A data processing method, electronic device, storage medium and computer program product

Abstract

The embodiment of the present application provides a data processing method, an electronic device, a storage medium and a computer program product, the method comprising: when receiving a data processing instruction, determining the encryption attribute of the target data type according to the target data type to which the data to be processed carried by the data processing instruction belongs, and the correspondence between the pre-stored data type and the encryption attribute; the encryption attribute includes encryption and non-encryption; when determining that the encryption attribute of the target data type is encryption, inserting a preset cryptographic function into the data processing instruction to obtain a reorganization instruction; sending the reorganization instruction to the database, the reorganization instruction is used to instruct the database to perform the indicated processing based on the cryptographic function and the data to be processed. By matching the data type with the encryption attribute, dynamically inserting the cryptographic function and other measures, the effect of ensuring data security and privacy while improving the efficiency of encrypted data retrieval is achieved.

Description

Technical Field

[0001] The present application relates to the field of data management technology, and in particular to a data processing method, electronic device, storage medium and computer program product. Background Art

[0002] With the rapid development of the information age, data has become the core resource for corporate competition. However, frequent security incidents such as data leakage and hacker attacks have brought huge economic losses and reputation risks to companies and individuals. Therefore, data encryption storage has become an important means to protect data security.

[0003] However, when certain fields in the database are encrypted, the fields cannot be directly retrieved through traditional plaintext queries. Although relevant technologies provide certain solutions to alleviate the incompatibility problem between encryption and plaintext queries, they still face some challenges and shortcomings. Therefore, there is an urgent need for a method to more comprehensively improve the efficiency of encrypted data retrieval while ensuring data security and privacy. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a data processing method, an electronic device, a storage medium and a computer program product, so as to achieve the technical effect of improving the efficiency of encrypted data retrieval while ensuring data security and privacy.

[0005] A first aspect of an embodiment of the present application provides a data processing method, the method being used to process encrypted data in a database; the processing comprising retrieval processing and / or addition processing; the method comprising:

[0006] In the case of receiving a data processing instruction, determining the encryption attribute of the target data type according to the target data type to which the data to be processed carried by the data processing instruction belongs and the correspondence between the pre-stored data type and the encryption attribute; the encryption attribute includes encryption and non-encryption;

[0007] When it is determined that the encryption attribute of the target data type is encryption, inserting a preset cryptographic function into the data processing instruction to obtain a reorganization instruction;

[0008] The reorganization instruction is sent to the database, where the reorganization instruction is used to instruct the database to perform the indicated processing based on the cryptographic function and the data to be processed.

[0009] In the above implementation process, the goal of improving the efficiency of encrypted data retrieval is achieved through intelligent matching of data types and encryption attributes, dynamic insertion of cryptographic functions, etc. At the same time, by sending a reorganization instruction containing a cryptographic function to the database, the cryptographic function is inserted into the processing instruction only when needed. This method can ensure that only authorized data types and operations are encrypted, effectively preventing data leakage and unauthorized access. In addition, by using the efficient processing capabilities of the database to accelerate the retrieval and addition operations of encrypted data, the security of data during transmission and storage can be maintained.

[0010] Further, the data processing instruction includes a retrieval processing instruction; the cryptographic function includes a decryption function; and the step of obtaining the reorganization instruction includes:

[0011] When it is determined that the encryption attribute of the target data type is encryption, the decryption function is inserted into the retrieval processing instruction to obtain a reorganization instruction including the decryption function; the reorganization instruction is used to instruct the database to retrieve the encrypted retrieval result of the data to be processed from the encrypted data, and decrypt the encrypted retrieval result based on the decryption function in the reorganization instruction.

[0012] In the above implementation process, since the decryption function is inserted into the retrieval processing instruction only when needed, and this process is automated, the tedious steps of manually decrypting or checking whether the data is encrypted one by one are avoided. At the same time, after receiving the reorganization instruction, the database can directly use the decryption function to decrypt the encrypted data and return the decrypted result, thereby improving the retrieval efficiency.

[0013] Furthermore, the cryptographic function also includes an inverse format conversion function; the reorganization instruction also includes the inverse format conversion function, and the reorganization instruction is used to instruct the database to use the inverse format conversion function to perform inverse format conversion on the encrypted retrieval result, and to use the decryption function to decrypt the encrypted retrieval result after inverse format conversion.

[0014] In the above implementation process, the encryption attribute and format of the data to be processed are intelligently identified. When it is determined that the data needs to be encrypted and format converted, the decryption function and the inverse format conversion function are dynamically inserted into the retrieval processing instruction to generate a reorganization instruction containing these two functions. The introduction of the inverse format conversion function enables this method to process a variety of data formats and meet the needs of different application scenarios.

[0015] Further, the data processing instruction includes an add processing instruction; the cryptographic function includes an encryption function; and the step of obtaining the reorganization instruction includes:

[0016] When it is determined that the encryption attribute of the target data type is encryption, the encryption function is inserted into the add processing instruction to obtain a reorganization instruction including the encryption function; the reorganization instruction is used to instruct the database to use the encryption function to encrypt and store the data to be processed.

