A database encryption access method, system and program product

Abstract

The present invention belongs to the technical field of database management, and specifically discloses a database encryption access method, system and program product. By decomposing the data relationship of the database and adopting partial encryption and consistent hash calculation, the amount of calculation is small, and a good encryption effect can be obtained without high-intensity encryption of all data. Compared with the traditional encryption method, the encrypted database is split into block files, which is convenient for transmission transactions, and can be retrieved and reconstructed in the encrypted state. Moreover, it is suitable for real-time transmission to a certain extent, and data reconstruction based on time points can be realized without stopping data conversion, thereby improving the transmission efficiency of large-scale databases. At the same time, this method can also quickly retrieve and reconstruct source data after encrypted transmission in accordance with the rules of the method, and can effectively support the mutual conversion and reconstruction between databases of multiple encryption types.

Description

Technical Field

[0001] The present invention belongs to the technical field of database management, and in particular relates to a database encryption access method, system and program product. Background Art

[0002] With the advent of the digital age, people want to open up data on the one hand, but also need to protect data from being illegally stolen on the other hand. Therefore, many data encryption access methods have been born. At present, the database encryption technologies still used in different scenarios mainly include front-end proxy encryption, application system encryption, file system encryption and post-proxy encryption, among which:

[0003] 1. Pre-proxy encryption technology. The idea of ​​this technology is to add a security proxy service before the database. All access to the database must go through the security proxy service. Security policies such as data encryption and decryption, access control, etc. are implemented in this service. The security proxy service implements data storage through the database access interface. The security proxy service exists between the client application and the database storage engine, and is responsible for completing the encryption and decryption of the data. The encrypted data is stored in the security proxy service. This technology relies on the security proxy and needs to be customized specifically for the database interface. It is not suitable for data transactions, and some matching retrieval will be slow.

[0004] 2. Application system encryption technology. This technology is that the application system encrypts sensitive data through encryption API (such as JDBC, ODBC, CAPI, etc.), stores the encrypted data in the underlying files of the database, and retrieves the ciphertext data to the client for decryption during data retrieval. The application system manages the key system by itself. This method is also not conducive to data exchange and transactions.

[0005] 3. File system encryption and decryption technology. This technology does not integrate with the principles of the database itself, but only encrypts and decrypts the data storage carrier from the operating system or file system level. This technology implants a certain invasive "hook" process in the operating system, performs decryption when the data storage file is opened, and performs encryption when the data is landed. While having basic encryption and decryption capabilities, it can perform basic access rights control based on the operating system user or the process ID that accesses the file. Such technology is system-related and is not conducive to data exchange and transactions.

[0006] 4. Post-proxy encryption technology. This technology uses "view" + "trigger" + "extended index" + "external call" to achieve data encryption while ensuring complete transparency of the application. The core idea is to make full use of the application customization and expansion capabilities provided by the database itself, and use its trigger expansion capabilities, index expansion capabilities, custom function expansion capabilities, and view technologies to meet the core requirements of data storage encryption, encrypted data retrieval, and seamless transparency to applications.

[0007] However, these existing database encryption technologies still have many deficiencies when applied, especially when transmitting the entire database data on a large scale. For example, a data provider needs to give the entire database data to a recipient, and a certain degree of encryption is required. Usually, such database encryption requires all database files to be encrypted as a whole and then transmitted, and then reconstructed and used remotely by decrypting the entire file. There are several problems with this. First, it takes a long time to encrypt and decrypt a large data file, and the file is too large to be processed in blocks; second, it is difficult to process incremental data, and it is basically impossible to do so for real-time data, because when all data is encrypted as a whole, it is impossible to reconstruct the data if the data is not fully transmitted; in addition, if the original data file of the database is used, then for different database types, the same database engine is required to process when reconstructing, which is very inconvenient for the mutual conversion and reconstruction of data resources between different types of databases. Summary of the invention

[0008] The purpose of the present invention is to provide a database encryption access method, system and program product to solve the above problems existing in the prior art.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] In a first aspect, a method for encrypted access to a database is provided, comprising:

[0011] Construct a data information storage file, split the data information storage file into several storage block files, and name each storage block file respectively;

[0012] Perform consistent hash calculation based on the name of each storage block file to determine the first position node corresponding to each storage block file in the first hash ring;

