Postgres database encryption method and system based on encryption card and storage medium

Abstract

The invention discloses a postgres database encryption method and system based on an encryption card and a storage medium, and solves the problems that in an existing encryption mode, an encryption program is cracked, and data is drained before being stored in a database, so that the data is stolen. The method comprises the steps that a trigger monitors a data operation event in real time, and a user-defined encryption and decryption function is started; and obtaining the operation data through the user-defined encryption and decryption function, carrying out communication with the encryption card to carry out encryption and decryption operation on the operation data, and returning the data after the operation. According to the method, the encryption method and the postgres database are integrated by starting from the internal self-defined function of the postgres database, combining the encryption card and applying the function of the database trigger, non-inductive transparent encryption is realized, and the data security of the database is ensured. The method does not need to analyze the sql statement and traverse the syntax tree of the sql like calling a JDBC library, and is convenient to implement. The encrypted database is transparent to users and developers and is very convenient.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to a postgres database encryption method, system and storage medium based on an encryption card. Background Art

[0002] With the development of digitalization, informatization and intelligence in various fields of society, data security has become an important issue. The data may contain sensitive business information and personal information. The leakage of data may lead to the loss of business secrets and property loss. Therefore, it is necessary to encrypt database data to protect data from illegal access and leakage.

[0003] At present, the data encryption method based on encryption cards is mainly to implant encryption programs outside the database software, that is, without making any changes to the database source code. In this case, it is easy for technicians to quickly crack the program by interpreting the encryption program to obtain data; or to implant data stealing programs before the data is stored in the database to divert useful information and thus steal data. Summary of the invention

[0004] The present invention mainly solves the problem that the encryption program is cracked and the data is drained before being stored in the database in the existing encryption method, resulting in the theft of data, and provides a postgres database encryption method, system and storage medium based on an encryption card.

[0005] The above technical problem of the present invention is mainly solved by the following technical solution: a postgres database encryption method based on an encryption card, comprising the following steps: The trigger monitors data running events in real time and starts the custom encryption and decryption functions; Obtain running data through custom encryption and decryption functions, communicate with the encryption card to perform encryption and decryption operations on the running data, and return the data after the operation.

[0006] The present invention starts with the internal custom function of the postgres database, combines the encryption card, and uses the database trigger function to integrate the encryption method with the postgres database, realizes non-sensing transparent encryption, and ensures the data security of the database. The present invention does not need to parse the SQL statement and traverse the syntax tree of SQL like calling the JDBC library, and the method of the present invention is easy to implement. The encrypted database of the present invention is transparent to users and developers and is very convenient. The postgres database of the present invention combines the encryption card to encrypt and decrypt sensitive data in the database, which can ensure the confidentiality of the data during storage and transmission. Even if the data is illegally obtained, it cannot be easily decrypted, thereby protecting the privacy and security of the data. The integrity of the data is guaranteed. The encryption card can not only encrypt the data, but also provide a data integrity verification function. By signing or verifying the data with the encryption card, it can be ensured that the data has not been tampered with during transmission or storage, ensuring the integrity and authenticity of the data. The encryption card can be used to implement the access control and identity authentication mechanism of the database. Only users holding a specific encryption card can access sensitive data, which increases the difficulty of illegal access and improves the security of the system. And prevent internal leakage. In the database system, sometimes internal personnel leak data. Database encryption technology based on encryption cards can perform fine-grained access control on data, preventing internal personnel from unauthorized access to sensitive data, thereby reducing the risk of internal leakage.

[0007] Improved system performance. Encryption cards usually have high-speed processing capabilities, which can quickly complete data encryption and decryption operations, thereby reducing the impact on database performance. At the same time, encryption cards can also provide parallel processing capabilities, further improving the overall performance of the system.

[0008] As a preferred solution, the communication with the encryption card to perform encryption and decryption operations on the running data includes: By calling the data acquisition dynamic library, the running data is transferred to the encryption card for encryption, and the encrypted data ciphertext is obtained; By calling the data acquisition dynamic library, the running data is transferred to the encryption card for decryption, and the decrypted data plaintext is obtained.

