Data encryption method, electronic device, storage medium and program product

Abstract

The embodiment of the invention provides a data encryption method, electronic equipment, a storage medium and a program product. The method comprises the steps of obtaining an original statement in response to an encryption instruction; performing grammatical analysis on the original statement to obtain an analysis result; based on an analysis result, determining a target field list from the first field list and the second field list, and storing a plaintext value corresponding to a plaintext field in the original statement into the target field list; performing batch encryption on the plaintext values in the first field list to obtain corresponding ciphertext fields; and performing batch abstract calculation on the plaintext values in the second field list to obtain corresponding abstract fields. The method is used for improving the data security while realizing the rapid encryption of the data.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a data encryption method, electronic equipment, storage medium and program product. Background Art

[0002] With the development of diversified functions of the Internet, more and more daily business can be handled directly through the Internet. Along with it comes a large amount of data generated in the process of various business processing. How to ensure data security has increasingly become a focus of social attention.

[0003] Generally, providers of various services will ensure data security by uniformly encrypting business data on the application side. However, in actual use, common data encryption methods usually completely switch and encrypt all data in a data block. This encryption method will take up a lot of computing resources during the encryption process, resulting in large performance loss, and it is easy for encryption to fail due to problems with some data, resulting in poor encryption effect. Summary of the invention

[0004] The embodiments of the present application provide a data encryption method, an electronic device, a storage medium, and a program product to achieve the effect of accelerating data encryption while ensuring data security.

[0005] In a first aspect, an embodiment of the present application provides a data encryption method, comprising:

[0006] In response to the encryption instruction, obtaining the original sentence;

[0007] Performing grammatical analysis on the original sentence to obtain an analysis result;

[0008] Based on the analysis result, determining a target field list from the first field list and the second field list, and storing the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list;

[0009] The plaintext values ​​in the first field list are encrypted in batches to obtain corresponding ciphertext fields; and the plaintext values ​​in the second field list are calculated in batches to obtain corresponding summary fields.

[0010] In a possible implementation, determining a target field list from the first field list and the second field list based on the analysis result includes:

[0011] When the analysis result indicates that field encryption is required, using the first field list as the target field list;

[0012] When the analysis result indicates that summary calculation needs to be performed, using the second field list as the target field list;

[0013] When the analysis result indicates that field encryption and digest calculation are required, both the first field list and the second field list are used as the target field list. In a possible implementation, the grammatical analysis of the original sentence to obtain the analysis result includes:

[0014] Get the preset query conditions;

[0015] When the query condition indicates that the query is based on the ciphertext field, field encryption is required as the analysis result;

[0016] When the query condition indicates that a query is performed based on the summary field, a summary calculation needs to be performed as the analysis result;

[0017] When the query condition indicates that the query is performed based on the ciphertext field and the digest field, field encryption and digest calculation are required as the analysis result.

[0018] In a possible implementation, the method further includes:

[0019] In response to a query instruction, obtaining a query field carried by the query instruction;

[0020] Compare the query field with at least one of the plaintext field, the ciphertext field, and the summary field to obtain a comparison result;

[0021] Based on the comparison result, a target original sentence corresponding to the query instruction is obtained. In a possible implementation manner, storing the plaintext value corresponding to the plaintext field in the original sentence into the target field list includes:

[0022] Acquire at least one pre-set field to be encrypted and at least one pre-set field to be calculated;

[0023] When the plaintext field has a first target field that is consistent with the field to be encrypted, and the target field list includes a first field list, the plaintext value corresponding to the first target field is stored in the first field list; when the plaintext field has a second field that is consistent with the field to be calculated, and the target field list includes a second field list, the plaintext value corresponding to the second target field is stored in the second field list.

[0024] In a possible implementation, the method further includes:

[0025] Obtaining a mapping relationship between a preset first parameter value and the field to be encrypted;

[0026] Based on the to-be-encrypted fields corresponding to the plaintext values ​​in the first field list, the first parameter values ​​corresponding to the plaintext values ​​are matched as the ciphertext values ​​of the ciphertext fields corresponding to the plaintext values. In a possible implementation, the method further includes:

[0027] Obtaining a mapping relationship between a preset second parameter value and the field to be calculated;

[0028] Based on the to-be-calculated fields corresponding to the plaintext values ​​in the second field list, the second parameter values ​​corresponding to the plaintext values ​​are matched as the summary values ​​of the summary fields corresponding to the plaintext values. In a possible implementation manner, the method further includes:

