Data processing method based on SQL (Structured Query Language) statement, electronic equipment and storage medium

Abstract

The invention provides a data processing method based on an SQL statement, electronic equipment and a storage medium, and belongs to the technical field of databases. The method comprises the steps of obtaining a to-be-processed SQL statement; the method comprises the following steps: analyzing grammar in an SQL (Structured Query Language) statement to construct a corresponding data flow diagram, the data flow diagram comprises a plurality of hierarchies, each hierarchy comprises at least one node, and an edge for connecting the nodes in the adjacent hierarchies indicates that the node in the previous hierarchy is obtained by assigning or operating one or more nodes in the next hierarchy in the adjacent hierarchies; nodes in the lowest level are data columns involved in the SQL statement; identifying whether an encryption operation node exists in all nodes in the data flow diagram, wherein the encryption operation node represents a node obtained by performing operation on a node corresponding to the encrypted data column; and when the encryption operation node exists, judging that the SQL statement is an illegal SQL statement. According to the method, the illegal SQL statement can be accurately judged.

Description

Technical Field

[0001] The present application relates to the field of database technology, and in particular to a data processing method, electronic device and storage medium based on SQL statements. Background Art

[0002] With the rapid development of information technology, data security has become the focus of attention for enterprises and organizations. Among the many data protection measures, database encryption is an effective means to prevent unauthorized access and data leakage by encrypting sensitive data. The client uses database SQL statements to add, delete, modify, and query data table columns in the database server. When the data columns that the SQL statement needs to process contain encrypted data columns, due to the limitations of ciphertext operations, some SQL statements will return incorrect results after being executed on the server, causing problems with the client-side business. At this time, the encryption gateway in the middle needs to identify such SQL statements that will return incorrect results (hereinafter collectively referred to as illegal SQL statements) and block the illegal SQL statements to prevent the spread of incorrect results.

[0003] To solve this problem, existing technical solutions usually rely on static rule sets to identify and block illegal SQL statements. However, this approach has limitations: it may not cover all possible illegal operations, especially in the case of complex queries and multi-table associations. In addition, static rule sets have high maintenance costs and are difficult to adapt to changing business needs and database structures. Summary of the invention

[0004] The purpose of this application is to provide a data processing method, electronic device and storage medium based on SQL statements to solve the above problems.

[0005] To achieve the above objectives, in a first aspect, the present application proposes a data processing method based on SQL statements, the method comprising: Get the SQL statement to be processed; A corresponding data flow graph is constructed by analyzing the syntax in the SQL statement, wherein the data flow graph includes multiple levels, each level includes at least one node, and the edge connecting the nodes in adjacent levels indicates that the node in the previous level in the adjacent levels depends on one or more nodes in the next level through assignment or operation, and the nodes in the lowest level are the data columns involved in the SQL statement; Identify whether there is an encryption operation node among all the nodes in the data flow graph, wherein the encryption operation node represents a node obtained by operating the node corresponding to the encrypted data column; When there is an encryption operation node, the SQL statement is determined to be an illegal SQL statement.

[0006] In some implementations, the nodes and edges in the data flow graph form a plurality of node flow chains; after determining that the SQL statement is an illegal SQL statement, the method further includes: The node flow chain where the encryption operation node is located is regarded as an illegal node flow chain; The SQL statement is intercepted, and interception information including an error output result is output, where the error output result is a result corresponding to a node at the top level in the illegal node flow chain.

[0007] In some embodiments, the method further comprises: In the bottom level of the data flow graph, nodes corresponding to the non-encrypted data columns are marked with a first mark, and nodes corresponding to the encrypted data columns are marked with a second mark; Flow the nodes into the chain, perform the third marking on the nodes obtained by computing the nodes containing the second marking, perform the first marking on the nodes obtained by computing or assigning only the nodes containing the first marking, perform the fourth marking on the nodes obtained by only assigning the nodes containing the second marking, and perform the fifth marking on the nodes obtained by only assigning the nodes containing the third marking; A data flow graph with labels is displayed, wherein the nodes with the third label represent encryption operation nodes.

[0008] In some embodiments, the method further comprises: Identifying the number of encryption operation nodes in the data flow graph; Based on the number of the encryption operation nodes, the illegality level of the SQL statement is determined.

[0009] In some implementations, after determining the illegality level of the SQL statement based on the number of the encryption operation nodes, the method further includes: Based on the illegal level of the SQL statement, determining a processing strategy corresponding to the SQL statement, the processing strategy including interception processing or rewriting processing; The processing strategy is executed on the SQL statement.

