Data page decryption method and device, computer equipment and readable storage medium

Abstract

The invention relates to a data page decryption method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: under the condition of receiving an access request for accessing an encrypted target table, obtaining a target value and a secondary key in a table space file corresponding to a master key and the target table; wherein the table space file comprises different data pages; acquiring a page identifier of a target data page in the data pages; determining a target mode from at least two candidate modes based on the page identifier and the target value; and under the condition that the primary key is utilized to decrypt the secondary key to obtain a plaintext secondary key, decrypting the target data page based on the target mode and the plaintext secondary key to obtain data corresponding to the target table. By adopting the method, the security of the data in the database can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device, computer-readable storage medium and computer program product for decrypting a data page. Background Art

[0002] With the development of computer technology and Internet technology, a tablespace encryption algorithm is currently provided in the database field. The master key and secondary key need to be obtained to encrypt the data page. This encryption method effectively avoids the direct use of plaintext on the physical storage, ensuring that even if the encrypted data file is stolen or lost, the attacker cannot directly read the plaintext data, which greatly enhances the security of the data and has been widely used in major databases.

[0003] However, in the current data page decryption method, based on the above-mentioned tablespace encryption scheme, when decrypting the data page, the master key and the secondary key also need to be obtained, so that the data page can be decrypted based on the master key and the secondary key. However, if an extreme scenario occurs, that is, the encrypted data file and the database master key are stolen at the same time, the attacker can use the master key to complete the decryption operation of the data file, thereby causing the plaintext data file to be stolen or lost. Therefore, how to improve the security of data in the database has become an urgent problem to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide a data page decryption method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems, which can effectively improve the security of data in the database.

[0005] In a first aspect, the present application provides a method for decrypting a data page, comprising: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages; obtaining a page identifier of a target data page in the data page; based on the page identifier and the target value, determining a target method from at least two candidate methods; and when decrypting the secondary key using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain data corresponding to the target table.

[0006] In one of the embodiments, before obtaining the master key and the target value and the secondary key in the tablespace file corresponding to the target table, the method also includes: randomly generating a hash value when creating the target table; the hash value belongs to a preset value range; storing the hash value as a target value at a preset position in the header of the tablespace file corresponding to the target table; determining a target mode from at least two candidate modes based on the target value and the page identifier of the data page; encrypting the data page based on the target mode and the plaintext secondary key, and encrypting the plaintext secondary key with the master key to obtain the secondary key, and storing the secondary key in the header of the tablespace file corresponding to the target table.

[0007] In one of the embodiments, obtaining the master key and the target value and the secondary key in the table space file corresponding to the target table includes: obtaining the master key from the memory; obtaining the secondary key from the header of the table space file corresponding to the target table, and obtaining the target value from a preset position in the header.

[0008] In one embodiment, the page identifier includes a page number; determining the target mode from at least two candidate modes based on the page identifier and the target value includes: performing a modulo operation on the page number to obtain a remainder value; performing a bitwise operation on the remainder value and the target value to obtain a result value; and determining the target mode from at least two candidate modes based on the result value.

[0009] In one embodiment, the candidate method includes candidate algorithms; the target method includes a target algorithm; determining the target method from at least two candidate methods based on the result value includes: when the result value is a first value, selecting a first candidate algorithm from at least two candidate algorithms as the target algorithm; wherein the first value is associated with the first candidate algorithm; and when the result value is not the first value, selecting other candidate algorithms from at least two candidate algorithms as the target algorithm.

[0010] In one of the embodiments, the access request carries a client identifier, and the method further includes: when the client corresponding to the client identifier accesses the target table for the first time, verifying the client identifier to obtain a verification result; when the verification result indicates that the verification is passed, sending a response message to the client for prompting to enter password information; when the password information returned by the client is received, matching the password information with a preset password to obtain a matching result; after decrypting the target data page based on the target mode and the plaintext secondary key to obtain the data corresponding to the target table, the method further includes: when the matching result indicates that the match is successful, returning the data corresponding to the target table to the client corresponding to the client identifier.

[0011] In one of the embodiments, the method also includes: receiving a key rotation request; determining an updated master key based on the key rotation request; encrypting the plaintext secondary key using the updated master key to obtain an updated secondary key, and storing the updated secondary key in a header of a tablespace file corresponding to the target table.

[0012] In the second aspect, the present application also provides a data page decryption device, including: an acquisition module, used to obtain a master key and a target value and a secondary key in a table space file corresponding to the target table when an access request for accessing an encrypted target table is received; wherein the table space file includes different data pages; obtaining a page identifier of a target data page in the data page; a determination module, used to determine a target method from at least two candidate methods based on the page identifier and the target value; a decryption module, used to decrypt the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table when the secondary key is decrypted using the master key to obtain a plaintext secondary key.

