Data processing method and device, equipment, medium and product

Abstract

The invention provides a data processing method and device, equipment, a medium and a product. The method comprises the steps of obtaining a first database operation statement; wherein the first database operation statement indicates to perform a first operation on data of a first plaintext column in the first database; rewriting the first database operation statement to obtain a second database operation statement; wherein the second database operation statement indicates that a first operation is carried out on data of a first ciphertext column in the first database, the first plaintext column stores original data, and the first ciphertext column stores data obtained after the original data is encrypted; and executing the second database operation statement to obtain a data processing result. According to the method, operation is carried out on plaintext data in a database for business parties, the business parties do not need to perceive the data encryption and decryption process and do not need to configure business codes related to data encryption and decryption, the data encryption and decryption process is decoupled from the business parties, transparent encryption and decryption are achieved, and the method is widely applied to various business parties.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of computer technology, the complexity of business has gradually increased, and the amount of business data has gradually increased. Usually, business data is stored in a database. Considering the security of business data, encrypted business data is usually stored in the database.

[0003] In the related art, the data encryption and decryption process between the business party and the database is usually implemented by the business party, that is, the process of storing encrypted business data in the database and the process of the business party obtaining decrypted business data are both implemented by the business party. However, the above method is coupled with the business party, and the business party needs to configure the corresponding business code for the data encryption and decryption process, which has high development costs and low applicability. Summary of the invention

[0004] The present application provides a data processing method. In the method, the data encryption and decryption process is decoupled from the business party to achieve transparent encryption and decryption. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0005] In a first aspect, the present application provides a data processing method, the method comprising:

[0006] Obtaining a first database operation statement; wherein the first database operation statement indicates performing a first operation on data in a first plaintext column in a first database;

[0007] Rewrite the first database operation statement to obtain a second database operation statement; wherein the second database operation statement indicates to perform the first operation on data in a first ciphertext column in the first database, the first plaintext column stores original data, and the first ciphertext column stores data encrypted from the original data;

[0008] Execute the second database operation statement to obtain a data processing result.

[0009] In some possible implementations, rewriting the first database operation statement to obtain a second database operation statement includes:

[0010] Parsing the first database operation statement to obtain a syntax tree of the first database operation statement;

[0011] Determine, according to the syntax tree of the first database operation statement, a first plaintext column serving as an operation object in the first database operation statement;

[0012] Determine a first ciphertext column corresponding to the first plaintext column according to a correspondence between plaintext columns and ciphertext columns in the first database;

[0013] The first database operation statement is rewritten according to the first ciphertext sequence to obtain a second database operation statement.

[0014] In some possible implementations, the first operation is a query operation, and rewriting the first database operation statement according to the first ciphertext column to obtain a second database operation statement includes:

[0015] According to the first ciphertext column, a replacement operation or an addition operation is performed on the column name of the first plaintext column as an operation object in the first database operation statement to obtain a second database operation statement.

[0016] In some possible implementations, the first operation is a non-query operation, and rewriting the first database operation statement according to the first ciphertext column to obtain a second database operation statement includes:

[0017] Determining first data as operation data in the first database operation statement;

[0018] Encrypting the first data to obtain first encrypted data;

[0019] According to the first ciphertext column and the first encrypted data, an addition operation is performed on the column name of the first plaintext column as the operation object in the first database operation statement, and an addition operation is performed on the field name of the first data as the operation data in the first database operation statement, so as to obtain a second database operation statement.

[0020] In some possible implementations, the method further includes:

[0021] Acquire an operation status of the first database; wherein the operation status represents a single read or a double read for the first database;

[0022] The step of performing a replacement operation or an addition operation on the column name of the first plaintext column as an operation object in the first database operation statement according to the first ciphertext column to obtain a second database operation statement includes:

[0023] In response to the operation status representation, a single read is performed on the first database, and a column name of the first plaintext column as an operation object in the first database operation statement is replaced with a column name of the first ciphertext column to obtain a second database operation statement;

[0024] In response to the operation status representation that a dual read is performed on the first database, a column name of the first ciphertext column is added to an operation object of the first database operation statement to obtain a second database operation statement.

[0025] In some possible implementations, the first operation is a query operation, and executing the second database operation statement to obtain a data processing result includes:

[0026] Execute the second database operation statement to obtain the query result;

[0027] The query result is decrypted and the decrypted query result is returned.

[0028] In some possible implementations, the first operation is a non-query operation, and executing the second database operation statement to obtain a data processing result includes:

[0029] Executing the second database operation statement to obtain an operation result indicating success or failure of the data operation;

[0030] Returns the result of the operation.