[0010] In some implementations, after determining that the SQL statement is an illegal SQL statement, the method further includes: Receiving an execution instruction for the illegal SQL statement; Based on the running instruction, determining a restricted data column in the illegal SQL statement corresponding to the encryption operation node, wherein the restricted data column is an encrypted data column participating in the operation in the illegal SQL statement; According to the read / write type corresponding to each restricted data column, modify the data value corresponding to each restricted data column to generate a modified SQL statement; The modified SQL statement is sent to a target database server, wherein the target database server is used to execute the modified SQL statement.

[0011] In some implementations, modifying the data value corresponding to each restricted data column according to the read / write type corresponding to each restricted data column includes: According to the read / write type corresponding to each restricted data column, marking each restricted data column as a write restricted data column or a read restricted data column; The data value corresponding to each read-restricted data column is decrypted and modified, and the data value corresponding to each write-restricted data column is encrypted and modified.

[0012] In some implementations, the decrypting and modifying the data value corresponding to each read-restricted data column, and the encrypting and modifying the data value corresponding to each write-restricted data column, further includes: Obtain a target decryption function corresponding to each read-restricted data column and a target encryption function corresponding to each write-restricted data column; Decrypt and modify the data value corresponding to each read restricted data column according to the target decryption function corresponding to each read restricted data column; and According to the target decryption function corresponding to each write restricted data column, the data value corresponding to each write restricted data column is encrypted and modified.

[0013] In a second aspect, the present application also proposes an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the data processing method based on SQL statements as described above.

[0014] In a third aspect, the present application further proposes a computer storage medium, wherein the storage medium stores executable instructions, and when the instructions are executed by a processor, the processor executes the data processing method based on SQL statements as described above.

[0015] Compared with the prior art, the beneficial effects of this application include: First, by building a data flow graph to analyze SQL statements, it is possible to accurately identify which operations involve encrypted columns, thereby more accurately determining illegal SQL statements. Second, by identifying encrypted computing nodes, it is possible to effectively prevent illegal computing operations on encrypted data columns, thereby enhancing the security of sensitive data in the database. Third, the present application identifies illegal SQL statements before they are executed, thereby avoiding business logic errors or data corruption caused by the execution of illegal SQL statements. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope of the present application.

[0017] Figure 1 A flowchart of a data processing method based on SQL statements in one embodiment; Figure 2 This is an example diagram of a data flow graph constructed based on SQL statements in an embodiment; Figure 3 This is an example diagram of a data flow graph constructed based on SQL statements in another embodiment; Figure 4 This is an example diagram of a data flow graph constructed based on SQL statements in another embodiment; Figure 5 A partial flow chart of a data processing method based on SQL statements in one embodiment; Figure 6 A partial flow chart of a data processing method based on SQL statements in another embodiment; Figure 7 A partial flow chart of a data processing method based on SQL statements in another embodiment; Figure 8 A partial flow chart of a data processing method based on SQL statements in yet another embodiment; Fig. 9 It is a structural schematic diagram of an electronic device involved in a data processing method based on SQL statements in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0019] All terms (including technical and scientific terms) used in this application have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used here should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0020] For example, the terms "first", "second", etc. used in this application may be used in this article to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first mark may be referred to as a second mark, and similarly, a second mark may be referred to as a first mark. Both the first mark and the second mark are marks, but they are not the same mark.

[0021] For another example, the terms “include”, “comprising”, etc. used in this application indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0022] As mentioned above, existing technical solutions usually rely on static rule sets to identify and block illegal SQL statements. However, this method has limitations: it may not cover all possible illegal operations, especially in the case of complex queries and multi-table associations. In addition, the maintenance cost of static rule sets is high, and it is difficult to adapt to changing business needs and database structures. To this end, the application proposes a data processing method, electronic device and storage medium based on SQL statements, which can analyze SQL statements by constructing a data flow graph, accurately identify which operations involve encrypted columns, and thus more accurately determine illegal SQL statements.

[0023] like Figure 1 As shown, the embodiment of the present application provides a data processing method based on SQL statements, including the following steps: Step S10, obtaining the SQL statement to be processed.

[0024] This embodiment is applied to a gateway, which is located between a database client and a database server, and is used to parse and process SQL statements sent from a database client to a database server. A database client refers to a client application or user interface that sends SQL statements. A database server refers to a database management system that receives and executes SQL statements. SQL statements refer to Structured Query Language statements, which are used to manage and operate relational databases. Common SQL statements include SELECT, INSERT, UPDATE, DELETE, etc.