[0029] Obtaining preset storage conditions;

[0030] The mapping relationship between the second parameter value and the field to be calculated is adjusted based on the storage condition. In a possible implementation, the mapping relationship between the second parameter value and the field to be calculated is adjusted based on the storage condition, including:

[0031] When the storage condition indicates that only plaintext fields are stored, the second parameter values ​​are all set to empty;

[0032] When the storage condition indicates that the plaintext field and the ciphertext field are stored simultaneously, the second parameter value is set to be non-empty. In a possible implementation manner, before the grammatical analysis of the original sentence based on the preset condition and obtaining the analysis result includes:

[0033] Matching the original statement with at least one analysis result in the first-level cache, and obtaining a matching result;

[0034] The grammatical analysis of the original sentence based on the preset conditions to obtain the analysis result includes:

[0035] When the matching result indicates that the analysis result corresponding to the original statement is not stored in the first-level cache, a preset condition is obtained, and a grammatical analysis is performed on the original statement based on the preset condition to obtain the analysis result. In a possible implementation, when the matching result indicates that the analysis result corresponding to the original statement is not stored in the first-level cache, a grammatical analysis is performed on the original statement to obtain the analysis result. When the matching result indicates that the analysis result corresponding to the original statement is not stored in the first-level cache, a preset condition is obtained, and a grammatical analysis is performed on the original statement based on the preset condition to obtain the analysis result, after obtaining the analysis result, the method includes:

[0036] The analysis results are stored in the first-level cache and the second-level cache respectively;

[0037] The method of determining a target field list from the first field list and the second field list based on the analysis result, and storing the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list based on the analysis result, storing the plaintext values ​​corresponding to the original sentence into the first field list, and storing the digest values ​​corresponding to the original sentence into the second field list, comprises:

[0038] In a second aspect, an embodiment of the present application provides a data encryption device, comprising:

[0039] An acquisition module, used for acquiring the original sentence in response to the encryption instruction;

[0040] An analysis module, configured to perform grammatical analysis on the original sentence, obtain an analysis result, obtain a preset condition, and perform grammatical analysis on the original sentence based on the preset condition to obtain an analysis result;

[0041] A storage module, configured to determine a target field list from the first field list and the second field list based on the analysis result, and store the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list; based on the analysis result, store the plaintext values ​​corresponding to the original sentence into the first field list, and store the digest values ​​corresponding to the original sentence into the second field list;

[0042] The processing module is used to batch encrypt the plaintext values ​​in the first field list to obtain the corresponding ciphertext fields; batch calculate the summary of the plaintext values ​​in the second field list to obtain the corresponding summary fields; batch encrypt the original sentences corresponding to the plaintext values ​​in the first field list, and batch calculate the summary of the original sentences corresponding to the plaintext values ​​in the second field list. In a third aspect, an embodiment of the present application provides a computer device, including: a memory, a processor;

[0043] The memory stores computer-executable instructions;

[0044] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the implementation methods of the first aspect and / or various possible data encryption methods of the first aspect as described above.

[0045] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the first aspect above and / or various possible data encryption method implementations of the first aspect.

[0046] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the implementation methods of the first aspect and / or various possible data encryption methods of the first aspect.

[0047] The data encryption method, electronic device, storage medium and program product provided in the embodiments of the present application can perform grammatical analysis on the original sentence based on pre-set preset conditions, thereby converting the original sentence into a representation inside the database, and further storing the plaintext value in the original sentence into a first field list based on the analysis result, storing the summary value in the original sentence into a second field list, and batch encrypting the plaintext fields in the original sentence based on the first field list, and batch summarizing the summary fields in the original sentence based on the second field list. By setting the number of plaintext values ​​and summary values ​​that the field list can accommodate, the amount of data that can be encrypted and summarized calculated at one time can be achieved. On the basis of achieving rapid encryption of data, the security risks caused by switching and encrypting all data at one time in common data encryption methods can be avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0049] Figure 1 A schematic diagram of a scenario of the data encryption method provided in this application;

[0050] Figure 2 A flowchart of the data encryption method provided by this application;

[0051] Figure 3 A schematic diagram of the structure of the data encryption device provided by this application;

[0052] Figure 4 A schematic diagram of the structure of the computer device provided for this application.

[0053] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0055] The data encryption method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 via the network.

