Data encryption method and device, electronic equipment and storage medium

Abstract

The invention provides a data encryption method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: receiving an SQL access request sent by an application end; determining a corresponding first analysis result according to the SQL access request; the first analysis result is sent to an encryption and decryption function module, and the encryption and decryption function module is used for encrypting a to-be-encrypted target field contained in the first analysis result to obtain a second analysis result; performing SQL rewriting and execution according to the second analysis result to obtain a first data execution result; and returning the first data execution result to the application end. According to the embodiment of the invention, the encryption process can be implanted into the main path for SQL analysis, rewriting and execution, the technical threshold is reduced, the encryption algorithm is flexibly adjusted through the encryption and decryption function module, and the flexibility of data encryption is improved.

Description

Background Art

[0002] With the rapid development of distributed databases, data security has become increasingly important. Among them, data encryption technology is a common security method and functional feature used in distributed databases.

[0003] In related technologies, a JDBC (Java Database Connectivity Driver) driver can be introduced on the application side and a data encryption and decryption algorithm can be embedded in the JDBC driver to achieve encryption of data transmission and access. Alternatively, data encryption can be achieved at the underlying storage layer of a distributed database using the data encryption function that comes with the distributed storage.

[0004] However, the JDBC driver has great restrictions on the development language, and it is difficult to adjust the encryption algorithm in real time during use, and the flexibility of data encryption is poor. The other method relies on the underlying distributed storage, which has a high technical threshold and makes it impossible to flexibly select and adjust the encryption algorithm.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The present disclosure provides a data encryption method, device, electronic device and storage medium, which at least to a certain extent overcome the problems that related technologies have great restrictions on development languages, high technical barriers, inability to flexibly select and adjust encryption algorithms, and poor flexibility in data encryption.

[0007] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0008] According to one aspect of the present disclosure, a data encryption method is provided, including: receiving a SQL (Structured Query Language) access request sent by an application end; determining a corresponding first parsing result according to the SQL access request; sending the first parsing result to an encryption and decryption function module, wherein the encryption and decryption function module is used to encrypt a target field to be encrypted contained in the first parsing result to obtain a second parsing result; rewriting and executing SQL according to the second parsing result to obtain a first data execution result; and returning the first data execution result to the application end.

[0009] In some embodiments, rewriting and executing SQL according to the second parsing result to obtain the first data execution result includes: rewriting SQL according to the second parsing result to obtain a rewritten SQL statement; executing the rewritten SQL statement to obtain the first data execution result;

[0010] The method provided by the embodiment of the present disclosure further includes: sending the rewritten SQL statement to each distributed storage node, wherein any distributed storage node is used to execute the rewritten SQL statement to obtain a corresponding second data execution result;

[0011] Returning the first data execution result to the application end includes: returning a target data execution result to the application end, wherein the target data execution result includes the first data execution result and each second data execution result.

[0012] In some embodiments, sending a first parsing result to the encryption and decryption function module includes: calling a functional pluggable interface; determining whether the functional pluggable interface references the encryption and decryption function module; if the encryption and decryption function module is referenced, sending the first parsing result to the encryption and decryption function module by calling the functional pluggable interface.

[0013] In some embodiments, returning the target data execution result to the application end includes: determining whether the target data execution result contains an encrypted field; if the target data execution result contains an encrypted field, sending the target data execution result to an encryption and decryption function module, wherein the encryption and decryption function module is used to decrypt the encrypted field contained in the target data execution result to obtain the decrypted target data execution result; and returning the decrypted target data execution result to the application end.

[0014] In some embodiments, determining a corresponding first parsing result based on a SQL access request includes: verifying the connection legitimacy and / or connection authority of the application end; if the verification passes, performing lexical parsing and / or grammatical parsing on the SQL access request to obtain a first parsing result.

[0015] In some embodiments, the method provided by the embodiments of the present disclosure also includes: obtaining pre-configured rule configuration information, the rule configuration information is used to describe the encryption rules for encrypting the target field; when rewriting SQL according to the second parsing result, adding the rule configuration information to the rewritten SQL statement; wherein the encryption and decryption function module is also used to determine the target field and / or the encryption algorithm used to encrypt the target field according to the rule configuration information.

[0016] In some embodiments, the method provided by the embodiments of the present disclosure also includes: when the rule configuration information is updated, obtaining the updated rule configuration information sent by the console, wherein the console is used to monitor the rule base storing the rule configuration information; and updating the pre-configured rule configuration information accordingly according to the updated rule configuration information.

[0017] In some embodiments, when the target data execution result includes an encrypted field, the encryption and decryption function module is further used to determine a decryption algorithm for decrypting the encrypted field according to the rule configuration information.

