Data warehouse management method and device, computer device and storage medium

Abstract

The application provides a data warehouse management method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining attribute information of a target data warehouse; determining a target encryption reconstruction strategy for encrypting and reconstructing the target data warehouse from a plurality of encryption reconstruction strategies according to the attribute information; and encrypting and reconstructing the target data warehouse according to the target encryption reconstruction strategy, so that all sensitive data in the target data warehouse is switched from plaintext sensitive data to ciphertext sensitive data. The application effectively improves the flexibility of encryption reconstruction of the data warehouse.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a data warehouse management method, apparatus, computer equipment and storage medium. Background Technology

[0002] A data warehouse helps businesses better manage, understand, and utilize data resources, and has the functions of data storage, management, and analysis. For example, financial companies use data warehouses to store customer data, insurance policy data, and customer image data, while medical organizations use data warehouses to store patient medical records, medical imaging data, and medical personnel data. With the development of the internet and the arrival of the big data era, the risks posed by the leakage of sensitive data such as mobile phone numbers, ID numbers, bank card numbers, email addresses, and physical addresses will become increasingly serious.

[0003] To prevent the leakage of sensitive data, current measures rely on table-level access control within the data warehouse, ensuring that data is not accessed by authorized personnel. However, when developers gain access to tables, they also gain the ability to view sensitive data, potentially leading to the leakage of customer privacy. This causes the data warehouse's security assessment to fail to meet national regulatory requirements, necessitating encryption upgrades to the existing data warehouse. However, current encryption methods are limited and cannot meet the diverse encryption needs of various data warehouses, resulting in poor flexibility in data warehouse encryption upgrades. Summary of the Invention

[0004] This application provides a data warehouse management method, apparatus, computer equipment, and storage medium, aiming to improve the flexibility of encryption transformation of data warehouses.

[0005] In a first aspect, embodiments of this application provide a data warehouse management method, including:

[0006] Obtain the attribute information of the target data warehouse, which is the data warehouse to be encrypted and modified;

[0007] Based on the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse is determined from multiple encryption transformation strategies.

[0008] According to the target encryption transformation strategy, the target data warehouse is encrypted to switch all sensitive data in the target data warehouse from plaintext sensitive data to ciphertext sensitive data.

[0009] Secondly, embodiments of this application also provide a data warehouse management device, the data warehouse management device comprising:

[0010] The information acquisition module is used to acquire attribute information of the target data warehouse, which is the data warehouse to be encrypted and modified.

[0011] The strategy determination module is used to determine, based on the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse from multiple encryption transformation strategies;

[0012] The data warehouse transformation module is used to perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, so that all sensitive data in the target data warehouse is switched from plaintext sensitive data to ciphertext sensitive data.

[0013] Thirdly, embodiments of this application also provide a computer device, the computer device including a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, it implements the data warehouse management method as described in the first aspect.

[0014] Fourthly, embodiments of this application also provide a storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the data warehouse management method as described in the first aspect.

[0015] This application provides a data warehouse management method, apparatus, computer equipment, and storage medium. By using the attribute information of the target data warehouse, this application can flexibly select a matching target encryption transformation strategy from multiple encryption transformation strategies for encrypting and transforming the target data warehouse. Then, according to the target encryption transformation strategy, the target data warehouse is encrypted and transformed, which effectively improves the flexibility of data warehouse encryption transformation. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a data warehouse management method provided in an embodiment of this application;

[0018] Figure 2 This is a schematic diagram illustrating the encryption modification of the data warehouse in this application embodiment;

[0019] Figure 3 This is another schematic diagram illustrating the encryption modification of the data warehouse in this application embodiment;

[0020] Figure 4 This is another schematic diagram illustrating the encryption modification of the data warehouse in this application embodiment;

[0021] Figure 5 This is a schematic block diagram of a data warehouse management device provided in an embodiment of this application;

[0022] Figure 6 This is a schematic block diagram of the structure of a computer device provided in an embodiment of this application.

[0023] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and the accompanying drawings. Detailed Implementation

[0024] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0026] Currently, access control is implemented at the table level within the data warehouse, ensuring that data is not accessed by authorized personnel. However, when developers gain access to tables, they also gain the ability to view sensitive data, potentially leading to the leakage of customer privacy. This causes the data warehouse security assessment to fail to meet national regulatory requirements, necessitating encryption upgrades to the existing data warehouse. However, current encryption methods are limited and cannot meet the diverse encryption needs of various data warehouses, resulting in poor flexibility in data warehouse encryption upgrades.

[0027] To address the aforementioned problems, embodiments of this application provide a data warehouse management method, apparatus, computer equipment, and storage medium. By utilizing the attribute information of the target data warehouse, embodiments of this application can flexibly select a matching target encryption strategy from multiple encryption strategies for encrypting and modifying the target data warehouse. Then, based on the target encryption strategy, the target data warehouse is encrypted and modified, effectively improving the flexibility of data warehouse encryption modification.

