Database full-secret-state encryption method and device based on hardware password card, electronic equipment and storage medium

Abstract

The invention provides a database full-secret-state encryption method and device based on a hardware password card, electronic equipment and a storage medium, and is applied to the technical field of database and data encryption. The method comprises the following steps: creating a client master key for encrypting a column encryption key, storing the client master key in a hardware password card, and generating a reading interface of the client master key by using the hardware password card; creating a column encryption key for specifying an encryption column, storing the column encryption key in the hardware password card, and generating a reading interface of the column encryption key by using the hardware password card; and reading the column encryption key from the hardware cipher card through a reading interface of the column encryption key, creating a table based on the specified encryption column by using the column encryption key, and encrypting inserted data in the table based on the specified encryption column by using a client master key stored in the hardware cipher card. According to the method provided by the invention, the rapid encryption and decryption of the fully-encrypted database and the security management of the key can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of database and data encryption, and in particular to a database full-secret encryption method and device based on a hardware password card, an electronic device and a storage medium. Background Art

[0002] The existing encryption and decryption methods for fully encrypted databases use software to encrypt and decrypt important data on the client side, and the keys are managed through cloud services or local file systems. However, the operating efficiency of data encryption and decryption through software is lower than that of hardware; key management through local files has poor key security and is easy to be illegally obtained. Key management through cloud services has high deployment requirements and is highly dependent on cloud services, making it impossible to easily deploy fully encrypted database functions. Summary of the invention

[0003] In view of the above problems, the present invention provides a database full-secret encryption method and device based on a hardware password card, an electronic device and a storage medium, in order to solve at least one of the above problems.

[0004] According to a first aspect of the present invention, a database full-secret encryption method based on a hardware password card is provided, comprising:

[0005] Create a client master key for encrypting a column encryption key, store the client master key in a hardware password card, and use the hardware password card to generate a reading interface for the client master key, wherein the client master key is used to store location information of the client master key in the hardware password card;

[0006] Create a column encryption key for a specified encrypted column, store the column encryption key in a hardware password card, and use the hardware password card to generate a reading interface for the column encryption key, wherein the column encryption key is used to store location information of the column encryption key in the hardware password card;

[0007] The column encryption key is read from the hardware password card through the column encryption key reading interface, a table based on the specified encryption column is created using the column encryption key, and the inserted data in the table based on the specified encryption column is encrypted using the client master key stored in the hardware password card.

[0008] According to an embodiment of the present invention, the above-mentioned creation of a client master key for encrypting a column encryption key, storing the client master key in a hardware password card, and using the hardware password card to generate a reading interface for the client master key includes:

[0009] Based on the uniqueness constraint of object names in the same namespace, a string that complies with the identifier naming specification is used as the object name of the client master key, and the management tool and encryption algorithm type of the client master key are specified;

[0010] Create a client master key based on the object name, path information, management tool, and encryption algorithm type of the client master key;

[0011] The client master key is stored in the hardware password card, and the hardware password card is used to generate a reading interface for the client master key.

[0012] According to an embodiment of the present invention, types of encryption algorithms for the above-mentioned client master key include RSA_2048, RSA3072 and SM2.

[0013] According to an embodiment of the present invention, the above-mentioned creation of a column encryption key for specifying an encrypted column, storing the column encryption key in a hardware password card, and using the hardware password card to generate a reading interface for the column encryption key includes:

[0014] Based on the uniqueness constraint of object names in the same namespace, a string that complies with the identifier naming specification is used as the object name of the column encryption key;

[0015] Specify the client master key used to encrypt the column encryption key, the encryption algorithm for the column encryption key, and the key password for the column encryption key;

[0016] Creates a column encryption key based on its object name, encryption algorithm, key password, and the client master key used to encrypt the column encryption key.

[0017] According to an embodiment of the present invention, the encryption algorithms of the above-mentioned column encryption key include AEAD_AES_256_CBC_HMAC_SHA256, AEAD_AES_128_CBC_HMAC_SHA256 and SM4_SM3.

[0018] According to an embodiment of the present invention, the key password of the column encryption key is optional;

[0019] The length of the key password of the column encryption key is within a preset range, and the length of the key password of the column encryption key can be adjusted within the preset range according to user requirements.

[0020] According to an embodiment of the present invention, the above-mentioned encrypting the inserted data in the table based on the designated encryption column by using the client master key stored in the hardware password card includes:

[0021] Use the client master key to decrypt the column encryption key stored in the hardware password card to obtain the plain text of the column encryption key;

[0022] The inserted data in the table based on the specified encryption column is encrypted by using the plain text of the column encryption key through the hardware password card.