[0018] According to another aspect of the present disclosure, there is also provided a data encryption device, comprising:

[0019] A request receiving module is used to receive SQL access requests sent by the application end;

[0020] A first parsing result determination module, used to determine a corresponding first parsing result according to the SQL access request;

[0021] The interface calling module is used to send the first parsing result to the encryption and decryption function module, wherein the encryption and decryption function module is used to encrypt the target field to be encrypted contained in the first parsing result to obtain a second parsing result;

[0022] A first data execution result determination module, used to rewrite and execute SQL according to the second parsing result to obtain a first data execution result;

[0023] The first data execution result returning module is used to return the first data execution result to the application end.

[0024] In some embodiments, the first data execution result determination module is used to rewrite the SQL statement according to the second parsing result to obtain a rewritten SQL statement; execute the rewritten SQL statement to obtain the first data execution result;

[0025] The data encryption device provided by the embodiment of the present disclosure also includes:

[0026] An SQL statement sending module, used for sending the rewritten SQL statement to each distributed storage node, wherein any distributed storage node is used for executing the rewritten SQL statement to obtain a corresponding second data execution result;

[0027] The first data execution result returning module is used to return the target data execution result to the application end, and the target data execution result includes the first data execution result and each second data execution result.

[0028] In some embodiments, the interface calling module is used to call the pluggable function interface; determine whether the pluggable function interface references the encryption and decryption function module; if the encryption and decryption function module is referenced, send the first parsing result to the encryption and decryption function module by calling the pluggable function interface.

[0029] In some embodiments, the first data execution result returning module is used to determine whether the target data execution result contains an encrypted field; if the target data execution result contains an encrypted field, the target data execution result is sent to the encryption and decryption function module, wherein the encryption and decryption function module is used to decrypt the encrypted field contained in the target data execution result to obtain the decrypted target data execution result; and the decrypted target data execution result is returned to the application end.

[0030] In some embodiments, the first parsing result determination module is used to verify the connection legitimacy and / or connection authority of the application end; if the verification is successful, the SQL access request is subjected to lexical parsing and / or grammatical parsing to obtain a first parsing result.

[0031] In some embodiments, the data encryption device provided by the embodiments of the present disclosure further includes:

[0032] A rule configuration information acquisition module is used to obtain pre-configured rule configuration information, where the rule configuration information is used to describe the encryption rules for encrypting the target field; when rewriting SQL according to the second parsing result, the rule configuration information is added to the rewritten SQL statement; wherein the encryption and decryption function module is also used to determine the target field and / or the encryption algorithm used to encrypt the target field according to the rule configuration information.

[0033] In some embodiments, the rule configuration information acquisition module is also used to obtain updated rule configuration information sent by the console when the rule configuration information is updated, wherein the console is used to monitor the rule base storing the rule configuration information; and update the pre-configured rule configuration information accordingly according to the updated rule configuration information.

[0034] In some embodiments, when the target data execution result includes an encrypted field, the encryption and decryption function module is further used to determine a decryption algorithm for decrypting the encrypted field according to the rule configuration information.

[0035] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned data encryption methods by executing the executable instructions.

[0036] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the above-mentioned data encryption methods is implemented.

[0037] According to another aspect of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the data encryption method provided in various optional ways in any embodiment of the present disclosure.

[0038] The technical solution provided in the embodiment of the present disclosure sends the first parsing result to the encryption and decryption function module after obtaining the first parsing result, encrypts the target field to be encrypted contained in the first parsing result through the encryption and decryption function module, and then performs SQL rewriting and execution on the encrypted second parsing result. The embodiment of the present disclosure can realize the implantation of the encryption process into the main path of SQL parsing, rewriting, and execution, lowering the technical threshold, and realizing the flexible adjustment of the encryption algorithm through the encryption and decryption function module, thereby improving the flexibility of data encryption.

[0039] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0041] Figure 1 A schematic diagram showing a system architecture in an embodiment of the present disclosure;

[0042] Figure 2 A flow chart of a data encryption method in an embodiment of the present disclosure is shown;

[0043] Figure 3 A schematic diagram of a computing engine core architecture according to an embodiment of the present disclosure is shown;

[0044] Figure 4 A schematic diagram showing a process of a data encryption method in an embodiment of the present disclosure is shown;

[0045] Figure 5 A schematic diagram showing a process of updating rule configuration information in an embodiment of the present disclosure is shown;

[0046] Figure 6 A schematic diagram of a data encryption device in an embodiment of the present disclosure is shown;

[0047] Figure 7 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0048] Figure 8 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0049] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0050] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0051] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0052] Figure 1 FIG. 1 shows an exemplary application system architecture diagram to which the data encryption method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture 100 may include an application terminal 101 , a network 102 and a server 103 .