[0025] Step S20, constructing a corresponding data flow graph by analyzing the syntax in the SQL statement.

[0026] The data flow graph includes multiple levels, each level includes at least one node, and the edges connecting the nodes in adjacent levels indicate that the node in the previous level in the adjacent levels depends on one or more nodes in the next level through assignment or operation, and the nodes in the lowest level are the data columns involved in the SQL statement.

[0027] In this embodiment, the data flow diagram is a graphical representation method for showing the flow path of data columns in SQL statements. The diagram includes multiple levels, each level contains one or more nodes, and the edges between the nodes indicate that the nodes in the upper level of the adjacent levels are obtained by assignment or operation depending on one or more nodes in the next level. The top level is the output layer in the data flow diagram, and the bottom level is the input layer in the data flow diagram. The nodes in the input layer are the data columns involved in the SQL statement. The level between the input layer and the output layer is the middle layer. Assignment means that the lower layer nodes are directly used as the nodes corresponding to the upper layer, and operation means that the nodes formed by logical operations between one or more nodes in the lower layer are required. The operation may specifically include operations such as maximum value, minimum value, sum, and average. The nodes can be parsed from the SQL statement by assignment or operation.

[0028] In some implementations, by analyzing SQL statements, objects (i.e., data columns) that need to be calculated in SQL statements are identified, and each object is used as an independent node in the lowest layer of the data flow diagram. Then, the SQL statement is analyzed based on the execution instructions for each lowest node, and the nodes of the upper layer relative to the lowest layer are constructed. The edge between the lowest node and the node of the upper layer reflects the connection relationship between the two nodes, and the node of the upper layer reflects the processing logic for the lowest node in the SQL statement, and the processing logic includes assignment and calculation. By completing the execution of the instructions for each SQL statement, it continues to extend to the upper layer of nodes until the SQL statement is completely disassembled to form an output layer, and each node in the output layer reflects the output result of the SQL statement.

[0029] Example 1: Figure 2 The SELECT statement shown in the figure is used to construct a two-layer data flow graph, where the SELECT statement is as follows: “SELECT AVG(prod_price) MAX(prod_price) MIN (prod_price) FROM products” By identifying the SELECT statement, we can find that the node at the bottom layer is the data column "prod_price", which is the prod_price column of the products table. The output layer contains three nodes, namely AVG(), MAX(), and MIN(). Each node in the output layer is a result that the SELECT statement needs to return, and the three nodes in the output layer are all nodes obtained through calculation.

[0030] Example 2: Figure 3 The SELECT statement shown in the figure is used to construct a two-layer data flow graph, where the SELECT statement is as follows: "SELECT prod_id,quantity, item_price,quantity *item_price FROM orderitems" By identifying this SELECT statement, we can find that the three nodes at the bottom layer are the three data columns "prod_id", "quantity" and "item_price" of the orderitems table, and the output layer contains four nodes, namely "prod_id", "quantity", "item_price" and "quantity *item_price". The three nodes in the output layer ("prod_id", "quantity" and "item_price") are directly assigned from the nodes in the input layer (see Figure 3 There is also an output layer node "quantity *item_price", which is the multiplication result of the input layer nodes "quantity" and "item_price".

[0031] Example 3: Figure 4 The four-layer data flow diagram shown is constructed by three-layer nested SELECT statements, wherein the three-layer nested SELECT statements are as follows: "SELECT vend_id, LOWER(new_prod_id),a3 FROM ( SELECT vend_id, new_prod_id, prod_price*2 As a3 FROM( SELECT vend_id, CONCAT ('MY',prod_id) As new_prod_id prod_price FROM products )As t1 )As t2;” By identifying the SELECT statement, we can get the three nodes at the bottom layer, which are the three data columns of the products table, "vend_id", "prod_id" and "prod_price"; the middle layer above the bottom layer includes three nodes, "vend_id", "CONCAT () As new_prod_id" and "prod_price"; the middle layer above the middle layer includes three nodes, "vend_id", "new_prod_id" and "prod_price*2 As a3"; the output layer includes three nodes, "vend_id", "LOWER()" and "a3". Each upper layer node is obtained by assigning or calculating the adjacent lower layer nodes.

[0032] Step S30, identifying whether there is an encryption operation node among all the nodes in the data flow graph.

