A method, device and system for encrypting a fully encrypted database

Abstract

The embodiment of the present application provides a method, device and system for encrypting a fully secret database, the system comprising a client and a server, the client is used to determine the data type and sensitivity level of the target data, and determine whether the server has the authority to process the target data; when it is identified that the target processing is not the preset processing, the client obtains the first ciphertext, obtains the first key, and uses the first key to encrypt the target data to obtain the second encrypted data; the server obtains the second ciphertext from the management end through a trusted environment, and obtains the first key; the second encrypted data is decrypted using the first key through the trusted environment to obtain the target data, and the target data is subjected to target processing through the trusted environment as the processing result. Applying the technical solution provided by the embodiment of the present application, it is possible to make data exist in the form of ciphertext in a non-trusted environment at all stages of the entire life cycle.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method, device and system for encrypting a fully secret database. Background Art

[0002] With the deepening of the digital age, the importance of data has become increasingly prominent, and the leakage of privacy data will bring serious consequences. Therefore, as data security threats increase, people's requirements for data security are also increasing.

[0003] Based on this, various methods for storing data in a confidential state have been designed in related technologies, but these methods cannot achieve the existence of encrypted data in an untrusted environment throughout the entire life cycle of data (including data generation, processing, transmission, calculation, storage, etc.). Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a method, device and system for encrypting a fully encrypted database, so as to enable data to exist in ciphertext form in an untrusted environment at all stages of the entire life cycle. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present application provides a fully secret database encryption system, the system comprising a client and a server; the server pre-registers first identity information and first permission information of the server with a corresponding management terminal;

[0006] The client is used to obtain and identify whether the target data to be sent to the server is private data; if the target data is private data, determine the data type and sensitivity level of the target data; and identify the target processing to be performed on the server after the target data is sent to the server;

[0007] The client is further configured to determine whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end;

[0008] The client is further used to identify whether the target processing is a preset processing;

[0009] When the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing,

[0010] The client is further configured to encrypt the target data to obtain first encrypted data, and send the first encrypted data to the server;

[0011] The server is used to perform the target processing on the first encrypted data to obtain a processing result;

[0012] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing,

[0013] The client is further configured to obtain a first ciphertext from the management end, wherein the first ciphertext is a ciphertext of the first key obtained by the management end encrypting the first key using the public key of the client; decrypt the first ciphertext using the private key of the client to obtain the first key, and encrypt the target data using the first key to obtain second encrypted data; and send the second encrypted data to the service end;

[0014] The server is further configured to send the second identity information of the server to the management end in response to the second encrypted data, so that the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal. If the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, where the second ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end;

[0015] The server is further configured to decrypt the second ciphertext using the private key of the server through the trusted environment to obtain the first key; decrypt the second encrypted data using the first key through the trusted environment to obtain the target data, and perform the target processing on the target data through the trusted environment as a processing result of performing the target processing on the target data;

[0016] Wherein, when the processing result is private data, the server is further used to store the processing result in a confidential form on the server.

[0017] In some embodiments, the second encrypted data includes third encrypted data and third ciphertext, and the third encrypted data and the third ciphertext are obtained in the following manner:

[0018] The client encrypts the target data using the second key to obtain the third encrypted data;

[0019] The client uses the first key to encrypt the second key to obtain the third ciphertext;

[0020] The server uses the first key to decrypt the second encrypted data through the trusted environment to obtain the target data, including:

[0021] The server uses the first key to decrypt the third ciphertext through the trusted environment to obtain the second key;

[0022] The server uses the second key to decrypt the third encrypted data through the trusted environment to obtain the target data.

[0023] In some embodiments, the client pre-registers the third identity information and the third authority information of the client in the corresponding management terminal, and the client obtains the first ciphertext from the management terminal, including:

[0024] The client sends the fourth identity information of the client to the management end; so that the management end verifies whether the management end has stored the fourth identity information and whether the fourth authority information corresponding to the fourth identity information is normal. If the management end has stored the fourth identity information and the fourth authority information corresponding to the fourth identity information is normal, the management end uses the public key of the client to encrypt the first key to obtain the first ciphertext, and sends the first ciphertext to the client.

[0025] In some embodiments, the client has pre-registered the third identity information and the third permission information of the client at the management end; when the processing result is private data,

[0026] The server is further configured to send the fifth identity information of the server to the management end, so that the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the server obtains a fourth ciphertext from the management end through a trusted environment, where the fourth ciphertext is a ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server.

[0027] The server is further configured to decrypt the fourth ciphertext using the private key of the server through the trusted environment to obtain the third key; and encrypt the processing result using the third key through the trusted environment to obtain a first encrypted result; and send the first encrypted result to the client;

[0028] The client is further configured to send the sixth identity information of the client to the management end in response to the first encryption result; so that the management end verifies whether the management end stores the sixth identity information and whether the sixth permission information corresponding to the sixth identity information is normal; if the management end stores the sixth identity information and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext, and sends the fifth ciphertext to the client;

[0029] The client is further used to use the private key of the client to decrypt the fifth ciphertext to obtain the third key; and use the third key to decrypt the first encryption result to obtain the processing result.

[0030] In some embodiments, the first encryption result includes a second encryption result and a sixth ciphertext, and the second encryption result and the sixth ciphertext are obtained in the following manner:

[0031] The server encrypts the processing result using a fourth key through the trusted environment to obtain the second encrypted result;

[0032] The server encrypts the fourth key using the third key through the trusted environment to obtain the sixth ciphertext;

[0033] The client uses the third key to decrypt the first encryption result to obtain the processing result, including:

[0034] The client uses the third key to decrypt the sixth ciphertext to obtain the fourth key;

[0035] The client uses the fourth key to decrypt the second encryption result to obtain the processing result.

[0036] In some embodiments, the server stores the processing result in a secret form on the server, including:

[0037] The server is further configured to dynamically intercept a storage instruction for the processing result; encrypt the processing result to obtain a third encrypted result, and store the third encrypted result;

[0038] The server is also used to dynamically intercept a read instruction for the processing result; and read the third encryption result, decrypt the third encryption result, and obtain the processing result.

[0039] In some embodiments, the client is further used to embed the data type and sensitivity level of the target data into a message header extension field of the message carrying the target data;

[0040] The client determines, according to the first permission information of the server sent by the client, the data type and sensitivity level of the target data, and the target processing, whether the server has the permission to process the target data, including:

[0041] The client is also used to determine whether the server has the authority to process the target data based on the first authority information of the server sent by the management end, the data type and sensitivity level of the target data in the message header extension field, and the target processing.

[0042] In some embodiments, the client encrypts the target data to obtain first encrypted data, including:

[0043] If the target processing is to compare the size, the client is specifically used to encrypt the target data using order-preserving encryption OPE or searchable symmetric encryption ORE;

[0044] If the target processing is a picture similarity search, the client is specifically used to encrypt the target data using a perceptual hash algorithm;

[0045] If the target processing is addition, subtraction, multiplication, division, or average operation, the client is specifically used to encrypt the target data using homomorphic encryption.

[0046] In some embodiments,

[0047] The client is further used to determine a target encryption unit from multiple encryption units according to a preset load balancing algorithm; and use the target encryption unit to encrypt data to be encrypted;

[0048] The management end is also used to write real-time key negotiation information into the key information block of the blockchain of the management end; the key negotiation information includes negotiation participants, key negotiation protocol process, and key attribute information.

[0049] In some embodiments, the server pre-registers the first identity information and the first authority information of the server with the management end, including:

[0050] The server has pre-registered the first identity information and the first permission information of the server in the identity information block of the blockchain of the management end;

[0051] The client pre-registers the third identity information and the third authority information of the client in the management end, including:

[0052] The client pre-registers the third identity information and the third permission information of the client in the identity information block of the blockchain of the management end.

[0053] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0054] The server is further configured to send the seventh identity information of the server and business-related meta-attribute information to the management end, and send the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server; so that the management end obtains the first authority information and the first identity information of the server; and registers the first authority information and the first identity information accordingly; and sends the first identity information to the server;

[0055] The service-related meta-attribute information includes: server identification, CPU identification, basic input / output system identification, operating system identification, database identification, service information, and signature public key.

[0056] In a second aspect, the embodiment of the present application further provides a fully secret database encryption method, which is applied to a fully secret database encryption system, wherein the system includes a client and a server; the server pre-registers the first identity information and the first permission information of the server with the management end;

[0057] The client obtains and identifies whether the target data to be sent to the server is private data; if the target data is private data, determines the data type and sensitivity level of the target data; and identifies the target processing to be performed on the server after the target data is sent to the server;

[0058] The client determines whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end;

[0059] The client identifies whether the target processing is a preset processing;

[0060] When the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing,

[0061] The client encrypts the target data to obtain first encrypted data, and sends the first encrypted data to the server;

[0062] The server performs the target processing on the first encrypted data to obtain a processing result;

[0063] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing,

[0064] The client obtains a first ciphertext from the management end, where the first ciphertext is a ciphertext of the first key obtained by the management end encrypting the first key with the public key of the client; decrypts the first ciphertext with the private key of the client to obtain the first key, and encrypts the target data with the first key to obtain second encrypted data; and sends the second encrypted data to the service end;

[0065] The server sends the second identity information of the server to the management end in response to the second encrypted data, so that the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal. If the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, where the second ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end.

[0066] The server uses the private key of the server to decrypt the second ciphertext through the trusted environment to obtain the first key; uses the first key to decrypt the second encrypted data through the trusted environment to obtain the target data, and performs the target processing on the target data through the trusted environment as a processing result of performing the target processing on the target data;

[0067] When the processing result is private data, the server stores the processing result in a confidential form on the server.

[0068] In some embodiments, the second encrypted data includes third encrypted data and third ciphertext, and the third encrypted data and the third ciphertext are obtained in the following manner:

[0069] The client encrypts the target data using the second key to obtain the third encrypted data;

[0070] The client uses the first key to encrypt the second key to obtain the third ciphertext;

[0071] The server uses the first key to decrypt the second encrypted data through the trusted environment to obtain the target data, including:

[0072] The server uses the first key to decrypt the third ciphertext through the trusted environment to obtain the second key;

[0073] The server uses the second key to decrypt the third encrypted data through the trusted environment to obtain the target data.

[0074] In some embodiments, the client pre-registers the third identity information and the third authority information of the client in the corresponding management terminal, and the client obtains the first ciphertext from the management terminal, including:

[0075] The client sends the fourth identity information of the client to the management end; so that the management end verifies whether the management end has stored the fourth identity information and whether the fourth authority information corresponding to the fourth identity information is normal. If the management end has stored the fourth identity information and the fourth authority information corresponding to the fourth identity information is normal, the management end uses the public key of the client to encrypt the first key to obtain the first ciphertext, and sends the first ciphertext to the client.

[0076] In some embodiments, the client has pre-registered the third identity information and the third permission information of the client at the management end; when the processing result is private data,

[0077] The server sends the fifth identity information of the server to the management end; so that the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the server obtains a fourth ciphertext from the management end through a trusted environment, and the fourth ciphertext is a ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server end;

[0078] The server uses the private key of the server to decrypt the fourth ciphertext through the trusted environment to obtain the third key; and encrypts the processing result through the trusted environment using the third key to obtain a first encrypted result; and sends the first encrypted result to the client;

[0079] The client sends the sixth identity information of the client to the management end in response to the first encryption result; so that the management end verifies whether the management end stores the sixth identity information and whether the sixth permission information corresponding to the sixth identity information is normal. If the management end stores the sixth identity information and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext, and sends the fifth ciphertext to the client;

[0080] The client uses the private key of the client to decrypt the fifth ciphertext to obtain the third key; and uses the third key to decrypt the first encryption result to obtain the processing result.

[0081] In some embodiments, the first encryption result includes a second encryption result and a sixth ciphertext, and the second encryption result and the sixth ciphertext are obtained in the following manner:

[0082] The server encrypts the processing result using a fourth key through the trusted environment to obtain the second encrypted result;

[0083] The server encrypts the fourth key using the third key through the trusted environment to obtain the sixth ciphertext;

[0084] The client uses the third key to decrypt the first encryption result to obtain the processing result, including:

[0085] The client uses the third key to decrypt the sixth ciphertext to obtain the fourth key;

[0086] The client uses the fourth key to decrypt the second encryption result to obtain the processing result.

[0087] In some embodiments, the server stores the processing result in a secret form on the server, including:

[0088] The server dynamically intercepts a storage instruction for the processing result; encrypts the processing result to obtain a third encrypted result, and stores the third encrypted result;

[0089] The server dynamically intercepts a read instruction for the processing result; and reads the third encryption result, decrypts the third encryption result, and obtains the processing result.

[0090] In some embodiments, the client embeds the data type and sensitivity level of the target data into a message header extension field of a message carrying the target data;

[0091] The client determines, according to the first permission information of the server sent by the client, the data type and sensitivity level of the target data, and the target processing, whether the server has the permission to process the target data, including:

[0092] The client determines whether the server has the authority to process the target data based on the first authority information of the server sent by the management end, the data type and sensitivity level of the target data in the message header extension field, and the target processing.