[0023] According to a second aspect of the present invention, there is provided a database full-secret encryption device based on a hardware password card, comprising:

[0024] A client master key creation module, used to create a client master key for encrypting a column encryption key, store the client master key in a hardware password card, and generate a reading interface of the client master key using the hardware password card, wherein the client master key is used to store location information of the client master key in the hardware password card;

[0025] A column encryption key creation module, used to create a column encryption key for a specified encrypted column, store the column encryption key in a hardware password card, and generate a reading interface for the column encryption key using the hardware password card, wherein the column encryption key is used to store location information of the column encryption key in the hardware password card;

[0026] The fully encrypted encryption module is used to read the column encryption key from the hardware password card through the column encryption key reading interface, use the column encryption key to create a table based on the specified encryption column, and use the client master key stored in the hardware password card to encrypt the inserted data in the table based on the specified encryption column.

[0027] According to a third aspect of the present invention, there is provided an electronic device, comprising:

[0028] one or more processors;

[0029] a storage device for storing one or more programs,

[0030] When one or more programs are executed by one or more processors, the one or more processors execute the above-mentioned database full-secret encryption method based on the hardware password card.

[0031] According to a third aspect of the present invention, there is provided a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned database full-secret encryption method based on a hardware password card.

[0032] The above-mentioned database full-secret encryption method based on hardware password card provided by the present invention is based on database full-secret equivalent query technology, uses hardware password card to quickly encrypt and decrypt important data, and the key used is stored in the card, which ensures the security of the key and realizes efficient and safe database data encryption; at the same time, the above-mentioned database full-secret encryption method based on hardware password card provided by the present invention utilizes the encryption and decryption and key management mechanism of hardware password card, and realizes the fast encryption and decryption of full-secret database and the safe management of key through high-strength national secret algorithm. In addition, the above-mentioned database full-secret encryption method based on hardware password card provided by the present invention can be applied to database clusters deployed in a single machine or distributed manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a flow chart of a database full-secret encryption method based on a hardware password card according to an embodiment of the present invention;

[0034] Figure 2 It is a schematic diagram of the structure of a database full-secret encryption device based on a hardware password card according to an embodiment of the present invention;

[0035] Figure 3 A block diagram of an electronic device suitable for implementing a database full-secret encryption method based on a hardware password card according to an embodiment of the present invention is schematically shown. DETAILED DESCRIPTION

[0036] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0037] The fully encrypted database aims to solve the privacy protection problem of data throughout its life cycle, so that no matter what business scenario and environment the system is in, data is always in a ciphertext state in all links of transmission, calculation and storage. When the data owner completes the data encryption on the client and sends it to the server, the attacker cannot obtain effective valuable information when stealing user data by taking advantage of system vulnerabilities, thereby protecting data privacy.

[0038] The encrypted equivalent query means that in the GBase database, the important data is protected by client encryption technology, and the server can still perform equivalent query operations. In this query, the client provides a ciphertext value, and the server compares it with the data stored in the ciphertext form to find the corresponding record. In this way, database administrators and other unauthorized users cannot view the content of important data, so that the data is in a ciphertext state throughout its life cycle, ensuring the security of the data.

[0039] Although fully secret database encryption schemes have been developed in the prior art, various fully secret database encryption schemes in the prior art have problems such as low operating efficiency, poor security, and high deployment and operation and maintenance costs.

[0040] In order to solve the problems existing in the existing technical solutions, the present invention provides a database full-secret encryption method based on a hardware password card, and realizes efficient and secure database data encryption through a full-secret encryption technical solution based on a hardware password card.

[0041] The following is a further detailed description of the database full-secret encryption method and device based on a hardware password card provided by the present invention through specific embodiments and in conjunction with the accompanying drawings.

[0042] Figure 1The present invention is a flowchart of a database full-secret encryption method based on a hardware password card according to an embodiment of the present invention.

[0043] like Figure 1 As shown, the above-mentioned database full-secret encryption method based on hardware password card includes operations S110 to S130.

[0044] In operation S110, a client master key for encrypting a column encryption key is created, the client master key is stored in a hardware password card, and a reading interface of the client master key is generated using the hardware password card, wherein the client master key is used to store location information of the client master key in the hardware password card.

[0045] In operation S120, a column encryption key for specifying an encrypted column is created, the column encryption key is stored in a hardware password card, and a read interface for the column encryption key is generated using the hardware password card, wherein the column encryption key is used to store location information of the column encryption key in the hardware password card.

[0046] In operation S130, a column encryption key is read from the hardware password card through a column encryption key reading interface, a table based on a specified encryption column is created using the column encryption key, and inserted data in the table based on the specified encryption column is encrypted using a client master key stored in the hardware password card.