[0031] In some possible implementations, rewriting the first database operation statement to obtain a second database operation statement includes:

[0032] In response to the presence of a second plaintext column in the first database operation statement, generating a column name rewriting sub-statement; wherein the second plaintext column is not an operation object of the first database operation statement, the column name of the second plaintext column is the same as the column name of the first ciphertext column, and the column name rewriting sub-statement indicates to rewrite the column name of the first ciphertext column;

[0033] The first database operation statement is rewritten according to the column name rewriting substatement to obtain a second database operation statement.

[0034] In a second aspect, the present application provides a data processing device, the device comprising:

[0035] An acquisition module, configured to acquire a first database operation statement; wherein the first database operation statement indicates to perform a first operation on data in a first plaintext column in a first database;

[0036] a rewriting module, configured to rewrite the first database operation statement to obtain a second database operation statement; wherein the second database operation statement indicates that the first operation is performed on data in a first ciphertext column of the first database, the first plaintext column stores original data, and the first ciphertext column stores data encrypted from the original data;

[0037] The execution module is used to execute the second database operation statement to obtain a data processing result.

[0038] In some possible implementations, the rewriting module is specifically used to:

[0039] Parsing the first database operation statement to obtain a syntax tree of the first database operation statement;

[0040] Determine, according to the syntax tree of the first database operation statement, a first plaintext column serving as an operation object in the first database operation statement;

[0041] Determine a first ciphertext column corresponding to the first plaintext column according to a correspondence between plaintext columns and ciphertext columns in the first database;

[0042] The first database operation statement is rewritten according to the first ciphertext sequence to obtain a second database operation statement.

[0043] In some possible implementations, the first operation is a query operation, and the rewriting module is specifically configured to:

[0044] According to the first ciphertext column, a replacement operation or an addition operation is performed on the column name of the first plaintext column as an operation object in the first database operation statement to obtain a second database operation statement.

[0045] In some possible implementations, the first operation is a non-query operation, and the rewriting module is specifically configured to:

[0046] Determining first data as operation data in the first database operation statement;

[0047] Encrypting the first data to obtain first encrypted data;

[0048] According to the first ciphertext column and the first encrypted data, an addition operation is performed on the column name of the first plaintext column as the operation object in the first database operation statement, and an addition operation is performed on the field name of the first data as the operation data in the first database operation statement, so as to obtain a second database operation statement.

[0049] In some possible implementations, the acquisition module is further configured to:

[0050] Acquire an operation status of the first database; wherein the operation status represents a single read or a double read for the first database;

[0051] The rewriting module is specifically used for:

[0052] In response to the operation status representation, a single read is performed on the first database, and a column name of the first plaintext column as an operation object in the first database operation statement is replaced with a column name of the first ciphertext column to obtain a second database operation statement;

[0053] In response to the operation status representation that a dual read is performed on the first database, a column name of the first ciphertext column is added to an operation object of the first database operation statement to obtain a second database operation statement.

[0054] In some possible implementations, the first operation is a query operation, and the execution module is specifically configured to:

[0055] Execute the second database operation statement to obtain the query result;

[0056] The query result is decrypted and the decrypted query result is returned.

[0057] In some possible implementations, the first operation is a non-query operation, and the execution module is specifically configured to:

[0058] Executing the second database operation statement to obtain an operation result indicating success or failure of the data operation;

[0059] Returns the result of the operation.

[0060] In some possible implementations, the rewriting module is specifically used to:

[0061] In response to the presence of a second plaintext column in the first database operation statement, generating a column name rewriting sub-statement; wherein the second plaintext column is not an operation object of the first database operation statement, the column name of the second plaintext column is the same as the column name of the first ciphertext column, and the column name rewriting sub-statement indicates to rewrite the column name of the first ciphertext column;

[0062] The first database operation statement is rewritten according to the column name rewriting substatement to obtain a second database operation statement.

[0063] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory, so that the electronic device performs the data processing method in the first aspect or any implementation of the first aspect.

[0064] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, wherein the instructions instruct an electronic device to execute the data processing method described in the first aspect or any one of the implementations of the first aspect.

[0065] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the data processing method described in the first aspect or any one of the implementations of the first aspect.

[0066] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0067] It can be seen from the above technical solutions that this application has the following advantages:

[0068] The present application provides a data processing method, which first obtains a first database operation statement, wherein the first database operation statement indicates that a first operation is performed on data in a first plaintext column in a first database, then rewrites the first database operation statement to obtain a second database operation statement, wherein the second database operation statement indicates that the first operation is performed on data in a first ciphertext column in the first database, the first plaintext column stores original data, the first ciphertext column stores data encrypted from the original data, executes the second database operation statement, and obtains a data processing result.