[0033] The encryption operation node represents the node obtained by the operation of the node corresponding to the encrypted data column. The operation can be any non-assignment logical operation such as function operation, mathematical operation, comparison operation, etc. Among them, function operation refers to the SQL statement to perform data processing or calculation by calling a function. Mathematical operation refers to the basic arithmetic operations such as addition, subtraction, multiplication, and division in the SQL statement. Comparison operation refers to the comparison between two values ​​in the SQL statement (such as equal, greater than, less than, etc.).

[0034] Among them, when the data column is an encrypted data column, the node corresponding to the data column is an encryption node, but the encryption node does not reflect the operation, so it is not an encryption operation node. However, if the upper-layer node is formed by the operation including the encryption node, then the upper-layer node is an encryption operation node; if the upper-layer node is formed only by assigning values ​​to the encryption node, it does not belong to an encryption operation node.

[0035] Step S40: When there is an encryption operation node, the SQL statement is determined to be an illegal SQL statement.

[0036] When there is an encryption operation node, it means that there is an operation on the encrypted data column in the SQL statement. Since the data column is encrypted, directly operating on the encrypted data column will lead to erroneous or meaningless calculation results. Therefore, if an encryption operation node is found in the data flow graph, the SQL statement is determined to be an illegal SQL statement.

[0037] For example, the SQL statement "SELECT MAX(salary) FROM employee" means to query the maximum value of the data column "salary" from the employee table.

[0038] If the data column "salary" is an encrypted data column, the database server will return the maximum value of the data column "salary" stored in ciphertext, and then return the corresponding plaintext to the client after decryption by the gateway. Usually, the ciphertext as the maximum value does not guarantee that the corresponding plaintext is also the maximum value, so the plaintext finally obtained by the client is not the highest salary (that is, the wrong result is obtained).

[0039] Therefore, when the present application constructs a corresponding data flow graph based on the SQL statement, it can directly determine that the SQL statement is an illegal SQL statement by identifying the existence of an encryption operation node.

[0040] In the data processing method based on SQL statements proposed in the embodiment of the present application, on the one hand, by constructing a data flow graph to analyze SQL statements, it is possible to accurately identify which operations involve encrypted columns, thereby more accurately determining illegal SQL statements. On the other hand, by identifying encryption operation nodes, it is possible to effectively prevent illegal operations on encrypted data columns, thereby enhancing the security of sensitive data in the database. On the third hand, the present application identifies illegal SQL statements before they are executed, thereby avoiding business logic errors or data corruption caused by the execution of illegal SQL statements.

[0041] like Figure 5 As shown, in one embodiment, after step S40, the method further includes: Step A10: The node flow chain where the encryption operation node is located is regarded as an illegal node flow chain.

[0042] In this embodiment, the nodes and edges in the data flow graph form one or more node flow chains. The node flow chain reflects the connection between each node of the output layer and each node of the lower layer through the edges.

[0043] like Figure 2As shown, the SQL statement forms three node flow chains, namely "prod_price →AVG()", "prod_price→MAX()" and "prod_price→MIN()".

[0044] Figure 3 The SQL statements shown form four node flow chains, namely: "prod_id→prod_id", "quantity→quantity" and "quantity, item_price→quantity*item_price".

[0045] Figure 4 The SQL statements shown form three node flow chains, namely "vend_id→vend_id→vend_id→vend_id", "prod_id→CONCAT () As new_prod_id→new_prod_id→LOWER()" and "prod_price→prod_price prod_price*2 As a3→a3".

[0046] When it is identified that the nodes included in any node flow chain belong to encryption operation nodes, the node flow chain is determined to be an illegal node flow chain. An illegal node flow chain means that the output result finally obtained by the node flow chain is an erroneous or meaningless calculation result.

[0047] For example, Figure 2 In the three node flow chains shown, when the node "prod_price" in the input layer is an encrypted data column, the three node flow chains are all illegal node flow chains. This is because the three nodes "AVG()", "MAX()" and "MIN()" in the output layer are all based on the encrypted data column "prod_price" to perform average, maximum and minimum operations, which are all wrong calculation results. Therefore, the three node flow chains that flow to these three wrong settlement results are all illegal node flow chains.

[0048] Step A20, intercepting the SQL statement, and outputting interception information including an error output result, where the error output result is the result corresponding to the node at the top level in the illegal node flow chain.

[0049] In this embodiment, once an illegal node flow chain is found, the gateway will intercept the SQL statement to prevent its execution, and generate interception information including an error output result, where the error output result is the result corresponding to the node at the top level in the illegal node flow chain.

