Data warehouse management method and device, computer equipment and storage medium

Abstract

The invention provides a data warehouse management method and device, computer equipment and a storage medium. The method comprises the steps of obtaining attribute information of a target data warehouse; determining a target encryption transformation strategy for encrypting and transforming the target data warehouse from a plurality of encryption transformation strategies according to the attribute information; and according to the target encryption transformation strategy, performing encryption transformation on the target data warehouse, so that all sensitive data in the target data warehouse is switched from plaintext sensitive data to ciphertext sensitive data. According to the invention, the encryption transformation flexibility of the data warehouse is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data warehouse management method, device, computer equipment and storage medium. Background Art

[0002] Data warehouses are used to help enterprises better manage, understand and utilize data resources, and have the functions of data storage, management and analysis. For example, financial enterprises use data warehouses to store customer data, insurance policy data and customer information image data, and medical organizations use data warehouses to store patient case data, medical image data and medical personnel data. With the development of the Internet and the advent of the big data era, the risks caused by the leakage of sensitive data such as mobile phone numbers, ID numbers, bank card numbers, email addresses and addresses will become more and more serious.

[0003] In order to prevent the leakage of sensitive data, it is currently implemented through table-level permission control in the data warehouse, that is, to ensure that the relevant data is not accessed by authorized personnel. When developers have access to the table, they will also have the ability to view sensitive data, and there will also be the possibility of customer privacy leakage, resulting in the security assessment of the data warehouse not meeting the requirements of national regulations. Therefore, it is necessary to encrypt the built data warehouse, but the current encryption transformation method of the data warehouse is single and cannot meet the encryption transformation needs of various data warehouses. The flexibility of the encryption transformation of the data warehouse is poor. Summary of the invention

[0004] The embodiments of the present application provide a data warehouse management method, apparatus, computer equipment and storage medium, aiming to improve the flexibility of encryption transformation of the data warehouse.

[0005] In a first aspect, an embodiment of the present application provides a data warehouse management method, including:

[0006] Acquire attribute information of a target data warehouse, where the target data warehouse is a data warehouse to be encrypted and transformed;

[0007] Determining, according to the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse from a plurality of encryption transformation strategies;

[0008] According to the target encryption transformation strategy, the target data warehouse is encrypted and transformed so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

[0009] In a second aspect, an embodiment of the present application further provides a data warehouse management device, the data warehouse management device comprising:

[0010] An information acquisition module, used to acquire attribute information of a target data warehouse, wherein the target data warehouse is a data warehouse to be encrypted and transformed;

[0011] A strategy determination module, used to determine a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies according to the attribute information;

[0012] The data warehouse transformation module is used to perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

[0013] In a third aspect, an embodiment of the present application further provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the data warehouse management method as described in the first aspect is implemented.

[0014] In a fourth aspect, an embodiment of the present application further provides a storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the data warehouse management method as described in the first aspect is implemented.

[0015] The embodiments of the present application provide a data warehouse management method, apparatus, computer equipment and storage medium. The embodiments of the present application can flexibly select a target encryption transformation strategy that matches the attribute information of the target data warehouse from multiple encryption transformation strategies for encrypting and transforming the target data warehouse, and then encrypt and transform the target data warehouse according to the target encryption transformation strategy, thereby effectively improving the flexibility of the encryption transformation of the data warehouse. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a flowchart of a data warehouse management method provided by an embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of encryption transformation of a data warehouse in an embodiment of the present application;

[0019] Figure 3 is another schematic diagram of encryption transformation of a data warehouse in an embodiment of the present application;

[0020] Figure 4 is another schematic diagram of encryption transformation of a data warehouse in an embodiment of the present application;

[0021] Figure 5 is a schematic block diagram of a data warehouse management device provided in an embodiment of the present application;

[0022] Figure 6 It is a schematic block diagram of the structure of a computer device provided in an embodiment of the present application.

[0023] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0026] Currently, this is achieved through table-level permission control in the data warehouse, that is, to ensure that the relevant data is not accessible to authorized personnel. When developers have table access permissions, they will also have the ability to view sensitive data, and there will also be the possibility of customer privacy leakage, resulting in the security assessment of the data warehouse not meeting the requirements of national regulations. Therefore, it is necessary to encrypt the built data warehouse, but the current encryption transformation method of the data warehouse is single and cannot meet the encryption transformation needs of various data warehouses. The flexibility of the encryption transformation of the data warehouse is poor.

[0027] To solve the above problems, the embodiments of the present application provide a data warehouse management method, apparatus, computer equipment and storage medium. The embodiments of the present application can flexibly select a target encryption transformation strategy for encrypting and transforming the target data warehouse from multiple encryption transformation strategies through the attribute information of the target data warehouse, and then perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, which effectively improves the flexibility of encryption transformation of the data warehouse.

