Data encryption method and device, server and storage medium

Abstract

The invention relates to the technical field of data processing, and provides a data encryption method, which comprises the following steps of: creating a backup node in a database as a slave node, adding the backup node into a replication set taking an online service node as a main node, synchronizing data from the main node to the slave node, and disconnecting the slave node from the replication set as an offline node; performing batch encryption on offline node data, and when the data of the main node is changed, encrypting the changed data of the main node and then synchronizing the encrypted changed data to the offline node; verifying the encrypted offline node data and offline node performance, performing bidirectional synchronization on the main node data and the offline node data, and transferring the service application of the main node to the offline node to perform service application verification; and after the verification of the service application is passed, configuring the offline node as a new main node. According to the data encryption method disclosed by the invention, the database data of the online system is encrypted and the data synchronization is ensured when the service of the online system is normally used.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data encryption method, device, server and storage medium. Background Art

[0002] With the development of mobile Internet, data security has attracted more and more attention. Among them, database encryption is currently a commonly used method to protect data security. However, if the online system has been put into use and the corresponding database is not encrypted, encrypting the entire database will have a greater impact on the online system.

[0003] In the prior art, the following methods are usually used for encryption:

[0004] 1. Online direct encryption can ensure that the services of the online system are in normal use, but it will cause the database data to contain both encrypted data and non-encrypted data. When the online system performs query operations or update and delete operations, it cannot determine whether the data to be operated is encrypted or non-encrypted, resulting in data errors and data asynchrony.

[0005] 2. Direct offline encryption can ensure that all data is encrypted and synchronized, but it cannot keep the online system services in normal use. The online system services need to be taken offline before the data can be encrypted. The larger the amount of data, the longer the online system service will be stopped.

[0006] 3. Offline backup encryption can keep the online system services in normal use, but it can only encrypt the backed-up data. The data that has been changed while the online system is running after the backup is completed cannot be encrypted, that is, the encryption of the backup data may cause data to be out of sync.

[0007] Therefore, there is an urgent need for a data encryption method that encrypts the database data of all online systems and ensures data synchronization while ensuring the normal use of online system services. Summary of the invention

[0008] The present invention provides a data encryption method, device, server and storage medium, the main purpose of which is to provide a data encryption method that ensures the normal use of online system services while encrypting database data of all online systems and ensuring data synchronization.

[0009] To achieve the above object, the present invention provides a data encryption method, the method comprising:

[0010] Establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node;

[0011] After data synchronization is completed, the slave node is disconnected from the replica set as an offline node, and the position of the last data in the log file of the master node is recorded in the log file of the master node;

[0012] Batch encrypt offline node data and monitor the master node in real time. When data changes on the master node, read the changed data from the master node according to the position of the last data in the log file of the master node, encrypt the data, and then synchronize it to the offline node.

[0013] Verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, perform two-way synchronization on the data of the master node and the offline node, and transfer the service application provided by the master node for online services to the offline node for verification;

[0014] When the service application passes the verification of the offline node, the offline node is configured as a new master node.

[0015] Optionally, the batch encrypting offline node data includes:

[0016] Detect offline node data and identify the data to be encrypted in the offline node data;

[0017] Batch encrypting the data to be encrypted and generating a key;

[0018] The key is stored in a service node located in the same network area as the database, and access rights to the database are set for the key at the service node.

[0019] Optionally, the real-time monitoring of the master node includes:

[0020] Tracking method classes involved in adding, deleting, modifying, and checking in the master node;

[0021] Detect whether the data at the tracking point has changed to monitor whether the data at the master node has changed.

[0022] Optionally, the reading the changed data from the master node and synchronizing the changed data to the offline node after encrypting the data includes:

[0023] Identify the type of operation for changing the data, where the type of operation includes adding data, updating data, and deleting data;

[0024] If the operation type of the data change is to add new data, the new data is encrypted using the same encryption algorithm as the offline node data and then synchronized to the offline node;

[0025] If the operation type of the changed data is to update data, determine whether the original data corresponding to the updated data in the offline node is encrypted. If so, encrypt the updated data using the same encryption algorithm as the original data and then synchronize it to the offline node to replace the original data. If not, directly synchronize the updated data to the offline node to replace the original data.