[0056] For example, the data encryption method is applied to the terminal 102. When the terminal 102 receives the encryption instruction, it obtains the original sentence, and then performs grammatical analysis on the original sentence to obtain the analysis result; then the terminal 102 determines the target field list from the first field list and the second field list based on the analysis result, and stores the plaintext value corresponding to the plaintext field in the original sentence into the target field list; finally, the original sentence corresponding to each plaintext value in the first field list is batch encrypted to obtain the corresponding ciphertext field; the original sentence corresponding to the plaintext value in the second field list is batch digest calculated to obtain the corresponding digest field. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers. The terminal 102 and the server 104 can be directly or indirectly connected by wired or wireless communication, such as through a network connection.

[0057] For another example, the data encryption method is applied to the server 104. When the terminal 102 receives the encryption instruction, it sends the encryption instruction to the server 104. Then the server 104 obtains the original sentence based on the encryption instruction, and performs grammatical analysis on the original sentence to obtain the analysis result; based on the analysis result, the server 104 determines the target field list from the first field list and the second field list, and stores the plaintext value corresponding to the plaintext field in the original sentence into the target field list; finally, the original sentence corresponding to each plaintext value in the first field list is encrypted in batches to obtain the corresponding ciphertext field; the original sentence corresponding to the plaintext value in the second field list is calculated in batches to obtain the corresponding summary field. It can be understood that the data storage system can be an independent storage device, or the data storage system is located on the server 104, or the data storage system is located on another terminal.

[0058] It should be noted that the network communication between the terminal 102 and the server 104 is applicable to different network standards, for example, it can be applicable to global system of mobile communication (GSM), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time division synchronous code division multiple access (TD-SCDMA), long term evolution (LTE) system and future 5G and other network standards. Optionally, the above communication system can be a system in the scenario of ultra-reliable and low latency communications (URLLC) transmission in a 5G communication system.

[0059] Therefore, optionally, the above-mentioned base station can be a base station (Base Transceiver Station, referred to as BTS) and / or a base station controller in GSM or CDMA, or a base station (NodeB, referred to as NB) and / or a radio network controller (Radio Network Controller, referred to as RNC) in WCDMA, or an evolved base station (EvolutionalNode B, referred to as eNB or eNodeB) in LTE, or a relay station or access point, or a base station (gNB) in the future 5G network, etc., and the present application is not limited here.

[0060] The terminal 102 can be a wireless terminal or a wired terminal. A wireless terminal can be a device that provides voice and / or other service data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. A wireless terminal can communicate with one or more core network devices via a radio access network (Radio Access Network, referred to as RAN). A wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device, which exchanges language and / or data with a radio access network. For another example, a wireless terminal can also be a personal communication service (Personal Communication Service, referred to as PCS) phone, a cordless phone, a Session Initiation Protocol (Session Initiation Protocol, referred to as SIP) phone, a wireless local loop (Wireless Local Loop, referred to as WLL) station, a personal digital assistant (Personal Digital Assistant, referred to as PDA) and other devices. The wireless terminal may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, an access terminal, a user terminal, a user agent, a user device or user equipment, without limitation. Optionally, the terminal device may also be a smart watch, a tablet computer or other device.

[0061] In one embodiment, a data encryption method is provided. This embodiment uses the data encryption method applied to a terminal as an example. It is understandable that the data encryption method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Figure 2 As shown, the data encryption method includes:

[0062] Step 202: In response to the encryption instruction, obtain the original sentence.

[0063] An encryption instruction refers to an instruction to encrypt stored data. As an example, an encryption instruction may be issued by a staff member of a service provider through a fixed component on the human-computer interaction interface of a terminal, wherein a fixed component may refer to a pre-built page or applet. Specifically, the human-computer interaction interface of the terminal may specifically display the interface of a fixed component, and a plurality of virtual buttons may be pre-integrated on the interface of the fixed component, each virtual button being used to represent the encryption of data at a specific storage location in the database, and the staff member of the service provider issues an encryption instruction by clicking any virtual button on the interface of the fixed component; or, an encryption instruction may be automatically generated by the terminal when the terminal detects that new data is stored in a specific storage location, and is used to automatically encrypt the data newly stored in the specific storage location. The database may refer to the above-mentioned data storage system or an additional separate database that is communicatively connected to the server.

[0064] A raw statement refers to a command or query instruction that directly interacts with a database. A raw statement is used to perform specific operations, such as inserting data, updating data, deleting data, or querying data in a database. A raw statement is usually in the form of a string.