[0028] This data warehouse management method can be applied to computer equipment, which may include servers or terminal devices, such as mobile phones, tablets, laptops, desktop computers, personal digital assistants, and wearable devices. Servers can be standalone servers or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0029] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0030] Please see Figure 1 , Figure 1 This is a flowchart illustrating a data warehouse management method provided in an embodiment of this application. The data warehouse management method is applied to computer equipment.

[0031] like Figure 1 As shown, the data warehouse management method includes steps S101 to S103.

[0032] Step S101: Obtain the attribute information of the target data warehouse.

[0033] In this embodiment, the target data warehouse is the data warehouse to be encrypted. This data warehouse can be a financial institution's data warehouse for storing customer data, policy data, and customer image data, or a medical organization's data warehouse for storing patient medical records, medical image data, and medical personnel data. It is understood that before the encryption transformation of the target data warehouse, all sensitive data in the target data warehouse is plaintext sensitive data. This sensitive data may include mobile phone numbers, ID card numbers, bank card numbers, email addresses, and physical addresses.

[0034] In some embodiments, the attribute information of the target data warehouse includes at least one of the available system resources and the amount of data stored in the target data warehouse. Alternatively, the attribute information of the target data warehouse includes at least one of the available system resources, the number of data tables, and the amount of data stored in the target data warehouse. Here, the available system resources of the target data warehouse include the available computing resources and available storage resources; the number of data tables in the target data warehouse is the total number of plaintext data tables in the target data warehouse; and the amount of data stored in the target data warehouse refers to the size of the data stored in the target data warehouse.

[0035] In some embodiments, obtaining attribute information of a target data warehouse may include: a computer device sending an attribute information query instruction to the target data warehouse, so that the target data warehouse can query attribute information according to the attribute information query instruction and send the queried attribute information to the computer device; and the computer device obtaining the attribute information sent by the target data warehouse. This embodiment can accurately obtain the attribute information of the target data warehouse.

[0036] In some embodiments, obtaining the attribute information of a target data warehouse may include: a computer device retrieving the attribute information of the target data warehouse from a mapping table between data warehouse identifier information and attribute information, based on the identifier information of the target data warehouse. The mapping table between data warehouse identifier information and attribute information is pre-established based on the attribute information and identifier information of each data warehouse. This embodiment enables rapid acquisition of the attribute information of the target data warehouse.

[0037] In some embodiments, the data warehouse management method further includes: a computer device acquiring an attribute information update instruction sent by the data warehouse, the attribute update instruction including a data warehouse identifier and the latest attribute information; and updating the attribute information corresponding to the data warehouse identifier in the mapping table to the latest attribute information, thereby updating the mapping table. Specifically, when the attribute information of the data warehouse changes, the data warehouse acquires its own data warehouse identifier and the latest attribute information, and sends an attribute information update instruction carrying the data warehouse identifier and the latest attribute information to the computer device.

[0038] Step S102: Based on the attribute information, determine the target encryption transformation strategy for the target data warehouse from multiple encryption transformation strategies.

[0039] In this embodiment, the multiple encryption modification strategies include a first encryption modification strategy, a second encryption modification strategy, and a third encryption modification strategy. The first encryption modification strategy is used to encrypt each plaintext data table in the target data warehouse by creating a corresponding first ciphertext data table. All sensitive data in the first ciphertext data table is ciphertext sensitive data, and all table fields in the first ciphertext data table are plaintext table fields.

[0040] The second encryption transformation strategy is used to create a new corresponding first ciphertext data table for each plaintext data table in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext table field and the ciphertext sensitive data corresponding to the first ciphertext table field for each plaintext data table in the processing layer of the target data warehouse. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext table.

[0041] The third encryption transformation strategy is used to encrypt each plaintext data table in the target data warehouse by adding a second ciphertext table field and the corresponding ciphertext sensitive data of the second ciphertext table field. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from the upstream ciphertext data table of the plaintext data table.

[0042] Understandably, the first encryption strategy is suitable for data warehouses with many downstream stakeholders, data warehouses located at the very top of the big data task chain, and / or clusters where the data warehouse resides with sufficient available system resources. The second encryption strategy is suitable for scenarios with a large volume of modification tasks and / or clusters where the data warehouse occupies a significant amount of available system resources (but the clusters where the data warehouse resides have insufficient available system resources). The third encryption strategy is suitable for scenarios requiring highly parallel encryption modifications to a large number of data tables in the data warehouse.

[0043] In some embodiments, determining the target encryption transformation strategy for the target data warehouse from multiple encryption transformation strategies based on attribute information may include: selecting a first encryption transformation strategy in response to a data volume being less than or equal to a first threshold and / or available system resources being greater than or equal to a second threshold. The first and second thresholds can be set based on actual conditions, and this embodiment does not specifically limit their settings. This embodiment improves the efficiency of data warehouse encryption transformation by using a newly created encrypted data table when available system resources are plentiful and / or the amount of stored data is small.