[0009] In this solution, the custom encryption and decryption function implements the running data encryption and decryption by calling the data acquisition dynamic library. The data acquisition dynamic library is formed by encapsulating the post request based on the http protocol using the curl tool of Linux. The custom encryption and decryption function obtains the running data, writes the input statement at the beginning of the custom encryption and decryption function, returns the data to the data storage after the encryption and decryption is completed, and writes the return statement at the end of the custom encryption and decryption function.

[0010] As a preferred solution, the communication with the encryption card to perform encryption and decryption operations on the running data includes: By calling the data acquisition dynamic library, the identity data is obtained for identity authentication, and after passing, the encrypted card login pass is obtained.

[0011] Using encryption cards to implement postgres database encryption also includes database identity authentication. When monitoring data operation events, the custom encryption and decryption function obtains identity data by calling the data acquisition dynamic library to authenticate each other. After the identity authentication is passed, the custom encryption and decryption function obtains the login pass, that is, the login token. Then, based on the token, the data acquisition dynamic library is called again to pass the operation data to the encryption card for encryption and decryption.

[0012] As a preferred solution, according to the data access and acquisition mode between the encryption card and the database, a data acquisition dynamic library is encapsulated.

[0013] Since the encryption card accesses and obtains data through the post request of the http protocol, the curl tool of linux is used to encapsulate the post request based on the http protocol into a dynamic library, that is, the data acquisition dynamic library. The present invention encapsulates the post request based on the http protocol into a dynamic library, named libcurlpost.so.

[0014] As a preferred solution, the trigger monitors data operation events including data addition, modification, query, and deletion.

[0015] The database trigger function is used to monitor data operation events in real time, including data addition, deletion, modification and query events. When the addition, deletion, modification and query command is detected, the custom encryption and decryption function is started.

[0016] As a preferred solution, the trigger monitors data addition or modification events in real time and starts the custom encryption and decryption function; Obtain the added or modified plaintext data, and by calling the data acquisition dynamic library, pass the added or modified data to the encryption card for encryption to obtain the encrypted data ciphertext.

[0017] This solution monitors data operation events according to triggers. When data is added or modified, a custom encryption and decryption function is started to perform encryption operations. The encryption process is made imperceptible to the user through the trigger function. The ciphertext can be stored in the database by adding or modifying the original text.

[0018] As a preferred solution, The trigger monitors data query or deletion events in real time and starts the custom encryption and decryption function; Get the ciphertext data to be queried or deleted, and transfer the queried or deleted data to the encryption card for decryption by calling the data acquisition dynamic library to obtain the decrypted data plaintext.

[0019] This solution monitors data operation events according to triggers. When performing data query or deletion events, it starts the custom encryption and decryption function to perform decryption operations. The trigger function makes the decryption process imperceptible to the user. By querying or deleting the ciphertext in the database, the plaintext can be obtained imperceptibly.

[0020] As a preferred solution, a trigger function is created to monitor data running events and start a custom encryption function when a data change command is executed.

[0021] Create a trigger function in the command line. When the trigger row number runs the data addition, deletion, modification and query command, the custom encryption and decryption function is started.

[0022] A postgres database encryption system based on an encryption card, comprising: The monitoring unit monitors the database data running events in real time and starts the custom encryption and decryption functions; Encryption card unit, with built-in encryption algorithm, encrypts and decrypts acquired data; The encryption and decryption unit creates a custom encryption and decryption function, obtains the running data through the custom encryption and decryption function, calls the data acquisition dynamic library to communicate with the encryption card, authenticates the database, encrypts and decrypts the running data, and returns the data after the operation.

[0023] A computer storage medium stores a postgres database encryption program, which implements the method as described in any one of claims 1 to 8 when executed.

[0024] Therefore, the advantages of the present invention are: starting from the internal custom function of the postgres database, combining the encryption card, and using the database trigger function, the encryption method and the postgres database are integrated to achieve non-sensing transparent encryption, thereby ensuring the data security of the database. There is no need to parse the SQL statement and traverse the SQL syntax tree like calling the JDBC library, and the method of the present invention is easy to implement. The encrypted database of the present invention is transparent to users and developers and is very convenient. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic flow chart of the method of the present invention.