[0065] Step 204: Perform grammatical analysis on the original sentence to obtain analysis results.

[0066] As an example, the terminal can perform grammatical analysis of the original sentence based on preset conditions. The preset conditions are used to guide how to parse and process the original sentence. As an example, the preset conditions can be used to constrain the field type and field length of the original sentence, and can also be used to perform summary processing of specific fields. For example, the preset conditions can be used to convert a specific field into a summary field when it meets the preset sensitive information category.

[0067] Syntax analysis is the process of converting the original statement into a database internal representation. This process checks whether the structure of the original statement conforms to the preset language grammar rules.

[0068] The analysis results may include a schematized representation of the original statement, which is used to display the components of the original statement and their hierarchical relationships. For example, it may include the modified original statement, whether encryption is required, whether digest calculation is required, and indexes of corresponding plaintext fields, encrypted fields, and digest fields.

[0069] Step 206: Based on the analysis result, determine a target field list from the first field list and the second field list, and store the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list.

[0070] A plaintext value is a raw data value that has not been encrypted or hashed, such as a string, number, or date. A plaintext value can be used in raw statements to refer to a plaintext field, especially in query and insert operations.

[0071] As an example, the first field list is used to store plaintext values ​​corresponding to fields that need to be encrypted in the original statement, and the second field list is used to store plaintext values ​​corresponding to fields that need to be digest calculated in the original statement.

[0072] Step 208: Batch encrypt the plaintext values ​​in the first field list to obtain corresponding ciphertext fields; batch calculate the summary of the plaintext values ​​in the second field list to obtain corresponding summary fields.

[0073] In this step, the terminal can call a pre-set encryption machine to perform batch encryption of the original sentences. The encryption machine is a special hardware device or software tool for performing encryption and decryption operations. They usually provide efficient encryption algorithms and key management functions to ensure the security of data during transmission and storage. As an example, the encryption machine can be pre-set in the server.

[0074] In this embodiment, the terminal matches the plaintext fields in the original sentence corresponding to each plaintext value based on at least one plaintext value stored in the first field list, and then calls the encryption machine to input the plaintext fields corresponding to each plaintext value into the encryption machine to encrypt the data using the encryption algorithm and key pre-set by the encryption machine, thereby completing the encryption of the plaintext fields.

[0075] Furthermore, on the basis of encrypting the original statement, the terminal can also perform a summary calculation on the plaintext field of the original statement. It should be noted that the result of the summary calculation can be used as an index of the original statement to query the original statement. This allows the database to reduce the amount of data that needs to be scanned and processed when executing the query of the original statement, thereby improving the query speed.

[0076] In this embodiment, the terminal matches the plaintext fields in the original sentence corresponding to each plaintext value based on at least one plaintext value stored in the second field list, and then performs digest calculations one by one to obtain a calculated digest result.

[0077] The data encryption method provided in the embodiment of the present application is that the terminal can perform grammatical analysis on the original sentence based on pre-set preset conditions, thereby converting the original sentence into a representation inside the database, and further storing the plaintext value in the original sentence into a first field list, storing the summary value in the original sentence into a second field list, and based on the first field list, batch encrypting the plaintext fields in the original sentence, and based on the second field list, batch summaries are calculated on the plaintext fields in the original sentence. By setting the number of plaintext values ​​that the first field list can accommodate and the number of plaintext values ​​that the second field list can accommodate, dynamic control of the amount of data for one-time encryption and summary calculation can be achieved. On the basis of achieving rapid encryption of data, it is possible to avoid the security risks caused by switching and encrypting all data at one time in common data encryption methods.

[0078] In some optional embodiments, step 206 includes:

[0079] When the analysis result indicates that field encryption is required, the first field list is used as the target field list;

[0080] When the analysis result indicates that summary calculation is required, the second field list is used as the target field list;

[0081] When the analysis result indicates that field encryption and digest calculation are required, both the first field list and the second field list are used as target field lists.

[0082] The analysis results of syntax analysis do not directly determine whether the original statement needs to be encrypted, but the analysis results can be used as a reference factor for whether field encryption is needed. For example, in the encryption scenario of database query statements, if the analysis results of syntax analysis show that the original statement contains specific sensitive fields (such as user personal information, financial data, etc.), these plaintext fields may need to be encrypted to protect data security.

[0083] Based on the result of grammatical analysis, the terminal can store the plaintext values ​​of the plaintext fields in the original sentence into the first field list or the second field list respectively, thereby distinguishing the plaintext fields that need to be encrypted and the plaintext fields that need to be digested, thereby realizing rapid analysis and processing of the original sentence.