[0093] In some embodiments, the client encrypts the target data to obtain first encrypted data, including:

[0094] If the target processing is to compare the size, the client uses order-preserving encryption OPE or searchable symmetric encryption ORE to encrypt the target data;

[0095] If the target processing is image similarity search, the client uses a perceptual hash algorithm to encrypt the target data;

[0096] If the target processing is addition, subtraction, multiplication, division, or average operation, the client uses homomorphic encryption to encrypt the target data.

[0097] In some embodiments, the client determines a target encryption unit from a plurality of encryption units according to a preset load balancing algorithm; and uses the target encryption unit to encrypt data to be encrypted;

[0098] The management end writes real-time key negotiation information into the key information block of the blockchain of the management end; the key negotiation information includes negotiation participants, key negotiation protocol process, and key attribute information.

[0099] In some embodiments, the server pre-registers the first identity information and the first authority information of the server with the management end, including:

[0100] The server has pre-registered the first identity information and the first permission information of the server in the identity information block of the blockchain of the management end;

[0101] The client pre-registers the third identity information and the third authority information of the client in the management end, including:

[0102] The client pre-registers the third identity information and the third permission information of the client in the identity information block of the blockchain of the management end.

[0103] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0104] The server sends the seventh identity information of the server and the meta-attribute information related to the business to the management end, and sends the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server; so that the management end obtains the first authority information and the first identity information of the server; and registers the first authority information and the first identity information accordingly; and sends the first identity information to the server;

[0105] The service-related meta-attribute information includes: server identification, CPU identification, basic input / output system identification, operating system identification, database identification, service information, and signature public key.

[0106] In a third aspect, the embodiment of the present application further provides a fully secret database encryption device, which is applied to a fully secret database encryption system, wherein the fully secret database encryption system includes a client and a server; the server pre-registers the first identity information and the first permission information of the server in the corresponding management end; the device includes,

[0107] A first identification module is used to drive the client to obtain and identify whether the target data to be sent to the server is private data; if the target data is private data, determine the data type and sensitivity level of the target data; and identify the target processing to be performed on the server after the target data is sent to the server;

[0108] a determination module, configured to drive the client to determine whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end;

[0109] A second identification module, used to drive the client to identify whether the target processing is a preset processing;

[0110] When the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing,

[0111] An encryption module, used for driving the client to encrypt the target data to obtain first encrypted data, and sending the first encrypted data to the server;

[0112] An execution module, used for driving the server to execute the target processing on the first encrypted data to obtain a processing result;

[0113] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing,

[0114] The encryption module is further used to drive the client to obtain a first ciphertext from the management end, where the first ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key with the public key of the client; decrypt the first ciphertext with the private key of the client to obtain the first key, and encrypt the target data with the first key to obtain second encrypted data; and send the second encrypted data to the service end;

[0115] a verification module, used to drive the server to send the second identity information of the server to the management end in response to the second encrypted data; so that the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal; if the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the server obtains a second ciphertext from the management end through a trusted environment, where the second ciphertext is a ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end;

[0116] a decryption module, configured to drive the server to decrypt the second ciphertext using the private key of the server through the trusted environment to obtain the first key; decrypt the second encrypted data using the first key through the trusted environment to obtain the target data, and perform the target processing on the target data through the trusted environment as a processing result of performing the target processing on the target data;

[0117] The storage module is used for storing the processing result in a confidential form on the server side when the processing result is private data.

[0118] In some embodiments, the second encrypted data includes third encrypted data and third ciphertext, and the third encrypted data and the third ciphertext are obtained in the following manner:

[0119] The client encrypts the target data using the second key to obtain the third encrypted data;

[0120] The client uses the first key to encrypt the second key to obtain the third ciphertext;

[0121] The server uses the first key to decrypt the second encrypted data through the trusted environment to obtain the target data, including:

[0122] The server uses the first key to decrypt the third ciphertext through the trusted environment to obtain the second key;

[0123] The server uses the second key to decrypt the third encrypted data through the trusted environment to obtain the target data.

[0124] In some embodiments, the encryption module is specifically used to:

[0125] The client sends the fourth identity information of the client to the management end; so that the management end verifies whether the management end has stored the fourth identity information and whether the fourth authority information corresponding to the fourth identity information is normal. If the management end has stored the fourth identity information and the fourth authority information corresponding to the fourth identity information is normal, the management end uses the public key of the client to encrypt the first key to obtain the first ciphertext, and sends the first ciphertext to the client.

[0126] In some embodiments, the client has pre-registered the third identity information and the third permission information of the client at the management end; when the processing result is private data,

[0127] The verification module is further used to drive the server to send the fifth identity information of the server to the management end; so that the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the server obtains a fourth ciphertext from the management end through a trusted environment, and the fourth ciphertext is a ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server end;

[0128] The encryption module is further used to drive the server to decrypt the fourth ciphertext using the private key of the server through the trusted environment to obtain the third key; and to encrypt the processing result using the third key through the trusted environment to obtain a first encryption result; and send the first encryption result to the client;

[0129] The verification module is further used to drive the client to send the sixth identity information of the client to the management end in response to the first encryption result; so that the management end verifies whether the management end stores the sixth identity information and whether the sixth permission information corresponding to the sixth identity information is normal. If the management end stores the sixth identity information and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext, and sends the fifth ciphertext to the client;

[0130] The decryption module is also used for the client to use the client's private key to decrypt the fifth ciphertext to obtain the third key; and use the third key to decrypt the first encryption result to obtain the processing result.

[0131] In some embodiments, the first encryption result includes a second encryption result and a sixth ciphertext, and the second encryption result and the sixth ciphertext are obtained in the following manner:

[0132] The server encrypts the processing result using a fourth key through the trusted environment to obtain the second encrypted result;

[0133] The server encrypts the fourth key using the third key through the trusted environment to obtain the sixth ciphertext;

[0134] The client uses the third key to decrypt the first encryption result to obtain the processing result, including:

[0135] The client uses the third key to decrypt the sixth ciphertext to obtain the fourth key;

[0136] The client uses the fourth key to decrypt the second encryption result to obtain the processing result.

[0137] In some embodiments, the storage module is specifically configured to:

[0138] The server dynamically intercepts a storage instruction for the processing result; encrypts the processing result to obtain a third encrypted result, and stores the third encrypted result;

[0139] The server dynamically intercepts a read instruction for the processing result; and reads the third encryption result, decrypts the third encryption result, and obtains the processing result.

[0140] In some embodiments, the client embeds the data type and sensitivity level of the target data into a message header extension field of a message carrying the target data;

[0141] The client determines, according to the first permission information of the server sent by the client, the data type and sensitivity level of the target data, and the target processing, whether the server has the permission to process the target data, including:

[0142] The client determines whether the server has the authority to process the target data based on the first authority information of the server sent by the management end, the data type and sensitivity level of the target data in the message header extension field, and the target processing.

[0143] In some embodiments, the encryption module is specifically used to:

[0144] If the target processing is to compare the size, the client uses order-preserving encryption OPE or searchable symmetric encryption ORE to encrypt the target data;

[0145] If the target processing is image similarity search, the client uses a perceptual hash algorithm to encrypt the target data;

[0146] If the target processing is addition, subtraction, multiplication, division, or average operation, the client uses homomorphic encryption to encrypt the target data.

[0147] In some embodiments, the client determines a target encryption unit from a plurality of encryption units according to a preset load balancing algorithm; and uses the target encryption unit to encrypt data to be encrypted;

[0148] The management end writes real-time key negotiation information into the key information block of the blockchain of the management end; the key negotiation information includes negotiation participants, key negotiation protocol process, and key attribute information.

[0149] In some embodiments, the server pre-registers the first identity information and the first authority information of the server with the management end, including:

[0150] The server has pre-registered the first identity information and the first permission information of the server in the identity information block of the blockchain of the management end;

[0151] The client pre-registers the third identity information and the third authority information of the client in the management end, including:

[0152] The client pre-registers the third identity information and the third permission information of the client in the identity information block of the blockchain of the management end.

[0153] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0154] The server sends the seventh identity information of the server and the meta-attribute information related to the business to the management end, and sends the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server; so that the management end obtains the first authority information and the first identity information of the server; and registers the first authority information and the first identity information accordingly; and sends the first identity information to the server;

[0155] The service-related meta-attribute information includes: server identification, CPU identification, basic input / output system identification, operating system identification, database identification, service information, and signature public key.

[0156] In a fourth aspect, an embodiment of the present application further provides an electronic device, including:

[0157] Memory, used to store computer programs;

[0158] The processor is used to implement any of the above-mentioned data encryption systems when executing the program stored in the memory.

[0159] In a fifth aspect, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above-described data encryption systems.

[0160] Beneficial effects of the embodiments of the present application:

[0161] In the technical solution provided in the embodiment of the present application, before sending the target data to the server, the client first analyzes the target data to determine whether the target data is private data. When it is determined that the target data is private data, the client further determines the data type and sensitivity level of the target data, and determines the operation that the server needs to perform on the target data after the target data is sent to the server, that is, target processing. Thereafter, the server determines whether it has the authority to process the target data in combination with the first permission information of the server obtained from the client. When the server has the authority to process the target data, the server executes the subsequent step of sending the target data to the server, thereby reducing the possibility of data leakage.

[0162] When the client determines that the server has the authority to process the target data, and recognizes that the target processing is a preset processing, the target data is encrypted to obtain the first encrypted data, and then the first encrypted data is directly sent to the server, and the server performs the target processing on the first encrypted data to obtain the processing result. It can be understood that when the target processing is the preset processing, regardless of whether the processed data is ciphertext or plaintext, the processing result obtained is the same. Therefore, when the target processing is the preset processing, the target data is directly encrypted and sent to the server, and the server processes the ciphertext of the target data. In this way, the risk of target data leakage is reduced, and at the same time, the complexity of the calculation is reduced.

[0163] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, the client obtains the first ciphertext from the management end, and uses the client's private key to decrypt the first ciphertext to obtain the first key, and then uses the first key to encrypt the target data to obtain second encrypted data, and then sends the second encrypted data to the server; after the server receives the second encrypted data, in response to the second encrypted data, it sends the second identity information to the management end so that the management end authenticates the server. When the management end determines that the second identity information is stored and the authority information corresponding to the second identity information is normal, the management end uses the server's public key to encrypt the first key to obtain the second ciphertext, and sends the second ciphertext to the server's trusted environment. Then, the server uses its own private key to decrypt the second ciphertext in the trusted environment to obtain the first key. Then, the first encrypted data is decrypted using the first key in the trusted environment to obtain the target data, and then the processing result of the target data is obtained. It can be understood that in the embodiment of the present application, the first key for encrypting the target data is provided by the management end, and the plaintext of the first key and the plaintext of the target data only exist in the form of ciphertext in the trusted environment of the server end. Therefore, even if the target data exists in the form of plaintext on the server end, the risk of leakage is low; after determining the processing result, the processing result is also stored in the form of ciphertext, which also reduces the risk of data leakage. In this way, based on the technical solution provided in the embodiment of the present application, data can exist in the form of ciphertext in a non-trusted environment at all stages of the entire life cycle.

[0164] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0165] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0166] Figure 1 A schematic diagram of the structure of a fully secret database encryption system provided in an embodiment of the present application;

[0167] Figure 2 A schematic diagram of a process flow of the first stage of the fully secret database encryption system provided in an embodiment of the present application;

[0168] Figure 3 A schematic diagram of the first process interaction of the second phase of the fully secret database encryption system provided in an embodiment of the present application;

[0169] Figure 4 A schematic diagram of the second process interaction of the second phase of the fully secret database encryption system provided in an embodiment of the present application;

[0170] Figure 5 A schematic diagram of the third process interaction of the second phase of the fully secret database encryption system provided in an embodiment of the present application;

[0171] Figure 6 A schematic diagram of a process interaction for returning the processing result to the client in a confidential form provided in an embodiment of the present application;

[0172] Figure 7 Another flow interaction diagram for returning the processing result to the client in ciphertext provided in an embodiment of the present application;

[0173] Figure 8 Another structural diagram of the fully secret database encryption system provided in the embodiment of the present application;

[0174] Fig. 9 A schematic diagram of a flow chart of a fully secret database encryption method provided in an embodiment of the present application;

[0175] Fig.10 A schematic diagram of the structure of a fully secret database encryption device provided in an embodiment of the present application;

[0176] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0177] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0178] In social consumption scenarios, many businesses will collect personal sensitive information such as name, mobile phone number, home address, etc. when users register as members, but the collected information may not be stored securely in compliance with regulations. For example, there are some businesses that have collected hundreds of millions of member information and tens of thousands of employee information over the years without storing them securely in compliance with regulations. Once these data are leaked, they may cause irreparable losses. Therefore, it is very important to store data securely in compliance with regulations, especially in untrusted scenarios such as cloud database services. A fully confidential database is needed to keep all data operations from the client to the server in a confidential form to prevent data from being leaked during generation, processing, transmission, calculation, and storage.