[0044] In some embodiments, determining the target encryption strategy for encrypting the target data warehouse from multiple encryption strategies based on attribute information may include: selecting a second encryption strategy in response to a data volume exceeding a first threshold and / or available system resources falling below a second threshold. This embodiment, by combining the creation of new ciphertext data tables and the addition of new ciphertext fields to encrypt the data warehouse when available system resources are limited and / or the amount of stored data is large, can reduce the system resources required for data warehouse encryption while ensuring efficiency.

[0045] In some embodiments, the attribute information of the target data warehouse includes the number of data tables and available system resources. Determining a target encryption strategy from multiple encryption strategies based on this attribute information may include: selecting a first encryption strategy in response to the number of data tables being less than or equal to a third threshold and the available system resources being greater than or equal to a second threshold. This embodiment improves the efficiency of data warehouse encryption by using newly created encrypted data tables to encrypt and transform the data warehouse when the number of data tables is small and the available system resources are abundant.

[0046] In some embodiments, determining the target encryption transformation strategy for the target data warehouse from multiple encryption transformation strategies based on attribute information may include: selecting a second encryption transformation strategy in response to the number of data tables being less than or equal to a third threshold and the available system resources being less than a second threshold. This embodiment, by combining the creation of new ciphertext data tables and the addition of ciphertext fields to perform encryption transformation on the data warehouse when the number of data tables is small and the available system resources are limited, can reduce the system resources required for data warehouse encryption transformation while ensuring the efficiency of data warehouse encryption transformation.

[0047] In some embodiments, determining the target encryption transformation strategy for the target data warehouse from multiple encryption transformation strategies based on attribute information may include: selecting a third encryption transformation strategy in response to the number of data tables exceeding a third threshold. This embodiment, by using the addition of ciphertext fields to encrypt and transform the data warehouse when the number of data tables is large, not only improves the efficiency of data warehouse encryption transformation but also reduces the system resources required for data warehouse encryption transformation.

[0048] Step S103: According to the target encryption transformation strategy, the target data warehouse is encrypted to switch all sensitive data in the target data warehouse from plaintext sensitive data to ciphertext sensitive data.

[0049] This embodiment can flexibly select a matching target encryption transformation strategy from multiple encryption transformation strategies by using the attribute information of the target data warehouse. Then, the target data warehouse is encrypted and transformed according to the target encryption transformation strategy, which effectively improves the flexibility of data warehouse encryption transformation.

[0050] In some embodiments, the target encryption transformation strategy is a first encryption transformation strategy. According to the target encryption transformation strategy, the target data warehouse is encrypted, including: creating a first ciphertext data table corresponding to each plaintext data table in the target data warehouse. The upstream business data accessed by the plaintext data table and the corresponding first ciphertext data table is the same, and the sensitive data in the plaintext data table is plaintext, while the sensitive data in the corresponding first ciphertext data table is ciphertext. For each plaintext data table, the caller of the plaintext data table switches the called plaintext data table to the first ciphertext data table. In response to the caller of the plaintext data table having switched the called plaintext data table to the first ciphertext data table, the plaintext data table is deleted. This embodiment can complete the encryption transformation of the data warehouse without affecting business operations, improving the convenience of data warehouse encryption transformation and business reliability.

[0051] For example, the target data warehouse stores things like Figure 2 As shown in (a), the plaintext data table `table_01` includes plaintext table fields `field_01`, `field_02`, and `field_03`, as well as plaintext non-sensitive data `normal_data_01`, `normal_data_02`, and plaintext sensitive data `sensitive_data`. Therefore, as... Figure 2 As shown in (b), a first ciphertext data table, table_02, corresponding to the plaintext data table table_01, is created in the target data warehouse. The first ciphertext data table table_02 includes plaintext table fields field_01, field_02, and field_03, as well as plaintext non-sensitive data normal_data_01 and normal_data_02, and ciphertext sensitive data encrypt_sensitive_data (obtained by encrypting the plaintext sensitive data sensitive_data). Then, the plaintext data table table_01 is deleted from the target data warehouse, leaving only the plaintext data table_02 in the target data warehouse. Figure 2 (c) shows the first encrypted data table table_02.

[0052] In some embodiments, creating a first ciphertext data table corresponding to a plaintext data table in the target data warehouse may include: creating a blank data table in the target data warehouse, connecting the upstream business data connected to the plaintext data table to the blank data table, and obtaining a new plaintext data table; encrypting all sensitive data in the new plaintext data table according to a preset encryption function to obtain the corresponding first ciphertext data table. The preset encryption function can be set based on actual conditions, and this application embodiment does not specifically limit it. For example, the preset encryption function may be a national cryptographic algorithm such as SM1 or SM3.

