Universal database transparent encryption method and system

Abstract

The invention relates to the technical field of databases, and provides a universal database transparent encryption method and system, and the method comprises the steps: creating an initial encryption strategy, obtaining database list fields from a database, and carrying out the classification and grading of the obtained database list fields; sequentially carrying out initial encryption strategy association processing and integrity processing on the classified and graded database list fields to obtain preprocessed database list fields; performing historical data cleaning on the preprocessed database list field, and creating an encryption strategy by updating the preprocessed database list field subjected to historical data cleaning; and after the service is accessed, periodically synchronizing and caching the encryption strategy, and carrying out data encryption and decryption by adopting the locally cached encryption strategy. According to the universal database transparent encryption method and system, database transparent encryption which is more efficient, safer, high in compatibility and low in cost can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a general database transparent encryption method and system. Background Art

[0002] Database transparent encryption is a technology that encrypts data in a database without changing the application logic. It allows data to exist in encrypted form when stored and automatically decrypted when used, thereby protecting sensitive data from unauthorized access. With the advancement of encryption technology, more efficient and secure encryption algorithms have emerged, improving the performance and security of transparent encryption. New encryption algorithms and technologies are constantly being introduced into transparent encryption, such as homomorphic encryption and secure multi-party computing, which can process encrypted data without decrypting the data. Transparent encryption technology is being more closely integrated with database management systems, providing a more seamless user experience and reducing the burden on management. Transparent encryption technology has been widely used in various database systems, including relational databases, NoSQL databases, etc.

[0003] With the continuous development of technology, database transparent encryption technology has become an important tool for protecting data security, but in practical applications, there are also the following defects and limitations: 1. Encryption and decryption operations will increase the load on the database system, especially when processing large amounts of data or frequent read and write operations, affecting overall performance; 2. Because encrypted data cannot be directly used for index lookup, for complex queries, especially those involving multiple encrypted fields, transparent encryption will lead to decreased query efficiency; 3. Key management is a key issue in transparent encryption. If the key is not managed properly, the data cannot be decrypted or the key will be leaked; 4. Certain types of encryption technology limit database operations due to their high computational complexity. For example, although fully homomorphic encryption is powerful, it is not practical in practical applications; 5. Different database systems require specific transparent encryption solutions, and transparent encryption technology requires extremely high compatibility, which makes it difficult to use across platforms; 6. Implementing transparent encryption requires additional hardware support or software licensing fees, which increases the cost of deployment.

[0004] Therefore, how to provide a more efficient, secure, highly compatible and low-cost transparent encryption technology has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a general database transparent encryption method and system.

[0006] According to a first aspect of the present invention, a general database transparent encryption method is provided, comprising: Create an initial encryption strategy, obtain database list fields from the database and classify and grade the obtained database list fields; Performing initial encryption policy association processing and integrity processing on the classified and graded database list fields in sequence to obtain pre-processed database list fields; Perform historical data cleansing on the preprocessing database list fields, and create an encryption strategy by updating the preprocessing database list fields that have undergone historical data cleansing; After accessing the service, the encryption policy is periodically synchronized and cached, and the locally cached encryption policy is used to encrypt and decrypt data.

[0007] Preferably, in the universal database transparent encryption method of the present invention, creating an initial encryption strategy includes: creating an encryption key and an initial strategy through TDES, associating the created encryption key with the initial strategy, and obtaining the initial encryption strategy.

[0008] Preferably, in the general database transparent encryption method of the present invention, obtaining database list fields from a database and classifying and grading the obtained database list fields comprises: Call TDEA to scan the database through TDES, obtain the database list, and select the database according to the obtained database list; Call TDEA through TDES to scan the database tables of the selected database, obtain the database table list, and select the list according to the obtained database table list; Call TDEA through TDES to scan the selected list, obtain the database list fields, classify and grade the obtained database list fields, and send the classification and grading results to the user.

