Data processing method and device

Abstract

The invention discloses a data processing method and device, and relates to the technical field of computers. A specific embodiment of the method comprises the following steps: acquiring to-be-stored data and a storage position thereof from a data storage request; determining a data type of the to-be-stored data and an encryption strategy corresponding to the data type according to the storage position and a pre-configured data encryption and decryption rule; wherein the data type comprises a query data type; and encrypting the to-be-stored data according to the encryption strategy, reconstructing a data storage request by using the encrypted data, and sending the reconstructed data storage request to a database so as to replace the to-be-stored data with the encrypted data for data storage. According to the implementation mode, non-intrusive and flexible data security processing is realized, the data encryption and decryption rule based on configuration is easy to expand and update, the processing process is simplified, non-inductive processing of the data is realized, and the processing based on the data granularity is convenient to operate the stored data.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for data processing. Background Art

[0002] With the continuous development of Internet technology, the network has penetrated into people's daily lives, greatly facilitating people's work and life. In the process of interaction between users and services, network services will collect a large amount of user data, including sensitive user data, including name, ID card, bank card, mobile phone number, address information, etc. If the program design is unreasonable and the user data is improperly stored, it will lead to the leakage of user sensitive information, which will have a negative impact on enterprises, society and individuals. Therefore, according to different usage scenarios and permission restrictions, it is particularly important to dynamically encrypt, decrypt, and desensitize user sensitive data to avoid leakage of user sensitive information and protect personal privacy. Existing data security processing technologies usually encrypt sensitive data by embedding processing logic in the database connection driver or encrypt the data file as a whole during the file storage stage of the database through the transparent data encryption (TDE) interface.

[0003] In the process of implementing the present invention, the inventors found that the prior art has the following problems:

[0004] The existing method of embedding processing logic requires the business side to perform code integration, which is invasive, complex to implement, and has poor scalability. The TDE method encrypts the entire data file, which not only takes up too many system resources, but also makes it inconvenient to add, delete, modify, and query the data within the file. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method and device for data processing, which realizes non-invasive and flexible data security processing. It is based on configurable data encryption and decryption rules, is easy to expand and update, simplifies the business data processing process, realizes the seamless processing of business data, and is based on data granularity security processing, which facilitates operations such as adding, deleting, modifying, and querying data stored in the database.

[0006] To achieve the above object, according to one aspect of an embodiment of the present invention, a data processing method is provided, comprising:

[0007] Acquire the data to be stored and the storage location of the data to be stored from the data storage request;

[0008] Determine the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes a query data type;

[0009] The data to be stored is encrypted according to the encryption strategy, a data storage request is reconstructed using the encrypted data, and the reconstructed data storage request is sent to the database, so as to use the encrypted data to replace the data to be stored for data storage.

[0010] Optionally, the query data type includes a precise query data type; in response to the data type of the data to be stored being the precise query data type, encrypting the data to be stored according to the encryption strategy, and using the encrypted data to reconstruct the data storage request, including: performing hash mapping on the data to be stored to obtain a hash mapping value, and using the hash mapping value as a precise index; encrypting the data to be stored to obtain encrypted data; and rewriting the request statement in the data storage request and the data to be stored according to the precise index and the encrypted data, to construct a data storage request with the precise index and the encrypted data.

[0011] Optionally, the query data type includes a fuzzy query data type; in response to the data type of the data to be stored being the fuzzy query data type, encrypting the data to be stored according to the encryption strategy, and using the encrypted data to reconstruct a data storage request, including: splitting the data to be stored into words to obtain multiple words to be stored; encrypting each of the words to be stored using a consistent encryption algorithm to obtain a fuzzy index composed of the encrypted words; encrypting the data to be stored to obtain encrypted data; and rewriting the request statement in the data storage request and the data to be stored according to the fuzzy index and the encrypted data to construct a data storage request with the fuzzy index and the encrypted data.

[0012] Optionally, before determining the data type of the data to be stored according to the storage location and pre-configured data encryption rules, the method also includes: authenticating the requester who sends the data storage request according to the data encryption and decryption rules, and determining whether the requester has the authority to store the data to be stored.

[0013] Optionally, the method further comprises: obtaining a query mode and data to be queried from a data query request; in response to the query mode being a precise query, performing hash mapping on the data to be queried to obtain a hash mapping value; querying and obtaining the data to be queried from the database according to the hash mapping value and the data encryption and decryption rules; in response to the query mode being a fuzzy query, using the consistent encryption algorithm to encrypt the data to be queried to obtain an encrypted word; querying and obtaining the data to be queried from the database according to the encrypted word and the data encryption and decryption rules.

[0014] Optionally, according to the hash mapping value and the data encryption and decryption rules, the data to be queried is queried from the database, including: using the hash mapping value as a precise index of the data to be queried, reconstructing a data query request, and sending the reconstructed data query request to the database; receiving the encrypted data found by the database using the hash mapping value as a precise index, decrypting the encrypted data according to the data encryption and decryption rules, and using the decrypted data as the data to be queried.

[0015] Optionally, according to the encryption word and the data encryption and decryption rules, the data to be queried is queried from the database, including: using the encryption word as a fuzzy index of the data to be queried, reconstructing a data query request, and sending the reconstructed data query request to the database; receiving the encrypted data found by the database using the encryption word as the fuzzy index, decrypting the encrypted data according to the data encryption and decryption rules, and using the decrypted data as the data to be queried.

[0016] Optionally, before decrypting the encrypted data, the method further includes: according to the data encryption and decryption rules, authenticating the requester who sends the data query request, and determining whether the requester has the authority to obtain the decrypted data; in response to the requester not having the authority to obtain the decrypted data, using the encrypted data as the data to be queried; in response to the requester having the authority to obtain the desensitized data, desensitizing the decrypted data, and using the desensitized data as the data to be queried.

[0017] Optionally, after decrypting the encrypted data, the method further includes: performing a hash operation on the decrypted data to obtain a hash value; performing an integrity check on the decrypted data by comparing the hash value with a hash mapping value of the data to be queried, and determining that the integrity check passes.