[0053] In some embodiments, the target encryption transformation strategy is a second encryption transformation strategy. According to the target encryption transformation strategy, the target data warehouse is encrypted, including: creating a first ciphertext data table corresponding to each first plaintext data table in the target data warehouse, the first plaintext data table being located in the source layer of the target data warehouse; adding a first ciphertext table field and the corresponding ciphertext sensitive data to each second plaintext data table to obtain a corresponding second ciphertext data table, the second plaintext table being located in the processing layer of the target data warehouse, the first ciphertext table field being obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table; for each first... For each plaintext data table, the caller of the first plaintext data table switches the invoked first plaintext data table to the corresponding first ciphertext data table. In response to the caller having switched the invoked first plaintext data table to the corresponding first ciphertext data table, the first plaintext data table is deleted. For each second ciphertext data table, the caller of the first plaintext table field in the second ciphertext data table switches the referenced first plaintext table field to the corresponding first ciphertext table field. In response to the caller of the first plaintext table field in the second ciphertext data table having switched the referenced first plaintext table field to the first ciphertext table field, the first plaintext table field and the corresponding plaintext sensitive data are deleted from the second ciphertext data table. This embodiment can complete the encryption transformation of the data warehouse without affecting business operations, improving the convenience and reliability of data warehouse encryption transformation. Furthermore, the encryption transformation of some data tables is performed by adding ciphertext fields, reducing the consumption of system resources.

[0054] For example, the target data warehouse stores things like Figure 3 (a) shows a first plaintext data table `table_11` located in the source layer and a second plaintext data table `table_21` located in the processing layer. The second plaintext data table `table_21` includes plaintext table fields `field_01`, `field_02`, and `field_03`, which are passed from the upstream first plaintext data table `table_11`. Therefore, as shown... Figure 3 As shown in (b), first create the first ciphertext data table table_12 corresponding to the first plaintext data table table_11.

[0055] Then as Figure 3As shown in (c), delete the first plaintext data table table_11 and add the first ciphertext table field field_03_enc (obtained by encrypting the plaintext table field field_03 in the first ciphertext data table table_12 according to the preset encryption function) and the ciphertext sensitive data encrypt_sensitive_data (obtained by encrypting the plaintext table sensitive data corresponding to the plaintext table field_03 according to the preset encryption function) to the second plaintext data table table_21, resulting in the second ciphertext data table table_21 (equivalent to converting the second plaintext data table table_21 into the second ciphertext data table table_21). Finally, switch the first plaintext data table table_11 referenced by the second ciphertext data table table_21 to the first ciphertext data table table_12, and delete the plaintext table field field_03 and the plaintext sensitive data sensitive_data in the second ciphertext data table table_21, resulting in the following... Figure 3 (d) shows the first ciphertext data table table_12 and the second ciphertext data table table_21.

[0056] In some embodiments, the target encryption transformation strategy is a third encryption transformation strategy. According to the target encryption transformation strategy, the target data warehouse is encrypted, including: adding a second ciphertext table field and the corresponding ciphertext sensitive data to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table; in response to the upstream data table of the third ciphertext data table being converted from a plaintext data table to a ciphertext data table, updating the second ciphertext table field in the third ciphertext data table according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table; for each third ciphertext data table, controlling the caller of the second plaintext table field in the third ciphertext data table to switch the referenced second plaintext table field to the corresponding second ciphertext table field; in response to the caller of the second plaintext table field in the third ciphertext data table having switched the referenced second plaintext table field to the second ciphertext table field, deleting the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field from the third ciphertext data table. This embodiment can complete the encryption transformation of the data warehouse without affecting business operations, improving the convenience and business reliability of the encryption transformation of the data warehouse. Furthermore, by using the method of adding ciphertext fields to encrypt the data warehouse, it not only improves the efficiency of the encryption transformation of the data warehouse, but also reduces the system resources required for the encryption transformation of the data warehouse.

[0057] In some embodiments, adding a second ciphertext table field and corresponding ciphertext sensitive data to a plaintext data table in a target data warehouse to obtain a corresponding third ciphertext data table may include: obtaining plaintext sensitive data and corresponding second plaintext table fields from the plaintext data table; encrypting the obtained second plaintext table fields based on a preset encryption function to obtain second ciphertext table fields, and encrypting the obtained plaintext sensitive data based on a preset encryption function to obtain ciphertext sensitive data; adding a second ciphertext table field and corresponding second ciphertext table fields to the plaintext data table.

[0058] For example, the target data warehouse stores things like Figure 4 (a) shows a first plaintext data table `table_11` located in the source layer and a second plaintext data table `table_21` located in the processing layer. The second plaintext data table `table_21` includes plaintext table fields `field_01`, `field_02`, and `field_03`, which are passed from the upstream first plaintext data table `table_11`. Therefore, as shown... Figure 4 As shown in (b), a second ciphertext table field field_03_enc and the corresponding ciphertext sensitive data encrypt_sensitive_data are added to the first plaintext data table table_11, thereby converting the first plaintext data table table_11 into a third ciphertext data table table_11 (the ciphertext table field field_03_enc in the third ciphertext data table table_11 is obtained by encrypting the plaintext table field field_03 in the first plaintext data table table_11). At the same time, a second ciphertext table field field_03_enc and the corresponding ciphertext sensitive data encrypt_sensitive_data are added to the second plaintext data table table_21, thereby converting the second plaintext data table table_21 into a third ciphertext data table table_21 (the ciphertext table field field_03_enc in the third ciphertext data table table_21 is obtained by encrypting the plaintext table field field_03 in the second plaintext data table table_21).

