Non-intrusive data information security management method and device

Abstract

The invention discloses a non-intrusive data information security management method and device. The method comprises the following steps: deploying database middleware between an application program and a database; the middleware manages database connection; the middleware receives an SQL request from an application program; the middleware analyzes the received SQL request; the middleware judges whether the SQL request contains a sensitive field needing to be specially processed or not; the fields are sensitive fields, and the middleware automatically applies an encryption and decryption algorithm; the modified SQL request is executed on a database so as to carry out data access operation; an execution result is returned to the application program, and the middleware decrypts the data; the Web interface provided by the middleware is used for configuring and managing encryption strategies, algorithms and secret keys; re-encrypting the existing data processed by using the old encryption scheme; and completing a data security management process. According to the method, access to sensitive fields is identified through the SQL analysis module, an encryption and decryption algorithm is automatically applied, and the safety of data in the transmission and storage process is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a non-intrusive data information security management method and device. Background Art

[0002] Traditional data information security management methods have many shortcomings, mainly including the following aspects:

[0003] Customized development requirements: The diversity of enterprise business needs requires that data security management solutions be customized for different data structures, which is not only time-consuming and labor-intensive, but also increases development and maintenance costs.

[0004] Code maintenance complexity: The encryption and decryption logic is directly embedded in the application code, resulting in poor code maintainability. Each upgrade or modification may require re-examination and modification of the encryption and decryption logic.

[0005] High development and maintenance costs: Due to the lack of a unified encryption management mechanism, the development and maintenance of each system are independent, which increases the complexity and risk of the overall system.

[0006] Encryption algorithm limitations: Traditional systems usually only support limited encryption algorithms and are difficult to adapt to different application scenarios and business needs.

[0007] Programming language and platform limitations: Different programming languages ​​and platforms have different levels of support for encryption algorithms. Old systems may only support specific encryption algorithms, while modern systems recommend the use of more secure algorithms.

[0008] Interoperability and compatibility issues: In cross-system and cross-platform environments, different implementations of the same encryption algorithm in different systems may cause problems in data exchange and integration.

[0009] Security and maintainability issues: Decentralized management of keys and encryption configurations and the lack of a unified encryption management mechanism increase the complexity and risk of the system.

[0010] Key management strategy: The lack of an effective key management strategy leads to security risks in the key generation, storage, and rotation processes.

[0011] Data desensitization requirements: For existing data, data desensitization needs to be performed to ensure data security, consistency, and compatibility with new systems. Summary of the invention

[0012] In order to solve the problems existing in the prior art, the present invention provides a non-intrusive data information security management method and device, which identifies access to sensitive fields through an SQL parsing module and automatically applies corresponding encryption and decryption algorithms to ensure the security of data during transmission and storage.

[0013] To achieve the above object, the present invention adopts the following technical solutions:

[0014] In one embodiment of the present invention, a non-intrusive data information security management method is proposed, the method comprising:

[0015] S01. Middleware deployment: Deploy database middleware between the application and the database. Database middleware is referred to as middleware below and acts as a proxy for data interaction.

[0016] like Figure 2 As shown, S02, connection management, the middleware manages database connections and uses connection pools to optimize resource usage;

[0017] Furthermore, the database middleware is a proxy layer between the application and the database. The database middleware provides a unified connection interface to simplify the interaction process between the application and the database.

[0018] The database middleware adopts an efficient database connection pool mechanism to uniformly manage connections with multiple database instances;

[0019] The database middleware applies a load balancing strategy to select the optimal database connection according to the real-time system load status, including the database instance with the shortest response time, the lightest load or the closest geographical location.

[0020] Significantly reduce the resource consumption of frequent creation and destruction of connections, thereby improving the overall system performance.

[0021] Based on the enterprise scale and business needs, you can flexibly choose a single-node or multi-node deployment architecture to enhance system availability and achieve load balancing.

[0022] Furthermore, the functions integrated in the database middleware include: connection management, SQL statement parsing and rewriting, data encryption and decryption processing, and cache management mechanism.

[0023] The middleware is designed to provide the highest level of data security without sacrificing performance. Through in-memory configuration and intelligent parsing, the middleware is able to quickly respond to SQL requests while ensuring data confidentiality and integrity.

[0024] Middleware can provide an efficient, secure and application-transparent data encryption and decryption solution, simplifying the complexity of data security management while improving the security of data operations.

[0025] Through the above measures, the middleware not only improves the efficiency and security of data access, but also provides enterprises with a flexible and scalable database access solution.

[0026] The middleware provides an intuitive web interface for administrators to configure and manage encryption policies and algorithms. This interface is the core configuration center of the middleware system and is responsible for all encryption-related settings.

[0027] Standard encryption algorithms: The web interface lists a series of standard encryption algorithms for selection, such as AES, MD5, RC4, SM3 / SM4, etc. Administrators can select the appropriate algorithm and configure related parameters, such as encryption key, encryption mode (such as CBC, ECB, etc.), encryption strength (such as AES-128, AES-256, etc.).

[0028] Key management: Administrators can manage encryption keys on the interface, including key generation, storage, rotation, etc. The system provides hierarchical management of keys to ensure that different keys are used for data of different sensitivities.

[0029] Upload and configure custom encryption and decryption algorithms, upload custom Java libraries: The administrator uploaded a custom Java library on the web interface, which contains a custom encryption algorithm "CustomEncrypt". This algorithm may be designed based on specific business needs and provide encryption features or performance advantages that standard algorithms cannot meet.

[0030] Custom algorithm selection and configuration: In the web interface, the administrator selects the "CustomEncrypt" algorithm to apply to the custom_field field of the users table. The administrator can further configure the algorithm's parameters, such as encryption strength, mode, etc.

[0031] Upload a key management script: In addition to the Java library of the custom encryption algorithm, the administrator also needs to upload a key management script. This script is used to manage the keys required by the CustomEncrypt algorithm.