[0053] Among them, the server 103 receives the SQL access request sent by the application end 101. Then, the server 103 can determine the corresponding first parsing result according to the SQL access request. Then, the server 103 can send the first parsing result to the encryption and decryption function module, wherein the encryption and decryption function module is used to encrypt the target field to be encrypted contained in the first parsing result to obtain the second parsing result. Finally, the server 103 can rewrite and execute SQL according to the second parsing result to obtain the first data execution result. And the server 103 can return the first data execution result to the application end 101.

[0054] The network 102 is a medium for providing a communication link between the application terminal 101 and the server 103, and can be a wired network or a wireless network.

[0055] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0056] The application end 101 may be a terminal device, which may be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0057] Optionally, the client of the application installed in different application terminals 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0058] The server 103 may be a server that provides various services, such as a background management server that provides support for the device operated by the user using the terminal device 101. The background management server may analyze and process the received request and other data, and feed back the processing results to the terminal device.

[0059] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0060] Those skilled in the art will know that Figure 1 The number of application terminals 101, networks 102 and servers 103 is only illustrative, and any number of application terminals 101, networks 102 and servers 103 may be provided according to actual needs. The embodiments of the present disclosure are not limited to this.

[0061] Under the above system architecture, a data encryption method is provided in an embodiment of the present disclosure, and the method can be executed by any electronic device with computing and processing capabilities.

[0062] Figure 2 A flow chart of a data encryption method in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the data encryption method provided in the embodiment of the present disclosure includes the following steps S202 to S208.

[0063] S202, receiving a SQL access request sent by an application.

[0064] In some exemplary embodiments, the embodiments of the present disclosure may be executed by a database kernel deployed in a server. The application may initiate an SQL access request to an access protocol layer of a database through a database connection driver.

[0065] Exemplarily, the SQL access request may be used to write, modify, delete, and read data in a database.

[0066] S204: Determine a corresponding first parsing result according to the SQL access request.

[0067] In some exemplary embodiments, determining a corresponding first parsing result based on a SQL access request includes: verifying the connection legitimacy and / or connection authority of the application end; if the verification passes, performing lexical parsing and / or grammatical parsing on the SQL access request to obtain a first parsing result.

[0068] Exemplarily, the connection legitimacy and / or connection authority can be verified through the database access protocol layer. Among them, the connection legitimacy and / or connection authority of the application end can be verified by user name verification, password verification, connection authorization, etc., which is not limited in the embodiments of the present disclosure.

[0069] In an exemplary embodiment, after receiving the SQL access request, the structure and semantics of the SQL access request can be determined by parsing the SQL access request. In addition, the SQL access request can also be parsed to convert its format for subsequent encryption, rewriting, execution and other operations.

[0070] In an exemplary embodiment, the SQL access request may be parsed by calling a SQL parser. When the SQL access request is lexically parsed, the SQL access request may be decomposed into a series of meaningful symbols, such as regular expressions, lexical analyzer generators, etc. The symbols may include keywords, identifiers, constants, operators, etc. Syntax parsing may be used to verify the syntax correctness of the SQL access, and an AST (Abstract Syntax Tree) representing the query structure may be constructed.

[0071] The embodiment of the present disclosure does not limit the implementation method of syntax parsing. For example, the SQL access request can be parsed by a recursive descent parser, a top-down parser, a bottom-up parser, etc.

[0072] S206: Send the first parsing result to the encryption and decryption function module, where the encryption and decryption function module is used to encrypt the target field to be encrypted contained in the first parsing result to obtain a second parsing result.

[0073] In some exemplary embodiments, sending a first parsing result to the encryption and decryption functional module includes: calling a functional pluggable interface; determining whether the functional pluggable interface references the encryption and decryption functional module; if the encryption and decryption functional module is referenced, sending the first parsing result to the encryption and decryption functional module by calling the functional pluggable interface.

[0074] Exemplarily, if the pluggable function interface does not reference any extended function module, SQL rewriting and execution can be performed based on the first parsing result to obtain the corresponding data execution result. If the pluggable function interface references the encryption and decryption function module, the first parsing result obtained based on the SQL parser can be sent to the encryption and decryption function module.

[0075] In some exemplary embodiments, the encryption and decryption function module may also read rule configuration information, and determine the target field and / or the encryption algorithm used to encrypt the target field according to the rule configuration information. The rule configuration information is used to describe the encryption rule for encrypting the target field. The rule configuration information may be stored in the memory of the database kernel.

[0076] Exemplarily, the encryption and decryption function module may determine whether the first parsing result includes the target field based on the rule configuration information.