[0018] Optionally, the method further includes: updating the configuration of the data encryption and decryption rules according to a received data processing requirement update request, so as to perform data processing that meets the requirement according to the updated data encryption and decryption rules.

[0019] According to a second aspect of an embodiment of the present invention, there is provided a data processing device, including:

[0020] A data acquisition module, used to acquire the data to be stored and the storage location of the data to be stored from the data storage request;

[0021] A policy acquisition module, used to determine the data type of the data to be stored and the encryption policy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes a query data type;

[0022] The data storage module is used to encrypt the data to be stored according to the encryption strategy, reconstruct the data storage request using the encrypted data, and send the reconstructed data storage request to the database to use the encrypted data to replace the data to be stored for data storage.

[0023] According to a third aspect of the present invention, there is provided a data processing device, comprising:

[0024] A query acquisition module is used to obtain the query method and the data to be queried from the data query request;

[0025] A precise query module, configured to perform hash mapping on the data to be queried to obtain a hash mapping value in response to the query mode being a precise query; and query and obtain the data to be queried from the database according to the hash mapping value and the data encryption and decryption rule;

[0026] The fuzzy query module is used to, in response to the query mode being a fuzzy query, use the consistent encryption algorithm to encrypt the data to be queried to obtain an encrypted word; and query and obtain the data to be queried from the database according to the encrypted word and the data encryption and decryption rules.

[0027] According to a fourth aspect of an embodiment of the present invention, there is provided an electronic device for data processing, including:

[0028] one or more processors;

[0029] a storage device for storing one or more programs,

[0030] When the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the first aspect of the embodiment of the present invention.

[0031] According to a fifth aspect of an embodiment of the present invention, there is provided a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method provided in the first aspect of the embodiment of the present invention is implemented.

[0032] According to a sixth aspect of an embodiment of the present invention, there is provided a computer program product, including a computer program, wherein when the computer program is executed by a processor, the method provided in the first aspect of the embodiment of the present invention is implemented.

[0033] An embodiment of the invention has the following advantages or beneficial effects: by obtaining the data to be stored and the storage location of the data to be stored from a data storage request; determining the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and pre-configured data encryption and decryption rules; wherein the data type includes a query data type; encrypting the data to be stored according to the encryption strategy, reconstructing the data storage request with the encrypted data, and sending the reconstructed data storage request to the database, so as to use the encrypted data instead of the data to be stored for data storage. A technical solution realizes a non-invasive, flexible and imperceptible data security processing method, which is based on configurable data encryption and decryption rules and is easy to expand and update, simplifies the business data processing process, realizes imperceptible processing of business data, and is based on data granularity security processing, which makes it easier to add, delete, modify and query data stored in the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0035] Figure 1 is a schematic diagram of the main flow of a data processing method according to an embodiment of the present invention;

[0036] Figure 2 is a flowchart of a method for data processing according to a reference embodiment of the present invention;

[0037] Figure 3 A flowchart of a method for data processing according to another reference embodiment of the present invention;

[0038] Figure 4 It is a complete flow chart of data query processing according to an embodiment of the present invention;

[0039] Figure 5 is a schematic diagram of main modules of a data processing device according to a first embodiment of the present invention;

[0040] Figure 6 is a schematic diagram of main modules of a data processing device according to a second embodiment of the present invention;

[0041] Figure 7 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0042] Figure 8 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0043] It should be noted that in the technical solution of the present invention, the collection / collection, update, analysis, use, transmission, storage and other aspects of user personal information involved are in compliance with the provisions of relevant laws and regulations, are used for legal and reasonable purposes, are not shared, leaked or sold outside of these legal uses, and are subject to supervision and management by national regulatory authorities. Necessary measures should be taken for user personal information to selectively block the use or access to personal information data to prevent illegal access to such personal information data, ensure that persons who have access to personal information data comply with the provisions of relevant laws and regulations, and ensure the security of user personal information. In addition, once these user personal information data are no longer needed, the risks should be minimized by limiting or even prohibiting data collection and / or deleting data.

[0044] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0045] The existing method of embedding processing logic requires the business party to integrate the code, which is invasive, complex to implement and has poor scalability. The method of using transparent data encryption (TDE) encrypts the entire data file, which not only takes up too many system resources, but also makes it inconvenient to add, delete, modify, and query the data inside the file, and cannot meet the actual application needs well.

[0046] In order to solve the above-mentioned problems existing in the prior art, the present invention proposes a data processing method, which determines the data type of the data to be stored according to the storage location of the data to be stored and the pre-configured data encryption and decryption rules, and then determines the encryption strategy corresponding to the data type, so as to encrypt and store the data to be stored according to the encryption strategy, thereby realizing a non-intrusive, flexible and imperceptible data security processing method. Based on the configured data encryption and decryption rules, it is easy to expand and update, simplifies the business data processing process, realizes the imperceptible processing of business data, and based on the security processing of data granularity, it is more convenient to add, delete, modify and query the data stored in the database.

[0047] Figure 1 is a schematic diagram of the main flow of the data processing method according to an embodiment of the present invention, such as Figure 1 As shown, the data processing method of the embodiment of the present invention includes the following steps S101 to S103.

[0048] Step S101: Acquire data to be stored and a storage location of the data to be stored from a data storage request.

[0049] Specifically, the data processing system of the embodiment of the present invention is mainly deployed between the business system and the database system. When the business system stores data in the database system, the business system issues a data storage request. The data processing system can obtain the data storage request with the help of an interception tool, or it can directly receive the data storage request issued by the business system. The data storage request can be actively sent by the business system, or it can be a data storage request automatically triggered by a pre-established scheduled task.

[0050] Understandably, based on the existing database sub-library and sub-table structure and sharding structure, before generating a data storage request, it is necessary to clarify the specific storage location of the data to be stored in the database, such as column 5 of table A1 in library A. Of course, a default storage location allocation rule can also be set. If there is no specific storage location in the data storage request, the storage location of the data to be stored is determined according to the default storage location allocation rule. Furthermore, based on the data to be stored and its corresponding storage location, the business system constructs a corresponding data storage request for the data to be stored this time.

