

[0044] The present invention can enhance the bytecode of the application program without modifying the source code through bytecode enhancement technology, thereby realizing encryption and decryption of database operations. This method avoids the potential risks that may be caused by directly modifying the source code, such as code conflicts, error introduction, etc. When the business system executes the SQL statement, the encryption component can identify and encrypt the fields that need to be encrypted in real time, ensuring that the data has been encrypted before storage. This greatly improves the security of the data and prevents the data from being leaked during transmission and storage. By optimizing the selection of encryption algorithms and the design of encryption processes, the impact of encryption operations on system performance can be minimized while ensuring encryption strength. In addition, the encryption interface class of the encryption component can efficiently intercept and process database operations, ensuring the timeliness and accuracy of encryption operations. Through real-time encryption and decryption operations, the scheme can ensure the security of data during storage and transmission. In addition, the encryption component also provides a strict key management mechanism and encryption algorithm selection strategy, further improving the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The figure is a flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0048] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0049] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0050] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0051] Embodiment 1:

[0052] See also Figure 1 The present invention proposes a data encryption method based on metadata management, comprising the following steps:

[0053] Initialize the encryption component configuration class of the data encryption component based on the business system; the data encryption component also includes an encryption interface class and an SQL parsing tool; the encryption interface class of the data encryption component begins to intercept the database driver and generate a database connection proxy object; when an SQL statement is executed in the business system, the data encryption component encrypts the fields in the original SQL statement that are consistent with the fields to be encrypted in the database table encryption configuration information, and uses the encrypted fields to overwrite the fields to be encrypted in the original SQL statement;

[0054] When the SQL statement prepares field mapping, the field mapping logic of the database driver is intercepted according to the encryption interface class of the data encryption component, and the fields to be decrypted in the SQL statement are decrypted; after receiving the decrypted fields, the encryption interface class uses the decrypted fields to replace the mapping values ​​of the fields to be decrypted in the database driver query result set; the database driver then returns the SQL execution result to the business system.

[0055] As a preferred implementation, the specific process of initializing the encryption component configuration class of the data encryption component is as follows:

[0056] The business system reads the external configuration file, obtains the configuration channels including the remote configuration mode, the local database configuration mode and the file configuration mode from the external configuration file, and obtains the database table encryption configuration information including the name of the encryption table, whether the table is divided, the field to be encrypted, the encryption key, the encryption algorithm and whether fuzzy query is supported from the external configuration file;

[0057] Convert the database table encryption configuration information into an encryption component configuration class object. The conversion process is as follows:

[0058] If the configuration mode is file configuration mode, the encryption component configuration class of the data encryption component obtains encryption and decryption configuration information by reading information in an external configuration file; and assigns the encryption and decryption configuration information to the properties of the encryption component configuration class object of the data encryption component.

[0059] As a preferred implementation, the specific steps of the data encryption component encrypting the SQL statement are:

[0060] The encryption interface class in the data encryption component calls the SQL parsing tool to parse out the condition column, database table name, and operation column in the SQL statement;

[0061] The encryption interface class calls the encryption component configuration class object in the data encryption component, and uses a hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name parsed from the SQL statement;

[0062] When the SQL statement is precompiled, the database driver starts to assign values ​​to the parameters in the SQL statement. The encryption interface class searches the database table encryption configuration information for the name of the currently assigned parameter to see if the field to be encrypted is consistent with the parameter.

[0063] If they are consistent, the encryption key and encryption algorithm in the database table encryption configuration information are used to encrypt the parameter; if they are inconsistent, the encryption operation is not performed;

[0064] Among them, the encryption and decryption algorithm implementation interface is provided, using the AES algorithm or SM4 algorithm for encryption;

[0065] The data encryption component passes the encryption key and encryption algorithm in the database table encryption configuration information to the encryption algorithm enumeration class, and the encryption algorithm enumeration class initializes the specific encryption and decryption algorithm implementation class according to the algorithm name;

[0066] The specific encryption process of the AES algorithm is as follows:

[0067] The AES algorithm implementation class creates an encryptor object; decodes the encryption key into a byte array, uses the decoded byte array to create an AES algorithm key object, and declares a byte array to store the encrypted data;

[0068] Initialize a byte array as vector IV, and use the key byte array and vector IV to initialize the encryptor object; convert the parameters to be encrypted into a UTF-8 byte stream for encryption, and obtain the encrypted ciphertext byte array;

[0069] Combine the vector IV and the ciphertext byte array and use them to perform Base64 encoding to obtain a Base64-encoded ciphertext string;

[0070] According to the information in the database table encryption configuration information whether fuzzy query is supported, if yes, the specific fuzzy query processing steps are as follows:

[0071] Call the fuzzy query encryption method, which uses the SALSA20 algorithm to encode the original value of the ciphertext string;

[0072] The encoding process is:

[0073] Declare a string variable and assign the ciphertext string to the string variable. Start traversing the string variable from the first character, and take each traversed character as a base point to intercept a substring with a length of the preset value M. If the character of the current base point + M is the terminator, the traversal ends. Use SALSA20 encoding to encode each string, and concatenate the strings according to the string generation order to obtain the fuzzy query feature string.