[0179] The fully encrypted database is a systematic solution that can completely solve the privacy protection of data throughout its life cycle on the database server side. Its core idea is that when the data leaves the client, the data is encrypted on the client side and sent to the server side in the form of ciphertext. The data is stored in the form of ciphertext on the server side throughout the process and does not affect the retrieval and calculation of the server side, thereby achieving data protection. For example, if the server side needs to obtain data from the client side and compare the size of the obtained data, the data (hereinafter referred to as data plaintext) that the server side needs to obtain can be encrypted on the client side, such as multiplying these data by a preset multiple to obtain the encrypted data (hereinafter referred to as data ciphertext), and then sending the data ciphertext to the server side. At this time, after the server side obtains the data ciphertext, since the data ciphertext is obtained by multiplying the data plaintext by the same multiple, if one data plaintext is larger than another data plaintext, the data ciphertext of the one data plaintext will also be larger than the data ciphertext of the other data plaintext. In other words, the server side can determine the size of each data plaintext by comparing the size of the data ciphertext. Since the server side does not obtain the data plaintext in this process, the data plaintext can be protected. Moreover, in this scenario, the key used to encrypt the plaintext data is usually kept by the client, and the database administrator cannot obtain the plaintext data. Therefore, even if the server data is stolen, the plaintext data cannot be obtained.

[0180] In the related art, there are many methods based on fully encrypted databases to prevent data leakage, which are committed to making data exist in ciphertext in non-trusted environments throughout the entire life cycle (including data production, processing, transmission, calculation, storage and other processes), but the methods in the related art actually only include part of the life cycle, and cannot make data exist in ciphertext in non-trusted environments throughout the entire life cycle. For example, the methods in the related art usually cannot guarantee the security of several dimensions other than "calculation" in the data life cycle; for another example, the methods in the related art can only solve the problem that the front-end calculation of the fully encrypted database occupies memory and consumes a lot of time, but does not strengthen the data security; for another example, there is a fully encrypted database system in the related art, which introduces a mode of installing a security agent on both the database client and the server to intercept and encrypt and decrypt structured statements (Structured Query Language, SQL), but for untrusted cloud service environments, data plaintext will still be exposed. It can be seen that the methods in the related art cannot actually achieve the existence of data in ciphertext in non-trusted environments throughout the entire life cycle.

[0181] Among them, the fully encrypted database divides the life cycle domain of data into a trusted domain and an untrusted domain. The trusted domain is generally the database client, upper-level user program, etc. Data in the trusted domain is considered safe and can be decrypted and expose plaintext information; the untrusted domain is usually the network transmission environment, database server, including the server's memory and hard disk. Data in the untrusted domain must exist in the form of ciphertext throughout the process, otherwise there will be a risk of privacy data leakage. In addition, in the fully encrypted database, a secret computing interface at the SQL operator level is usually provided, through which the database can process data ciphertext.

[0182] In order to realize that data exists in ciphertext form in all stages of the entire life cycle in a non-trusted environment, the embodiment of the present application provides a fully encrypted database encryption system. Figure 1 , Figure 1 A structural diagram of a fully secret database encryption system provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the data encryption system includes a client 11 and a server 12. The client 11 is a data holder, and can also be called a database client; the server 12 is a data user, which is used to process data and can also be called a database server. The client 11 and the server 12 are both software or systems, which can be integrated into the same electronic device or deployed in different electronic devices. Among them, the electronic device can be a server or a terminal device. In actual applications, the terminal device can be a smart phone, a tablet computer, a desktop computer, etc.

[0183] Below, the fully secret database encryption system provided by the embodiment of the present application is described in detail through specific examples.

[0184] It can be understood that the fully secret database encryption system provided in the embodiment of the present application is mainly implemented through two stages to make the data exist in the form of ciphertext in all stages of the entire life cycle in an untrusted environment. Specifically,

[0185] The first stage is that the client performs dynamic interception operations. Specifically, the client analyzes in real time whether the data to be sent to the server is sensitive data (i.e., privacy data), and classifies and grades the sensitive data and performs semantic analysis, and then performs security risk assessment and blocking processing (i.e., dynamic interception operations) based on the processing results, or processes the data in a preset processing method and sends it to the server. For details, please refer to the following Figure 2 Description in .

[0186] The second stage can be divided into two situations. One is that the operation performed by the server on the data (which can be understood as the target data below, that is, the data that needs to be sent from the client to the server for processing) is a preset operation. At this time, the client directly sends the data in a confidential form to the server, and the server processes it. For details, please refer to the following Figure 3 The preset operation can be understood as an operation that can support secret state operations. For example, the operation that the server needs to perform after obtaining data A is operation A, and the processing result obtained by the server performing operation A on the ciphertext of data A is the same as the processing result obtained by the server performing operation A on the plaintext of data A. Then operation A is an operation that can support secret state operations, that is, operation A is a preset operation.

[0187] The other is that the operation performed by the server on the data is not a preset operation. In this case, the client, server, and management end need to conduct real-time identity and authority challenges, as well as trusted environment key negotiation challenges (that is, initiate a key negotiation challenge in a trusted environment). After the real-time identity and authority challenges and the trusted environment key negotiation challenges are passed, the server can decrypt the plaintext data in its own trusted environment, and then process the plaintext data to obtain the processing results, and implement confidential storage of the processing results on the server. Among them, the management end can be understood as a management platform provided by a third party other than the client and the server for negotiating communication between the client and the server. The management end can also be integrated on an electronic device. For details, please refer to the following Figure 4 Description in .

[0188] Next, through Figure 2-Figure 4The two stages of the fully secret database encryption system provided in the embodiment of the present application are explained. It should be noted that the fully secret database encryption system provided in the embodiment of the present application includes a client and a server, and the server has pre-registered first identity information and first authority information of the server in the corresponding management end.

[0189] It can be understood that the server sends its own identification information and trusted environment information and other information that can be used to represent its own identity to the management end in advance. After receiving the information sent by the server, the management end can assign corresponding permission information to the server, and store the identity information of the server and the assigned permission information in the management end accordingly, thereby realizing the first identity information and the first permission information of the corresponding registered server in the management end.

[0190] Specifically, in some embodiments, the server may send the seventh identity information and business-related meta-attribute information to the management end, and send the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server, so that the management end obtains the first authority information and the first identity information of the server; registers the first authority information and the first identity information accordingly; and sends the first identity information to the server.

[0191] Among them, the seventh identity information can be the server's own identification, or a unique identification generated by the server that can represent itself, etc., which can be used to represent the server's own identity; the business-related meta-attribute information can include the server's identification, the central processing unit (CPU) identification, the basic input output system (BIOS) identification, the operating system identification, the database identification, business information, signature public key, etc.; the first identity information and the first permission information pre-registered by the server at the management end can be obtained in the following way: after the management end receives the seventh identity information, business-related meta-attribute information, and trusted environment information of the server, it can generate new identity information for the server based on the seventh identity information, and / or business-related meta-attribute information, and / or trusted environment information, and assign corresponding permission information. The generated identity information can be used as the first identity information, and the permission information assigned to it can be used as the first permission information. The first permission information may be permission information manually assigned to the server by the user based on the seventh identity information, and / or business-related meta-attribute information, and / or trusted environment information sent by the server and received by the management end, or may be permission information assigned to the server by the management end based on a preset permission allocation rule, in combination with the seventh identity information, and / or business-related meta-attribute information, and / or trusted environment information. After obtaining the first identity information, the management end also returns the first identity information to the server end, so that the server end can subsequently perform related operations such as real-time identity permission challenge with the management end through the first identity information.

[0192] In some embodiments, a blockchain module (such as the blockchain smart contract in the following content) is set in the management end, and the first identity information and the first permission information of the server are correspondingly registered in the identity information block of the blockchain of the client.

[0193] In addition, to facilitate the understanding of the subsequent content, the identity information such as the first identity information, the second identity information, and the first permission information and the second permission information in this article are first explained. In this article, the identity information can be represented in the form of an identifier, a digital certificate, etc., and the permission information is information used to represent the permission of the server or the client, which can be represented in the form of a numerical value, such as pre-setting multiple numerical values ​​and multiple permission levels, and setting the relationship between each numerical value and each permission level, and the operations that can be performed at each permission level. For example, numerical value 1 and numerical value 2 are pre-set; and permission level 1 and permission level 2; and the permission level corresponding to data value 1 is permission level 1, and the permission level corresponding to numerical value 2 is permission level 2; if the permission level of the server is permission level 1, the operations that the server can perform include operations A and B, and if the permission level of the server is permission level 2, the operations that the server can perform include operations A, operation B, and operation C. Based on this, after determining the permission information, the operations that the server can perform can be determined according to the permission information. For example, continuing with the above example, when it is determined that the permission information of the server is 1, it indicates that the permission level of the server is permission level 1, and the operations that the server can perform include operation A and operation B.

[0194] Alternatively, the permission information may directly carry the operation identifier of the operation that can be executed. For example, if the operation identifier carried by the permission information of a server includes the identifier of operation A and the identifier of operation B, then it can be considered that the server has the authority to execute operations A and B, and if it does not carry the operation identifier, it can be considered that it does not have the authority to execute. For example, if the permission information of the server does not carry the identifier of operation C, then it can be considered that the server does not have the authority to execute operation C.

[0195] In addition, the verification of whether the permission information is normal mentioned below can be understood as that each permission information registered in the management terminal corresponds to status information, and if the status information corresponding to the permission information is normal, then the permission information is normal.

[0196] See also Figure 2 , Figure 2 A schematic flow chart of the first phase of the fully secret database encryption system provided in the embodiment of the present application includes the following steps:

[0197] Step S21: the client obtains and identifies whether the target data to be sent to the server is private data, and if the target data is private data, determines the data type and sensitivity level of the target data;

[0198] Step S22: the client identifies the target data and sends it to the server, and then performs target processing on the server;

[0199] Step S23: The client determines whether the server has the authority to process the target data based on the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end.

[0200] Step S24: The client identifies whether the target process is a preset process.

[0201] In the technical solution provided by the embodiment of the present application, before the client sends the target data to the server, it first analyzes the target data to determine whether the target data is private data. If it is determined that the target data is private data, it further determines the data type and sensitivity level of the target data, and determines the operation that the server needs to perform on the target data after the target data is sent to the server, that is, the target processing. After that, it combines the first permission information of the server obtained from the client to determine whether the server has the authority to process the target data. When the server has the authority to process the target data, it executes the subsequent steps of sending the target data to the server, thereby reducing the possibility of data leakage. At the same time, after determining that the server has the authority to process the target data, the client also identifies whether the target processing is the preset processing. When the target processing is the preset processing, the following Figure 3 The target data is processed in the manner shown. When the target processing is not the preset processing, the following Figure 4 The target data is processed in the manner shown, thereby flexibly deciding on the processing method of the target data and reducing the consumption of calculations.

[0202] In the above step S21, the target data is the data that the client needs to send to the server for processing.

[0203] In an embodiment of the present application, the client can identify the privacy data of the target data based on the privacy analyzer by combining machine learning models, natural language processing algorithms, regular expression matching and other technologies; when the target data is identified as privacy data, it is classified and graded again, that is, the data type and sensitivity level of the target data are determined.

[0204] Among them, the machine learning model can be a Term Frequency-Inverse Document Frequency (TF-IDF) model, which extracts privacy data through steps such as word segmentation, de-disturbing data, and model processing. It is mainly used in the recognition of complex scenarios such as business license numbers. The natural language processing algorithm can use conditional random fields (CRF) to extract privacy data through steps such as word segmentation and similarity calculation. It is mainly used in the recognition of Chinese unstructured privacy data such as addresses and names. Regular expressions are used in the recognition of privacy data with strong regularity, such as Internet Protocol Address (IP) addresses, Media Access Control Address (MAC) addresses, and ID card numbers.

[0205] The identification of data types and sensitivity levels can also be automatically processed through machine learning models, where data types can include two types, one is a major category and the other is a minor category. The client can first determine the major category to which the target data belongs, and then determine the minor category to which the target data belongs, and use the major category and the minor category to which the target data belongs as the data type of the target data; generally, the major category can be divided into enterprise information category, institution information category, public service information category, etc.; the minor category can be subdivided into consumer information category, communication record category, geographic location information category, etc. The sensitivity level can be clustered and graded according to domestic and foreign privacy protection laws and regulations, such as extremely sensitive, sensitive, relatively sensitive, and low sensitive.

[0206] It can be understood that after determining whether the target data is private data, if the target data is private data, the subsequent step S22 is continued to be executed; if the target data is not private data, the subsequent step S22 can be omitted and the target data can be directly sent to the server in plain text for processing.

[0207] In the above step S22, the target processing is the processing that the server needs to perform on the target data after the client sends the target data to the server.

[0208] In an embodiment of the present application, the client can identify the target processing required for the target data through steps such as grammatical analysis and semantic analysis in natural language processing. Among them, grammatical analysis mainly splits the target data message into more fine-grained phrases and words, while semantic analysis adds context information and background information, thereby constructing the target processing for the target data. Among them, the target data message can be understood as a message based on the Structured Query Language (SQL) protocol, which carries the target data and is used to send the target data from the client to the server.