[0050] In the data processing method based on SQL statements proposed in the embodiment of the present application, on the one hand, by identifying and intercepting illegal SQL statements containing encryption operation nodes, potential security risks can be effectively prevented. On the other hand, intercepting illegal SQL statements can prevent the database server from performing invalid or harmful operations, thereby saving server resources and improving overall performance. On the third hand, by locating the erroneous output results corresponding to the illegal SQL statements, it is helpful to quickly locate the problem and perform troubleshooting.

[0051] like Figure 6 As shown, based on the above embodiment, the method further includes: Step A30: In the bottom level of the data flow graph, nodes corresponding to the non-encrypted data columns are marked with a first mark, and nodes corresponding to the encrypted data columns are marked with a second mark.

[0052] It is important to understand that there are usually corresponding metadata tables or data value attributes in the database, indicating which columns are encrypted and which columns are not encrypted. Therefore, the gateway can identify the non-encrypted data columns and the encrypted data columns by identifying the metadata tables or data value attributes associated with the SQL statement.

[0053] In this embodiment, nodes in the data flow diagram are marked differently based on whether the data column is encrypted and whether the node is obtained by calculation or assignment, and different marks are used to reflect different types between nodes. The mark can be in the form of a label mark or an intuitive color mark. The embodiment of the present application does not limit the specific mark form.

[0054] Specifically, for the nodes in the lowest level, the nodes corresponding to the non-encrypted data columns are marked with a first mark, and the nodes corresponding to the encrypted data columns are marked with a second mark.

[0055] Step A40, flows the nodes into the chain, performs a third mark on the nodes obtained by operation on the nodes containing the second mark, performs a first mark on the nodes obtained by operation or assignment only on the nodes containing the first mark, performs a fourth mark on the nodes obtained by only assignment on the nodes containing the second mark, and performs a fifth mark on the nodes obtained by only assignment on the nodes containing the third mark.

[0056] For example, refer to Figures 2 to 4 In the data flow diagram, the first mark can be the light blue mark in the lowest level, and the second mark can be the dark blue mark in the lowest level. The third mark is used to mark the node flow chain. The node obtained by calculating the node containing the second mark can refer to Figures 2 to 4The fourth mark, marking the node flow chain, is the node obtained by assigning only the value of the node containing the second mark. Figures 2 to 4 The fifth mark is used to mark the node flow chain. The node obtained by assigning only the value of the node containing the third mark can be referred to Figures 2 to 4 Green markers in the data flow diagram.

[0057] Step A50, displaying a data flow graph with labels, wherein nodes with a third label represent encryption operation nodes.

[0058] In the data flow diagram, nodes with marks are displayed. It should be noted that the nodes with the third mark are encryption operation nodes.

[0059] In the SQL statement-based data processing method proposed in the embodiment of the present application, detailed error information can be provided by marking and displaying the marked data flow diagram, helping administrators and developers to quickly locate and understand the error causes of illegal SQL statements.

[0060] like Figure 7 As shown, based on the above embodiment, the method further includes: Step A60, identifying the number of encryption operation nodes in the data flow graph.

[0061] Step A70, determining the illegality level of the SQL statement based on the number of encryption operation nodes.

[0062] In this embodiment, the number of encryption operation nodes in the data flow graph is counted, and the illegal level of the SQL statement is determined according to a predefined level classification rule.

[0063] In one embodiment, the classification rule may be to determine the corresponding illegal level according to the number of encryption operation nodes, and the illegal level may be classified into medium risk and high risk according to the severity from low to high. The more the number of encryption operation nodes, the higher the illegal level.

[0064] For example, if there are 0 cryptographic operation nodes, there is no corresponding illegal level. If there are 1 to 3 cryptographic operation nodes, there is a medium risk. If there are 4 or more cryptographic operation nodes, there is a high risk.

[0065] In some implementations, after step A70, the method further includes: Step A80, based on the illegal level of the SQL statement, determine the processing strategy corresponding to the SQL statement, the processing strategy includes interception processing or rewriting processing.

[0066] Step A90: Execute the processing strategy for the SQL statement.

[0067] In this embodiment, the higher the illegality level of the SQL statement, the stricter the processing strategy to be executed. The processing strategy includes interception processing and rewriting processing, and the interception processing is stricter than the rewriting processing.

[0068] Specifically, if the illegality level of the SQL statement is high risk, it will be intercepted to prevent potential security threats. If the illegality level of the SQL statement is medium risk, it will be rewritten to optimize its security. If the SQL statement has no encryption operation node, that is, no corresponding illegality level, it will be directly forwarded to the target database server.

