Database backup encryption method and device, equipment, storage medium and program product

Abstract

The invention provides a database backup encryption method and device, equipment, a storage medium and a program product. The database backup encryption method is applied to a backup system and comprises the following steps: acquiring metadata; encrypting data of each node in the metadata by using a key of the node corresponding to the father node identifier in the attribute information to obtain encrypted metadata; wherein the secret key during encryption of the root node is the secret key in the attribute information of the root node; sending the encrypted metadata to a database system to enable the database system to perform hierarchical decryption on the encrypted metadata, and encrypting backup data matched with the backup path characteristics of the nodes by using keys of the nodes in the decrypted metadata to obtain encrypted backup data; and acquiring and storing the encrypted backup data. The metadata which can be flexibly configured is utilized to realize hierarchical encryption, so that the flexibility and efficiency of data backup are improved.

Description

Technical Field

[0001] The present application relates to the technical field of database backup, and in particular to a database backup encryption method, device, equipment, storage medium and program product. Background Art

[0002] In order to ensure data security, it is often necessary to back up the data in the database to a backup warehouse regularly or irregularly, such as backing up the database.

[0003] In order to further ensure the security of backup data, the backup data needs to be encrypted. Hierarchical Identity-Based Encryption (HIBE) is widely used due to its flexibility and high security. In related technologies, one hierarchical encryption method is to directly transmit the plain text of the backup data remotely to the backup warehouse, and then the backup warehouse will encrypt and save the backup data in layers. Due to the use of plain text transmission, the transmission process has low security and there is a risk of leakage. To overcome this problem, there is another encryption method, which is to encrypt the backup data with a single key, transmit it to the backup warehouse, decrypt the backup warehouse, and then encrypt the backup data through hierarchical encryption. Due to the need for repeated encryption and decryption, it takes a long time, requires a large amount of computing resources, and is costly.

[0004] Therefore, there is an urgent need to provide an efficient and low-cost database backup layered encryption solution. Summary of the invention

[0005] The present application provides a database backup encryption method, apparatus, device, storage medium and program product, which utilize metadata to implement hierarchical encryption of database backups, eliminating the need to repeatedly encrypt and decrypt backup data, thereby improving encryption efficiency. At the same time, metadata supports flexible configuration, thereby improving the flexibility of hierarchical encryption.

[0006] In a first aspect, the present application provides a database backup encryption method, which is applied to a backup system, and the method includes: obtaining metadata; wherein the metadata includes nodes of multiple levels and attribute information of each node, and the attribute information includes a node identifier, a parent node identifier, a backup path feature, and a key; using the key of the node corresponding to the parent node identifier in the attribute information, encrypting the data of each node in the metadata to obtain encrypted metadata; wherein the key for encrypting the root node is the key in its own attribute information; sending the encrypted metadata to a database system so that the database system decrypts the encrypted metadata in layers, and uses the key of each node in the decrypted metadata to encrypt the backup data matching the backup path feature of each node to obtain encrypted backup data; obtaining and saving the encrypted backup data.

[0007] Optionally, obtaining metadata includes: obtaining initial metadata; the key of each node in the initial metadata is a to-be-filled item; obtaining a preset key, and determining the preset key as the key of the root node in the initial metadata, and determining each randomly generated key as the key of each node in the initial metadata except the root node, to obtain metadata.

[0008] Optionally, obtaining initial metadata includes: obtaining a storage directory of the database system; determining the level of each path to be backed up in the initial metadata based on the level and security level of each path to be backed up in the storage directory; and generating initial metadata based on the level of each path to be backed up in the initial metadata.

[0009] Optionally, the attribute information also includes encryption algorithm configuration information; the data of each node in the metadata is encrypted using the key of the node corresponding to the parent node identifier in the attribute information, including: for each node in the metadata, based on the encryption algorithm configuration information in the attribute information of the node, determining the encryption algorithm used by the node; based on the encryption algorithm used by the node and the key in the attribute information of the node, encrypting the data of the node.

[0010] In a second aspect, the present application provides a database backup encryption method, which is applied to a backup system, and the method includes: obtaining encrypted metadata sent by the backup system; performing hierarchical decryption on the encrypted metadata, and decrypting the data of the child nodes of the parent node based on the key of the parent node obtained by decryption, to obtain the decrypted metadata; matching the backup data corresponding to each node based on the backup path characteristics of each node in the decrypted metadata, and encrypting the backup data based on the key of each node to obtain the encrypted backup data; and sending the encrypted backup data to the backup system.

[0011] In a third aspect, the present application provides a database backup encryption device, which is applied to a backup system, and the device includes: a metadata acquisition module, which is used to acquire metadata; wherein the metadata includes nodes of multiple levels and attribute information of each node, and the attribute information includes a node identifier, a parent node identifier, a backup path feature and a key; a metadata encryption module, which is used to encrypt the data of each node in the metadata using the key of the node corresponding to the parent node identifier in the attribute information to obtain encrypted metadata; wherein the key for encrypting the root node is the key in its own attribute information; an encrypted metadata sending module, which is used to send the encrypted metadata to a database system, so that the database system decrypts the encrypted metadata in layers, and uses the keys of each node in the decrypted metadata to encrypt the backup data matching the backup path features of each node to obtain encrypted backup data; an encrypted backup saving module, which is used to acquire and save the encrypted backup data.