[0026] If the operation type of changing the data is deleting data, the corresponding original data is deleted in the offline node.

[0027] Optionally, verifying the encrypted offline node data includes:

[0028] Batch obtain encrypted offline node data and corresponding master node data;

[0029] Compare the unencrypted part of offline node data with the corresponding part of master node data in batches to determine whether there is any data inconsistency;

[0030] If so, the data in the offline node that is inconsistent with the master node is modified to be the master node data.

[0031] Optionally, verifying the offline node performance includes:

[0032] Obtaining configuration information of the server where the database is located, the configuration information including CPU information, memory information and hard disk space information;

[0033] Detecting a first resource usage rate before data encryption, a second resource usage rate during data encryption and decryption, and a third resource usage rate after data encryption in offline nodes based on the configuration information;

[0034] Calculate, according to the first resource usage rate, the second resource usage rate, and the third resource usage rate, the CPU usage rate, the memory usage rate, and the hard disk space usage rate when the offline node performs encryption and decryption operations on the offline node data;

[0035] The offline node performance is verified based on the CPU usage, memory occupancy and hard disk space occupancy. If the verification fails, an offline node performance verification report is generated and sent to the management terminal corresponding to the database.

[0036] Optionally, transferring the service application of the master node to the offline node for service application verification includes:

[0037] Acquire service application information of the master node, and select a service application according to the service application information;

[0038] The selected service application is transferred to the offline node for operation test. If the test passes, all service applications of the main node are transferred to the offline node. If the test fails, an offline node service application test report is generated and sent to the management terminal corresponding to the database.

[0039] In order to solve the above problem, the present invention further provides a data encryption device, the data encryption device comprising:

[0040] A backup module is used to establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node;

[0041] A recording module, used for disconnecting the slave node from the replication set as an offline node after data synchronization is completed, and recording the position of the last data in the log file of the master node in the log file of the master node;

[0042] An encryption module is used to encrypt offline node data in batches and monitor the master node in real time. When data on the master node is changed, the changed data is read from the master node according to the position of the last data in the log file of the master node, encrypted and synchronized to the offline node.

[0043] A verification module is used to verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, the data of the master node and the offline node are synchronized bidirectionally, and the service application provided by the master node for online service is transferred to the offline node for verification;

[0044] A configuration module is used to configure the offline node as a new master node after the service application passes the verification of the offline node.

[0045] In order to solve the above problem, the present invention further provides a server, the server comprising:

[0046] at least one processor; and,

[0047] a memory communicatively connected to the at least one processor; wherein,

[0048] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the data encryption method as described above.

[0049] In order to solve the above problem, the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the data encryption method described above is implemented.

[0050] The present invention encrypts the data after backing up the database master node data at the offline node, and detects the changed data of the master node through the data synchronization program to synchronously modify and encrypt the offline node data, thereby encrypting the backup data and maintaining data synchronization while ensuring the normal use of online services; after the encryption is completed, the offline node data verification is verified to ensure data security, and the offline node after data encryption is verified for service application online, and then configured as a new master node and then the original master node is offline, thereby realizing seamless switching of online service use. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A flow chart of an embodiment of a data encryption method of the present invention;

[0052] Figure 2 A schematic diagram of an embodiment of a server of the present invention;

[0053] Figure 3 It is a structural schematic diagram of an embodiment of a data encryption device of the present invention.

[0054] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the present invention clearer, the principle and spirit of the present invention will be described with reference to several specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0056] It should be understood that the "multiple" mentioned in this application refers to two or more. In the description of this application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate the clear description of the technical solution of this application, the words "first" and "second" are used to distinguish between the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not limit them to be different.