[0209] In some embodiments, the target processing may also be carried in the target data message. By analyzing the target data message, the target processing corresponding to the target data carried by the target data message can be obtained.

[0210] In the above step S23, the first permission information is the permission information of the server registered with the management end obtained by the client from the management end; whether the server has the permission to process the target data includes whether the server has the permission to obtain the target data, and whether the server has the permission to perform target processing on the target data.

[0211] In an embodiment of the present application, after the client identifies the target processing according to the above step S22, it can dynamically decide whether the server has the authority to process the target data based on the data type and sensitivity level of the target data and the first permission information. If the decision result indicates that there is a high risk for the server to process the target data, subsequent operations will no longer be performed, that is, the target data will no longer be sent to the server for processing.

[0212] For example, the malicious attack statement SELECT FROM users WHERE username = 'OR 1=1; DROPDATABASE users; --' will cause the user table to be maliciously deleted. However, since the user table is extremely sensitive data and the target processing to be executed is deletion, combined with the first permission information, it can be seen that the server-side deletion of the user table has a high security risk. Therefore, the client can block the operation of sending the user table to the server for processing.

[0213] In some embodiments, after the client determines the data type and sensitivity level of the target data, the data type and sensitivity level of the target data can be marked. For example, in some embodiments, the client can embed the data type and sensitivity level of the target data into the message header extension field of the message carrying the target data (i.e., the target data message), so that when executing the above step S23, the data type and sensitivity level of the target data can be directly obtained from the message header extension field. In this way, after determining the data type and sensitivity level of the target data, there is no need to select another storage space for storing the classification and grading information of the target data; when the classification and grading information of the target data is needed, there is no need to call it from other storage spaces, which reduces the complexity of processing and improves processing efficiency.

[0214] In the above step S24, the preset processing can be understood as an operation that can perform secret operations (also called a simple processing operation). The client can determine whether the target processing belongs to a simple processing operation or a complex processing operation through steps such as semantic analysis; or, some simple processing operations can be pre-set. When the client recognizes that the target processing is a preset simple processing operation, the target processing can be considered to be a preset processing. Usually, common simple processing operations are operations that belong to simple execution logic, such as operations that belong to single-table execution logic. Based on this, it can be understood that if the target processing is not a preset processing, it indicates that the target processing is not an operation that can perform secret operations, that is, the result of performing the target processing on the ciphertext of the target data is not the result of performing the target processing on the plaintext of the target data. Usually, common operations that cannot support secret operations are operations that belong to complex execution logic, such as operations that belong to linked table execution logic.

[0215] When the client recognizes that the target processing is the preset processing, the client can directly encrypt the target data to obtain the encrypted target data (that is, the ciphertext of the target data). After that, the client sends the ciphertext of the target data to the server. After the server receives the ciphertext of the target data, it directly performs the target processing on the ciphertext of the target data. It can be understood that for the preset processing, even if the target data is private data, it can be directly processed in the form of ciphertext, that is, the processing result obtained by performing the target processing on the ciphertext of the target data in the untrusted environment of the server is the same as the processing result obtained by performing the target processing on the plaintext of the target data. Therefore, after the client determines that the target processing is the preset processing, it can directly send the ciphertext of the target data to the server for secret operation, that is, perform the target processing on the target data in the form of ciphertext. For details, please refer to the following Figure 3 Description in .

[0216] When the target processing is not the preset processing, the server cannot obtain the processing result that can be obtained by executing the target processing on the plaintext of the target data by executing the target processing on the ciphertext of the target data. Therefore, the following Figure 4 The method shown in the figure decrypts the plaintext of the target data in the trusted environment of the server, and then performs target processing on the plaintext of the target data in the trusted environment. For details, please refer to the following Figure 4 Description in .

[0217] See also Figure 3 , Figure 3 The first process interaction diagram of the second phase of the fully secret database encryption system provided in the embodiment of the present application includes the following steps when the client determines that the server has the authority to process the target data and recognizes that the target processing is the preset processing:

[0218] Step S31: The client encrypts the target data to obtain first encrypted data;

[0219] Step S32: the client sends the first encrypted data to the server;

[0220] Step S33: the server performs target processing on the first encrypted data to obtain a processing result;

[0221] Step S34: The server stores the processing result in a confidential form on the server.

[0222] In the technical solution provided by the embodiment of the present application, when the client determines that the server has the authority to process the target data, and identifies that the target processing is a preset processing, the target data is encrypted to obtain the first encrypted data, and then the first encrypted data is directly sent to the server, and the server performs the target processing on the first encrypted data to obtain the processing result. It can be understood that when the target processing is the preset processing, regardless of whether the processed data is ciphertext or plaintext, the processing result obtained is the same. Therefore, when the target processing is the preset processing, the target data is directly encrypted and sent to the server, and the server processes the ciphertext of the target data. In this way, the risk of target data leakage is reduced, and at the same time, the complexity of the calculation is reduced.

[0223] In the above step S31, when the client determines that the server has the authority to process the target data and identifies that the target processing is a preset processing, the target data can be directly encrypted to obtain the first encrypted data.

[0224] In the embodiments of the present application, the encryption algorithm used by the client to encrypt the target data can be determined according to the target processing to be performed by the server. Specifically, in some embodiments, if the target processing is to compare the size, the client can use Optimal Password Encryption (OPE) or searchable symmetric encryption (ORE) to encrypt the target data. It can be understood that OPE order-preserving encryption or ORE searchable symmetric encryption can enable the target data to still show a size relationship consistent with the plaintext while maintaining the ciphertext state. Here, the size relationship refers to the numerical size relationship of the plaintext, that is, after the target data is encrypted using OPE order-preserving encryption or ORE searchable symmetric encryption, the size relationship of the encrypted target data is consistent with the size relationship of the unencrypted target data. Therefore, it is suitable for scenarios where size comparisons are performed, such as salary data size comparisons.

[0225] If the target processing is image similarity search or image search by image features, the client can use the perceptual hash algorithm to encrypt the target data; the perceptual hash algorithm can dynamically adjust the Hamming distance to generate a 64-bit fingerprint for the image for retrieval. If the target processing is addition, subtraction, multiplication, division, or average operation, the client can use homomorphic encryption to encrypt the target data.

[0226] In the above step S32, after the client obtains the first encrypted data, it can directly send the first encrypted data to the server. It can be understood that after receiving the first encrypted data, the server directly processes the first encrypted data (such as performing target processing on the first encrypted data), that is, the first encrypted data always exists in a secret state in the server. Therefore, when the client sends the first encrypted data to the server, it can be sent to the trusted environment of the server or to the untrusted environment of the server. In order to reduce the occupation of resources in the trusted environment, the first encrypted data can be sent to the untrusted environment of the server.

[0227] In the above step S33, after the server performs target processing on the first encrypted data, a processing result can be obtained.

[0228] In the above step S34, after the server obtains the processing result, if the processing result is not private data, it can be directly stored in the server in plain text, or directly returned to the client in plain text; if the processing result is private data, the processing result needs to be stored in the server in a secret form. For example, if the Insert complex compound statement involves the storage of private data, the processing result can be stored in a secret form after the correct processing result is calculated in the server's trusted environment (such as TEE).

[0229] Specifically, in some embodiments, when the processing result is private data, during the data storage process, the server can dynamically intercept the storage instruction for the processing result; then, encrypt the processing result to obtain a third encrypted result, and then store the third encrypted result. During the data reading process, the server dynamically intercepts the read instruction for the processing result and reads the third encrypted result. Then, the third encrypted result is decrypted to obtain the plain text of the processing result, thereby realizing the reading of the processing result.

[0230] For example, in some embodiments, the server can use database transparent data encryption (Transparent Data Encryption, TDE) technology to dynamically intercept the storage read and write functions (such as the above-mentioned storage instructions and read execution) between the server and the operating system file system, and use the counter (Counter, CTR) mode of the SM4 algorithm to perform automatic encryption for writing (that is, encrypting the processing result during storage to obtain a third encrypted result) and automatic decryption for reading (that is, decrypting the third encrypted result during reading), so that the processing result also exists in a secret form during the storage process. At the same time, encryption and decryption are performed at the database cache layer, which can improve computing performance.

[0231] See also Figure 4 , Figure 4 The second process interaction diagram of the second phase of the fully secret database encryption system provided in the embodiment of the present application includes the following steps when the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing:

[0232] Step S41: the client obtains a first ciphertext from the management end, wherein the first ciphertext is a ciphertext of the first key obtained by encrypting the first key by the management end using the public key of the client;

[0233] Step S42: the client uses the client's private key to decrypt the first ciphertext to obtain the first key; and uses the first key to encrypt the target data to obtain second encrypted data;

[0234] Step S43: the client sends the second encrypted data to the server;

[0235] Step S44: the server sends the second identity information of the server to the management end in response to the second encrypted data;

[0236] Step S45: the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal. If the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the subsequent step S46 is executed;

[0237] Step S46: the server obtains a second ciphertext from the management end through the trusted environment, wherein the second ciphertext is a ciphertext of the first key obtained by encrypting the first key by the management end using the public key of the server end;

[0238] Step S47: the server uses the private key of the server to decrypt the second ciphertext through the trusted environment to obtain the first key; decrypts the second encrypted data through the trusted environment using the first key to obtain the target data; performs target processing on the target data through the trusted environment, and uses the processing result of executing the target processing on the target data as the target data;

[0239] Step S48: When the processing result is private data, the server stores the processing result in a confidential form on the server.

[0240] In the technical solution provided by the embodiment of the present application, the client obtains the first ciphertext from the management end, and uses the client's private key to decrypt the first ciphertext to obtain the first key. Then, the target data is encrypted using the first key to obtain the second encrypted data, and the second encrypted data is sent to the server; after the server receives the second encrypted data, it responds to the second encrypted data and sends the second identity information to the management end so that the management end can authenticate the server. When the management end determines that the second identity information is stored and the authority information corresponding to the second identity information is normal, the management end uses the server's public key to encrypt the first key to obtain the second ciphertext, and sends the second ciphertext to the server's trusted environment. Then, the server uses its own private key to decrypt the second ciphertext in the trusted environment to obtain the first key. As a result, the server uses the first key to decrypt the first encrypted data in the trusted environment to obtain the target data, and then obtains the processing result of the target data. It can be understood that in the embodiment of the present application, the first key for encrypting the target data is provided by the management end, and the plaintext of the first key and the plaintext of the target data only exist in the form of ciphertext in the trusted environment of the server end. Therefore, even if the target data exists in the form of plaintext on the server end, the risk of leakage is low. After the processing result is determined, the processing result is also stored in the form of ciphertext, which also reduces the risk of data leakage.

[0241] In the above step S41, the first ciphertext is the ciphertext of the first key obtained after the management end encrypts the first key using the public key of the client; the first key is a key generated by the management end.

[0242] Regarding the relationship between the management end and the first key, in some embodiments, the blockchain of the management end maintains the dispersion factor of the first key, and the same dispersion factor can be used to derive the same key through the key management system of the management end. If the client and the server have registered identity information and authority information on the management end, the client and the server can perform identity verification on the blockchain of the management end (such as the blockchain smart contract in the following content). After the identity verification is passed, the same key, i.e., the first key, can be generated through the key management system of the management end, and then the first key can be sent to the client and the server in the form of ciphertext. For the relevant content of the server, please refer to the description in the following steps S44 and S45.

[0243] Alternatively, in other embodiments, the ciphertext of the first key is maintained on the blockchain of the management end, and the ciphertext is obtained by encrypting the first key by the management end. If the client and the server both have identity information and authority information registered on the management end, then both the client and the server can perform identity verification on the blockchain of the management end. After the identity verification is passed, the management end can decrypt and obtain the plaintext of the first key, and then use the public key of the server to encrypt the first key and send it to the server, or use the public key of the client to encrypt the first key and send it to the client, so that the client and the server obtain the first key.

[0244] It is understandable that the client does not need to pre-register the identity information and permission information in the management end. When the client needs to obtain the first key, it can directly obtain it from the management end. For example, the client and the server have a pre-negotiated key identifier. The client can obtain the ciphertext of the first key (such as the first ciphertext) from the management end based on the pre-negotiated key identifier, and the server also carries the pre-negotiated key identifier when performing identity authentication on the management end. In this way, after the identity information and permission information of the server are verified, based on the key identifier carried by the server, the management end can determine that the key that the server needs to obtain is the first key, and then send the ciphertext of the first key (such as the second ciphertext) to the server. As a result, both the client and the server can obtain the first key.

[0245] Regarding the process of the client obtaining the first ciphertext from the management end, in some embodiments, the client has pre-registered the client's third identity information and third authority information in the management end. When obtaining the first ciphertext, the client can send the client's fourth identity information to the management end; after the management end receives the client's fourth identity information, it can verify whether the management end stores the fourth identity information, and whether the fourth authority information corresponding to the fourth identity information is normal. If the management end stores the fourth identity information, and the fourth authority information corresponding to the fourth identity information is normal, the management end uses the client's public key to encrypt the first key to obtain the first ciphertext. After that, the management end can actively send the first ciphertext to the client.