[0017] In the above implementation process, by intelligently identifying the encryption attributes of the data to be processed, when it is determined that the data needs to be encrypted and stored, the encryption function is dynamically inserted into the add processing instruction, and a reorganization instruction containing the encryption function is generated, ensuring that the data to be processed is encrypted before storage, thereby enhancing the security of the data. In addition, the encryption function is inserted into the add processing instruction only when it is determined that the data needs to be encrypted and stored. This process is automated, avoiding the tedious steps of manually encrypting each data one by one. After receiving the reorganization instruction, the database can directly use the encryption function to encrypt and store the data, thereby improving the efficiency of data addition.

[0018] Furthermore, the cryptographic function also includes a format conversion function; the reorganization instruction also includes the format conversion function, and the reorganization instruction is used to instruct the database to use the encryption function to encrypt the data to be processed, and use the format conversion function to convert the format of the encrypted data and then store it.

[0019] In the above implementation process, the data after format conversion is easier to store and transmit, and the security of the data is also enhanced.

[0020] Furthermore, before receiving the data processing instruction, the method further includes:

[0021] receiving data to be stored;

[0022] If the encryption attribute of the data to be stored is encryption, a storage instruction carrying the data to be stored and the encryption function is generated by running a preset program; wherein the preset program is code obfuscated by a preset obfuscation tool; and the encryption attribute is input by a user;

[0023] If the encryption attribute of the data to be stored is non-encrypted, generating a storage instruction carrying the data to be stored by running the preset program;

[0024] Sending the storage instruction to the database, wherein the storage instruction is used to instruct the database to store the data to be stored;

[0025] The corresponding relationship between the data type and the encryption attribute is established by running the preset program.

[0026] In the above implementation process, the program code is obfuscated to prevent the preset program and database from being leaked and cracked through decompilation and the like, thereby achieving the purpose of protecting data.

[0027] Furthermore, the cryptographic functions include an AES encryption function, an AES decryption function, a HEX() function for format conversion, and a UNHEX() function for inverse format conversion; the reorganization instructions are generated by calling a JSQLParser tool; and the obfuscation tool includes a ProGuard code obfuscation tool.

[0028] In the above implementation process, by introducing specific cryptographic functions, reorganized instruction generation tools and code obfuscation tools, we have achieved advanced encryption protection, flexible data format processing, automated instruction generation, code obfuscation to enhance security and comprehensive data protection. These effects together constitute an efficient, secure and flexible data processing solution that is suitable for various application scenarios that need to protect sensitive data and meet diverse processing needs.

[0029] A second aspect of an embodiment of the present application provides an electronic device, the electronic device comprising:

[0030] processor;

[0031] a memory for storing processor-executable instructions;

[0032] Wherein, when the processor calls the executable instruction, any method described in the first aspect is implemented.

[0033] A third aspect of an embodiment of the present application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any method described in the first aspect.

[0034] A fourth aspect of the embodiments of the present application provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, any method described in the first aspect is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 A flowchart of a data processing method provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of a data processing flow provided in an embodiment of the present application;

[0038] Figure 3 A flowchart of another data processing method provided in an embodiment of the present application;

[0039] Figure 4 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0041] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0042] The technology that alleviates the incompatibility between encryption and plaintext query is usually called "searchable encryption". In the related art, there are many ways to implement searchable encryption, including but not limited to:

[0043] Searchable encryption based on symmetric encryption: Encrypt data using symmetric encryption algorithms (such as AES) and build a corresponding index structure to support ciphertext search. However, building a secure index structure usually requires additional computing resources and storage space, which is costly and is easily affected by factors such as the design of the index structure, the optimization of the search algorithm, and the limitation of hardware resources, resulting in low search efficiency.

[0044] Searchable encryption based on asymmetric encryption: Encrypt data using an asymmetric encryption algorithm (such as RSA or ECC), and use a public key and a private key to enable ciphertext search. This method may be more secure, but it also has higher computational overhead and resource requirements.

[0045] Searchable encryption based on homomorphic encryption: Homomorphic encryption is a technology that allows arbitrary calculations to be performed on encrypted data and obtain encrypted results. Although homomorphic encryption can theoretically support complex ciphertext search operations, it is subject to certain limitations in practical applications due to its high computational complexity and performance overhead.

[0046] Therefore, although the relevant technologies provide certain solutions to alleviate the incompatibility issues between encryption and plaintext queries, they still face some challenges and shortcomings. There is an urgent need for a method that can more comprehensively improve the efficiency of encrypted data retrieval while ensuring security and privacy.

[0047] In response to any of the above-mentioned problems, the present application provides a data processing method, referring to Figure 1 , Figure 1 A flowchart of a data processing method provided in an embodiment of the present application.