[0069] In the data processing method based on SQL statements proposed in the embodiment of the present application, on the one hand, by identifying the number of encryption operation nodes, the risk level of SQL statements can be quantified, thereby achieving more refined security control. On the other hand, the security policy is dynamically adjusted according to the number of encryption operation nodes, thereby improving the flexibility and adaptability of the gateway.

[0070] like Figure 8 As shown, in one embodiment, after step S40, the method further includes: Step B10, receiving an execution instruction for an illegal SQL statement.

[0071] In this embodiment, when further receiving a user's running instruction, the illegal SQL statement can be corrected and the corrected SQL statement can be executed to avoid execution errors.

[0072] Specifically, it is possible to further detect whether the illegality level of the illegal SQL statement is lower than a preset illegality level threshold. When it is equal to the preset illegality level threshold, the illegal SQL statement is corrected and executed. When it is higher than the illegality level threshold, the execution of the illegal SQL statement is rejected. For example, the illegality level threshold is the above-mentioned medium risk. When it is determined that the illegality level of the illegal SQL statement belongs to the medium risk level, the gateway will wait for the client to send a run instruction. This run instruction is used to instruct to continue to execute the illegal SQL statement, but it needs to be corrected.

[0073] Step B20: Based on the running instruction, determine the restricted data columns in the illegal SQL statement corresponding to the encryption operation node.

[0074] The gateway identifies the encryption operation nodes by analyzing the data flow graph of the illegal SQL statement, and determines the restricted data columns corresponding to these nodes. The restricted data columns are the encrypted data columns involved in the operation in the illegal SQL statement, that is, the data columns involved in the reading or writing of encrypted data in the illegal SQL statement, that is, the data columns in the nodes corresponding to the upper layer of these encryption operation nodes.

[0075] Step B30: modify the data value corresponding to each restricted data column according to the read / write type corresponding to each restricted data column to generate a modified SQL statement.

[0076] The gateway modifies these data values ​​accordingly based on the read / write type of each restricted data column (i.e., whether the data value needs to be read or written into encrypted data) to ensure data security.

[0077] It should be noted that data columns that are related to the encrypted data columns but are not restricted data columns corresponding to the encryption operation nodes are called non-restricted data columns. No modification is performed on the non-restricted data columns.

[0078] For example, in the SQL statement "SELECT id, salary FROM employee", the data column "salary" is an encrypted data column, but it does not have an encryption operation node. In this case, the data column is an unrestricted data column. During the execution of the SQL statement, the corresponding data value is not decrypted. After the target database server executes the SQL statement, it returns the ciphertext of the data column "salary". The gateway decrypts it into plaintext and returns it to the client, and finally obtains the correct result.

[0079] In some embodiments, step B30 includes: Step B31 : Mark each restricted data column as a write restricted data column or a read restricted data column according to the read / write type corresponding to each restricted data column.

[0080] Step B32: decrypt and modify the data value corresponding to each read-restricted data column, and encrypt and modify the data value corresponding to each write-restricted data column. Specifically, if the restricted data column is used as a read-restricted data column in an illegal SQL statement (such as a SELECT statement), the decryption function "Decrypt()" is applied to the data value corresponding to the read-restricted data column. If the restricted data column is used as a write-restricted data column in an illegal SQL statement (such as an INSERT / UPDATE statement), the encryption function "Encrypt()" is applied to the data value (which can be a constant or an expression) corresponding to the write-restricted data column.

[0081] Example 1: In the SQL statement "SELECT MAX(salary) FROM employee", the data column "salary" is an encrypted data column. In the data flow graph formed for this SQL statement, the node "MAX()" in the output layer is an encryption operation node, and the node above "MAX()" is "salary". "Salary" is the data value corresponding to the restricted data column. The decryption function is directly applied to "salary". The corrected SQL statement is: "SELECT MAX(Decrypt(salary))FROM employee".

[0082] Example 2: In the SQL statement "SELECT prod_id, quantity, item_price, quantity * item_price FROM orderitems", combined with Figure 3 As shown, "item_price" and "quantity" are both encrypted data columns. In the data flow diagram formed for this SQL statement, the same nodes "item_price" and "quantity" exist in both the input layer and the output layer. The nodes "item_price" and "quantity" in the output layer are both assigned nodes. The two encrypted data columns are both unrestricted data columns, and their corresponding data values ​​do not need to be decrypted. For the node "quantity * item_price" in the output layer, its corresponding "item_price" and "quantity" belong to restricted data columns. Since they are both read as restricted data columns, the decryption function is applied to their corresponding data values. The corrected SQL statement is: "SELECT prod_id, quantity, item_price, quantity * Decrypt(item_price) FROM orderitems".