[0013] Extract each storage data resource in the source database, determine the data table structure information corresponding to each storage data resource, and perform consistent hash calculation based on the data table structure information and the set data information storage encryption key to determine the second position node corresponding to each storage data resource in the first hash ring;

[0014] Determine the storage block file mapped by each storage data resource according to the first position node corresponding to each storage block file in the first hash ring and the second position node corresponding to each storage data resource in the first hash ring, write each storage data resource into the storage block file mapped thereto, and determine the storage position data of each storage data resource in the corresponding storage block file;

[0015] Construct a data index information file, split the data index information file into several index files, and name each index file respectively;

[0016] Perform consistent hash calculation based on the name of each index file, determine the third position node corresponding to each index file in the second hash ring, respectively combine the data table structure information corresponding to each storage data resource with the set data information storage encryption key to obtain the corresponding index information, perform consistent hash calculation on each index information, and determine the fourth position node corresponding to each index information in the second hash ring;

[0017] Determine the index file mapped by each index information according to the fourth position node corresponding to each index information in the second hash ring and the third position node corresponding to each index file in the second hash ring;

[0018] Calculate the key value of each index information, determine the storage location data of the storage data resource corresponding to each index information, associate the key value of each index information with the storage location data of the storage data resource corresponding to it, and write it into the index file to which it is mapped;

[0019] Construct a database table structure information file, and write the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database into the database table structure information file;

[0020] Encrypt and name the written database table structure information file to obtain the corresponding database information relationship file;

[0021] The database information relationship file, each storage block file that has been written, and each index file that has been written are transmitted to the receiving end, so that the receiving end performs reverse processing on the database information relationship file, and forms each index information based on the data table structure information of each data table obtained by the reverse processing and the set data information storage encryption key, performs consistent hash calculation based on each index information and the name of each storage block file, determines the storage block file corresponding to each index information, performs consistent hash calculation based on each index information and the name of each index file, determines the index file corresponding to each index information, calculates the key value of each index information, finds the associated storage location data in the corresponding index file based on the key value of each index information, finds the corresponding storage data resource in the corresponding storage block file according to the storage location data, and rebuilds a new database using each storage data resource and its data table structure information and the data table structure information of each data table.

[0022] In a possible design, the extraction of each storage data resource in the source database includes: extracting the initial storage data resource from the corresponding row and column data units of the corresponding data table of the source database; when the initial storage data resource meets the set data volume condition or data type condition, using the set data information storage encryption key to symmetrically encrypt the initial storage data resource to obtain the encrypted storage data resource.

[0023] In one possible design, when the total number of all initial storage data resources is less than a set threshold condition, the method further includes: using a set data information storage encryption key to symmetrically encrypt all initial storage data resources to obtain encrypted storage data resources of each initial storage data resource.

[0024] In a possible design, the data table structure information includes table name, field column name and row number.

[0025] In one possible design, the name of the storage block file includes the database name, the latest data time, the number of storage block files and the storage block file number, and the name of the index file includes the database name, the latest data time, the number of index files and the index file number.

[0026] In a possible design, the performing hash calculation on each index information includes: performing hash calculation on each index information using a set hash algorithm, and using the calculated hash value as a key value of the corresponding index information.

[0027] In a second aspect, a method for encrypted access to a database is provided, comprising:

[0028] Receiving the database information relationship file, each storage block file and each index file transmitted by the sending end;

[0029] Decrypting the database information relationship file using a preset key to obtain a database table structure information file, wherein the database table structure information file includes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database;

[0030] Based on the data table structure information of each data table and the set data information storage encryption key, each index information is traversed and constructed;

[0031] Perform consistent hash calculation based on each index information and the name of each storage block file to determine the storage block file mapped in the first hash ring to the storage data resource corresponding to each index information, and perform consistent hash calculation based on each index information and the name of each index file to determine the index file mapped in the second hash ring to each index information;

[0032] Calculate the key value of each index information, find the associated storage location data in the corresponding index file based on the key value of each index information, and find the corresponding storage data resource in the corresponding storage block file according to the storage location data;

[0033] A new database is rebuilt using each storage data resource and its data table structure information as well as the data table structure information of each data table.