[0069] In this method, the first database operation statement sent by the business party operates on the data in the plaintext column of the database, and by rewriting the first database operation statement, the operation is performed on the data in the corresponding ciphertext column of the database. In this way, for the business party, all operations are performed on the plaintext data in the database. The business party does not need to perceive the data encryption and decryption process, and does not need to configure the business code related to data encryption and decryption. The data encryption and decryption process is decoupled from the business party, realizing transparent encryption and decryption, and is widely applicable to various types of business parties. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0071] Figure 1 A flowchart of a data processing method provided in an embodiment of the present application;

[0072] Figure 2 An interactive schematic diagram of a data processing system provided in an embodiment of the present application;

[0073] Figure 3 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application;

[0074] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0076] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0077] In the process of business development, operation and maintenance, a large amount of business data may be generated. Usually, considering the security of business data, some business data may be encrypted and stored in the database.

[0078] Since the database stores encrypted business data, and the business party usually uses unencrypted business data, there is a data encryption and decryption process between the business party and the database. Specifically, the data encryption and decryption process may include the following two processes: encrypting the business data provided by the business party and storing the encrypted business data in the database, and decrypting the encrypted business data in the database and returning the decrypted business data to the business party.

[0079] Normally, considering the stability of business operation, the above data encryption and decryption process is implemented through transparent encryption and decryption technology. Among them, transparent encryption and decryption technology can be understood as automatic encryption and decryption during the transmission of business data, and the business party does not need to perceive this process, that is, when the business is running, only unencrypted business data needs to be provided, and in the process of transmitting the unencrypted business data to the database, the business data is automatically encrypted, and then the encrypted business data is stored in the database. Similarly, when there is a need to operate business data from the database during business operation, a request for operation on unencrypted business data is sent, the business data is automatically decrypted, and the decrypted business data is returned to the business party. In this way, for the business party, the process of business data encryption and business data decryption is transparent, and the business party only needs to operate on the unencrypted business data, without having to pay attention to how to encrypt or decrypt the business data.

[0080] In the related art, the above transparent encryption and decryption process is implemented by executing the business code of the business party. In some examples, a software development kit (SDK) is deployed in the application layer of the business party, and the business traffic between the business party and the database, such as database operation statements, is obtained through the SDK, and the database operation statements are modified to implement the data encryption and decryption process. In other examples, a business code for calling the data encryption and decryption application programming interface (API) is added, and the data encryption and decryption process is implemented by calling the data encryption and decryption API.

[0081] However, in the above-mentioned transparent encryption and decryption method based on SDK, the SDK deployed in the application layer needs to be adapted to the programming language used by the business party. Different business parties need to deploy corresponding SDKs, which has high development costs. When the business is upgraded, the SDK also needs to be upgraded, which is not conducive to business expansion. In the above-mentioned transparent encryption and decryption method based on API, the business code of each business party needs to be modified, which has certain maintenance costs, is not conducive to opening up the data encryption and decryption process across businesses, and has poor applicability.

[0082] In view of this, the present application provides a data processing method, which first obtains a first database operation statement, wherein the first database operation statement indicates that a first operation is performed on data in a first plaintext column in a first database, then rewrites the first database operation statement to obtain a second database operation statement, wherein the second database operation statement indicates that the first operation is performed on data in a first ciphertext column in the first database, the first plaintext column stores original data, the first ciphertext column stores data after the original data is encrypted, executes the second database operation statement, and obtains a data processing result.

[0083] In this method, the first database operation statement sent by the business party operates on the data in the plaintext column of the database, and by rewriting the first database operation statement, the operation is performed on the data in the corresponding ciphertext column of the database. In this way, for the business party, all operations are performed on the plaintext data in the database. The business party does not need to perceive the data encryption and decryption process, and does not need to configure the business code related to data encryption and decryption. The data encryption and decryption process is decoupled from the business party, realizing transparent encryption and decryption, and is widely applicable to various types of business parties.

[0084] To facilitate understanding of the technical solution provided by the embodiments of the present application, the following will be described in conjunction with the accompanying drawings. Figure 1 A flow chart of a data processing method is shown, the method specifically comprising:

[0085] S101: Acquire a first database operation statement.

[0086] The first database operation statement may be understood as a statement used to operate data in a database. For example, the first database operation statement may be a structured query language (SQL) statement.

[0087] In an embodiment of the present application, the first database operation statement may be sent by the business party, and the first database operation statement may indicate to perform a first operation on the data of the first plain text column in the first database. The first database may be a relational database associated with the business party, in other words, the first database may be understood as a database for storing the business data of the business party.