[0026] Figure 2 It is a principle schematic diagram of the custom encryption and decryption function in the present invention.

[0027] Figure 3This is a second principle diagram of the custom encryption and decryption function in the present invention. DETAILED DESCRIPTION

[0028] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0029] Embodiment 1: This embodiment is a postgres database encryption method based on an encryption card, such as Figure 1 As shown, the following steps are included: The trigger monitors data running events in real time and starts the custom encryption and decryption functions; Obtain running data through custom encryption and decryption functions, communicate with the encryption card to perform encryption and decryption operations on the running data, and return the data after the operation.

[0030] The present invention starts with the internal custom function of the postgres database, combines the encryption card, and uses the database trigger function to integrate the encryption method with the postgres database, realizes non-sensing transparent encryption, and ensures the data security of the database. The postgres database of the present invention combines the encryption card to encrypt and decrypt sensitive data in the database, which can ensure the confidentiality of the data during storage and transmission. Even if the data is illegally obtained, it cannot be easily decrypted, thereby protecting the privacy and security of the data. The integrity of the data is guaranteed. The encryption card can not only encrypt the data, but also provide a data integrity verification function. By signing or verifying the data with the encryption card, it can be ensured that the data has not been tampered with during transmission or storage, thereby ensuring the integrity and authenticity of the data. The encryption card can be used to implement the access control and identity authentication mechanism of the database. Only users holding a specific encryption card can access sensitive data, which increases the difficulty of illegal access and improves the security of the system. And prevent internal leakage. In the database system, sometimes there will be situations where internal personnel leak data. The database encryption technology based on the encryption card can perform fine-grained access control on the data, prevent internal personnel from unauthorized access to sensitive data, thereby reducing the risk of internal leakage. Improved system performance. Encryption cards usually have high-speed processing capabilities, which can quickly complete data encryption and decryption operations, thereby reducing the impact on database performance. At the same time, encryption cards can also provide parallel processing capabilities, further improving the overall performance of the system.

[0031] As a preferred solution of this embodiment, according to the data access and acquisition method between the encryption card and the database, a data acquisition dynamic library is encapsulated. Since the encryption card accesses and obtains data through the post request of the http protocol, the curl tool of Linux is used to implement the post request based on the http protocol and encapsulate it into a dynamic library, that is, the data acquisition dynamic library, named libcurlpost.so.

[0032] Custom function library encapsulation, the custom function is located in the postgres database .. / src / tutorial / funcs.c source file. After modification, package the funcs.c file into a dynamic library and copy the dynamic library to pgsql / lib under the database installation path. At this point, the custom function library has been established.

[0033] Open the postgres database and enter CREATE FUNCTION ENCRYPT(text) RETURNStext AS ' / usr / local / pgsql / lib / funcs', 'ENCRYPT' LANGUAGE C STRICT in the command line to create a custom encryption and decryption function. This embodiment uses ENCRYPT as an example to create a custom encryption and decryption function. The C language program of the custom extension library of postgres data needs to add the extension library entry declaration so that it can be correctly recognized and processed by PostgreSQL, that is, first add the following statement: PG MODULE MAGIC; This is a macro used to identify the version and compatibility information of the module. PG_FUNCTION INFO V1(ENCRYPT); This is a macro that declares metadata for a function. Here, it associates the function name ENCRYPT with the function version number v1.

[0034] Write the statement PG_GETARG_TEXT_P(0) at the beginning of the custom encryption and decryption function to pass the original data into the custom ENCRYPT function. The custom encryption and decryption function calls the data acquisition dynamic library to perform encryption and decryption operations on the data. Add the statement PG_RETURN_TEXT_P(text) at the end of the custom ENCRYPT function to return the operated data to the SQL statement.