[0057] The phrases "one embodiment" or "some embodiments" described in the present application mean that the specific features, structures or characteristics described in the embodiment are included in one or more embodiments of the present application. Therefore, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments" and the like that appear in different places in the present application do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized. In addition, the terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0058] like Figure 1 FIG. 4 is a flow chart of an embodiment of a data encryption method of the present invention. The data encryption method is applied to a server and includes steps S1-S5.

[0059] S1. Establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node;

[0060] In one embodiment, the database can be a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of hosts or network servers. Correspondingly, the node of the database can be an internal storage unit of the network server, or a network server in the server group.

[0061] In one embodiment, the database is a MongoDB database, and the log file of the master node is an oplog operation log. The oplog operation log is a special upper-limited collection used to save a rolling record of all operations that modify data stored in the database. The MongoDB database applies database operations on the master node, records these operations in the oplog, and then replicates and applies these operations from the node through an asynchronous process.

[0062] S2. After data synchronization is completed, the slave node is disconnected from the replication set as an offline node, and the position of the last data in the log file of the master node is recorded in the log file of the master node.

[0063] In one embodiment, when the data synchronization process is interrupted, the database operation record of the master node after the data synchronization interruption is read according to the position of the last data before the synchronization interruption in the log file of the master node, and the data synchronization operation is continued according to the database operation record.

[0064] S3. Batch encrypt offline node data and monitor the master node in real time. When data changes occur at the master node, read the changed data from the master node according to the position of the last data in the log file of the master node, encrypt the data, and then synchronize it to the offline node.

[0065] In one embodiment, batch encrypting offline node data includes:

[0066] Detect offline node data and identify the data to be encrypted in the offline node data;

[0067] Batch encrypting the data to be encrypted and generating a key;

[0068] The key is stored in a service node located in the same network area as the database, and access rights to the database are set for the key at the service node.

[0069] In one embodiment, the symmetric encryption algorithm is an AES encryption algorithm, and when the online service is started, the database automatically obtains the key for the online service to perform data encryption and decryption.

[0070] In one embodiment, the service node is other storage space located in the same network area as the database. Specifically, the service node can be a server, a memory, or other storage space located in the same server or server cluster as the database.

[0071] In one embodiment, real-time monitoring of the master node includes:

[0072] Tracking method classes involved in adding, deleting, modifying, and checking in the master node;

[0073] Detect whether the data at the tracking point has changed to monitor whether the data at the master node has changed.

[0074] In one embodiment, the data synchronization program is an SDK generated by encapsulating the java aspect-oriented programming (AOP) and data encryption and decryption program for the database. Among them, the AOP (Aspect Oriented Programming) interception function is an aspect-oriented programming technology, which allows developers to define aspects (Aspect) to cross-cut concerns, such as logging, transaction management, security control, etc., without modifying the existing code, and apply these functions to multiple parts of the program. Using AOP, various parts of the business logic can be isolated, thereby reducing the coupling between the various parts of the business logic, improving the reusability of the program, and improving the efficiency of development.

[0075] In this embodiment, the data interception entry points defined by aspect-oriented programming include:

[0076] 1. Query result encapsulation class:

[0077] execution(com.mongodb.connection.QueryResult.new(MongoNamespace,List,long,ServerAddress))&&args(namespace,results,cursorId,serverAddress)

[0078] 2. Query condition method:

[0079] within(com.mongodb.operation.*Operation)&&execution(*

[0080] filter(BsonDocument))&&args(filter)

[0081] 3. Method of inserting data:

[0082] execution(com.mongodb.operation.InsertOperation.new(MongoNamespace,boo lean,WriteConcern,List <insertrequest>))&&args(namespace,ordered,writeConcern,insertRequests)

[0083] 4. Update data method:

[0084] execution(com.mongodb.operation.UpdateOperation.new(MongoNamespace,boolean,WriteConcern,List <updaterequest>))&&args(namespace,ordered,writeConcern,updates)

[0085] 5. Method for deleting data:

[0086] execution(com.mongodb.operation.DeleteOperation.new(MongoNamespace,boolean,WriteConcern,List <deleterequest>))&&args(namespace,ordered,writeConcern,deleteRequests)