[0013] In a third aspect, the present application also provides a computer device, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages; obtaining a page identifier of a target data page in the data page; determining a target mode from at least two candidate modes based on the page identifier and the target value; and when decrypting the secondary key using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target mode and the plaintext secondary key to obtain data corresponding to the target table.

[0014] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the following steps when executed by a processor: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages; obtaining a page identifier of a target data page in the data page; determining a target method from at least two candidate methods based on the page identifier and the target value; and when decrypting the secondary key using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain data corresponding to the target table.

[0015] In a fifth aspect, the present application also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages; obtaining a page identifier of a target data page in the data page; determining a target method from at least two candidate methods based on the page identifier and the target value; and when decrypting the secondary key using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain data corresponding to the target table.

[0016] The above-mentioned data page decryption method, device, computer equipment, computer-readable storage medium and computer program product obtain the master key and the target value and secondary key in the table space file corresponding to the target table when receiving an access request for accessing the encrypted target table; wherein the table space file includes different data pages; further, obtain the page identifier of the target data page in the data page, and determine the target mode from at least two candidate modes based on the page identifier and the target value; when the secondary key is decrypted using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target mode and the plaintext secondary key to obtain the data corresponding to the target table. Since the target value and the secondary key are stored in the tablespace file in advance, when an access request for accessing the encrypted target table is received, the target value and the secondary key can be directly obtained from the tablespace file corresponding to the target table, and based on the target value and the page identifiers of different data pages in the same tablespace file, the target mode of different data pages can be determined from at least two candidate modes; when the secondary key is decrypted by using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target mode and the plaintext secondary key to obtain the actual data corresponding to the target table, thereby realizing the mixed use of different target modes for decryption of different data pages in the same tablespace, thereby effectively improving the security of data in the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0018] FIG1 is an application environment diagram of a method for decrypting a data page in one embodiment;

[0019] FIG2 is a schematic flow chart of a method for decrypting a data page in one embodiment;

[0020] FIG3 is a schematic diagram of encryption logic of a hybrid algorithm in one embodiment;

[0021] FIG4 is a schematic diagram of an embodiment of an encryption and decryption process using the sm4 algorithm;

[0022] FIG5 is a schematic diagram of a trusted authentication process in one embodiment;

[0023] FIG6 is a block diagram of a data page decryption device according to an embodiment;

[0024] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0026] The decryption method of the data page provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. When the server 104 receives an access request for accessing the encrypted target table sent by the terminal 102, the server 104 obtains the target value and the secondary key in the table space file corresponding to the master key and the target table; wherein the table space file includes different data pages; further, the server 104 obtains the page identifier of the target data page in the data page, and determines the target method from at least two candidate methods based on the page identifier and the target value; when the server 104 uses the master key to decrypt the secondary key to obtain the plaintext secondary key, the server 104 decrypts the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table, and returns the obtained data corresponding to the target table to the terminal 102. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0027] In an exemplary embodiment, as shown in FIG. 2 , a method for decrypting a data page is provided. The method is described by taking the application of the method to the server in FIG. 1 as an example, and includes the following steps 202 to 206 .

[0028] Step 202: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages.

[0029] The target table refers to a table in a database for storing data. For example, the target table in the present application may be an encrypted data table, that is, access to the target table requires decryption to obtain the data corresponding to the target table.

[0030] The master key refers to the key used to encrypt the secondary key. For example, the encryption key corresponding to data page A is a randomly generated secondary key, which is encrypted by the master key and stored in the header of the tablespace file.

[0031] A table space file refers to a file used to store data pages. For example, the table space file in the present application includes at least different data pages and secondary keys.

[0032] The target value refers to a value pre-stored in a preset position of a table space file corresponding to the target table. For example, in the present application, the target value may be a hash number randomly generated in advance when the target table is created.

[0033] The secondary key refers to a key used to encrypt (or decrypt) a data page. For example, for data page A, the server can encrypt data page A based on the secondary key and the target encryption algorithm to obtain encrypted data page A.

[0034] A data page refers to a page in a database that is used to store actual data records. Pages in a database can be divided into multiple types, and each type of page has different uses. For example, page types include: data pages, index pages, log pages, etc. It can be understood that different data pages in this application can be stored in the same table space file.