[0246] In the embodiments of the present application, the third identity information can be understood as the identity information of the client provided by the client when registering in the management end, and the third permission information can be understood as the permission information assigned to the client by the management end according to the third identity information of the client; in some embodiments, the third identity information and the third permission information can also be understood as the identity information and permission information assigned to the client by the management end after the client sends information that can represent the identity information of the client (such as business-related information, device identification information, etc.) to the management end. After the management end assigns the third identity information and the third permission information to the client, it stores the identity information and permission information of the client accordingly, that is, the client registers the third identity information and the third permission information to the management end accordingly. Specifically, in some embodiments, the third identity information and the third permission information of the client can be registered in the identity information block of the client's blockchain accordingly.

[0247] The fourth identity information is the identity information sent by the client to the management end when the client initiates identity authentication to the management end. It can be understood that the fourth identity information is used to authenticate the client on the management end. Therefore, in theory, the fourth identity information is the third identity information of the client registered in the management end. That is, if the corresponding third identity information stored in the management end is the identifier assigned by the management end to the client based on the client information, then in theory, the fourth identity information sent by the client to the management end is the third identity information assigned by the management end to the client.

[0248] In the process of obtaining the first key from the management end, the client can send the fourth identity information of the client to the management end. If the management end determines that the fourth identity information is stored in the management end and the fourth authority information corresponding to the fourth identity information is normal (specifically, it can be understood that there is a third identity information consistent with the fourth identity information in the management end, and the third authority information corresponding to the third identity information is normal), then the management end can obtain the first key, and use the public key of the client to encrypt the first key to obtain the first ciphertext, and send the first ciphertext to the client; if the management end determines that the fourth identity information is not stored in the management end, such as there is no third identity information consistent with the fourth identity information in the management end, or there is a third identity information consistent with the fourth identity information in the management device, but the third authority information corresponding to the third identity information is abnormal, then the management end can refuse to provide the first key to the client.

[0249] In an embodiment of the present application, the identity information and permission information of the client are pre-stored in the management end. The management end provides the first key to the client only when the identity information and permission information of the client are verified, so as to carry out the subsequent process of encrypting the target data with the first key and sending it to the server. In this way, the client is prevented from providing a key to an abnormal client, that is, the abnormal client is prevented from sending abnormal target data to a normal server, thereby further improving the security of data transmission.

[0250] In the above step S42, the second encrypted data is the ciphertext of the target data obtained by the management end encrypting the target data using the first key; the first key is the key obtained by the client after decrypting the first ciphertext using the client's private key.

[0251] In the above step S43, after the client obtains the second encrypted data, the second encrypted data can be sent to the server. It can be understood that the second encrypted data needs to be decrypted later to obtain the target data, and the plain text of the target data is directly processed. Therefore, in order to avoid leakage of the target data and facilitate processing, here, the target data can be directly sent to the trusted environment of the server.

[0252] In the above step S44, after receiving the second encrypted data, the server sends the second identity information of the server to the management end in response to the second encrypted data. The second identity information is the identity information sent by the server to the management end for identity authentication (ie, identity information authentication, authority information authentication).

[0253] In the above step S45, if the management end determines that the second identity information is stored in the management end, and determines that the second permission information corresponding to the second identity information is normal (specifically, it can be understood that there is first identity information consistent with the second identity information in the management end, and the first permission information corresponding to the first identity information is normal), then continue to execute the following step S26; if the management end determines that the second identity information is not stored in the management end, such as there is no first identity information consistent with the second identity information in the management end, or there is first identity information consistent with the second identity information in the management end, but the second permission information corresponding to the second identity information is abnormal, then the management end can refuse to provide the first key to the server.

[0254] In the above step S46, the second ciphertext is the ciphertext of the first key obtained by the management end using the public key of the server end to encrypt the first key; the server end obtains the second ciphertext from the management end through a trusted environment, which can be understood as that after the management end obtains the second ciphertext, it directly sends the second ciphertext to the trusted environment of the server end.

[0255] In the above step S47, based on the above steps S41-S46, there are second ciphertext and second encrypted data in the trusted environment of the server. Based on this, the server can use the server's private key in the trusted environment to decrypt the second ciphertext to obtain the first key, and use the first key in the trusted environment of the server to decrypt the second encrypted data to obtain the target data (i.e., the plaintext of the target data), and then perform target processing on the plaintext of the target data in the trusted environment to obtain the processing result.

[0256] In the above step S48, when the processing result is private data, the server can store the processing result in a confidential form. Step S48 is the same as the above step S34, and the details can refer to the description of the above step S34.

[0257] See also Figure 5 , Figure 5 The third process interaction diagram of the second phase of the fully secret data encryption system provided in the embodiment of the present application is similar to the above Figure 4 Correspondingly, when the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing, the following steps may be included:

[0258] Step S51: the client obtains a first ciphertext from the management end, wherein the first ciphertext is a ciphertext of the first key obtained by encrypting the first key by the management end using the public key of the client;

[0259] Step S52: the client uses the client's private key to decrypt the first ciphertext to obtain the first key; the second encrypted data includes the third encrypted data and the third ciphertext; the client uses the second key to encrypt the target data to obtain the third encrypted data; and uses the first key to encrypt the second key to obtain the third ciphertext;

[0260] Step S53: the client sends the second encrypted data to the server;

[0261] Step S54: the server sends the second identity information of the server to the management end in response to the second encrypted data;

[0262] Step S55: the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal; if the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the subsequent step S56 is executed;

[0263] Step S56: The server obtains a second ciphertext from the management end through the trusted environment, wherein the second ciphertext is a ciphertext of the first key obtained by encrypting the first key by the management end using the public key of the server end;

[0264] Step S57: the server uses the private key of the server to decrypt the second ciphertext through the trusted environment to obtain the first key; decrypts the third ciphertext through the trusted environment using the first key to obtain the second key; and decrypts the third encrypted data through the trusted environment using the second key to obtain the target data; performs target processing on the target data through the trusted environment, and uses the processing result of executing the target processing on the target data as the target data;

[0265] Step S58: When the processing result is private data, the server stores the processing result in a confidential form on the server.

[0266] In the technical solution provided in the embodiment of the present application, compared with the above Figure 4 In the manner shown, in an embodiment of the present application, the target data is encrypted using the second key to obtain third encrypted data, and then the third key is encrypted using the first key obtained from the management end. In this way, the second data sent to the server end includes the third encrypted data and the third ciphertext. Although the third encrypted data is the ciphertext encrypted with the second key, the second key also exists in the form of ciphertext (i.e., the third ciphertext), and the first key that can decrypt the third ciphertext can only be obtained after the server end authenticates its identity to the management end. Therefore, even if the third encrypted data and the third ciphertext are leaked, they are difficult to crack if the first key cannot be obtained. In this way, the risk of target data leakage is further reduced.

[0267] It can be understood that the above step S51 is the same as the above step S52. Figure 4 Step S41 is the same as in the above, and steps S53 to S56 are the same as in the above Figure 4 Steps S43 to S46 are the same as above; step S58 is the same as above Figure 4 The process is the same as step S48 in the above process, and therefore, it will not be described again here.

[0268] In the above step S52, the second encrypted data includes the third encrypted data and the third ciphertext; the third encrypted data is the ciphertext of the target data obtained after the client encrypts the target data using the second key; the third ciphertext is the ciphertext of the second key obtained after the client encrypts the second key using the first key. For other descriptions of step S52, please refer to the content of the above step S42.

[0269] In the above step S57, the second encrypted data received by the server includes the third encrypted data and the third ciphertext; therefore, after obtaining the second ciphertext, the server decrypts the second ciphertext according to its own private key in the trusted environment to obtain the first key; then, the server decrypts the third ciphertext using the first key in the trusted environment to obtain the second key; and then, the server decrypts the second encrypted data using the second key in the trusted environment to obtain the target data. For other descriptions of step S57, please refer to the content of the above step S47.

[0270] For the above Figure 3-Figure 5 In the manner shown, in some embodiments, the client can also determine the target encryption unit from multiple encryption units according to a preset load balancing algorithm, and use the target encryption unit to encrypt the target data. The encryption unit can be understood as a unit in the client for encrypting the target data, and the target encryption unit can be understood as the encryption unit that is most suitable for encrypting the current target data calculated by the client according to the preset load balancing algorithm.

[0271] It is understandable that in order to improve the efficiency of client encryption operations, the client-side software and hardware computing resources can be dynamically enumerated to perform load balancing encryption task allocation. For an encryption operation, the software resources are generally the CPU core of the server where the client is located, and the hardware resources are generally the password card hardware, CPU acceleration module, etc. of the server where the client is located. According to the performance peak of the above computing units for the encryption algorithm and the resource occupancy of the implementation, weighted polling load balancing allocation can be performed.

[0272] In addition, in some embodiments, the management end can also write the real-time key negotiation information into the key information block of the blockchain of the management end, so that the key key negotiation information cannot be maliciously tampered with, so that the data obtained in the subsequent audit tracing process is more reliable. Among them, the key negotiation information includes the negotiation participants (such as the identity of the server, the identity of the client), the key negotiation protocol process (such as the relevant information in the process of obtaining the first key and the third key), and the key attribute information (such as the attribute information of the first key and the attribute information of the third key).

[0273] In some embodiments, the client pre-registers the client's third identity information and third permission information on the management side. When the processing result is private data, the server can store the processing result in a confidential form (see the description in the above step S34 for details), and can also return the processing result to the client in a confidential form. For example, if complex statements such as Select table query involve the return of private data, after calculating the correct plaintext result of the intersection of sensitive data (i.e., the processing result) in TEE, the processing result can be returned to the client in a confidential form. For details, please refer to the following Figure 6 Description in .

[0274] Figure 6 A schematic diagram of a process interaction for returning the processing result to the client in a confidential form provided in an embodiment of the present application may include the following steps:

[0275] Step S61: the server sends the fifth identity information of the server to the management end;

[0276] Step S62: the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the subsequent step S63 is executed;

[0277] Step S63: the server obtains a fourth ciphertext from the management end through the trusted environment, where the fourth ciphertext is a ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server end;

[0278] Step S64: the server uses the private key of the server to decrypt the fourth ciphertext through the trusted environment to obtain a third key; and encrypts the processing result through the trusted environment using the third key to obtain a first encrypted result;

[0279] Step S65: the server sends the first encryption result to the client;

[0280] Step S66: the client sends the sixth identity information of the client to the management end in response to the first encryption result;

[0281] Step S67: the management end verifies whether the management end stores the sixth identity information and whether the sixth permission information corresponding to the sixth identity information is normal. If the management end stores the sixth identity information and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext.

[0282] Step S68: The management terminal sends the fifth ciphertext to the client;

[0283] Step S69: The client uses the client's private key to decrypt the fifth ciphertext to obtain a third key; and uses the third key to decrypt the first encryption result to obtain a processing result.

[0284] In the technical solution provided in the embodiment of the present application, the first encryption result is obtained by the server using the third key to encrypt the processing result, and the third key can only be obtained after the server performs identity authentication on the management end. After the server sends the first encryption result to the client, the client also needs to perform identity authentication on the management end to obtain the first key, and then use the first key to decrypt the first encryption result to obtain the processing result, thereby reducing the risk of leakage of the processing result.

[0285] In the above step S61, the fifth identity information is the identity information for identity authentication sent by the server to the client when the server returns the processing result to the client.

[0286] In the above step S62, after the management end receives the fifth identity information from the service end, it determines whether the management end has the corresponding fifth identity information stored, that is, the management end determines whether there is the first identity information consistent with the fifth identity information in the first identity information stored by itself; at the same time, the management end determines whether the fifth permission information corresponding to the fifth identity information is normal, that is, after the management end determines that there is the first identity information consistent with the fifth identity information, it can determine whether the first permission information registered corresponding to the first identity information is normal. If the first permission information is normal, the fifth permission information corresponding to the fifth identity information is normal. When the management end determines that it has the fifth identity information stored, and the fifth permission information corresponding to the fifth identity information is normal, the subsequent step S63 is executed; if the management end does not store the fifth identity information, or the fifth permission information corresponding to the fifth identity information is abnormal, the subsequent step S63 is no longer executed, that is, the subsequent step of sending the third key to the service end is no longer executed.

[0287] In the above step S63, the management end uses the public key of the server end to encrypt the third key to obtain the fourth ciphertext; then, the server end obtains the fourth ciphertext from the management end through the trusted environment, that is, after the management end obtains the fourth ciphertext, it sends the fourth ciphertext to the trusted environment of the server end. The management end generates the third key in the same way as the first key, and the details can be found in the description of the above step S41.

[0288] In the above step S64, after the server obtains the fourth ciphertext through the trusted environment, it can use the server's private key in the trusted environment to decrypt the fourth ciphertext to obtain the third key, and then the server can use the third key in the trusted environment to encrypt the processing result to obtain the first encrypted result. The first encrypted result is the ciphertext of the processing result obtained after the server encrypts the processing result through the trusted environment.

[0289] In the above step S65, the server may send the first encryption result to the client.

[0290] In the above step S66, in order to obtain the plain text of the processing result, the server needs to authenticate the identity of the management end to obtain the third key, and the sixth identity information is the identity information sent by the client to the management end for identity authentication when obtaining the third key.