[0048] In this embodiment, the method is used to process encrypted data in a database; the processing includes retrieval processing and / or addition processing; the method includes:

[0049] Step S10: upon receiving a data processing instruction, determining the encryption attribute of the target data type according to the target data type to which the data to be processed carried in the data processing instruction belongs and the correspondence between the pre-stored data type and the encryption attribute; the encryption attribute includes encryption and non-encryption;

[0050] It should be noted that the execution subject of this embodiment may be a server, on which a preset program code is running, and the program code contains all processing instructions that may be used in the data processing process. Before executing the method described in this embodiment, the data has been encrypted and stored in the database by running the program code. When the code side and the database side on the server are built, the code side receives the data processing instructions input by the user, and executes the method described in this embodiment by running the program code. Figure 2 As shown, Figure 2 A data processing flow diagram provided for an embodiment of the present application, wherein a code end receives a data processing instruction carrying data to be processed input by a user, and judges the encryption attribute of the data to be processed based on the correspondence between the pre-stored data type and the encryption attribute. When it is determined that the data to be processed is encrypted data, the code end reorganizes the data processing instruction and sends the reorganized data processing instruction to the database end to instruct the database to perform corresponding data processing; when it is determined that the data to be processed is unencrypted data, the code end forwards the data processing instruction to the database end to instruct the database to perform corresponding data processing.

[0051] The data processing instruction may include information such as the data to be processed, the type of data (i.e., the target data type), and the processing type (such as adding processing, searching processing, etc.). The data processing instruction may also only include the data to be processed and the processing type (such as adding processing, searching processing, etc.), and then the system automatically determines the data type of the data to be processed.

[0052] The correspondence between data types and encryption attributes can be stored in the code or database in a table or any other form. The data type field is used to identify the type of data (such as name, ID number, bank account, etc.), while the encryption attribute field indicates whether the data of this type needs to be encrypted (such as encrypted or non-encrypted). The correspondence defines which data types need to be encrypted and which do not. In addition, in order to save maintenance costs and reduce workload, the correspondence can only maintain the data types that need to be encrypted, and the remaining data types are defaulted to non-encrypted. In this case, the correspondence only defines which data types need to be encrypted. By querying this correspondence, it can be determined whether the target data type is the data type that needs to be encrypted and exists in the correspondence. If not, it can be determined that the target data type is non-encrypted.

[0053] Specifically, after receiving the data processing instruction, the system will query the encryption attribute of this data type from the pre-stored correspondence according to the data type of the data to be processed. Once the encryption attribute of the data type is determined, the subsequent data processing flow is determined according to this attribute. If the data needs to be encrypted, the corresponding encryption function or decryption function will be called during the processing; if the data does not need to be encrypted, the subsequent processing operations (such as storage, retrieval, addition, etc.) will be carried out directly.

[0054] Step S20: When it is determined that the encryption attribute of the target data type is encryption, inserting a preset cryptographic function into the data processing instruction to obtain a reorganization instruction;

[0055] It should be noted that the cryptographic function may include an encryption function and / or a decryption function, and may also include functions such as data format conversion, encoding, decoding, and data verification. This embodiment does not limit the cryptographic function.

[0056] When it is determined that the encryption attribute of the target data type is encrypted, if the data processing instruction includes a retrieval processing instruction, it means that the data to be retrieved and processed is stored in encrypted form. At this time, it is necessary to insert a preset decryption function into the data processing instruction to obtain a reorganization instruction to instruct the database to obtain the encrypted retrieval result of the data to be processed from the encrypted data, and decrypt the encrypted retrieval result based on the decryption function, and finally return the plaintext data.

[0057] When it is determined that the encryption attribute of the target data type is encrypted, if the data processing instruction includes an add processing instruction, it means that the data to be added needs to be stored after encryption. At this time, it is necessary to insert the preset encryption function into the data processing instruction to obtain a reorganization instruction to instruct the database to encrypt and store the data to be processed.

[0058] Step S30: sending the reorganization instruction to the database, wherein the reorganization instruction is used to instruct the database to perform the indicated processing based on the cryptographic function and the data to be processed.

[0059] In the specific implementation, after sending the reorganization instruction to the database, the database will perform corresponding operations according to the cryptographic function and the data to be processed. For example, if the instruction is to add processing, the database will store the encrypted data to be processed in the corresponding location; if the instruction is to retrieve processing, the database will query and decrypt the data and return the original data, that is, the plaintext data.

[0060] In this embodiment, on the one hand, the goal of improving the efficiency of encrypted data retrieval is achieved through intelligent matching of data types and encryption attributes, dynamic insertion of cryptographic functions, and other measures. On the other hand, when a cryptographic function is used as an encryption function, it can effectively protect sensitive data from unauthorized access or disclosure, thereby maintaining the privacy of the data. Even if a cryptographic function is not specifically used for encryption, its application can indirectly improve the security of the system by increasing the complexity of the data processing process. For example, by applying encoding or conversion functions, the system can make data more difficult to be parsed or attacked during transmission.