[0035] Optionally / exemplarily, when the client first establishes a link with the server, or when the client first sends an access request for accessing an encrypted target table, the server can obtain the client identifier carried in the access request, and perform trusted authentication based on the client identifier. When the trusted authentication succeeds, the server will be triggered to execute the subsequent processing flow, that is, when the trusted authentication succeeds, the server can obtain the master key and the target value and secondary key in the table space file corresponding to the target table. For example, the server can preferentially obtain the master key from its own memory, and obtain the secondary key and target value from the header of the table space file corresponding to the target table. Among them, the table space file in the present application includes different data pages, for example, the table space file includes data page A, data page B and data page C.

[0036] For example, assuming that the server receives an access request from client A for accessing the encrypted target table 1, the server can obtain the client identifier (client A102) carried in the access request 1, and perform trusted authentication based on the client identifier (client A102). Only when the trusted authentication succeeds, the server will execute the subsequent processing flow, that is, when the trusted authentication succeeds, the server first obtains the master key Q from its own memory, and obtains the secondary key M and the target value S=53 from the header of the table space file corresponding to the target table 1. Among them, the table space file includes at least data page A, data page B and data page C.

[0037] Step 204: Obtain a page identifier of a target data page in the data pages.

[0038] The target data page refers to one or more data pages determined from different data pages included in the table space file. For example, if the table space file includes at least data page A, data page B, and data page C, the target data page may be data page A selected from data page A, data page B, and data page C.

[0039] A page identifier refers to an identifier used to identify a unique data page. For example, the page identifier in this application may be a page number.

[0040] Step 206: Determine a target mode from at least two candidate modes based on the page identifier and the target value.

[0041] The candidate method refers to a pre-configured encryption and decryption method or encryption and decryption algorithm. For example, the candidate methods in this application include but are not limited to: an encryption method using the SM4 algorithm and an encryption method using the AES algorithm.

[0042] The target method refers to a specific encryption and decryption method or encryption and decryption algorithm determined from the candidate methods. For example, the target method in this application can be determined from the candidate methods: an encryption method using the sm4 algorithm. It can be understood that the candidate methods and target methods in this application are both methods for encryption (or decryption).

[0043] Optionally / exemplarily, after obtaining the target value and the secondary key in the tablespace file corresponding to the master key and the target table, the server can obtain the page identifier of the target data page from different data pages of the tablespace file. For example, the server can obtain the page number of the target data page from the tablespace file as 002. Further, the server can determine the target mode from at least two candidate modes based on the page identifier and the target value. For example, the server can perform a modulo operation on the page number of the target data page to obtain a remainder value, and perform a bitwise operation on the obtained remainder value and the target value to obtain a result value. The server determines the target mode from at least two candidate modes based on the obtained result value.

[0044] For example, the server first obtains the master key Q from its own memory, and obtains the secondary key M and the target value S=33 (corresponding to binary 0x0000000000010001) from the header of the tablespace file corresponding to the target table 1. Assuming that the tablespace file corresponding to the target table 1 includes at least data page A, data page B, and data page C, the server can obtain the target data page, i.e., data page B, from the tablespace file. The page number is p=50. Further, based on the page identifier (p=50) and the target value (S=53), the server can perform a remainder operation on the page number p=50 of the target data page, i.e., 50 mod 16, to obtain a remainder value 2, and perform a bit operation on the remainder value 2 and the target value S=33 (corresponding to binary 0x0000000000010001) to obtain a result value R. Based on the result value R, the server determines the target method from at least two candidate methods as: the encryption method using the AES algorithm.

[0045] Step 208 , when the secondary key is decrypted using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target mode and the plaintext secondary key to obtain data corresponding to the target table.

[0046] The plaintext secondary key refers to: the actual key obtained by decrypting the encrypted secondary key. For example, the encrypted secondary key is As. After decrypting the (encrypted) secondary key As, the actual key 098999 is obtained. The decrypted actual key 098999 is the plaintext secondary key.

[0047] Optionally / exemplarily, after the server determines the target mode from at least two candidate modes based on the page identifier and the target value, the server can use the obtained master key to decrypt the secondary key to obtain a plaintext secondary key. Further, that is, when the plaintext secondary key is obtained, the server can decrypt the target data page based on the determined target mode and the plaintext secondary key to obtain the plaintext data corresponding to the target table, i.e., the actual data, from the target data page.

[0048] For example, suppose that the server determines the target method from at least two candidate methods: after adopting the encryption method of the AES algorithm, the server can use the obtained master key Q to decrypt the secondary key M to obtain the plaintext secondary key M. Furthermore, that is, when the plaintext secondary key M is obtained, the server can decrypt the target data page based on the determined target method, that is, use the AES algorithm and the plaintext secondary key M to obtain the plaintext data corresponding to the target table, that is, the actual data, from the target data page, and in response to the access request, return the plaintext data corresponding to the target table to the client that sent the access request.