[0012] In a fourth aspect, the present application provides a database backup encryption device, which is applied to a database system, and the device includes: an encrypted metadata acquisition module, which is used to obtain the encrypted metadata sent by the backup system; a metadata decryption module, which is used to perform hierarchical decryption on the encrypted metadata, so as to decrypt the data of the child nodes of the parent node based on the key of the parent node obtained by decryption, and obtain the decrypted metadata; a backup data encryption module, which is used to match the backup data corresponding to each node based on the backup path characteristics of each node in the decrypted metadata, and encrypt the backup data based on the key of each node to obtain the encrypted backup data; an encrypted backup sending module, which is used to send the encrypted backup data to the backup system.

[0013] In a fifth aspect, the present application provides an electronic device comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided in the first aspect or the second aspect of the present application.

[0014] In a sixth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method provided in the first aspect or the second aspect of the present application.

[0015] In a seventh aspect, the present application provides a computer program product, including a computer program, which implements the method provided in the first aspect or the second aspect of the present application when the computer program is executed by a processor.

[0016] The database backup encryption method, device, equipment, storage medium and program product provided by the present application realize the hierarchical encryption of database backup through configurable metadata. The specific process is that at the backup system, the data of the child node in the metadata is encrypted by using the key of the parent node, the metadata is hierarchically encrypted from bottom to top, the encrypted metadata is obtained, and the encrypted metadata is transmitted to the database system; thereby, the database system obtains the keys of the nodes at each layer in the metadata through hierarchical decryption from top to bottom, and the backup data under the path corresponding to the node is encrypted by using the key of the node, so that the backup data of different levels are encrypted with different keys, and the encrypted backup data is transmitted to the backup system. The risk of leakage caused by the plaintext transmission of backup data is effectively avoided. At the same time, the hierarchical encryption of backup data is realized by using metadata, which has high security; the encryption and decryption method of metadata is adopted to reduce the number of encryption and decryption of backup data. Since the amount of metadata data is small, the encryption and decryption speed is fast and the cost is low, thereby reducing the cost of hierarchical encryption of backup data and improving the efficiency of hierarchical encryption; in addition, metadata supports flexible configuration, which improves the flexibility of data encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] Figure 1 A flowchart of a database backup encryption method provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a metadata layered encryption process provided in an embodiment of the present application;

[0020] Figure 3 A flowchart of another database backup encryption method provided in an embodiment of the present application;

[0021] Figure 4 A flowchart of another database backup encryption method provided in an embodiment of the present application;

[0022] Figure 5 For this application Figure 3 A schematic diagram of a decryption process of encrypted metadata corresponding to the illustrated embodiment;

[0023] Figure 6 A flowchart of another database backup encryption method provided in an embodiment of the present application;

[0024] Figure 7 A schematic diagram of a remote backup data encryption process provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of the structure of a database backup encryption device provided in an embodiment of the present application;

[0026] Fig. 9 A schematic diagram of the structure of another database backup encryption device provided in an embodiment of the present application;

[0027] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0028] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0029] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0030] First, some of the terms involved in this application are explained:

[0031] Metadata: Data used to describe related information of other data. In this application, it refers to data describing the encryption information of the backup data of the database, which is a tree structure.

[0032] Hierarchical Identity-Based Encryption (HIBE): Encryption is performed using attributes defined by a tree structure. Only users holding the keys of the corresponding level can decrypt the ciphertext of the nodes at the corresponding level, which improves the security of encrypted data.

[0033] In database systems, it is often necessary to perform data backup regularly or proactively to prevent data loss due to hardware failure, natural disasters, human errors, etc., reduce the risk of data corruption, and improve the system's recovery capabilities.

[0034] In order to improve the security of backup data, the backup system usually needs to encrypt the backup data of the database.

[0035] For remote backup scenarios, when the backup system has encryption enabled, the backup system uses a single key to encrypt the database backup data and save the encrypted backup data. The risk of a single key being cracked is high and the security is poor.

[0036] In order to solve the problem of poor security of a single key, layered encryption came into being.

[0037] In order to achieve hierarchical encryption of backup data, one method is to transmit the backup data in plain text to the backup system, and then encrypt the backup data using the key of the corresponding layer. This method uses plain text transmission, which is prone to data leakage during the transmission process. Another method is to use a single password to encrypt the backup data on the database system side, transmit the ciphertext to the backup system and then decrypt it, and then encrypt the backup data using the key of the corresponding layer. Although this method overcomes the security issues caused by plain text transmission, it requires repeated encryption and decryption, which takes a long time and requires more computing resources.

[0038] In order to achieve a safe and efficient hierarchical encryption method for database backup, the present application provides a database backup encryption method, which uses flexibly configurable tree-structured metadata to achieve hierarchical encryption of backup data; at the same time, in order to improve the security of metadata transmission, during the transmission process, the data of the child node is encrypted using the key of the parent node, and the encrypted metadata is transmitted.