[0088] The first database may include multiple data tables, each of which stores business data in the form of a table. Specifically, a data table consists of rows and columns. Usually, one column of a data table corresponds to one field, and one row of a data table corresponds to one piece of business data. For example, a piece of business data includes an account identification (identity, ID) and an account nickname. The first column of the data table may correspond to the account ID field, in which the account IDs of different accounts may be stored. The second column of the data table may correspond to the account nickname field, in which the account nicknames of different accounts may be stored. In addition, the first column and the second column of the same row store data of the same account.

[0089] Considering that there may be more critical fields in the business data, in order to ensure the security of the business data, the first database may include plaintext columns and ciphertext columns. Among them, the plaintext column can be understood as a column for storing unencrypted business data, and the ciphertext column can be understood as a column for storing encrypted business data. In an embodiment of the present application, for the same field in the business data, the first database stores both the unencrypted business data and the encrypted business data, that is, there are plaintext columns and ciphertext columns with corresponding relationships in the first database, and the plaintext columns and ciphertext columns with corresponding relationships respectively store the plaintext data and ciphertext data of the same business data.

[0090] The business party can perform different types of first operations on the data in the first database. That is, the first operation can be understood as any operation performed on the data in the first database. For example, the first operation can be a query operation, an insert operation, an update operation, a delete operation, etc.

[0091] For the business party, the business data that the business party comes into contact with is only unencrypted, and the business party does not understand how the business data is encrypted and stored in the first database. Therefore, when the business party has the need to operate on the data in the first database, the first database operation statement sent is to operate on the plaintext data in the first database (i.e., the data in the first plaintext column).

[0092] S102: rewrite the first database operation statement to obtain a second database operation statement.

[0093] In the embodiment of the present application, considering the transmission security and storage security of business data, in the process of actually accessing the first database, operations are performed on the encrypted data in the first database. In this way, it is necessary to rewrite the first database operation statement to obtain the rewritten second database operation statement.

[0094] The second database operation statement may indicate that a first operation is performed on the data of the first ciphertext column in the first database, the first plaintext column stores the original data, and the first ciphertext column stores the data after the original data is encrypted. That is, the first plaintext column and the first ciphertext column have a corresponding relationship, the first plaintext column and the first ciphertext column store the same original data, the first plaintext column stores the plaintext data of the original data, and the first ciphertext column stores the ciphertext data of the original data.

[0095] By rewriting the first database operation statement, the rewritten second database operation statement performs the same first operation as the first database operation statement, but the second database operation statement operates on the data of the first ciphertext column.

[0096] In a specific implementation, the first database operation statement is parsed to obtain a syntax tree of the first database operation statement; based on the syntax tree of the first database operation statement, a first plaintext column serving as an operation object in the first database operation statement is determined; based on a correspondence between plaintext columns and ciphertext columns in the first database, a first ciphertext column corresponding to the first plaintext column is determined; based on the first ciphertext column, the first database operation statement is rewritten to obtain a second database operation statement.

[0097] The syntax tree (also called parse tree) of the first database operation statement can be understood as a tree model for representing the statement structure of the first database operation statement, and the syntax tree describes the grammatical and semantic structures of the first database operation statement.

[0098] The embodiment of the present application does not limit the method for obtaining the syntax tree of the first database operation statement. For example, the first database operation statement can be decomposed into multiple tokens, and the multiple tokens can be combined into a syntax tree from top to bottom or from bottom to top according to the syntax rules of the first database operation statement.

[0099] The object can be understood as a column corresponding to a field included in a database operation statement, and the operation object can be understood as an object returned after executing a database operation statement. For example, when certain data of field A is returned after executing a database operation statement, the operation object can be a column corresponding to field A. Since there can be multiple objects in the first database operation statement, but not all of the multiple objects are necessarily operation objects, therefore, in the embodiment of the present application, the syntax tree of the first database operation statement is analyzed to determine the first plain text column in the first database operation statement as the operation object.

[0100] For example, the database operation statement is "SELECT name FROM customers WHERE age>30", where the objects include name and age. After executing the database operation statement, the object returned is name, so the operation object is the name column.

[0101] By determining the first plaintext column as the operation object in the first database operation statement, based on the correspondence between the plaintext column and the ciphertext column, the first ciphertext column corresponding to the first plaintext column can be further determined, so that the first database operation statement is rewritten in combination with the first ciphertext column.

[0102] In the embodiments of the present application, different types of first operations may have different rewrite logics. In some embodiments, the first operation is a query operation, in which case, according to the first ciphertext column, a column name of the first plaintext column as an operation object in the first database operation statement is replaced or added to obtain a second database operation statement.