[0049] In this embodiment, when an access request for accessing an encrypted target table is received, a master key and a target value and a secondary key in a table space file corresponding to the target table are obtained; wherein the table space file includes different data pages; further, a page identifier of a target data page in the data page is obtained, and based on the page identifier and the target value, a target mode is determined from at least two candidate modes; when the secondary key is decrypted using the master key to obtain a plaintext secondary key, the target data page is decrypted based on the target mode and the plaintext secondary key to obtain data corresponding to the target table. Since the target value and the secondary key are stored in the tablespace file in advance, when an access request for accessing the encrypted target table is received, the target value and the secondary key can be directly obtained from the tablespace file corresponding to the target table, and based on the target value and the page identifiers of different data pages in the same tablespace file, the target mode of different data pages can be determined from at least two candidate modes; when the secondary key is decrypted by using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target mode and the plaintext secondary key to obtain the actual data corresponding to the target table, thereby realizing the mixed use of different target modes for decryption of different data pages in the same tablespace, thereby effectively improving the security of data in the database.

[0050] In an exemplary embodiment, before obtaining the target value and the secondary key in the table space file corresponding to the primary key and the target table, the method further includes:

[0051] When creating the target table, a hash value is randomly generated; the hash value belongs to a preset value range;

[0052] The hash value is stored as a target value at a preset position in the header of the table space file corresponding to the target table;

[0053] Determine a target mode from at least two candidate modes based on the target value and the page identifier of the data page;

[0054] The data page is encrypted based on the target mode and the plaintext secondary key, and the plaintext secondary key is encrypted using the master key to obtain the secondary key, which is stored in the header of the tablespace file corresponding to the target table.

[0055] The header of the tablespace file refers to the first n rows of data in the tablespace file. For example, the first row and the second row in the tablespace file are used as the header, and the header is used to store the secondary key and the target value.

[0056] The preset position in the header may be a preset specific position, for example, a 2-byte space is reserved in the header for storing the target value.

[0057] Specifically, as shown in Figure 3, it is a schematic diagram of the encryption logic of the hybrid algorithm. That is, as shown in Figure 3, when creating a target table to be encrypted, the server can randomly generate a hash value, and the hash value belongs to a preset value range (0 to 65535). For example, the server can randomly generate a value between 0 and 65535 and record the value as S_RAND. Further, the server can store the value S_RAND as a target value at a preset position in the header of the table space file corresponding to the target table. For example, the server can store the value S_RAND as a target value at a reserved 2-byte space position in the header of the table space file corresponding to the target table; further, the server can determine the target method from at least two candidate methods based on the target value S_RAND and the page identifier of the data page, that is, the page number. For example, the server can perform a modulo operation on the page number of each data page to obtain a modulo value, and perform a bitwise operation on the obtained modulo value and the target value S_RAND to obtain a result value R. Based on the obtained result value R, the server determines the target encryption method for each data page from at least two candidate methods, so that the server can encrypt each data page based on the determined target encryption method and the plaintext secondary key, and use the master key to encrypt the plaintext secondary key to obtain the encrypted secondary key, and store the encrypted secondary key in the header of the table space file corresponding to the target table. As a result, the encryption method of different data pages can be dynamically determined through the page identifiers of different data pages and the randomly generated target values, realizing an encryption method in which different data pages in the same table space use a mixed SM4 and AES algorithm, thereby effectively improving the security of data in the database.

[0058] In an exemplary embodiment, the step of obtaining the target value and the secondary key in the table space file corresponding to the primary key and the target table includes:

[0059] Get the master key from memory;

[0060] The secondary key is obtained from the header of the table space file corresponding to the target table, and the target value is obtained from a preset position in the header.

[0061] Specifically, when the server receives an access request for accessing the encrypted target table for the first time, the server can read the master key from the local or remote end, and then load the master key into the memory, so that when the master key is used subsequently, the server can directly read the master key from the memory, effectively avoiding the time overhead caused by re-reading the master key from the remote end each time the encrypted table is accessed, thereby improving execution efficiency and data processing efficiency; further, the server can obtain the secondary key from the header of the table space file corresponding to the target table, and obtain the target value from the preset position in the header. For example, assuming that when creating a target table that needs to be encrypted, the server stores the randomly generated hash value S_RAND as the target value at the reserved 2-byte space position in the header of the table space file corresponding to the target table, and stores the encrypted secondary key in the header of the table space file corresponding to the target table, then the server can obtain the target value, i.e., S_RAND, from the reserved 2-byte space position in the header of the table space file corresponding to the target table, and obtain the encrypted secondary key from the header of the table space file corresponding to the target table. As a result, the encryption method of different data pages can be dynamically determined through the page identifiers of different data pages and the randomly generated target values, and an encryption method that mixes the SM4 and AES algorithms for different data pages in the same table space is implemented, thereby effectively improving the security of data in the database.