[0009] Preferably, in the general database transparent encryption method of the present invention, the classified and graded database list fields are subjected to initial encryption policy association processing and integrity processing to obtain preprocessed database list fields, including: the user selects fields according to the classification and grading results, and the selected fields are associated with the initial encryption policy by calling TDEA through TDES, and encrypted fields, auxiliary query fields and fuzzy query fields are added to the fields associated with the initial encryption policy.

[0010] Preferably, in the universal database transparent encryption method of the present invention, historical data cleaning is performed on the pre-processed database list field, including: encrypting the historical data corresponding to the pre-processed database list field in the database through TDES calling TDEA.

[0011] Preferably, in the general database transparent encryption method of the present invention, an encryption strategy is created by updating the pre-processed database list fields that have been cleaned with historical data, including: creating an encryption strategy by calling the encrypted fields, auxiliary query fields and fuzzy query fields in the pre-processed database list fields that have been cleaned with historical data by TDES.

[0012] Preferably, in the general database transparent encryption method of the present invention, the encryption strategy is periodically synchronized and cached after accessing the service, and the locally cached encryption strategy is used for data encryption and decryption, including: accessing the service through a data transparent encryption SDK or a data transparent encryption agent, periodically synchronizing the encryption strategy from TDES, locally caching the synchronized encryption strategy, and using the locally cached encryption strategy for data encryption and decryption.

[0013] Preferably, in the general database transparent encryption method of the present invention, a data transparent encryption SDK or a data transparent encryption agent access service is used, encryption strategies are periodically synchronized from TDES, the synchronized encryption strategies are locally cached, and data encryption and decryption are performed using the locally cached encryption strategies, including: After accessing the business, parse the original SQL of the business data to obtain the database, field, action and data corresponding to the field operated in the SQL; By querying the encryption policy of the local cache, it is determined whether the original SQL contains encrypted fields. If the original SQL does not contain encrypted fields, the original SQL is rewritten and encrypted. The rewritten encrypted SQL is sent to the database for execution, the execution results are merged, and the original data corresponding to the encrypted fields is obtained by decrypting and querying the merged execution results.

[0014] Preferably, in the general database transparent encryption method of the present invention, when the original SQL does not contain an encrypted field, the original SQL is rewritten and encrypted, including: when the operation in the SQL is insert, update or delete, the original field of the original SQL is replaced with an encrypted field, an auxiliary query field and a fuzzy query field are added, and the data corresponding to the SQL is encrypted into ciphertext data.

[0015] According to a second aspect of the present invention, a general database transparent encryption system is provided, the system includes a transparent encryption server, the transparent encryption server is used to: create an initial encryption policy, obtain database list fields from a database and classify and grade the obtained database list fields; perform initial encryption policy association processing and integrity processing on the classified and graded database list fields in turn to obtain pre-processed database list fields; perform historical data cleansing on the pre-processed database list fields, and create an encryption policy by updating the pre-processed database list fields that have been cleaned with historical data; periodically synchronize and cache the encryption policy after accessing the service, and use the locally cached encryption policy to encrypt and decrypt data.

[0016] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0017] The general database transparent encryption method and system of the present invention have the following beneficial technical effects: 1. Supports deployment on and off the cloud, provides support for different business systems, and supports multiple database types.

[0018] 2. The service side integrates key management, which supports a variety of hardware encryption machines and plug-in mechanisms, allowing for rapid integration and flexible expansion.

[0019] 3. The service side classifies and grades the collected fields and displays the classified and graded field data to the user. The user can intuitively determine which field data in the business needs to be encrypted, making it convenient for the user to select the business fields to be encrypted.