[0035] Create a trigger function, create a trigger function in the command line, the trigger monitors data running events in real time, and starts the custom encryption function when the data change command is executed. Specifically, the trigger monitors data running events including data addition, modification, query, and deletion. This embodiment monitors data running events according to the trigger. When adding or modifying data events, the custom encryption and decryption function is started to perform encryption operations. The encryption process is made imperceptible to the user through the trigger function. The ciphertext can be stored in the database by adding or modifying the original text. When querying or deleting data events, the custom encryption and decryption function is started to perform decryption operations. The decryption process is made imperceptible to the user through the trigger function. The ciphertext in the database can be obtained imperceptibly by querying or deleting the ciphertext in the database.

[0036] As a preferred solution of this embodiment, the trigger monitors the data running event in real time and starts the custom encryption and decryption function, including: When the trigger detects data addition, modification, query, or deletion events, it starts the custom encryption and decryption function.

[0037] As a preferred solution of this embodiment, the operation data is obtained through a custom encryption and decryption function, and the encryption card is communicated to perform encryption and decryption operations on the operation data, and the data after the operation is returned, such as Figure 1 and 3 As shown, including: When listening to data addition or modification events, Get the added or modified plaintext data, that is, pass the plaintext data as a parameter to the custom encryption and decryption function; By calling the data acquisition dynamic library, that is, calling libcurlpost.so, the added or modified data is transferred to the encryption card for encryption, and the encrypted data ciphertext is obtained; Return the ciphertext to the sql statement.

[0038] As another implementation of this embodiment, it includes: When listening to data query or deletion events, Get the ciphertext data to be queried or deleted, that is, pass the ciphertext data as a parameter to the custom encryption and decryption function; By calling the data acquisition dynamic library, that is, calling libcurlpost.so, the query or deletion data is transferred to the encryption card for decryption, and the decrypted data plaintext is obtained; Returns the plain text to the SQL statement.

[0039] This embodiment also discloses a postgres database encryption system based on an encryption card, which is used to implement the above method. The system includes: The monitoring unit monitors the database data running events in real time and starts the custom encryption and decryption functions; Encryption card unit, with built-in encryption algorithm, encrypts and decrypts acquired data; The encryption and decryption unit creates a custom encryption and decryption function, obtains the running data through the custom encryption and decryption function, calls the data acquisition dynamic library to communicate with the encryption card, performs encryption and decryption operations on the running data, and returns the data after the operation.

[0040] The monitoring unit is connected to the encryption and decryption unit, and the encryption card and the encryption and decryption unit are connected to each other. The monitoring unit monitors the database data operation events in real time. The data operation events include data addition, modification, query, and deletion. When the above command is monitored, the custom encryption and decryption function is started. The monitoring unit uses database triggers to create trigger functions through the command line. The encryption and decryption unit creates a custom encryption and decryption function. First, the custom function library is encapsulated. The custom function is located in the postgres database.. / src / tutorial / funcs.c source file. After modification, the funcs.c file is packaged into a dynamic library and the dynamic library is copied to the pgsql / lib under the database installation path. At this point, the custom function library has been established. Open the postgres database and enter CREATE FUNCTION ENCRYPT(text) RETURNS text AS ' / usr / local / pgsql / lib / funcs', 'ENCRYPT' LANGUAGE C STRICT in the command line; thereby creating a custom encryption and decryption function. The C language program of the custom extension library of postgres data needs to add the extension library entry declaration so that it can be correctly recognized and processed by PostgreSQL. That is, you first need to add the following statement: PG MODULE MAGIC; This is a macro used to identify the version and compatibility information of the module. PG_FUNCTION INFO V1(ENCRYPT); This is a macro used to declare metadata of a function. Here, the function name ENCRYPT is associated with the function version number v1.

[0041] The custom encryption and decryption function writes the statement PG_GETARG_TEXT_P(0) at the beginning to pass the data into the custom ENCRYPT function. The custom encryption and decryption function calls the data acquisition dynamic library to encrypt and decrypt the data. Add the PG_RETURN_TEXT_P(text) statement at the end of the custom ENCRYPT function to return the operated data to the SQL statement.