[0062] In an exemplary embodiment, the page identifier includes a page number; and the step of determining a target mode from at least two candidate modes based on the page identifier and the target value includes:

[0063] Perform a remainder operation on the page number to obtain the remainder value;

[0064] Perform bitwise operation on the remainder value and the target value to obtain the result value;

[0065] Based on the result value, a target mode is determined from at least two candidate modes.

[0066] Specifically, assuming that the server obtains the master key Q from its own memory, obtains the secondary key M and the target value S=33 (the corresponding binary value is 0x0000000000010001) from the header of the tablespace file corresponding to the target table 1, and obtains the target data page, that is, the page number of data page B, p=50 from the tablespace file, as shown in the processing flow in FIG3 , the server can perform a modulo operation on the page number p=50 of the target data page based on the page identifier (p=50) and the target value (S=53), that is, 50mod16, to obtain a remainder value 2, and perform a bit operation on the obtained remainder value 2 and the target value S=33 (the corresponding binary value is 0x0000000000010001) to obtain a result value R. Based on the obtained result value R, the server determines the target method from at least two candidate methods as: an encryption method using the AES algorithm.

[0067] The calculation method of the result value R in the embodiment of the present application can be shown in the following formula:

[0068] R = S_RAND| (1 << (PAGE_NO mod 16)

[0069] When R is 1, the SM4 algorithm is used, otherwise the AES algorithm is used; S_RAND is the target value stored in the header, and PAGE_NO is the page number of the data page.

[0070] In this embodiment, the encryption algorithms of different data pages can be dynamically determined through the page identifier of the data page and the randomly generated target value, thereby realizing an encryption method in which different data pages in the same table space use a mixed use of the SM4 and AES algorithms, thereby effectively improving the security of the data in the database.

[0071] In an exemplary embodiment, the candidate mode includes a candidate algorithm; the target mode includes a target algorithm; and the step of determining the target mode from at least two candidate modes based on the result value includes:

[0072] When the result value is a first value, selecting a first candidate algorithm from at least two candidate algorithms as a target algorithm; wherein the first value has an association relationship with the first candidate algorithm;

[0073] When the result value is not the first value, another candidate algorithm is selected from at least two candidate algorithms as the target algorithm.

[0074] The first value may include 1 or 5. The association relationship between the first value and the first candidate algorithm may be a preset mapping relationship. For example, when the result value is the first value, the first candidate algorithm, ie, the sm4 algorithm, is used.

[0075] Specifically, as shown in FIG4 , it is a schematic diagram of using the SM4 algorithm for encryption and decryption processing. Assuming that the candidate algorithms include two encryption algorithms, namely the SM4 algorithm and the AES algorithm, and the first value is associated with the SM4 algorithm, then when the result value R is the first value, the server can select the first candidate algorithm, namely the SM4 algorithm, from at least two candidate algorithms, namely the SM4 algorithm and the AES algorithm as the target algorithm; wherein the first value (1 or 5) is associated with the first candidate algorithm, namely the SM4 algorithm; when the result value R is not the first value, the server selects other candidate algorithms, namely the AES algorithm, from at least two candidate algorithms, namely the SM4 algorithm and the AES algorithm as the target algorithm. As a result, the encryption algorithms of different data pages can be dynamically determined through the page identifier of the data page and the randomly generated target value, realizing an encryption method in which different data pages in the same table space use a mixed use of the SM4 and AES algorithms, thereby effectively improving the security of data in the database.

[0076] In an exemplary embodiment, the access request carries a client identifier, and the method further includes:

[0077] When the client corresponding to the client identifier accesses the target table for the first time, the client identifier is verified to obtain a verification result;

[0078] When the verification result indicates that the verification is passed, a response message is sent to the client to prompt for password information input;

[0079] When receiving the password information returned by the client, the password information is matched with the preset password to obtain a matching result;

[0080] After decrypting the target data page based on the target mode and the plaintext secondary key to obtain data corresponding to the target table, the method further includes:

[0081] When the matching result indicates a successful match, the data corresponding to the target table is returned to the client corresponding to the client identifier.