[0084] In some optional embodiments, step 204 includes:

[0085] Get the preset query conditions;

[0086] When the query condition indicates a query based on a ciphertext field, the field will need to be encrypted as the analysis result;

[0087] When the query condition indicates a query based on a summary field, a summary calculation will be required as the analysis result;

[0088] When the query condition indicates a query based on a ciphertext field and a digest field, field encryption and digest calculation will be required as the analysis result.

[0089] The query condition is used to indicate the search method that can be used when searching for fields in the encrypted original statement.

[0090] The query condition can reflect the search method by setting the query status. When the query status is TRUE, it means the query is based on the summary field; when the query status is FALSE, it means the query is based on the plain text field.

[0091] As an example, when the statement form of the original statement is an INSERT statement, an UPDATE statement, a REPLACE statement or a SELECT statement, a DELECT statement, and the query status of the query condition is TRUE, the terminal can take the need for field encryption as an analysis result.

[0092] Among them, the specific operation corresponding to the INSERT statement is that it can only add new records to the table, but cannot update existing records; the specific operation corresponding to the UPDATE statement is that it can only update existing records in the table, but cannot add new records; the specific operation corresponding to the REPLACE statement is that it can both add new records and update existing records.

[0093] In this embodiment, the terminal can dynamically adjust the analysis result of the syntax analysis according to the preset query conditions, thereby realizing customized data encryption.

[0094] In some optional embodiments, the data encryption method further includes:

[0095] In response to a query instruction, obtaining a query field carried by the query instruction;

[0096] Compare the query field with at least one of the plaintext field, the ciphertext field, and the summary field to obtain a comparison result;

[0097] Based on the comparison results, the target sentence corresponding to the query instruction is obtained.

[0098] The query field refers to the instruction to search for statements stored in the database.

[0099] In this embodiment, the terminal can accurately match and search for statements stored in the database based on the query field carried by the query instruction and at least one of the plaintext field, the ciphertext field, and the summary field as an index, thereby quickly determining the target original statement.

[0100] In some optional embodiments, step 204 includes:

[0101] Acquire at least one pre-set field to be encrypted and at least one pre-set field to be calculated;

[0102] When there is a first target field in the plaintext field that matches the field to be encrypted, and the target field list includes the first field list, the plaintext value corresponding to the first target field is stored in the first field list; when there is a second field in the plaintext field that matches the field to be calculated, and the target field list includes the second field list, the plaintext value corresponding to the second target field is stored in the second field list.

[0103] In this embodiment, the terminal can match the plaintext fields in the original sentence with at least one pre-set field to be encrypted and at least one field to be calculated, respectively, and store the plaintext value of the first target field that successfully matches the field to be encrypted into the first field list to indicate the need for encryption, and store the plaintext value of the second target field that successfully matches the field to be calculated into the second field list to indicate the need for summary calculation, thereby achieving rapid determination of the specific processing method of the plaintext field in the original sentence, thereby accelerating the data encryption speed.

[0104] In some optional embodiments, the data encryption method further includes:

[0105] Obtaining a mapping relationship between a preset first parameter value and a field to be encrypted;

[0106] Based on the to-be-encrypted fields corresponding to the plaintext values ​​in the first field list, the first parameter values ​​corresponding to the plaintext values ​​are matched as the ciphertext values ​​of the ciphertext fields corresponding to the plaintext values.

[0107] In the scenario of data encryption, since the original statements are stored in the database in ciphertext, the query operation is usually more complicated. By using the first parameter value as the pre-compiled parameter index, the parsing time of the original statement can be reduced each time the query is made, thus improving the query efficiency.

[0108] In some optional embodiments, the data encryption method further includes:

[0109] Obtaining the mapping relationship between the preset second parameter value and the field to be calculated;

[0110] Based on the to-be-calculated fields corresponding to the plaintext values ​​in the second field list, second parameter values ​​corresponding to the plaintext values ​​are matched as summary values ​​of the summary fields corresponding to the plaintext values.

[0111] Similarly, using the second parameter value as the pre-compiled parameter index can reduce the parsing time of the original statement each time a query is made, thereby improving query efficiency.

