Automatic encryption and decryption method for database field access

Abstract

The invention provides an automatic encryption and decryption method for database field access, which comprises the following steps of: marking a data object and a field which need to be encrypted and decrypted, and assigning a corresponding encryption and decryption algorithm; performing addition, deletion, modification and check operations on the data on the business logic layer, and performing encryption and decryption processing on the corresponding data objects and fields according to the marks; a setting parameter interceptor is used for encrypting fields needing to be encrypted before addition, deletion and modification operation, and a query result interceptor is used for decrypting fields needing to be decrypted after query operation; calling a corresponding encryption and decryption processing class according to the encryption and decryption algorithm type marked by the field, and executing specific encryption and decryption operation; and storing the encrypted data in a database, and returning the decrypted data to the user. The method has the advantages that encryption and decryption of the corresponding algorithm are automatically completed, a developer does not need to process or understand specific encryption and decryption operation, encryption and decryption of the database can be managed in a unified mode, and meanwhile the complexity of application program development and maintenance is reduced.

Description

Technical Field

[0001] The invention belongs to the field of computer technology, and in particular relates to an automatic encryption and decryption method for accessing database fields. Background Art

[0002] In modern information systems, database security and data privacy protection are crucial. In order to protect sensitive data stored in the database, database-level encryption technology is often used. The encryption and decryption of database data generally explicitly encrypts and decrypts the data during business processing. This method requires encryption and decryption to be written for each update and query operation, and the encryption and decryption logic is repeatedly implemented in each operation processing, which increases the complexity of maintenance and management. Summary of the invention

[0003] In view of this, the present invention aims to propose an automatic encryption and decryption method for accessing database fields, in order to solve at least one of the above-mentioned technical problems.

[0004] To achieve the above object, the technical solution of the present invention is achieved as follows:

[0005] The automatic encryption and decryption method for accessing database fields includes the following steps:

[0006] Mark the data objects and fields that need to be encrypted and decrypted, and specify the corresponding encryption and decryption algorithms;

[0007] Performing data addition, deletion, modification and query operations at the business logic layer, and performing encryption and decryption processing on the corresponding data objects and fields according to the tags, wherein the encryption and decryption processing includes using the setting parameter interceptor to encrypt the fields that need to be encrypted before the addition, deletion and modification operations, and using the query result interceptor to decrypt the fields that need to be decrypted after the query operation;

[0008] According to the encryption and decryption algorithm type marked in the field, call the corresponding encryption and decryption processing class to perform specific encryption and decryption operations;

[0009] The encrypted data is stored in the database and the decrypted data is returned to the user.

[0010] Furthermore, the process of using the parameter setting interceptor to encrypt the fields that need to be encrypted before the addition, deletion, and modification operations includes:

[0011] The business logic layer receives requests from the control layer and identifies the corresponding data objects based on the received requests;

[0012] Before executing a database operation, a parameter interceptor is triggered, and the parameter interceptor checks the objects and fields marked as requiring encryption and decryption;

[0013] In the parameter interceptor, the annotation of the data object is parsed through the reflection mechanism to check whether the current data object is, and obtain the corresponding encryption and decryption algorithm type;

[0014] Before performing an insert or update operation, for the fields marked as requiring encryption, call the corresponding encryption processing class to encrypt the field values ​​and pass the encrypted data to the database operation.

[0015] Furthermore, the process of using the query result interceptor to decrypt the fields that need to be decrypted after the query operation includes:

[0016] Create a query result interceptor for processing the results returned by the database query, and the query result interceptor is triggered after the query operation is completed;

[0017] Traverse each data object in the query result and use the reflection mechanism to obtain the fields in each object that are marked as requiring decryption;

[0018] For fields marked as requiring decryption, obtain the specified decryption algorithm type and use the corresponding decryption logic to decrypt the encrypted field value;

[0019] Update the decrypted field value back into the data object.

[0020] Furthermore, the process of using the query result interceptor to decrypt the fields that need to be decrypted after the query operation includes the encryption process in the encryption and decryption algorithm being specifically as follows:

[0021] A key of corresponding length is set according to actual business needs, and the fields to be encrypted are hashed according to the key. During the hash encryption process, a time vector at the current time is generated, and the time vector is used as an increment to replace the bytes of the fields to be encrypted.

[0022] Furthermore, the byte replacement process is specifically as follows:

[0023] Convert the field to be encrypted into data in the corresponding ASCII code format, and increase or decrease each ASCII code data according to the time vector; if the direction of the time vector points to the second or third quadrant, increase the current ASCII code by the same value as the scalar in the time vector; otherwise, decrease the current ASCII code by the same value as the scalar in the time vector.

[0024] Compared with the prior art, the automatic encryption and decryption method for accessing database fields described in the present invention has the following beneficial effects:

[0025] Based on this invention, automatic encryption and decryption of database data can be realized. The encryption and decryption processing method is specified for the database field through simple annotations, and the encryption and decryption of the corresponding algorithm is automatically completed. The developer does not need to handle or understand the specific encryption and decryption operations. The encryption and decryption of parameters are completed when mybatis processes SQL data. This method can uniformly manage the encryption and decryption of the database while reducing the complexity of application development and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0027] Figure 1 The figure is a flowchart of the automatic encryption and decryption method for accessing database fields according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0029] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0030] The automatic encryption and decryption method for accessing database fields includes the following steps:

[0031] S1. Mark the data objects and fields that need to be encrypted and decrypted, and specify the corresponding encryption and decryption algorithms;

[0032] S2. Performing data addition, deletion, modification and query operations at the business logic layer, and performing encryption and decryption processing on the corresponding data objects and fields according to the tags, wherein the encryption and decryption processing includes using a setting parameter interceptor to encrypt the fields that need to be encrypted before the addition, deletion and modification operations, and using a query result interceptor to decrypt the fields that need to be decrypted after the query operation;

[0033] S3. According to the encryption and decryption algorithm type marked in the field, call the corresponding encryption and decryption processing class to perform specific encryption and decryption operations;

[0034] S4. Store the encrypted data in the database and return the decrypted data to the user.