[0020] 4. Flexible business access methods, supporting the ability to integrate data encryption without modifying business logic. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 This is a diagram showing an example of the architecture of a general database transparent encryption system according to an embodiment of the present invention; Figure 2 Another example diagram of the architecture of a general database transparent encryption system according to an embodiment of the present invention; Figure 3A flowchart of a general database transparent encryption method according to an embodiment of the present invention; Figure 4 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0023] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0024] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0025] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0026] The technical principles of the present invention are as follows: The general database transparent encryption system of this embodiment includes a data transparent encryption service (TDES), a data transparent encryption service agent (TDEA), a data transparent encryption agent (TDEP) and a data transparent encryption SDK, and supports databases such as MySQL, SQLServer, PostgreSQL, GreenPlum, ClickHouse, Oracle and SQLServer that are accessed using JDBC. The data transparent encryption service obtains the original field information of the database based on the data transparent encryption service agent, and displays the fields to the user on the service side according to the data classification and grading. The user determines the fields to be encrypted based on the collection results, and binds the fields to the encryption policy. The historical data is cleaned on the service side to ensure that the historical data can be used normally after the business access. The business can use agent access or SDK access. When the agent access is used, the business party can use it directly without modifying the business logic. The SDK business needs to modify the code, which is more flexible to use. The agent and SDK synchronize the policy to the business local through the policy synchronization mechanism and encrypt the storage. After the business party accesses, the policy automatically takes effect to realize the encryption and decryption of the field. The system supports cloud and cloud deployment to meet different business needs.

[0027] In the present invention, TDEA is an execution unit, which includes field scanning and data cleaning functions. The database user and password are configured in the configuration file, the agent is started, the agent is directly connected to the user database, and the scanning instruction issued by TDES is received. The scanning of the database field is completed, and all field information of the specified database is returned, including the field name, field type, field length, field comment, and whether it is the primary key, etc. The data cleaning instruction issued by TDES is received, the specified encrypted field data is encrypt, the ciphertext data is written into the ciphertext field, and the fuzzy query field and the auxiliary query field are updated at the same time.

[0028] In the present invention, TDES is a background service that provides encryption policy management, encryption key management, and classification and grading of field data, provides interface support for the management interface, and issues original database field collection and data cleaning instructions to TDEA.

[0029] The present invention deploys TDEA, and TDES connects TDEA to create an encryption policy. The initial encryption policy is associated with the encryption key and encryption field, and the data cleaning task is performed to ensure that the historical data is correctly encrypted and the data can be used normally after the service is connected; when the business is connected, the business can use the agent TDEP or SDK. The two methods are based on the same core implementation and the core functions remain consistent. In the business operation stage, the agent or SDK will periodically synchronize the policy from the server according to the policy synchronization mechanism during the operation process and use the latest policy. The business data executes SQL to complete the database operation, and the database data in the database is ciphertext.

[0030] Figure 1 FIG. 1 is a diagram showing an example of the architecture of a general database transparent encryption system according to an embodiment of the present invention. Figure 1 As shown, the system may include a transparent encryption server 101, a communication network 102 and / or one or more transparent encryption clients 103. Figure 1 The example shown is a plurality of transparent encryption clients 103 .

[0031] The transparent encryption server 101 can be any appropriate server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the transparent encryption server 101 can perform appropriate functions. For example, in some embodiments, the transparent encryption server 101 can be used for transparent encryption of databases. As an optional example, in some embodiments, the transparent encryption server 101 can be used to: create an initial encryption policy, obtain database list fields from a database and classify and grade the obtained database list fields; perform initial encryption policy association processing and integrity processing on the classified and graded database list fields in turn to obtain pre-processed database list fields; perform historical data cleaning on the pre-processed database list fields, and create an encryption policy by updating the pre-processed database list fields that have been cleaned with historical data; periodically synchronize and cache encryption policies after accessing the service, and use locally cached encryption policies to encrypt and decrypt data.

[0032] As another example, in some embodiments, the transparent encryption server 101 may send the general database transparent encryption method to the transparent encryption client 103 for the user to use according to the request of the transparent encryption client 103 .

[0033] As an optional example, in some embodiments, the transparent encryption client 103 is used to provide a visual transparent encryption interface, which is used to receive a user's general database transparent encryption selection input operation, and, in response to the selection input operation, obtain the transparent encryption interface corresponding to the option selected by the selection input operation from the transparent encryption server 101 and display the transparent encryption interface, wherein the transparent encryption interface at least displays general database transparent encryption information and operation options for the general database transparent encryption information.

[0034] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The transparent encryption client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the transparent encryption server 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the transparent encryption client 103 and the transparent encryption server 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.