[0047] The above-mentioned database full-secret encryption method based on hardware password card provided by the present invention is based on database full-secret equivalent query technology, uses hardware password card to quickly encrypt and decrypt important data, and the key used is stored in the card, which ensures the security of the key and realizes efficient and safe database data encryption; at the same time, the above-mentioned database full-secret encryption method based on hardware password card provided by the present invention utilizes the encryption and decryption and key management mechanism of hardware password card, and realizes the fast encryption and decryption of full-secret database and the safe management of key through high-strength national secret algorithm. In addition, the above-mentioned database full-secret encryption method based on hardware password card provided by the present invention can be applied to database clusters deployed in a single machine or distributed manner.

[0048] According to an embodiment of the present invention, the above-mentioned creation of a client master key for encrypting a column encryption key, storing the client master key in a hardware password card, and using the hardware password card to generate a reading interface for the client master key includes: based on the uniqueness constraint of the object name in the same namespace, using a string that complies with the identifier naming specification as the object name of the client master key, and specifying the management tool and encryption algorithm type of the client master key; creating the client master key based on the object name, path information, management tool, and encryption algorithm type of the client master key;

[0049] The client master key is stored in the hardware password card, and the hardware password card is used to generate a reading interface for the client master key.

[0050] According to an embodiment of the present invention, types of encryption algorithms for the above-mentioned client master key include RSA_2048, RSA3072 and SM2.

[0051] The process of creating the client master key provided by the present invention is further described in detail below through specific embodiments.

[0052] Use the database (for example, GBASE database) structured query language: CREATE CLIENT MASTER KEY to create a client master key object, which can be used to encrypt the Column Encryption Key object.

[0053] The CMK object created by the structured query language only stores the method for reading the key from the hardware password card, but does not store the key itself.

[0054] The interface for generating CMK keys from hardware password cards is FM_CPC_GenECCKeypair. The generated keys can be permanently stored in the card, and the CMK object only saves the key location. Ensure that the key does not leave the card to ensure security.

[0055] The complete SQL syntax format for creating the client master key is as follows:

[0056] CREATE CLIENT MASTER KEY client_master_key_name WITH (KEY_STORE =key_store_name, KEY_PATH = "key_path_value", ALGORITHM = algorithm_type).

[0057] Among them, client_master_key_name: This parameter is used as the key object name. In the same namespace, it must meet the naming uniqueness constraint. Value range: string, which must comply with the naming specification of the identifier.

[0058] KEY_STORE: Specifies the key tool or component that manages the CMK. Value: Currently only localkms is supported.

[0059] KEY_PATH: KEY_STORE is responsible for managing multiple CMK keys. The KEY_PATH option is used to uniquely identify the CMK in the KEY_STORE. The value is similar to: "key_path_value".

[0060] ALGORITHM: This parameter is used to specify the type of encryption algorithm for the encrypted COLUMN ENCRYPTION KEY created by this syntax. The value range is: RSA_2048, RSA3072, and SM2.

[0061] According to an embodiment of the present invention, the above-mentioned creation of a column encryption key for specifying an encrypted column, storing the column encryption key in a hardware password card, and using the hardware password card to generate a reading interface for the column encryption key includes: based on the uniqueness constraint of the object name in the same namespace, using a string that conforms to the identifier naming specification as the object name of the column encryption key; specifying the client master key used to encrypt the column encryption key, the encryption algorithm of the column encryption key, and the key password of the column encryption key; creating the column encryption key based on the object name of the column encryption key, the encryption algorithm, the key password, and the client master key used to encrypt the column encryption key.

[0062] According to an embodiment of the present invention, the encryption algorithms of the above-mentioned column encryption key include AEAD_AES_256_CBC_HMAC_SHA256, AEAD_AES_128_CBC_HMAC_SHA256 and SM4_SM3.

[0063] According to an embodiment of the present invention, the key password of the column encryption key is an optional item; wherein the length of the key password of the column encryption key is within a preset range, and the length of the key password of the column encryption key can be adjusted within the preset range according to user needs.

[0064] The process of creating the column encryption key is further described in detail below through a specific embodiment.

[0065] By Structured Query Language (SQL): CREATE COLUMNENCRYPTION KEY, create a column encryption key that can be used to encrypt the specified column in the table.

[0066] The above SQL syntax creates a CEK object that can be used for column-level encryption. When defining a column field in a table, you can specify a CEK object to encrypt the column.