[0103] The query operation can be understood as an operation of querying data from the first database. In other words, the first database operation statement itself does not carry data, and after the query operation is executed, the returned query result carries data. In this case, the column name of the first plaintext column as the operation object is rewritten, and the column name of the first plaintext column is replaced with the column name of the first ciphertext column, or, based on the first database operation statement, the first ciphertext column is added as the operation object to implement the logic of querying data from the first ciphertext column of the first database.

[0104] The existence of replacement or addition operations in the above rewrite logic takes into account the different operation states of the first database. Specifically, the operation state of the first database is obtained, and the operation state can represent a single read or a double read of the first database. In response to the operation state representing a single read of the first database, the column name of the first plaintext column as the operation object in the first database operation statement is replaced with the column name of the first ciphertext column, and the second database operation statement is obtained. Similarly, in response to the operation state representing a double read of the first database, the column name of the first ciphertext column is added to the operation object of the first database operation statement to obtain the second database operation statement.

[0105] Among them, single reading can be understood as reading only ciphertext data from the database, that is, the returned query results only include ciphertext data. Double reading can be understood as reading both plaintext data and ciphertext data from the database, that is, the returned query results include both plaintext data and ciphertext data. Usually, double reading is used in the grayscale testing phase. By reading both plaintext data and ciphertext data at the same time, the plaintext data is used as the backup data. In the actual business operation process, single reading is usually used.

[0106] Thus, when the operation state is single read, since only the ciphertext data needs to be read, the column name of the first plaintext column is replaced with the column name of the first ciphertext column, so that the second database operation statement has the logic of "reading data from the first ciphertext column". When the operation state is dual read, since both plaintext data and ciphertext data need to be read at the same time, the column name of the first ciphertext column is added on the basis of the column name of the first plaintext column as the operation object, so that the second database operation statement has the logic of "reading data from the first plaintext column and the first ciphertext column".

[0107] For example, the first database operation statement is "SELECT Name FROM t", the first plaintext column as the operation object in the first database operation statement is the Name column, and the first ciphertext column corresponding to the first plaintext column is the _Name column. When the operation status is single-read, the first database operation statement is rewritten to obtain the second database operation statement "SELECT_Name FROM t", and the ciphertext data of the _Name column is queried from the data table t. When the operation status is dual-read, the first database operation statement is rewritten to obtain the second database operation statement "SELECT Name,_Name FROM t", and the plaintext data of the Name column and the ciphertext data of the _Name column are queried from the data table t at the same time.

[0109] In other embodiments, the first operation is a non-query operation. In this case, the first data serving as operation data in the first database operation statement is determined, the first data is encrypted to obtain first encrypted data, and based on the first ciphertext column and the first encrypted data, an addition operation is performed on the column name of the first plaintext column serving as the operation object in the first database operation statement, and an addition operation is performed on the field name of the first data serving as operation data in the first database operation statement to obtain a second database operation statement.

[0110] A non-query operation can be understood as a modification operation on designated data, where designated data is the operation data, for example, an insert operation to insert designated data into a database, a delete operation to delete designated data from a database, an update operation to update original data in a database using designated data, etc. In other words, the first database operation statement itself carries data, and in an embodiment of the present application, the designated data targeted by the non-query operation is referred to as the first data. In this case, the column name of the first plaintext column as the operation object and the first data as the operation data are rewritten at the same time. On the basis of the first database operation statement, the first ciphertext column is added as the operation object, and the first encrypted data is added as the operation data, so as to implement the logic of modifying the first plaintext column and the first ciphertext column at the same time.

[0111] For example, the first database operation statement is "INSERT INTO t(Name)VALUES('plain_name')", the first plain text column as the operation object in the first database operation statement is the Name column, the first cipher text column corresponding to the first plain text column is the _Name column, the first data as the operation data in the first database operation statement is 'plain_name', and the first encrypted data obtained after encrypting the first data is 'cipher_name'. The first database operation statement is rewritten to obtain the second database operation statement "INSERT INTO t(Name, _Name) VALUES('plain_name', 'cipher_name')", which inserts the plain text data 'plain_name' into the Name column of the data table t, and at the same time, inserts the cipher text data 'cipher_name' into the _Name column of the data table t.

[0112] In some possible implementations, the object in the first database operation statement may conflict with the column name of the first ciphertext column. In response to the existence of the second plaintext column in the first database operation statement, a column name rewriting sub-statement is generated, and the first database operation statement is rewritten according to the column name rewriting sub-statement to obtain a second database operation statement.