[0077] In a possible implementation, the rule configuration information may include various preset fields that need to be encrypted. After the encryption / decryption function module obtains the first parsing result, it may determine whether each field included in the first parsing result is hit by the preset field. If any field included in the first parsing result is judged to be hit by the preset field, then the field is the target field.

[0078] In addition, if the first analysis result does not contain the target field, there is no need to encrypt it. The encryption and decryption function module can directly return the first analysis result, and then SQL can be rewritten and executed according to the first analysis result to obtain the corresponding data execution result.

[0079] Exemplarily, the encryption and decryption function module can determine the encryption algorithm for encrypting the target field based on the rule configuration information. In a possible implementation, the encryption and decryption function module can retrieve the corresponding target field, encryption algorithm and key information based on the rule configuration information, thereby encrypting the target field.

[0080] S208, rewriting and executing SQL according to the second parsing result to obtain a first data execution result.

[0081] In some exemplary embodiments, rewriting and executing SQL according to the second parsing result to obtain the first data execution result includes: rewriting SQL according to the second parsing result to obtain a rewritten SQL statement; executing the rewritten SQL statement to obtain the first data execution result.

[0082] Exemplarily, the SQL rewriting may be performed by a SQL rewriter. In a possible implementation, the SQL rewriter may perform distributed SQL rewriting based on a distributed horizontal splitting rule and a SQL optimization rule.

[0083] In an exemplary embodiment, a distributed database usually distributes data according to a horizontal split rule of certain columns, i.e., sharding keys. The SQL rewriter needs to identify the sharding keys involved in the SQL statement in the second parsing result to determine the distribution of the data. For example, the SQL rewriter can determine the distribution of data on different nodes according to the sharding strategy of the table, such as hash sharding, range sharding, etc.

[0084] Exemplarily, SQL rewriting methods may include pushing query conditions to each shard node to reduce data transmission, rewriting JOIN operations to adapt to data access patterns in a distributed environment, and rewriting aggregate functions and sorting operations to achieve parallel processing on each shard.

[0085] In an exemplary embodiment, the rewritten SQL statement needs to be converted into one or more distributed execution plans, and any distributed execution plan is used to describe the method of executing queries on different database shards and merging query results.

[0086] In addition, the obtained distributed execution plan can be optimized using SQL optimization rules to improve query performance. For example, the SQL optimization rules include selecting the most appropriate index, adjusting the query order, merging operations, etc. Then, the optimized distributed execution plan can be converted into code that can be executed on each shard.

[0087] Exemplarily, after the SQL rewriter rewrites the SQL to obtain a rewritten SQL statement, the rewritten SQL statement can be executed by calling the SQL executor to obtain a first data execution result.

[0088] In some embodiments, the data encryption method provided by the embodiments of the present disclosure may further include: sending a rewritten SQL statement to each distributed storage node, wherein any distributed storage node is used to execute the rewritten SQL statement to obtain a corresponding second data execution result.

[0089] Exemplarily, after the SQL executor executes the rewritten SQL statement, the SQL statement can be distributed to each distributed storage node of the underlying database for SQL execution. Each distributed storage node can execute the rewritten SQL statement accordingly and obtain the second data execution result accordingly. In addition, each distributed storage node can also send the second data execution result to the data aggregator to achieve data aggregation.

[0090] In some exemplary embodiments, the data encryption method provided by the embodiments of the present disclosure may also include: obtaining pre-configured rule configuration information, the rule configuration information is used to describe the encryption rules for encrypting the target field; when rewriting SQL according to the second parsing result, adding the rule configuration information to the rewritten SQL statement.

[0091] Therefore, the embodiments of the present disclosure can enable the encryption and decryption function module to determine the target field and / or the encryption algorithm used to encrypt the target field according to the rule configuration information.

[0092] It should be noted that, according to different business scenarios and different security level requirements, it may be necessary to flexibly select encryption algorithms and dynamically adjust the encryption algorithms. Therefore, the embodiments of the present disclosure can assist in selecting encryption algorithms during the data encryption process by encrypting hidden fields.

[0093] In an exemplary embodiment, the encryption and decryption function module can perform encryption based on rule configuration information. The rule configuration information can be loaded into the kernel memory when the database server is started, and the rule configuration information can be written into a hidden column for storage when SQL is rewritten, and the decryption algorithm can be determined according to the rule configuration information when the SQL is read later.