[0028] The data warehouse management method can be applied to computer equipment, which may include a server or a terminal device, and the terminal device may be a mobile phone, a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, a wearable device, etc. The server may be an independent server, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0029] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0030] See also Figure 1 , Figure 1 The present invention provides a flow chart of a data warehouse management method provided in an embodiment of the present invention. The data warehouse management method is applied to computer equipment.

[0031] like Figure 1 As shown, the data warehouse management method includes steps S101 to S103.

[0032] Step S101: Obtain attribute information of the target data warehouse.

[0033] In this embodiment, the target data warehouse is a data warehouse to be encrypted and transformed. The data warehouse to be encrypted and transformed can be a data warehouse used by financial enterprises to store customer data, insurance policy data, and customer information image data, etc., or a data warehouse used by medical organizations to store patient case data, medical image data, and medical personnel data, etc. It is understandable that before the target data warehouse is encrypted and transformed, all sensitive data in the target data warehouse are plaintext sensitive data. Among them, sensitive data may include mobile phone numbers, certificate numbers (ID numbers), bank card numbers, email addresses, and addresses, etc.

[0034] In some embodiments, the attribute information of the target data warehouse includes at least one of the available system resources and the amount of data stored in the target data warehouse. Alternatively, the attribute information of the target data warehouse includes at least one of the available system resources, the number of data tables, and the amount of data stored in the target data warehouse. The available system resources of the target data warehouse include the available computing resources and available storage resources of the target data warehouse, the number of data tables of the target data warehouse is the total number of plaintext data tables in the target data warehouse, and the amount of data stored in the target data warehouse refers to the size of the data stored in the target data warehouse.

[0035] In some embodiments, obtaining the attribute information of the target data warehouse may include: the computer device sends an attribute information query instruction to the target data warehouse, so that the target data warehouse queries the attribute information according to the attribute information query instruction, and sends the queried attribute information to the computer device; the computer device obtains the attribute information sent by the target data warehouse. This embodiment can accurately obtain the attribute information of the target data warehouse.

[0036] In some embodiments, obtaining the attribute information of the target data warehouse may include: the computer device obtains the attribute information of the target data warehouse from a mapping relationship table between the data warehouse identification information and the attribute information according to the identification information of the target data warehouse. The mapping relationship table between the data warehouse identification information and the attribute information is established in advance according to the attribute information and identification information of each data warehouse. This embodiment can quickly obtain the attribute information of the target data warehouse.

[0037] In some embodiments, the data warehouse management method further includes: the computer device obtains an attribute information update instruction sent by the data warehouse, the attribute update instruction includes a data warehouse identifier and the latest attribute information; the attribute information corresponding to the data warehouse identifier in the mapping relationship table is updated to the latest attribute information to update the mapping relationship table. Wherein, when the attribute information of the data warehouse changes, the data warehouse obtains its own data warehouse identifier and the latest attribute information, and sends an attribute information update instruction carrying the data warehouse identifier and the latest attribute information to the computer device.

[0038] Step S102: Determine a target encryption transformation strategy for encrypting and transforming a target data warehouse from a plurality of encryption transformation strategies according to the attribute information.

[0039] In this embodiment, the multiple encryption transformation strategies include a first encryption transformation strategy, a second encryption transformation strategy, and a third encryption transformation strategy. Among them, the first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a corresponding first ciphertext data table for each plaintext data table in the target data warehouse, all sensitive data in the first ciphertext data table are ciphertext sensitive data, and all table fields in the first ciphertext data table are plaintext table fields.

[0040] The second encryption transformation strategy is used to create a corresponding first ciphertext data table for each plaintext data table located in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext field and ciphertext sensitive data corresponding to the first ciphertext table field to each plaintext data table located in the processing layer of the target data warehouse. The first ciphertext field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table.

[0041] The third encryption transformation strategy is used to encrypt and transform each plaintext data table in the target data warehouse by adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from the upstream ciphertext data table of the plaintext data table.

[0042] It is understandable that the first encryption transformation strategy is applicable to data warehouses with many downstream related parties, data warehouses at the most upstream of the big data task chain, and / or scenarios where the available system resources of the cluster where the data warehouse is located are sufficient. The second encryption transformation strategy is applicable to scenarios where the transformation task volume is large and / or the available system resources of the cluster occupied by the data warehouse are large (the available system resources of the cluster where the data warehouse is located are insufficient). The third encryption transformation strategy is applicable to scenarios where a large number of data tables in the data warehouse need to be encrypted in high parallelism.