[0032] Features include:

[0033] Key generation and distribution: Scripts can contain logic for dynamically generating keys, generating or selecting keys based on specific context (such as field names, usage scenarios).

[0034] Key rotation and update: Define key rotation strategies to regularly update keys and improve system security. Scripts can implement the process of revoking old keys and replacing new keys.

[0035] Key access control: Set access permissions to keys through scripts to ensure that only authorized users or system components can access and use keys.

[0036] Encryption and decryption strategy definition and selection:

[0037] Encryption policy: Administrators can define encryption policies through the web interface, including selecting which fields need to be encrypted, which encryption algorithm to use, and the selection of keys. For example, you can select AES-256 encryption for the password field in the users table and specify a specific key.

[0038] Decryption policy, corresponding to encryption policy, administrators can also define decryption policy. Decryption policy defines how to restore encrypted data, usually including the selection of corresponding decryption algorithm and key. For example, when reading data, the same key and algorithm as used for encryption need to be used for decryption.

[0039] With policy refinement, administrators can choose different encryption and decryption policies based on the sensitivity and type of data. For example, for highly sensitive data (such as financial information), you can choose a stronger encryption algorithm and a more complex key management policy; for low-sensitivity data (such as public user information), you can choose a simple hash process.

[0040] S03, receiving SQL request, the middleware receives the SQL request from the application;

[0041] Further, the S03 includes:

[0042] S031. Predefined configuration: The middleware uses a centralized configuration file or database table to maintain sensitive field information. The sensitive field information includes: field name, associated table, data type, and encryption requirements. The above information is defined and loaded when the system is initialized;

[0043] S032. Configuration loading: When starting the middleware, the configuration data is loaded into the memory for quick access. The configuration data includes: field encryption requirements and possible access control rules.

[0044] S04, parsing the SQL request: the middleware parses the received SQL request to identify the operation type and the data involved;

[0045] Furthermore, the S04 includes: after the middleware receives the SQL request, it uses the parsing engine to extract key information, including: operation type, data table, field and query condition.

[0046] S05, sensitive fields, the middleware determines whether the SQL request contains sensitive fields that need special processing;

[0047] Furthermore, S05 includes: the parsing engine compares the fields involved in the request with the sensitive field list in the memory to identify the fields that need to be encrypted or decrypted.

[0048] S06. Apply encryption and decryption. If the field is a sensitive field, the middleware automatically applies the encryption and decryption algorithm.

[0049] Further, the S06 includes:

[0050] S061, Algorithm configuration, the encryption or decryption requirements of each sensitive field are defined in detail in the configuration, including: the selected algorithm type, encryption key, encryption mode and other parameters;

[0051] S062. Algorithm loading and application. The middleware loads the corresponding algorithm at startup according to the configuration and dynamically inserts encryption or decryption functions during SQL execution.

[0052] S063. Function name and parameter determination: Based on the encryption configuration of the field, the middleware determines the inserted function name and required parameters, including field value, key, encryption mode, etc.

[0053] S07, executing SQL operation, the modified SQL request is executed on the database to perform data access operation;

[0054] S08, return result, the execution result is returned to the application, and the middleware decrypts the data;

[0055] Furthermore, the S08 includes: before sending the encrypted data back to the application, the middleware calls a corresponding decryption function to convert the encrypted field back to the original format to ensure that the application receives and processes the plaintext data.

[0056] S09, Management configuration, use the Web interface provided by the middleware to configure and manage encryption policies, algorithms and keys;

[0057] S010. Process existing data and re-encrypt existing data processed using the old encryption scheme to ensure compatibility with the new scheme;

[0058] Although the existing data has been desensitized by the old solution, the original encrypted data may not be decrypted by the new solution due to changes in the encryption algorithm or key management strategy in the new solution. Therefore, the existing data must be desensitized again to ensure data security, consistency and compatibility with the new system.

[0059] Assume that in the users table, the original data has been desensitized according to the old scheme, and the email field has been encrypted using the old encryption algorithm. Now, the email field needs to be desensitized again according to the new scheme and encrypted using the new AES-256 algorithm.

[0060] Further, the S010 includes:

[0061] S0101. Add a ciphertext column. Add a new ciphertext column in the users table to store data encrypted using the new algorithm.

[0062] S0102. Read and decrypt old data, extract all existing field data from the database, and decrypt some field data to restore the original information;

[0063] S0103. Read and decrypt old data, apply the encryption algorithm in the new scheme to the read data, and store the encrypted result in a new ciphertext column;

[0064] S0104. Update the database, write the newly encrypted data into the new ciphertext column, and retain the old ciphertext column to ensure data security and rollback of operations;

[0065] S0105. Verify and check by comparing the original data with the encrypted data or by decrypting samples to ensure that all data has been correctly encrypted and written into the new ciphertext column;

[0066] S0106. Switch to the new encrypted column. After verifying that the new encrypted data is correct, switch the system to use the new ciphertext column for data reading and writing operations. All queries and operations will be based on the new encrypted data.

[0067] S0107. Delete the old encrypted data columns. After confirming that the system is running stably and the old data is no longer needed, delete the old ciphertext columns and switch to the new encryption scheme.

[0068] S011. End, completing the data security management process.

[0069] In one embodiment of the present invention, a non-intrusive data information security management device is also proposed, the device comprising:

[0070] Middleware deployment module deploys database middleware between the application and the database. Database middleware is referred to as middleware hereafter and acts as a proxy for data interaction.

[0071] Connection management module, middleware manages database connections and uses connection pools to optimize resource usage;

[0072] SQL request receiving module, the middleware receives SQL requests from the application;

[0073] Parsing SQL request module: The middleware parses the received SQL request to identify the operation type and the data involved;

[0074] Sensitive field module, the middleware determines whether the SQL request contains sensitive fields that require special processing;

[0075] Apply the encryption and decryption module. If the field is a sensitive field, the middleware automatically applies the encryption and decryption algorithm.