[0059] Since the first plaintext data table `table_11` is the upstream data table of the second plaintext data table `table_21`, it can be determined that the upstream data table of the third ciphertext data table `table_21` has been converted from the first plaintext data table `table_11` to the third ciphertext data table `table_11`. Therefore, the ciphertext table field `field_03_enc` in the third ciphertext data table `table_11` is passed to the third ciphertext data table `table_21`, thereby updating the ciphertext table field `field_03_enc` in the third ciphertext data table `table_21` to `table_11_field_03_enc`, resulting in the following... Figure 4 (c) shows the third ciphertext data table, table_21. Finally, in the caller of the plaintext table field field_03, the referenced plaintext table field field_03 is switched to field_03_enc. This removes the plaintext table field field_03 and the plaintext sensitive data sensitive_data from both the third ciphertext data tables, table_11 and table_21, resulting in the following... Figure 4 (d) shows the third ciphertext data table table_11 and the third ciphertext data table table_21.

[0060] Please see Figure 5 , Figure 5 This is a schematic block diagram of a data warehouse management device provided in an embodiment of this application.

[0061] like Figure 5 As shown, the data warehouse management device 100 includes:

[0062] The information acquisition module 110 is used to acquire attribute information of the target data warehouse, which is the data warehouse to be encrypted and modified.

[0063] The strategy determination module 120 is used to determine a target encryption transformation strategy for encrypting and transforming the target data warehouse from multiple encryption transformation strategies based on the attribute information.

[0064] The data warehouse transformation module 130 is used to perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, so that all sensitive data in the target data warehouse is switched from plaintext sensitive data to ciphertext sensitive data.

[0065] In some embodiments, the attribute information includes at least one of available system resources and the amount of data stored, and the policy determination module 120 is further configured to:

[0066] In response to the data volume being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold, a first encryption transformation strategy is selected. The first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a new corresponding first ciphertext data table for each plaintext data table in the target data warehouse. All sensitive data in the first ciphertext data table is ciphertext sensitive data, and all table fields are plaintext table fields.

[0067] In response to the data volume being greater than the first threshold and / or the available system resources being less than the second threshold, a second encryption transformation strategy is selected. The second encryption transformation strategy is used to create a new corresponding first ciphertext data table for each plaintext data table in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field for each plaintext data table in the processing layer of the target data warehouse. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table.

[0068] In some embodiments, the target encryption transformation strategy is the first encryption transformation strategy, and the data warehouse transformation module 130 is further configured to:

[0069] In the target data warehouse, a first ciphertext data table is created corresponding to each plaintext data table. The upstream business data accessed by the plaintext data table and the corresponding first ciphertext data table is the same, and the sensitive data in the plaintext data table is plaintext, while the sensitive data in the corresponding first ciphertext data table is ciphertext.

[0070] For each of the plaintext data tables, the caller of the plaintext data table controls the caller to switch the plaintext data table to the first ciphertext data table;

[0071] In response to the caller of the plaintext data table having switched the invoked plaintext data table to the first ciphertext data table, the plaintext data table is deleted.

[0072] In some embodiments, the data warehouse transformation module 130 is further configured to:

[0073] A new blank data table is created in the target data warehouse, and the upstream business data connected to the plaintext data table is connected to the blank data table to obtain a new plaintext data table.

[0074] According to the preset encryption function, all sensitive data in the new plaintext data table is encrypted to obtain the corresponding first ciphertext data table.

[0075] In some embodiments, the target encryption transformation strategy is the second encryption transformation strategy, and the data warehouse transformation module 130 is further configured to:

[0076] In the target data warehouse, a first ciphertext data table is created corresponding to each first plaintext data table, and the first plaintext data table is located in the source layer;

[0077] A first ciphertext table field and the corresponding ciphertext sensitive data are added to each second plaintext data table to obtain the corresponding second ciphertext data table. The second plaintext data table is located in the processing layer. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table.

[0078] For each of the first plaintext data tables, the caller of the first plaintext data table controls the caller to switch the first plaintext data table to the corresponding first ciphertext data table.

[0079] In response to the caller of the first plaintext data table having switched the first plaintext data table to the corresponding first ciphertext data table, the first plaintext data table is deleted.

[0080] For each second ciphertext data table, the caller of the first plaintext table field in the second ciphertext data table switches the referenced first plaintext table field to the corresponding first ciphertext table field;

[0081] In response to the caller having switched the referenced first plaintext table field in the second ciphertext data table to the first ciphertext table field, the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field are deleted from the second ciphertext data table.

[0082] In some embodiments, the attribute information includes the number of data tables in the target data warehouse, and the strategy determination module 120 is further configured to:

[0083] In response to the number of data tables exceeding a third threshold, a third encryption transformation strategy is selected. The third encryption transformation strategy is used to encrypt each plaintext data table in the target data warehouse by adding a second ciphertext table field and the corresponding ciphertext sensitive data of the second ciphertext table field. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from the upstream ciphertext data table of the plaintext data table.