[0039] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0040] Figure 1 The following is a flow chart of a database backup encryption method provided in an embodiment of the present application. The database backup encryption method is applied to a backup system, which may be a backup database or other system for storing backup data. Figure 1 As shown, the database backup encryption includes the following steps:

[0041] Step S101, obtaining metadata.

[0042] The metadata includes nodes at multiple levels and attribute information of each node. The attribute information of the node includes node identification, parent node identification, backup path characteristics and key.

[0043] The metadata is a tree structure. According to the position of the node in the tree, the node can be divided into multiple levels of nodes, and different nodes have different attribute information.

[0044] The node identifier is used to identify a unique node in metadata and can be in a numerical form, a string form, or other forms.

[0045] The parent node identifier is the identifier of the parent node of the node, which is used to identify the parent node corresponding to the node. Since the root node has no parent node, its parent node identifier can be empty.

[0046] The backup path is the path where the backup data is stored in the database system. The backup path feature is the feature of the corresponding backup path, which is used to identify the corresponding backup path. The backup path feature can be in the form of a string or an address.

[0047] Exemplarily, the backup path feature may be a representative portion of the backup path.

[0048] Each node in the metadata corresponds to a key, which is used to encrypt the backup data corresponding to the backup path characteristics of the node. The key of the parent node is also used to encrypt the data of the child node, such as attribute information.

[0049] The key of the root node can be a key agreed upon by the backup system and the database system. The keys of other nodes except the root node can be generated randomly or according to a certain rule. For example, the key of the first-level node can replace A and B with 00 and 01, and the key of the second-level node can replace A and B with 10 and 11.

[0050] In some embodiments, the metadata may be pre-stored in the backup system, and after the backup is started, the metadata stored is read from the local system.

[0051] The metadata used for database system backup encryption can be determined by the storage hierarchy of the data to be backed up in the database system. The hierarchical structure of each node in the metadata can be determined through the storage hierarchy of the data to be backed up, including the connection relationship of each node, node identification and other information, and the backup path characteristics of the node can be determined based on the storage path of the data to be backed up corresponding to the hierarchy, and the key in the attribute information of each node can be supplemented to obtain complete metadata.

[0052] In some embodiments, the attribute information of the node in the metadata also includes other extensible information, such as encryption algorithm configuration information, backup time, data annotation, etc. The encryption algorithm configuration information is used to configure the encryption algorithm, encryption strength, etc.

[0053] Step S102: using the key of the node corresponding to the parent node identifier in the attribute information, encrypt the data of each node in the metadata to obtain encrypted metadata.

[0054] The key used when encrypting the root node is the key in its own attribute information.

[0055] The key in the attribute information of the root node is the preset key. The preset key is the key agreed upon by the backup system and the database system. Since the root node has no parent node, when encrypting the root node, the key used is the key in the root node's own attributes, that is, the preset key.

[0056] When encrypting metadata, we use bottom-up hierarchical encryption, that is, we start from the leaf nodes and encrypt them layer by layer. For each layer of nodes, we use the key of its parent node (determined by the parent node identifier in the attribute information) to encrypt the attribute information of the node until the root node is encrypted, and then we can get the encrypted metadata.

[0057] Bottom-up hierarchical encryption specifically refers to determining the deepest level in the metadata, and first encrypting the nodes in this level; then determining the level where the parent node corresponding to each node in this level is located, and encrypting the nodes in this level; finally, encrypting the root node.

[0058] For example, Figure 2 Schematic diagram of metadata layered encryption process provided by the embodiment of the present application. Figure 2 As shown, the backup database includes a backup warehouse for storing encrypted backup data and also stores metadata. Figure 2 The metadata shown includes three layers of nodes, the root node is node a, node a includes two child nodes, node aa and node ab; node aa includes two child nodes, node aaa and node aab; node ab includes one child node, node aba. Figure 2 The metadata shown only shows the key and backup path characteristics in the node attribute information. Taking node aa as an example, its key is key aa and its backup path characteristic is / data / p2. Different nodes have different backup path characteristics to encrypt backup data in different storage paths in the database system.

[0059] When encrypting metadata from bottom to top, the leaf nodes, i.e., nodes aaa, aab, and aba, are first encrypted. Nodes aaa and aab are encrypted using the key aa of their parent node aa; and node aba is encrypted using the key ab of its parent node ab. After the leaf nodes are encrypted, the second-level nodes, i.e., nodes aa and ab, are encrypted using the key a of their parent node, i.e., node a. After the second-level encryption is completed, the root node, i.e., node a, is encrypted. Since node a has no parent node, it is encrypted using the key a of node a.

[0060] In some embodiments, while encryption is performed using the key of the node corresponding to the parent node identifier in the attribute information, encryption may be performed using other extensible information in the attribute information, such as the encryption algorithm or encryption strength indicated in the encryption algorithm configuration information.

[0061] Step S103, sending the encrypted metadata to the database system so that the database system decrypts the encrypted metadata in layers, and uses the key of each node in the decrypted metadata to encrypt the backup data matching the backup path characteristics of each node to obtain the encrypted backup data.