[0061] Based on any of the above embodiments, the data processing instruction includes a retrieval processing instruction; the cryptographic function includes a decryption function; and the step of obtaining the reorganization instruction includes:

[0062] When it is determined that the encryption attribute of the target data type is encryption, the decryption function is inserted into the retrieval processing instruction to obtain a reorganization instruction including the decryption function; the reorganization instruction is used to instruct the database to retrieve the encrypted retrieval result of the data to be processed from the encrypted data, and decrypt the encrypted retrieval result based on the decryption function in the reorganization instruction.

[0063] It should be noted that the data processing instruction including the retrieval processing instruction may refer to the case where the data processing instruction only includes the retrieval processing instruction, in which case the data processing instruction is equivalent to the retrieval processing instruction; or it may refer to the case where the data processing instruction includes multiple processing instructions, such as the data processing instruction nesting the retrieval processing instruction, the addition processing instruction, the modification processing instruction, etc. This embodiment takes the first case: the data processing instruction only includes the retrieval processing instruction as an example for explanation.

[0064] After determining that the encryption attribute of the target data type is encryption, select the corresponding decryption function and insert it into the search processing instruction according to the encryption method and key management strategy of the target data type to obtain the reorganization instruction, and send the reorganization instruction to the database. After receiving the reorganization instruction, the database first retrieves the corresponding encrypted search result from the encrypted data according to the search conditions in the instruction. Then, the database uses the decryption function in the reorganization instruction to decrypt the encrypted search result and return the original data, that is, the plaintext data.

[0065] In this embodiment, by inserting a decryption function into a retrieval processing instruction and generating a reorganization instruction, efficient and secure retrieval and decryption processing of encrypted data in a database can be achieved, thereby improving data security and retrieval efficiency.

[0066] Based on any of the above embodiments, the cryptographic function also includes an inverse format conversion function; the reorganization instruction also includes the inverse format conversion function, and the reorganization instruction is used to instruct the database to use the inverse format conversion function to perform inverse format conversion on the encrypted retrieval result, and use the decryption function to decrypt the encrypted retrieval result after inverse format conversion.

[0067] It should be noted that, based on any of the above embodiments, the scope of the cryptographic function has been expanded, including not only a decryption function for decrypting data, but also an inverse format conversion function. The inverse format conversion function is a special cryptographic function, which is used to convert encrypted data that has been converted into a specific format back to its original format (or a format that is easier to process, and this embodiment uses the conversion back to its original format as an example). For example, when the encrypted data is converted into a hexadecimal format during storage, the inverse format conversion function needs to convert the hexadecimal data back to the original text or digital format.

[0068] In the specific implementation, the corresponding decryption function and inverse format conversion function are selected according to the encryption method and storage format of the data. Then, these two functions are inserted into the retrieval processing instruction to obtain the reorganization instruction. The reorganization instruction is sent to the database. After receiving the reorganization instruction, the database first retrieves the corresponding encrypted retrieval result from the encrypted data according to the retrieval condition. Then, the inverse format conversion function is applied to convert the format of the encrypted retrieval result and convert it back to a format that is easier to process. Then, the database applies the decryption function to decrypt the encrypted retrieval result after the format conversion to obtain the original data.

[0069] In this embodiment, by inserting the decryption function and the inverse format conversion function in the retrieval processing instruction at the same time, it is possible to ensure that the encrypted data retrieved from the database is correctly decrypted and converted back to the original format before being returned to the user. This avoids the risk of data leakage and format mismatch during transmission, and improves the security and integrity of the data.

[0070] Based on any of the above embodiments, the data processing instruction includes an add processing instruction; the cryptographic function includes an encryption function; and the step of obtaining the reorganization instruction includes:

[0071] When it is determined that the encryption attribute of the target data type is encryption, the encryption function is inserted into the add processing instruction to obtain a reorganization instruction including the encryption function; the reorganization instruction is used to instruct the database to use the encryption function to encrypt and store the data to be processed.

[0072] It should be noted that the data processing instruction including the add processing instruction may refer to the case where the data processing instruction only includes the add processing instruction, in which case the data processing instruction is equivalent to the add processing instruction; or it may refer to the case where the data processing instruction includes multiple processing instructions, such as the data processing instruction nesting the retrieval processing instruction, the add processing instruction, the modify processing instruction, etc. This embodiment takes the first case: the data processing instruction only includes the add processing instruction as an example for explanation.

[0073] The encryption function is used to convert plaintext data into ciphertext data to ensure the security of data during storage and transmission. The encryption function accepts plaintext data as input and outputs the corresponding ciphertext data.

[0074] It is understandable that after receiving the reorganization instruction, the database first encrypts the data to be added according to the encryption function. Then, the database stores the encrypted data in a specified location or a location that meets specific conditions. For example, according to the storage location requirements carried by the instruction, the data to be processed is inserted into a row or column of the table.

[0075] In this embodiment, by inserting an encryption function in the add processing instruction and generating a reorganization instruction, encrypted storage of the data to be added in the database can be achieved, which not only improves the security of the data, but also simplifies the data processing flow and improves the data processing efficiency.