[0051] In addition, given that the data communication between the business system and the database system is based on the communication protocol, after receiving the data storage request, the data storage request is parsed according to the format of the communication protocol, and the specific SQL statement and the parameters therein are obtained from the protocol, and then the data to be stored and the storage location of the data to be stored are obtained from the SQL statement and the parameters.

[0052] Step S102: Determine the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and pre-configured data encryption and decryption rules; wherein the data type includes a query data type.

[0053] Specifically, the embodiment of the present invention pre-configures the data encryption and decryption rules of the user dimension on the management end. The data encryption and decryption rules specifically define the data types of the user name, library name, table name, and column name, as well as the encryption strategy corresponding to the data type. For example, the data stored by user A in column C of table T in database D is of a sensitive data type, and sensitive field encryption is required accordingly. Further, according to the storage location of the data to be stored determined above, and the user name of the data to be stored attached to the data storage request, a match is made from the data encryption and decryption rules, and the target encryption and decryption rules are found, from which the data type of the data to be stored and the encryption strategy corresponding to the data type are obtained.

[0054] It is understandable that for data storage requests, storing the data to be stored in the database satisfies the need for data storage. However, from the perspective of the subsequent processing, handling, and operation of the data in the database, the encrypted data is not conducive to data query. In order to ensure the security of the data in the embodiment of the present invention, the results of encrypting the same data twice are different, so the encrypted data cannot be used as a query condition. In order to solve this problem, the embodiment of the present invention not only provides a data storage method for ordinary sensitive fields that do not need to be used as query conditions, but also provides an exclusive data storage method for data of this query data type, that is, data used as data query conditions. For example, if the name column in a table is a query condition, then the data type of the column is a query data type, and the address column is only a sensitive field, and the data type of the address column is a non-query data type. By providing corresponding encryption strategies for different data types, it is convenient to perform operations such as adding, deleting, modifying, and querying the data stored in the database without wasting system resources.

[0055] According to one embodiment of the present invention, before determining the data type of the data to be stored according to the storage location and pre-configured data encryption rules, the method also includes: authenticating the requester who sends the data storage request according to the data encryption and decryption rules, and determining whether the requester has the authority to store the data to be stored.

[0056] Specifically, in order to improve the security of data processing and prevent unauthorized users from performing arbitrary operations on the data in the database, before determining the data type of the data to be stored according to the storage location and the pre-configured data encryption rules, first determine from the data encryption and decryption rules whether the user name of the requester of the data storage request has the storage permission to store the data to be stored in the storage location. For example, user B has the query permission for database D, table T, but user B wants to store data in database D, table T, then user B is not authenticated and does not have the permission to store in database D, table T. Only the requester user who passes the authentication is allowed to determine the data type and the encryption policy corresponding to the data type, which means that the data to be stored can be subsequently encrypted.

[0057] Step S103: encrypt the data to be stored according to the encryption strategy, use the encrypted data to reconstruct a data storage request, and send the reconstructed data storage request to the database to use the encrypted data to replace the data to be stored for data storage.

[0058] Specifically, based on the encryption strategy for the data to be stored determined by the above query, the data to be stored is encrypted, and then based on the SQL statements and parameters obtained by the above analysis, the SQL statements and parameters are rewritten using the encrypted data, which is equivalent to replacing the data to be stored with the encrypted data. The data storage request for storing the encrypted data is rebuilt according to the communication protocol between the business system and the database system, and then sent to the database, thereby realizing data encryption storage without the requester's awareness.

[0059] It can be understood that when the data to be stored is a non-query data type, it is only necessary to encrypt the stored data according to the sensitive data encryption policy, rewrite the SQL using the encrypted data as parameters in the SQL statement, and then rebuild the data storage request based on the rewritten SQL and parameters, and send the rebuilt data storage request to the database.

[0060] Figure 2 1 is a flow chart of a method for data processing according to a reference embodiment of the present invention. As another embodiment of the present invention, data security processing when the data type is a query data type is shown. The specific query data type mainly includes two types: precise query data type and fuzzy query data type. These two types correspond to two different processing methods, such as Figure 2 As shown, the data processing method may include:

[0061] Step S201: Obtain data to be stored and a storage location of the data to be stored from a data storage request.

[0062] Step S202: Determine the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and pre-configured data encryption and decryption rules; wherein the data type includes a query data type.

[0063] Step S203: In response to the data type of the data to be stored being the precise query data type, hash mapping is performed on the data to be stored to obtain a hash mapping value, and the hash mapping value is used as a precise index.

[0064] Specifically, for the query data type, considering that it is a query condition, it may be a precise query condition. For example, if the query condition is "Zhang San", it is necessary to accurately search whether "Zhang San" exists in the name column of the database. Considering that the encryption results of "Zhang San" in the embodiment of the present invention are different at different encryption times, in order to facilitate subsequent queries on the data stored in the database, the embodiment of the present invention uses a hash algorithm to perform hash mapping on the data to be stored to obtain a hash mapping value. Since the result of the hash operation is fixed, the hash mapping value is used as a precise index of the data to be stored.

[0065] Step S204: encrypt the data to be stored to obtain encrypted data.

[0066] Specifically, the data to be stored can be encrypted according to an agreed data encryption algorithm, such as a symmetric encryption algorithm, an asymmetric encryption algorithm, or a symmetric and asymmetric hybrid encryption algorithm. Finally, the encrypted data of the data to be stored is obtained.

[0067] Step S205: rewrite the request statement and the data to be stored in the data storage request according to the precise index and the encrypted data, and construct a data storage request with the precise index and the encrypted data.

[0068] Specifically, based on the precise index of the data to be stored calculated by the hash map and the encrypted data of the data to be stored, the request statement and the data to be stored in the data storage request are rewritten. The specific implementation method is to add a parameter to the SQL statement obtained by parsing the data storage request to represent the precise index, and replace the data to be stored corresponding to the original parameter with the encrypted data, and use the precise index and the encrypted data as the rewritten data to be stored, and reassemble them according to the above communication protocol to construct a data storage request with the precise index and encrypted data. It can be understood that there is a corresponding relationship between the precise index of the data to be stored and the encrypted data.