[0034] In a third aspect, a database encryption access system is provided, including a sending end and a receiving end for establishing data connection, wherein the sending end is used to:

[0035] Construct a data information storage file, split the data information storage file into several storage block files, and name each storage block file respectively;

[0036] Perform consistent hash calculation based on the name of each storage block file to determine the first position node corresponding to each storage block file in the first hash ring;

[0037] Extract each storage data resource in the source database, determine the data table structure information corresponding to each storage data resource, and perform consistent hash calculation based on the data table structure information and the set data information storage encryption key to determine the second position node corresponding to each storage data resource in the first hash ring;

[0038] Determine the storage block file mapped by each storage data resource according to the first position node corresponding to each storage block file in the first hash ring and the second position node corresponding to each storage data resource in the first hash ring, write each storage data resource into the storage block file mapped thereto, and determine the storage position data of each storage data resource in the corresponding storage block file;

[0039] Construct a data index information file, split the data index information file into several index files, and name each index file respectively;

[0040] Perform consistent hash calculation based on the name of each index file, determine the third position node corresponding to each index file in the second hash ring, respectively combine the data table structure information corresponding to each storage data resource with the set data information storage encryption key to obtain the corresponding index information, perform consistent hash calculation on each index information, and determine the fourth position node corresponding to each index information in the second hash ring;

[0041] Determine the index file mapped by each index information according to the fourth position node corresponding to each index information in the second hash ring and the third position node corresponding to each index file in the second hash ring;

[0042] Calculate the key value of each index information, determine the storage location data of the storage data resource corresponding to each index information, associate the key value of each index information with the storage location data of the storage data resource corresponding to it, and write it into the index file to which it is mapped;

[0043] Construct a database table structure information file, and write the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database into the database table structure information file;

[0044] Encrypt and name the written database table structure information file to obtain the corresponding database information relationship file;

[0045] The database information relationship file, each storage block file that has been written, and each index file that has been written are transmitted to the receiving end.

[0046] In one possible design, the receiving end is used to:

[0047] Receiving the database information relationship file, each storage block file and each index file transmitted by the sending end;

[0048] Decrypting the database information relationship file using a preset key to obtain a database table structure information file, wherein the database table structure information file includes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database;

[0049] Based on the data table structure information of each data table and the set data information storage encryption key, each index information is traversed and constructed;

[0050] Perform consistent hash calculation based on each index information and the name of each storage block file to determine the storage block file mapped in the first hash ring to the storage data resource corresponding to each index information, and perform consistent hash calculation based on each index information and the name of each index file to determine the index file mapped in the second hash ring to each index information;

[0051] Calculate the key value of each index information, find the associated storage location data in the corresponding index file based on the key value of each index information, and find the corresponding storage data resource in the corresponding storage block file according to the storage location data;

[0052] A new database is rebuilt using each storage data resource and its data table structure information as well as the data table structure information of each data table.

[0053] In a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored on the computer-readable storage medium, and when the instructions are executed on a computer, the computer executes any one of the methods described in the first aspect. In addition, a computer program product is provided, and when the computer program product is executed on a computer, the computer executes any one of the methods described in the first aspect.

[0054] Beneficial effects: The present invention decomposes the data relationship of the database and adopts partial encryption and consistent hash calculation, so that the amount of calculation is small, and there is no need to encrypt all data with high intensity to obtain a good encryption effect; compared with the traditional encryption method, the encrypted database is split into block files, which is convenient for transmission transactions, and can be retrieved and reconstructed in the encrypted state, and is suitable for real-time transmission to a certain extent. It does not need to stop data conversion, and can realize data reconstruction based on time points, thereby improving the transmission efficiency of large-scale databases; at the same time, this method of quickly retrieving and reconstructing source data after encrypted transmission in accordance with the rules of the method can effectively support the mutual conversion and reconstruction between databases of multiple encryption types. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 This is a schematic diagram of the steps of the method in Example 1 of the present invention;

[0057] Figure 2 This is a schematic diagram of the structure of the system in Example 2 of the present invention. DETAILED DESCRIPTION

[0058] It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. The specific structures and functional details disclosed herein are only used to describe the exemplary embodiments of the present invention. However, the present invention can be embodied in many alternative forms, and it should not be understood that the present invention is limited to the embodiments set forth herein.

[0059] It should be understood that unless otherwise clearly specified and limited, the corresponding terms should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments can be understood according to specific circumstances.