[0291] In the above step S67, after the management end receives the sixth identity information, it verifies whether the value itself stores the sixth identity information, that is, it determines whether the third identity information stored in the management end is consistent with the sixth identity information. If the third identity information exists, it is considered that the management end has stored the sixth identity information. At the same time, when the management end stores the sixth identity information, it determines whether the sixth permission information corresponding to the sixth identity information is normal, that is, it determines whether the third permission information corresponding to the third identity information consistent with the sixth identity information is normal. If normal, the sixth permission information corresponding to the sixth identity information is normal.

[0292] When the management end determines that the sixth identity information is stored and the sixth authority information corresponding to the sixth identity information is normal, the third key can be encrypted using the public key of the client to obtain the fifth ciphertext.

[0293] In the above step S68, after the management end generates the fifth ciphertext, the fifth ciphertext can be sent to the service end.

[0294] In the above step S69, after the client obtains the fifth ciphertext, it can use the client's private key to decrypt the fifth ciphertext to obtain the third key, and then, based on the third key, the first encryption result can be decrypted to obtain the processing result.

[0295] See also Figure 7 , Figure 7 Another flow interaction diagram for returning the processing result to the client in ciphertext provided in the embodiment of the present application may include the following steps:

[0296] Step S71: the server sends the fifth identity information of the server to the management end;

[0297] Step S72: the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the subsequent step S73 is executed;

[0298] Step S73: the server obtains a fourth ciphertext from the management end through the trusted environment; wherein the fourth ciphertext is a ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server end;

[0299] Step S74: the server uses the private key of the server to decrypt the fourth ciphertext through the trusted environment to obtain the third key; the first encryption result includes the second encryption result and the sixth ciphertext, and the server uses the fourth key to encrypt the processing result through the trusted environment to obtain the second encryption result; and uses the third key to encrypt the fourth key to obtain the sixth ciphertext;

[0300] Step S75: the server sends the first encryption result to the client;

[0301] Step S76: the client sends the sixth identity information of the client to the management end in response to the first encryption result;

[0302] Step S77: the management end verifies whether the management end stores the sixth identity information and whether the sixth permission information corresponding to the sixth identity information is normal. If the management end stores the sixth identity information and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext.

[0303] Step S78: the management terminal sends the fifth ciphertext to the client;

[0304] Step S79: The client uses the client's private key to decrypt the fifth ciphertext to obtain the third key; uses the third key to decrypt the sixth ciphertext to obtain the fourth key; uses the fourth key to decrypt the second encryption result to obtain the processing result.

[0305] In the technical solution provided in the embodiment of the present application, compared with the above Figure 6 In the manner shown, in an embodiment of the present application, the server uses the fourth key to encrypt the processing result to obtain a second encryption result, and then uses the third key obtained from the management end to encrypt the fourth key, so that the first encryption result sent to the client includes the second encryption result and the sixth ciphertext. Although the second encryption result is the ciphertext encrypted by the fourth key, the fourth key also exists in the form of ciphertext (i.e., the sixth ciphertext), and the third key that can decrypt the fourth ciphertext can only be obtained after the client authenticates its identity to the management end. Therefore, even if the second encryption result and the sixth ciphertext are leaked, they are difficult to crack if the third key cannot be obtained. In this way, the risk of leakage of the processing result is further reduced.

[0306] It can be understood that the above steps S71 to S73 are the same as the above steps S61 to S63, and steps S75 to S78 are the same as the above steps S65 to S68, which will not be repeated here.

[0307] In the above step S74, the first encryption result includes the second encryption result and the sixth ciphertext; the second encryption result is the ciphertext of the processing result obtained by the server end using the fourth key to encrypt the processing result through the trusted environment; the sixth ciphertext is the ciphertext of the fourth key obtained by the server end using the third key to encrypt the fourth key through the trusted environment. Among them, the third key is the plaintext data of the third key obtained by the server end obtaining the fourth ciphertext and decrypting the fourth ciphertext through the trusted environment using the private key of the server end; the fourth key can be a key randomly generated by a device (such as a security password device) for generating an encryption algorithm pre-set in the server end.

[0308] It can be understood that using the fourth key to encrypt the processing result and using the third key to encrypt the fourth key can both be understood as application layer encryption, and application layer encryption and communication link Secure Sockets Layer (SSL) encryption can be superimposed and the two do not conflict.

[0309] In the above step S79, the client receives the first encryption result including the second encryption result and the sixth ciphertext; therefore, after obtaining the fifth ciphertext, the client can decrypt the fifth ciphertext according to its own private key to obtain the third key; then, use the third key to decrypt the sixth ciphertext to obtain the fourth key; then use the fourth key to decrypt the second encryption result to obtain the processing result.

[0310] Regarding the above Figure 1-Figure 7 Any of the fully-secret database encryption systems shown, in some embodiments, the present application is provided with a fully-secret database driver and a fully-secret security processing module. In the preparation stage, the fully-secret data driver can be deployed to the client side and embedded in the client environment data operation execution logic to drive the client to execute the steps performed by the client as the main body in the above text; and the fully-secret security processing module is deployed to the server side, located in front of the original data server execution logic, to drive the server to execute the steps performed by the server as the main body in the above content.

[0311] Below, taking the trusted environment as the TEE environment as an example, the various modules in the client, server, and management end of the fully secret database encryption system provided in the embodiment of the present application are described. Figure 8 , Figure 8 Another structural diagram of the fully secret database encryption system provided in the embodiment of the present application is as follows. It can be understood that: Figure 8 The management end is included in the application, but the management end does not belong to the fully secret database encryption system of this application. Figure 8 It is shown here just to facilitate the explanation of the client and server.

[0312] like Figure 8 As shown, the database client 81 includes four modules: sensitive identification classification and grading 811 (see the description in the above step S21), semantic analysis risk blocking 812 (see the description in the above step S23), soft and hard collaborative SQL splitting 813 (see the description in the above step S24), and dynamic orchestration of secret operations 814 (see the above content of using a preset load balancing algorithm to determine the target encryption unit); the database server 82 includes four modules: identity authority chain verification 821, multi-party key negotiation challenge 822, TEE trusted area operation 823, and secret operation transparent encryption 824. Among them, the identity authority chain verification 821 is used to communicate with the management end to verify the self The multi-party key negotiation challenge 822 is used to obtain keys from the management end, the TEE trusted area operation 823 is used to perform target processing on the plaintext of the target data, and the secret operation transparent encryption 824 realizes the storage and reading of the processing results in a secret form; the central management end 83 includes four modules: key hierarchical management 831, blockchain smart contract 832, identity and permission challenge 833, and TEE key negotiation 834. Among them, key hierarchical management 831 and TEE key negotiation 834 are used to maintain keys, blockchain smart contract 832 is used to maintain identity information and permission information, and identity and permission challenge 833 is used to verify the identity information and permission information of the client and the server.

[0313] In summary, the technical solution provided by the embodiments of the present application can achieve the following technical effects:

[0314] (a) The client acts as a trusted environment, dynamically identifying the data type and sensitivity level of private data, and determines the operation risk based on contextual semantic analysis to promptly intercept high-risk operations.

[0315] (b) The client dynamically splits SQL statements, and the intelligent decision-making of software and hardware collaboration is performed in the software operation part and the security hardware operation part; the logic executed by the intelligent decision-making on the client side and the logic executed on the server side improves the performance of the fully encrypted logic operation. When the decision is executed on the client side, the appropriate encryption algorithm is dynamically arranged according to the semantic analysis results to encrypt the private data, and the encrypted private data ciphertext is sent to the server. The server performs database ciphertext retrieval, fuzzy query, size comparison, summation, and mean calculation when the private data is ciphertext.

[0316] (c) As a non-trusted cloud service environment, the server dynamically conducts identity authentication challenges, permission authentication challenges, and multi-level key negotiation challenges (such as the process of obtaining the first key and the third key mentioned above) with the client based on the data type and sensitivity level of the target data. The permission allocation and key negotiation process are recorded through the blockchain smart contract in the management end.

[0317] (d) When the target data is private data and the target processing is not the preset processing, the server obtains the plaintext of the target data only in the trusted TEE area authorized by the client (i.e. the trusted environment mentioned above) after passing the identity authentication challenge, permission authentication challenge and key negotiation, and performs the target processing on the target data to obtain the processing result. Afterwards, if the processing result is private data, if it is to be stored on the server, it will be stored in the form of ciphertext; if it is to be returned to the client, it will also be returned to the client in the form of ciphertext after key negotiation.

[0318] (e) The entire life cycle of the target data is stored in a confidential form in a non-trusted environment. The security of the fully confidential state is guaranteed through classified and graded information identification, dynamic identity and authority challenges, multi-level key negotiation, blockchain evidence storage, TEE trusted area execution, and combined confidential operations. This solves the limitations of the original application layer encryption (inability to perform confidential calculations) and TDE encryption (exposure of plain text data except for storage processes); at the same time, the fully confidential operation performance is improved through soft and hard collaborative computing and client-server dual-end collaborative logic processing.

[0319] Corresponding to the above-mentioned fully secret database encryption system, the embodiment of the present application also provides a fully secret database encryption method, which is applied to the fully secret database encryption system. The fully secret database encryption system includes a client and a server. The server pre-registers the first identity information and the first permission information of the server in the management terminal. Fig. 9 As shown, the following steps may be included:

[0320] Step S91: the client obtains and identifies whether the target data to be sent to the server is private data; if the target data is private data, determines the data type and sensitivity level of the target data; and identifies the target processing to be performed on the server after the target data is sent to the server;

[0321] Step S92: the client determines whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end;

[0322] Step S93: the client identifies whether the target process is a preset process;

[0323] When the client determines that the server has the authority to process the target data and identifies that the target processing is a preset processing, the following steps S94 to S95 are executed;

[0324] Step S94: the client encrypts the target data to obtain first encrypted data, and sends the first encrypted data to the server;

[0325] Step S95: the server performs target processing on the first encrypted data to obtain a processing result;

[0326] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, the following steps S96 to S98 are executed.

[0327] Step S96: the client obtains a first ciphertext from the management end, where the first ciphertext is the ciphertext of the first key obtained by the management end using the public key of the client to encrypt the first key; decrypts the first ciphertext using the private key of the client to obtain the first key, and encrypts the target data using the first key to obtain second encrypted data; and sends the second encrypted data to the service end;

[0328] Step S97: the server sends the second identity information of the server to the management end in response to the second encrypted data, so that the management end verifies whether the management end has the corresponding second identity information stored therein, and whether the second permission information corresponding to the second identity information is normal. If the management end has the second identity information stored therein, and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, and the second ciphertext is the ciphertext of the first key obtained by encrypting the first key by the management end using the public key of the server end.

[0329] Step S98: the server uses the private key of the server to decrypt the second ciphertext through the trusted environment to obtain the first key; decrypts the second encrypted data through the trusted environment using the first key to obtain the target data, and performs target processing on the target data through the trusted environment as the processing result of performing the target processing on the target data;

[0330] Step S99: When the processing result is private data, the server stores the processing result in a confidential form on the server.

[0331] In the technical solution provided in the embodiment of the present application, before sending the target data to the server, the client first analyzes the target data to determine whether the target data is private data. When it is determined that the target data is private data, the client further determines the data type and sensitivity level of the target data, and determines the operation that the server needs to perform on the target data after the target data is sent to the server, that is, target processing. Thereafter, the server determines whether it has the authority to process the target data in combination with the first permission information of the server obtained from the client. When the server has the authority to process the target data, the server executes the subsequent step of sending the target data to the server, thereby reducing the possibility of data leakage.

[0332] When the client determines that the server has the authority to process the target data, and recognizes that the target processing is a preset processing, the target data is encrypted to obtain the first encrypted data, and then the first encrypted data is directly sent to the server, and the server performs the target processing on the first encrypted data to obtain the processing result. It can be understood that when the target processing is the preset processing, regardless of whether the processed data is ciphertext or plaintext, the processing result obtained is the same. Therefore, when the target processing is the preset processing, the target data is directly encrypted and sent to the server, and the server processes the ciphertext of the target data. In this way, the risk of target data leakage is reduced, and at the same time, the complexity of the calculation is reduced.

[0333] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, the client obtains the first ciphertext from the management end, and uses the client's private key to decrypt the first ciphertext to obtain the first key, and then uses the first key to encrypt the target data to obtain second encrypted data, and then sends the second encrypted data to the server; after the server receives the second encrypted data, in response to the second encrypted data, it sends the second identity information to the management end so that the management end authenticates the server. When the management end determines that the second identity information is stored and the authority information corresponding to the second identity information is normal, the management end uses the server's public key to encrypt the first key to obtain the second ciphertext, and sends the second ciphertext to the server's trusted environment. Then, the server uses its own private key to decrypt the second ciphertext in the trusted environment to obtain the first key. Then, the first encrypted data is decrypted using the first key in the trusted environment to obtain the target data, and then the processing result of the target data is obtained. It can be understood that in the embodiment of the present application, the first key for encrypting the target data is provided by the management end, and the plaintext of the first key and the plaintext of the target data only exist in the form of ciphertext in the trusted environment of the server end. Therefore, even if the target data exists in the form of plaintext on the server end, the risk of leakage is low; after determining the processing result, the processing result is also stored in the form of ciphertext, which also reduces the risk of data leakage. In this way, based on the technical solution provided in the embodiment of the present application, data can exist in the form of ciphertext in a non-trusted environment at all stages of the entire life cycle.

