Data isolation encryption method, device and system and readable storage medium

Abstract

The invention discloses a data isolation encryption method, device and system and a readable storage medium, which are applied to the field of data security, and are characterized in that a user identity is embedded into a data writing request through an application proxy gateway, a corresponding encryption key is determined through a database proxy gateway according to the user identity in the data writing request, and encryption is carried out; and encryption protection of database data is realized. That is to say, when a user logs in the application service to access the database, differential key encryption of the application identity is realized on the database through the access proxy of the double gateways, so that the database has higher security under the condition of encrypted storage, and the application service does not need to modify codes and is non-inductive to service logic; data encryption protection can be implemented before and after the application server, subsequent isolation encryption of the extensible permission access control capability data is more flexible and convenient, and the expansibility is high.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a data isolation encryption method, device, system and readable storage medium. Background Art

[0002] Usually, multiple application data are stored in the same database. At this time, a method is needed to isolate and encrypt data based on application identity to protect the security of data assets. In this way, although data of different application identities exist in the same database and table, they are isolated and invisible to each other.

[0003] In the prior art, the method of isolating and encrypting data using identity is generally modified on the application side, and the encryption and decryption business logic is written into the application through hard-coding. This isolation and encryption method is relatively cumbersome, and the business is highly coupled with the application, resulting in poor flexibility in data protection.

[0004] Therefore, how to provide a convenient and flexible data isolation encryption method is an urgent problem that needs to be solved. Summary of the invention

[0005] In view of this, an object of the present invention is to provide a data isolation encryption method, device, system and readable storage medium, which solves the problem that data isolation encryption is not flexible enough in the prior art.

[0006] In order to solve the above technical problems, the present invention provides a data isolation encryption method, comprising:

[0007] Using the application proxy gateway to obtain a data write request from a user to access an application system, determining a target user identity according to a session identifier in the data write request, embedding the target user identity into the data write request, and sending the embedded data write request to an application server;

[0008] A database proxy gateway is used to receive the request statement sent by the application server according to the embedded data write request, an encryption key is determined according to the target user identity in the request statement, the plain text in the request statement is encrypte... d using the encryption key, and the encrypted request statement is sent to the database server.

[0009] Optionally, before using the application proxy gateway to obtain a data write request from a user to access the application system, the method further includes:

[0010] Using the application proxy gateway to obtain a login request from the user to log in to the application system through a browser; the login request includes login information, and the login information includes at least a user identity and the session identifier;

[0011] Constructing a mapping relationship between the user identity and the session identifier, and caching the mapping relationship;

[0012] Accordingly, determining the target user identity according to the session identifier in the data writing request includes:

[0013] The corresponding target user identity is searched from the cached mapping relationship according to the session identifier in the data writing request.

[0014] Optionally, before using the application proxy gateway to obtain a data write request from a user to access the application system, the method further includes:

[0015] Starting a key management system, wherein the key management system stores encryption key information corresponding to different user identities;

[0016] Accordingly, determining the encryption key according to the target user identity in the request statement includes:

[0017] According to the target user identity in the request statement, the corresponding encryption key is searched from the key management system.

[0018] Optionally, embedding the target user identity into the data writing request includes:

[0019] The data content in the data write request is encrypted using a preset isolation encryption strategy and the target user identity to obtain the embedded data write request.

[0020] Optionally, the preset isolation encryption strategy includes at least strategies for request address, encryption field, user identity and field encryption method.

[0021] Optionally, the user identity is a user account.

[0022] Optionally, also include:

[0023] When the database server receives a data read request, the database server sends the ciphertext data list corresponding to the data read request to the database proxy gateway;

[0024] Decrypting the ciphertext data list through the database proxy gateway to obtain a decrypted data list, and sending it to the application server, so that the application server sends the decrypted data list to the application proxy gateway;

[0025] The user identity in the decrypted data list is removed by the application proxy gateway to obtain a plaintext list without the user identity, and the plaintext list is returned to the browser for display.