[0067] The interface for hardware password card to generate CEK key is FM_CPC_GenKey. The generated key can be permanently stored in the card to ensure that the key does not leave the card and ensure security. At the same time, the CEK object only saves the key ciphertext, which can be decrypted by CMK to obtain CEK plaintext, and then CEK is used to encrypt and decrypt user data.

[0068] The completed SQL syntax format is as follows:

[0069] CREATE COLUMN ENCRYPTION KEY column_encryption_key_name WITH(CLIENT_MASTER_KEY = client_master_key_name, ALGORITHM = algorithm_type, ENCRYPTED_VALUE = encrypted_value);

[0070] Among them, column_encryption_key_name: This parameter is used as the key object name. In the same namespace, it must meet the naming uniqueness constraint; value range: string, must comply with the naming conventions of identifiers.

[0071] CLIENT_MASTER_KEY: specifies the CMK used to encrypt this CEK. The value is: CMK object name. The CMK object is created using the CREATE CLIENT MASTER KEY syntax.

[0072] ALGORITHM: Specifies the encryption algorithm that the CEK will be used for. The value range is: AEAD_AES_256_CBC_HMAC_SHA256, AEAD_AES_128_CBC_HMAC_SHA256, and SM4_SM3;

[0073] ENCRYPTED_VALUE (optional): This value is the key password specified by the user. The key password length ranges from 28 to 256 bits. The security strength of the key derived from 28 bits meets the requirements of AES128. If the user needs to use AES256, the key password length needs to be 39 bits. If not specified, a 256-bit key will be automatically generated.

[0074] According to an embodiment of the present invention, the above-mentioned use of the client master key stored in the hardware password card to encrypt the inserted data in the table based on the specified encryption column includes: using the client master key to decrypt the column encryption key stored in the hardware password card to obtain the plaintext of the column encryption key; using the plaintext of the column encryption key to encrypt the inserted data in the table based on the specified encryption column through the hardware password card.

[0075] The process of creating a table with designated encryption columns and encrypting data inserted into the table is further described in detail below through a specific embodiment.

[0076] Use SQL language to create a table for specifying encrypted columns. The syntax format is as follows:

[0077] CREATE TABLE table_name ( column_name data_type ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = column_encryption_key, ENCRYPTION_TYPE = encryption_type_value ) );

[0078] Among them, column_encryption_key is the name of the column encryption key CEK; the value of encryption_type_value is [DETERMINISTIC | RANDOMIZED], which represents deterministic or non-deterministic encryption, and the value is generally DETERMINISTIC.

[0079] At this time, when inserting data into the newly created table with encrypted columns, the asymmetric key generated in operation S110 is first used to decrypt the symmetric key CEK ciphertext stored in operation S120 to obtain the CEK plaintext. Then, the obtained CEK plaintext is used to encrypt the data in the user column through the password card hardware device.

[0080] After the client completes the encryption of the encrypted column, the column data obtained by the server is ciphertext, so that this column data is in ciphertext state throughout its life cycle, ensuring the security of sensitive data.

[0081] It can be seen that the above method provided by the present invention uses a hardware password card to complete the function of a fully encrypted database, which greatly improves performance and security.

[0082] Figure 2 It is a structural schematic diagram of a database full-secret encryption device based on a hardware password card according to an embodiment of the present invention.

[0083] like Figure 2 As shown, the above-mentioned database full-secret encryption device based on the hardware password card includes a client master key creation module 210, a column encryption key creation module 220 and a full-secret encryption module 230.

[0084] The client master key creation module 210 is used to create a client master key for encrypting a column encryption key, store the client master key in a hardware password card, and generate a reading interface of the client master key using the hardware password card, wherein the client master key is used to store the location information of the client master key in the hardware password card.

[0085] The column encryption key creation module 220 is used to create a column encryption key for a specified encrypted column, store the column encryption key in a hardware password card, and generate a reading interface for the column encryption key using the hardware password card, wherein the column encryption key is used to store the position information of the column encryption key in the hardware password card.

[0086] The fully secret encryption module 230 is used to read the column encryption key from the hardware password card through the column encryption key reading interface, use the column encryption key to create a table based on the specified encryption column, and use the client master key stored in the hardware password card to encrypt the inserted data in the table based on the specified encryption column.

[0087] The above-mentioned database full-secret encryption device based on hardware password card improves data security and effectively protects user data privacy while ensuring database operation efficiency.

[0088] Figure 3 A block diagram of an electronic device suitable for implementing a database full-secret encryption method based on a hardware password card according to an embodiment of the present invention is schematically shown.