[0082] When the matching result indicates a matching failure, a prompt message indicating that access is denied is returned.

[0083] Specifically, as shown in FIG5 , it is a flow chart of trusted authentication. When the server receives the access request for accessing the encrypted target table sent by the client for the first time, the server can obtain the client identifier carried by the access request, that is, when the client corresponding to the client identifier establishes interaction with the server for the first time or accesses the data for the first time, the server needs to verify the client identifier and obtain the verification result; when the verification result indicates that the verification is passed, the server can send a response message to the client for prompting to enter the password information; when receiving the password information returned by the client, the server can match the password information returned by the client with the preset password to obtain the matching result; when the matching result indicates that the match is successful, it indicates that the client has passed the trusted authentication, and the subsequent server can return the data corresponding to the target table obtained after decryption to the client corresponding to the client identifier; when the matching result indicates that the match fails, it indicates that the client cannot pass the trusted authentication, and the server can return a prompt message of denying access. As a result, by configuring the process of password authentication required for access to the encrypted table, the management of the visible row range of the subdivided encrypted data is realized, and users who cannot pass the password authentication have no authority to view the data, further improving the security of the data.

[0084] In an exemplary embodiment, the method further comprises:

[0085] Receive key rotation requests;

[0086] Determining to update the master key based on the key rotation request;

[0087] The plaintext secondary key is encrypted using the updated master key to obtain an updated secondary key, and the updated secondary key is stored in the header of the table space file corresponding to the target table.

[0088] Among them, the key rotation request refers to a request for replacing the master key. For example, when the master key is not secure, the user (user or administrator) can initiate a key rotation request.

[0089] Specifically, the server receives the key rotation request sent by the client, and determines to update the master key based on the key rotation request. For example, the server updates the master key A to the master key B, and uses the updated master key B to encrypt the plaintext secondary key Q to obtain the encrypted updated secondary key B+Q, and stores the encrypted updated secondary key B+Q in the header of the table space file corresponding to the target table, thus completing the key rotation and update. As a result, the server only needs to re-encrypt the secondary key update with the new master key, avoiding the huge overhead of re-encrypting all encrypted table space data pages in the database, and effectively improving the processing efficiency of key updates.

[0090] In an exemplary embodiment, the method provided in the embodiment of the present application can be applied to decryption or encryption of data pages in various scenarios. The following encryption and decryption scenarios of different data pages in the same table space in the database are taken as an example to illustrate the decryption method of the data page provided in the embodiment of the present application.

[0091] Problems and disadvantages of traditional methods include:

[0092] Currently, a traditional tablespace encryption algorithm is provided in the database field. A master key is stored on the server or elsewhere. The encryption and decryption key of the actual data page is a randomly generated secondary key (also called tablespace key), which is encrypted by the master key and stored in the tablespace header. Encrypting the data page with the secondary key in the tablespace avoids the direct use of plaintext on the physical storage, ensuring that even if the data file is stolen or lost, the attacker cannot directly read the plaintext data, greatly enhancing the security of the data, and has been widely used in major databases.

[0093] However, if an extreme scenario occurs, that is, the data file and the master key are stolen at the same time, the attacker can complete the decryption of the data file by combining the general default algorithm. This is unacceptable to users who are highly sensitive to security requirements. That is, if the database master key is stolen, the attacker can directly decrypt the file data, which will cause the plaintext data file to be stolen or lost. Therefore, how to improve the security of data in the database has become an urgent problem to be solved.

[0094] Therefore, in order to solve the above problems, based on the traditional tablespace encryption scheme, this application provides a more secure hybrid encryption method for data pages, which prevents the attacker from decrypting the plaintext data by combining the default encryption algorithm when the master key and data file are lost at the same time. At the same time, it provides trusted authentication capabilities, and only the client authentication password is allowed to query the encrypted table data, further enhancing the security of the data.

[0095] That is, the purpose of this application is to provide a hybrid encryption method for data pages, which combines the page number of the data page and the random hash added in the table space header to achieve the purpose of hybrid encryption by mixing the SM4 and AES algorithms for different data pages in the same table space. At the same time, trusted authentication is implemented on the server side, allowing password authentication to be configured for access to encrypted tables, so as to further improve data security.

[0096] As shown in FIG3 , a hybrid encryption method for a data page provided in an embodiment of the present application specifically includes:

[0097] 1. Master key acquisition module: After the server reads the master key from the local or remote end, it loads the key information into the memory to avoid the overhead of re-reading the key every time the encryption table is accessed, thereby improving execution efficiency.