[0113] Among them, the second plaintext column is not the operation object of the first database operation statement, the column name of the second plaintext column is the same as the column name of the first ciphertext column, and the column name rewrite substatement indicates to rewrite the column name of the first ciphertext column. In other words, there is a second plaintext column with the same column name as the first ciphertext column in the first database operation statement. For example, the first database operation statement is "SELECT Name FROM (SELECT Name, Age AS_Name FROM t)", the first plaintext column as the operation object in the first database operation statement is the Name column, and the first ciphertext column corresponding to the first plaintext column is the _Name column. At the same time, there is also a second plaintext column _Name column in the first database operation statement, which has a naming conflict with the first ciphertext column.

[0114] In this case, in order to avoid the smooth execution of the second database operation statement, a naming replacement is required. Continuing with the above example, when the operation status is single-read, the second database operation statement is "SELECT Name FROM(SELECT_Name ASName,Age AS_Name FROM t)", where the column name rewriting sub-statement is "_Name AS Name". When the operation status is double-read, the second database operation statement is "SELECT Name,_Name_0FROM(SELECT Name,Age AS_Name,_Name as_Name_0FROM t)", where the column name rewriting sub-statement is "_Name as_Name_0". In this way, in the event of a naming conflict, the column name rewriting sub-statement is used to ensure that the first ciphertext column in the rewritten second database operation statement does not have the same column name as other objects, thereby ensuring the smooth execution of the second database operation statement.

[0115] S103: Execute the second database operation statement to obtain a data processing result.

[0116] After completing the rewriting of the database operation statement, the second database operation statement can indicate an operation on the encrypted data in the first database. Therefore, when executing the second database operation statement, during the actual access to the first database, the operation is performed on the encrypted data in the first database, ensuring the transmission security and storage security of the business data.

[0117] Similarly, first operations of different operation types may obtain different data processing results. In some embodiments, the first operation is a query operation, in which case the second database operation statement is executed to obtain a query result, the query result is decrypted, and the decrypted query result is returned.

[0118] In the case where the first operation is a query operation, by executing the second database operation statement, the query result returned carries the ciphertext data read from the first database, so it is necessary to decrypt the query result and return the corresponding plaintext data to the business party. In this way, the business party sends the first database operation statement indicating to query the plaintext data, receives the query result including the plaintext data, and does not perceive the data encryption and decryption process.

[0119] In other embodiments, the first operation is a non-query operation. In this case, the second database operation statement is executed to obtain an operation result indicating a successful data operation or a failed data operation, and the operation result is returned.

[0120] In the case where the first operation is a non-query operation, by executing the second database operation statement, the returned operation result does not carry the data in the first database, but only indicates whether the operation is successful. Therefore, there is no need to decrypt the operation result, and the operation result is directly returned to the business party. In this way, the business party sends the first database operation statement indicating a non-query operation on plaintext data, receives the operation result, and does not perceive the data encryption and decryption process.

[0121] In this method, the first database operation statement sent by the business party operates on the data in the plaintext column of the database, and by rewriting the first database operation statement, the operation is performed on the data in the corresponding ciphertext column of the database. In this way, for the business party, all operations are performed on the plaintext data in the database. The business party does not need to perceive the data encryption and decryption process, and does not need to configure the business code related to data encryption and decryption. The data encryption and decryption process is decoupled from the business party, realizing transparent encryption and decryption, and is widely applicable to various types of business parties.

[0122] The above data processing method can be executed by a data processing system. In the embodiment of the present application, the data processing system can be provided in the form of a component. In other words, the data processing system can be connected to the business logic of the business party as a component, and transparent encryption and decryption can be achieved without modifying the original business logic of the business party. In addition, only the data processing system component can be updated and upgraded later without affecting other business logics of the business party.

[0123] The data processing system can implement the above data processing method together with other components, such as Figure 2As shown, the business direction sends a first database operation statement to the data processing system, and the data processing system parses the first database operation statement to obtain a syntax tree of the first database operation statement. Next, the data model component sends the column information in the first database to the data processing system, such as information that each column in the first database is a plaintext column or a ciphertext column, information about the encryption algorithm of each ciphertext column in the first database, etc. The data processing system determines the first plaintext column that is the operation object and has a corresponding ciphertext column from the syntax tree of the first database operation statement based on the column information in the first database.

[0124] Next, the logic control component sends the correspondence between the plaintext columns and the ciphertext columns in the first database to the data processing system. The data processing system determines the first ciphertext column corresponding to the first plaintext column based on the correspondence between the plaintext columns and the ciphertext columns in the first database, and rewrites the first database operation statement based on the first ciphertext column to obtain the second database operation statement.