[0083] In the query result of the modified SQL statement returned by the database server, the result of "quantity * item_price" is plain text, the result of "item_price" is cipher text, and "item_price" is decrypted into plain text after passing through the gateway and then returned to the client.

[0084] Example 3, SQL statement "INSERT INTO employee (id, name, age, salary, department) In the statement "VALUES (1001, 'Zhang San', 24, 8000, 'R&D department')", "name", "age", and "salary" are encrypted data columns. In the resulting data flow diagram, for the upper-level nodes "name", "age", and "salary" in the statement corresponding to the encryption operation node "VALUES ()", they are write-restricted data columns, and the corresponding data values need to be wrapped with an encryption function (converted to ciphertext and inserted). The corrected SQL statement is: "INSERT INTO employee (id,name, age, salary, department) VALUES (1001, Encrypt('Zhang San'), Encrypt(24), Encrypt('8000'), 'R&Ddepartment') " Example 4, in the SQL statement "UPDATE employee SET salary = salary + 1000 WHERE id =1001", "salary" is an encrypted data column. In the resulting data flow diagram, for the "salary" related operations involved in the encryption operation node "salary +1000", they are read, added, and written in sequence. The "salary" involved in this encryption operation node, as a write-restricted data column, has the "Encrypt90" function wrapped around its corresponding data value (the entire modified addition expression). The corrected SQL statement is: "UPDATE employee SET salary = Encrypt(Decrypt(salary)+1000)) WHERE id = 1001".

[0085] In some embodiments, step B32 further includes: Step C10, obtaining the target decryption function corresponding to each read-restricted data column and the target encryption function corresponding to each write-restricted data column.

[0086] This embodiment takes into account that different application scenarios may require the use of different encryption and decryption algorithms to ensure data security and compliance. Therefore, the gateway not only identifies the restricted data columns and their read / write types, but also obtains the target decryption function corresponding to each read-restricted data column and the target encryption function corresponding to each write-restricted data column from the configuration file of this illegal SQL statement.

[0087] Step C20, decrypt and modify the data value corresponding to each read restricted data column according to the target decryption function corresponding to each read restricted data column; and encrypt and modify the data value corresponding to each write restricted data column according to the target decryption function corresponding to each write restricted data column.

[0088] In this embodiment, the gateway decrypts and modifies the data value corresponding to each read-restricted data column according to the pre-configured target decryption function, so as to ensure that the database server can restore the encrypted data column when reading the data value corresponding to the read-restricted data column. And, according to the pre-configured target encryption function, the gateway encrypts and modifies the data value corresponding to each write-restricted data column, so as to ensure that the database server can protect the encrypted data column when writing the data value corresponding to the write-restricted data column.

[0089] Step B40: sending the modified SQL statement to the target database server, wherein the target database server is used to execute the modified SQL statement.

[0090] In this embodiment, by deploying an encryption / decryption plug-in on the database server side, the encryption / decryption plug-in first performs a decryption operation on the corrected SQL statement to obtain the plain text, and then performs subsequent processing on the plain text, and the result is as expected. Similarly, when writing the encrypted data column, the encryption operation is first performed on the written value, and then the encryption result (ciphertext) is saved to the database. Both cases can obtain correct results.

[0091] In the data processing method based on SQL statements proposed in the embodiment of the present application, on the one hand, by correcting the restricted data columns in the illegal SQL statements, the security and compliance of the SQL statements can be ensured. On the other hand, according to the different read and write types, different encryption and decryption algorithms are flexibly nested, which improves the adaptability and robustness of the gateway.

[0092] In one embodiment, a computer-readable storage medium is provided, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the steps in the above-mentioned method embodiments.

[0093] In one embodiment, an electronic device is also provided, including one or more processors; a memory, in which one or more programs are stored, wherein when the one or more programs are executed by one or more processors, the one or more processors execute the steps in the above-mentioned method embodiments.

[0094] In one embodiment, Fig. 9As shown, it shows a schematic diagram of the structure of an electronic device for implementing an embodiment of the present application. The electronic device 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the electronic device 900 are also stored. The CPU 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0095] The following components are connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage section 908 as needed.