[0076] Based on any of the above embodiments, the cryptographic function also includes a format conversion function; the reorganization instruction also includes the format conversion function, and the reorganization instruction is used to instruct the database to use the encryption function to encrypt the data to be processed, and use the format conversion function to convert the format of the encrypted data and then store it.

[0077] It should be noted that the format conversion function corresponds to the inverse format conversion function in the above embodiment, and they are respectively used to convert data from one format to another format, and restore the converted data to the original format.

[0078] Specifically, in order to facilitate data storage and transmission and enhance data security, a format conversion function is added on the basis of inserting the encryption function to obtain a reorganization instruction carrying the encryption function and the format conversion function. After receiving the reorganization instruction, the database first encrypts the data to be processed according to the encryption function. Then, the database applies the format conversion function to convert the encrypted data into a specified storage format. Finally, the database stores the encrypted data after format conversion in a specified location or a location that meets specific conditions.

[0079] In this embodiment, encryption and format conversion logic are integrated into the add processing instruction, which reduces the multiple conversion and processing steps during data transmission and processing, simplifies the data processing flow, and improves the response speed and efficiency of the system.

[0080] Based on any of the above embodiments, before receiving the data processing instruction, the method further includes: Figure 3 Steps S01 to S05 shown:

[0081] Step S01: receiving data to be stored;

[0082] It should be noted that this embodiment involves the construction of the code side and the database side before receiving the data processing instruction.

[0083] The data to be stored can be any type of information, such as text, images, videos, etc.

[0084] Step S02: if the encryption attribute of the data to be stored is encryption, a storage instruction carrying the data to be stored and the encryption function is generated by running a preset program; wherein the preset program is code obfuscated by a preset obfuscation tool; and the encryption attribute is input by a user;

[0085] Step S03: if the encryption attribute of the data to be stored is non-encrypted, generating a storage instruction carrying the data to be stored by running the preset program;

[0086] It should be noted that the code side needs to determine the encryption attribute of the received data to be stored. This attribute is specified by the user when submitting the data. When submitting the data, the user specifies the encryption attribute of the data as a preliminary operation. The method involved in the first embodiment is a later data operation. In the later data operation process, the user does not need to specify the encryption attribute of the data. The preliminary operation will generate a correspondence between multiple data types and encryption attributes and store them on the code side or the database side. In the later data operation process, this correspondence can be queried.

[0087] It should be understood that reverse compilation, also known as computer software reverse engineering, refers to the work of "reverse analysis and research" on the target program (such as executable program) of other people's software to derive the design elements such as ideas, principles, structures, algorithms, processing procedures, and operation methods used by other people's software products. In certain specific cases, the source code may be derived. Decompilation is used as a reference when developing software by yourself, or directly used in your own software products. Source code design and implementation methods may result in code leakage when the startup package is decompiled without code obfuscation. In this embodiment, in order to prevent the database or code from leaking and being cracked (reverse compilation), the source code is obfuscated by a preset code obfuscation tool to achieve the effect of protecting data.

[0088] Code obfuscation tools can be: ProGuard, Allatori, ZKM, ConfuserEx, Themida, UPX, etc. When the system source code startup package has a certain degree of security, the code obfuscation step can be abandoned. For example, when the source code startup package does not need to be deployed to an external device, it means that it has a certain degree of security and the code obfuscation step can be abandoned. If the source code startup package needs to be deployed externally and the bytecode file needs to be encrypted to achieve a certain degree of security for the source code, the code obfuscation step must be implemented.

[0089] It is understandable that if the data to be stored needs to be encrypted, a storage instruction is generated by running a preset program. This program includes an encryption function and receives the data to be stored as input.

[0090] If the data to be stored does not need to be encrypted, a storage instruction will also be generated, but this time it does not contain an encryption function, but only contains the data to be stored. This storage instruction instructs the database to directly store the data to be stored without encryption processing.

[0091] Step S04: sending the storage instruction to the database, wherein the storage instruction is used to instruct the database to store the data to be stored;

[0092] It should be noted that the data to be stored stored according to the storage instruction carrying the encryption function eventually constitutes the encrypted data in the database, and the data to be stored stored according to the storage instruction not carrying the encryption function eventually constitutes the unencrypted data in the database.

[0093] Step S05: Establishing a correspondence between the data type and the encryption attribute by running the preset program.

[0094] Exemplarily, the corresponding relationship is established through the following steps:

[0095] 1. Define data types and encryption attributes

[0096] 2. Design a database or data structure to store this information. The database table or data structure should contain the following fields:

[0097] Data type: stores the name or identifier of the data type;

[0098] Encryption attribute: stores the encryption status of the data type;

[0099] Other relevant information: such as data size, storage location, creation time, etc. (optional).

[0100] 3. Write program logic to manage this database or data structure. The program should include the following functions:

[0101] Add data type: allows users to add new data types and specify their encryption properties;

[0102] Update encryption attributes: Allows users to change the encryption attributes of existing data types;

[0103] Query data type information: Allows users to query the encrypted properties of a specific data type or all data types;

[0104] Data encryption / decryption: If the data type is marked as encrypted, the program should provide the corresponding encryption / decryption function.