[0074] The fuzzy query feature string and the ciphertext string are concatenated together using a segmentation mark, and the concatenated string is used to overwrite the parameters that need to be encrypted in the original SQL statement;

[0075] If it is not, the ciphertext string is directly used to overwrite the parameters that need to be encrypted in the original SQL statement.

[0076] As a preferred implementation, the specific process of decrypting the parameters to be decrypted in the SQL statement is as follows:

[0077] Use the hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name, and pass the parameters to be decrypted and the encryption configuration information to the decryption service;

[0078] The decryption service instantiates the decryption implementation class according to the AES algorithm. The specific decryption steps are:

[0079] Determine whether there is a fuzzy query feature string in the data returned by executing SQL. If so, use the segmentation mark to remove the fuzzy query feature string to obtain the ciphertext string;

[0080] Create a decryption container object, use Base64 decoding on the parameters to be decrypted, and decode the encryption key into a key byte array;

[0081] Initialize a byte array as vector IV, use the key byte array and vector IV to initialize the decryption container object, use the decryption container object to decrypt the decoded ciphertext data, and convert the decrypted byte array into a string using UTF-8 encoding;

[0082] If the decryption is successful, the decrypted result is used to overwrite the data in the result set; if the decryption fails, the undecrypted original data is returned.

[0083] Embodiment 2:

[0084] This embodiment provides that the present invention also provides a data encryption system based on metadata management, including:

[0085] The data encryption component initialization module initializes the encryption component configuration class of the data encryption component based on the business system; wherein the data encryption component also includes an encryption interface class and an SQL parsing tool; in the data encryption module, the encryption interface class of the data encryption component begins to intercept the database driver and generate a database connection proxy object; when an SQL statement is executed in the business system, the data encryption component encrypts the fields in the original SQL statement that are consistent with the fields to be encrypted in the database table encryption configuration information, and uses the encrypted fields to overwrite the fields to be encrypted in the original SQL statement;

[0086] The data decryption module intercepts the field mapping logic of the database driver according to the encryption interface class of the data encryption component when the SQL statement prepares the field mapping, and decrypts the fields to be decrypted in the SQL statement; after the encryption interface class receives the decrypted fields, it uses the decrypted fields to replace the mapping values ​​of the fields to be decrypted in the database driver query result set; the database driver then returns the SQL execution results to the business system.

[0087] Embodiment three:

[0088] This embodiment provides an electronic device having a computer program stored thereon. When the computer program is executed by a processor, a data encryption method based on metadata management as described in any embodiment of the present invention is implemented.

[0089] Embodiment 4:

[0090] This embodiment provides a computer-readable medium for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a data encryption method based on metadata management as described in any embodiment of the present invention.

[0091] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0092] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0093] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0094] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk, and other media that can store program codes.