[0035] The parameter interceptor and the query result interceptor are both mybatis interceptors.

[0036] The process of using the parameter setting interceptor to encrypt the fields that need to be encrypted before the addition, deletion, and modification operations includes:

[0037] The business logic layer receives requests from the control layer and identifies the corresponding data objects based on the received requests;

[0038] Before executing a database operation, a parameter interceptor is triggered, and the parameter interceptor checks the objects and fields marked as requiring encryption and decryption;

[0039] In the parameter interceptor, the annotation of the data object is parsed through the reflection mechanism to check whether the current data object is, and obtain the corresponding encryption and decryption algorithm type;

[0040] Before performing an insert or update operation, for the fields marked as requiring encryption, call the corresponding encryption processing class to encrypt the field values ​​and pass the encrypted data to the database operation.

[0041] The process of using the query result interceptor to decrypt the fields that need to be decrypted after the query operation includes:

[0042] Create a query result interceptor for processing the results returned by the database query, and the query result interceptor is triggered after the query operation is completed;

[0043] Traverse each data object in the query result and use the reflection mechanism to obtain the fields in each object that are marked as requiring decryption;

[0044] For fields marked as requiring decryption, obtain the specified decryption algorithm type and use the corresponding decryption logic to decrypt the encrypted field value;

[0045] Update the decrypted field value back into the data object.

[0046] The process of using the query result interceptor to decrypt the fields that need to be decrypted after the query operation includes the encryption process in the encryption and decryption algorithm being specifically as follows:

[0047] A key of corresponding length is set according to actual business needs, and the fields to be encrypted are hashed according to the key. During the hash encryption process, a time vector at the current time is generated, and the time vector is used as an increment to replace the bytes of the fields to be encrypted.

[0048] The byte replacement process is specifically as follows:

[0049] Convert the field to be encrypted into data in the corresponding ASCII code format, and increase or decrease each ASCII code data according to the time vector; if the direction of the time vector points to the second or third quadrant, increase the current ASCII code by the same value as the scalar in the time vector; otherwise, decrease the current ASCII code by the same value as the scalar in the time vector.

[0050] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0051] In the several embodiments provided in the present application, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the division of the units described above is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The above-mentioned units may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0052] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

[0053] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An automatic encryption and decryption method for accessing database fields, characterized in that: The steps include: Mark the data objects and fields that need to be encrypted and decrypted, and specify the corresponding encryption and decryption algorithms; Performing data addition, deletion, modification and query operations at the business logic layer, and performing encryption and decryption processing on the corresponding data objects and fields according to the tags, wherein the encryption and decryption processing includes using the setting parameter interceptor to encrypt the fields that need to be encrypted before the addition, deletion and modification operations, and using the query result interceptor to decrypt the fields that need to be decrypted after the query operation; According to the encryption and decryption algorithm type marked in the field, call the corresponding encryption and decryption processing class to perform specific encryption and decryption operations; The encrypted data is stored in the database and the decrypted data is returned to the user.

2. The automatic encryption and decryption method for accessing database fields according to claim 1, characterized in that: The process of using the parameter setting interceptor to encrypt the fields that need to be encrypted before the addition, deletion, and modification operations includes: The business logic layer receives requests from the control layer and identifies the corresponding data objects based on the received requests; Before executing a database operation, a parameter interceptor is triggered, and the parameter interceptor checks the objects and fields marked as requiring encryption and decryption; In the parameter interceptor, the annotation of the data object is parsed through the reflection mechanism to check whether the current data object is, and obtain the corresponding encryption and decryption algorithm type; Before performing an insert or update operation, for the fields marked as requiring encryption, call the corresponding encryption processing class to encrypt the field values ​​and pass the encrypted data to the database operation.

3. The automatic encryption and decryption method for accessing database fields according to claim 1, characterized in that: The process of using the query result interceptor to decrypt the fields that need to be decrypted after the query operation includes: Create a query result interceptor for processing the results returned by the database query, and the query result interceptor is triggered after the query operation is completed; Traverse each data object in the query result and use the reflection mechanism to obtain the fields in each object that are marked as requiring decryption; For fields marked as requiring decryption, obtain the specified decryption algorithm type and use the corresponding decryption logic to decrypt the encrypted field value; Update the decrypted field value back into the data object.

4. The automatic encryption and decryption method for accessing database fields according to claim 1, characterized in that: The process of using the query result interceptor to decrypt the fields that need to be decrypted after the query operation includes the encryption process in the encryption and decryption algorithm being specifically as follows: A key of corresponding length is set according to actual business needs, and the fields to be encrypted are hashed according to the key. During the hash encryption process, a time vector at the current time is generated, and the time vector is used as an increment to replace the bytes of the fields to be encrypted.

5. The automatic encryption and decryption method for accessing database fields according to claim 4, characterized in that: The byte replacement process is specifically as follows: Convert the field to be encrypted into data in the corresponding ASCII code format, and increase or decrease each ASCII code data according to the time vector; if the direction of the time vector points to the second or third quadrant, increase the current ASCII code by the same value as the scalar in the time vector; otherwise, decrease the current ASCII code by the same value as the scalar in the time vector.

Images