[0062] When the database system has data that needs to be backed up, the backup system sends the encrypted metadata to the database system. The database system decrypts the encrypted metadata from top to bottom, obtains the decrypted metadata, and obtains the attribute information of each node in the metadata.

[0063] Top-down hierarchical decryption is the opposite of bottom-up hierarchical encryption, that is, decryption starts from the root node, and the root node is decrypted using the agreed-upon key to obtain the attribute information of the root node. The key in the attribute information of the root node obtained by decryption is used to decrypt the child nodes of the root node, and so on, until all nodes are decrypted.

[0064] After decrypting and obtaining the backup path feature in the attribute information of a node in the metadata, the backup path feature is used to match the backup data in the database system corresponding to the node, and the backup data corresponding to the node is encrypted using the key in the attribute information of the node to obtain the encrypted backup data corresponding to the node. The encrypted backup data corresponding to each node in the metadata are all encrypted backup data.

[0065] The database system sends the encrypted backup data, including the encrypted backup data corresponding to each node in the metadata, to the backup system. It can be sent all at once after all encryption is completed, or it can be sent to the backup system after each encrypted backup data corresponding to a node is obtained.

[0066] Step S104, obtaining and saving the encrypted backup data.

[0067] After obtaining the encrypted backup data, the backup system stores the encrypted backup data locally.

[0068] When the database system needs to obtain the encrypted backup data for data recovery, the encrypted backup data and the encrypted metadata can be sent to the database system at the same time, so that the database system decrypts the encrypted backup data using the key in the decrypted metadata.

[0069] The database backup encryption method provided in the embodiment of the present application realizes hierarchical encryption of database backup through configurable metadata. The specific process is that at the backup system, the data of the child node in the metadata is encrypted using the key of the parent node, and the metadata is hierarchically encrypted from bottom to top to obtain the encrypted metadata, and the encrypted metadata is transmitted to the database system; thereby, the database system obtains the keys of the nodes at each layer in the metadata through hierarchical decryption from top to bottom, and uses the key of the node to encrypt the backup data under the path corresponding to the node, so that the backup data of different levels are encrypted with different keys, and the encrypted backup data is transmitted to the backup system. The risk of leakage caused by plain text transmission of backup data is effectively avoided. At the same time, the hierarchical encryption of backup data is realized by using metadata, which has high security; the encryption and decryption method of metadata is adopted to reduce the number of encryption and decryption of backup data. Since the amount of metadata data is small, the encryption and decryption speed is fast and the cost is low, thereby reducing the cost of hierarchical encryption of backup data and improving the efficiency of hierarchical encryption; in addition, metadata supports flexible configuration, which improves the flexibility of data encryption.

[0070] Figure 3 A flowchart of another database backup encryption method provided in an embodiment of the present application. Figure 1 Based on the embodiment shown, a further system of step S101 and step S102 is as follows: Figure 3 As shown, the database backup encryption method provided in this embodiment may specifically include the following steps:

[0071] Step S301, obtaining initial metadata, where the key of each node in the initial metadata is an item to be filled in.

[0072] The difference between initial metadata and metadata is that the key in the attribute information in initial metadata is empty, that is, it is an item to be filled in.

[0073] The initial metadata can be obtained by pre-defining each node in the initial metadata, obtaining the node identification and connection relationship of each node, and then obtaining the node identification and parent node identification in the node attribute information. The backup path characteristics can be determined by the storage path of the data to be backed up assigned to the node.

[0074] The storage directory of the data to be backed up in the database system can be used to determine the node level and the number of nodes at each level in the initial metadata, obtain the node connection relationship, and then define the node identification and backup path characteristics for each node to obtain the initial metadata.

[0075] Optionally, obtaining initial metadata includes: obtaining a storage directory of the database system; determining the level of each path to be backed up in the initial metadata based on the level and security level of each path to be backed up in the storage directory; and generating initial metadata based on the level of each path to be backed up in the initial metadata.

[0076] The storage directory of the database system is a directory structure used to store data files, log files, configuration files and other related files in the database system.

[0077] The level of each path to be backed up is the level of the backup path in the storage directory. The security level is determined by the importance of the data corresponding to the path to be backed up, and can also be specified manually.

[0078] Specifically, after the backup system starts the backup, the backup system reads the storage directory of the database system. The storage directory is a tree structure, which is used to describe the hierarchical relationship between different storage paths. The paths to be backed up are some of the storage paths. The backup system determines the level of the nodes corresponding to each path to be backed up in the initial metadata based on the security level of each path to be backed up and the level in the storage directory. The initial metadata is generated based on the level of the nodes corresponding to each path to be backed up in the initial metadata.

[0079] For the path to be backed up with the highest level (smallest value) in the storage directory, the node corresponding to the path to be backed up can be directly determined as the root node in the initial metadata. For other paths to be backed up, the level of the node corresponding to each path to be backed up in the initial metadata can be determined based on the security level of the path to be backed up and the level in the storage directory.