[0098] 2. Encryption and decryption processing module: modify the table space header content, add 2 bytes (16 bits) of space in the reserved part as a random hash number. When encrypting, the page number and the random value are used to determine whether to use the AES or SM4 algorithm to encrypt and decrypt the data page. The specific process is as follows:

[0099] (1) When creating a table (encrypted table), a value between 0 and 65535 is randomly generated at the head of the table space, recorded as S_RAND, and stored in this position as a bitmap for subsequent arithmetic operations;

[0100] (2) Use the data page number, denoted as PAGE_NO, to take the remainder of 16 to obtain the remainder N, and then perform a bit operation on the remainder N and the random number S_RAND. If the Nth bit from the right of the binary corresponding to S_RAND is 1, the SM4 algorithm is used, otherwise the AES algorithm is used. The total formula is R = S_RAND | (1 << (PAGE_NO mod 16)). The specific processing flow is shown in FIG3.

[0101] (3) If the result R is 1, the SM4 algorithm is used, otherwise the AES algorithm is used. After determining the algorithm to be used, the data page is encrypted or decrypted. A simple example is as follows: S_RAND = 33 (the corresponding binary number is 0x0000000000010001). If PAGE_NO = 50, 50 mod 16 is 2, and the second bit from the right of the binary number corresponding to S_RAND is 0, so the AES algorithm is used. Similarly, if PAGE_NO = 49, the SM4 algorithm is used;

[0102] (4) When it comes to splitting and merging data pages, since the pages in the memory are already decrypted content, they can be decrypted and stored according to the rules of step 2.

[0103] 3. Key rotation module: If the user feels that the master key is not secure, he can initiate a key rotation request. After receiving the request, the server only needs to re-encrypt the secondary key update, avoiding the huge overhead of re-encrypting all encrypted tablespace data pages in the database.

[0104] 4. Trusted authentication module: After configuring password authentication for access to the encrypted table, as shown in Figure 5, when the server accesses the encrypted table for the first time in the session, it will verify whether the client is a trusted client. If it is trusted, it will initiate the password authentication process, prompt the user to enter the SMS password, and match the user password information with the password sent back by the remote end. If the client is not a trusted client or the password authentication fails, the user cannot access the relevant content of the encrypted table. After passing, the relevant operations of the encrypted table are audited. This operation subdivides the management of the visible row range of encrypted data and improves the security level of the encrypted table.

[0105] The hybrid encryption method for a data page provided by the present invention has the following advantages:

[0106] 1. Since different data pages in the same tablespace use a mixture of SM4 and AES encryption methods, even if a database is dragged or the master key is lost, attackers cannot directly decrypt the data page using a single algorithm, which provides higher security.

[0107] 2. Configured server-side trusted authentication, namely the server-side trusted authentication configuration and client interaction logic, subdivided the management of the visibility range of encrypted data. Users who cannot pass the password authentication have no permission to view the data, further improving security.

[0108] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0109] Based on the same inventive concept, the embodiment of the present application also provides a data page decryption device for implementing the data page decryption method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiment of the decryption device for one or more data pages provided below can refer to the limitations of the data page decryption method above, and will not be repeated here.

[0110] In an exemplary embodiment, as shown in FIG6 , a data page decryption device is provided, including: an acquisition module 602 , a determination module 604 and a decryption module 606 , wherein:

[0111] The acquisition module 602 is used to obtain the target value and the secondary key in the table space file corresponding to the master key and the target table when receiving an access request for accessing the encrypted target table; wherein the table space file includes different data pages; and obtain the page identifier of the target data page in the data page.

[0112] The determination module 604 is configured to determine a target mode from at least two candidate modes based on the page identifier and the target value.

[0113] The decryption module 606 is used to decrypt the target data page based on the target mode and the plaintext secondary key to obtain the data corresponding to the target table when the secondary key is decrypted by the master key to obtain the plaintext secondary key.

[0114] In one embodiment, the device also includes: a generation module, which is used to randomly generate a hash value when creating the target table; the hash value belongs to a preset value range; a storage module, which is used to store the hash value as a target value at a preset position in the header of the table space file corresponding to the target table; the determination module is also used to determine the target mode from at least two candidate modes based on the target value and the page identifier of the data page; an encryption module, which is used to encrypt the data page based on the target mode and the plaintext secondary key, and use the master key to encrypt the plaintext secondary key to obtain the secondary key; the storage module is also used to store the secondary key in the header of the table space file corresponding to the target table.

[0115] In one embodiment, the acquisition module is further used to acquire the master key from the memory; acquire the secondary key from the header of the table space file corresponding to the target table, and acquire the target value from a preset position in the header.