[0125] The data processing system executes the second database operation statement in the first database to obtain the data processing result sent by the first database. When the first operation is a query operation, the data processing result is a query result including ciphertext data. The data processing system calls the encryption and decryption processing component to decrypt the data processing result, obtains the decrypted data processing result returned by the encryption and decryption processing component, and returns the decrypted data processing result to the business party. In this way, the business party does not need to modify the business code or rewrite the database operation statement by itself. By accessing the data processing system, data processing and transparent data encryption and decryption are realized on the basis of sending the first database operation statement and without perceiving the data encryption and decryption process.

[0126] Combination of the above Figure 1 and Figure 2 The data processing method provided in the embodiment of the present application is introduced in detail. The device and equipment provided in the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0127] See also Figure 3 The structural diagram of the data processing device shown in FIG. 30 includes:

[0128] An acquisition module 301 is configured to acquire a first database operation statement, wherein the first database operation statement indicates to perform a first operation on data in a first plaintext column in a first database;

[0129] A rewriting module 302 is configured to rewrite the first database operation statement to obtain a second database operation statement; wherein the second database operation statement indicates that the first operation is performed on data in a first ciphertext column in the first database, the first plaintext column stores original data, and the first ciphertext column stores data encrypted from the original data;

[0130] The execution module 303 is used to execute the second database operation statement to obtain a data processing result.

[0131] In some possible implementations, the rewriting module 302 is specifically configured to:

[0132] Parsing the first database operation statement to obtain a syntax tree of the first database operation statement;

[0133] Determine, according to the syntax tree of the first database operation statement, a first plaintext column serving as an operation object in the first database operation statement;

[0134] Determine a first ciphertext column corresponding to the first plaintext column according to a correspondence between plaintext columns and ciphertext columns in the first database;

[0135] The first database operation statement is rewritten according to the first ciphertext sequence to obtain a second database operation statement.

[0136] In some possible implementations, the first operation is a query operation, and the rewriting module 302 is specifically configured to:

[0137] According to the first ciphertext column, a replacement operation or an addition operation is performed on the column name of the first plaintext column as an operation object in the first database operation statement to obtain a second database operation statement.

[0138] In some possible implementations, the first operation is a non-query operation, and the rewriting module 302 is specifically configured to:

[0139] Determining first data as operation data in the first database operation statement;

[0140] Encrypting the first data to obtain first encrypted data;

[0141] According to the first ciphertext column and the first encrypted data, an addition operation is performed on the column name of the first plaintext column as the operation object in the first database operation statement, and an addition operation is performed on the field name of the first data as the operation data in the first database operation statement, so as to obtain a second database operation statement.

[0142] In some possible implementations, the acquisition module 301 is further configured to:

[0143] Acquire an operation status of the first database; wherein the operation status represents a single read or a double read for the first database;

[0144] The rewriting module 302 is specifically used for:

[0145] In response to the operation status representation, a single read is performed on the first database, and a column name of the first plaintext column as an operation object in the first database operation statement is replaced with a column name of the first ciphertext column to obtain a second database operation statement;

[0146] In response to the operation status representation that a dual read is performed on the first database, a column name of the first ciphertext column is added to an operation object of the first database operation statement to obtain a second database operation statement.

[0147] In some possible implementations, the first operation is a query operation, and the execution module 303 is specifically configured to:

[0148] Execute the second database operation statement to obtain the query result;

[0149] The query result is decrypted and the decrypted query result is returned.

[0150] In some possible implementations, the first operation is a non-query operation, and the execution module 303 is specifically configured to:

[0151] Executing the second database operation statement to obtain an operation result indicating success or failure of the data operation;

[0152] Returns the result of the operation.

[0153] In some possible implementations, the rewriting module 302 is specifically configured to:

[0154] In response to the presence of a second plaintext column in the first database operation statement, generating a column name rewriting sub-statement; wherein the second plaintext column is not an operation object of the first database operation statement, the column name of the second plaintext column is the same as the column name of the first ciphertext column, and the column name rewriting sub-statement indicates to rewrite the column name of the first ciphertext column;

[0155] The first database operation statement is rewritten according to the column name rewriting substatement to obtain a second database operation statement.

[0156] The data processing device 30 according to the embodiment of the present application may correspond to executing the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the data processing device 30 are respectively to implement Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0157] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 The functionality of the data processing device 30 in the embodiment shown.

[0158] Figure 4 A schematic diagram of the structure of an electronic device 400 is provided. Figure 4 As shown, the electronic device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate with each other via the bus 401.

[0159] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0160] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0161] The communication interface 403 is used for communicating with the outside. For example, the communication interface 403 can be used for communicating with a terminal.

[0162] The memory 404 may include a volatile memory, such as a random access memory (RAM). The memory 404 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0163] The memory 404 stores executable codes, and the processor 402 executes the executable codes to perform the aforementioned data processing method.