[0080] When the security level is moderate, such as between the first level and the second level, the level of the node corresponding to the path to be backed up in the initial metadata can be equal to the level of the path to be backed up in the storage directory. The first level is greater than the second level, and is between the first level and the second level, which specifically means less than or equal to the first level, and greater than or equal to the second level.

[0081] When the security level is higher than the first level, the level of the node corresponding to the path to be backed up in the initial metadata may be the sum of the level of the path to be backed up in the storage directory and the preset level. The preset level may be a default value, such as 1, 2, 3, etc., or may be determined based on the security level, such as being equal to the security level, or being the integer result of the product of the ratio of the security level to the maximum value of the security level and the first coefficient, where the first coefficient is a positive integer greater than 1.

[0082] When the security level is lower than the second level, the level of the node corresponding to the path to be backed up in the initial metadata can be the difference between the level of the path to be backed up in the storage directory and the set level. The set level can be a default value, such as 1, 2, etc., and is also determined based on the security level, such as being equal to the security level, or being the maximum value of the security level and the product of the ratio of the security level to and the second coefficient, and the second coefficient is a positive integer greater than 1. When the difference is less than 2, the level of the node corresponding to the path to be backed up in the initial metadata can be directly determined as the second level.

[0083] After the nodes corresponding to each path to be backed up are hierarchical in the initial metadata, the connection relationship of each node in the metadata and its backup path characteristics can be obtained, based on which the initial metadata can be generated.

[0084] By stratifying the paths to be backed up in the storage directory of the database system, nodes of appropriate levels are allocated to each path to be backed up, thereby realizing adaptive customization of metadata node levels, improving the matching degree between metadata node levels and node quantities and backup scenarios, and avoiding designing too many nodes, which results in excessively long encryption and decryption time, and designing too few nodes, which results in poor encryption security. At the same time, considering the security level of the paths to be backed up, the use of deep-level nodes to encrypt paths with high security levels is realized, thereby improving the encryption strength of data under the path and improving the security of data backup with high security levels.

[0085] Step S302, obtaining a preset key, and determining the preset key as the key of the root node in the initial metadata, and determining each randomly generated key as the key of each node in the initial metadata except the root node, to obtain metadata.

[0086] Since the attribute information of the initial metadata lacks a key, when allocating keys to each node in the initial raw data, the preset key agreed upon with the database system can be directly determined as the key of the root node in the initial metadata.

[0087] In order to increase the difficulty of cracking the encryption, multiple keys can be randomly generated and determined as the keys of each node except the root node, and finally metadata with complete attribute information can be obtained.

[0088] In order to prevent the risk of key cracking due to key reuse, the key of each node can be updated after each encryption of the backup data.

[0089] The attribute information of the metadata may also include encryption algorithm configuration information, which may be used to configure the algorithm when using key encryption.

[0090] Step S303: for each node in the metadata, based on the encryption algorithm configuration information in the attribute information of the node, determine the encryption algorithm used by the node.

[0091] The encryption algorithm can be AES-128, AES-256, or DES.

[0092] Exemplarily, nodes at the same level may use the same encryption algorithm. The encryption algorithm of the child node may be stronger than the encryption algorithm of the parent node, for example, the encryption algorithm of the parent node may be AES-128, and the encryption algorithm of the child node may be AES-256.

[0093] Step S304: using the key of the node corresponding to the parent node identifier in the attribute information and the encryption algorithm used, encrypt the data of each node in the metadata to obtain encrypted metadata.

[0094] The metadata is encrypted hierarchically from bottom to top, and each node uses the key and encryption algorithm of the node corresponding to the parent node identifier in the attribute information to encrypt the attribute information of each node.

[0095] Step S305, the encrypted metadata is sent to the database system so that the database system decrypts the encrypted metadata in layers, and uses the key of each node in the decrypted metadata and the encryption algorithm used to encrypt the backup data matching the backup path characteristics of each node to obtain the encrypted backup data.

[0096] Step S306, obtaining and saving the encrypted backup data.

[0097] Each node is encrypted by randomly generated keys. Since the randomly generated keys are unpredictable, the difficulty of cracking is increased, the overall strength of encryption is improved, and the security of metadata is enhanced. By adding encryption algorithm configuration information to the attribute information, flexible configuration of node encryption algorithms is achieved, and the flexibility of layered encryption is improved. At the same time, through differentiated encryption algorithms, the strength of data encryption is further improved, ensuring the security of data backup.

[0098] Figure 4 A flowchart of another database backup encryption method provided in an embodiment of the present application is provided. The database backup encryption method is applied to a database system, such as Figure 4 As shown, after the backup system generates the encrypted metadata, the database backup encryption method includes the following steps:

[0099] Step S401: Obtain the encrypted metadata sent by the backup system.

[0100] The backup system generates encrypted metadata using the aforementioned database backup encryption method and transmits the encrypted metadata to the database system, which receives the encrypted metadata.

[0101] Step S402, hierarchically decrypt the encrypted metadata, so as to decrypt the data of the child nodes of the parent node based on the key of the parent node obtained by decryption, and obtain the decrypted metadata.