[0095] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data encryption method based on metadata management, characterized in that: The following steps are involved: Initialize the encryption component configuration class of the data encryption component based on the business system; the data encryption component also includes an encryption interface class and an SQL parsing tool; The encryption interface class of the data encryption component begins to intercept the database driver and generate a database connection proxy object. When an SQL statement is executed in the business system, the data encryption component encrypts the fields in the original SQL statement that are consistent with the fields to be encrypted in the database table encryption configuration information, and uses the encrypted fields to overwrite the fields to be encrypted in the original SQL statement. When the SQL statement prepares field mapping, the encryption interface class of the data encryption component intercepts the field mapping logic of the database driver and decrypts the fields to be decrypted in the SQL statement; after receiving the decrypted fields, the encryption interface class uses the decrypted fields to replace the mapping values ​​of the fields to be decrypted in the database driver query result set; the database driver then returns the SQL execution results to the business system; The specific steps of the data encryption component to encrypt SQL statements are: The encryption interface class in the data encryption component calls the SQL parsing tool to parse out the condition column, database table name, and operation column in the SQL statement; The encryption interface class calls the encryption component configuration class object in the data encryption component, and uses a hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name parsed from the SQL statement; When the SQL statement is precompiled, the database driver starts to assign values ​​to the parameters in the SQL statement. The encryption interface class searches the database table encryption configuration information for the name of the currently assigned parameter to see if the field to be encrypted is consistent with the parameter. If they are consistent, the encryption key and encryption algorithm in the database table encryption configuration information are used to encrypt the parameter; Among them, the encryption and decryption algorithm implementation interface is provided, using the AES algorithm or SM4 algorithm for encryption; The data encryption component passes the encryption key and encryption algorithm in the database table encryption configuration information to the encryption algorithm enumeration class, and the encryption algorithm enumeration class initializes the specific encryption and decryption algorithm implementation class according to the algorithm name; The specific encryption process of the AES algorithm is as follows: The AES algorithm implementation class creates an encryptor object; decodes the encryption key into a byte array, uses the decoded byte array to create an AES algorithm key object, and declares a byte array to store the encrypted data; Initialize a byte array as vector IV, and use the key byte array and vector IV to initialize the encryptor object; convert the parameters to be encrypted into a UTF-8 byte stream for encryption, and obtain the encrypted ciphertext byte array; Combine the vector IV and the ciphertext byte array and use them to perform Base64 encoding to obtain a Base64-encoded ciphertext string; According to the information in the database table encryption configuration information whether fuzzy query is supported, if yes, the specific fuzzy query processing steps are as follows: Call the fuzzy query encryption method, which uses the SALSA20 algorithm to encode the original value of the ciphertext string; The encoding process is: Declare a string variable and assign the ciphertext string to the string variable. Start traversing the string variable from the first character, and take each traversed character as a base point to intercept a substring with a length of the preset value M. If the character of the current base point + M is the terminator, the traversal ends. Use SALSA20 encoding to encode each string, and concatenate the strings according to the string generation order to obtain the fuzzy query feature string. The fuzzy query feature string and the ciphertext string are concatenated together using a segmentation mark, and the concatenated string is used to overwrite the parameters that need to be encrypted in the original SQL statement; If it is not, the ciphertext string is directly used to overwrite the parameters that need to be encrypted in the original SQL statement; The specific process of decrypting the parameters that need to be decrypted in the SQL statement is as follows: Use the hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name, and pass the parameters to be decrypted and the encryption configuration information to the decryption service; The decryption service instantiates the decryption implementation class according to the AES algorithm. The specific decryption steps are: Determine whether there is a fuzzy query feature string in the data returned by executing SQL. If so, use the segmentation mark to remove the fuzzy query feature string to obtain the ciphertext string; Create a decryption container object, use Base64 decoding on the parameters to be decrypted, and decode the encryption key into a key byte array; Initialize a byte array as vector IV, use the key byte array and vector IV to initialize the decryption container object, use the decryption container object to decrypt the decoded ciphertext data, and convert the decrypted byte array into a string using UTF-8 encoding; If the decryption is successful, the decrypted result is used to overwrite the data in the result set; if the decryption fails, the undecrypted original data is returned.

2. According to claim 1, a data encryption method based on metadata management is characterized in that: The specific process of initializing the encryption component configuration class of the data encryption component is as follows: The business system reads the external configuration file, obtains the configuration channels including the remote configuration mode, the local database configuration mode and the file configuration mode from the external configuration file, and obtains the database table encryption configuration information including the name of the encryption table, whether the table is divided, the field to be encrypted, the encryption key, the encryption algorithm and whether fuzzy query is supported from the external configuration file; Convert the database table encryption configuration information into an encryption component configuration class object. The conversion process is as follows: If the configuration mode is file configuration mode, the encryption component configuration class of the data encryption component obtains encryption and decryption configuration information by reading information in an external configuration file; and assigns the encryption and decryption configuration information to the properties of the encryption component configuration class object of the data encryption component.