[0164] Specifically, in implementing Figure 3 In the case of the embodiment shown, and Figure 3 When each module or unit of the data processing device 30 described in the embodiment is implemented by software, the execution Figure 3 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned data processing method.

[0165] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the data processing method applied to the data processing device 30.

[0166] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0167] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0168] When the computer program product is executed by a computer, the computer executes any of the aforementioned data processing methods. The computer program product may be a software installation package, and when any of the aforementioned data processing methods is needed, the computer program product may be downloaded and executed on a computer.

[0169] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0170] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0171] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0172] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0173] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0174] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0175] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0176] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0177] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data processing method, characterized in that: The method comprises: Obtaining a first database operation statement; wherein the first database operation statement indicates performing a first operation on data in a first plaintext column in a first database; Rewrite the first database operation statement to obtain a second database operation statement; wherein the second database operation statement indicates to perform the first operation on data in a first ciphertext column in the first database, the first plaintext column stores original data, and the first ciphertext column stores data encrypted from the original data; Execute the second database operation statement to obtain a data processing result.

2. The method according to claim 1, characterized in that The rewriting of the first database operation statement to obtain a second database operation statement includes: Parsing the first database operation statement to obtain a syntax tree of the first database operation statement; Determine, according to the syntax tree of the first database operation statement, a first plaintext column serving as an operation object in the first database operation statement; Determine a first ciphertext column corresponding to the first plaintext column according to a correspondence between plaintext columns and ciphertext columns in the first database; The first database operation statement is rewritten according to the first ciphertext sequence to obtain a second database operation statement.

3. The method according to claim 2, characterized in that The first operation is a query operation, and rewriting the first database operation statement according to the first ciphertext column to obtain a second database operation statement includes: According to the first ciphertext column, a replacement operation or an addition operation is performed on the column name of the first plaintext column as an operation object in the first database operation statement to obtain a second database operation statement.

4. The method according to claim 2, characterized in that: The first operation is a non-query operation, and rewriting the first database operation statement according to the first ciphertext column to obtain a second database operation statement includes: Determining first data in the first database operation statement as operation data; Encrypting the first data to obtain first encrypted data; According to the first ciphertext column and the first encrypted data, an addition operation is performed on the column name of the first plaintext column as the operation object in the first database operation statement, and an addition operation is performed on the field name of the first data as the operation data in the first database operation statement, so as to obtain a second database operation statement.

5. The method according to claim 3, characterized in that: The method further comprises: Acquire an operation status of the first database; wherein the operation status represents a single read or a double read for the first database; The step of performing a replacement operation or an addition operation on the column name of the first plaintext column as an operation object in the first database operation statement according to the first ciphertext column to obtain a second database operation statement includes: In response to the operation status representation, a single read is performed on the first database, and a column name of the first plaintext column as an operation object in the first database operation statement is replaced with a column name of the first ciphertext column to obtain a second database operation statement; In response to the operation status representation that a dual read is performed on the first database, a column name of the first ciphertext column is added to an operation object of the first database operation statement to obtain a second database operation statement.

6. The method according to claim 1, characterized in that The first operation is a query operation, and the executing the second database operation statement to obtain a data processing result includes: Execute the second database operation statement to obtain the query result; The query result is decrypted and the decrypted query result is returned.

7. The method according to claim 1, characterized in that The first operation is a non-query operation, and the executing the second database operation statement to obtain a data processing result includes: Executing the second database operation statement to obtain an operation result indicating success or failure of the data operation; Returns the result of the operation.

8. The method according to any one of claims 1 to 7, characterized in that: The rewriting of the first database operation statement to obtain a second database operation statement includes: In response to the presence of a second plaintext column in the first database operation statement, generating a column name rewriting sub-statement; wherein the second plaintext column is not an operation object of the first database operation statement, the column name of the second plaintext column is the same as the column name of the first ciphertext column, and the column name rewriting sub-statement indicates to rewrite the column name of the first ciphertext column; The first database operation statement is rewritten according to the column name rewriting substatement to obtain a second database operation statement.

9. A data processing device, characterized in that: The device comprises: An acquisition module, configured to acquire a first database operation statement; wherein the first database operation statement indicates to perform a first operation on data in a first plaintext column in a first database; a rewriting module, configured to rewrite the first database operation statement to obtain a second database operation statement; wherein the second database operation statement indicates that the first operation is performed on data in a first ciphertext column of the first database, the first plaintext column stores original data, and the first ciphertext column stores data encrypted from the original data; The execution module is used to execute the second database operation statement to obtain a data processing result.

10. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 8.

Images