[0026] The present invention also provides a data isolation encryption device, comprising:

[0027] A user identity embedding module is used to obtain a data write request from a user to access an application system by using an application proxy gateway, determine a target user identity according to a session identifier in the data write request, embed the target user identity into the data write request, and send the embedded data write request to an application server;

[0028] The data encryption module is used to use the database proxy gateway to receive the request statement sent by the application server according to the embedded data write request, determine the encryption key according to the target user identity in the request statement, use the encryption key to encrypt the plain text in the request statement, and send the encrypted request statement to the database server.

[0029] The present invention also provides a data isolation encryption system, comprising:

[0030] Application proxy gateway, application server, database proxy gateway and database server;

[0031] The application proxy gateway is used to obtain a data writing request from a user to access an application system, determine a target user identity according to a session identifier in the data writing request, embed the target user identity into the data writing request, and send the embedded data writing request to the application server;

[0032] The database proxy gateway is used to receive the request statement sent by the application server according to the embedded data write request, determine the encryption key according to the target user identity in the request statement, use the encryption key to encrypt the plain text in the request statement, and send the encrypted request statement to the database server.

[0033] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the steps of the data isolation encryption method as described above are implemented.

[0034] It can be seen that the present invention uses the application proxy gateway to obtain the data write request of the user to access the application system, determines the target user identity according to the session identifier in the data write request, embeds the target user identity into the data write request, and sends the embedded data write request to the application server; uses the database proxy gateway to receive the request statement sent by the application server according to the embedded data write request, determines the encryption key according to the target user identity in the request statement, encrypts the plaintext in the request statement using the encryption key, and sends the encrypted request statement to the database server. The present invention embeds the user identity in the data write request through the application proxy gateway, determines the corresponding encryption key according to the user identity in the data write request through the database proxy gateway, and encrypts it to realize the encryption protection of the database data. That is to say, when the user logs in to the application service to access the database, the differential key encryption of the application identity is realized for the database through the access proxy of the dual gateway, so that the database has higher security in the case of secret storage, and the application service does not need to modify the code and is not sensitive to the business logic; it can implement data encryption protection before and after the application server, and the isolation encryption of the permission access control capability data can be expanded later, which is more flexible and convenient, and has strong scalability.

[0035] In addition, the present invention also provides a data isolation encryption device, system and readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flowchart of a data isolation encryption method provided by an embodiment of the present invention;

[0038] Figure 2 An example flowchart of a data writing method provided by an embodiment of the present invention;

[0039] Figure 3 A schematic diagram of the structure of a data isolation and encryption device provided by an embodiment of the present invention;

[0040] Figure 4 A schematic diagram of the structure of a data isolation encryption system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The secret database can prevent the stored data from being leaked due to attacks on application and database vulnerabilities. Based on the current data isolation security requirements, a method is needed to isolate and encrypt data based on application identity to protect the security of data assets, ensuring that data written by different application identities exist in the same database and table, but are isolated and cannot be seen.

[0043] In the prior art, when an application writes data to a database, different application identities are encrypted with the same key, and it is impossible to isolate data based on different identities. Even if identity data isolation encryption is implemented, it is hard-coded in the code, that is, the encryption and decryption business logic is written in the application. This results in a high degree of coupling between the business and the application, and is not flexible enough in data protection.

[0044] Based on the above problems, the present invention uses dual gateway technology to encrypt data based on identity-based differentiated keys, thereby achieving identity isolation when storing / writing data. Figure 1 , Figure 1 A flowchart of a data isolation encryption method provided by an embodiment of the present invention. The method may include:

[0045] S101: Using the application proxy gateway to obtain a data write request from a user to access an application system, determining a target user identity according to a session identifier in the data write request, embedding the target user identity into the data write request, and sending the embedded data write request to an application server.

[0046] It should be noted that the application proxy gateway is deployed in series between the application server and the user terminal. When the user accesses the application server through the user terminal, the traffic will pass through the application proxy gateway. Therefore, the application proxy gateway can monitor the requests between the user terminal and the application server. In this embodiment, the request between the user terminal and the server is an HTTP (HyperText Transfer Protocol) request. Based on the mechanism of the HTTP protocol itself, the request header after each HTTP login will carry a session ID (identification number or identifier). This embodiment does not limit the user terminal, for example, it can be a browser. This embodiment does not limit the user identity, as long as the user can be indicated. For example, the user identity can be a user ID, or an admin (user) account.