[0096] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, including a computer-readable medium carrying instructions, in such an embodiment, the instructions can be downloaded and installed from a network through the communication part 609, and / or installed from a removable medium 911. When the instructions are executed by the central processing unit (CPU) 901, the various method steps described in the present application are executed.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0098] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the above claims, any one of the claimed embodiments may be used in any combination. The information disclosed in this background technology section is intended only to deepen the understanding of the overall background technology of the present application and should not be regarded as an admission or in any form of implication that the information constitutes prior art known to those skilled in the art.

Claims

1. A data processing method based on SQL statements, characterized in that: The method comprises: Get the SQL statement to be processed; A corresponding data flow graph is constructed by analyzing the syntax in the SQL statement, wherein the data flow graph includes multiple levels, each level includes at least one node, and the edge connecting the nodes in adjacent levels indicates that the node in the previous level in the adjacent levels depends on one or more nodes in the next level through assignment or operation, and the nodes in the lowest level are the data columns involved in the SQL statement; Identify whether there is an encryption operation node among all the nodes in the data flow graph, wherein the encryption operation node represents a node obtained by operating the node corresponding to the encrypted data column; When there is an encryption operation node, the SQL statement is determined to be an illegal SQL statement.

2. The data processing method based on SQL statements according to claim 1, characterized in that: The nodes and edges in the data flow graph form a plurality of node flow chains; after determining that the SQL statement is an illegal SQL statement, the method further includes: The node flow chain where the encryption operation node is located is regarded as an illegal node flow chain; The SQL statement is intercepted, and interception information including an error output result is output, where the error output result is a result corresponding to a node at the top level in the illegal node flow chain.

3. The data processing method based on SQL statements according to claim 2 is characterized in that: The method further comprises: In the bottom level of the data flow graph, nodes corresponding to the non-encrypted data columns are marked with a first mark, and nodes corresponding to the encrypted data columns are marked with a second mark; Flow the nodes into the chain, perform the third marking on the nodes obtained by computing the nodes containing the second marking, perform the first marking on the nodes obtained by computing or assigning only the nodes containing the first marking, perform the fourth marking on the nodes obtained by only assigning the nodes containing the second marking, and perform the fifth marking on the nodes obtained by only assigning the nodes containing the third marking; A data flow graph with labels is displayed, wherein the nodes with the third label represent encryption operation nodes.

4. The data processing method based on SQL statements according to claim 1, characterized in that: The method further comprises: Identifying the number of encryption operation nodes in the data flow graph; Based on the number of the encryption operation nodes, the illegality level of the SQL statement is determined.

5. The data processing method based on SQL statements according to claim 4 is characterized in that: After determining the illegal level of the SQL statement based on the number of the encryption operation nodes, the method further includes: Based on the illegal level of the SQL statement, determining a processing strategy corresponding to the SQL statement, the processing strategy including interception processing or rewriting processing; The processing strategy is executed on the SQL statement.

6. The data processing method based on SQL statements according to claim 1, characterized in that: After determining that the SQL statement is an illegal SQL statement, the method further includes: Receiving an execution instruction for the illegal SQL statement; Based on the running instruction, determining a restricted data column in the illegal SQL statement corresponding to the encryption operation node, wherein the restricted data column is an encrypted data column participating in the operation in the illegal SQL statement; According to the read / write type corresponding to each restricted data column, modify the data value corresponding to each restricted data column to generate a modified SQL statement; The modified SQL statement is sent to a target database server, wherein the target database server is used to execute the modified SQL statement.

7. The data processing method based on SQL statements according to claim 6 is characterized in that: The modifying the data value corresponding to each restricted data column according to the read / write type corresponding to each restricted data column includes: According to the read / write type corresponding to each restricted data column, marking each restricted data column as a write restricted data column or a read restricted data column; The data value corresponding to each read-restricted data column is decrypted and modified, and the data value corresponding to each write-restricted data column is encrypted and modified.

8. The data processing method based on SQL statements according to claim 7 is characterized in that: The decrypting and modifying the data value corresponding to each read-restricted data column, and encrypting and modifying the data value corresponding to each write-restricted data column, further includes: Obtain a target decryption function corresponding to each read-restricted data column and a target encryption function corresponding to each write-restricted data column; Decrypt and modify the data value corresponding to each read restricted data column according to the target decryption function corresponding to each read restricted data column; and According to the target decryption function corresponding to each write restricted data column, the data value corresponding to each write restricted data column is encrypted and modified.

9. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the data processing method based on SQL statements as described in any one of claims 1 to 8.

10. A storage medium, characterized in that: The storage medium stores executable instructions, and when the instructions are executed by the processor, the processor executes the data processing method based on SQL statements according to any one of claims 1 to 8.

Images