[0076] Execute the SQL operation module, and the modified SQL request is executed on the database to perform data access operations;

[0077] Return result module, the execution result is returned to the application, and the middleware decrypts the data;

[0078] Management configuration module, using the web interface provided by the middleware to configure and manage encryption policies, algorithms and keys;

[0079] Processing stock data module, re-encrypting the existing data processed by the old encryption scheme to ensure compatibility with the new scheme;

[0080] End the module and complete the data security management process.

[0081] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned non-invasive data information security management method is implemented.

[0082] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing a non-intrusive data information security management method.

[0083] Beneficial effects:

[0084] The present invention provides a non-intrusive data information security management method and device, which has the following beneficial effects:

[0085] Transparency and non-intrusive code: Applications can use the encryption and decryption functions provided by the database middleware without modifying existing code to achieve automatic data protection, thereby significantly reducing the technical complexity of development and maintenance work.

[0086] Automatic identification of sensitive fields: The middleware has the ability to automatically identify sensitive fields in SQL statements and automatically apply appropriate encryption and decryption logic, which simplifies the data protection process and ensures the security of data at every stage.

[0087] Flexible policy configuration and management interface: Provides an intuitive and easy-to-use web interface that enables administrators to flexibly define and adjust encryption policies based on the type and sensitivity of data, including key management and algorithm selection, enhancing the system's configurability and ease of management. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1It is a flow chart of the non-intrusive data information security management method of the present invention;

[0089] Figure 2 This is a schematic diagram of the database middleware module;

[0090] Figure 3 It is a flowchart of the data encryption and decryption solution;

[0091] Figure 4 It is a structural schematic diagram of the non-intrusive data information security management device of the present invention;

[0092] Figure 5 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0093] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0094] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0095] According to an embodiment of the present invention, a non-intrusive data information security management method and device are proposed, which identifies access to sensitive fields through an SQL parsing module and automatically applies corresponding encryption and decryption algorithms to ensure the security of data during transmission and storage.

[0096] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0097] like Figure 1 As shown, the present invention relates to a non-intrusive data information security management method, the method comprising:

[0098] S01. Middleware deployment: Deploy database middleware between the application and the database. Database middleware is referred to as middleware below and acts as a proxy for data interaction.

[0099] like Figure 2 As shown, S02, connection management, the middleware manages database connections and uses connection pools to optimize resource usage;

[0100] The database middleware is a proxy layer between the application and the database. The database middleware provides a unified connection interface to simplify the interaction process between the application and the database.

[0101] The database middleware adopts an efficient database connection pool mechanism to uniformly manage connections with multiple database instances;

[0102] The database middleware applies a load balancing strategy to select the optimal database connection according to the real-time system load status, including the database instance with the shortest response time, the lightest load or the closest geographical location.

[0103] Significantly reduce the resource consumption of frequent creation and destruction of connections, thereby improving the overall system performance.

[0104] Based on the enterprise scale and business needs, you can flexibly choose a single-node or multi-node deployment architecture to enhance system availability and achieve load balancing.

[0105] The functions integrated by the database middleware include: connection management, SQL statement parsing and rewriting, data encryption and decryption processing, and cache management mechanism.

[0106] For example:

[0107] The original application directly connected to the database through jdbc:mysql: / / db_host:3306 / mydatabase, and now it connects through the middleware. You only need to update the connection string to jdbc:mysql: / / autoproxy:3306 / mydatabase. This change simplifies the configuration of the application and leaves the complexity and security management of the connection to the middleware.

[0108] The middleware is designed to provide the highest level of data security without sacrificing performance. Through in-memory configuration and intelligent parsing, the middleware is able to quickly respond to SQL requests while ensuring data confidentiality and integrity.

[0109] Middleware can provide an efficient, secure and application-transparent data encryption and decryption solution, simplifying the complexity of data security management while improving the security of data operations.

[0110] Through the above measures, the middleware not only improves the efficiency and security of data access, but also provides enterprises with a flexible and scalable database access solution.

[0111] The middleware provides an intuitive web interface for administrators to configure and manage encryption policies and algorithms. This interface is the core configuration center of the middleware system and is responsible for all encryption-related settings.

[0112] Standard encryption algorithms: The web interface lists a series of standard encryption algorithms for selection, such as AES, MD5, RC4, SM3 / SM4, etc. Administrators can select the appropriate algorithm and configure related parameters, such as encryption key, encryption mode (such as CBC, ECB, etc.), encryption strength (such as AES-128, AES-256, etc.).

[0113] Key management: Administrators can manage encryption keys on the interface, including key generation, storage, rotation, etc. The system provides hierarchical management of keys to ensure that different keys are used for data of different sensitivities.

[0114] Upload and configure custom encryption and decryption algorithms, upload custom Java libraries: The administrator uploaded a custom Java library on the web interface, which contains a custom encryption algorithm "CustomEncrypt". This algorithm may be designed based on specific business needs and provide encryption features or performance advantages that standard algorithms cannot meet.

[0115] Custom algorithm selection and configuration: In the web interface, the administrator selects the "CustomEncrypt" algorithm to apply to the custom_field field of the users table. The administrator can further configure the algorithm's parameters, such as encryption strength, mode, etc.

[0116] Upload a key management script: In addition to the Java library of the custom encryption algorithm, the administrator also needs to upload a key management script. This script is used to manage the keys required by the CustomEncrypt algorithm.

[0117] Features include:

[0118] Key generation and distribution: Scripts can contain logic for dynamically generating keys, generating or selecting keys based on specific context (such as field names, usage scenarios).

[0119] Key rotation and update: Define key rotation strategies to regularly update keys and improve system security. Scripts can implement the process of revoking old keys and replacing new keys.

[0120] Key access control: Set access permissions to keys through scripts to ensure that only authorized users or system components can access and use keys.

[0121] Encryption and decryption strategy definition and selection:

[0122] Encryption policy: Administrators can define encryption policies through the web interface, including selecting which fields need to be encrypted, which encryption algorithm to use, and the selection of keys. For example, you can select AES-256 encryption for the password field in the users table and specify a specific key.