[0084] In some embodiments, the target encryption transformation strategy is the third encryption transformation strategy, and the data warehouse transformation module 130 is further configured to:

[0085] A second ciphertext table field and the corresponding ciphertext sensitive data are added to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table.

[0086] In response to the fact that the upstream data table of the third ciphertext data table has been converted from a plaintext data table to a ciphertext data table, the second ciphertext table field in the third ciphertext data table is updated according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table.

[0087] For each of the third ciphertext data tables, the caller of the second plaintext table field in the third ciphertext data table switches the referenced second plaintext table field to the corresponding second ciphertext table field;

[0088] In response to the caller having switched the referenced second plaintext table field to the second ciphertext table field in the third ciphertext data table, the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field are deleted from the third ciphertext data table.

[0089] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the above-described apparatus and its modules and units can be referred to the corresponding processes in the aforementioned data warehouse management method embodiments, and will not be repeated here.

[0090] The apparatus provided in the above embodiments can be implemented as a computer program, which can be used in, for example... Figure 6 It runs on the computer device shown.

[0091] Please see Figure 6 , Figure 6 This is a schematic block diagram illustrating the structure of a computer device according to an embodiment of this application. The computer device can be a server or a terminal device.

[0092] like Figure 6 As shown, the computer device includes a processor, a memory, and a network interface connected via a system bus, wherein the memory may include a storage medium and internal memory.

[0093] The storage medium can store the operating system and computer programs. These computer programs include program instructions that, when executed, cause the processor to perform any data warehouse management method.

[0094] The processor provides computing and control capabilities, supporting the operation of the entire computer device.

[0095] This network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0096] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0097] In one embodiment, the processor is configured to run a computer program stored in a memory to perform the following steps:

[0098] Obtain the attribute information of the target data warehouse, which is the data warehouse to be encrypted and modified;

[0099] Based on the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse is determined from multiple encryption transformation strategies.

[0100] According to the target encryption transformation strategy, the target data warehouse is encrypted to switch all sensitive data in the target data warehouse from plaintext sensitive data to ciphertext sensitive data.

[0101] In some embodiments, when the processor determines a target encryption transformation policy for encryption transformation of the target data warehouse from multiple encryption transformation policies based on the attribute information, it is configured to:

[0102] In response to the data volume being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold, a first encryption transformation strategy is selected. The first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a new corresponding first ciphertext data table for each plaintext data table in the target data warehouse. All sensitive data in the first ciphertext data table is ciphertext sensitive data, and all table fields are plaintext table fields.

[0103] In response to the data volume being greater than the first threshold and / or the available system resources being less than the second threshold, a second encryption transformation strategy is selected. The second encryption transformation strategy is used to create a new corresponding first ciphertext data table for each plaintext data table in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field for each plaintext data table in the processing layer of the target data warehouse. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table.

[0104] In some embodiments, the target encryption transformation strategy is the first encryption transformation strategy, and the processor, when implementing the encryption transformation of the target data warehouse according to the target encryption transformation strategy, is configured to:

[0105] In the target data warehouse, a first ciphertext data table is created corresponding to each plaintext data table. The upstream business data accessed by the plaintext data table and the corresponding first ciphertext data table is the same, and the sensitive data in the plaintext data table is plaintext, while the sensitive data in the corresponding first ciphertext data table is ciphertext.

[0106] For each of the plaintext data tables, the caller of the plaintext data table controls the caller to switch the plaintext data table to the first ciphertext data table;

[0107] In response to the caller of the plaintext data table having switched the invoked plaintext data table to the first ciphertext data table, the plaintext data table is deleted.

[0108] In some embodiments, when the processor implements the creation of a first ciphertext data table corresponding to a plaintext data table in the target data warehouse, it is configured to:

[0109] A new blank data table is created in the target data warehouse, and the upstream business data connected to the plaintext data table is connected to the blank data table to obtain a new plaintext data table.

[0110] According to the preset encryption function, all sensitive data in the new plaintext data table is encrypted to obtain the corresponding first ciphertext data table.

[0111] In some embodiments, the target encryption transformation strategy is the second encryption transformation strategy, and the processor, when implementing the encryption transformation of the target data warehouse according to the target encryption transformation strategy, is configured to:

[0112] In the target data warehouse, a first ciphertext data table is created corresponding to each first plaintext data table, and the first plaintext data table is located in the source layer;

[0113] A first ciphertext table field and the corresponding ciphertext sensitive data are added to each second plaintext data table to obtain the corresponding second ciphertext data table. The second plaintext data table is located in the processing layer. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table.

[0114] For each of the first plaintext data tables, the caller of the first plaintext data table controls the caller to switch the first plaintext data table to the corresponding first ciphertext data table.

[0115] In response to the caller of the first plaintext data table having switched the first plaintext data table to the corresponding first ciphertext data table, the first plaintext data table is deleted.