[0069] For example, the SQL statement is: insert into dt (c) values ​​(?); parameter: abc. After rewriting, it is: insert into dt (c, c_index) values(?,?); parameter: 0bee89b07a248e27c83fc3d5951213c1, f5ac8127b3b6b85cdc13f237c6005d80. User c inserts and stores abc in column c of table t in database d. abc is the data to be stored. The configured data encryption and decryption rules include: user c has full read and write permissions for table t in database d, column c is a precise query data type, and the data stored in column c needs to be encrypted. It can be seen that the data abc to be stored needs to be encrypted, and abc needs to be hash mapped, so a parameter c_index is added. Accordingly, the placeholder of the parameter increases from one? to two? , the precise index of abc, that is, the hash mapping value is f5ac8127b3b6b85cdc13f237c6005d80, and the encrypted data of abc is: 0bee89b07a248e27c83fc3d5951213c1.

[0070] Step S206 : In response to the data type of the data to be stored being the fuzzy query data type, splitting the data to be stored into words to obtain a plurality of words to be stored.

[0071] Specifically, in addition to the precise query data types mentioned above, the data to be stored may also be of fuzzy query data types. For example, the item names in the order data table, washing machines may correspond to fully automatic washing machines, smart washing machines, etc. For this type of fuzzy query data, the above hash mapping method is no longer applicable. Considering that fuzzy queries match queries at word granularity, the embodiment of the present invention first splits the data to be stored into words to obtain multiple words to be stored.

[0072] Step S207: encrypt each of the words to be stored using a consistent encryption algorithm to obtain a fuzzy index composed of the encrypted words.

[0073] Specifically, the multiple words to be stored obtained by the above splitting are encrypted word by word using a consistent encryption algorithm, and the values ​​of the multiple encryptions of the same word by the consistent encryption algorithm used at this time are fixed. According to the order of each word of the data to be stored, the encrypted words of each word are arranged to form a fuzzy index of the data to be stored.

[0074] Step S208: encrypt the data to be stored to obtain encrypted data.

[0075] Specifically, the data to be stored is encrypted according to the agreed data encryption algorithm to obtain the encrypted data which is stored in the database.

[0076] Step S209: rewrite the request statement and the data to be stored in the data storage request according to the fuzzy index and the encrypted data, and construct a data storage request with the fuzzy index and the encrypted data.

[0077] Specifically, based on the fuzzy index and encrypted data of the data to be stored determined above, the data to be stored corresponding to the request SQL statement and the parameters in the SQL statement in the data storage request are rewritten. Similar to the above, a fuzzy index parameter is added, and the plaintext of the data to be stored is rewritten using the encrypted data. The fuzzy index and the encrypted data are used as the rewritten data to be stored, and are reassembled according to the communication protocol of the business system and the database system to construct a data storage request with the fuzzy index and the encrypted data. It can be understood that there is a corresponding relationship between the fuzzy index and the encrypted data of the data to be stored.

[0078] In addition, in some special scenarios, the data to be stored may be both a precise query data type and a fuzzy query data type, that is, the data to be stored is used as a query condition and supports both precise query and fuzzy query. In this case, according to the above method, the precise index and fuzzy index of the data to be stored, as well as the encrypted data, are determined; according to the precise index, fuzzy index and the encrypted data, the request statement in the data storage request and the data to be stored are rewritten to construct a data storage request with the precise index, the fuzzy index and the encrypted data. That is, two parameters (precise index and fuzzy index) are added to SQL, and the corresponding relationship between the precise index, the fuzzy index and the encrypted data is established.

[0079] Step S210: Send the reconstructed data storage request to the database, so as to use the encrypted data to replace the data to be stored for data storage.

[0080] Finally, the reconstructed data storage request containing the encrypted data, precise index and / or fuzzy index is sent to the database. According to the received database storage request, the database adds one or two columns before or after the column where the encrypted data is located to store the precise index and / or fuzzy index, thereby maintaining the corresponding relationship between the encrypted data and the precise index and / or fuzzy index.

[0081] The embodiment of the present invention implements data storage processing without the requesting user's perception by parsing the communication protocol, rewriting the SQL statement, and reconstructing the data storage request based on the communication protocol. This not only protects data security, but also does not add additional operation procedures for the requesting user, thereby greatly ensuring user-friendliness of the operation.

[0082] Figure 3 1 is a flow chart of a method for data processing according to another reference embodiment of the present invention. As another embodiment of the present invention, Figure 3 It mainly represents the main steps of data query, such as Figure 3 As shown, the data processing method may include:

[0083] Step S301: Obtain a query method and data to be queried from a data query request.

[0084] Specifically, in addition to the data storage requests mentioned above, the business system may also send data query requests to the database system. Since data processing is imperceptible to the requesting user, the user only needs to submit the plain text of the data to be queried, and whether the query method is fuzzy query or precise query. After the data processing system obtains the data query request, it parses the SQL statement and its parameters according to the communication protocol, and obtains the data to be queried and the query method of the data to be queried.

[0085] Step S302: In response to the query mode being a precise query, the data to be queried is hash mapped to obtain a hash mapping value; and according to the hash mapping value and the data encryption and decryption rule, the data to be queried is queried from the database.

[0086] Specifically, when the query method is precise query, since the database stores encrypted data and the data to be queried is plain text, the corresponding precise index is added in the storage process of the data to be stored based on the above precise query data type. Therefore, at this time, it is necessary to perform hash mapping on the data to be queried to obtain the hash mapping value of the data to be queried, so as to find the encrypted data of the data to be queried in the database according to the hash mapping value, and then obtain the data to be queried.

[0087] According to one embodiment of the present invention, according to the hash mapping value and the data encryption and decryption rules, the data to be queried is queried from the database, including: using the hash mapping value as a precise index of the data to be queried, reconstructing a data query request, and sending the reconstructed data query request to the database; receiving the encrypted data found by the database using the hash mapping value as a precise index, decrypting the encrypted data according to the data encryption and decryption rules, and using the decrypted data as the data to be queried.