[0047] It should be further explained that the application system IP (Internet Protocol) in this embodiment is the same as the application proxy gateway IP, that is, when user A logs in to the application system using the user account, the application system IP accessed at this time is the application proxy gateway IP. The purpose of step S101 is to use the application proxy gateway to embed the user identity into the intercepted data write request and send it to the application server.

[0048] Furthermore, in order to improve the accuracy and efficiency of the application proxy gateway in determining the user identity according to the session ID in the request, before the above-mentioned use of the application proxy gateway to obtain the user's data writing request to access the application system, the following steps may also be included:

[0049] Using the application proxy gateway to obtain a login request from a user to log in to the application system through a browser; the login request includes login information, and the login information includes at least a user identity and a session identifier;

[0050] Build a mapping between user identity and session identifier and cache the mapping.

[0051] Accordingly, the above-mentioned determination of the target user identity according to the session identifier in the data writing request may specifically include the following steps:

[0052] The corresponding target user identity is searched from the cached mapping relationship according to the session identifier in the data write request.

[0053] Specifically, the application proxy gateway listens to the data write request of the user who logs into the application system through the browser. The data write request is an HTTP request, so the request header contains a session ID. The session ID is a unique identifier automatically generated by the system during a specific session, which is used to distinguish and manage different user sessions. When a user logs into the application system for the first time, the login request (the login request is also an HTTP request) will carry login information, such as user identity and session ID. At this time, the application proxy gateway caches the mapping relationship between the session ID and the user identity. After the same user logs into the application system, the session ID will not change during the session. Subsequent access requests (the access request is also an HTTP request, such as data write requests and data read requests) can determine the identity of the user currently logged into the system through the session ID and its cached mapping relationship.

[0054] Furthermore, in order to improve the accuracy and efficiency of identity embedding by the application proxy gateway, the above-mentioned embedding of the target user identity into the data writing request may specifically include the following steps:

[0055] The data content in the data write request is encrypted using the preset isolation encryption strategy and the target user identity to obtain an embedded data write request.

[0056] Specifically, the application proxy gateway intercepts the data write request, finds the corresponding user identity from the application proxy gateway cache according to the session ID in the request header, encrypts the data content in the request in combination with the pre-set isolation encryption strategy, modifies the request data body and embeds the identity identifier, and then forwards the modified request to the application server.

[0057] Furthermore, in order to ensure the security and accuracy of identity embedding, the above-mentioned preset isolation encryption strategy at least includes strategies for request address, encryption field, user identity and field encryption method.

[0058] Specifically, the preset isolation encryption strategy includes configuration of request address / encryption field / login user / field encryption method, etc. For example, the specific contents of request address, encryption field, user identity and field encryption method can refer to Table 1.

[0059] Table 1 Preset isolation encryption strategy table

[0060]

[0061] S102: Using a database proxy gateway to receive a request statement sent by an application server according to an embedded data write request, determining an encryption key according to a target user identity in the request statement, using the encryption key to encrypt the plain text in the request statement, and sending the encrypted request statement to a database server.

[0062] It should be noted that the database proxy gateway is deployed in series between the application server and the database server, and the database proxy gateway can monitor the SQL (Structured Query Language) request traffic of the application accessing the database. In other words, the request between the application server and the database server is a request for an SQL statement. The application server obtains a request statement based on the data write request embedded with the user identity sent by the application service gateway, and sends it to the database proxy gateway, where the request statement is an SQL statement. The database proxy gateway encrypts the plaintext in the request statement based on the user identity in the request statement. The purpose of step S102 is to use the database proxy gateway to determine the encryption key based on the user identity, and use the encryption key to encrypt the request statement of the user identity, thereby realizing encryption of data based on the user identity.

[0063] Furthermore, in order to improve the accuracy and security of encryption, before using the application proxy gateway to obtain the data writing request of the user to access the application system, the following steps may also be included:

[0064] Start the key management system, which stores encryption key information corresponding to different user identities.