[0035] The transparent encryption client 103 may include any one or more clients that present an interface related to the general database transparent encryption in an appropriate form for use and operation by a user. In some embodiments, the transparent encryption client 103 may include any suitable type of device. For example, in some embodiments, the transparent encryption client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0036] Although the transparent encryption server 101 is illustrated as one device, in some embodiments, any suitable number of devices may be used to perform the functions performed by the transparent encryption server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the transparent encryption server 101. Alternatively, the functions of the transparent encryption server 101 may be implemented using a cloud service.

[0037] Figure 2 FIG. 2 is another example diagram of the architecture of a general database transparent encryption system according to an embodiment of the present invention; Figure 2 As shown, as an optional example, the universal database transparent encryption system of this embodiment includes the following components: 1. TDES (Data Transparency Encryption Service), including: Policy management module: defines encryption algorithms, key rotation cycles, access control, encryption field management, etc.; key management module: generates, stores, distributes and destroys keys; data classification and grading module: automatically classifies data based on predefined rules; field collection module: interacts with TDEA to obtain database field information; data cleaning module: coordinates TDEA to encrypt historical data; API interface layer: provides RESTful API for other components to call.

[0038] 2. TDEA (Data Transparent Encryption Service Agent), including: Database connection module: supports multiple database connection methods; field scanning module: analyzes database structure and identifies potential sensitive fields; data cleaning execution module: executes cleaning tasks issued by TDES.

[0039] 3. TDEP (Data Transparent Encryption Proxy), including: Policy synchronization module: regularly synchronize the latest policies from TDES; local policy storage: use a secure method to store encryption policies locally; SQL parsing module: analyze and rewrite SQL queries; encryption and decryption module: encrypt and decrypt data in real time according to policies; connection pool management: optimize database connection performance.

[0040] 4. Data transparent encryption SDK, including: Lightweight policy synchronization and execution module: similar to TDEP, but more suitable for embedded applications; encryption and decryption API: provides a simple interface for application calls; configuration management module: allows developers to customize SDK behavior.

[0041] Based on the above system, an embodiment of the present invention provides a general database transparent encryption method, which is described below through the following embodiments.

[0042] Figure 3 FIG. 1 is a flowchart of a method for transparently encrypting a general database according to an embodiment of the present invention. The method for transparently encrypting a general database according to the present embodiment can be executed at a transparent encryption server, such as Figure 3 As shown, the general database transparent encryption method includes the following steps: Step S201: Create an initial encryption strategy, obtain database list fields from a database, and classify and grade the obtained database list fields.

[0043] As an optional example, this embodiment creates an encryption key and an initial policy through TDES, associates the created encryption key with the initial policy, and obtains the initial encryption policy. This embodiment configures the encryption algorithm through TDES to create an encryption key. The name of the initial policy is created when the initial policy is created. The TDES of this embodiment is also used to configure the database name, IP, user name and password of the target database. It should be noted that this embodiment uses a multi-layer key structure such as a master key and a data encryption key; the key is automatically updated regularly through key rotation to improve security; and the key availability and disaster recovery are ensured through key backup and recovery.

[0044] The TDES of this embodiment calls TDEA by issuing instructions, and TDES calls TDEA to scan the database, obtain the database list, and select the database according to the obtained database list; TDES calls TDEA to scan the database table of the selected database, obtain the database table list, and select the list according to the obtained database table list; TDES calls TDEA to scan the selected list and obtain the database list field. For example, the information of the database list field in this embodiment includes the field name, type, length, comment, and whether it is a primary key.

[0045] After obtaining the database list fields, this embodiment classifies and grades the obtained database list fields, and sends the classification and grading results to the user. For example, the field classification of this embodiment may include: regular fields, internal fields, sensitive fields, and confidential fields; field grading includes: personal sensitive information, etc. It should be noted that this embodiment classifies and grades the obtained database list fields through a data classification and grading algorithm, including but not limited to a pattern matching algorithm based on regular expressions or a user-defined rule algorithm.