[0088] Specifically, the hash mapping value of the data to be queried is used as the precise index of the data to be queried, and the SQL statement and parameters are rewritten. For example, taking the above user c querying abc in the c column of the table t in the database d as an example, there is an SQL statement: select c from dt where c = abc. After rewriting, it is: select c, c_index from d.twhere c_index = f5ac8127b3b6b85cdc13f237c6005d80. It can be seen that the hash mapping of the query data abc is performed to obtain f5ac8127b3b6b85cdc13f237c6005d80, and the hash mapping value is used as the precise index of c_index to rewrite the SQL statement.

[0089] Furthermore, based on the communication protocol agreed upon between the business system and the database system, the rewritten SQL is reassembled into a data query request so as to interact with the database system, and the reconstructed data query request is sent to the database. After receiving the data query request, the database parses and obtains the precise index, finds the data item matching the precise index, and returns the corresponding encrypted data in the data item to the data processing system. The data processing system receives the encrypted data returned by the database, determines the corresponding decryption method according to the pre-configured data encryption and decryption rules, decrypts the received encrypted data, and finally uses the decrypted data as the data to be queried.

[0090] According to another embodiment of the present invention, after decrypting the encrypted data, the method further includes: performing a hash operation on the decrypted data to obtain a hash value; performing an integrity check on the decrypted data by comparing the hash value with a hash mapping value of the data to be queried, and determining that the integrity check passes.

[0091] Specifically, in order to further ensure the integrity of the data, that is, the data has not been tampered with, in the scenario of precise query, after decrypting the encrypted data, the decrypted plaintext data can be verified again by hash operation. The integrity of the decrypted data is verified by comparing the verified hash value with the precise index of the data to be queried stored in the database, that is, whether the hash mapping value at the time of storage is consistent. Only after the integrity check passes and it is determined that the data has not been tampered with, can the decrypted data be determined to be the data to be queried.

[0092] The embodiment of the present invention utilizes hash mapping, which not only provides a stable and reliable precise index for data query, so as to use the precise index to find the encrypted data of the data to be queried, but also provides a method for verifying the integrity of the decrypted data, thereby further improving the reliability and stability of the query data.

[0093] Step S303, in response to the query mode being a fuzzy query, encrypt the data to be queried using the consistent encryption algorithm to obtain an encrypted word; and query and obtain the data to be queried from the database according to the encrypted word and the data encryption and decryption rules.

[0094] Specifically, when the query method is fuzzy query, since the database stores encrypted data and the data to be queried is plain text, the corresponding fuzzy index is added in the storage process of the data to be stored based on the above fuzzy query data type. Therefore, at this time, it is necessary to use a consistent encryption algorithm to encrypt the data to be queried word by word to obtain the encrypted word of the data to be queried, so as to find and locate the encrypted data of the data to be queried in the database according to the encrypted word, and then obtain the data to be queried.

[0095] According to one embodiment of the present invention, based on the encryption word and the data encryption and decryption rules, the data to be queried is queried from the database, including: using the encryption word as a fuzzy index of the data to be queried, reconstructing a data query request, and sending the reconstructed data query request to the database; receiving the encrypted data found by the database using the encryption word as a fuzzy index, decrypting the encrypted data according to the data encryption and decryption rules, and using the decrypted data as the data to be queried.

[0096] Specifically, the encrypted word of the data to be queried determined above is used as the fuzzy index of the data to be queried, and the SQL statement and parameters are rewritten, and the SQL statement for querying the data is converted and rewritten into an SQL statement for querying the data corresponding to the fuzzy index. Then, based on the communication protocol agreed upon between the business system and the database system, the rewritten SQL is reassembled into a data query request so as to interact with the database system, and the reconstructed data query request is sent to the database. After receiving the data query request, the database parses and obtains the fuzzy index, searches for data items that at least partially match the fuzzy index, and returns the corresponding encrypted data in the data item to the data processing system. The data processing system receives the encrypted data returned by the database, determines the corresponding decryption method according to the pre-configured data encryption and decryption rules, decrypts the received encrypted data, and finally uses the decrypted data as the data to be queried.

[0097] It can be understood that, whether it is a precise query or a fuzzy query, after the decrypted data is used as the data to be queried, the decrypted data is used to rewrite the encrypted data returned by the database, and the response result corresponding to the data query request is reconstructed according to the communication protocol, and the response result is returned to the requesting user.

[0098] To sum up, the embodiments of the present invention implement data query processing without the perception of the requesting user by parsing the communication protocol, rewriting the SQL statement, and reconstructing the data query request and response results based on the communication protocol. This not only protects data security, but also does not add additional operation procedures for the requesting user, thereby greatly ensuring the user-friendliness of the operation.

[0099] According to another embodiment of the present invention, before decrypting the encrypted data, the method further includes: according to the data encryption and decryption rules, authenticating the requester who sends the data query request, and determining that the requester has the authority to obtain the decrypted data; in response to the requester not having the authority to obtain the decrypted data, using the encrypted data as the data to be queried; in response to the requester having the authority to obtain the desensitized data, desensitizing the decrypted data, and using the desensitized data as the data to be queried.

[0100] Specifically, in order to further ensure the security of data, whether it is a precise query or a fuzzy query, before decrypting the encrypted data, the decryption authority of the requester is authenticated according to the preset data encryption and decryption rules. Only when the authentication is passed and the requester has the authority to obtain the plaintext is the encrypted data allowed to be decrypted. If the requester does not have the authority to obtain the plaintext data, then no decryption is done, and only the ciphertext data is returned to the business system as the data to be queried. If the requester has the authority to obtain the desensitized data, then the decrypted plaintext data needs to be desensitized and the desensitized data is used as the data to be queried.

[0101] Exemplarily, taking the above-mentioned user c querying abc in column c of table t in database d as an example, the query statement select c from dt where c = abc is rewritten as: select c, c_index from dt where c_index = f5ac8127b3b6b85cdc13f237 c6005d80, and the data query request is rebuilt and sent to the database. The database returns the precise index and the encrypted data corresponding to the precise index, and the return result is: 0bee89b07a248e27c83fc3d5951213c1, f5ac8127b3b6b85cdc13f237c6005d80. After decrypting the encrypted data 0bee89b07a248e27c83fc3d5951213c1, abc is obtained, and finally it is desensitized to a*c according to the desensitization configuration, and finally a*c is returned.