[0123] Decryption policy, corresponding to encryption policy, administrators can also define decryption policy. Decryption policy defines how to restore encrypted data, usually including the selection of corresponding decryption algorithm and key. For example, when reading data, the same key and algorithm as used for encryption need to be used for decryption.

[0124] With policy refinement, administrators can choose different encryption and decryption policies based on the sensitivity and type of data. For example, for highly sensitive data (such as financial information), you can choose a stronger encryption algorithm and a more complex key management policy; for low-sensitivity data (such as public user information), you can choose a simple hash process.

[0125] S03, receiving SQL request, the middleware receives the SQL request from the application;

[0126] The S03 includes:

[0127] S031. Predefined configuration: The middleware uses a centralized configuration file or database table to maintain sensitive field information. The sensitive field information includes: field name, associated table, data type, and encryption requirements. The above information is defined and loaded when the system is initialized;

[0128] S032. Configuration loading: When starting the middleware, the configuration data is loaded into the memory for quick access. The configuration data includes: field encryption requirements and possible access control rules.

[0129] S04, parsing the SQL request: the middleware parses the received SQL request to identify the operation type and the data involved;

[0130] The S04 includes: after the middleware receives the SQL request, it uses the parsing engine to extract key information, including: operation type (such as SELECT, INSERT, UPDATE), data table, field and query condition.

[0131] S05, sensitive fields, the middleware determines whether the SQL request contains sensitive fields that need special processing;

[0132] The S05 includes: the parsing engine compares the fields involved in the request with the sensitive field list in the memory, and identifies the fields that need to be encrypted or decrypted.

[0133] For example, if the email field of the users table is marked as sensitive and requires encryption, the middleware will identify and handle all access requests to this field.

[0134] S06. Apply encryption and decryption. If the field is a sensitive field, the middleware automatically applies the encryption and decryption algorithm.

[0135] The S06 includes:

[0136] S061, Algorithm configuration, the encryption or decryption requirements of each sensitive field are defined in detail in the configuration, including: the selected algorithm type, encryption key, encryption mode and other parameters;

[0137] S062. Algorithm loading and application. The middleware loads the corresponding algorithm at startup according to the configuration and dynamically inserts encryption or decryption functions during SQL execution.

[0138] For example, for an email field encrypted using the AES algorithm, the middleware will automatically pass the email value in the SQL statement to the AES encryption function;

[0139] S063. Function name and parameter determination: Based on the encryption configuration of the field, the middleware determines the inserted function name and required parameters, including field value, key, encryption mode, etc.

[0140] Example: For an email field that needs to be encrypted, the middleware rewrites the condition email = 'user@example.com' in the SQL statement to email = AES_encrypt_function('user@example.com', 'key12345', 'CBC') to ensure that the data is correctly encrypted before storage.

[0141] S07, executing SQL operation, the modified SQL request is executed on the database to perform data access operation;

[0142] S08, return result, the execution result is returned to the application, and the middleware decrypts the data;

[0143] The S08 includes: before sending the encrypted data back to the application, the middleware calls the corresponding decryption function to convert the encrypted field back to the original format to ensure that the application receives and processes the plaintext data.

[0144] S09, Management configuration, use the Web interface provided by the middleware to configure and manage encryption policies, algorithms and keys;

[0145] S010. Process existing data and re-encrypt existing data processed using the old encryption scheme to ensure compatibility with the new scheme;

[0146] Although the existing data has been desensitized by the old solution, the original encrypted data may not be decrypted by the new solution due to changes in the encryption algorithm or key management strategy in the new solution. Therefore, the existing data must be desensitized again to ensure data security, consistency and compatibility with the new system.

[0147] Assume that in the users table, the original data has been desensitized according to the old scheme, and the email field has been encrypted using the old encryption algorithm. Now, the email field needs to be desensitized again according to the new scheme and encrypted using the new AES-256 algorithm.

[0148] (1) Add ciphertext columns

[0149] Add a new ciphertext column new_encrypted_email to the users table to store data encrypted using the new algorithm.

[0150] (2) Read and decrypt old data

[0151] Extract all existing email field data from the database that was encrypted using the old scheme and, if necessary, decrypt it to recover the original message.

[0152] (3) Read and decrypt old data

[0153] Apply the encryption algorithm (AES-256) in the new scheme to the read data and store the encrypted result in a new ciphertext column new_encrypted_email.

[0154] (4) Update the database

[0155] Write the newly encrypted data to the new_encrypted_email column while retaining the old email column to ensure data security and rollback of the operation.

[0156] (5) Verification and inspection

[0157] Make sure all data has been correctly encrypted and written into the new ciphertext column. This can be verified by comparing the original data with the encrypted data, or by decrypting a sample.

[0158] (6) Switch to the new encrypted column

[0159] After verifying that the newly encrypted data is correct, switch the system to use the new new_encrypted_email column for data reading and writing operations. At this point, all queries and operations will be based on the newly encrypted data.

[0160] (7) Delete the old encrypted data column

[0161] After confirming that the system is running stably and the old data is no longer needed, you can choose to delete the old email column and completely switch to the new encryption scheme.

[0162] Although the existing data has been desensitized by the old solution, the original encrypted data may not be decrypted by the new solution due to changes in the encryption algorithm or key management strategy in the new solution. Therefore, the existing data must be desensitized again to ensure data security, consistency and compatibility with the new system.

[0163] Assume that in the users table, the original data has been desensitized according to the old scheme, and the email field has been encrypted using the old encryption algorithm. Now, the email field needs to be desensitized again according to the new scheme and encrypted using the new AES-256 algorithm.

[0164] (1) Add ciphertext columns

[0165] Add a new ciphertext column new_encrypted_email to the users table to store data encrypted using the new algorithm.

[0166] (2) Read and decrypt old data

[0167] Extract all existing email field data from the database that was encrypted using the old scheme and, if necessary, decrypt it to recover the original message.