[0046] Step S202: performing initial encryption policy association processing and integrity processing on the classified and graded database list fields in sequence to obtain pre-processed database list fields.

[0047] As an optional example, in this embodiment, the user selects a field based on the classification and grading results, associates the selected field with the initial encryption policy through TDES calling TDEA, and adds encrypted fields, auxiliary query fields, and fuzzy query fields to the fields associated with the initial encryption policy. In this embodiment, different encryption policies are allowed to be applied to specific fields, and the added encrypted fields, auxiliary query fields, and fuzzy query fields can be flexibly set and deleted according to the actual application scenario. The value of the encrypted field is the ciphertext of the original field. The fuzzy query field is used to solve the problem that ciphertext data cannot be fuzzily queried, and the auxiliary query field is used to improve the efficiency of the query.

[0048] Step S203: perform historical data cleaning on the pre-processing database list field, and create an encryption strategy by updating the pre-processing database list field that has undergone historical data cleaning.

[0049] The fields associated with the initial encryption policy contain historical data in the database. These data have not been encrypted and are in plain text, so they need to be encrypted. As an optional example, this embodiment calls TDEA through TDES to encrypt the historical data corresponding to the preprocessing database list field in the database. An encryption policy is created by calling TDEA through TDES to clean the encrypted fields, auxiliary query fields, and fuzzy query fields in the preprocessing database list field after historical data cleaning. It should be noted that the encryption policy created in this embodiment supports multiple encryption algorithms including but not limited to AES, RSA, and national encryption algorithms.

[0050] Step S204: After accessing the service, periodically synchronize and cache the encryption policy, and use the locally cached encryption policy to encrypt and decrypt data.

[0051] The data transparent encryption agent is an independent application service that can be directly connected to the original database and implements data encryption without modifying the application code. The core functions provided by the data transparent encryption SDK are the same as those of the agent. The difference is that when using the data transparent encryption SDK, the business needs to modify the code.

[0052] This embodiment accesses the service through a data transparent encryption SDK or a data transparent encryption agent, periodically synchronizes encryption policies from TDES, locally caches the synchronized encryption policies, and uses the locally cached encryption policies to encrypt and decrypt data.

[0053] As an optional example, after accessing the business, the original SQL of the business data is parsed to obtain the database, field, action and data corresponding to the field operated in the SQL. In this embodiment, the corresponding syntax tree is selected for parsing according to different database types.

[0054] By querying the encryption policy of the local cache, it is determined whether the original SQL contains an encrypted field. When the original SQL does not contain an encrypted field, the original SQL is rewritten and encrypted. For example, in this embodiment, the rewriting and encryption of the original SQL is performed in the following manner: when the operation in the SQL is insert, update, or delete, the original field of the original SQL is replaced with an encrypted field, an auxiliary query field and a fuzzy query field are added, and the data corresponding to the SQL is encrypted into ciphertext data. The rewritten and encrypted SQL is sent to the database for execution, and the execution results are merged. By decrypting and querying the merged execution results, the original data corresponding to the encrypted field is obtained.

[0055] The general database transparent encryption method and system according to the embodiments of the present invention have the following beneficial technical effects: 1. Supports deployment on and off the cloud, provides support for different business systems, and supports multiple database types.

[0056] 2. The service side integrates key management, which supports a variety of hardware encryption machines and plug-in mechanisms, allowing for rapid integration and flexible expansion.

[0057] 3. The service side classifies and grades the collected fields and displays the classified and graded field data to the user. The user can intuitively determine which field data in the business needs to be encrypted, making it convenient for the user to select the business fields to be encrypted.

[0058] 4. Flexible business access methods, supporting the ability to integrate data encryption without modifying business logic.

[0059] like Figure 4 As shown, the present invention further provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a computer program executable by the processor, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned general database transparent encryption method by running the executable computer program.