[0087] 6. Batch operation method:

[0088] execution(com.mongodb.operation.MixedBulkWriteOperation.new(MongoNamespace,List<?extends WriteRequest>,boolean,

[0089] WriteConcern))&&args(namespace,writeRequests,ordered,writeConcern)

[0090] 7. Batch operation method:

[0091] this(writeOperation)&&execution(com.mongodb.operation.FindAnd*Operation.new(MongoNamespace,WriteConcern,Decoder,

[0092] BsonDocument))&&args(namespace,writeConcern,decoder,doc)

[0093] 8. Deduplication operation method:

[0094] this(distinctOperation)&&args(namespace,results,cursorId,serverAddress)&&call(com.mongodb.connection.QueryResult.new(MongoNamespace,List,long,ServerAddress))

[0095] Aspect-oriented programming intercepts the addition, deletion, modification and query of MongoDB database data through the above data interception entry point, and adds encryption and decryption code of the symmetric encryption algorithm to the entry point, so as to automatically detect, intercept, encrypt and decrypt the changed data of MongoDB database.

[0096] In one embodiment, reading the changed data from the master node and synchronizing the changed data to the offline node after encrypting the data includes:

[0097] Identify the type of operation for changing the data, where the type of operation includes adding data, updating data, and deleting data;

[0098] If the operation type of the data change is to add new data, the new data is encrypted using the same encryption algorithm as the offline node data and then synchronized to the offline node;

[0099] If the operation type of the changed data is to update data, determine whether the original data corresponding to the updated data in the offline node is encrypted. If so, encrypt the updated data using the same encryption algorithm as the original data and then synchronize it to the offline node to replace the original data. If not, directly synchronize the updated data to the offline node to replace the original data.

[0100] If the operation type of changing the data is deleting data, the corresponding original data is deleted in the offline node.

[0101] For example, when the data synchronization program detects that the data on the master node has changed: data A is added, data B is modified to data C, and data D is deleted; then data A is the newly added data, data C is the updated data, and data D is the deleted data. The data synchronization program encrypts data A and synchronizes it to the offline node; detects whether the original data B' corresponding to data B in the offline node is encrypted. If so, encrypt data C and synchronize it to the offline node to replace data B'. If not, synchronize data C directly to the offline node to replace data B'; delete the original data D' corresponding to data D in the offline node.

[0102] In this proposal, data encryption is performed by replicating the master node data through offline nodes, and the changed data of the master node is synchronized during the encryption process for encryption synchronization, thereby achieving data encryption without modifying the original data and maintaining data synchronization between the encrypted data and the original data.

[0103] S4. Verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, perform two-way synchronization on the data of the master node and the offline node, and transfer the service application of the online service provided by the master node to the offline node for verification.

[0104] In one embodiment, verifying the encrypted offline node data includes:

[0105] Batch obtain encrypted offline node data and corresponding master node data;

[0106] Compare the unencrypted part of offline node data with the corresponding part of master node data in batches to determine whether there is any data inconsistency;

[0107] If so, the data in the offline node that is inconsistent with the master node is modified to be the master node data.

[0108] In one embodiment, verifying the performance of offline nodes includes:

[0109] Obtaining configuration information of the server where the database is located, the configuration information including CPU information, memory information and hard disk space information;

[0110] Detecting a first resource usage rate before data encryption, a second resource usage rate during data encryption and decryption, and a third resource usage rate after data encryption in offline nodes based on the configuration information;

[0111] Calculate, according to the first resource usage rate, the second resource usage rate, and the third resource usage rate, the CPU usage rate, the memory usage rate, and the hard disk space usage rate when the offline node performs encryption and decryption operations on the offline node data;

[0112] The offline node performance is verified based on the CPU usage, memory occupancy and hard disk space occupancy. If the verification fails, an offline node performance verification report is generated and sent to the management terminal corresponding to the database.

[0113] In one embodiment, bidirectional synchronization of master node data and offline node data includes:

[0114] According to the data synchronization operation records in the log file of the master node, the data of the master node and the offline node data are synchronized bidirectionally through the data synchronization program.