[0105] 4. Implement a user interface (optional). To facilitate user operation, you can design a user interface (such as a command line interface or a graphical user interface). The user interface should provide easy-to-understand menus and options so that users can easily add, update, and query data types and their encryption properties.

[0106] In this embodiment, first, the data to be stored is received, and the processing method of the data is determined according to the encryption attribute input by the user. If the data is marked as requiring encryption, a storage instruction containing an encryption function and the data itself is generated through a preset program that has been obfuscated by code. This step is intended to enhance the security of the data and protect sensitive information from being accessed by unauthorized personnel through encryption. At the same time, the application of code obfuscation technology increases the difficulty of reverse engineering and further improves the security of the system. If the data is marked as not requiring encryption, the processing flow is simplified, and only a storage instruction containing the data is generated and sent to the database for data storage. After experiencing at least one step of storing data according to the storage instruction, a corresponding relationship between the data type and the encryption attribute is established by running a preset program to guide the subsequent data processing process. On the one hand, through encryption processing and code obfuscation technology, data can be more effectively protected from being leaked or tampered with. On the other hand, by establishing a corresponding relationship between the data type and the encryption attribute, the system can manage and maintain data more efficiently and improve the efficiency of data processing.

[0107] Based on any of the above embodiments, the cryptographic function includes an AES encryption function, an AES decryption function, a HEX() function for format conversion, and a UNHEX() function for inverse format conversion; the reorganization instruction is generated by calling the JSQLParser tool; and the obfuscation tool includes the ProGuard code obfuscation tool.

[0108] It should be understood that the AES encryption function may be an AES_ENCRYPT() function, and the AES decryption function may be an AES_DECRYPT() function. The data processing method described in the first embodiment is completed by calling the JSQLParser tool.

[0109] The cryptographic functions include the following four functions:

[0110] ①AES encryption function: AES (Advanced Encryption Standard) is a widely used symmetric encryption algorithm. It provides three encryption strengths: 128-bit, 192-bit, and 256-bit. You can choose the appropriate encryption strength to protect the data according to your needs. The AES encryption function usually accepts two input parameters: the data to be encrypted (plaintext) and the encryption key. It encrypts the data using the key and outputs the encrypted data (ciphertext).

[0111] ②AES decryption function: The AES decryption function is the inverse process of the AES encryption function. It accepts two input parameters: the data to be decrypted (ciphertext) and the decryption key (the same key used for encryption). Using the decryption key, the AES decryption function can restore the original data (plaintext) before encryption.

[0112] ③HEX() function: used to convert binary data into a string in hexadecimal format. This is very useful for data transmission and storage, because hexadecimal strings are easier to read and debug than binary data. For example, a block of binary data may be converted into a series of hexadecimal digits, each digit taking up two characters.

[0113] ④UNHEX() function: The UNHEX() function is the inverse process of the HEX() function. It accepts a hexadecimal formatted string as input and converts it back to the original binary data. This is very useful when you need to restore a hexadecimal string to binary data for further processing.

[0114] The reorganization instructions are generated by calling the JSQLParser tool. JSQLParser is a Java library for parsing, modifying, and generating SQL statements. For example, JSQLParser can modify the table name, field name, conditional expression, etc. in the SQL statement to meet the needs of data encryption, access control, or data desensitization. Using JSQLParser, you can easily parse the original SQL statement, modify it as needed, and finally generate the reorganization instructions (i.e., new SQL statements) that meet the requirements.

[0115] ProGuard code obfuscation tool: ProGuard is an open source Java class file compression, optimization, obfuscation and pre-verification tool. It is commonly used in Android development to reduce the size of APK files and improve the security of the code. Code obfuscation is a core function of ProGuard. It makes the code difficult to understand and track by renaming class names, method names, field names, etc., thereby increasing the difficulty of reverse engineering. In addition, ProGuard can also delete unused code, optimize bytecode structure, etc. to further reduce the size of APK files and improve operating efficiency. In this embodiment, using ProGuard to obfuscate programs containing sensitive codes such as AES encryption functions can effectively protect the code from being analyzed or tampered with by unauthorized personnel.

[0116] It should be noted that in addition to using the above-mentioned program code obfuscation method on the system side, the following methods can also be used on the data side to prevent database or code leakage and cracking (decompilation):

[0117] The data encryption method used is implemented based on the MYSQL built-in encryption (AES_ENCRYPT()) function. At the same time, to ensure that the encrypted data can maintain the integrity and security of the data, the MYSQL built-in function HEX() is used to convert the data into hexadecimal format, which can avoid character encoding problems that may occur when processing data and ensure the correctness and readability of the data;

[0118] Encryption details: The AES_ENCRYPT() function has two parameters: the first parameter is the encrypted data, and the second parameter is the encryption key; the encryption process uses the MYSQL Advanced Encryption Standard (AES) algorithm to encrypt the data, and HEX() converts the encrypted data into hexadecimal representation. This processed data can be stored and transmitted more easily, and also increases data security;