[0042] The data acquisition dynamic library is encapsulated according to the data access and acquisition method between the encryption card and the database. Since the encryption card accesses and obtains data through the post request of the http protocol, the curl tool of Linux is used to implement the post request based on the http protocol and encapsulate it into a dynamic library, that is, the data acquisition dynamic library, named libcurlpost.so.

[0043] This embodiment also discloses a computer storage medium, which stores a postgres database encryption program. When the postgres database encryption program is executed, the postgres database encryption method based on the encryption card in the above embodiment 1 or 2 is implemented.

[0044] Embodiment 2: This embodiment provides another postgres database encryption method based on an encryption card, comprising the following steps: The trigger monitors data running events in real time and starts the custom encryption and decryption functions; Obtain running data through custom encryption and decryption functions, communicate with the encryption card for identity authentication, encrypt and decrypt the running data, and return the data after the operation.

[0045] The present invention starts with the internal custom function of the postgres database, combines the encryption card, and uses the database trigger function to integrate the encryption method with the postgres database, realizes non-sensing transparent encryption, and ensures the data security of the database. The postgres database of the present invention combines the encryption card to encrypt and decrypt sensitive data in the database, which can ensure the confidentiality of the data during storage and transmission. Even if the data is illegally obtained, it cannot be easily decrypted, thereby protecting the privacy and security of the data. The integrity of the data is guaranteed. The encryption card can not only encrypt the data, but also provide a data integrity verification function. By signing or verifying the data with the encryption card, it can be ensured that the data has not been tampered with during transmission or storage, thereby ensuring the integrity and authenticity of the data. The encryption card can be used to implement the access control and identity authentication mechanism of the database. Only users holding a specific encryption card can access sensitive data, which increases the difficulty of illegal access and improves the security of the system. And prevent internal leakage. In the database system, sometimes there will be situations where internal personnel leak data. The database encryption technology based on the encryption card can perform fine-grained access control on the data, prevent internal personnel from unauthorized access to sensitive data, thereby reducing the risk of internal leakage. Improved system performance. Encryption cards usually have high-speed processing capabilities, which can quickly complete data encryption and decryption operations, thereby reducing the impact on database performance. At the same time, encryption cards can also provide parallel processing capabilities, further improving the overall performance of the system.

[0046] Custom function library encapsulation, the custom function is located in the postgres database .. / src / tutorial / funcs.c source file. After modification, package the funcs.c file into a dynamic library and copy the dynamic library to pgsql / lib under the database installation path. At this point, the custom function library has been established.

[0047] Open the postgres database and enter CREATE FUNCTION ENCRYPT(text) RETURNStext AS ' / usr / local / pgsql / lib / funcs', 'ENCRYPT' LANGUAGE C STRICT in the command line to create a custom encryption and decryption function. This embodiment uses ENCRYPT as an example to create a custom encryption and decryption function. The C language program of the custom extension library of postgres data needs to add the extension library entry declaration so that it can be correctly recognized and processed by PostgreSQL, that is, first add the following statement: PG MODULE MAGIC; This is a macro used to identify the version and compatibility information of the module. PG_FUNCTION INFO V1(ENCRYPT); This is a macro that declares metadata for a function. Here, it associates the function name ENCRYPT with the function version number v1.

[0048] Write the statement PG_GETARG_TEXT_P(0) at the beginning of the custom encryption and decryption function to pass the original data into the custom ENCRYPT function. The custom encryption and decryption function calls the data acquisition dynamic library to perform encryption and decryption operations on the data. Add the statement PG_RETURN_TEXT_P(text) at the end of the custom ENCRYPT function to return the operated data to the SQL statement.

[0049] Create a trigger function, create a trigger function in the command line, the trigger monitors data running events in real time, and starts the custom encryption function when the data change command is executed. Specifically, the trigger monitors data running events including data addition, modification, query, and deletion. This embodiment monitors data running events according to the trigger. When adding or modifying data events, the custom encryption and decryption function is started to perform encryption operations. The encryption process is made imperceptible to the user through the trigger function. The ciphertext can be stored in the database by adding or modifying the original text. When querying or deleting data events, the custom encryption and decryption function is started to perform decryption operations. The decryption process is made imperceptible to the user through the trigger function. The ciphertext in the database can be obtained imperceptibly by querying or deleting the ciphertext in the database.