[0043] In some embodiments, based on the attribute information, determining a target encryption transformation strategy for encrypting and transforming a target data warehouse from a plurality of encryption transformation strategies may include: selecting a first encryption transformation strategy in response to the amount of data being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold. The first threshold and the second threshold may be set based on actual conditions, and the embodiments of the present application do not specifically limit this. This embodiment may improve the efficiency of encryption transformation of the data warehouse by using a newly created ciphertext data table to encrypt and transform the data warehouse when more available system resources are available and / or the amount of stored data is less.

[0044] In some embodiments, according to the attribute information, determining the target encryption transformation strategy for encryption transformation of the target data warehouse from multiple encryption transformation strategies may include: in response to the amount of data being greater than a first threshold and / or the available system resources being less than a second threshold, selecting a second encryption transformation strategy. This embodiment performs encryption transformation on the data warehouse in combination with a newly created ciphertext data table and a newly added ciphertext field when the available system resources are small and / or the amount of stored data is large, thereby ensuring the efficiency of the encryption transformation of the data warehouse while reducing the system resources required for the encryption transformation of the data warehouse.

[0045] In some embodiments, the attribute information of the target data warehouse includes the number of data tables and available system resources of the target data warehouse. According to the attribute information, determining the target encryption transformation strategy for encryption transformation of the target data warehouse from multiple encryption transformation strategies may include: in response to the number of data tables being less than or equal to a third threshold, and the available system resources being greater than or equal to a second threshold, selecting the first encryption transformation strategy. This embodiment improves the efficiency of encryption transformation of the data warehouse by using a newly created ciphertext data table to encrypt the data warehouse when the number of data tables is small and the available system resources are large.

[0046] In some embodiments, based on attribute information, determining a target encryption transformation strategy for encrypting and transforming a target data warehouse from multiple encryption transformation strategies may include: in response to the number of data tables being less than or equal to a third threshold and the available system resources being less than a second threshold, selecting a second encryption transformation strategy; this embodiment encrypts and transforms the data warehouse by combining the creation of new ciphertext data tables and the addition of new ciphertext fields when the number of data tables and the available system resources are small, thereby ensuring the efficiency of the encryption transformation of the data warehouse while reducing the system resources required for the encryption transformation of the data warehouse.

[0047] In some embodiments, according to the attribute information, determining the target encryption transformation strategy for encryption transformation of the target data warehouse from the multiple encryption transformation strategies may include: in response to the number of data tables being greater than a third threshold, selecting the third encryption transformation strategy. In this embodiment, by using a newly added ciphertext field to encrypt the data warehouse when the number of data tables is large, not only the efficiency of the encryption transformation of the data warehouse is improved, but also the system resources required for the encryption transformation of the data warehouse can be reduced.

[0048] Step S103: According to the target encryption transformation strategy, the target data warehouse is encrypted and transformed so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

[0049] This embodiment uses the attribute information of the target data warehouse to flexibly select a target encryption transformation strategy that matches the target data warehouse from multiple encryption transformation strategies, and then encrypts the target data warehouse according to the target encryption transformation strategy, effectively improving the flexibility of the encryption transformation of the data warehouse.

[0050] In some embodiments, the target encryption transformation strategy is the first encryption transformation strategy, and according to the target encryption transformation strategy, the target data warehouse is encrypted and transformed, including: creating a first ciphertext data table corresponding to each plaintext data table in the target data warehouse, the plaintext data table and the corresponding first ciphertext data table access the same upstream business data, and the sensitive data in the plaintext data table is plaintext, and the sensitive data in the corresponding first ciphertext data table is ciphertext; for each plaintext data table, the caller of the plaintext data table is controlled to switch the called plaintext data table to the first ciphertext data table; in response to the caller of the plaintext data table having switched the called plaintext data table to the first ciphertext data table, the plaintext data table is deleted. This embodiment can complete the encryption transformation of the data warehouse without affecting the business, thereby improving the convenience of encryption transformation of the data warehouse and the business reliability.

[0051] For example, the target data warehouse stores Figure 2 (a) shows a plaintext data table table_01, which includes plaintext table fields field_01, field_02, and field_03, as well as plaintext non-sensitive data normal_data_01, normal_data_02, and sensitive_data. Figure 2 As shown in (b), a first ciphertext data table table_02 corresponding to the plaintext data table table_01 is newly created in the target data warehouse. The first ciphertext data table table_02 includes plaintext table fields field_01, plaintext table fields field_02 and plaintext table fields field_03 as well as plaintext non-sensitive data normal_data_01, plaintext non-sensitive data normal_data_02 and ciphertext sensitive data encrypt_sensitive_data (obtained by encrypting the plaintext sensitive data sensitive_data). Then, the plaintext data table table_01 is deleted from the target data warehouse. The target data warehouse only includes Figure 2 (c) shows the first ciphertext data table table_02.