[0060] In the following description, certain details are provided to facilitate a complete understanding of the example embodiments. However, it will be appreciated by those of ordinary skill in the art that the example embodiments may be implemented without these certain details. For example, devices may be shown in block diagrams to avoid obscuring the examples with unnecessary details. In other embodiments, well-known processes, structures, and techniques may not be shown in unnecessary detail to avoid obscuring the embodiments.

[0061] Embodiment 1:

[0062] This embodiment provides a database encryption access method, which can be applied to a corresponding database encryption access system, wherein the system includes a sending end and a receiving end, such as Figure 1 As shown, the method comprises the following steps:

[0063] S1. The sending end constructs a data information storage file, splits the data information storage file into several storage block files, and names each storage block file respectively. In specific implementation, first construct a data information storage file, split the data information storage file into several storage block files, the number of storage block files can be set according to actual needs, and then name each storage block file respectively, the naming format is such as "database name" + "storage block file number" + "time" + "number of storage block files", that is, the name of the storage block file includes the database name, the latest data time, the number of storage block files and the storage block file number.

[0064] S2. The sending end performs a consistent hash calculation based on the name of each storage block file to determine the first position node corresponding to each storage block file in the first hash ring. In specific implementation, the consistent hash calculation is performed using the name of each storage block file, such as using the MurmurHash3 algorithm to perform a consistent hash calculation to calibrate the first position node corresponding to each storage block file in the first hash ring.

[0065] S3. The sending end extracts each storage data resource in the source database, determines the data table structure information corresponding to each storage data resource, and performs consistent hash calculation based on the data table structure information and the set data information storage encryption key to determine the second position node corresponding to each storage data resource in the first hash ring. In specific implementation, each storage data resource can be extracted from the source database, each storage data resource is stored in the corresponding data table of the source database, each data table is provided with a table name, the data table contains a number of rows and field columns, and each storage data resource is stored in the data unit of the corresponding row and column. When extracting the storage data resources, the data table structure information corresponding to each storage data resource is synchronously determined, including the table name, field column name and row number of the corresponding data table. Then, the data table structure information can be combined with the set data information storage encryption key to obtain DATA_HASH KEY = table name + field column name + row number + key (that is, the set data information storage encryption key), and the DATA_HASH KEY corresponding to each storage data resource is subjected to consistent hash calculation, such as using the MurmurHash3 algorithm to perform consistent hash calculation, and the corresponding second position node corresponding to the storage data resource in the first hash ring is calibrated.

[0066] When the initial storage data resource extracted from the row and column data units corresponding to the source database data table meets the set data volume condition or data type condition, the initial storage data resource can be symmetrically encrypted using the set data information storage encryption key (such as using encryption algorithms such as SM4 and AES) to obtain the encrypted storage data resource. For example, the format of the encrypted storage data resource can be as shown in Table 1 below:

[0067] Table 1

[0068]

[0069] When the total number of data records in the source database is too small, such as when the total number of all initial storage data resources is less than the set threshold condition, the set data information storage encryption key can be used to perform symmetrical encryption on all initial storage data resources to obtain the encrypted storage data resources of each initial storage data resource.

[0070] S4. The sending end determines the storage block file mapped by each storage data resource according to the first position node corresponding to each storage block file in the first hash ring and the second position node corresponding to each storage data resource in the first hash ring, and writes each storage data resource into the storage block file to which it is mapped, and determines the storage position data of each storage data resource in the corresponding storage block file. In specific implementation, the first hash ring can be searched in a clockwise direction, and the corresponding second position node can be mapped to its previous first position node in the first hash ring, thereby realizing the mapping of the storage data resource corresponding to the second position node to the storage block file corresponding to the previous first position node. Then each storage data resource is written into the storage block file to which it is mapped, and the storage position data of each storage data resource in the corresponding storage block file is determined.

[0071] S5. The sending end constructs a data index information file, splits the data index information file into several index files, and names each index file respectively. In specific implementation, a data index information file can be constructed, split the data index information file into several index files, the number of split index files can be set according to actual needs, and then each index file is named respectively, and the naming format is such as "database name" + "index file number" + "time" + "number of index files", that is, the name of the index file includes the database name, the latest data time, the number of index files and the index file number.