[0119] The basic level of the data decryption method adopted is to use the MYSQL built-in decryption function (AES_DECRYPT()) as the benchmark and rely on the UNHEX() function to reverse the hexadecimal format data to the original format; data decryption is achieved by using the system layer as the main benchmark point, JSQLParser as the core intersection layer (transfer layer), and the MYSQL built-in decryption AES_DECRYPT()) function as the data decryption basic level;

[0120] Decryption details: For example, there is a student table in the system, which contains name, age, sex, and remark fields, among which the name field is processed by the encryption policy; when displaying data in the system, the corresponding request for data retrieval or display will be intercepted by JSQLParser, and after interception, the encrypted field will be reorganized by adding the data retrieval DML language of the AES_ENCRYPT() decryption function through JSQLParser to achieve the effect of displaying the encrypted data in plain text;

[0121] It is understandable that in the related art, when it is necessary to encrypt certain fields in the database, the field cannot be obtained through a fuzzy query on the plain text after encryption. If you want to perform a fuzzy query on the field, you cannot encrypt the field, making the encryption incompatible with the fuzzy query on the plain text. This embodiment combines Proguard, JSQLParser and Mysql's AES encryption. Specifically, Mysql's AES is used to encrypt the code and database, JSQLParser is used for decryption, and Proguard is used to obfuscate the code. Based on this method, fuzzy matching can be achieved, that is, using unencrypted search terms, encrypted data can be retrieved.

[0122] As an example, after inputting the text to be searched at the system level, it will enter the JSQLParser entry layer managed by the system. In JSQLParser, it will check whether there is data information that needs to be decrypted. If so, field parsing will be performed. When querying, AES_DECRYPT() will be used to perform DML language decryption processing. When adding or modifying data, data encryption processing will be performed through AES_ENCRYPT() to complete the addition and modification of data.

[0123] In this embodiment, the AES encryption and decryption function provides the ability to encrypt and decrypt data, the reorganization instruction meets the data processing requirements by modifying the SQL statement, and the obfuscation tool improves the security of the code by obfuscating the code. These tools and technologies together constitute an important part of the data processing process and improve the security and privacy of the data.

[0124] In addition, the present application also provides a data processing method based on encrypted code and database, and the specific implementation process is as follows:

[0125] First, in order to ensure system security, data confidentiality, and prevent database or code leakage and reverse compilation, when deploying the system locally or performing security vulnerability detection (involving source code execution packages, database packages, and servers), the following points are used to implement system integrity restrictions:

[0126] Data side:

[0127] The data encryption method adopted in this embodiment is implemented by using the MYSQL built-in encryption (AES_ENCRYPT()) function as a benchmark. At the same time, in order to ensure that the encrypted data can maintain the integrity and security of the data, the MYSQL built-in function HEX() is used to convert the data into hexadecimal format, which can avoid character encoding problems that may occur when processing data and ensure the correctness and readability of the data;

[0128] Encryption details: The AES_ENCRYPT() function has two parameters: the first parameter is the encrypted data, and the second parameter is the encryption key; the encryption process uses the MYSQL Advanced Encryption Standard (AES) algorithm to encrypt the data, and HEX() converts the encrypted data into hexadecimal representation. This processed data can be stored and transmitted more easily, and also increases data security;

[0129] The data decryption method adopted in this embodiment is implemented by using the MYSQL built-in decryption function (AES_DECRYPT()) as a benchmark, and relies on the UNHEX() function to reverse the hexadecimal format data to the original format; wherein data decryption is implemented by using the system layer as the main benchmark point, JSQLParser as the core intersection layer (transfer layer), and the MYSQL built-in decryption AES_DECRYPT()) function as the data decryption base layer;

[0130] Decryption details:

[0131] For example, there is a student table in the system, which contains name, age, sex, and remark fields, among which the name field is a field processed by the encryption policy; when displaying data in the system, the corresponding request for data retrieval or display will be intercepted by JSQLParser, and after interception, the encrypted field will be reorganized by adding the data retrieval DML language of the AES_ENCRYPT() decryption function through JSQLParser to achieve the effect of displaying the encrypted data in plain text;

[0132] System side:

[0133] Based on the data-side processing benchmark, the source code design and implementation method may result in code leakage when the startup package is decompiled without Proguard code obfuscation, so it is necessary to use Proguard to obfuscate the source code to achieve the purpose of protecting the decrypted data.

[0134] Secondly, after the text to be searched is inputted at the system level, it will enter the JSQLParser entry level managed by the system. In JSQLParser, it will check whether there is data information to be decrypted. If there is, field parsing will be performed. When querying, the AES_DECRYPT() function will be used to perform DML language decryption processing. When adding or modifying data, the AES_ENCRYPT() function will be used to encrypt the data and complete the addition and modification of data. Specifically, when the system level receives a search request from the user, in which the search request carries the text to be searched, JSQLParser will intercept and reorganize the search statement, and determine whether the text to be searched is an encrypted attribute based on the pre-stored correspondence table between data types and encrypted attributes. When it is indeed an encrypted attribute, the UNHEX() function and AES_DECRYPT() function will be inserted to obtain the reorganized search statement, so that the database can perform search processing according to the reorganized search statement and finally return the search results.