[0052] In some embodiments, creating a first ciphertext data table corresponding to a plaintext data table in a target data warehouse may include: creating a blank data table in the target data warehouse, connecting the upstream business data connected to the plaintext data table to the blank data table, and obtaining a new plaintext data table; encrypting all sensitive data in the new plaintext data table according to a preset encryption function, and obtaining a corresponding first ciphertext data table. The preset encryption function can be set based on actual conditions, and the embodiments of the present application do not specifically limit this. For example, the preset encryption function is a national secret algorithm such as SM1 or SM3.

[0053] In some embodiments, the target encryption transformation strategy is a second encryption transformation strategy. According to the target encryption transformation strategy, the target data warehouse is encrypted and transformed, including: creating a first ciphertext data table corresponding to each first plaintext data table in the target data warehouse, the first plaintext data table is located in the source layer of the target data warehouse; adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field in each second plaintext data table to obtain a corresponding second ciphertext data table, the second plaintext data table is located in the processing layer of the target data warehouse, the first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table; for each first Plaintext data table, control the caller of the first plaintext data table to switch the called first plaintext data table to the corresponding first ciphertext data table; in response to the caller of the first plaintext data table having switched the called first plaintext data table to the corresponding first ciphertext data table, delete the first plaintext data table; for each second ciphertext data table, control the caller of the first plaintext table field in the second ciphertext data table to switch the referenced first plaintext table field to the corresponding first ciphertext table field; in response to the caller of the first plaintext table field in the second ciphertext data table having switched the referenced first plaintext table field to the first ciphertext table field, delete the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field from the second ciphertext data table. This embodiment can complete the encryption transformation of the data warehouse without affecting the business, improve the convenience of the encryption transformation of the data warehouse and the business reliability, and the encryption transformation of some data tables is carried out by adding ciphertext fields, reducing the consumption of system resources.

[0054] For example, the target data warehouse stores Figure 3 (a) shows the first plaintext data table table_11 located at the source layer and the second plaintext data table table_21 located at the processing layer. The second plaintext data table table_21 includes plaintext table field field_01, plaintext table field field_02 and plaintext table field field_03, and the plaintext table field field_01, plaintext table field field_02 and plaintext table field field_03 are transferred from the upstream first plaintext data table table_11. Therefore, Figure 3 As shown in (b), first create a first ciphertext data table table_12 corresponding to the first plaintext data table table_11.

[0055] Then as Figure 3As shown in (c), the first plaintext data table table_11 is deleted, and the first ciphertext table field field_03_enc (obtained by encrypting the plaintext table field field_03 in the first ciphertext data table table_12 according to the preset encryption function) and the ciphertext sensitive data encrypt_sensitive_data (obtained by encrypting the plaintext sensitive data sensitive_data corresponding to the plaintext table field field_03 according to the preset encryption function) are added to the second plaintext data table table_21 to obtain the second ciphertext data table table_21 (equivalent to converting the second plaintext data table table_21 to the second ciphertext data table table_21). Finally, the first plaintext data table table_11 referenced by the second ciphertext data table table_21 is switched to the first ciphertext data table table_12, and the plaintext table field field_03 and the plaintext sensitive data sensitive_data in the second ciphertext data table table_21 are deleted, and the following is obtained. Figure 3 (d) shows the first ciphertext data table table_12 and the second ciphertext data table table_21.

[0056] In some embodiments, the target encryption transformation strategy is a third encryption transformation strategy, and the target data warehouse is encrypted and transformed according to the target encryption transformation strategy, including: adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field in each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table, the second ciphertext table field being obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table; in response to the upstream data table of the third ciphertext data table having been converted from a plaintext data table to a ciphertext data table, updating the second ciphertext table field in the third ciphertext data table according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table; for each third ciphertext data table, controlling the caller of the second plaintext table field in the third ciphertext data table to switch the referenced second plaintext table field to the corresponding second ciphertext table field; in response to the caller of the second plaintext table field in the third ciphertext data table having switched the referenced second plaintext table field to the second ciphertext table field, deleting the plaintext sensitive data corresponding to the second plaintext table field and the second plaintext table field from the third ciphertext data table. This embodiment can complete the encryption transformation of the data warehouse without affecting the business, thereby improving the convenience and business reliability of the encryption transformation of the data warehouse, and uses the method of adding ciphertext fields to encrypt the data warehouse, which not only improves the efficiency of the encryption transformation of the data warehouse, but also reduces the system resources required for the encryption transformation of the data warehouse.