[0065] Accordingly, the above-mentioned determination of the encryption key according to the target user identity in the request statement may specifically include the following steps:

[0066] According to the target user identity in the request statement, the corresponding encryption key is found from the key management system.

[0067] Specifically, the KMS (Key Management Service) system is started in advance. The system mainly stores different user identities and corresponding encryption key information. In this way, the database proxy gateway extracts the user identity from the request statement, and then accesses the KMS system to obtain the encryption key corresponding to the user identity. The encryption key is used to encrypt the plaintext content in the request statement, that is, the plaintext content of the request statement is replaced with ciphertext. It is then forwarded to the database server to achieve identity isolation encryption.

[0068] Furthermore, the above method may further include the following steps:

[0069] Step S11: When the database server receives a data read request, the database server sends the ciphertext data list corresponding to the data read request to the database proxy gateway;

[0070] Step S12: decrypting the ciphertext data list through the database proxy gateway to obtain a decrypted data list, and sending it to the application server, so that the application server sends the decrypted data list to the application proxy gateway;

[0071] Step S13: removing the user identity from the decrypted data list through the application proxy gateway to obtain a plaintext list without the user identity, and returning the plaintext list to the browser for display.

[0072] The access request targeted by step S101 and step S102 is a data write request, while the access request targeted by step S11 and step S13 is a data read request. It can be understood that the core content of the data write request and the data read request remains unchanged. The data write request is the process of embedding identity and encrypting data in the request. On the contrary, the data read request is the process of decrypting data and removing identity in the response to the request. For details, please refer to the following content:

[0073] After the user logs in to the application system using a browser, the application proxy gateway obtains the identity of the currently logged in user and saves the user identity corresponding to the current login session ID. The application server initiates a database query request (select * from article_info) to the database proxy gateway, and the database proxy gateway forwards the request statement to the database server. Exemplarily, the data reading request is a request to view the article list page. The database server returns the query ciphertext data list (see Table 2) to the database proxy gateway. The database proxy gateway obtains the user identity ciphertext from the encrypted data in the ciphertext data list, determines the corresponding key based on the user identity ciphertext, and performs data decryption operations. The decrypted data list is forwarded to the application server, and the application server forwards it to the application proxy gateway. The application proxy gateway removes the user identity from the decrypted data list, processes the plaintext list without the user identity (see Table 3), and returns the plaintext list to the browser for display.

[0074] Table 2 List of examples of ciphertext data to be queried

[0075]

[0076] Table 3 Plain text example list

[0077]

[0078] The data isolation encryption method provided by the embodiment of the present invention is applied, and the data write request of the user to access the application system is obtained by using the application proxy gateway, and the target user identity is determined according to the session identifier in the data write request, and the target user identity is embedded in the data write request, and the embedded data write request is sent to the application server; the database proxy gateway is used to receive the request statement sent by the application server according to the embedded data write request, and the encryption key is determined according to the target user identity in the request statement, and the plain text in the request statement is encrypted by the encryption key, and the encrypted request statement is sent to the database server. The present invention embeds the user identity in the data write request through the application proxy gateway, and determines the corresponding encryption key according to the user identity in the data write request through the database proxy gateway, and encrypts it to realize the encryption protection of the database data. That is to say, when the user logs in to the application service to access the database, the differential key encryption of the application identity is realized for the database through the access proxy of the dual gateway, so that the database has higher security in the case of secret storage, and the application service does not need to modify the code and is not sensitive to the business logic; data encryption protection can be implemented before and after the application server, and the isolation encryption of the permission access control capability data can be expanded later, which is more flexible and convenient, and has strong scalability.

[0079] In order to make the present invention easier to understand, please refer to Figure 2 , Figure 2 This is a flow chart of a data writing method provided by an embodiment of the present invention. The participating modules include a browser, an application proxy gateway, an application server, a database proxy gateway, and a database server. The specific process can be divided into preparation, identity embedding, and data encryption. The following is a detailed description of each part:

[0080] 1. Preparation:

[0081] (1) Start the KMS system, which is mainly used to store different user identities and corresponding encryption key information;

[0082] (2) Deploy the application proxy gateway in series upstream of the application server and start it. All access requests from users to the application server through the browser will pass through the application proxy gateway, where the access requests can be monitored. The access requests are HTTP requests. Due to the mechanism of the HTTP protocol itself, the request header after each HTTP login will carry a [session ID].