[0094] In a possible implementation, a rule configuration information including an encrypted hidden field may be expressed as:

[0095] {"data":[

[0096] {"id":522, / / Identification

[0097] "clusterId":25493, / / The ID of the cluster

[0098] "tableName":"lingxiao_encrpt_test", / / The associated table name

[0099] "originalColumn":"YHUUID", / / Original column name

[0100] "characterSet":"utf8", / / character set

[0101] "encryptColumn":"sec_col", / / encrypted column name

[0102] "memo": "encrypted", / / Note that this information is used for encryption

[0103] "modifyBy":"wylingxiao", / / Modify the user name of the record

[0104] "modificationDate":1721820394000, / / modification timestamp

[0105] "encryptAlg":"Symmetric", / / Type of encryption algorithm

[0106] "tableKey":"id"}]} / / The name of the primary key or unique identifier field in the table

[0107] The rule configuration information describes that in a table named "lingxiao_encrpt_test", the data in a column named "YHUUID" is encrypted, and the encrypted data is stored in a column named "sec_col". In addition, the encryption algorithm used for encryption is symmetric encryption.

[0108] In some exemplary embodiments, the data encryption method provided by the embodiments of the present disclosure may also include: when the rule configuration information is updated, obtaining the updated rule configuration information sent by the console, wherein the console is used to monitor the rule base storing the rule configuration information; and updating the pre-configured rule configuration information accordingly according to the updated rule configuration information.

[0109] In an exemplary embodiment, when it is necessary to dynamically modify the encryption algorithm or dynamically add or cancel the preset fields that need to be encrypted, the database kernel can reload the rule configuration information to add the latest encryption algorithm and / or the preset fields that need to be encrypted to the kernel of the computing engine, and the next SQL request can use the updated rule configuration information. The computing engine is included in the database kernel. In the distributed database architecture, the computing engine kernel becomes a syntax converter and data gateway between the application end and the underlying storage layer of the distributed database, which can enable the SQL access request of the application end to interact with the shards based on distributed rules, SQL parsing algorithms, and encryption and decryption algorithms.

[0110] Exemplarily, the corresponding encryption algorithm may be recorded by adding a hidden field in the SQL statement.

[0111] CREATE TABLE `sso_user` ( / / Create a new table

[0112] `ID`int(11)auto_increment NOT NULL COMMENT'Primary key', / / The column corresponding to the primary key, the column name is ID

[0113] `YHUUID` char(32) NOT NULL COMMENT 'Sensitive field', / / The column corresponding to the sensitive field, the column name is YHUUID

[0114] `sec_col` char(32) NOT NULL COMMENT 'Hidden field', / / The column corresponding to the hidden field, the column name is sec_col

[0115] PRIMARY KEY(`ID`) / / Define the primary key of the table,

[0116] )ENGINE = InnoDB; / / Specifies the storage engine used by the table

[0117] Among them, the sensitive field is used to record the preset fields that need to be encrypted. The hidden field is used to record the corresponding encryption algorithm. Therefore, the above SQL statement contains the preset fields that need to be encrypted and the corresponding encryption algorithm.

[0118] In an exemplary embodiment, the rule configuration information can be configured by a database administrator through an engine service (console) and can be adjusted in real time. The rule configuration information can be persistently stored in a rule base. When the engine service (console) senses that the rule configuration information has been updated, the updated rule configuration information can be pushed to the computing engine. The computing engine can update the rule configuration information in memory accordingly and take effect on SQL access requests in real time.

[0119] S210, returning the first data execution result to the application end.

[0120] In some exemplary embodiments, returning the first data execution result to the application end includes: returning a target data execution result to the application end, where the target data execution result includes the first data execution result and each second data execution result.

[0121] Exemplarily, each distributed storage node may also send the second data execution result to a data aggregator, which may perform encoding logic processing on the first data execution result and each second data execution result to achieve data aggregation. Then, the first data execution result may be returned to the application end through the data aggregator.

[0122] In some exemplary embodiments, returning the target data execution result to the application end includes: determining whether the target data execution result contains an encrypted field; if the target data execution result contains an encrypted field, sending the target data execution result to an encryption and decryption function module, wherein the encryption and decryption function module is used to decrypt the encrypted field contained in the target data execution result to obtain a decrypted target data execution result; and returning the decrypted target data execution result to the application end.

[0123] Exemplarily, the data aggregator can be used to determine whether the target data execution result contains an encrypted field that needs to be decrypted through the rule configuration information. If the target data execution result contains an encrypted field, the data aggregator can call the encryption and decryption function module, and the encryption and decryption function module can decrypt the encrypted field through the rule configuration information and return the decrypted field to the data aggregator. The data aggregator can merge the decrypted field with the data execution result to obtain the decrypted target data execution result.

[0124] In addition, if the target data execution result does not contain an encrypted field, the data aggregator can perform encoding logic processing on the target data execution result and return it to the application end.

[0125] In some exemplary embodiments, when the target data execution result includes an encrypted field, the encryption and decryption function module is further used to determine a decryption algorithm for decrypting the encrypted field according to the rule configuration information.