[0334] In some embodiments, the second encrypted data includes third encrypted data and third ciphertext, and the third encrypted data and the third ciphertext are obtained by:

[0335] The client encrypts the target data using the second key to obtain third encrypted data;

[0336] The client uses the first key to encrypt the second key to obtain a third ciphertext;

[0337] The server uses the first key to decrypt the second encrypted data in a trusted environment to obtain the target data, including:

[0338] The server uses the first key to decrypt the third ciphertext in a trusted environment to obtain a second key.

[0339] The server uses the second key to decrypt the third encrypted data in a trusted environment to obtain the target data.

[0340] In some embodiments, the client pre-registers the third identity information and the third authority information of the client on the management end, and the client obtains the first ciphertext from the management end, including:

[0341] The client sends the fourth identity information of the client to the management end; so that the management end verifies whether the management end has stored the corresponding fourth identity information, and whether the fourth authority information corresponding to the fourth identity information is normal. If the management end has stored the fourth identity information, and the fourth authority information corresponding to the fourth identity information is normal, the management end uses the public key of the client to encrypt the first key, obtains the first ciphertext, and sends the first ciphertext to the client.

[0342] In some embodiments, the client pre-registers the third identity information and the third permission information of the client on the management end; when the processing result is private data,

[0343] The server sends the fifth identity information of the server to the management end; so that the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the server obtains the fourth ciphertext from the management end through the trusted environment. The fourth ciphertext is the ciphertext of the third key obtained by encrypting the third key by the management end using the public key of the server end.

[0344] The server uses the private key of the server to decrypt the fourth ciphertext through the trusted environment to obtain a third key; and encrypts the processing result through the trusted environment using the third key to obtain a first encrypted result; and sends the first encrypted result to the client;

[0345] The client sends the sixth identity information of the client to the management end in response to the first encryption result; so that the management end verifies whether the management end has the corresponding sixth identity information stored, and whether the sixth permission information corresponding to the sixth identity information is normal. If the management end has the sixth identity information stored, and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext, and sends the fifth ciphertext to the client;

[0346] The client uses the private key of the client to decrypt the fifth ciphertext to obtain a third key; and uses the third key to decrypt the first encryption result to obtain a processing result;

[0347] In some embodiments, the first encryption result includes the second encryption result and the sixth ciphertext, and the second encryption result and the sixth ciphertext are obtained by:

[0348] The server encrypts the processing result using the fourth key in the trusted environment to obtain a second encrypted result;

[0349] The server encrypts the fourth key using the third key in the trusted environment to obtain a sixth ciphertext;

[0350] The client uses the third key to decrypt the first encryption result to obtain a processing result, including:

[0351] The client uses the third key to decrypt the sixth ciphertext to obtain the fourth key;

[0352] The client uses the fourth key to decrypt the second encryption result to obtain a processing result.

[0353] In some embodiments, the server stores the processing results in a confidential form on the server, including:

[0354] The server dynamically intercepts the storage instruction for the processing result; encrypts the processing result to obtain a third encrypted result, and stores the third encrypted result;

[0355] The server dynamically intercepts the read instruction for the processing result; and reads the third encryption result, decrypts the third encryption result, and obtains the processing result.

[0356] In some embodiments, the client embeds the data type and sensitivity level of the target data into a message header extension field of the message carrying the target data;

[0357] The client determines whether the server has the authority to process the target data according to the first authority information of the server sent by the client, the data type and sensitivity level of the target data, and the target processing, including:

[0358] The client determines whether the server has the authority to process the target data based on the first authority information of the server sent by the management end, the data type and sensitivity level of the target data in the message header extension field, and the target processing.

[0359] In some embodiments, the client encrypts the target data to obtain first encrypted data, including:

[0360] If the target processing is to compare the size, the client is specifically used to encrypt the target data using order-preserving encryption OPE or searchable symmetric encryption ORE;

[0361] If the target processing is image similarity search, the client is specifically used to encrypt the target data using a perceptual hash algorithm;

[0362] If the target processing is addition, subtraction, multiplication, division, or average operation, the client is specifically used to encrypt the target data using homomorphic encryption.

[0363] In some embodiments, the client determines a target encryption unit from a plurality of encryption units according to a preset load balancing algorithm; encrypts the data to be encrypted using the target encryption unit;

[0364] The management end writes the real-time key negotiation information into the key information block of the management end's blockchain; the key negotiation information includes the negotiation participants, the key negotiation protocol process, and the key attribute information.

[0365] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0366] The server pre-registers the first identity information and the first permission information of the server in the identity information block of the blockchain of the management end;

[0367] The client pre-registers the third identity information and third authority information of the client on the management end, including:

[0368] The client pre-registers the third identity information and the third permission information of the client in the identity information block of the blockchain of the management end.

[0369] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0370] The server sends the seventh identity information of the server and the meta-attribute information related to the business to the management end, and sends the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server; so that the management end obtains the first authority information and the first identity information of the server; and registers the first authority information and the first identity information accordingly; and sends the first identity information to the server end;

[0371] The business-related meta-attribute information includes: server identification, CPU identification, basic input and output system identification, operating system identification, database identification, business information, and signature public key.

[0372] Corresponding to the above-mentioned fully secret database encryption system, the embodiment of the present application also provides a fully secret database encryption device, which is applied to the fully secret database encryption system. The fully secret database encryption system includes a client and a server. The server pre-registers the first identity information and the first permission information of the server with the management end. Fig.10 As shown, the device comprises:

[0373] The first identification module 101 is used to drive the client to obtain and identify whether the target data to be sent to the server is private data; if the target data is private data, determine the data type and sensitivity level of the target data; and identify the target processing to be performed on the server after the target data is sent to the server;

[0374] The determination module 102 is used to drive the client to determine whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end;

[0375] The second identification module 103 is used to drive the client to identify whether the target processing is a preset processing;

[0376] When the client determines that the server has the authority to process the target data and recognizes that the target processing is the preset processing,

[0377] The encryption module 104 is used to drive the client to encrypt the target data, obtain the first encrypted data, and send the first encrypted data to the server;

[0378] An execution module 105 is used to drive the server to execute a target process on the first encrypted data to obtain a processing result;

[0379] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing,

[0380] The encryption module 104 is further used to drive the client to obtain a first ciphertext from the management end, where the first ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key with the public key of the client; decrypt the first ciphertext with the private key of the client to obtain the first key, and encrypt the target data with the first key to obtain the second encrypted data; and send the second encrypted data to the service end;

[0381] The verification module 106 is used to drive the server to send the second identity information of the server to the management end in response to the second encrypted data, so that the management end verifies whether the management end has the corresponding second identity information stored, and whether the second permission information corresponding to the second identity information is normal. If the management end has the second identity information stored, and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, and the second ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end;

[0382] The decryption module 107 is used to drive the server to decrypt the second ciphertext using the private key of the server through the trusted environment to obtain the first key; decrypt the second encrypted data using the first key through the trusted environment to obtain the target data, and perform the target processing on the target data through the trusted environment as the processing result of performing the target processing on the target data;

[0383] The storage module 108 is used for storing the processing result in a confidential form on the server side when the processing result is private data.

[0384] In the technical solution provided in the embodiment of the present application, before sending the target data to the server, the client first analyzes the target data to determine whether the target data is private data. When it is determined that the target data is private data, the client further determines the data type and sensitivity level of the target data, and determines the operation that the server needs to perform on the target data after the target data is sent to the server, that is, target processing. Thereafter, the server determines whether it has the authority to process the target data in combination with the first permission information of the server obtained from the client. When the server has the authority to process the target data, the server executes the subsequent step of sending the target data to the server, thereby reducing the possibility of data leakage.

[0385] When the client determines that the server has the authority to process the target data, and recognizes that the target processing is a preset processing, the target data is encrypted to obtain the first encrypted data, and then the first encrypted data is directly sent to the server, and the server performs the target processing on the first encrypted data to obtain the processing result. It can be understood that when the target processing is the preset processing, regardless of whether the processed data is ciphertext or plaintext, the processing result obtained is the same. Therefore, when the target processing is the preset processing, the target data is directly encrypted and sent to the server, and the server processes the ciphertext of the target data. In this way, the risk of target data leakage is reduced, and at the same time, the complexity of the calculation is reduced.

[0386] When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, the client obtains the first ciphertext from the management end, and uses the client's private key to decrypt the first ciphertext to obtain the first key, and then uses the first key to encrypt the target data to obtain second encrypted data, and then sends the second encrypted data to the server; after the server receives the second encrypted data, in response to the second encrypted data, it sends the second identity information to the management end so that the management end authenticates the server. When the management end determines that the second identity information is stored and the authority information corresponding to the second identity information is normal, the management end uses the server's public key to encrypt the first key to obtain the second ciphertext, and sends the second ciphertext to the server's trusted environment. Then, the server uses its own private key to decrypt the second ciphertext in the trusted environment to obtain the first key. Then, the first encrypted data is decrypted using the first key in the trusted environment to obtain the target data, and then the processing result of the target data is obtained. It can be understood that in the embodiment of the present application, the first key for encrypting the target data is provided by the management end, and the plaintext of the first key and the plaintext of the target data only exist in the form of ciphertext in the trusted environment of the server end. Therefore, even if the target data exists in the form of plaintext on the server end, the risk of leakage is low; after determining the processing result, the processing result is also stored in the form of ciphertext, which also reduces the risk of data leakage. In this way, based on the technical solution provided in the embodiment of the present application, data can exist in the form of ciphertext in a non-trusted environment at all stages of the entire life cycle.

[0387] In some embodiments, the second encrypted data includes third encrypted data and third ciphertext, and the third encrypted data and the third ciphertext are obtained by:

[0388] The client encrypts the target data using the second key to obtain third encrypted data;

[0389] The client uses the first key to encrypt the second key to obtain a third ciphertext;

[0390] The server uses the first key to decrypt the second encrypted data in a trusted environment to obtain the target data, including:

[0391] The server uses the first key to decrypt the third ciphertext in a trusted environment to obtain a second key.

[0392] The server uses the second key to decrypt the third encrypted data in a trusted environment to obtain the target data.

[0393] In some embodiments, the encryption module 104 is specifically configured to:

[0394] The driver client sends the fourth identity information of the client to the management end; so that the management end verifies whether the management end has stored the fourth identity information and whether the fourth permission information corresponding to the fourth identity information is normal. If the management end has stored the fourth identity information and the fourth permission information corresponding to the fourth identity information is normal, the management end uses the public key of the client to encrypt the first key to obtain the first ciphertext, and sends the first ciphertext to the client.

[0395] In some embodiments, the client pre-registers the third identity information and the third permission information of the client on the management end; when the processing result is private data,

[0396] The verification module 106 is further used to drive the server to send the fifth identity information of the server to the management end; so that the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the server obtains the fourth ciphertext from the management end through the trusted environment, and the fourth ciphertext is the ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server end;

[0397] The encryption module 104 is further used to drive the server to decrypt the fourth ciphertext using the private key of the server through the trusted environment to obtain the third key; and to encrypt the processing result using the third key through the trusted environment to obtain the first encryption result; and send the first encryption result to the client;

[0398] The verification module 106 is further used to drive the client to send the sixth identity information of the client to the management end in response to the first encryption result; so that the management end verifies whether the management end has the corresponding sixth identity information stored, and whether the sixth permission information corresponding to the sixth identity information is normal. If the management end has the sixth identity information stored, and the sixth permission information corresponding to the sixth identity information is normal, the management end uses the public key of the client to encrypt the third key to obtain the fifth ciphertext, and sends the fifth ciphertext to the client;

[0399] The decryption module 107 is further used to drive the client to decrypt the fifth ciphertext using the client's private key to obtain a third key; and to decrypt the first encryption result using the third key to obtain a processing result;

[0400] In some embodiments, the first encryption result includes the second encryption result and the sixth ciphertext, and the second encryption result and the sixth ciphertext are obtained by:

[0401] The server encrypts the processing result using the fourth key in the trusted environment to obtain a second encrypted result;

[0402] The server encrypts the fourth key using the third key in the trusted environment to obtain a sixth ciphertext;

[0403] The client uses the third key to decrypt the first encryption result to obtain a processing result, including:

[0404] The client uses the third key to decrypt the sixth ciphertext to obtain the fourth key;

[0405] The client uses the fourth key to decrypt the second encryption result to obtain a processing result.

[0406] In some embodiments, the storage module 108 is specifically configured to:

[0407] The driver server dynamically intercepts the storage instruction for the processing result; encrypts the processing result to obtain a third encrypted result, and stores the third encrypted result;

[0408] The driver server dynamically intercepts the read instruction for the processing result; and reads the third encryption result, decrypts the third encryption result, and obtains the processing result.