[0112] In some optional embodiments, the data encryption method includes:

[0113] Obtaining preset storage conditions;

[0114] Adjusting the mapping relationship between the second parameter value and the field to be calculated based on the storage condition;

[0115] Specifically, when the storage condition indicates that only the plaintext field is stored, the terminal can set the second parameter value to be empty; when the storage condition indicates that both the plaintext field and the ciphertext field are stored, the terminal can set the second parameter value to be non-empty.

[0116] The storage condition is used to indicate the field content that needs to be stored.

[0117] When the storage condition indicates that only plaintext fields are stored, the terminal can set the second parameter value to empty. When the storage condition indicates that both plaintext fields and ciphertext fields are stored, the second parameter value is set to non-empty, thereby achieving effective control over the fields that the database can store.

[0118] In some optional embodiments, before step 204, the following steps are included:

[0119] Match the original statement with at least one analysis result in the first-level cache, and obtain the matching result;

[0120] Step 204 includes:

[0121] When the matching result indicates that the analysis result corresponding to the original sentence is not stored in the first-level cache, a preset condition is obtained, and a grammatical analysis is performed on the original sentence based on the preset condition to obtain an analysis result.

[0122] Specifically, after step 204, the following steps are included:

[0123] The analysis results are stored in the first-level cache and the second-level cache respectively;

[0124] Before step 206, the following steps are included:

[0125] Get the analysis results from the secondary cache.

[0126] In this embodiment, after obtaining the original sentence, the terminal first determines whether the analysis result corresponding to the original sentence is stored in the first-level cache. If not, it can be considered that the original sentence has not been subjected to grammatical analysis before. At this time, the terminal can perform the first grammatical analysis on the original sentence to obtain the analysis result.

[0127] Furthermore, after obtaining the analysis results, the terminal can synchronously store the analysis results in the first cache and the second cache. Accordingly, before the terminal executes step 208, it is necessary to first obtain the analysis results from the second cache, and then based on the analysis results, store the plaintext value corresponding to the original statement into the first field list and the second field list.

[0128] The storage capacity of the first cache is smaller than that of the second cache.

[0129] In this embodiment, when the terminal obtains the original sentence corresponding to the encrypted instruction and needs to perform grammatical analysis on the original sentence, it can first match whether there is an analysis result corresponding to the original sentence in the first cache. If not, it can be considered that the original sentence has not been grammatically analyzed before. At this time, the terminal can perform a first grammatical analysis on the original sentence to obtain the analysis result; if it exists, it can be considered that the original sentence has been grammatically analyzed before. At this time, the terminal can directly obtain the analysis result of the original sentence from the second cache, thereby avoiding repeated grammatical analysis processing on the same original sentence and saving data processing steps.

[0130] The above-mentioned data encryption method can, after receiving the encryption instruction and obtaining the original sentence, first confirm whether the analysis result corresponding to the original sentence already exists in the first cache. If so, the analysis result is directly obtained from the second cache. If not, the original sentence is subjected to grammatical analysis based on the preset preset conditions, thereby converting the original sentence into the internal representation of the database, and further synchronously storing the analysis result in the first cache and the second cache, thereby avoiding repeated grammatical analysis of the same original sentence, and further based on the analysis result, storing the plaintext value in the first field list and the second field list, and based on the first field list, batch encrypting the plaintext value, and based on the second field list, batch digest calculation of the plaintext value, by setting the number of plaintext values ​​that the first field list and the second field list can accommodate, the amount of data for one-time encryption and digest calculation can be controlled, and on the basis of realizing fast encryption of data, the security risks caused by switching and encrypting all data at one time in common data encryption methods can be avoided.

[0131] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0132] Based on the same inventive concept, the embodiment of the present application also provides a data encryption device for implementing the data encryption method involved above. The implementation solution provided by the data encryption device to solve the problem is similar to the implementation solution recorded in the above data encryption method, so the specific limitations in one or more device embodiments provided below can refer to the limitations on the data encryption method above, and will not be repeated here.

[0133] In one embodiment, Figure 3 As shown, a data encryption device is provided, comprising:

[0134] An acquisition module 302, for acquiring an original statement in response to an encryption instruction;

[0135] The analysis module 304 is used to perform grammatical analysis on the original sentence to obtain an analysis result;

[0136] A storage module 306 is used to determine a target field list from the first field list and the second field list based on the analysis result, and store the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list;

[0137] The processing module 308 is used to perform batch encryption on the plaintext values ​​in the first field list to obtain corresponding ciphertext fields; and perform batch digest calculation on the plaintext values ​​in the second field list to obtain corresponding digest fields.