[0126] Exemplarily, the encryption and decryption function module may retrieve the encryption field, encryption algorithm and key information based on the rule configuration information, so as to perform decryption using the acquired encryption algorithm and key information.

[0127] The method provided by the embodiment of the present disclosure sends the first parsing result to the encryption and decryption function module after obtaining the first parsing result, encrypts the target field to be encrypted contained in the first parsing result through the encryption and decryption function module, and then performs SQL rewriting and execution on the encrypted second parsing result. The embodiment of the present disclosure can realize the implantation of the encryption process into the main path of SQL parsing, rewriting, and execution, lowering the technical threshold, and realizing the flexible adjustment of the encryption algorithm through the encryption and decryption function module, thereby improving the flexibility of data encryption.

[0128] In an exemplary embodiment, a distributed database computing engine kernel architecture diagram may be as follows: Figure 3 As shown. Figure 3 The computing engine features include multi-database dialect SQL compatibility, access protocol support, horizontal splitting, built-in & custom algorithms, distributed transactions, data encryption and decryption, elastic scaling / data migration, read-write separation, high availability, distributed management, and distributed service governance. APP (Application) can send SQL access requests through JDBC access and Proxy access.

[0129] The distributed computing engine kernel may include functional modules such as parsing module, permission module, service governance, metadata management, transaction module, query decision maker, routing module, aggregation module, data encryption and decryption, execution module, connection management, and elastic scheduling. In addition, the distributed computing engine kernel may also support JDBC, DistSQL (Distributed SQL, distributed database) and database protocols.

[0130] The distributed database may include at least one M (Master) database, and each M database may correspond to at least one S (Slave) database. The distributed computing engine kernel may be connected to each M database and each S database. In addition, the distributed computing engine kernel may also be connected to a distributed database management and control platform. The distributed database management and control platform is used to implement data management and control operations and distributed management.

[0131] In an exemplary embodiment, a process diagram of a data encryption method may be as follows: Figure 4 shown.

[0132] In this Figure 4In the example, the application can send the SQL access request to the access protocol layer of the database. Then, the SQL access request is parsed by calling the SQL parser. Then, the function pluggable interface can be called to determine whether to reference the encryption and decryption function module. If referenced, the first parsing result obtained based on the SQL parser can be sent to the encryption and decryption function module. If not referenced, the first parsing result can be sent to the SQL rewriter for SQL rewriting. It should be noted that the encryption and decryption function module can be included in Figure 4 Security Center in.

[0133] In addition, after the SQL rewriter rewrites the SQL statement to obtain the rewritten SQL statement, the SQL executor can be called to execute the rewritten SQL statement to obtain the first data execution result. In addition, the SQL executor can send the rewritten SQL statement to each distributed storage node, wherein any distributed storage node is used to execute the rewritten SQL statement to obtain the corresponding second data execution result. Each distributed storage node can be included in Figure 4 The data aggregator can aggregate the first data execution result and the second data execution result to obtain the target data execution result. Finally, the target data execution result can be returned to the application end.

[0134] In an exemplary embodiment, a schematic diagram of a process of updating rule configuration information can be as follows: Figure 5 shown.

[0135] In this Figure 5 In the example, the computing engine can store data in the database cluster according to the business application process. The computing engine includes rule configuration information. In addition, the rule configuration information can be configured accordingly through the engine service and can be adjusted in real time. The rule configuration information can be persistently stored in the rule library. When the engine service perceives that the rule configuration information is updated, the updated rule configuration information can be pushed to the computing engine based on memory loading. The computing engine can update the rule configuration information in the memory accordingly.

[0136] The disclosed embodiment realizes the construction of a pluggable and configurable encryption and decryption function module in a distributed database computing engine through a pluggable function interface. The encryption and decryption function module can flexibly introduce encryption algorithms in a distributed database and flexibly encrypt and decrypt target fields, solving the user's demand for flexible selection of encryption algorithms and dynamic adjustment of encryption strategies in different business scenarios.

[0137] The disclosed embodiment builds a pluggable interface in the database computing engine kernel, thereby introducing an encryption and decryption function module, and the encryption and decryption function module can be connected or exited by configuring rule configuration information. Therefore, the use requirements of database data encryption in different business scenarios can be met.

[0138] Secondly, the disclosed embodiment implements the implantation of encryption and decryption algorithms into the main path of SQL parsing, rewriting, and execution, and implements the core logic and process of database data encryption and decryption. In addition, the disclosed embodiment implements the setting and modification of the encryption algorithm of a single field by introducing hidden fields. Therefore, the present application can realize the kinetic energy of flexibly selecting encryption algorithms and dynamically adjusting encryption algorithms.