[0135] In this embodiment, the three technologies of AES encryption method, JSQLParser and Proguard are organically combined to encrypt the code and database, thereby improving the security of the code and database, and solving the problem of fuzzy query of data encryption and decryption through JSQLParser, thereby improving the retrieval efficiency of encrypted data. In addition, the method of this embodiment can integrate the problem of plain text display of encrypted data as a whole without the need to decrypt the attributes to be decrypted one by one, thereby improving the speed and integration of data encryption and decryption processing, and it is ready to use out of the box, and can be continuously supplemented after one configuration, without the need to be compatible with other special implementations, and supports rapid completion of encryption and decryption processing and display of plain text.

[0136] Based on the method described in any of the above embodiments, the present application also provides Figure 4 A schematic diagram of the structure of an electronic device is shown in FIG. Figure 4 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the method described in any of the above embodiments.

[0137] Based on the method described in any of the above embodiments, the present application also provides a computer storage medium, which stores a computer program. When the computer program is executed by a processor, it can be used to execute the method described in any of the above embodiments.

[0138] Based on the method described in any of the above embodiments, the present application also provides a computer program product, which includes one or more computer programs or instructions. The computer program or instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. When the computer program is executed by a processor, the method described in any of the above embodiments is implemented.

[0139] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0140] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0141] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0142] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0143] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0144] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A data processing method, characterized in that: The method is used to process encrypted data in a database; the processing includes retrieval processing and / or addition processing; the method includes: In the case of receiving a data processing instruction, determining the encryption attribute of the target data type according to the target data type to which the data to be processed carried by the data processing instruction belongs and the correspondence between the pre-stored data type and the encryption attribute; the encryption attribute includes encryption and non-encryption; When it is determined that the encryption attribute of the target data type is encryption, inserting a preset cryptographic function into the data processing instruction to obtain a reorganization instruction; The reorganization instruction is sent to the database, where the reorganization instruction is used to instruct the database to perform the indicated processing based on the cryptographic function and the data to be processed.

2. The method according to claim 1, characterized in that The data processing instruction includes a retrieval processing instruction; the cryptographic function includes a decryption function; and the step of obtaining the reorganization instruction includes: When it is determined that the encryption attribute of the target data type is encryption, the decryption function is inserted into the retrieval processing instruction to obtain a reorganization instruction including the decryption function; the reorganization instruction is used to instruct the database to retrieve the encrypted retrieval result of the data to be processed from the encrypted data, and decrypt the encrypted retrieval result based on the decryption function in the reorganization instruction.

3. The method according to claim 2, characterized in that The cryptographic function also includes an inverse format conversion function; the reorganization instruction also includes the inverse format conversion function, and the reorganization instruction is used to instruct the database to use the inverse format conversion function to perform inverse format conversion on the encrypted retrieval result, and to use the decryption function to decrypt the encrypted retrieval result after inverse format conversion.

4. The method according to claim 1, characterized in that The data processing instruction includes an add processing instruction; the cryptographic function includes an encryption function; and the step of obtaining the reorganization instruction includes: When it is determined that the encryption attribute of the target data type is encryption, the encryption function is inserted into the add processing instruction to obtain a reorganization instruction including the encryption function; the reorganization instruction is used to instruct the database to use the encryption function to encrypt and store the data to be processed.

5. The method according to claim 4, characterized in that The cryptographic function also includes a format conversion function; the reorganization instruction also includes the format conversion function, and the reorganization instruction is used to instruct the database to use the encryption function to encrypt the data to be processed, and use the format conversion function to convert the format of the encrypted data and then store it.

6. The method according to any one of claims 1 to 5, characterized in that: Before receiving the data processing instruction, the method further includes: receiving data to be stored; If the encryption attribute of the data to be stored is encryption, a storage instruction carrying the data to be stored and the encryption function is generated by running a preset program; wherein the preset program is code obfuscated by a preset obfuscation tool; and the encryption attribute is input by a user; If the encryption attribute of the data to be stored is non-encrypted, generating a storage instruction carrying the data to be stored by running the preset program; Sending the storage instruction to the database, wherein the storage instruction is used to instruct the database to store the data to be stored; The corresponding relationship between the data type and the encryption attribute is established by running the preset program.

7. The method according to claim 6, characterized in that The cryptographic functions include an AES encryption function, an AES decryption function, a HEX() function for format conversion, and a UNHEX() function for reverse format conversion; the reorganization instructions are generated by calling a JSQLParser tool; and the obfuscation tool includes a ProGuard code obfuscation tool.

8. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; Wherein, when the processor calls the executable instruction, the method described in any one of claims 1-7 is implemented.

9. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the computer instructions are executed by a processor, the steps of any method described in claims 1-7 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images