[0102] The data of the root node in the encrypted metadata is decrypted using a total key such as a preset key to obtain the attribute information of the root node; based on the key in the attribute information of the root node, the data of the child nodes of the root node in the encrypted metadata is decrypted, and so on, using a top-down hierarchical decryption method to decrypt and obtain the attribute information of each node.

[0103] For example, Figure 5 For this application Figure 4 The schematic diagram of the decryption process of the encrypted metadata corresponding to the embodiment shown is as follows. Figure 5 As shown, the database system includes a database for storing plaintext backup data, and the database can also store data that does not need to be backed up. The database system is also used to decrypt the encrypted metadata. The process of decrypting the encrypted metadata from top to bottom is specifically: using the total key such as key a to decrypt the encrypted attribute information of node a (root node) to obtain the attribute information of the root node, including key key a; using key key a to decrypt each child node of node a to obtain the attribute information of node aa and node ab including key key aa and key ab; using keys key aa and keyab to decrypt the child nodes of node aa and node ab respectively to obtain the attribute information of child nodes aaa, aab and aba, and thus completing the decryption of the encrypted metadata to obtain the attribute information of each node, including the key and backup path characteristics, so as to use the key of the node to encrypt the backup data stored in the database that matches the backup path characteristics.

[0104] Taking node aaa as an example, key aaa is used to encrypt the backup data with storage path DB / data / p4. The storage path DB / data / p4 matches the backup path feature " / data / p4" of node aaa, where "DB" represents the root directory in the storage directory of the database system.

[0105] Step S403, based on the backup path features of each node in the decrypted metadata, the backup data corresponding to each node is matched and the backup data is encrypted based on the key of each node to obtain the encrypted backup data.

[0106] For each node, the backup path characteristics in the attribute information of the node in the decrypted metadata are obtained, and the backup data corresponding to the node is matched from the database system according to the backup path characteristics, that is, the backup data whose storage path matches the backup path characteristics is determined to be the backup data corresponding to the node, and the backup data corresponding to the node is encrypted using the key of the node.

[0107] Exemplarily, it is assumed that the metadata includes four nodes 40, node 41, node 42, and node 411, where node 40 is a root node, node 41 and node 42 are child nodes of node 40, and node 411 is a leaf node and a child node of node 41. The backup path features of node 40, node 41, node 42, and node 411 are: / data / d1*, / data / d2*, / data / d3, and / data / d4, respectively. The backup data with the storage path DB / data / d1 is the backup data corresponding to node 40 and is encrypted using the key of node 40; the backup data with the storage path DB / data / d1 / x is also the backup data corresponding to node 40 and is encrypted using the key of node 40; the backup data with the storage path DB / data / d2 / x is the backup data corresponding to node 41 and is encrypted using the key of node 41; the backup data with the storage path DB / data / d2 / y is the backup data corresponding to node 41 and is encrypted using the key of node 41; the backup data with the storage path DB / data / d3 is the backup data corresponding to node 42 and is encrypted using the key of node 42; the backup data with the storage path DB / data / d4 is the backup data corresponding to node 411 and is encrypted using the key of node 411. "DB" in the storage path indicates the database system, which is the root directory in the storage directory, and "x" and "y" indicate any two different directories.

[0108] After the backup data is encrypted, the encrypted backup data is sent to the backup system.

[0109] Step S404: Send the encrypted backup data to the backup system.

[0110] The encrypted backup data is sent to the backup system for storage to complete the database backup encryption.

[0111] In the backup system, there is no need to decrypt the encrypted backup data, and the encrypted backup data can be directly saved.

[0112] When the database system needs to use the encrypted backup data stored in the backup system for data recovery, the encrypted backup data and its corresponding encrypted metadata can be obtained from the backup system. The encrypted metadata is decrypted hierarchically to obtain the key of each node, and then the key of each node is used to decrypt the encrypted backup data corresponding to each node to obtain the required plaintext backup data, and data recovery is performed based on the backup data.

[0113] In this embodiment, in the database system, the encrypted metadata is decrypted to obtain the attribute information corresponding to each node, and then the key of each node obtained by decryption is used to encrypt the backup data corresponding to each node, and then the encrypted backup data is sent to the backup system, thereby avoiding the risk of leakage caused by plain text transmission of backup data and improving the security of database backup; at the same time, by using different keys to encrypt backup data in different locations, differentiated encryption is achieved, reducing the risk of backup data being intercepted completely.

[0114] Figure 6 A flow chart of another database backup encryption method provided in an embodiment of the present application. This embodiment is applied to a backup system and a database system. The backup system and the database system are remotely connected, and the two can communicate data through a network.

[0115] like Figure 6 As shown, the database backup encryption method provided in this embodiment specifically includes the following steps:

[0116] Step S601: The backup system encrypts metadata hierarchically from top to bottom, and sends the encrypted metadata to the database system.

[0117] Step S602: the database system decrypts the encrypted metadata in layers from bottom to top to obtain plaintext metadata.

[0118] Step S603: the database system uses the backup path features of each node in the metadata to match and obtain the nodes corresponding to the data that needs to be backed up.

[0119] Step S604: the database system uses the key of the corresponding node to encrypt the data to be backed up.

[0120] Step S605: The backup system stores the encrypted backup data sent by the remote database system locally.