[0050] As a preferred solution of this embodiment, the trigger monitors the data running event in real time and starts the custom encryption and decryption function, including: When the trigger detects data addition, modification, query, or deletion events, it starts the custom encryption and decryption function.

[0051] As a preferred solution of this embodiment, the operation data is obtained through a custom encryption and decryption function, and the encryption card is communicated to perform encryption and decryption operations on the operation data, and the data after the operation is returned, such as Figure 2 As shown, including: When listening to data addition or modification events, Get the added or modified plaintext data, that is, pass the plaintext data as a parameter to the custom encryption and decryption function; By calling the data acquisition dynamic library, that is, calling libcurlpost.so, the identity data is obtained for identity authentication. After passing, the encryption card login pass is obtained, that is, the login token is obtained.

[0052] Call libcurlpost.so again based on token, pass the added or modified data to the encryption card for encryption, and obtain the encrypted data ciphertext; Return the ciphertext to the sql statement.

[0053] As another implementation of this embodiment, it includes: When listening to data query or deletion events, Get the ciphertext data to be queried or deleted, that is, pass the ciphertext data as a parameter to the custom encryption and decryption function; By calling the data acquisition dynamic library, that is, calling libcurlpost.so, the identity data is obtained for identity authentication. After passing, the encryption card login pass is obtained, that is, the login token is obtained.

[0054] Call libcurlpost.so again based on token, pass the query or deletion data to the encryption card for decryption, and obtain the decrypted data plaintext; Returns the plain text to the SQL statement.

[0055] This embodiment also discloses a postgres database encryption system based on an encryption card, which is used to implement the above method. The system includes: The monitoring unit monitors the database data running events in real time and starts the custom encryption and decryption functions; Encryption card unit, with built-in encryption algorithm, encrypts and decrypts acquired data; The encryption and decryption unit creates a custom encryption and decryption function, obtains the running data through the custom encryption and decryption function, calls the data acquisition dynamic library to communicate with the encryption card, authenticates the database, encrypts and decrypts the running data, and returns the data after the operation.

[0056] The monitoring unit is connected to the encryption and decryption unit, and the encryption card and the encryption and decryption unit are connected to each other. The monitoring unit monitors the database data operation events in real time. The data operation events include data addition, modification, query, and deletion. When the above command is monitored, the custom encryption and decryption function is started. The monitoring unit uses database triggers to create trigger functions through the command line. The encryption and decryption unit creates a custom encryption and decryption function. First, the custom function library is encapsulated. The custom function is located in the postgres database.. / src / tutorial / funcs.c source file. After modification, the funcs.c file is packaged into a dynamic library and the dynamic library is copied to the pgsql / lib under the database installation path. At this point, the custom function library has been established. Open the postgres database and enter CREATE FUNCTION ENCRYPT(text) RETURNS text AS ' / usr / local / pgsql / lib / funcs', 'ENCRYPT' LANGUAGE C STRICT in the command line; thereby creating a custom encryption and decryption function. The C language program of the custom extension library of postgres data needs to add the extension library entry declaration so that it can be correctly recognized and processed by PostgreSQL. That is, you first need to add the following statement: PG MODULE MAGIC; This is a macro used to identify the version and compatibility information of the module. PG_FUNCTION INFO V1(ENCRYPT); This is a macro used to declare metadata of a function. Here, the function name ENCRYPT is associated with the function version number v1.

[0057] The custom encryption and decryption function writes the statement PG_GETARG_TEXT_P(0) at the beginning to pass the data into the custom ENCRYPT function. The custom encryption and decryption function calls the data acquisition dynamic library to obtain the identity data for identity authentication. After passing the authentication, the encryption card login token is obtained. Based on the token, the dynamic library is called again to encrypt and decrypt the data. Add the PG_RETURN_TEXT_P(text) statement at the end of the custom ENCRYPT function to return the data after the operation to the SQL statement.