[0083] (3) The database proxy gateway is deployed in series between the application server and the database server and started to monitor the application's access to the database request, which is a SQL request.

[0084] This embodiment is divided into two parts. This embodiment takes the data writing request as a request to add an article as an example for explanation:

[0085] 2. Identity Embedding:

[0086] (1) User A logs in to the application system using the admin account. The IP address of the application system being accessed is the IP address of the application proxy gateway. The application proxy gateway forwards the HTTP request to the application server. All HTTP requests and response data pass through the application proxy gateway.

[0087] (2) The application proxy gateway listens to the HTTP request for user login. When a user logs into the application system for the first time, the HTTP request will carry login information, such as the admin account and session ID. The application proxy gateway caches the mapping relationship between the session ID and the admin account. The session ID will not change during the same user login session. Subsequent HTTP requests can determine the admin account currently logged into the system through the session ID.

[0088] (3) After the user logs in, the user creates an article on the browser's operating web page. For example, after the user enters the article title and content on the browser interface and clicks the submit button, the actual network layer HTTP request data is as follows:

[0089] Request URL: article / add, submission message content format

[0090] {

[0091] "title": "The title of this article",

[0092] "content": "content of this article",

[0093] }

[0094] (4) After the application proxy gateway intercepts the above request to add an article, it first obtains the session ID in the request header, finds the corresponding account admin from the application proxy gateway cache based on the session ID, and matches the data content of the request that needs to be encrypted in combination with the isolation encryption strategy configured in advance. It will modify the submitted request data body and embed the identity identifier, and then forward the modified request to the application server.

[0095] The modified request data is as follows:

[0096] {

[0097] "title": "The title of this article, [identity admin]",

[0098] “content”: “The content of this article, [identity ID admin]”,

[0099] }

[0100] 3. Data encryption:

[0101] (1) After receiving the (encrypted) request from the browser to add an article, the application server establishes a connection with the database proxy gateway, which in turn establishes a connection with the database server. The application server then sends a SQL (Structured Query Language) statement to the database proxy gateway, as follows:

[0102] insert into article_info values(100, "This article title, [identity admin]", "This article content, [identity admin]")

[0103] (2) The database proxy gateway listens to the SQL statement sent by the application server to the database server. The database proxy gateway parses the SQL statement to extract whether there is an identity identifier in the title / content, such as the admin account. If so, it accesses the KMS system to obtain the encryption key corresponding to the admin account, and uses the encryption key to encrypt "this article title" and "this article content", replacing the plain text content in the SQL statement with cipher text.

[0104] (3) Forward the encrypted SQL statement (such as insert into article_info values(100, "Title ciphertext", "Content ciphertext")) to the database server to implement identity isolation encryption.

[0105] The following is an introduction to a data isolation encryption device provided by an embodiment of the present invention. The data isolation encryption device described below and the data isolation encryption method described above can be referenced to each other.

[0106] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of a data isolation encryption device provided by an embodiment of the present invention may include:

[0107] The user identity embedding module 100 is used to obtain a data writing request from a user to access an application system by using an application proxy gateway, determine a target user identity according to a session identifier in the data writing request, embed the target user identity into the data writing request, and send the embedded data writing request to an application server;

[0108] The data encryption module 200 is used to use the database proxy gateway to receive the request statement sent by the application server according to the embedded data write request, determine the encryption key according to the target user identity in the request statement, use the encryption key to encrypt the plain text in the request statement, and send the encrypted request statement to the database server.