[0116] For each second ciphertext data table, the caller of the first plaintext table field in the second ciphertext data table switches the referenced first plaintext table field to the corresponding first ciphertext table field;

[0117] In response to the caller having switched the referenced first plaintext table field in the second ciphertext data table to the first ciphertext table field, the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field are deleted from the second ciphertext data table.

[0118] In some embodiments, the attribute information includes the number of data tables in the target data warehouse. When the processor determines a target encryption transformation strategy for encrypting the target data warehouse from multiple encryption transformation strategies based on the attribute information, it is configured to:

[0119] In response to the number of data tables exceeding a third threshold, a third encryption transformation strategy is selected. The third encryption transformation strategy is used to encrypt each plaintext data table in the target data warehouse by adding a second ciphertext table field and the corresponding ciphertext sensitive data of the second ciphertext table field. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from the upstream ciphertext data table of the plaintext data table.

[0120] In some embodiments, the target encryption modification strategy is the third encryption modification strategy, and the processor, in its implementation, is used to implement:

[0121] A second ciphertext table field and the corresponding ciphertext sensitive data are added to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table.

[0122] In response to the fact that the upstream data table of the third ciphertext data table has been converted from a plaintext data table to a ciphertext data table, the second ciphertext table field in the third ciphertext data table is updated according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table.

[0123] For each of the third ciphertext data tables, the caller of the second plaintext table field in the third ciphertext data table switches the referenced second plaintext table field to the corresponding second ciphertext table field;

[0124] In response to the caller having switched the referenced second plaintext table field to the second ciphertext table field in the third ciphertext data table, the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field are deleted from the third ciphertext data table.

[0125] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the computer equipment described above can be referred to the corresponding process in the aforementioned data warehouse management method embodiments, and will not be repeated here.

[0126] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0127] This application also provides a storage medium storing a computer program, the computer program including program instructions, and the method implemented when the program instructions are executed can be found in various embodiments of the data warehouse management method of this application.

[0128] The storage medium can be volatile or non-volatile. It can be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard drive or memory of the computer device. Alternatively, it can be an external storage device of the computer device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card.

[0129] Furthermore, the storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store the operating system, applications required for at least one function, etc.; and the data storage area may store data created based on the use of blockchain nodes, etc.

[0130] The blockchain referred to in this application is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0131] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0132] It should also be understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. It should be noted that, herein, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0133] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. The above descriptions are merely specific implementations of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data warehouse management method, characterized in that, include: Obtain the attribute information of the target data warehouse, which is the data warehouse to be encrypted and modified; Based on the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse is determined from multiple encryption transformation strategies. According to the target encryption transformation strategy, the target data warehouse is encrypted and transformed so that all sensitive data in the target data warehouse is switched from plaintext sensitive data to ciphertext sensitive data. The attribute information includes at least one of available system resources and the amount of data stored. The step of determining a target encryption transformation strategy for encrypting the target data warehouse from multiple encryption transformation strategies based on the attribute information includes: In response to the data volume exceeding a first threshold and / or the available system resources falling below a second threshold, a second encryption transformation strategy is selected. The second encryption transformation strategy is used to create a new corresponding first ciphertext data table for each plaintext data table in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field for each plaintext data table in the processing layer of the target data warehouse. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext data table. The target encryption transformation strategy is the second encryption transformation strategy, and the step of encrypting the target data warehouse according to the target encryption transformation strategy includes: In the target data warehouse, a first ciphertext data table is created corresponding to each first plaintext data table, and the first plaintext data table is located in the source layer; A first ciphertext table field and the corresponding ciphertext sensitive data are added to each second plaintext data table to obtain the corresponding second ciphertext data table. The second plaintext data table is located in the processing layer. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table.

2. The data warehouse management method according to claim 1, characterized in that, The attribute information includes at least one of available system resources and the amount of data stored. The step of determining a target encryption transformation strategy for encrypting the target data warehouse from multiple encryption transformation strategies based on the attribute information includes: In response to the data volume being less than or equal to a first threshold and / or the available system resources being greater than or equal to a second threshold, a first encryption transformation strategy is selected. The first encryption transformation strategy is used to encrypt and transform the target data warehouse by creating a corresponding first ciphertext data table for each plaintext data table in the target data warehouse. All sensitive data in the first ciphertext data table is ciphertext sensitive data, and all table fields are plaintext table fields.

3. The data warehouse management method according to claim 2, characterized in that, The target encryption transformation strategy is the first encryption transformation strategy, and the step of encrypting the target data warehouse according to the target encryption transformation strategy includes: In the target data warehouse, a first ciphertext data table is created corresponding to each plaintext data table. The upstream business data accessed by the plaintext data table and the corresponding first ciphertext data table is the same, and the sensitive data in the plaintext data table is plaintext, while the sensitive data in the corresponding first ciphertext data table is ciphertext. For each of the plaintext data tables, the caller of the plaintext data table controls the caller to switch the plaintext data table to the first ciphertext data table; In response to the caller of the plaintext data table having switched the invoked plaintext data table to the first ciphertext data table, the plaintext data table is deleted.