[0115] In one embodiment, transferring the service application of the master node to the offline node for service application verification includes:

[0116] Acquire service application information of the master node, and select a service application according to the service application information;

[0117] The selected service application is transferred to the offline node for operation test. If the test passes, all service applications of the main node are transferred to the offline node. If the test fails, an offline node service application test report is generated and sent to the management terminal corresponding to the database.

[0118] S5. After the service application passes the verification of the offline node, the offline node is configured as a new master node.

[0119] In one embodiment, configuring an offline node as a new master node includes:

[0120] Create a replica set with the offline node as the primary node and configure a backup node in the replica set to back up the encrypted data of the offline node;

[0121] Modify the online access path of the database service application to an offline node;

[0122] Service application access information is generated according to the offline node information, and a service application access modification notification is generated based on the service application access information and sent to a terminal accessing a database service.

[0123] It can be seen from the above embodiments that the embodiments of the present invention encrypt the data after backing up the database master node data at the offline node, and detect the changed data of the master node during the encryption process through the data synchronization program to synchronously modify and encrypt the offline node data, thereby ensuring the normal use of online services while encrypting the backup data and maintaining data synchronization; after the encryption is completed, the offline node data verification is verified to ensure data security, and the offline node after data encryption is verified for service application online, and then configured as a new master node and then the original master node is offline, thereby realizing seamless switching of online service use.

[0124] like Figure 2 FIG. 1 is a schematic diagram of an embodiment of a server of the present invention. Server 1 is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. The server 1 can be a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of hosts or network servers, wherein cloud computing is a type of distributed computing, a super virtual computer composed of a group of loosely coupled computer sets.

[0125] In this embodiment, the server 1 includes, but is not limited to, a memory 11, a processor 12, and a network interface 13 that can be interconnected and communicated via a system bus. The memory 11 stores a data encryption program 10 that can be executed by the processor 12. Figure 2 Only the server 1 having components 11-13 and the data encryption program 10 is shown. It can be understood by those skilled in the art that Figure 2 The structure shown does not constitute a limitation on the server 1, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0126] The memory 11 includes a memory and at least one type of readable storage medium. The memory provides a cache for the operation of the server 1; the readable storage medium may be volatile or non-volatile. Specifically, the readable storage medium may be a storage medium such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the readable storage medium may be an internal storage unit of the server 1, such as a hard disk of the server 1; in other embodiments, the storage medium may also be an external storage device of the server 1, such as a plug-in hard disk equipped on the server 1, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. In this embodiment, the readable storage medium of the memory 11 mainly includes a program storage area and a data storage area, wherein the program storage area is generally used to store an operating system and various application software installed on the server 1, such as storing the code of the data encryption program 10 in one embodiment of the present invention; the data storage area can store data created according to the use of the blockchain node, such as various types of data that have been output or are to be output.

[0127] In some embodiments, the processor 12 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 12 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect the various components of the entire electronic device, and executes or executes programs or modules stored in the memory 11 (for example, executing resource dynamic scheduling programs, etc.), and calls data stored in the memory 11 to execute various functions of the electronic device and process data. The processor 12 is generally used to control the overall operation of the server 1, such as executing control and processing related to data interaction or communication with other devices. In this embodiment, the processor 12 is used to run the program code stored in the memory 11 or process data, such as running the data encryption program 10, etc.

[0128] The network interface 13 may include a wireless network interface or a wired network interface.

[0129] Optionally, the server 1 may further include a user interface, which may include a display, an input unit such as a keyboard, and an optional user interface may further include a standard wired interface and a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an organic light-emitting diode (OLED) touch device. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the server 1 and to display a visual user interface.