[0138] In some optional embodiments, the storage module 306 is further configured to:

[0139] When the analysis result indicates that field encryption is required, the first field list is used as the target field list;

[0140] When the analysis result indicates that summary calculation is required, the second field list is used as the target field list;

[0141] When the analysis result indicates that field encryption and digest calculation are required, both the first field list and the second field list are used as target field lists.

[0142] In some optional embodiments, the analysis module 304 is further configured to:

[0143] Get the preset query conditions;

[0144] When the query condition indicates a query based on a ciphertext field, the field will need to be encrypted as the analysis result;

[0145] When the query condition indicates a query based on a summary field, a summary calculation will be required as the analysis result;

[0146] When the query condition indicates a query based on a ciphertext field and a digest field, field encryption and digest calculation will be required as the analysis result.

[0147] In some optional embodiments, the processing module 308 is further configured to:

[0148] In response to a query instruction, obtaining a query field carried by the query instruction;

[0149] Compare the query field with at least one of the plaintext field, the ciphertext field, and the summary field to obtain a comparison result;

[0150] Based on the comparison result, the target original sentence corresponding to the query instruction is obtained.

[0151] In some optional embodiments,

[0152] The storage module 306 is further configured to:

[0153] Acquire at least one pre-set field to be encrypted and at least one pre-set field to be calculated;

[0154] When the plaintext field has a first target field that matches the field to be encrypted, and the target field list includes the first field list, the plaintext value corresponding to the first target field is stored in the first field list; when the plaintext field has a second field that matches the field to be calculated, and the target field list includes the second field list, the plaintext value corresponding to the second target field is stored in the second field list. In some optional embodiments, the processing module 308 is further configured to:

[0155] Obtaining a mapping relationship between a preset first parameter value and a field to be encrypted;

[0156] Based on the to-be-encrypted fields corresponding to the plaintext values ​​in the first field list, the first parameter values ​​corresponding to the plaintext values ​​are matched as the ciphertext values ​​of the ciphertext fields corresponding to the plaintext values.

[0157] The processing module 308 is further configured to:

[0158] Obtaining the mapping relationship between the preset second parameter value and the field to be calculated;

[0159] Based on the to-be-calculated fields corresponding to the plaintext values ​​in the second field list, the second parameter values ​​corresponding to the plaintext values ​​are matched as the summary values ​​of the summary fields corresponding to the plaintext values. In some optional embodiments, the analysis module 304 is further configured to:

[0160] Obtaining preset storage conditions;

[0161] The mapping relationship between the second parameter value and the field to be calculated is adjusted based on the storage condition. In some optional embodiments, the analysis module 304 is further configured to:

[0162] When the storage condition indicates that only the plaintext field is stored, the second parameter value is set to null;

[0163] When the storage condition indicates storing both the plaintext field and the ciphertext field, the second parameter value is set to be non-empty.

[0164] In some optional embodiments, the analysis module 304 is further configured to:

[0165] Match the original statement with at least one analysis result in the first-level cache, and obtain the matching result;

[0166] When the matching result indicates that the analysis result corresponding to the original sentence is not stored in the first-level cache, a preset condition is obtained, and a grammatical analysis is performed on the original sentence based on the preset condition to obtain an analysis result.

[0167] In some optional embodiments, the analysis module 304 is further configured to:

[0168] The analysis results are stored in the first-level cache and the second-level cache respectively;

[0169] The processing module 308 is further configured to:

[0170] Get the analysis results from the secondary cache.

[0171] Each module in the above device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0172] The (device subject) provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be described in detail here.

[0173] Figure 4 The schematic diagram of the computer structure provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the device 40 also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0174] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0175] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0176] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0177] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0178] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0179] The present application also provides a computer program product, including a computer program, which implements the above-mentioned data encryption method when executed by a processor.

[0180] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned data encryption method is implemented.

[0181] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0182] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0183] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0184] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0185] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0186] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0187] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0188] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data encryption method, characterized in that: include: In response to the encryption instruction, obtaining the original sentence; Performing grammatical analysis on the original sentence to obtain an analysis result; Based on the analysis result, determining a target field list from the first field list and the second field list, and storing the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list; Batch encrypt the plaintext values ​​in the first field list to obtain corresponding ciphertext fields; Batch digest calculation is performed on the plaintext values ​​in the second field list to obtain corresponding digest fields.