[0139] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0140] Based on the same inventive concept, the present disclosure also provides a data encryption device, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0141] Figure 6 A schematic diagram of a data encryption device in an embodiment of the present disclosure is shown. Figure 6 As shown, the device comprises:

[0142] The request receiving module 601 is used to receive the SQL access request sent by the application end;

[0143] A first parsing result determination module 602, configured to determine a corresponding first parsing result according to the SQL access request;

[0144] The interface calling module 603 is used to send the first parsing result to the encryption and decryption function module, wherein the encryption and decryption function module is used to encrypt the target field to be encrypted contained in the first parsing result to obtain a second parsing result;

[0145] A first data execution result determination module 604 is used to rewrite and execute SQL according to the second parsing result to obtain a first data execution result;

[0146] The first data execution result returning module 605 is used to return the first data execution result to the application end.

[0147] In some embodiments, the first data execution result determination module 604 is used to rewrite the SQL statement according to the second parsing result to obtain a rewritten SQL statement; execute the rewritten SQL statement to obtain the first data execution result;

[0148] The data encryption device provided by the embodiment of the present disclosure also includes:

[0149] An SQL statement sending module, used for sending the rewritten SQL statement to each distributed storage node, wherein any distributed storage node is used for executing the rewritten SQL statement to obtain a corresponding second data execution result;

[0150] The first data execution result returning module 605 is used to return the target data execution result to the application end, where the target data execution result includes the first data execution result and each second data execution result.

[0151] In some embodiments, the interface calling module 603 is used to call the pluggable function interface; determine whether the pluggable function interface references the encryption and decryption function module; if the encryption and decryption function module is referenced, send the first parsing result to the encryption and decryption function module by calling the pluggable function interface.

[0152] In some embodiments, the first data execution result return module 605 is used to determine whether the target data execution result contains an encrypted field; if the target data execution result contains an encrypted field, the target data execution result is sent to the encryption and decryption function module, wherein the encryption and decryption function module is used to decrypt the encrypted field contained in the target data execution result to obtain the decrypted target data execution result; and the decrypted target data execution result is returned to the application end.

[0153] In some embodiments, the first parsing result determination module 602 is used to verify the connection legitimacy and / or connection authority of the application end; if the verification is successful, the SQL access request is subjected to lexical parsing and / or grammatical parsing to obtain a first parsing result.

[0154] In some embodiments, the data encryption device provided by the embodiments of the present disclosure further includes:

[0155] A rule configuration information acquisition module is used to obtain pre-configured rule configuration information, where the rule configuration information is used to describe the encryption rules for encrypting the target field; when rewriting SQL according to the second parsing result, the rule configuration information is added to the rewritten SQL statement; wherein the encryption and decryption function module is also used to determine the target field and / or the encryption algorithm used to encrypt the target field according to the rule configuration information.

[0156] In some embodiments, the rule configuration information acquisition module is also used to obtain updated rule configuration information sent by the console when the rule configuration information is updated, wherein the console is used to monitor the rule base storing the rule configuration information; and update the pre-configured rule configuration information accordingly according to the updated rule configuration information.

[0157] In some embodiments, when the target data execution result includes an encrypted field, the encryption and decryption function module is further used to determine a decryption algorithm for decrypting the encrypted field according to the rule configuration information.

[0158] The device provided by the embodiment of the present disclosure sends the first parsing result to the encryption and decryption function module after obtaining the first parsing result, encrypts the target field to be encrypted contained in the first parsing result through the encryption and decryption function module, and then performs SQL rewriting and execution on the encrypted second parsing result. The embodiment of the present disclosure can realize the implantation of the encryption process into the main path of SQL parsing, rewriting, and execution, lowering the technical threshold, and realizing the flexible adjustment of the encryption algorithm through the encryption and decryption function module, thereby improving the flexibility of data encryption.

[0159] It should be noted that the request receiving module 601, the first parsing result determination module 602, the interface calling module 603, the first data execution result determination module 604, and the first data execution result return module 605 correspond to S202 to S210 in the method embodiment, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0160] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0161] The present disclosure embodiment provides an electronic device, which exemplarily includes: a processor and a memory. The memory can be used to store executable instructions of the processor. The processor is configured to perform the data encryption method provided by the present disclosure embodiment by executing the above executable instructions.

[0162] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0163] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0164] Among them, the storage unit stores a program code, and the program code can be executed by the processing unit 710, so that the processing unit 710 executes the steps described in the above "Exemplary Method" section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 710 can execute the following steps of the above method embodiment: receiving an SQL access request sent by the application end; determining the corresponding first parsing result according to the SQL access request; sending the first parsing result to the encryption and decryption function module, wherein the encryption and decryption function module is used to encrypt the target field to be encrypted contained in the first parsing result to obtain a second parsing result; rewriting and executing SQL according to the second parsing result to obtain a first data execution result; returning the first data execution result to the application end.