[0057] In some embodiments, adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field to the plaintext data table in the target data warehouse to obtain the corresponding third ciphertext data table may include: obtaining the plaintext sensitive data and the second plaintext table field corresponding to the plaintext sensitive data from the plaintext data table; encrypting the obtained second plaintext table field based on a preset encryption function to obtain the second ciphertext table field, and encrypting the obtained plaintext sensitive data based on a preset encryption function to obtain the ciphertext sensitive data; adding a second ciphertext table field and the second ciphertext table field to the plaintext data table.

[0058] For example, the target data warehouse stores Figure 4 (a) shows the first plaintext data table table_11 located at the source layer and the second plaintext data table table_21 located at the processing layer. The second plaintext data table table_21 includes plaintext table field field_01, plaintext table field field_02 and plaintext table field field_03, and the plaintext table field field_01, plaintext table field field_02 and plaintext table field field_03 are transferred from the upstream first plaintext data table table_11. Therefore, Figure 4 As shown in (b), a second ciphertext table field field_03_enc and corresponding ciphertext sensitive data encrypt_sensitive_data are added to the first plaintext data table table_11, thereby converting the first plaintext data table table_11 into a third ciphertext data table table_11 (the ciphertext table field field_03_enc in the third ciphertext data table table_11 is obtained by encrypting the plaintext table field field_03 in the first plaintext data table table_11), and at the same time, a second ciphertext table field field_03_enc and corresponding ciphertext sensitive data encrypt_sensitive_data are added to the second plaintext data table table_21, thereby converting the second plaintext data table table_21 into the third ciphertext data table table_21 (the ciphertext table field field_03_enc in the third ciphertext data table table_21 is obtained by encrypting the plaintext table field field_03 in the second plaintext data table table_21).

[0059] Since the first plaintext data table table_11 is the upstream data table of the second plaintext data table table_21, it can be determined that the upstream data table of the third ciphertext data table table_21 has been converted from the first plaintext data table table_11 to the third ciphertext data table table_11. Therefore, the ciphertext table field field_03_enc in the third ciphertext data table table_11 is transferred to the third ciphertext data table table_21, thereby updating the ciphertext table field field_03_enc in the third ciphertext data table table_21 to table_11_field_03_enc, and the following is obtained: Figure 4 (c) The third ciphertext data table table_21 shown. Finally, the caller of the plaintext table field field_03 switches the referenced plaintext table field field_03 to field_03_enc, and then deletes the plaintext table field field_03 and the plaintext sensitive data sensitive_data from the third ciphertext data table table_11 and the third ciphertext data table table_21, and obtains the following Figure 4 (d) shows the third ciphertext data table table_11 and the third ciphertext data table table_21.

[0060] See also Figure 5 , Figure 5 It is a schematic block diagram of a data warehouse management device provided in an embodiment of the present application.

[0061] like Figure 5 As shown, the data warehouse management device 100 includes:

[0062] The information acquisition module 110 is used to acquire the attribute information of the target data warehouse, where the target data warehouse is the data warehouse to be encrypted and transformed;

[0063] A strategy determination module 120, configured to determine, according to the attribute information, a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies;

[0064] The data warehouse transformation module 130 is used to perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

[0065] In some embodiments, the attribute information includes at least one of available system resources and stored data volume, and the policy determination module 120 is further configured to:

[0066] In response to the data volume being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold, selecting a first encryption transformation strategy, wherein the first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a corresponding first ciphertext data table for each plaintext data table in the target data warehouse, wherein all sensitive data in the first ciphertext data table are ciphertext sensitive data, and all table fields are plaintext table fields;

[0067] In response to the data volume being greater than the first threshold and / or the available system resources being less than the second threshold, a second encryption transformation strategy is selected, wherein the second encryption transformation strategy is used to create a corresponding first ciphertext data table for each plaintext data table located in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext field and ciphertext sensitive data corresponding to the first ciphertext table field to each plaintext data table located in the processing layer of the target data warehouse, wherein the first ciphertext field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table.

[0068] In some embodiments, the target encryption transformation strategy is the first encryption transformation strategy, and the data warehouse transformation module 130 is further used to:

[0069] A first ciphertext data table corresponding to each plaintext data table is newly created in the target data warehouse, wherein the plaintext data table and the corresponding first ciphertext data table access the same upstream business data, and the sensitive data in the plaintext data table is plaintext, and the sensitive data in the corresponding first ciphertext data table is ciphertext;

[0070] For each of the plaintext data tables, controlling the caller of the plaintext data table to switch the called plaintext data table to the first ciphertext data table;

[0071] In response to the caller of the plaintext data table having switched the called plaintext data table to the first ciphertext data table, the plaintext data table is deleted.