[0102] In addition, in addition to the data storage mathematics and data query processing mentioned above, the embodiments of the present invention also support data modification processing and data deletion processing. For data modification, the original data to be modified and the updated data are obtained from the data modification request, and the original data to be modified are hash mapped, and the hash mapping value is used as the precise index; the updated data are hash mapped and data encrypted respectively to obtain the updated index and encrypted updated data; according to the precise index, the updated index and the encrypted updated data, the original data in the database is updated to the encrypted updated data, and the precise index corresponding to the original data is updated to the updated index.

[0103] For example, taking the abc of column c of table t of the above user c in the database d as an example, it is known that the precise index corresponding to abc is f5ac8127b3b6b85cdc13f237c6005d80. For the SQL statement update dt set c = 123where c = abc, the rewritten SQL statement is update dt set c = ba1f2511fc30423bdbb183fe33f3dd0f, c_index = e7df7cd2ca07f4f1ab415d457a6e1c13 where c_index =f5ac8127b3b6 b85cdc13f237c6005d80. That is, the encrypted data corresponding to the precise index f5ac8127b3b6b85cdc13f237c6005d80 is changed to the encrypted data ba1f2511fc30423bdbb183fe33f3dd0f of "123". Correspondingly, the corresponding precise index is changed to e7df7cd2ca07f4f1ab415d457a6e1c13.

[0104] Similarly, for data deletion processing, the data to be deleted is obtained from the data deletion request, hash mapping is performed on the data to be deleted, and the hash mapping value is used as the precise index; according to the precise index, the encrypted data corresponding to the precise index in the database is deleted. For example, taking the abc of the c column of the above-mentioned user c in the database d table t as an example, for the SQL statement deletefrom dt where c = abc, the rewritten SQL is delete from dt where c_index = f5ac8127b3b6b85cdc13f237c6005d80. That is, the encrypted data corresponding to the precise index f5ac8127b3b6 b85cdc13f237c6005d80 is deleted.

[0105] According to another embodiment of the present invention, the method further includes: updating the configuration of the data encryption and decryption rules according to a received data processing requirement update request, so as to perform data processing that meets the requirement according to the updated data encryption and decryption rules.

[0106] Specifically, the data encryption, decryption, data encryption and decryption permissions, and encryption strategies corresponding to data types in the embodiments of the present invention are all protected by configured data encryption and decryption rules. This flexible and dynamic solution is easier to apply and expand. If an update to data processing requirements is received, such as modifying user permissions, modifying encryption algorithms, etc., the configured data encryption and decryption rules can be directly modified to conveniently and efficiently implement data processing that meets the requirements. In addition, it is also possible to stop losses in time in scenarios where data leaks occur by modifying and updating the configuration. At the same time, for old project codes that have been developed for a long time, this configured non-intrusive data encryption and decryption rule greatly simplifies the business access process and is more conducive to data processing of old project codes.

[0107] Figure 4 It is a complete flow chart of data query processing in an embodiment of the present invention. The requesting user sends a data query request through the business system. The data processing system parses the SQL query statement and parameters in the data query request according to the communication protocol specified between the business system and the database system, and then obtains the data to be queried and the query method. According to the data encryption and decryption rules pre-configured in the management end configuration file, the requesting user of the data query request is authenticated to determine whether he has the query permission. If he does not have the query permission, an error prompt is returned. If he has the query permission, it is determined from the data encryption and decryption rules whether the query method uses hash mapping or word encryption to treat the query data, thereby generating a precise index or fuzzy index of the data to be queried, so as to rewrite the SQL statement and the parameters therein, and obtain the SQL query statement of the encrypted data corresponding to the rewritten query precise index or fuzzy index. According to the rewritten SQL query statement and the communication protocol, the data query request is reconstructed, and the reconstructed data query request is sent to the database.

[0108] After receiving the data query request, the database parses and obtains the precise index or fuzzy index, locates the corresponding encrypted data from the table in the database based on the precise index or fuzzy index, and returns it to the data processing system. The data processing system receives the encrypted data to be queried returned by the database, queries the data encryption and decryption rules in the configuration file to determine whether the requesting user has the authority to obtain the decrypted data, decrypts the encrypted data according to the data encryption and decryption rules, and performs desensitization processing if necessary. Subsequently, the decrypted or desensitized data is used as the data to be queried to replace the encrypted data returned by the database, rewrites the returned result, and finally reconstructs the response result corresponding to the data query request in combination with the communication protocol, and returns the response result to the requesting user.

[0109] The embodiment of the present invention implements data security processing without the perception of the requesting user by parsing the communication protocol, rewriting the SQL statement, and reconstructing the query request and response result based on the communication protocol. It not only protects data security, but also does not add additional operation procedures for the requesting user, thereby greatly ensuring the user-friendliness of the operation.

[0110] Figure 5 FIG. 1 is a schematic diagram of the main modules of the data processing device according to the first embodiment of the present invention. Figure 5 As shown, the first device 500 for data processing mainly includes a data acquisition module 501 , a strategy acquisition module 502 and a data storage module 503 .

[0111] A data acquisition module 501 is used to acquire the data to be stored and the storage location of the data to be stored from a data storage request;

[0112] A policy acquisition module 502 is used to determine the data type of the data to be stored and the encryption policy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes a query data type;

[0113] The data storage module 503 is used to encrypt the data to be stored according to the encryption strategy, reconstruct the data storage request using the encrypted data, and send the reconstructed data storage request to the database to use the encrypted data to replace the data to be stored for data storage.

[0114] According to one embodiment of the present invention, the query data type includes a precise query data type; in response to the data type of the data to be stored being the precise query data type, the data storage module 503 is further used to: perform hash mapping on the data to be stored to obtain a hash mapping value, and use the hash mapping value as a precise index; perform data encryption on the data to be stored to obtain encrypted data; and rewrite the request statement in the data storage request and the data to be stored according to the precise index and the encrypted data, to construct a data storage request with the precise index and the encrypted data.