[0109] Based on the above embodiment, the data isolation encryption device may further include:

[0110] A login information acquisition module, used to use the application proxy gateway to acquire a login request from the user to log in to the application system through a browser; the login request includes login information, and the login information includes at least a user identity and the session identifier;

[0111] A mapping relationship building module, used to build a mapping relationship between the user identity and the session identifier, and cache the mapping relationship;

[0112] Accordingly, the user identity embedding module 100 may include:

[0113] The user identity search unit is used to search the corresponding target user identity from the cached mapping relationship according to the session identifier in the data writing request.

[0114] Based on the above embodiment, the data isolation encryption device may further include:

[0115] A key management system startup module, used to start the key management system, wherein the key management system stores encryption key information corresponding to different user identities;

[0116] Accordingly, the data encryption module 200 may include:

[0117] The encryption key search unit is used to search the corresponding encryption key from the key management system according to the target user identity in the request statement.

[0118] Based on the above embodiment, the user identity embedding module 100 may include:

[0119] The identity embedding unit is used to encrypt the data content in the data writing request by using a preset isolation encryption strategy and the target user identity to obtain the embedded data writing request.

[0120] Based on the above embodiment, the preset isolation encryption strategy at least includes strategies for request address, encryption field, user identity and field encryption method.

[0121] Based on the above embodiment, the user identity is a user account.

[0122] Based on the above embodiment, the data isolation encryption device may further include:

[0123] A ciphertext data list acquisition module, configured to, when the database server receives a data read request, send the ciphertext data list corresponding to the data read request to the database proxy gateway;

[0124] A decryption module, used to decrypt the ciphertext data list through the database proxy gateway to obtain a decrypted data list, and send it to the application server, so that the application server sends the decrypted data list to the application proxy gateway;

[0125] The removal module is used to remove the user identity in the decrypted data list through the application proxy gateway, obtain a plaintext list without the user identity, and return the plaintext list to the browser for display.

[0126] It should be noted that the order of the modules and units in the above-mentioned data isolation encryption device can be changed without affecting the logic.

[0127] The data isolation encryption device provided by the embodiment of the present invention is used, through the user identity embedding module 100, to obtain the data write request of the user to access the application system by using the application proxy gateway, determine the target user identity according to the session identifier in the data write request, embed the target user identity into the data write request, and send the embedded data write request to the application server; the data encryption module 200 is used to receive the request statement sent by the application server according to the embedded data write request by using the database proxy gateway, determine the encryption key according to the target user identity in the request statement, encrypt the plaintext in the request statement by using the encryption key, and send the encrypted request statement to the database server. This device embeds the user identity in the data write request through the application proxy gateway, determines the corresponding encryption key according to the user identity in the data write request through the database proxy gateway, and encrypts it, so as to realize the encryption protection of the database data. That is to say, when the user logs in to the application service to access the database, the database is encrypted with differentiated keys of the application identity through the access proxy of the dual gateway, so that the database has higher security in the case of confidential storage, and the application service does not need to modify the code and is unaware of the business logic; data encryption protection can be implemented before and after the application server, and the isolation encryption of data with expandable permission access control capabilities can be expanded later, which is more flexible, convenient and scalable.

[0128] The following is an introduction to a data isolation encryption system provided by an embodiment of the present invention. The data isolation encryption system described below and the data isolation encryption method described above can be referenced to each other.

[0129] Please refer to Figure 4 , Figure 4A structural diagram of a data isolation encryption system provided by an embodiment of the present invention may include:

[0130] Application proxy gateway 10, application server 20, database proxy gateway 30 and database server 40;

[0131] The application proxy gateway 10 is used to obtain a data writing request from a user to access an application system, determine a target user identity according to a session identifier in the data writing request, embed the target user identity into the data writing request, and send the embedded data writing request to the application server 20;

[0132] The database proxy gateway 30 is used to receive the request statement sent by the application server 20 according to the embedded data write request, determine the encryption key according to the target user identity in the request statement, use the encryption key to encrypt the plain text in the request statement, and send the encrypted request statement to the database server 40.

[0133] The specific execution actions of the proxy gateway 10, the application server 20, the database proxy gateway 30 and the database server 40 in the system can refer to the data isolation encryption method described above.