[0072] In some embodiments, the data warehouse transformation module 130 is further used to:

[0073] Create a new blank data table in the target data warehouse, and access the upstream business data accessed by the plaintext data table to the blank data table to obtain a new plaintext data table;

[0074] According to a preset encryption function, all sensitive data in the new plaintext data table are encrypted to obtain a corresponding first ciphertext data table.

[0075] In some embodiments, the target encryption transformation strategy is the second encryption transformation strategy, and the data warehouse transformation module 130 is further used to:

[0076] Creating a first ciphertext data table corresponding to each first plaintext data table in the target data warehouse, wherein the first plaintext data table is located in the source layer;

[0077] Adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field in each second plaintext data table to obtain a corresponding second ciphertext data table, wherein the second plaintext data table is located in the processing layer, and the first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table;

[0078] For each of the first plaintext data tables, controlling the caller of the first plaintext data table to switch the called first plaintext data table to the corresponding first ciphertext data table;

[0079] In response to the caller of the first plaintext data table having switched the called first plaintext data table to the corresponding first ciphertext data table, deleting the first plaintext data table;

[0080] For each of the second ciphertext data tables, controlling the caller of the first plaintext table field in the second ciphertext data table to switch the referenced first plaintext table field to the corresponding first ciphertext table field;

[0081] In response to the caller of the first plaintext table field in the second ciphertext data table having switched the referenced first plaintext table field to the first ciphertext table field, the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field are deleted from the second ciphertext data table.

[0082] In some embodiments, the attribute information includes the number of data tables in the target data warehouse, and the policy determination module 120 is further configured to:

[0083] In response to the number of data tables being greater than a third threshold, a third encryption transformation strategy is selected, wherein the third encryption transformation strategy is used to encrypt and transform each plaintext data table in the target data warehouse by adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field, wherein the second ciphertext table field is obtained by encrypting a second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from an upstream ciphertext data table of the plaintext data table.

[0084] In some embodiments, the target encryption transformation strategy is the third encryption transformation strategy, and the data warehouse transformation module 130 is further used to:

[0085] Adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table, wherein the second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table;

[0086] In response to the upstream data table of the third ciphertext data table being converted from a plaintext data table to a ciphertext data table, updating the second ciphertext table field in the third ciphertext data table according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table;

[0087] For each of the third ciphertext data tables, controlling the caller of the second plaintext table field in the third ciphertext data table to switch the referenced second plaintext table field to the corresponding second ciphertext table field;

[0088] In response to the caller of the second plaintext table field in the third ciphertext data table having switched the referenced second plaintext table field to the second ciphertext table field, the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field are deleted from the third ciphertext data table.

[0089] It should be noted that technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working processes of the above-described devices and modules and units can refer to the corresponding processes in the aforementioned data warehouse management method embodiment, and will not be repeated here.

[0090] The apparatus provided in the above embodiment may be implemented in the form of a computer program. The computer program may be Figure 6 Runs on the computer device shown.

[0091] See also Figure 6 , Figure 6 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server or a terminal device.

[0092] like Figure 6 As shown, the computer device includes a processor, a memory, and a network interface connected via a system bus, wherein the memory may include a storage medium and an internal memory.

[0093] The storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any data warehouse management method.

[0094] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0095] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0096] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0097] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0098] Acquire attribute information of a target data warehouse, where the target data warehouse is a data warehouse to be encrypted and transformed;

[0099] Determining, according to the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse from a plurality of encryption transformation strategies;

[0100] According to the target encryption transformation strategy, the target data warehouse is encrypted and transformed so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

[0101] In some embodiments, when the processor determines, according to the attribute information, a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies, the processor is configured to implement:

[0102] In response to the data volume being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold, selecting a first encryption transformation strategy, wherein the first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a corresponding first ciphertext data table for each plaintext data table in the target data warehouse, wherein all sensitive data in the first ciphertext data table are ciphertext sensitive data, and all table fields are plaintext table fields;

[0103] In response to the data volume being greater than the first threshold and / or the available system resources being less than the second threshold, a second encryption transformation strategy is selected, wherein the second encryption transformation strategy is used to create a corresponding first ciphertext data table for each plaintext data table located in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext field and ciphertext sensitive data corresponding to the first ciphertext table field to each plaintext data table located in the processing layer of the target data warehouse, wherein the first ciphertext field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table.