[0115] According to another embodiment of the present invention, the query data type includes a fuzzy query data type; in response to the data type of the data to be stored being the fuzzy query data type, the data storage module 503 is further used to: split the data to be stored into words to obtain multiple words to be stored; encrypt each of the words to be stored using a consistent encryption algorithm to obtain a fuzzy index composed of the encrypted words; encrypt the data to be stored to obtain encrypted data; and rewrite the request statement in the data storage request and the data to be stored according to the fuzzy index and the encrypted data to construct a data storage request with the fuzzy index and the encrypted data.

[0116] According to another embodiment of the present invention, the data processing device 500 also includes an authentication module (not shown in the figure), which is used to: before determining the data type of the data to be stored according to the storage location and pre-configured data encryption rules, authenticate the requester who sends the data storage request according to the data encryption and decryption rules, and determine whether the requester has the authority to store the data to be stored.

[0117] According to another embodiment of the present invention, the data processing device 500 also includes a configuration update module (not shown in the figure), which is used to: update the configuration of the data encryption and decryption rules according to the received data processing demand update request, so as to perform data processing that meets the demand according to the updated data encryption and decryption rules.

[0118] Figure 6 FIG. 2 is a schematic diagram of the main modules of a data processing device according to a second embodiment of the present invention. Figure 6 As shown, the data processing device 600 mainly includes a query acquisition module 601, a precise query module 602 and a fuzzy query module 603.

[0119] The query acquisition module 601 is used to acquire the query mode and the data to be queried from the data query request;

[0120] The precise query module 602 is used to perform hash mapping on the data to be queried to obtain a hash mapping value in response to the query mode being a precise query; and query and obtain the data to be queried from the database according to the hash mapping value and the data encryption and decryption rule;

[0121] The fuzzy query module 603 is used to, in response to the query mode being a fuzzy query, use the consistent encryption algorithm to encrypt the data to be queried to obtain an encrypted word; and query and obtain the data to be queried from the database according to the encrypted word and the data encryption and decryption rules.

[0122] According to one embodiment of the present invention, the precise query module 602 is also used to: use the hash mapping value as the precise index of the data to be queried, reconstruct the data query request, and send the reconstructed data query request to the database; receive the encrypted data found by the database using the hash mapping value as the precise index, decrypt the encrypted data according to the data encryption and decryption rules, and use the decrypted data as the data to be queried.

[0123] According to another embodiment of the present invention, the fuzzy query module 603 is also used to: use the encrypted word as the fuzzy index of the data to be queried, reconstruct the data query request, and send the reconstructed data query request to the database; receive the encrypted data found by the database using the encrypted word as the fuzzy index, decrypt the encrypted data according to the data encryption and decryption rules, and use the decrypted data as the data to be queried.

[0124] According to another embodiment of the present invention, the data processing device 600 also includes a query authentication module (not shown in the figure), which is used to: before decrypting the encrypted data, authenticate the requester who sends the data query request according to the data encryption and decryption rules, and determine whether the requester has the authority to obtain the decrypted data; in response to the requester not having the authority to obtain the decrypted data, use the encrypted data as the data to be queried; in response to the requester having the authority to obtain the desensitized data, desensitize the decrypted data and use the desensitized data as the data to be queried.

[0125] According to another embodiment of the present invention, the data processing device 600 also includes a verification module (not shown in the figure), which is used to: after decrypting the encrypted data, perform a hash operation on the decrypted data to obtain a hash value; perform an integrity check on the decrypted data by comparing the hash value with the hash mapping value of the data to be queried, and determine that the integrity check passes.

[0126] Figure 7 is an exemplary system architecture diagram to which embodiments of the present invention can be applied.

[0127] like Figure 7 As shown, system architecture 700 may include terminal devices 701, 702, 703, network 704 and server 705. Network 704 is used to provide a medium for communication links between terminal devices 701, 702, 703 and server 705. Network 704 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0128] Users can use terminal devices 701, 702, 703 to interact with server 705 through network 704 to receive or send messages, etc. Various communication client applications, such as data processing applications, etc., can be installed on terminal devices 701, 702, 703 (only as examples).

[0129] The terminal devices 701 , 702 , and 703 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0130] The server 705 may be a server that provides various services, such as a background management server that supports data processing performed by users using terminal devices 701, 702, and 703 (for example only). The background management server may obtain the data to be stored and the storage location of the data to be stored from the data storage request; determine the data type of the data to be stored and the encryption policy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes the query data type; encrypt the data to be stored according to the encryption policy, reconstruct the data storage request using the encrypted data, and send the reconstructed data storage request to the database, so as to use the encrypted data to replace the data to be stored for data storage and other processing, and feed back the processing result to the terminal device.

[0131] It should be noted that the data processing method provided in the embodiment of the present invention is generally executed by the server 705 , and accordingly, the data processing device is generally set in the server 705 .

[0132] It should be understood that Figure 7 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0133] Reference below Figure 8 , Figure 8 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. Figure 8 The terminal device or server shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0134] like Figure 8As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the system 800 are also stored. The CPU 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0135] The following components are connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage section 808 as needed.

[0136] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processing unit (CPU) 801, the above-mentioned functions defined in the system of the present invention are executed.

[0137] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0138] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0139] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes: a data acquisition module, a policy acquisition module and a data storage module.

[0140] The names of these modules do not, in some cases, limit the modules themselves. For example, the data acquisition module can also be described as “a module for acquiring data to be stored and a storage location of the data to be stored from a data storage request”.

[0141] On the other hand, the present invention also provides a computer-readable medium, which may be included in the device described in the embodiment; or it may exist independently and not be assembled into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by a device, the device includes: obtaining the data to be stored and the storage location of the data to be stored from a data storage request; determining the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes the query data type; encrypting the data to be stored according to the encryption strategy, reconstructing the data storage request with the encrypted data, and sending the reconstructed data storage request to the database, so as to use the encrypted data to replace the data to be stored for data storage.