2. The method according to claim 1, characterized in that Determining a target field list from the first field list and the second field list based on the analysis result includes: When the analysis result indicates that field encryption is required, using the first field list as the target field list; When the analysis result indicates that summary calculation is required, using the second field list as the target field list; When the analysis result indicates that field encryption and digest calculation are required, both the first field list and the second field list are used as the target field lists.

3. The method according to claim 2, characterized in that The grammatical analysis of the original sentence to obtain the analysis result includes: Get the preset query conditions; When the query condition indicates that the query is based on the ciphertext field, field encryption is required as the analysis result; When the query condition indicates that a query is performed based on the summary field, a summary calculation needs to be performed as the analysis result; When the query condition indicates that the query is performed based on the ciphertext field and the digest field, field encryption and digest calculation are required as the analysis result.

4. The method according to claim 2 or 3, characterized in that: The method further comprises: In response to a query instruction, obtaining a query field carried by the query instruction; Compare the query field with at least one of the plaintext field, the ciphertext field, and the summary field to obtain a comparison result; Based on the comparison result, a target original sentence corresponding to the query instruction is obtained.

5. The method according to claim 1, characterized in that The storing the plaintext value corresponding to the plaintext field in the original sentence into the target field list includes: Acquire at least one pre-set field to be encrypted and at least one pre-set field to be calculated; When the plaintext field has a first target field that is consistent with the field to be encrypted, and the target field list includes a first field list, the plaintext value corresponding to the first target field is stored in the first field list; when the plaintext field has a second target field that is consistent with the field to be calculated, and the target field list includes a second field list, the plaintext value corresponding to the second target field is stored in the second field list.

6. The method according to claim 5, characterized in that The method further comprises: Obtaining a mapping relationship between a preset first parameter value and the field to be encrypted; Based on the to-be-encrypted fields corresponding to the plaintext values ​​in the first field list, first parameter values ​​corresponding to the plaintext values ​​are matched as ciphertext values ​​of the ciphertext fields corresponding to the plaintext values.

7. The method according to claim 5, characterized in that The method further comprises: Obtaining a mapping relationship between a preset second parameter value and the field to be calculated; Based on the to-be-calculated fields corresponding to the plaintext values ​​in the second field list, second parameter values ​​corresponding to the plaintext values ​​are matched as summary values ​​of the summary fields corresponding to the plaintext values.

8. The method according to claim 7, characterized in that The method further comprises: Obtaining preset storage conditions; The mapping relationship between the second parameter value and the field to be calculated is adjusted based on the storage condition.

9. The method according to claim 8, characterized in that The adjusting the mapping relationship between the second parameter value and the field to be calculated based on the storage condition includes: When the storage condition indicates that only plaintext fields are stored, the second parameter values ​​are all set to empty; When the storage condition indicates storing the plaintext field and the ciphertext field simultaneously, the second parameter value is set to be non-empty.

10. The method according to claim 1, characterized in that Before the grammatical analysis of the original sentence is performed to obtain the analysis result, the method includes: Matching the original statement with at least one analysis result in the first-level cache, and obtaining a matching result; The grammatical analysis of the original sentence to obtain the analysis result includes: When the matching result indicates that the analysis result corresponding to the original statement is not stored in the first-level cache, a grammatical analysis is performed on the original statement to obtain the analysis result.

11. The method according to claim 10, characterized in that When the matching result indicates that the analysis result corresponding to the original statement is not stored in the first-level cache, the original statement is parsed to obtain the analysis result, including: The analysis results are stored in the first-level cache and the second-level cache respectively; The step of determining a target field list from the first field list and the second field list based on the analysis result, and storing the plaintext values ​​corresponding to the plaintext fields in the original sentence before entering the target field list includes: The analysis result is obtained from the secondary cache.

12. A data encryption device, characterized in that: include: An acquisition module, used for acquiring the original sentence in response to the encryption instruction; An analysis module, used for performing grammatical analysis on the original sentence to obtain an analysis result; A storage module, configured to determine a target field list from the first field list and the second field list based on the analysis result, and store the plaintext values ​​corresponding to the plaintext fields in the original sentence into the target field list; A processing module, used for batch encrypting the plaintext values ​​in the first field list to obtain corresponding ciphertext fields; Batch digest calculation is performed on the plaintext values ​​in the second field list to obtain corresponding digest fields.

13. A computer device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the data encryption method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the data encryption method according to any one of claims 1 to 11.

15. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the data encryption method according to any one of claims 1 to 11.

Images