[0104] In some embodiments, the target encryption transformation strategy is the first encryption transformation strategy, and the processor, when implementing encryption transformation of the target data warehouse according to the target encryption transformation strategy, is used to implement:

[0105] A first ciphertext data table corresponding to each plaintext data table is newly created in the target data warehouse, wherein the plaintext data table and the corresponding first ciphertext data table access the same upstream business data, and the sensitive data in the plaintext data table is plaintext, and the sensitive data in the corresponding first ciphertext data table is ciphertext;

[0106] For each of the plaintext data tables, controlling the caller of the plaintext data table to switch the called plaintext data table to the first ciphertext data table;

[0107] In response to the caller of the plaintext data table having switched the called plaintext data table to the first ciphertext data table, the plaintext data table is deleted.

[0108] In some embodiments, when creating a new first ciphertext data table corresponding to the plaintext data table in the target data warehouse, the processor is used to implement:

[0109] Create a new blank data table in the target data warehouse, and access the upstream business data accessed by the plaintext data table to the blank data table to obtain a new plaintext data table;

[0110] According to a preset encryption function, all sensitive data in the new plaintext data table are encrypted to obtain a corresponding first ciphertext data table.

[0111] In some embodiments, the target encryption transformation strategy is the second encryption transformation strategy, and the processor, when implementing encryption transformation of the target data warehouse according to the target encryption transformation strategy, is used to implement:

[0112] Creating a first ciphertext data table corresponding to each first plaintext data table in the target data warehouse, wherein the first plaintext data table is located in the source layer;

[0113] Adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field in each second plaintext data table to obtain a corresponding second ciphertext data table, wherein the second plaintext data table is located in the processing layer, and the first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table;

[0114] For each of the first plaintext data tables, controlling the caller of the first plaintext data table to switch the called first plaintext data table to the corresponding first ciphertext data table;

[0115] In response to the caller of the first plaintext data table having switched the called first plaintext data table to the corresponding first ciphertext data table, deleting the first plaintext data table;

[0116] For each of the second ciphertext data tables, controlling the caller of the first plaintext table field in the second ciphertext data table to switch the referenced first plaintext table field to the corresponding first ciphertext table field;

[0117] In response to the caller of the first plaintext table field in the second ciphertext data table having switched the referenced first plaintext table field to the first ciphertext table field, the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field are deleted from the second ciphertext data table.

[0118] In some embodiments, the attribute information includes the number of data tables of the target data warehouse, and the processor, when determining a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies according to the attribute information, is used to implement:

[0119] In response to the number of data tables being greater than a third threshold, a third encryption transformation strategy is selected, wherein the third encryption transformation strategy is used to encrypt and transform each plaintext data table in the target data warehouse by adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field, wherein the second ciphertext table field is obtained by encrypting a second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from an upstream ciphertext data table of the plaintext data table.

[0120] In some embodiments, the target encryption transformation strategy is the third encryption transformation strategy, and the processor, when implemented, is used to implement:

[0121] Adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table, wherein the second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table;

[0122] In response to the upstream data table of the third ciphertext data table being converted from a plaintext data table to a ciphertext data table, updating the second ciphertext table field in the third ciphertext data table according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table;

[0123] For each of the third ciphertext data tables, controlling the caller of the second plaintext table field in the third ciphertext data table to switch the referenced second plaintext table field to the corresponding second ciphertext table field;

[0124] In response to the caller of the second plaintext table field in the third ciphertext data table having switched the referenced second plaintext table field to the second ciphertext table field, the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field are deleted from the third ciphertext data table.

[0125] It should be noted that those skilled in the art can clearly understand that, for the sake of convenience and brevity of description, the specific working process of the computer device described above can refer to the corresponding process in the aforementioned data warehouse management method embodiment, and will not be repeated here.

[0126] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0127] An embodiment of the present application further provides a storage medium, on which a computer program is stored. The computer program includes program instructions. The method implemented when the program instructions are executed can refer to the various embodiments of the data warehouse management method of the present application.

[0128] The storage medium may be volatile or non-volatile. The storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0129] Furthermore, the storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the blockchain node, etc.

[0130] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0131] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0132] It should also be understood that the term "and / or" used in the specification of this application and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0133] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific implementation mode of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A data warehouse management method, characterized in that: include: Acquire attribute information of a target data warehouse, where the target data warehouse is a data warehouse to be encrypted and transformed; Determining, according to the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse from a plurality of encryption transformation strategies; According to the target encryption transformation strategy, the target data warehouse is encrypted and transformed so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

2. The data warehouse management method according to claim 1, characterized in that: The attribute information includes at least one of available system resources and the amount of stored data. The determining, based on the attribute information, a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies includes: In response to the data volume being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold, selecting a first encryption transformation strategy, wherein the first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a corresponding first ciphertext data table for each plaintext data table in the target data warehouse, wherein all sensitive data in the first ciphertext data table are ciphertext sensitive data, and all table fields are plaintext table fields; In response to the data volume being greater than the first threshold and / or the available system resources being less than the second threshold, a second encryption transformation strategy is selected, wherein the second encryption transformation strategy is used to create a corresponding first ciphertext data table for each plaintext data table located in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext field and ciphertext sensitive data corresponding to the first ciphertext table field to each plaintext data table located in the processing layer of the target data warehouse, wherein the first ciphertext field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table.