4. The data warehouse management method according to claim 3, characterized in that, In the target data warehouse, a first encrypted data table corresponding to the plaintext data table is created, including: A new blank data table is created in the target data warehouse, and the upstream business data connected to the plaintext data table is connected to the blank data table to obtain a new plaintext data table. According to the preset encryption function, all sensitive data in the new plaintext data table is encrypted to obtain the corresponding first ciphertext data table.

5. The data warehouse management method according to claim 2, characterized in that, The target encryption transformation strategy is the second encryption transformation strategy, and the step of encrypting the target data warehouse according to the target encryption transformation strategy further includes: For each of the first plaintext data tables, the caller of the first plaintext data table controls the caller to switch the first plaintext data table to the corresponding first ciphertext data table. In response to the caller of the first plaintext data table having switched the first plaintext data table to the corresponding first ciphertext data table, the first plaintext data table is deleted. For each second ciphertext data table, the caller of the first plaintext table field in the second ciphertext data table switches the referenced first plaintext table field to the corresponding first ciphertext table field; In response to the caller having switched the referenced first plaintext table field in the second ciphertext data table to the first ciphertext table field, the first plaintext table field and the plaintext sensitive data corresponding to the first plaintext table field are deleted from the second ciphertext data table.

6. The data warehouse management method according to any one of claims 1-5, characterized in that, The attribute information includes the number of data tables in the target data warehouse. The step of determining a target encryption transformation strategy for encrypting the target data warehouse from multiple encryption transformation strategies based on the attribute information includes: In response to the number of data tables exceeding a third threshold, a third encryption transformation strategy is selected. The third encryption transformation strategy is used to encrypt each plaintext data table in the target data warehouse by adding a second ciphertext table field and the corresponding ciphertext sensitive data of the second ciphertext table field. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the same plaintext data table, or the second ciphertext table field is obtained from the upstream ciphertext data table of the plaintext data table.

7. The data warehouse management method according to claim 6, wherein the target encryption transformation strategy is the third encryption transformation strategy, and the step of encrypting the target data warehouse according to the target encryption transformation strategy includes: A second ciphertext table field and the corresponding ciphertext sensitive data are added to each plaintext data table in the target data warehouse to obtain a corresponding third ciphertext data table. The second ciphertext table field is obtained by encrypting the second plaintext table field corresponding to the plaintext sensitive data in the plaintext data table. In response to the fact that the upstream data table of the third ciphertext data table has been converted from a plaintext data table to a ciphertext data table, the second ciphertext table field in the third ciphertext data table is updated according to the ciphertext table field in the upstream ciphertext data table of the third ciphertext data table. For each of the third ciphertext data tables, the caller of the second plaintext table field in the third ciphertext data table switches the referenced second plaintext table field to the corresponding second ciphertext table field; In response to the caller having switched the referenced second plaintext table field to the second ciphertext table field in the third ciphertext data table, the second plaintext table field and the plaintext sensitive data corresponding to the second plaintext table field are deleted from the third ciphertext data table.

8. A data warehouse management device, characterized in that, The data warehouse management device includes: The information acquisition module is used to acquire attribute information of the target data warehouse, which is the data warehouse to be encrypted and modified. The strategy determination module is used to determine, based on the attribute information, a target encryption transformation strategy for encrypting and transforming the target data warehouse from multiple encryption transformation strategies; The data warehouse transformation module is used to perform encryption transformation on the target data warehouse according to the target encryption transformation strategy, so that all sensitive data in the target data warehouse is switched from plaintext sensitive data to ciphertext sensitive data. The attribute information includes at least one of available system resources and the amount of stored data. The strategy determination module is further configured to select a second encryption transformation strategy in response to the data amount being greater than a first threshold and / or the available system resources being less than a second threshold. The second encryption transformation strategy is used to create a corresponding first ciphertext data table for each plaintext data table in the source layer of the target data warehouse, and to encrypt and transform the target data warehouse by adding a first ciphertext table field and ciphertext sensitive data corresponding to the first ciphertext table field for each plaintext data table in the processing layer of the target data warehouse. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the sensitive data in the first ciphertext table. The target encryption transformation strategy is the second encryption transformation strategy. The data warehouse transformation module is further used to create a first ciphertext data table corresponding to each first plaintext data table in the target data warehouse. The first plaintext data table is located in the source layer. A first ciphertext table field and the ciphertext sensitive data corresponding to the first ciphertext table field are added to each second plaintext data table to obtain the corresponding second ciphertext data table. The second plaintext table is located in the processing layer. The first ciphertext table field is obtained by encrypting the first plaintext table field corresponding to the ciphertext sensitive data in the first ciphertext data table upstream of the second plaintext data table.

9. A computer device, characterized in that, The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, it implements the data warehouse management method as described in any one of claims 1 to 7.

10. A storage medium for computer-readable storage, characterized in that, The storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the data warehouse management method as described in any one of claims 1 to 7.

Images