[0130] In one embodiment of the present invention, when the data encryption program 10 is executed by the processor 12, the following data encryption method is implemented, including steps S1-S5:

[0131] S1. Establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node;

[0132] S2. After data synchronization is completed, disconnect the slave node from the replica set as an offline node, and record the position of the last data in the log file of the master node in the log file of the master node;

[0133] S3, encrypt offline node data in batches, and monitor the master node in real time. When data changes on the master node, read the changed data from the master node according to the position of the last data in the log file of the master node, encrypt the data, and then synchronize it to the offline node;

[0134] S4. Verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, perform two-way synchronization on the data of the master node and the offline node, and transfer the service application provided by the master node for online service to the offline node for verification.

[0135] S5. After the service application passes the verification of the offline node, the offline node is configured as a new master node.

[0136] The specific operation steps implemented by the above steps S1-S5 are substantially the same as steps S1-S5 of the first embodiment of the data encryption method of the present invention, and will not be repeated here.

[0137] In other embodiments, the data encryption program 10 can also be divided into one or more modules, one or more modules are stored in the memory 11, and are executed by one or more processors (processor 12 in this embodiment) to complete the present invention. The module referred to in the present invention refers to a series of computer program instruction segments that can perform specific functions, and is used to describe the execution process of the data encryption program 10 in the server 1.

[0138] like Figure 3 FIG. 1 is a schematic diagram of the structure of a data encryption device provided by an embodiment of the present invention.

[0139] In the first embodiment of the present invention, the data encryption device 100 includes a backup module 110, a recording module 120, an encryption module 130, a verification module 140 and a configuration module 150. Exemplarily:

[0140] The backup module 110 is used to establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node;

[0141] The recording module 120 is used to disconnect the slave node from the replication set as an offline node after data synchronization is completed, and record the position of the last data in the log file of the master node in the log file of the master node;

[0142] The encryption module 130 is used to encrypt offline node data in batches and monitor the master node in real time. When data changes occur at the master node, the changed data is read from the master node according to the position of the last data in the log file of the master node, and encrypted and synchronized to the offline node.

[0143] The verification module 140 is used to verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, the data of the master node and the offline node are synchronized bidirectionally, and the service application provided by the master node for online service is transferred to the offline node for verification;

[0144] The configuration module 150 is used to verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, bidirectional synchronization is performed on the data of the master node and the offline node, and the service application provided by the master node for online services is transferred to the offline node for verification.

[0145] The specific operation steps implemented when the backup module 110, the recording module 120, the encryption module 130, the verification module 140 and the configuration module 150 are executed are substantially the same as those in the above embodiment and will not be repeated here.

[0146] In addition, the embodiment of the present invention further proposes a computer-readable storage medium, which can be volatile or non-volatile. Specifically, the computer-readable storage medium can be any one or any combination of a hard disk, a multimedia card, an SD card, a flash memory card, an SMC, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disk read-only memory (CD-ROM), a USB memory, etc. The computer-readable storage medium stores a data encryption program.

[0147] When the data encryption program is executed by the processor, the following operations are implemented:

[0148] A1. Establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node;

[0149] A2. After data synchronization is completed, disconnect the slave node from the replica set as an offline node, and record the position of the last data in the log file of the master node in the log file of the master node;

[0150] A3. Encrypt offline node data in batches and monitor the master node in real time. When data on the master node changes, read the changed data from the master node according to the position of the last data in the log file of the master node, encrypt the data, and then synchronize it to the offline node.

[0151] A4. Verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, perform two-way synchronization on the data of the master node and the offline node, and transfer the service application of the online service provided by the master node to the offline node for verification;

[0152] A5. After the service application passes the verification of the offline node, the offline node is configured as a new master node.

[0153] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0154] It should be noted that, in this article, the term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the existence of other identical elements in the process, device, article or method including the element.

[0155] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0156] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.< / deleterequest> < / updaterequest> < / insertrequest>

Claims

1. A data encryption method, characterized in that: The method comprises: Establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node; After data synchronization is completed, the slave node is disconnected from the replica set as an offline node, and the position of the last data in the log file of the master node is recorded in the log file of the master node; Batch encrypt offline node data and monitor the master node in real time. When data changes on the master node, read the changed data from the master node according to the position of the last data in the log file of the master node, encrypt the data, and then synchronize it to the offline node. Verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, perform two-way synchronization on the data of the master node and the offline node, and transfer the service application provided by the master node for online services to the offline node for verification; When the service application passes the verification of the offline node, the offline node is configured as a new master node.