[0072] S6. The sending end performs a consistent hash calculation based on the name of each index file, determines the third position node corresponding to each index file in the second hash ring, respectively combines the data table structure information corresponding to each storage data resource with the set data information storage encryption key, obtains the corresponding index information, performs a consistent hash calculation on each index information, and determines the fourth position node corresponding to each index information in the second hash ring. In specific implementation, the name of each index file is used to perform a consistent hash calculation, such as using the MurmurHash3 algorithm to perform a consistent hash calculation to mark the third position node corresponding to each index file in the second hash ring. The data table structure information corresponding to each storage data resource can be combined with the set data information storage encryption key to obtain the corresponding index information INDEX_HASH KEY = table name + field column name + row number + key (i.e., the set data information storage encryption key), and then performs a consistent hash calculation on each index information INDEX_HASH KEY to determine the fourth position node corresponding to each index information INDEX_HASH KEY in the second hash ring.

[0073] S7. The sending end determines the index file mapped by each index information according to the fourth position node corresponding to each index information in the second hash ring and the third position node corresponding to each index file in the second hash ring. In specific implementation, the corresponding fourth position node can be searched in a clockwise direction on the second hash ring to map the corresponding fourth position node to its previous third position node in the second hash ring, thereby mapping the index information corresponding to the fourth position node to the index file corresponding to the previous third position node.

[0074] S8. The sending end calculates the key value of each index information, and determines the storage location data of the storage data resource corresponding to each index information, associates the key value of each index information with the storage location data of the corresponding storage data resource, and writes it into the index file to which it is mapped. In specific implementation, a set hash algorithm (such as SM3, SHA256 and other hash algorithms with strong discrete relationships) can be used to perform hash calculations on each index information, and the calculated hash value is used as the key value of the corresponding index information. Then, the storage location data of the storage data resource corresponding to each index information is determined, and the key value of each index information is associated with the storage location data of the corresponding storage data resource and written into the index file to which it is mapped using a B+ tree structure.

[0075] S9. The sending end constructs a database table structure information file, and writes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database into the database table structure information file. In specific implementation, the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database are determined, and then the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database are written into the constructed database table structure information file.

[0076] S10. The sending end encrypts and names the written database table structure information file to obtain the corresponding database information relationship file, and transmits the database information relationship file, the written storage block files, and the written index files to the receiving end. In specific implementation, symmetric or asymmetric encryption means (SM2, SM4, AES and other encryption algorithms) can be used to encrypt the written database table structure information file and name it, such as naming it in the form of "table structure information identifier prefix + database name + time". If it is necessary to encrypt a continuously changing source database, then after the data of the source database changes, a new database table structure relationship information file can be added according to a certain time node, and the above processing can be performed with the latest data time, so that a certain degree of continuous real-time database update can be supported. Finally, the sending end transmits the database information relationship file, the written storage block files, and the written index files to the receiving end.

[0077] S11. The receiving end receives the database information relationship file, each storage block file and each index file transmitted by the sending end.

[0078] S12. The receiving end uses a preset key to decrypt the database information relationship file to obtain a database table structure information file, which includes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database. In specific implementation, after receiving the database information relationship file, each storage block file and each index file transmitted by the sending end, the receiving end can perform corresponding reverse processing. First, the database information relationship file can be decrypted using a preset key to obtain a database table structure information file. Then, the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file and the data table structure information of each data table in the source database can be extracted from the database table structure information file for subsequent processing. For example, each received storage block file can be verified based on the number of storage block files and the name of each storage block file, and each received index file can be verified based on the number of index files and the name of each index file.

[0079] S13. The receiving end traverses and constructs each index information based on the data table structure information of each data table and the set data storage encryption key. In specific implementation, the receiving end can use the data table structure information of each data table (including table name, field column name and row number, etc.) and the set data storage encryption key to traverse and construct each index information INDEX_HASHKEY = table name + field column name + row number + key (that is, the set data storage encryption key).

[0080] S14. The receiving end performs a consistent hash calculation based on each index information and the name of each storage block file, determines the storage block file mapped in the first hash ring by the storage data resource corresponding to each index information, and performs a consistent hash calculation based on each index information and the name of each index file, and determines the index file mapped in the second hash ring by each index information. In specific implementation, the receiving end may perform a consistent hash calculation based on each index information and the name of each storage block file, and determine the storage block file mapped in the first hash ring by the storage data resource corresponding to each index information through the same reverse processing as the sending end. At the same time, a consistent hash calculation is performed based on each index information and the name of each index file, and the index file mapped in the second hash ring by each index information is determined through the same reverse processing as the sending end.