[0168] (3) Read and decrypt old data

[0169] Apply the encryption algorithm (AES-256) in the new scheme to the read data and store the encrypted result in a new ciphertext column new_encrypted_email.

[0170] (4) Update the database

[0171] Write the newly encrypted data to the new_encrypted_email column while retaining the old email column to ensure data security and rollback of the operation.

[0172] (5) Verification and inspection

[0173] Make sure all data has been correctly encrypted and written into the new ciphertext column. This can be verified by comparing the original data with the encrypted data, or by decrypting a sample.

[0174] (6) Switch to the new encrypted column

[0175] After verifying that the newly encrypted data is correct, switch the system to use the new new_encrypted_email column for data reading and writing operations. At this point, all queries and operations will be based on the newly encrypted data.

[0176] (7) Delete the old encrypted data column

[0177] After confirming that the system is running stably and the old data is no longer needed, you can choose to delete the old email column and completely switch to the new encryption scheme.

[0178] S011. End, completing the data security management process.

[0179] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0180] In order to explain the above non-invasive data information security management method more clearly, it is described below in conjunction with a specific embodiment. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0181] like Figure 1 As shown, the present invention relates to a non-intrusive data information security management method, the method comprising:

[0182] S01. Middleware deployment: Deploy database middleware between the application and the database. Database middleware is referred to as middleware below and acts as a proxy for data interaction.

[0183] like Figure 2 As shown, S02, connection management, the middleware manages database connections and uses connection pools to optimize resource usage;

[0184] Furthermore, the database middleware is a proxy layer between the application and the database. The database middleware provides a unified connection interface to simplify the interaction process between the application and the database.

[0185] The database middleware adopts an efficient database connection pool mechanism to uniformly manage connections with multiple database instances;

[0186] The database middleware applies a load balancing strategy to select the optimal database connection according to the real-time system load status, including the database instance with the shortest response time, the lightest load or the closest geographical location.

[0187] Significantly reduce the resource consumption of frequent creation and destruction of connections, thereby improving the overall system performance.

[0188] Based on the enterprise scale and business needs, you can flexibly choose a single-node or multi-node deployment architecture to enhance system availability and achieve load balancing.

[0189] Furthermore, the functions integrated in the database middleware include: connection management, SQL statement parsing and rewriting, data encryption and decryption processing, and cache management mechanism.

[0190] For example:

[0191] The original application directly connected to the database through jdbc:mysql: / / db_host:3306 / mydatabase, and now it connects through the middleware. You only need to update the connection string to jdbc:mysql: / / autoproxy:3306 / mydatabase. This change simplifies the configuration of the application and leaves the complexity and security management of the connection to the middleware.

[0192] The middleware is designed to provide the highest level of data security without sacrificing performance. Through in-memory configuration and intelligent parsing, the middleware is able to quickly respond to SQL requests while ensuring data confidentiality and integrity.

[0193] Middleware can provide an efficient, secure and application-transparent data encryption and decryption solution, simplifying the complexity of data security management while improving the security of data operations.

[0194] Through the above measures, the middleware not only improves the efficiency and security of data access, but also provides enterprises with a flexible and scalable database access solution.

[0195] The middleware provides an intuitive web interface for administrators to configure and manage encryption policies and algorithms. This interface is the core configuration center of the middleware system and is responsible for all encryption-related settings.

[0196] Standard encryption algorithms: The web interface lists a series of standard encryption algorithms for selection, such as AES, MD5, RC4, SM3 / SM4, etc. Administrators can select the appropriate algorithm and configure related parameters, such as encryption key, encryption mode (such as CBC, ECB, etc.), encryption strength (such as AES-128, AES-256, etc.).

[0197] Key management: Administrators can manage encryption keys on the interface, including key generation, storage, rotation, etc. The system provides hierarchical management of keys to ensure that different keys are used for data of different sensitivities.

[0198] Upload and configure custom encryption and decryption algorithms, upload custom Java libraries: The administrator uploaded a custom Java library on the web interface, which contains a custom encryption algorithm "CustomEncrypt". This algorithm may be designed based on specific business needs and provide encryption features or performance advantages that standard algorithms cannot meet.

[0199] Custom algorithm selection and configuration: In the web interface, the administrator selects the "CustomEncrypt" algorithm to apply to the custom_field field of the users table. The administrator can further configure the algorithm's parameters, such as encryption strength, mode, etc.

[0200] Upload a key management script: In addition to the Java library of the custom encryption algorithm, the administrator also needs to upload a key management script. This script is used to manage the keys required by the CustomEncrypt algorithm.

[0201] Features include:

[0202] Key generation and distribution: Scripts can contain logic for dynamically generating keys, generating or selecting keys based on specific context (such as field names, usage scenarios).

[0203] Key rotation and update: Define key rotation strategies to regularly update keys and improve system security. Scripts can implement the process of revoking old keys and replacing new keys.

[0204] Key access control: Set access permissions to keys through scripts to ensure that only authorized users or system components can access and use keys.

[0205] Encryption and decryption strategy definition and selection:

[0206] Encryption policy: Administrators can define encryption policies through the web interface, including selecting which fields need to be encrypted, which encryption algorithm to use, and the selection of keys. For example, you can select AES-256 encryption for the password field in the users table and specify a specific key.

[0207] Decryption policy, corresponding to encryption policy, administrators can also define decryption policy. Decryption policy defines how to restore encrypted data, usually including the selection of corresponding decryption algorithm and key. For example, when reading data, the same key and algorithm as used for encryption need to be used for decryption.

[0208] With policy refinement, administrators can choose different encryption and decryption policies based on the sensitivity and type of data. For example, for highly sensitive data (such as financial information), you can choose a stronger encryption algorithm and a more complex key management policy; for low-sensitivity data (such as public user information), you can choose a simple hash process.