[0060] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0061] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0062] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0063] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A general database transparent encryption method, characterized in that: The method comprises: Create an initial encryption strategy, obtain database list fields from the database and classify and grade the obtained database list fields; Performing initial encryption policy association processing and integrity processing on the classified and graded database list fields in sequence to obtain pre-processed database list fields; Perform historical data cleansing on the preprocessing database list fields, and create an encryption strategy by updating the preprocessing database list fields that have undergone historical data cleansing; After accessing the service, the encryption policy is periodically synchronized and cached, and the locally cached encryption policy is used to encrypt and decrypt data.

2. The general database transparent encryption method according to claim 1, characterized in that: Creating an initial encryption policy includes: creating an encryption key and an initial policy through TDES, associating the created encryption key with the initial policy, and obtaining the initial encryption policy.

3. The general database transparent encryption method according to claim 1, characterized in that: Obtain database list fields from a database and classify and grade the obtained database list fields, including: Call TDEA to scan the database through TDES, obtain the database list, and select the database according to the obtained database list; Call TDEA through TDES to scan the database tables of the selected database, obtain the database table list, and select the list according to the obtained database table list; Call TDEA through TDES to scan the selected list, obtain the database list fields, classify and grade the obtained database list fields, and send the classification and grading results to the user.

4. The general database transparent encryption method according to claim 1, characterized in that: The classified and graded database list fields are subjected to initial encryption policy association processing and integrity processing to obtain pre-processed database list fields, including: the user selects fields according to the classification and grading results, and TDES calls TDEA to associate the selected fields with the initial encryption policy, and adds encrypted fields, auxiliary query fields, and fuzzy query fields to the fields associated with the initial encryption policy.

5. The general database transparent encryption method according to claim 1, characterized in that: The historical data of the pre-processing database list fields are cleaned, including: calling TDEA through TDES to encrypt the historical data corresponding to the pre-processing database list fields in the database.

6. The general database transparent encryption method according to claim 1, characterized in that: An encryption strategy is created by updating the pre-processed database list fields that have been cleaned with historical data, including: creating an encryption strategy by calling the encrypted fields, auxiliary query fields and fuzzy query fields in the pre-processed database list fields that have been cleaned with historical data by TDES.

7. The general database transparent encryption method according to claim 1, characterized in that: After accessing the service, encryption policies are periodically synchronized and cached, and locally cached encryption policies are used for data encryption and decryption, including: accessing the service through a data transparent encryption SDK or a data transparent encryption agent, periodically synchronizing encryption policies from TDES, locally caching the synchronized encryption policies, and using locally cached encryption policies for data encryption and decryption.

8. The general database transparent encryption method according to claim 1, characterized in that: Access the service through the data transparent encryption SDK or data transparent encryption agent, periodically synchronize encryption policies from TDES, cache the synchronized encryption policies locally, and use the locally cached encryption policies to encrypt and decrypt data, including: After accessing the business, parse the original SQL of the business data to obtain the database, field, action and data corresponding to the field operated in the SQL; By querying the encryption policy of the local cache, it is determined whether the original SQL contains encrypted fields. If the original SQL does not contain encrypted fields, the original SQL is rewritten and encrypted. The rewritten encrypted SQL is sent to the database for execution, the execution results are merged, and the original data corresponding to the encrypted fields is obtained by decrypting and querying the merged execution results.

9. The general database transparent encryption method according to claim 8, characterized in that: When the original SQL does not contain encrypted fields, the original SQL is rewritten and encrypted, including: when the operation in the SQL is insert, update or delete, the original fields of the original SQL are replaced with encrypted fields, auxiliary query fields and fuzzy query fields are added, and the data corresponding to the SQL is encrypted into ciphertext data.

10. A general database transparent encryption system, characterized in that: The system includes a transparent encryption server, which is used to: create an initial encryption policy, obtain database list fields from a database and classify and grade the obtained database list fields; perform initial encryption policy association processing and integrity processing on the classified and graded database list fields in sequence to obtain pre-processed database list fields; Perform historical data cleansing on the preprocessing database list fields, and create an encryption strategy by updating the preprocessing database list fields that have undergone historical data cleansing; After accessing the service, the encryption policy is periodically synchronized and cached, and the locally cached encryption policy is used to encrypt and decrypt data.

Images