3. A data encryption system based on metadata management, characterized in that: include: The data encryption component initialization module initializes the encryption component configuration class of the data encryption component based on the business system; wherein the data encryption component also includes an encryption interface class and an SQL parsing tool; in the data encryption module, the encryption interface class of the data encryption component begins to intercept the database driver and generate a database connection proxy object; when an SQL statement is executed in the business system, the data encryption component encrypts the fields in the original SQL statement that are consistent with the fields to be encrypted in the database table encryption configuration information, and uses the encrypted fields to overwrite the fields to be encrypted in the original SQL statement; The data decryption module intercepts the field mapping logic of the database driver according to the encryption interface class of the data encryption component when the SQL statement prepares the field mapping, and decrypts the fields to be decrypted in the SQL statement; after the encryption interface class receives the decrypted fields, it uses the decrypted fields to replace the mapping values ​​of the fields to be decrypted in the database driver query result set; the database driver then returns the SQL execution results to the business system; The specific steps of the data encryption module and the data encryption component for encrypting SQL statements are as follows: The encryption interface class in the data encryption component calls the SQL parsing tool to parse out the condition column, database table name, and operation column in the SQL statement; The encryption interface class calls the encryption component configuration class object in the data encryption component, and uses a hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name parsed from the SQL statement; When the SQL statement is precompiled, the database driver starts to assign values ​​to the parameters in the SQL statement. The encryption interface class searches the database table encryption configuration information for the name of the currently assigned parameter to see if the field to be encrypted is consistent with the parameter. If they are consistent, the encryption key and encryption algorithm in the database table encryption configuration information are used to encrypt the parameter; Among them, the encryption and decryption algorithm implementation interface is provided, using the AES algorithm or SM4 algorithm for encryption; The data encryption component passes the encryption key and encryption algorithm in the database table encryption configuration information to the encryption algorithm enumeration class, and the encryption algorithm enumeration class initializes the specific encryption and decryption algorithm implementation class according to the algorithm name; The specific encryption process of the AES algorithm is as follows: The AES algorithm implementation class creates an encryptor object; decodes the encryption key into a byte array, uses the decoded byte array to create an AES algorithm key object, and declares a byte array to store the encrypted data; Initialize a byte array as vector IV, and use the key byte array and vector IV to initialize the encryptor object; convert the parameters to be encrypted into a UTF-8 byte stream for encryption, and obtain the encrypted ciphertext byte array; Combine the vector IV and the ciphertext byte array and use them to perform Base64 encoding to obtain a Base64-encoded ciphertext string; According to the information in the database table encryption configuration information whether fuzzy query is supported, if yes, the specific fuzzy query processing steps are as follows: Call the fuzzy query encryption method, which uses the SALSA20 algorithm to encode the original value of the ciphertext string; The encoding process is: Declare a string variable and assign the ciphertext string to the string variable. Start traversing the string variable from the first character, and take each traversed character as a base point to intercept a substring with a length of the preset value M. If the character of the current base point + M is the terminator, the traversal ends. Use SALSA20 encoding to encode each string, and concatenate the strings according to the string generation order to obtain the fuzzy query feature string. The fuzzy query feature string and the ciphertext string are concatenated together using a segmentation mark, and the concatenated string is used to overwrite the parameters that need to be encrypted in the original SQL statement; If it is not, the ciphertext string is directly used to overwrite the parameters that need to be encrypted in the original SQL statement; The data decryption module decrypts the parameters to be decrypted in the SQL statement in the following specific process: Use the hash algorithm to obtain the database table encryption configuration information of the table in the encryption component configuration object according to the database table name, and pass the parameters to be decrypted and the encryption configuration information to the decryption service; The decryption service instantiates the decryption implementation class according to the AES algorithm. The specific decryption steps are: Determine whether there is a fuzzy query feature string in the data returned by executing SQL. If so, use the segmentation mark to remove the fuzzy query feature string to obtain the ciphertext string; Create a decryption container object, use Base64 decoding on the parameters to be decrypted, and decode the encryption key into a key byte array; Initialize a byte array as vector IV, use the key byte array and vector IV to initialize the decryption container object, use the decryption container object to decrypt the decoded ciphertext data, and convert the decrypted byte array into a string using UTF-8 encoding; If the decryption is successful, the decrypted result is used to overwrite the data in the result set; if the decryption fails, the undecrypted original data is returned.

4. A data encryption system based on metadata management according to claim 3, characterized in that: The data encryption component initialization module, the encryption component configuration class initialization of the data encryption component specific process is: The business system reads the external configuration file, obtains the configuration channels including the remote configuration mode, the local database configuration mode and the file configuration mode from the external configuration file, and obtains the database table encryption configuration information including the name of the encryption table, whether the table is divided, the field to be encrypted, the encryption key, the encryption algorithm and whether fuzzy query is supported from the external configuration file; Convert the database table encryption configuration information into an encryption component configuration class object. The conversion process is as follows: If the configuration mode is file configuration mode, the encryption component configuration class of the data encryption component obtains encryption and decryption configuration information by reading information in an external configuration file; and assigns the encryption and decryption configuration information to the properties of the encryption component configuration class object of the data encryption component.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the data encryption method based on metadata management as described in any one of claims 1 to 2 is implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a data encryption method based on metadata management as described in any one of claims 1 to 2 is implemented.

Images