[0058] The data acquisition dynamic library is encapsulated according to the data access and acquisition method between the encryption card and the database. Since the encryption card accesses and obtains data through the post request of the http protocol, the curl tool of Linux is used to implement the post request based on the http protocol and encapsulate it into a dynamic library, that is, the data acquisition dynamic library, named libcurlpost.so.

[0059] This embodiment discloses a computer storage medium, which stores a postgres database encryption program. When the postgres database encryption program is executed, the postgres database encryption method based on the encryption card in the above embodiment 1 or 2 is implemented.

[0060] The specific embodiments described herein are merely examples of the spirit of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in similar ways, but they will not deviate from the spirit of the present invention or exceed the scope defined by the appended claims.

[0061] Although this article uses more terms such as custom encryption and decryption functions, encryption cards, triggers, data acquisition dynamic libraries, and data operation events, it does not exclude the possibility of using other terms. These terms are used only to more conveniently describe and explain the essence of the present invention; interpreting them as any additional restrictions is contrary to the spirit of the present invention.

Claims

1. A postgres database encryption method based on an encryption card, characterized in that: The following steps are involved: The trigger monitors data running events in real time and starts the custom encryption and decryption functions; Obtain running data through custom encryption and decryption functions, communicate with the encryption card to perform encryption and decryption operations on the running data, and return the data after the operation.

2. According to claim 1, a postgres database encryption method based on an encryption card is characterized in that: The communication with the encryption card to perform encryption and decryption operations on the operating data includes: By calling the data acquisition dynamic library, the running data is transferred to the encryption card for encryption, and the encrypted data ciphertext is obtained; By calling the data acquisition dynamic library, the running data is transferred to the encryption card for decryption, and the decrypted data plaintext is obtained.

3. The postgres database encryption method based on an encryption card according to claim 2 is characterized in that: The communication with the encryption card to perform encryption and decryption operations on the operating data includes: By calling the data acquisition dynamic library, the identity data is obtained for identity authentication, and after passing, the encrypted card login pass is obtained.

4. A postgres database encryption method based on an encryption card according to claim 2 or 3, characterized in that: According to the data access and acquisition method between the encryption card and the database, a data acquisition dynamic library is encapsulated.

5. A postgres database encryption method based on an encryption card according to claim 1, 2 or 3, characterized in that: Triggers monitor data operation events including data addition, modification, query, and deletion.

6. The postgres database encryption method based on an encryption card according to claim 5 is characterized in that: The trigger monitors data addition or modification events in real time and starts the custom encryption and decryption function; Obtain the added or modified plaintext data, and by calling the data acquisition dynamic library, pass the added or modified data to the encryption card for encryption to obtain the encrypted data ciphertext.

7. The postgres database encryption method based on an encryption card according to claim 5 is characterized in that: The trigger monitors data query or deletion events in real time and starts the custom encryption and decryption function; Get the ciphertext data to be queried or deleted, and transfer the queried or deleted data to the encryption card for decryption by calling the data acquisition dynamic library to obtain the decrypted data plaintext.

8. A postgres database encryption method based on an encryption card according to claim 1, 2 or 3, characterized in that: Create a trigger function, listen to data running events, and start the custom encryption function when the data change command is executed.

9. A postgres database encryption system based on an encryption card, used to implement the method described in any one of claims 1 to 8, characterized in that: include: The monitoring unit monitors the database data running events in real time and starts the custom encryption and decryption functions; Encryption card unit, with built-in encryption algorithm, encrypts and decrypts acquired data; The encryption and decryption unit creates a custom encryption and decryption function, obtains the running data through the custom encryption and decryption function, calls the data acquisition dynamic library to communicate with the encryption card, authenticates the database, encrypts and decrypts the running data, and returns the data after the operation.

10. A computer storage medium, characterized in that: A postgres database encryption program is stored on a computer storage medium, and when the postgres database encryption program is executed, the method as described in any one of claims 1 to 8 is implemented.

Images