[0121] Figure 7 This is a schematic diagram of the remote backup data encryption process provided in an embodiment of the present application, with respect to the database backup encryption method applied to the backup system and the database system provided in the aforementioned embodiment. Figure 7Take the example of a remote backup system and database system connected via a network. Figure 7 As shown, the encryption process provided by this embodiment is as follows: when the backup system turns on the encryption function, the total key that is agreed upon with the remote database system, that is, the aforementioned preset key, is obtained, the total key is used as the key of the root node in the metadata for hierarchical encryption of the backup data, the keys of other nodes of the metadata are randomly generated, and other attribute information is configured for each node, including backup path characteristics, node identification, parent node identification, etc., thereby obtaining complete metadata. The backup system encrypts the metadata, specifically, encrypts the node layer by layer from bottom to top using the parent node key to obtain the encrypted metadata, and transmits the encrypted metadata to the database system. On the database system side, the encrypted metadata is hierarchically decrypted from top to bottom to obtain plaintext metadata. When there is backup data, based on the storage path of the backup data, the node corresponding to the backup data (the node whose backup path characteristics match the storage path) is determined from the node of the metadata, and the backup data is encrypted using the key of the corresponding node to implement hierarchical encryption of the backup data, obtain the encrypted backup data, and send the encrypted backup data to the backup system, and the backup system directly stores the encrypted backup data in the backup warehouse.

[0122] Corresponding to the database backup encryption method applied to the backup system provided in the aforementioned embodiment, the embodiment of the present application also provides a corresponding device. Figure 8 A schematic diagram of a database backup encryption device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the database backup encryption device is applied to a backup system, and includes: a metadata acquisition module 810 , a metadata encryption module 820 , an encrypted metadata sending module 830 and an encrypted backup storage module 840 .

[0123] The metadata acquisition module 810 is used to acquire metadata, wherein the metadata includes nodes of multiple levels and attribute information of each node, wherein the attribute information includes a node identifier, a parent node identifier, backup path characteristics and a key; the metadata encryption module 820 is used to encrypt the data of each node in the metadata using the key of the node corresponding to the parent node identifier in the attribute information to obtain encrypted metadata, wherein the key for encrypting the root node is the key in its own attribute information; the encrypted metadata sending module 830 is used to send the encrypted metadata to the database system so that the database system decrypts the encrypted metadata in layers, and uses the key of each node in the decrypted metadata to encrypt the backup data matching the backup path characteristics of each node to obtain encrypted backup data; the encrypted backup preservation module 840 is used to obtain and preserve the encrypted backup data.

[0124] Optionally, the metadata acquisition module 810 includes an initial metadata acquisition unit and a key determination unit, wherein the initial metadata acquisition unit is used to acquire initial metadata; the key of each node in the initial metadata is an item to be filled in; the key determination unit is used to acquire a preset key, and determine the preset key as the key of the root node in the initial metadata, and determine each randomly generated key as the key of each node in the initial metadata except the root node, to obtain metadata.

[0125] Optionally, the initial metadata acquisition unit is specifically used to: obtain the storage directory of the database system; determine the level of each path to be backed up in the initial metadata based on the level and security level of each path to be backed up in the storage directory; generate initial metadata based on the level of each path to be backed up in the initial metadata.

[0126] Optionally, the metadata encryption module 820 is specifically used for: the attribute information also includes encryption algorithm configuration information, for each node in the metadata, based on the encryption algorithm configuration information in the attribute information of the node, determining the encryption algorithm used by the node; based on the encryption algorithm used by the node and the key in the attribute information of the node, encrypting the data of the node to obtain encrypted metadata; wherein the key for encrypting the root node is the key in its own attribute information.

[0127] The database backup encryption device provided in the embodiment of the present application can be used to execute the technical solution of the database backup encryption method applied to the backup system provided in any of the above embodiments of the present application. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0128] Corresponding to the database backup encryption method applied to the database system provided in the aforementioned embodiment, the embodiment of the present application also provides a corresponding device. Fig. 9 A schematic diagram of the structure of another database backup encryption device provided in an embodiment of the present application, such as Fig. 9 As shown, the database backup encryption device is applied to a database system, and includes: an encrypted metadata acquisition module 910 , a metadata decryption module 920 , a backup data encryption module 930 and an encrypted backup sending module 940 .

[0129] The encrypted metadata acquisition module 910 is used to obtain the encrypted metadata sent by the backup system; the metadata decryption module 920 is used to perform hierarchical decryption on the encrypted metadata, so as to decrypt the data of the child nodes of the parent node based on the key of the parent node obtained by decryption, and obtain the decrypted metadata; the backup data encryption module 930 is used to match the backup data corresponding to each node based on the backup path characteristics of each node in the decrypted metadata, and encrypt the backup data based on the key of each node to obtain the encrypted backup data; the encrypted backup sending module 940 is used to send the encrypted backup data to the backup system.