[0209] S03, receiving SQL request, the middleware receives the SQL request from the application;

[0210] Further, the S03 includes:

[0211] S031. Predefined configuration: The middleware uses a centralized configuration file or database table to maintain sensitive field information. The sensitive field information includes: field name, associated table, data type, and encryption requirements. The above information is defined and loaded when the system is initialized;

[0212] S032. Configuration loading: When starting the middleware, the configuration data is loaded into the memory for quick access. The configuration data includes: field encryption requirements and possible access control rules.

[0213] S04, parsing the SQL request: the middleware parses the received SQL request to identify the operation type and the data involved;

[0214] Furthermore, the S04 includes: after receiving the SQL request, the middleware uses a parsing engine to extract key information, including: operation type (such as SELECT, INSERT, UPDATE), data table, field and query condition.

[0215] S05, sensitive fields, the middleware determines whether the SQL request contains sensitive fields that need special processing;

[0216] Furthermore, S05 includes: the parsing engine compares the fields involved in the request with the sensitive field list in the memory to identify the fields that need to be encrypted or decrypted.

[0217] For example, if the email field of the users table is marked as sensitive and requires encryption, the middleware will identify and handle all access requests to this field.

[0218] S06. Apply encryption and decryption. If the field is a sensitive field, the middleware automatically applies the encryption and decryption algorithm.

[0219] Further, the S06 includes:

[0220] S061, Algorithm configuration, the encryption or decryption requirements of each sensitive field are defined in detail in the configuration, including: the selected algorithm type, encryption key, encryption mode and other parameters;

[0221] S062. Algorithm loading and application. The middleware loads the corresponding algorithm at startup according to the configuration and dynamically inserts encryption or decryption functions during SQL execution.

[0222] For example, for an email field encrypted using the AES algorithm, the middleware will automatically pass the email value in the SQL statement to the AES encryption function;

[0223] S063. Function name and parameter determination: Based on the encryption configuration of the field, the middleware determines the inserted function name and required parameters, including field value, key, encryption mode, etc.

[0224] Example: For an email field that needs to be encrypted, the middleware rewrites the condition email = 'user@example.com' in the SQL statement to email = AES_encrypt_function('user@example.com', 'key12345', 'CBC') to ensure that the data is correctly encrypted before storage.

[0225] S07, executing SQL operation, the modified SQL request is executed on the database to perform data access operation;

[0226] S08, return result, the execution result is returned to the application, and the middleware decrypts the data;

[0227] Furthermore, the S08 includes: before sending the encrypted data back to the application, the middleware calls a corresponding decryption function to convert the encrypted field back to the original format to ensure that the application receives and processes the plaintext data.

[0228] S09, Management configuration, use the Web interface provided by the middleware to configure and manage encryption policies, algorithms and keys;

[0229] S010. Process existing data and re-encrypt existing data processed using the old encryption scheme to ensure compatibility with the new scheme;

[0230] Although the existing data has been desensitized by the old solution, the original encrypted data may not be decrypted by the new solution due to changes in the encryption algorithm or key management strategy in the new solution. Therefore, the existing data must be desensitized again to ensure data security, consistency and compatibility with the new system.

[0231] Assume that in the users table, the original data has been desensitized according to the old scheme, and the email field has been encrypted using the old encryption algorithm. Now, the email field needs to be desensitized again according to the new scheme and encrypted using the new AES-256 algorithm.

[0232] (1) Add ciphertext columns

[0233] Add a new ciphertext column new_encrypted_email to the users table to store data encrypted using the new algorithm.

[0234] (2) Read and decrypt old data

[0235] Extract all existing email field data from the database that was encrypted using the old scheme and, if necessary, decrypt it to recover the original message.

[0236] (3) Read and decrypt old data

[0237] Apply the encryption algorithm (AES-256) in the new scheme to the read data and store the encrypted result in a new ciphertext column new_encrypted_email.

[0238] (4) Update the database

[0239] Write the newly encrypted data to the new_encrypted_email column while retaining the old email column to ensure data security and rollback of the operation.

[0240] (5) Verification and inspection

[0241] Make sure all data has been correctly encrypted and written into the new ciphertext column. This can be verified by comparing the original data with the encrypted data, or by decrypting a sample.

[0242] (6) Switch to the new encrypted column

[0243] After verifying that the newly encrypted data is correct, switch the system to use the new new_encrypted_email column for data reading and writing operations. At this point, all queries and operations will be based on the newly encrypted data.

[0244] (7) Delete the old encrypted data column

[0245] After confirming that the system is running stably and the old data is no longer needed, you can choose to delete the old email column and completely switch to the new encryption scheme.

[0246] Raw data:

[0247] ID:1

[0248] Name:Alice

[0249] Email:"OldEncryptedEmailData"

[0250] New encrypted data:

[0251] ID:1

[0252] Name:Alice

[0253] New_Encrypted_Email:"NewEncryptedEmailData"

[0254] S011. End, completing the data security management process.

[0255] like Figure 3 As shown, a complete implementation process of the present invention includes:

[0256] Start, the starting point of the process;

[0257] Receive SQL requests. The middleware receives SQL requests from applications.

[0258] SQL parsing module, the SQL parsing module of the middleware starts working;

[0259] Operation type, SELECT / INSERT / UPDATE: The parsing module identifies the operation type of the SQL statement;

[0260] Field information: extract the table and field information involved in the SQL statement;

[0261] Conditions such as WHERE clause, extract the conditional part of the SQL statement, such as the WHERE clause;

[0262] Match with sensitive field list, matching the extracted field information with the predefined sensitive field list;

[0263] Mark the fields that need to be encrypted / decrypted. If the field is a sensitive field, the parsing module marks it as needing encryption or decryption;

[0264] No processing is required. If the field is not a sensitive field, no additional processing is required;

[0265] Determine the encryption / decryption algorithm and parameters, and determine the corresponding algorithm and parameters for the fields that need to be encrypted or decrypted;

[0266] Insert encryption / decryption function, insert the corresponding encryption or decryption function call in the SQL statement;

[0267] Execute SQL statements. The modified SQL statements are sent to the database for execution.