[0142] The technical solution according to the embodiment of the present invention has the following advantages or beneficial effects: by obtaining the data to be stored and the storage location of the data to be stored from the data storage request; determining the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes the query data type; encrypting the data to be stored according to the encryption strategy, reconstructing the data storage request with the encrypted data, and sending the reconstructed data storage request to the database, so as to use the encrypted data instead of the data to be stored for data storage. The technical solution realizes a non-invasive and flexible data security processing method, which is based on the configured data encryption and decryption rules, is easy to expand and update, simplifies the business data processing process, realizes the senseless processing of business data, and based on the security processing of data granularity, it is more convenient to add, delete, modify, query and other operations on the data stored in the database.

[0143] The specific implementation methods described herein do not constitute limitations on the scope of protection of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A method for data processing, characterized in that: include: Acquire the data to be stored and the storage location of the data to be stored from the data storage request; Determine the data type of the data to be stored and the encryption strategy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes a query data type; The data to be stored is encrypted according to the encryption strategy, a data storage request is reconstructed using the encrypted data, and the reconstructed data storage request is sent to the database, so as to use the encrypted data to replace the data to be stored for data storage.

2. The method according to claim 1, characterized in that The query data type includes a precise query data type; In response to the data type of the data to be stored being the precise query data type, encrypting the data to be stored according to the encryption strategy, and reconstructing the data storage request using the encrypted data, including: Performing hash mapping on the data to be stored to obtain a hash mapping value, and using the hash mapping value as a precise index; Encrypting the data to be stored to obtain encrypted data; According to the precise index and the encrypted data, the request statement and the data to be stored in the data storage request are rewritten to construct a data storage request with the precise index and the encrypted data.

3. The method according to claim 1, characterized in that The query data type includes a fuzzy query data type; In response to the data type of the data to be stored being the fuzzy query data type, encrypting the data to be stored according to the encryption strategy, and reconstructing the data storage request using the encrypted data, including: Splitting the data to be stored into words to obtain a plurality of words to be stored; Encrypt each of the words to be stored using a consistent encryption algorithm to obtain a fuzzy index composed of the encrypted words; Encrypting the data to be stored to obtain encrypted data; According to the fuzzy index and the encrypted data, the request statement and the data to be stored in the data storage request are rewritten to construct a data storage request with the fuzzy index and the encrypted data.

4. The method according to claim 1, characterized in that: Before determining the data type of the data to be stored according to the storage location and the pre-configured data encryption rule, the method further includes: According to the data encryption and decryption rules, the requester who sends the data storage request is authenticated, and it is determined whether the requester has the authority to store the data to be stored.

5. The method according to claim 2 or 3, characterized in that: The method further comprises: Obtain the query method and the data to be queried from the data query request; In response to the query mode being a precise query, performing hash mapping on the data to be queried to obtain a hash mapping value; querying and acquiring the data to be queried from the database according to the hash mapping value and the data encryption and decryption rule; In response to the query mode being a fuzzy query, the data to be queried is encrypted using the consistent encryption algorithm to obtain an encrypted word; and according to the encrypted word and the data encryption and decryption rules, the data to be queried is queried from the database.

6. The method according to claim 5, characterized in that According to the hash mapping value and the data encryption and decryption rule, querying and obtaining the to-be-queried data from the database includes: Using the hash map value as the precise index of the data to be queried, reconstructing the data query request, and sending the reconstructed data query request to the database; The encrypted data found by the database using the hash mapping value as a precise index is received, the encrypted data is decrypted according to the data encryption and decryption rule, and the decrypted data is used as the data to be queried.

7. The method according to claim 5, characterized in that According to the encryption word and the data encryption and decryption rule, querying and acquiring the to-be-queried data from the database comprises: Using the encrypted word as a fuzzy index of the data to be queried, reconstructing a data query request, and sending the reconstructed data query request to the database; The encrypted data found by the database using the encryption word as a fuzzy index is received, the encrypted data is decrypted according to the data encryption and decryption rule, and the decrypted data is used as the data to be queried.

8. The method according to claim 6 or 7, characterized in that: Before decrypting the encrypted data, the method further includes: According to the data encryption and decryption rules, the requester who sends the data query request is authenticated, and it is determined that the requester has the authority to obtain the decrypted data; In response to the requesting party not having the authority to obtain the decrypted data, using the encrypted data as the data to be queried; In response to the requesting party having the authority to obtain the desensitized data, the decrypted data is desensitized and the desensitized data is used as the data to be queried.

9. The method according to claim 6, characterized in that After decrypting the encrypted data, the method further comprises: Perform hash operation on the decrypted data to obtain a hash value; By comparing the hash value with the hash mapping value of the data to be queried, an integrity check is performed on the decrypted data, and it is determined that the integrity check passes.

10. The method according to claim 1, characterized in that The method further comprises: According to the received data processing requirement update request, the configuration of the data encryption and decryption rules is updated to perform data processing that meets the requirements according to the updated data encryption and decryption rules.

11. A data processing device, characterized in that: include: A data acquisition module, used to acquire the data to be stored and the storage location of the data to be stored from the data storage request; A policy acquisition module, used to determine the data type of the data to be stored and the encryption policy corresponding to the data type according to the storage location and the pre-configured data encryption and decryption rules; wherein the data type includes a query data type; The data storage module is used to encrypt the data to be stored according to the encryption strategy, reconstruct the data storage request using the encrypted data, and send the reconstructed data storage request to the database to use the encrypted data to replace the data to be stored for data storage.

12. A data processing device, characterized in that: include: A query acquisition module is used to obtain the query method and the data to be queried from the data query request; A precise query module, configured to perform hash mapping on the data to be queried to obtain a hash mapping value in response to the query mode being a precise query; and query and obtain the data to be queried from the database according to the hash mapping value and the data encryption and decryption rule; The fuzzy query module is used to, in response to the query mode being a fuzzy query, use the consistent encryption algorithm to encrypt the data to be queried to obtain an encrypted word; and query and obtain the data to be queried from the database according to the encrypted word and the data encryption and decryption rules.

13. A mobile electronic device terminal, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 10.

14. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images