[0165] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0166] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0167] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0168] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0169] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0170] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer program product, which includes: a computer program, which implements the above data encryption method when executed by a processor.

[0171] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, and when the computer program is executed by a processor, the data encryption method provided in the embodiment of the present disclosure can be implemented. The computer-readable storage medium can be a readable signal medium or a readable storage medium.

[0172] Figure 8 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. Figure 8As shown, a program product capable of implementing the above method of the present disclosure is stored on the computer-readable storage medium 800. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0173] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0174] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0175] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0176] In a specific implementation, the program code for performing the operation of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0177] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0178] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0179] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0180] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The description and examples are to be regarded as exemplary only, and the true scope of the present disclosure is indicated by the appended claims.

Claims

1. A data encryption method, characterized in that: include: Receive SQL access requests sent by the application side; Determine a corresponding first parsing result according to the SQL access request; Sending the first parsing result to an encryption / decryption function module, wherein the encryption / decryption function module is configured to encrypt the target field to be encrypted contained in the first parsing result to obtain a second parsing result; Rewrite and execute SQL according to the second parsing result to obtain the first data execution result; Return the first data execution result to the application end.

2. The data encryption method according to claim 1, wherein: Rewriting and executing SQL according to the second parsing result to obtain the first data execution result includes: Rewrite the SQL statement according to the second parsing result to obtain a rewritten SQL statement; Executing the rewritten SQL statement to obtain the first data execution result; The method further comprises: Sending the rewritten SQL statement to each distributed storage node, wherein any distributed storage node is used to execute the rewritten SQL statement to obtain a corresponding second data execution result; The returning the first data execution result to the application end includes: Returning a target data execution result to the application end, the target data execution result including a first data execution result and each second data execution result.

3. The data encryption method according to claim 1, wherein: The sending the first parsing result to the encryption / decryption function module includes: Calling function pluggable interface; Determining whether the functional pluggable interface references the encryption and decryption function module; If the encryption and decryption function module is referenced, the first parsing result is sent to the encryption and decryption function module by calling the pluggable function interface.

4. The data encryption method according to claim 2, wherein: The returning the target data execution result to the application end includes: Determining whether the target data execution result contains an encrypted field; If the target data execution result includes an encrypted field, the target data execution result is sent to the encryption / decryption function module, wherein the encryption / decryption function module is used to decrypt the encrypted field included in the target data execution result to obtain a decrypted target data execution result; Return the decrypted target data execution result to the application end.

5. The data encryption method according to any one of claims 1 to 3, characterized in that: Determining a corresponding first parsing result according to the SQL access request includes: Verifying the legitimacy and / or connection authority of the application end; If the verification is successful, lexical analysis and / or grammatical analysis are performed on the SQL access request to obtain the first analysis result.

6. The data encryption method according to claim 2, wherein: The method further comprises: Obtaining pre-configured rule configuration information, where the rule configuration information is used to describe an encryption rule for encrypting the target field; When rewriting SQL according to the second parsing result, adding the rule configuration information to the rewritten SQL statement; The encryption / decryption function module is further configured to determine a target field and / or an encryption algorithm for encrypting the target field according to the rule configuration information.

7. The data encryption method according to claim 6, characterized in that: The method further comprises: When the rule configuration information is updated, obtaining the updated rule configuration information sent by the console, wherein the console is used to monitor the rule base storing the rule configuration information; According to the updated rule configuration information, the pre-configured rule configuration information is correspondingly updated.

8. The data encryption method according to claim 6 or 7, characterized in that: When the target data execution result includes an encrypted field, the encryption and decryption function module is further configured to determine a decryption algorithm for decrypting the encrypted field according to the rule configuration information.

9. A data encryption device, characterized in that: include: Request receiving module, used to receive SQL access requests sent by the application side; A first parsing result determining module, configured to determine a corresponding first parsing result according to the SQL access request; an interface calling module, configured to send the first parsing result to an encryption / decryption function module, wherein the encryption / decryption function module is configured to encrypt the target field to be encrypted contained in the first parsing result to obtain a second parsing result; A first data execution result determination module, configured to rewrite and execute SQL according to the second parsing result to obtain a first data execution result; The first data execution result returning module is configured to return the first data execution result to the application end.

10. An electronic device, characterized in that: include: processor; as well as a memory for storing executable instructions of the processor; The processor is configured to execute the data encryption method according to any one of claims 1 to 8 by executing the executable instructions.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data encryption method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device performs the data encryption method according to any one of claims 1 to 8.

Images