[0134] Of course, it should be noted that Figure 4 The structure shown does not constitute a limitation on the data isolation encryption system in the embodiment of the present invention. In actual applications, the data isolation encryption system may include Figure 4 More or fewer components than shown, or combinations of certain components.

[0135] The following is an introduction to a readable storage medium provided in an embodiment of the present invention. The readable storage medium described below and the data isolation encryption method described above can be referenced to each other.

[0136] The present invention also provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data isolation encryption method are implemented.

[0137] The readable storage medium may be a computer-readable storage medium, which may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0138] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0139] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0140] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0141] The above is a detailed introduction to a data isolation encryption method, device, system and computer-readable storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a general technician in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A data isolation encryption method, characterized in that: include: Using the application proxy gateway to obtain a data write request from a user to access an application system, determining a target user identity according to a session identifier in the data write request, embedding the target user identity into the data write request, and sending the embedded data write request to an application server; A database proxy gateway is used to receive the request statement sent by the application server according to the embedded data write request, an encryption key is determined according to the target user identity in the request statement, the plain text in the request statement is encrypte... d using the encryption key, and the encrypted request statement is sent to the database server.

2. The data isolation encryption method according to claim 1, characterized in that: Before using the application proxy gateway to obtain the data writing request of the user to access the application system, it also includes: Using the application proxy gateway to obtain a login request from the user to log in to the application system through a browser; the login request includes login information, and the login information includes at least a user identity and the session identifier; Constructing a mapping relationship between the user identity and the session identifier, and caching the mapping relationship; Accordingly, determining the target user identity according to the session identifier in the data writing request includes: The corresponding target user identity is searched from the cached mapping relationship according to the session identifier in the data writing request.

3. The data isolation encryption method according to claim 1, characterized in that: Before using the application proxy gateway to obtain the data writing request of the user to access the application system, it also includes: Starting a key management system, wherein the key management system stores encryption key information corresponding to different user identities; Accordingly, determining the encryption key according to the target user identity in the request statement includes: According to the target user identity in the request statement, the corresponding encryption key is searched from the key management system.

4. The data isolation encryption method according to claim 1, characterized in that: The embedding the target user identity into the data writing request includes: The data content in the data write request is encrypted using a preset isolation encryption strategy and the target user identity to obtain the embedded data write request.

5. The data isolation encryption method according to claim 4, characterized in that: The preset isolation encryption strategy at least includes strategies for request address, encryption field, user identity and field encryption method.

6. The data isolation encryption method according to claim 2 or 3, characterized in that: The user identity is a user account.

7. The data isolation encryption method according to claim 1, characterized in that: Also includes: When the database server receives a data read request, the database server sends the ciphertext data list corresponding to the data read request to the database proxy gateway; Decrypting the ciphertext data list through the database proxy gateway to obtain a decrypted data list, and sending it to the application server, so that the application server sends the decrypted data list to the application proxy gateway; The user identity in the decrypted data list is removed by the application proxy gateway to obtain a plaintext list without the user identity, and the plaintext list is returned to the browser for display.

8. A data isolation encryption device, characterized in that: include: A user identity embedding module is used to obtain a data write request from a user to access an application system by using an application proxy gateway, determine a target user identity according to a session identifier in the data write request, embed the target user identity into the data write request, and send the embedded data write request to an application server; The data encryption module is used to use the database proxy gateway to receive the request statement sent by the application server according to the embedded data write request, determine the encryption key according to the target user identity in the request statement, use the encryption key to encrypt the plain text in the request statement, and send the encrypted request statement to the database server.

9. A data isolation encryption system, characterized in that: include: Application proxy gateway, application server, database proxy gateway and database server; The application proxy gateway is used to obtain a data writing request from a user to access an application system, determine a target user identity according to a session identifier in the data writing request, embed the target user identity into the data writing request, and send the embedded data writing request to the application server; The database proxy gateway is used to receive the request statement sent by the application server according to the embedded data write request, determine the encryption key according to the target user identity in the request statement, use the encryption key to encrypt the plain text in the request statement, and send the encrypted request statement to the database server.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the steps of the data isolation encryption method according to any one of claims 1 to 7 are implemented.

Images