[0409] In some embodiments, the client embeds the data type and sensitivity level of the target data into a message header extension field of the message carrying the target data;

[0410] The client determines whether the server has the authority to process the target data according to the first authority information of the server sent by the client, the data type and sensitivity level of the target data, and the target processing, including:

[0411] The client determines whether the server has the authority to process the target data based on the first authority information of the server sent by the management end, the data type and sensitivity level of the target data in the message header extension field, and the target processing.

[0412] In some embodiments, the encryption module 104 is specifically configured to:

[0413] If the target is to compare the size, the client uses order-preserving encryption OPE or searchable symmetric encryption ORE to encrypt the target data;

[0414] If the target processing is image similarity search, the client uses the perceptual hash algorithm to encrypt the target data;

[0415] If the target processing is addition, subtraction, multiplication, division, or average operation, the client uses homomorphic encryption to encrypt the target data.

[0416] In some embodiments, the client determines a target encryption unit from a plurality of encryption units according to a preset load balancing algorithm; encrypts the data to be encrypted using the target encryption unit;

[0417] The management end writes the real-time key negotiation information into the key information block of the management end's blockchain; the key negotiation information includes the negotiation participants, the key negotiation protocol process, and the key attribute information.

[0418] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0419] The server pre-registers the first identity information and the first permission information of the server in the identity information block of the blockchain of the management end;

[0420] The client pre-registers the third identity information and third authority information of the client on the management end, including:

[0421] The client pre-registers the third identity information and the third permission information of the client in the identity information block of the blockchain of the management end.

[0422] In some embodiments, the server pre-registers the first identity information and the first permission information of the server with the management end, including:

[0423] The server sends the seventh identity information of the server and the meta-attribute information related to the business to the management end, and sends the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server; so that the management end obtains the first authority information and the first identity information of the server; and registers the first authority information and the first identity information accordingly; and sends the first identity information to the server end;

[0424] The business-related meta-attribute information includes: server identification, CPU identification, basic input and output system identification, operating system identification, database identification, business information, and signature public key.

[0425] The present application also provides an electronic device, such as Fig.11 As shown, including:

[0426] A memory 111, used for storing computer programs;

[0427] The processor 112 is used to implement any of the above-mentioned data encryption systems when executing the program stored in the memory 111.

[0428] Furthermore, the electronic device may further include a communication bus and / or a communication interface, and the processor 112, the communication interface, and the memory 111 communicate with each other via the communication bus.

[0429] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0430] The communication interface is used for communication between the above electronic device and other devices.

[0431] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0432] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0433] In another embodiment provided in the present application, a computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, any of the above-mentioned fully secret database encryption systems is implemented.

[0434] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any fully secret database encryption system in the above-mentioned embodiments.

[0435] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a solid-state hard disk (SSD), etc.

[0436] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0437] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0438] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A fully secret database encryption system, characterized in that: The system includes a client and a server; the server is pre-registered with the management end with first identity information and first authority information of the server; The client is used to obtain and identify whether the target data to be sent to the server is private data; In the case where the target data is private data, determining the data type and sensitivity level of the target data; and identifying the target processing to be performed on the server after the target data is sent to the server; The client is further configured to determine whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end; The client is further used to identify whether the target processing is a preset processing; When the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing, The client is further configured to encrypt the target data to obtain first encrypted data, and send the first encrypted data to the server; The server is used to perform the target processing on the first encrypted data to obtain a processing result; When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, The client is further used to obtain a first ciphertext from the management end, where the first ciphertext is a ciphertext of the first key obtained by the management end encrypting the first key using the public key of the client; Decrypting the first ciphertext using the private key of the client to obtain the first key, and encrypting the target data using the first key to obtain second encrypted data; and sending the second encrypted data to the server; The server is further configured to send the second identity information of the server to the management end in response to the second encrypted data, so that the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal. If the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, where the second ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end; The server is further configured to decrypt the second ciphertext using the private key of the server through the trusted environment to obtain the first key; Decrypting the second encrypted data using the first key through the trusted environment to obtain the target data, and performing the target processing on the target data through the trusted environment as a processing result of performing the target processing on the target data; Wherein, when the processing result is private data, the server is further used to store the processing result in a confidential form on the server.

2. The system according to claim 1, characterized in that The second encrypted data includes third encrypted data and third ciphertext, and the third encrypted data and the third ciphertext are obtained in the following manner: The client encrypts the target data using the second key to obtain the third encrypted data; The client uses the first key to encrypt the second key to obtain the third ciphertext; The server uses the first key to decrypt the second encrypted data through the trusted environment to obtain the target data, including: The server uses the first key to decrypt the third ciphertext through the trusted environment to obtain the second key; The server uses the second key to decrypt the third encrypted data through the trusted environment to obtain the target data.

3. The system according to claim 1, characterized in that The client pre-registers the third identity information and the third authority information of the client in the corresponding management terminal, and the client obtains the first ciphertext from the management terminal, including: The client sends the fourth identity information of the client to the management end; So that the management end can verify whether the management end stores the fourth identity information and whether the fourth authority information corresponding to the fourth identity information is normal. If the management end stores the fourth identity information and the fourth authority information corresponding to the fourth identity information is normal, the management end uses the public key of the client to encrypt the first key, obtain the first ciphertext, and send the first ciphertext to the client.

4. The system according to claim 1, characterized in that The client has pre-registered the third identity information and the third authority information of the client in the management terminal; when the processing result is private data, The server is further configured to send the fifth identity information of the server to the management end, so that the management end verifies whether the management end stores the fifth identity information and whether the fifth permission information corresponding to the fifth identity information is normal. If the management end stores the fifth identity information and the fifth permission information corresponding to the fifth identity information is normal, the server obtains a fourth ciphertext from the management end through a trusted environment, where the fourth ciphertext is a ciphertext of the third key obtained by the management end encrypting the third key using the public key of the server. The server is further configured to decrypt the fourth ciphertext using the private key of the server through the trusted environment to obtain the third key; and encrypt the processing result using the third key through the trusted environment to obtain a first encrypted result; and send the first encrypted result to the client; The client is further configured to send the sixth identity information of the client to the management end in response to the first encryption result; so that the management end verifies whether the management end stores the sixth identity information and whether the sixth permission information corresponding to the sixth identity information is normal; if the management end stores the sixth identity information and the sixth permission information corresponding to the sixth identity information is normal, the management end encrypts the third key using the public key of the client to obtain a fifth ciphertext, and sends the fifth ciphertext to the client; The client is further used to use the private key of the client to decrypt the fifth ciphertext to obtain the third key; and use the third key to decrypt the first encryption result to obtain the processing result.

5. The system according to claim 4, characterized in that The first encryption result includes a second encryption result and a sixth ciphertext, and the second encryption result and the sixth ciphertext are obtained in the following manner: The server encrypts the processing result using a fourth key through the trusted environment to obtain the second encrypted result; The server encrypts the fourth key using the third key through the trusted environment to obtain the sixth ciphertext; The client uses the third key to decrypt the first encryption result to obtain the processing result, including: The client uses the third key to decrypt the sixth ciphertext to obtain the fourth key; The client uses the fourth key to decrypt the second encryption result to obtain the processing result.

6. The system according to claim 1, characterized in that The server stores the processing result in a secret form on the server, including: The server is further configured to dynamically intercept a storage instruction for the processing result; encrypt the processing result to obtain a third encrypted result, and store the third encrypted result; The server is also used to dynamically intercept a read instruction for the processing result; and read the third encryption result, decrypt the third encryption result, and obtain the processing result.

7. The system according to claim 1, characterized in that The client is further used to embed the data type and sensitivity level of the target data into a message header extension field of the message carrying the target data; The client determines, according to the first permission information of the server sent by the client, the data type and sensitivity level of the target data, and the target processing, whether the server has the permission to process the target data, including: The client is also used to determine whether the server has the authority to process the target data based on the first authority information of the server sent by the management end, the data type and sensitivity level of the target data in the message header extension field, and the target processing.

8. The system according to claim 1, characterized in that The client encrypts the target data to obtain first encrypted data, including: If the target processing is to compare the size, the client is specifically used to encrypt the target data using order-preserving encryption OPE or searchable symmetric encryption ORE; If the target processing is a picture similarity search, the client is specifically used to encrypt the target data using a perceptual hash algorithm; If the target processing is addition, subtraction, multiplication, division, or average operation, the client is specifically used to encrypt the target data using homomorphic encryption.

9. The system according to claim 1, characterized in that The client is further used to determine a target encryption unit from multiple encryption units according to a preset load balancing algorithm; and use the target encryption unit to encrypt data to be encrypted; The management end is also used to write real-time key negotiation information into the key information block of the blockchain of the management end; the key negotiation information includes negotiation participants, key negotiation protocol process, and key attribute information.

10. The system according to claim 3, characterized in that The server pre-registers the first identity information and the first authority information of the server with the management end, including: The server has pre-registered the first identity information and the first permission information of the server in the identity information block of the blockchain of the management end; The client pre-registers the third identity information and the third authority information of the client in the management end, including: The client pre-registers the third identity information and the third permission information of the client in the identity information block of the blockchain of the management end.

11. The system according to claim 1, characterized in that The server has pre-registered first identity information and first authority information of the server on the management end, including: The server is further configured to send the seventh identity information of the server and business-related meta-attribute information to the management end, and send the trusted environment information of the trusted environment of the server to the management end through the trusted environment of the server; so that the management end obtains the first authority information and the first identity information of the server; and registers the first authority information and the first identity information accordingly; and sends the first identity information to the server; The service-related meta-attribute information includes: server identification, CPU identification, basic input / output system identification, operating system identification, database identification, service information, and signature public key.

12. A fully secret database encryption method, applied to a fully secret database encryption system, characterized in that: The system includes a client and a server; the server is pre-registered with the management end with first identity information and first authority information of the server; The client obtains and identifies whether the target data to be sent to the server is private data; In the case where the target data is private data, determining the data type and sensitivity level of the target data; and identifying the target processing to be performed on the server after the target data is sent to the server; The client determines whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end; The client identifies whether the target processing is a preset processing; When the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing, The client encrypts the target data to obtain first encrypted data, and sends the first encrypted data to the server; The server performs the target processing on the first encrypted data to obtain a processing result; When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, The client obtains a first ciphertext from the management end, where the first ciphertext is a ciphertext of the first key obtained by the management end encrypting the first key using the public key of the client; Decrypting the first ciphertext using the private key of the client to obtain the first key, and encrypting the target data using the first key to obtain second encrypted data; and sending the second encrypted data to the server; The server sends the second identity information of the server to the management end in response to the second encrypted data; so that the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal. If the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, where the second ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end; The server uses the private key of the server to decrypt the second ciphertext through the trusted environment to obtain the first key; Decrypting the second encrypted data using the first key through the trusted environment to obtain the target data, and performing the target processing on the target data through the trusted environment as a processing result of performing the target processing on the target data; When the processing result is private data, the server stores the processing result in a confidential form on the server.

13. A fully secret database encryption device, applied to a fully secret database encryption system, characterized in that: The fully secret database encryption system includes a client and a server; the server is pre-registered with the first identity information and the first authority information of the server at the management end; the device includes: A first identification module, used to drive the client to obtain and identify whether the target data to be sent to the server is private data; In the case where the target data is private data, determining the data type and sensitivity level of the target data; and identifying the target processing to be performed on the server after the target data is sent to the server; A first determination module, configured to drive the client to determine whether the server has the authority to process the target data according to the data type and sensitivity level of the target data, the target processing, and the first authority information of the server obtained from the management end; A second identification module, used to drive the client to identify whether the target processing is a preset processing; When the client determines that the server has the authority to process the target data and identifies that the target processing is the preset processing, An encryption module, used for driving the client to encrypt the target data to obtain first encrypted data, and sending the first encrypted data to the server; An execution module, used for driving the server to execute the target processing on the first encrypted data to obtain a processing result; When the client determines that the server has the authority to process the target data and recognizes that the target processing is not the preset processing, The encryption module is further used to drive the client to obtain a first ciphertext from the management end, where the first ciphertext is a ciphertext of the first key obtained after the management end encrypts the first key using the public key of the client; Decrypting the first ciphertext using the private key of the client to obtain the first key, and encrypting the target data using the first key to obtain second encrypted data; and sending the second encrypted data to the server; a verification module, configured to drive the server to send second identity information of the server to the management end in response to the second encrypted data; so that the management end verifies whether the management end stores the second identity information and whether the second permission information corresponding to the second identity information is normal. If the management end stores the second identity information and the second permission information corresponding to the second identity information is normal, the server obtains the second ciphertext from the management end through the trusted environment, where the second ciphertext is the ciphertext of the first key obtained by the management end encrypting the first key using the public key of the server end; a decryption module, used to drive the server to decrypt the second ciphertext using the private key of the server through the trusted environment to obtain the first key; Decrypting the second encrypted data using the first key through the trusted environment to obtain the target data, and performing the target processing on the target data through the trusted environment as a processing result of performing the target processing on the target data; The storage module is used for storing the processing result in a confidential form on the server side when the processing result is private data.

Images