[0268] Encryption and decryption of encrypted fields. Encrypt data before writing it to the database and decrypt it when reading it from the database.

[0269] Decrypt the result before returning it to ensure that the data returned to the application is in plain text so that the application can process it normally;

[0270] The results are returned to the application, and the processed data is returned to the application as the query result;

[0271] End, the process is over.

[0272] Example of a standard encryption configuration:

[0273] Assume that there is a database table named users, which contains the following fields: ID, Name, Password. The Password field needs to be encrypted and decrypted using the standard encryption algorithm AES-256.

[0274] Raw data:

[0275] ID:1

[0276] Name:Bob

[0277] Password:MySecretPassword

[0278] Standard encryption process:

[0279] Select standard encryption algorithm: The administrator selects AES-256 as the encryption algorithm for the Password field in the web interface.

[0280] Key management: To ensure data security, the administrator specifies a key for encryption operations. Assume that the key is my_secure_key_256_bits_1234567890abcd.

[0281] Encryption function call: Encrypt the Password field using the AES-256 algorithm and the specified key.

[0282] / / Example encryption function call (pseudocode)

[0283] String encryptedPassword=AES256.encrypt("MySecretPassword",

[0284] "my_secure_key_256_bits_1234567890abcd");

[0285] Encrypted data

[0286] ID:1

[0287] Name:Bob

[0288] Password:AES_ENCRYPTED_DATA

[0289] AES_ENCRYPTED_DATA is the encrypted password data, for example, X4FsdGVkX19hzZDn9Z1NQ6Y2 / 97b0==

[0290] Standard decryption process:

[0291] When reading data, the system uses the corresponding decryption function and calls the stored key for decryption

[0292] / / Example decryption function call (pseudocode)

[0293] String decryptedPassword=AES256.decrypt("AES_ENCRYPTED_DATA",

[0294] "my_secure_key_256_bits_1234567890abcd");

[0295] Decrypted data

[0296] ID:1

[0297] Name:Bob

[0298] Password:MySecretPassword

[0299] Custom encryption and decryption configuration example:

[0300] Assume that there is a database table named users, which contains the following fields: ID, Name, Custom_Field. Custom_Field needs to be encrypted and decrypted using the custom encryption algorithm "CustomEncrypt".

[0301] Raw data:

[0302] ID:1

[0303] Name:Alice

[0304] Custom_Field:SensitiveData123

[0305] Custom encryption process:

[0306] Encryption algorithm library: The administrator uploaded a Java library named CustomEncrypt.jar, which contains a custom encryption algorithm implementation.

[0307] Key management script: The administrator also uploaded the CustomKeyManager.java script for managing encryption keys.

[0308]

[0309] Encryption function call:

[0310] Encrypt through the encryption function in the CustomEncrypt library and use the key provided by CustomKeyManager.getKey("users_custom_field").

[0311] / / Example encryption function call

[0312] String encryptedData=CustomEncrypt.encrypt("SensitiveData123",

[0313] "secure_key_12345");

[0314] Encrypted data:

[0315] ID:1

[0316] Name:Alice

[0317] Custom_Field:ENCRYPTED_DATA

[0318] Among them, ENCRYPTED_DATA may be an unreadable encryption result, such as X7FsdGVkX1+21KiW87Qs53lKzR9+e / Q==

[0319] Customize the decryption process:

[0320] When reading data, the system will use the custom decryption function and call the key provided by CustomKeyManager for decryption.

[0321] / / Example decryption function call

[0322] String decryptedData=CustomEncrypt.decrypt("ENCRYPTED_DATA",

[0323] "secure_key_12345");

[0324] Decrypted data:

[0325] ID:1

[0326] Name:Alice

[0327] Custom_Field:SensitiveData123

[0328] Through decryption, the original data SensitiveData123 is successfully restored.

[0329] Based on the same inventive concept, the present invention also proposes a non-intrusive data information security management device. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0330] Figure 4 Schematic diagram of the structure of the non-intrusive data information security management device of the present invention. Figure 4 As shown, the device comprises:

[0331] Middleware deployment module 101, deploys database middleware between the application and the database, the database middleware is hereinafter referred to as middleware, as a proxy for data interaction;

[0332] Connection management module 102, middleware manages database connections and uses connection pools to optimize resource usage;

[0333] The receiving SQL request module 103, the middleware receives the SQL request from the application;

[0334] Parsing SQL request module 104, the middleware parses the received SQL request to identify the operation type and the data involved;

[0335] Sensitive field module 105, the middleware determines whether the SQL request contains sensitive fields that need special processing;

[0336] Application encryption and decryption module 106, the field is a sensitive field, and the middleware automatically applies the encryption and decryption algorithm;

[0337] Execute SQL operation module 107, the modified SQL request is executed on the database to perform data access operation;

[0338] The result return module 108 returns the execution result to the application, and the middleware decrypts the data;

[0339] Management configuration module 109, using the Web interface provided by the middleware to configure and manage encryption policies, algorithms and keys;

[0340] The existing data processing module 110 re-encrypts the existing data processed using the old encryption scheme to ensure compatibility with the new scheme;

[0341] End module 111 and complete the data security management process.

[0342] It should be noted that although several modules of the non-intrusive data information security management device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0343] Based on the above invention concept, Figure 5 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220, and when the processor 220 executes the computer program 230, the aforementioned non-invasive data information security management method is implemented.

[0344] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which has the following beneficial effects:

[0345] Transparency and non-intrusive code: Applications can use the encryption and decryption functions provided by the database middleware without modifying existing code to achieve automatic data protection, thereby significantly reducing the technical complexity of development and maintenance work.

[0346] Automatic identification of sensitive fields: The middleware has the ability to automatically identify sensitive fields in SQL statements and automatically apply appropriate encryption and decryption logic, which simplifies the data protection process and ensures the security of data at every stage.