[0081] S15. The receiving end calculates the key value of each index information, and finds the associated storage location data in the corresponding index file based on the key value of each index information, and finds the corresponding storage data resource in the corresponding storage block file according to the storage location data. In specific implementation, the receiving end also uses a set hash algorithm (such as SM3, SHA256 and other hash algorithms with strong discrete relationships) to perform hash calculations on each index information, and uses the calculated hash value as the key value of the corresponding index information. Then, the key value of each index information is used to find the associated storage location data in the corresponding index file using a B+ tree structure, and the corresponding storage data resource is found in the corresponding storage block file according to the storage location data. If the storage data resource found is encrypted, the encrypted storage data resource can be decrypted using the set data information storage encryption key key.

[0082] S16. The receiving end rebuilds a new database using each storage data resource and its data table structure information and the data table structure information of each data table. In specific implementation, the receiving end can use each storage data resource and its data table structure information and the data table structure information of each data table to call the corresponding API to rebuild a new database.

[0083] The method of this embodiment decomposes the data relationship of the database and adopts partial encryption and consistent hash calculation, so that the amount of calculation is small, and there is no need to encrypt all data with high intensity to obtain a good encryption effect; compared with the traditional encryption method, the encrypted database is split into block files, which is convenient for transmission transactions, and can be retrieved and reconstructed in the encrypted state, and is suitable for real-time transmission to a certain extent. It does not need to stop data conversion to achieve data reconstruction based on time points, thereby improving the transmission efficiency of large-scale databases; at the same time, this method can also quickly retrieve and reconstruct source data after encrypted transmission in accordance with the rules of this method, which can effectively support the mutual conversion and reconstruction between databases of multiple encryption types.

[0084] Embodiment 2:

[0085] This embodiment provides a database encryption access system, such as Figure 2 As shown, it includes a sending end and a receiving end for establishing data connection, and the sending end is used to:

[0086] Construct a data information storage file, split the data information storage file into several storage block files, and name each storage block file respectively;

[0087] Perform consistent hash calculation based on the name of each storage block file to determine the first position node corresponding to each storage block file in the first hash ring;

[0088] Extract each storage data resource in the source database, determine the data table structure information corresponding to each storage data resource, and perform consistent hash calculation based on the data table structure information and the set data information storage encryption key to determine the second position node corresponding to each storage data resource in the first hash ring;

[0089] Determine the storage block file mapped by each storage data resource according to the first position node corresponding to each storage block file in the first hash ring and the second position node corresponding to each storage data resource in the first hash ring, write each storage data resource into the storage block file mapped thereto, and determine the storage position data of each storage data resource in the corresponding storage block file;

[0090] Construct a data index information file, split the data index information file into several index files, and name each index file respectively;

[0091] Perform consistent hash calculation based on the name of each index file, determine the third position node corresponding to each index file in the second hash ring, respectively combine the data table structure information corresponding to each storage data resource with the set data information storage encryption key to obtain the corresponding index information, perform consistent hash calculation on each index information, and determine the fourth position node corresponding to each index information in the second hash ring;

[0092] Determine the index file mapped by each index information according to the fourth position node corresponding to each index information in the second hash ring and the third position node corresponding to each index file in the second hash ring;

[0093] Calculate the key value of each index information, determine the storage location data of the storage data resource corresponding to each index information, associate the key value of each index information with the storage location data of the storage data resource corresponding to it, and write it into the index file to which it is mapped;

[0094] Construct a database table structure information file, and write the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database into the database table structure information file;

[0095] Encrypt and name the written database table structure information file to obtain the corresponding database information relationship file;

[0096] The database information relationship file, each storage block file that has been written, and each index file that has been written are transmitted to the receiving end.

[0097] The receiving end is used for:

[0098] Receiving the database information relationship file, each storage block file and each index file transmitted by the sending end;

[0099] Decrypting the database information relationship file using a preset key to obtain a database table structure information file, wherein the database table structure information file includes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database;

[0100] Based on the data table structure information of each data table and the set data information storage encryption key, each index information is traversed and constructed;

[0101] Perform consistent hash calculation based on each index information and the name of each storage block file to determine the storage block file mapped in the first hash ring to the storage data resource corresponding to each index information, and perform consistent hash calculation based on each index information and the name of each index file to determine the index file mapped in the second hash ring to each index information;

[0102] Calculate the key value of each index information, find the associated storage location data in the corresponding index file based on the key value of each index information, and find the corresponding storage data resource in the corresponding storage block file according to the storage location data;

[0103] A new database is rebuilt using each storage data resource and its data table structure information as well as the data table structure information of each data table.