[0116] In one embodiment, the page identifier includes a page number; the device also includes: an operation module, used to perform a modulo operation on the page number to obtain a remainder value; perform a bit operation on the remainder value and the target value to obtain a result value; the determination module is also used to determine the target mode from at least two candidate modes based on the result value.

[0117] In one embodiment, the candidate mode includes candidate algorithms; the target mode includes a target algorithm; the device also includes: a selection module, used to select a first candidate algorithm from at least two of the candidate algorithms as the target algorithm when the result value is a first value; wherein the first value has an association with the first candidate algorithm; when the result value is not the first value, select other candidate algorithms from at least two of the candidate algorithms as the target algorithm.

[0118] In one embodiment, the access request carries a client identifier, and the device further includes: a verification module, which is used to verify the client identifier and obtain a verification result when the client corresponding to the client identifier accesses the target table for the first time; a sending module, which is used to send a response message to the client for prompting the client to enter password information when the verification result indicates that the verification is passed; a matching module, which is used to match the password information with a preset password when receiving the password information returned by the client to obtain a matching result; the sending module is also used to return the data corresponding to the target table to the client corresponding to the client identifier when the matching result indicates that the match is successful.

[0119] Each module in the above data page decryption device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0120] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store decrypted data of a data page. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for decrypting a data page is implemented.

[0121] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In an exemplary embodiment, in one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0123] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0124] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0125] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0126] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0127] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0128] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for decrypting a data page, characterized in that: The method comprises: When receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages; Obtaining a page identifier of a target data page in the data pages; Determine a target mode from at least two candidate modes based on the page identifier and the target value; When the secondary key is decrypted by using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target mode and the plaintext secondary key to obtain data corresponding to the target table.

2. The method according to claim 1, characterized in that Before obtaining the master key and the target value and the secondary key in the table space file corresponding to the target table, the method further includes: When creating the target table, a hash value is randomly generated; the hash value belongs to a preset value range; The hash value is stored as a target value at a preset position in the header of the table space file corresponding to the target table; Determining a target mode from at least two candidate modes based on the target value and the page identifier of the data page; The data page is encrypted based on the target mode and the plaintext secondary key, and the plaintext secondary key is encrypted using the master key to obtain the secondary key, which is stored in the header of the tablespace file corresponding to the target table.

3. The method according to claim 2, characterized in that The step of obtaining the master key and the target value and the secondary key in the table space file corresponding to the target table includes: Retrieving the master key from memory; The secondary key is obtained from a header of a table space file corresponding to the target table, and the target value is obtained from a preset position in the header.

4. The method according to claim 1, characterized in that: The page identifier includes a page number; The determining of the target mode from at least two candidate modes based on the page identifier and the target value includes: Performing a remainder operation on the page number to obtain a remainder value; Performing a bitwise operation on the remainder value and the target value to obtain a result value; Based on the result value, a target mode is determined from at least two candidate modes.

5. The method according to claim 4, characterized in that The candidate mode includes a candidate algorithm; the target mode includes a target algorithm; The determining of a target mode from at least two candidate modes based on the result value includes: When the result value is a first value, selecting a first candidate algorithm from at least two of the candidate algorithms as the target algorithm; wherein the first value is associated with the first candidate algorithm; When the result value is not the first value, another candidate algorithm is selected from at least two of the candidate algorithms as the target algorithm.

6. The method according to claim 1, characterized in that The access request carries a client identifier, and the method further includes: When the client corresponding to the client identifier accesses the target table for the first time, verifying the client identifier to obtain a verification result; When the verification result indicates that the verification is passed, a response message for prompting the client to input password information is sent; When receiving the password information returned by the client, matching the password information with the preset password to obtain a matching result; After decrypting the target data page based on the target mode and the plaintext secondary key to obtain data corresponding to the target table, the method further includes: When the matching result indicates a successful match, the data corresponding to the target table is returned to the client corresponding to the client identifier.

7. A data page decryption device, characterized in that: The device comprises: An acquisition module is used to, upon receiving an access request for accessing an encrypted target table, acquire a master key and a target value and a secondary key in a table space file corresponding to the target table; wherein the table space file includes different data pages; and acquire a page identifier of a target data page in the data pages; A determination module, configured to determine a target mode from at least two candidate modes based on the page identifier and the target value; The decryption module is used to decrypt the target data page based on the target mode and the plaintext secondary key to obtain the data corresponding to the target table when the master key is used to decrypt the secondary key to obtain the plaintext secondary key.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images