[0347] Flexible policy configuration and management interface: Provides an intuitive and easy-to-use web interface that enables administrators to flexibly define and adjust encryption policies based on the type and sensitivity of data, including key management and algorithm selection, enhancing the system's configurability and ease of management.

[0348] The present invention provides a non-intrusive data information security management method and device. Through the grayscale publishing service, the control plane of the API gateway updates the publishing plan and monitors the grayscale publishing status at the same time. It can integrate multiple grayscale publishing strategies and improve the controllability and compatibility of grayscale publishing.

[0349] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0350] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0351] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0352] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0353] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0354] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0355] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0356] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0357] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0358] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A non-intrusive data information security management method, characterized in that: The method includes: S01. Middleware deployment: Deploy database middleware between the application and the database. Database middleware is referred to as middleware below and acts as a proxy for data interaction. S02, connection management, the middleware manages database connections and uses connection pools to optimize resource usage; S03, receiving SQL request, the middleware receives the SQL request from the application; S04, parsing the SQL request: the middleware parses the received SQL request to identify the operation type and the data involved; S05, sensitive fields, the middleware determines whether the SQL request contains sensitive fields that need special processing; S06. Apply encryption and decryption. If the field is a sensitive field, the middleware automatically applies the encryption and decryption algorithm. S07, executing SQL operation, the modified SQL request is executed on the database to perform data access operation; S08, return result, the execution result is returned to the application, and the middleware decrypts the data; S09, Management configuration, use the Web interface provided by the middleware to configure and manage encryption policies, algorithms and keys; S010. Process existing data and re-encrypt existing data processed using the old encryption scheme to ensure compatibility with the new scheme; S011. End, completing the data security management process.

2. The non-intrusive data information security management method according to claim 1, characterized in that: The database middleware is a proxy layer between the application and the database, and provides a unified connection interface; The database middleware adopts a database connection pool mechanism to uniformly manage connections with multiple database instances; The database middleware applies a load balancing strategy to select the optimal database connection according to the real-time system load status, including the database instance with the shortest response time, the lightest load or the closest geographical location.

3. The non-intrusive data information security management method according to claim 1, characterized in that: The functions integrated by the database middleware include: connection management, SQL statement parsing and rewriting, data encryption and decryption processing, and cache management mechanism.

4. The non-intrusive data information security management method according to claim 1, characterized in that: The S03 includes: S031. Predefined configuration: The middleware uses a centralized configuration file or database table to maintain sensitive field information. The sensitive field information includes: field name, associated table, data type, and encryption requirements. The above information is defined and loaded when the system is initialized; S032. Configuration loading: When starting the middleware, the configuration data is loaded into the memory for quick access. The configuration data includes: field encryption requirements and possible access control rules.

5. The non-intrusive data information security management method according to claim 1, characterized in that: The S04 includes: after the middleware receives the SQL request, it uses the parsing engine to extract key information, including: operation type, data table, field and query condition.

6. The non-intrusive data information security management method according to claim 1, characterized in that: The S05 includes: the parsing engine compares the fields involved in the request with the sensitive field list in the memory, and identifies the fields that need to be encrypted or decrypted.

7. The non-intrusive data information security management method according to claim 1, characterized in that: The S06 includes: S061, Algorithm configuration, the encryption or decryption requirements of each sensitive field are defined in detail in the configuration, including: the selected algorithm type, encryption key, and encryption mode; S062. Algorithm loading and application. The middleware loads the corresponding algorithm at startup according to the configuration and dynamically inserts encryption or decryption functions during SQL execution. S063. Function name and parameter determination: Based on the encryption configuration of the field, the middleware determines the inserted function name and required parameters, including field value, key, encryption mode, etc.

8. The non-intrusive data information security management method according to claim 1, characterized in that: The S08 includes: before sending the encrypted data back to the application, the middleware calls the corresponding decryption function to convert the encrypted field back to the original format, and the application receives and processes the plaintext data.

9. The non-intrusive data information security management method according to claim 1, characterized in that: The S010 includes: S0101. Add a ciphertext column. Add a new ciphertext column in the users table to store data encrypted using the new algorithm. S0102. Read and decrypt old data, extract all existing field data from the database, and decrypt some field data to restore the original information; S0103. Read and decrypt old data, apply the encryption algorithm in the new scheme to the read data, and store the encrypted result in a new ciphertext column; S0104. Update the database, write the newly encrypted data into the new ciphertext column, and retain the old ciphertext column to ensure data security and rollback of operations; S0105. Verify and check by comparing the original data with the encrypted data or by decrypting samples to ensure that all data has been correctly encrypted and written into the new ciphertext column; S0106. Switch to the new encrypted column. After verifying that the new encrypted data is correct, switch the system to use the new ciphertext column for data reading and writing operations. All queries and operations will be based on the new encrypted data. S0107. Delete the old encrypted data columns. After confirming that the system is running stably and the old data is no longer needed, delete the old ciphertext columns and switch to the new encryption scheme.

10. A non-intrusive data information security management device, characterized in that: The device includes: Middleware deployment module deploys database middleware between the application and the database. Database middleware is referred to as middleware hereafter and acts as a proxy for data interaction. Connection management module, middleware manages database connections and uses connection pools to optimize resource usage; SQL request receiving module, the middleware receives SQL requests from the application; Parsing SQL request module: The middleware parses the received SQL request to identify the operation type and the data involved; Sensitive field module, the middleware determines whether the SQL request contains sensitive fields that require special processing; Apply the encryption and decryption module. If the field is a sensitive field, the middleware automatically applies the encryption and decryption algorithm. Execute the SQL operation module, and the modified SQL request is executed on the database to perform data access operations; Return result module, the execution result is returned to the application, and the middleware decrypts the data; Management configuration module, using the web interface provided by the middleware to configure and manage encryption policies, algorithms and keys; Processing stock data module, re-encrypting the existing data processed by the old encryption scheme to ensure compatibility with the new scheme; End the module and complete the data security management process.

11. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 9.

Images