[0089] like Figure 3 As shown, the electronic device 300 according to an embodiment of the present invention includes a processor 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 308 to the random access memory (RAM) 303. The processor 301 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 301 may also include an onboard memory for caching purposes. The processor 301 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0090] In RAM 303, various programs and data required for the operation of electronic device 300 are stored. Processor 301, ROM 302 and RAM 303 are connected to each other via bus 304. Processor 301 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 302 and / or RAM 303. It should be noted that the program can also be stored in one or more memories other than ROM 302 and RAM 303. Processor 301 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in one or more memories.

[0091] According to an embodiment of the present invention, the electronic device 300 may further include an input / output (I / O) interface 305, which is also connected to the bus 304. The electronic device 300 may further include one or more of the following components connected to the I / O interface 305: an input portion 306 including a keyboard, a mouse, etc.; an output portion 307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 308 including a hard disk, etc.; and a communication portion 309 including a network interface card such as a LAN card, a modem, etc. The communication portion 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed, so that a computer program read therefrom is installed into the storage portion 308 as needed.

[0092] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0093] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 302 and / or RAM 303 described above and / or one or more memories other than ROM 302 and RAM 303.

[0094] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0095] The above specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A database full-secret encryption method based on hardware password card, It is characterized in that include: Creating a client master key for encrypting a column encryption key, storing the client master key in the hardware password card, and using the hardware password card to generate a reading interface for the client master key, wherein the client master key is used to store location information of the client master key in the hardware password card; Creating a column encryption key for a designated encrypted column, storing the column encryption key in the hardware password card, and using the hardware password card to generate a reading interface for the column encryption key, wherein the column encryption key is used to store location information of the column encryption key in the hardware password card; The column encryption key is read from the hardware password card through the reading interface of the column encryption key, a table based on the specified encryption column is created using the column encryption key, and the inserted data in the table based on the specified encryption column is encrypted using the client master key stored in the hardware password card.

2. The method according to claim 1, It is characterized in that Creating a client master key for encrypting a column encryption key, storing the client master key in the hardware password card, and using the hardware password card to generate a reading interface for the client master key includes: Based on the uniqueness constraint of object names in the same namespace, a character string that complies with the identifier naming specification is used as the object name of the client master key, and a management tool and encryption algorithm type of the client master key are specified; Creating the client master key based on the object name, path information, management tool, and encryption algorithm type of the client master key; The client master key is stored in the hardware password card, and a reading interface of the client master key is generated by using the hardware password card.

3. The method according to claim 2, It is characterized in that The encryption algorithm types of the client master key include RSA_2048, RSA3072 and SM2.

4. The method according to claim 1, It is characterized in that Creating a column encryption key for a designated encrypted column, storing the column encryption key in the hardware password card, and using the hardware password card to generate a reading interface for the column encryption key includes: Based on the uniqueness constraint of the object name in the same namespace, a character string that complies with the identifier naming specification is used as the object name of the column encryption key; specifying a client master key used to encrypt the column encryption key, an encryption algorithm for the column encryption key, and a key password for the column encryption key; A column encryption key is created based on the object name of the column encryption key, the encryption algorithm, the key password, and the client master key used to encrypt the column encryption key.

5. The method according to claim 4, It is characterized in that The encryption algorithms of the column encryption key include AEAD_AES_256_CBC_HMAC_SHA256, AEAD_AES_128_CBC_HMAC_SHA256 and SM4_SM3.

6. The method according to claim 4, It is characterized in that The key password of the column encryption key is optional; The length of the key password of the column encryption key is within a preset range, and the length of the key password of the column encryption key can be adjusted within the preset range according to user requirements.

7. The method according to claim 1, It is characterized in that Encrypting the inserted data in the table based on the designated encryption column by using the client master key stored in the hardware password card comprises: Decrypting the column encryption key stored in the hardware password card using the client master key to obtain the plain text of the column encryption key; The inserted data in the table based on the designated encryption column is encrypted by the hardware password card using the plain text of the column encryption key.

8. A database full-secret encryption device based on a hardware password card, It is characterized in that include: A client master key creation module, used to create a client master key for encrypting a column encryption key, store the client master key in the hardware password card, and generate a reading interface of the client master key using the hardware password card, wherein the client master key is used to store location information of the client master key in the hardware password card; a column encryption key creation module, used to create a column encryption key for a specified encrypted column, store the column encryption key in the hardware password card, and generate a reading interface for the column encryption key using the hardware password card, wherein the column encryption key is used to store location information of the column encryption key in the hardware password card; The fully secret encryption module is used to read the column encryption key from the hardware password card through the reading interface of the column encryption key, use the column encryption key to create a table based on the specified encryption column, and use the client master key stored in the hardware password card to encrypt the inserted data in the table based on the specified encryption column.

9. An electronic device, include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 7.

Images