[0104] Embodiment 3:

[0105] This embodiment provides a database encryption access system, which includes:

[0106] Data interface, used to establish data connection between the processor and the external data terminal;

[0107] A memory for storing instructions;

[0108] The processor is used to read the instructions stored in the memory and execute the execution steps of the sending end or the receiving end in Example 1 according to the instructions.

[0109] Optionally, the system further includes an internal bus, through which the processor, the memory and the data interface can be interconnected, and the internal bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0110] The memory may include, but is not limited to, random access memory (RAM), read only memory (ROM), flash memory, first input first output (FIFO) and / or first in last out (FILO), etc. The processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0111] Embodiment 4:

[0112] This embodiment provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the execution steps of the sending end or the receiving end in Embodiment 1. The computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive and / or a memory stick, etc. The computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices.

[0113] This embodiment also provides a computer program product, which, when running on a computer, executes the execution steps of the sending end or the receiving end in Embodiment 1. The computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable device.

[0114] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A database encryption access method, applied to a sending end, characterized in that: include: Construct a data information storage file, split the data information storage file into several storage block files, and name each storage block file respectively; Perform consistent hash calculation based on the name of each storage block file to determine the first position node corresponding to each storage block file in the first hash ring; Extract each storage data resource in the source database, determine the data table structure information corresponding to each storage data resource, and perform consistent hash calculation based on the data table structure information and the set data information storage encryption key to determine the second position node corresponding to each storage data resource in the first hash ring; Determine the storage block file mapped by each storage data resource according to the first position node corresponding to each storage block file in the first hash ring and the second position node corresponding to each storage data resource in the first hash ring, write each storage data resource into the storage block file mapped thereto, and determine the storage position data of each storage data resource in the corresponding storage block file; Construct a data index information file, split the data index information file into several index files, and name each index file respectively; Perform consistent hash calculation based on the name of each index file, determine the third position node corresponding to each index file in the second hash ring, respectively combine the data table structure information corresponding to each storage data resource with the set data information storage encryption key to obtain the corresponding index information, perform consistent hash calculation on each index information, and determine the fourth position node corresponding to each index information in the second hash ring; Determine the index file mapped by each index information according to the fourth position node corresponding to each index information in the second hash ring and the third position node corresponding to each index file in the second hash ring; Calculate the key value of each index information, determine the storage location data of the storage data resource corresponding to each index information, associate the key value of each index information with the storage location data of the storage data resource corresponding to it, and write it into the index file to which it is mapped; Construct a database table structure information file, and write the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database into the database table structure information file; Encrypt and name the written database table structure information file to obtain the corresponding database information relationship file; The database information relationship file, each storage block file that has been written, and each index file that has been written are transmitted to the receiving end, so that the receiving end performs reverse processing on the database information relationship file, and forms each index information based on the data table structure information of each data table obtained by the reverse processing and the set data information storage encryption key, performs consistent hash calculation based on each index information and the name of each storage block file, determines the storage block file corresponding to each index information, performs consistent hash calculation based on each index information and the name of each index file, determines the index file corresponding to each index information, calculates the key value of each index information, finds the associated storage location data in the corresponding index file based on the key value of each index information, finds the corresponding storage data resource in the corresponding storage block file according to the storage location data, and rebuilds a new database using each storage data resource and its data table structure information and the data table structure information of each data table.

2. A method for encrypted access to a database according to claim 1, characterized in that: The extracting of each storage data resource in the source database includes: extracting the initial storage data resource from the corresponding row and column data units of the corresponding data table of the source database; when the initial storage data resource meets the set data volume condition or data type condition, using the set data information storage encryption key to symmetrically encrypt the initial storage data resource to obtain the encrypted storage data resource.

3. A method for encrypted access to a database according to claim 2, characterized in that: When the total number of all initial storage data resources is less than a set threshold condition, the method further includes: using a set data information storage encryption key to symmetric encrypt all initial storage data resources to obtain encrypted storage data resources of each initial storage data resource.

4. A method for encrypted access to a database according to claim 1, characterized in that: The data table structure information includes table name, field column name and row number.