2. The data encryption method according to claim 1, characterized in that: The batch encryption of offline node data includes: Detect offline node data and identify the data to be encrypted in the offline node data; Batch encrypting the data to be encrypted and generating a key; The key is stored in a service node located in the same network area as the database, and access rights to the database are set for the key at the service node.

3. The data encryption method according to claim 1, characterized in that: The real-time monitoring of the master node comprises: Tracking method classes involved in adding, deleting, modifying and checking in the master node; Detect whether the data at the tracking point has changed to monitor whether the data at the master node has changed.

4. The data encryption method according to claim 1, characterized in that: The step of reading the changed data from the master node and synchronizing the changed data to the offline node after encrypting the data comprises: Identify the type of operation for changing the data, where the type of operation includes adding data, updating data, and deleting data; If the operation type of the data change is to add new data, the new data is encrypted using the same encryption algorithm as the offline node data and then synchronized to the offline node; If the operation type of the changed data is to update data, determine whether the original data corresponding to the updated data in the offline node is encrypted. If so, encrypt the updated data using the same encryption algorithm as the original data and then synchronize it to the offline node to replace the original data. If not, directly synchronize the updated data to the offline node to replace the original data. If the operation type of changing the data is deleting data, the corresponding original data is deleted in the offline node.

5. The data encryption method according to claim 1, characterized in that: The verification of the encrypted offline node data includes: Batch obtain encrypted offline node data and corresponding master node data; Compare the unencrypted part of offline node data with the corresponding part of master node data in batches to determine whether there is any data inconsistency; If so, the data in the offline node that is inconsistent with the master node is modified to be the master node data.

6. The data encryption method according to claim 1, characterized in that: The verification of offline node performance includes: Obtaining configuration information of the server where the database is located, the configuration information including CPU information, memory information and hard disk space information; Detecting a first resource usage rate before data encryption, a second resource usage rate during data encryption and decryption, and a third resource usage rate after data encryption in offline nodes based on the configuration information; Calculate, according to the first resource usage rate, the second resource usage rate, and the third resource usage rate, the CPU usage rate, the memory usage rate, and the hard disk space usage rate when the offline node performs encryption and decryption operations on the offline node data; The offline node performance is verified based on the CPU usage, memory occupancy and hard disk space occupancy. If the verification fails, an offline node performance verification report is generated and sent to the management terminal corresponding to the database.

7. The data encryption method according to claim 1, characterized in that: The transferring of the service application of the master node to the offline node for service application verification includes: Acquire service application information of the master node, and select a service application according to the service application information; The selected service application is transferred to the offline node for operation test. If the test passes, all service applications of the main node are transferred to the offline node. If the test fails, an offline node service application test report is generated and sent to the management terminal corresponding to the database.

8. A data encryption device, characterized in that: The data encryption device comprises: A backup module is used to establish a backup node in the database providing online services, add the backup node as a slave node to a replica set with the online service node as the master node, synchronize data from the master node to the slave node through the replica set, and record the data synchronization operation in the log file of the master node; A recording module, used for disconnecting the slave node from the replication set as an offline node after data synchronization is completed, and recording the position of the last data in the log file of the master node in the log file of the master node; An encryption module is used to encrypt offline node data in batches and monitor the master node in real time. When data on the master node is changed, the changed data is read from the master node according to the position of the last data in the log file of the master node, encrypted and synchronized to the offline node. A verification module is used to verify the encrypted offline node data and the offline node performance. After the offline node performance verification is passed, the data of the master node and the offline node are synchronized bidirectionally, and the service application provided by the master node for online service is transferred to the offline node for verification; A configuration module is used to configure the offline node as a new master node after the service application passes the verification of the offline node.

9. A server, characterized in that: The server comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the data encryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the data encryption method according to any one of claims 1 to 7 is implemented.

Images