3. The data warehouse management method according to claim 2, characterized in that: The target encryption transformation strategy is the first encryption transformation strategy, and performing encryption transformation on the target data warehouse according to the target encryption transformation strategy includes: A first ciphertext data table corresponding to each plaintext data table is newly created in the target data warehouse, wherein the plaintext data table and the corresponding first ciphertext data table access the same upstream business data, and the sensitive data in the plaintext data table is plaintext, and the sensitive data in the corresponding first ciphertext data table is ciphertext; For each of the plaintext data tables, controlling the caller of the plaintext data table to switch the called plaintext data table to the first ciphertext data table; In response to the caller of the plaintext data table having switched the called plaintext data table to the first ciphertext data table, the plaintext data table is deleted.

4. The data warehouse management method according to claim 3, characterized in that: Creating a first ciphertext data table corresponding to the plaintext data table in the target data warehouse includes: Create a new blank data table in the target data warehouse, and access the upstream business data accessed by the plaintext data table to the blank data table to obtain a new plaintext data table; According to a preset encryption function, all sensitive data in the new plaintext data table are encrypted to obtain a corresponding first ciphertext data table.

5. The data warehouse management method according to claim 2, characterized in that: The target encryption transformation strategy is the second encryption transformation strategy, and performing encryption transformation on the target data warehouse according to the target encryption transformation strategy includes: Creating a first ciphertext data table corresponding to each first plaintext data table in the target data warehouse, wherein the first plaintext data table is located in the source layer; Adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field in each second plaintext data table to obtain a corresponding second ciphertext data table, wherein the second plaintext data table is located in the processing layer, and the first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table; For each of the first plaintext data tables, controlling the caller of the first plaintext data table to switch the called first plaintext data table to the corresponding first ciphertext data table; In response to the caller of the first plaintext data table having switched the called first plaintext data table to the corresponding first ciphertext data table, deleting the first plaintext data table; For each of the second ciphertext data tables, controlling the caller of the first plaintext table field in the second ciphertext data table to switch the referenced first plaintext table field to the corresponding first ciphertext table field; In response to the caller of the first plaintext table field in the second ciphertext data table having switched the referenced first plaintext table field to the first ciphertext table field, the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field are deleted from the second ciphertext data table.

6. The data warehouse management method according to any one of claims 1 to 5, characterized in that: The attribute information includes the number of data tables of the target data warehouse, and determining a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies according to the attribute information includes: In response to the number of data tables being greater than a third threshold, a third encryption transformation strategy is selected, wherein the third encryption transformation strategy is used to encrypt and transform each plaintext data table in the target data warehouse by adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field, wherein the second ciphertext table field is obtained by encrypting a second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from an upstream ciphertext data table of the plaintext data table.

7. The data warehouse management method according to claim 6, wherein the target encryption transformation strategy is the third encryption transformation strategy, and the encryption transformation of the target data warehouse according to the target encryption transformation strategy comprises: Adding a second ciphertext table field and ciphertext sensitive data corresponding to the second ciphertext table field to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table, wherein the second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table; In response to the upstream data table of the third ciphertext data table being converted from a plaintext data table to a ciphertext data table, updating the second ciphertext table field in the third ciphertext data table according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table; For each of the third ciphertext data tables, controlling the caller of the second plaintext table field in the third ciphertext data table to switch the referenced second plaintext table field to the corresponding second ciphertext table field; In response to the caller of the second plaintext table field in the third ciphertext data table having switched the referenced second plaintext table field to the second ciphertext table field, the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field are deleted from the third ciphertext data table.

8. A data warehouse management device, characterized in that: The data warehouse management device comprises: An information acquisition module, used to acquire attribute information of a target data warehouse, wherein the target data warehouse is a data warehouse to be encrypted and transformed; A strategy determination module, used to determine a target encryption transformation strategy for encryption transformation of the target data warehouse from a plurality of encryption transformation strategies according to the attribute information; The data warehouse transformation module is used to perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, so that all sensitive data in the target data warehouse are switched from plaintext sensitive data to ciphertext sensitive data.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the data warehouse management method according to any one of claims 1 to 7 is implemented.

10. A storage medium for computer-readable storage, characterized in that: The storage medium stores a computer program, wherein when the computer program is executed by a processor, the data warehouse management method according to any one of claims 1 to 7 is implemented.

Images