5. A method for encrypted access to a database according to claim 1, characterized in that: The name of the storage block file includes the database name, the latest data time, the number of storage block files and the storage block file number, and the name of the index file includes the database name, the latest data time, the number of index files and the index file number.

6. A method for encrypted access to a database according to claim 1, characterized in that: The performing hash calculation on each index information includes: performing hash calculation on each index information using a set hash algorithm, and using the calculated hash value as a key value of the corresponding index information.

7. A database encryption access method, applied to a receiving end, characterized in that: include: Receiving the database information relationship file, each storage block file and each index file transmitted by the sending end; Decrypting the database information relationship file using a preset key to obtain a database table structure information file, wherein the database table structure information file includes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database; Based on the data table structure information of each data table and the set data information storage encryption key, each index information is traversed and constructed; Perform consistent hash calculation based on each index information and the name of each storage block file to determine the storage block file mapped in the first hash ring to the storage data resource corresponding to each index information, and perform consistent hash calculation based on each index information and the name of each index file to determine the index file mapped in the second hash ring to each index information; Calculate the key value of each index information, find the associated storage location data in the corresponding index file based on the key value of each index information, and find the corresponding storage data resource in the corresponding storage block file according to the storage location data; A new database is rebuilt using each storage data resource and its data table structure information as well as the data table structure information of each data table.

8. A database encryption access system, characterized in that: It includes a sending end and a receiving end for establishing data connection, wherein the sending end is used to: Construct a data information storage file, split the data information storage file into several storage block files, and name each storage block file respectively; Perform consistent hash calculation based on the name of each storage block file to determine the first position node corresponding to each storage block file in the first hash ring; Extract each storage data resource in the source database, determine the data table structure information corresponding to each storage data resource, and perform consistent hash calculation based on the data table structure information and the set data information storage encryption key to determine the second position node corresponding to each storage data resource in the first hash ring; Determine the storage block file mapped by each storage data resource according to the first position node corresponding to each storage block file in the first hash ring and the second position node corresponding to each storage data resource in the first hash ring, write each storage data resource into the storage block file mapped thereto, and determine the storage position data of each storage data resource in the corresponding storage block file; Construct a data index information file, split the data index information file into several index files, and name each index file respectively; Perform consistent hash calculation based on the name of each index file, determine the third position node corresponding to each index file in the second hash ring, respectively combine the data table structure information corresponding to each storage data resource with the set data information storage encryption key to obtain the corresponding index information, perform consistent hash calculation on each index information, and determine the fourth position node corresponding to each index information in the second hash ring; Determine the index file mapped by each index information according to the fourth position node corresponding to each index information in the second hash ring and the third position node corresponding to each index file in the second hash ring; Calculate the key value of each index information, determine the storage location data of the storage data resource corresponding to each index information, associate the key value of each index information with the storage location data of the storage data resource corresponding to it, and write it into the index file to which it is mapped; Construct a database table structure information file, and write the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database into the database table structure information file; Encrypt and name the written database table structure information file to obtain the corresponding database information relationship file; The database information relationship file, each storage block file that has been written, and each index file that has been written are transmitted to the receiving end.

9. A database encryption access system according to claim 8, characterized in that: The receiving end is used for: Receiving the database information relationship file, each storage block file and each index file transmitted by the sending end; Decrypting the database information relationship file using a preset key to obtain a database table structure information file, wherein the database table structure information file includes the database name of the source database, the latest data time of the source database, the number of storage block files, the name of each storage block file, the set data information storage encryption key, the number of index files, the name of each index file, and the data table structure information of each data table in the source database; Based on the data table structure information of each data table and the set data information storage encryption key, each index information is traversed and constructed; Perform consistent hash calculation based on each index information and the name of each storage block file to determine the storage block file mapped in the first hash ring to the storage data resource corresponding to each index information, and perform consistent hash calculation based on each index information and the name of each index file to determine the index file mapped in the second hash ring to each index information; Calculate the key value of each index information, find the associated storage location data in the corresponding index file based on the key value of each index information, and find the corresponding storage data resource in the corresponding storage block file according to the storage location data; A new database is rebuilt using each storage data resource and its data table structure information as well as the data table structure information of each data table.

10. A computer program product, characterized in that When the computer program product is run on a computer, the database encryption access method according to any one of claims 1 to 7 is executed.

Images