[0130] The database backup encryption device provided in the embodiment of the present application can be used to execute the technical solution of the database backup encryption method applied to the database system provided in any of the above embodiments of the present application. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0131] Fig.10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.10 As shown, the electronic device of this embodiment may include: at least one processor 1001; and a memory 1002 communicatively connected to the at least one processor; wherein the memory 1002 stores instructions executable by the at least one processor 1001, and the instructions are executed by the at least one processor 1001 so that the electronic device executes a method as in any of the above embodiments.

[0132] Optionally, the memory 1002 may be independent or integrated with the processor 1001 .

[0133] When the memory 1002 is independently provided, the device further includes a bus for connecting the memory 1002 and the processor 1001 .

[0134] The implementation principle and technical effects of the electronic device provided in this embodiment can be found in the aforementioned embodiments and will not be described in detail here.

[0135] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the method provided in any of the aforementioned embodiments can be implemented.

[0136] An embodiment of the present application also provides a computer program product, including a computer program, which implements the method provided in any of the above embodiments when executed by a processor.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0138] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0139] It should be understood that the above processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can be any conventional processor, etc. The steps of the method disclosed in the application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0140] The memory may include a high-speed memory, and may also include a non-volatile memory, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk, or an optical disk.

[0141] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0142] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0143] An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in a dedicated integrated circuit. Of course, the processor and the storage medium can also exist as discrete components in the electronic device or the control device of the vehicle sentry mode.

[0144] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0145] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods provided in each embodiment of the present application.

[0147] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0148] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A database backup encryption method, characterized in that: Applied to a backup system, the method comprises: Obtaining metadata; wherein the metadata includes nodes of multiple levels and attribute information of each of the nodes, and the attribute information includes a node identifier, a parent node identifier, a backup path feature, and a key; Using the key of the node corresponding to the parent node identifier in the attribute information, encrypt the data of each node in the metadata to obtain encrypted metadata; wherein the key used for encrypting the root node is the key in its own attribute information; Sending the encrypted metadata to a database system so that the database system decrypts the encrypted metadata in layers, and uses the key of each node in the decrypted metadata to encrypt backup data matching the backup path feature of each node to obtain encrypted backup data; Acquire and save the encrypted backup data.

2. The method according to claim 1, characterized in that Get metadata, including: Obtaining initial metadata; the key of each node in the initial metadata is an item to be filled in; A preset key is obtained, and the preset key is determined as the key of the root node in the initial metadata, and each randomly generated key is determined as the key of each node in the initial metadata except the root node, to obtain the metadata.

3. The method according to claim 2, characterized in that Get initial metadata, including: Obtaining a storage directory of the database system; Based on the level and security level of each to-be-backed-up path in the storage directory, determining the level of each to-be-backed-up path in the initial metadata; The initial metadata is generated based on the level of each to-be-backed-up path in the initial metadata.

4. The method according to any one of claims 1 to 3, characterized in that: The attribute information also includes encryption algorithm configuration information; Using the key of the node corresponding to the parent node identifier in the attribute information, encrypting the data of each node in the metadata includes: For each node in the metadata, based on the encryption algorithm configuration information in the attribute information of the node, determining the encryption algorithm used by the node; The data of the node is encrypted based on the encryption algorithm used by the node and the key in the attribute information of the node.

5. A database backup encryption method, characterized in that: Applied to a database system, the method comprises: Get the encrypted metadata sent by the backup system; Decrypting the encrypted metadata in layers, so as to decrypt the data of the child nodes of the parent node based on the key of the parent node obtained by decryption, and obtain the decrypted metadata; Based on the backup path features of each node in the decrypted metadata, the backup data corresponding to each node is matched and the backup data is encrypted based on the key of each node to obtain the encrypted backup data; The encrypted backup data is sent to the backup system.

6. A database backup encryption device, characterized in that: Applied to a backup system, the device comprises: A metadata acquisition module, used to acquire metadata; wherein the metadata includes nodes of multiple levels and attribute information of each of the nodes, and the attribute information includes a node identifier, a parent node identifier, a backup path feature, and a key; A metadata encryption module, used to encrypt the data of each node in the metadata using the key of the node corresponding to the parent node identifier in the attribute information to obtain encrypted metadata; wherein the key used for encrypting the root node is the key in its own attribute information; An encrypted metadata sending module is used to send the encrypted metadata to the database system, so that the database system decrypts the encrypted metadata in layers, and uses the key of each node in the decrypted metadata to encrypt the backup data matching the backup path characteristics of each node to obtain the encrypted backup data; The encrypted backup saving module is used to obtain and save the encrypted backup data.

7. A database backup encryption device, characterized in that: Applied to a database system, the device comprises: An encrypted metadata acquisition module, used to acquire the encrypted metadata sent by the backup system; A metadata decryption module, used to perform hierarchical decryption on the encrypted metadata, so as to decrypt the data of the child nodes of the parent node based on the key of the parent node obtained by decryption, and obtain the decrypted metadata; A backup data encryption module, used to match the backup path characteristics of each node in the decrypted metadata to obtain the backup data corresponding to each node, and encrypt the backup data based on the key of each node to obtain the encrypted backup data; The encrypted backup sending module is used to send the encrypted backup data to the backup system.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

10. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 5 when the computer program is executed by a processor.

Images