Database data synchronization method and device based on quantum security, equipment and medium

Abstract

The embodiment of the invention provides a database data synchronization method and device based on quantum security, equipment and a medium. The method comprises the following steps: in a process of switching from a plaintext mode to a ciphertext mode, writing ciphertext data obtained by encrypting first plaintext data and second plaintext data into a second data table, and executing a ciphertext-to-plaintext synchronization task to decrypt the encrypted first plaintext data and write the decrypted first plaintext data into a first data table; emptying the first plaintext data in the first data table; in the process of switching from the ciphertext mode to the plaintext mode, decrypting ciphertext data and writing the decrypted ciphertext data into a first data table; and executing a synchronization task from the plaintext to the ciphertext to encrypt the decrypted ciphertext data, and writing the ciphertext data and the second plaintext data into a second data table. According to the embodiment of the invention, the sensitive data of the plaintext table is encrypted and then stored to the underlying logic of the ciphertext table, and the synchronization task and the switchable plaintext and ciphertext mode are set, so that the flexible switching and bidirectional synchronization of the plaintext and ciphertext data can be completed without the interruption of service of a service system on line.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a database data synchronization method based on quantum security and a database data synchronization device based on quantum security. Background Art

[0002] Existing database encryption products mainly rely on encryption technology for database storage files. This method requires that before the system is officially launched, the business systems that need encryption protection must be temporarily suspended in order to smoothly deploy data encryption tools and related database plug-ins. Such operations not only increase the maintenance cost of the system, but also affect the user experience, because users cannot use related services normally during the service suspension. In addition, systems using such encryption methods often face poor disaster recovery performance. Once a failure occurs, the encrypted data recovery process is complicated and time-consuming, which may cause the data recovery time to be extended, thereby affecting the continuity and stability of the business. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a method for quantum-secure database data synchronization and a corresponding device for quantum-secure database data synchronization that overcome the above problems or at least partially solve the above problems.

[0004] According to a first aspect of an embodiment of the present invention, a method for synchronizing database data based on quantum security is provided, the method comprising:

[0005] When the business system is in plaintext mode, obtaining plaintext data generated by the business system, and writing the plaintext data into a first data table;

[0006] When the business system is in ciphertext mode, obtaining plaintext data generated by the business system, determining first plaintext data belonging to a target field and second plaintext data not belonging to the target field, encrypting the first plaintext data to obtain ciphertext data, and writing the ciphertext data and the second plaintext data into a second data table;

[0007] After the business system switches from the plaintext mode to the intermediate mode, obtaining the plaintext data generated by the business system, writing the ciphertext data encrypted by the first plaintext data and the second plaintext data into the second data table, and performing a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table, and writing the first plaintext data into the first data table;

[0008] After the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data in the first data table;

[0009] After the business system switches from the ciphertext mode to the intermediate mode, obtaining ciphertext data generated by the business system and encrypted from the first plaintext data, decrypting the ciphertext data and writing it into the first data table;

[0010] After the business system switches from the intermediate mode to the plaintext mode, a plaintext-to-ciphertext synchronization task is performed to encrypt the decrypted ciphertext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0011] Optionally, the method further includes:

[0012] When the business system goes online, determine the stock data in the first data table; the stock data is plain text data;

[0013] Creating the second data table;

[0014] Execute a stock data migration task, wherein the stock data migration task is to encrypt first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table;

[0015] Obtaining plaintext data generated by the business system, encrypting the first plaintext data to obtain ciphertext data, writing the ciphertext data and second plaintext data into the second data table, performing a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and writing the decrypted ciphertext data into the first data table;

[0016] Obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform a plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0017] Optionally, the obtaining the plaintext data generated by the business system, and writing the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table includes:

[0018] Obtaining first plaintext data generated by the business system;

[0019] Obtain an encryption strategy and a quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption strategy and the quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0020] Optionally, decrypting the first plaintext data encrypted in the second data table and writing the first plaintext data into the first data table includes:

[0021] Obtaining ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system;

[0022] An encryption strategy and a quantum key corresponding to the first plaintext data are obtained, and according to the encryption strategy and the quantum key corresponding to the first plaintext data, ciphertext data corresponding to the first plaintext data is decrypted and written into the first data table.

[0023] Optionally, the first data table and the second data table include multiple fields; before creating the second data table, the method further includes:

[0024] Setting an encryption policy for first plaintext data of a target field among the multiple fields;

[0025] Obtaining a quantum key corresponding to the first plaintext data;

[0026] The quantum key corresponding to the first plaintext data is encrypted using the encryption strategy and then saved.

[0027] Optionally, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0028] According to a second aspect of an embodiment of the present invention, a database data synchronization device based on quantum security is provided, the device comprising:

[0029] A first writing module, used for obtaining plaintext data generated by the business system when the business system is in plaintext mode, and writing the plaintext data into a first data table;

[0030] A second writing module is used to, when the business system is in a ciphertext mode, obtain the plaintext data generated by the business system, determine the first plaintext data belonging to the target field, and the second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table;

[0031] a third writing module, configured to obtain the plaintext data generated by the business system after the business system switches from the plaintext mode to the intermediate mode, write the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table, and write the first plaintext data into the first data table;

[0032] A first clearing module, configured to clear the first plaintext data in the first data table after the business system switches from the intermediate mode to the ciphertext mode;

[0033] A fourth writing module is used to obtain the ciphertext data generated by the business system and obtained by encrypting the first plaintext data after the business system switches from the ciphertext mode to the intermediate mode, decrypt the ciphertext data and write it into the first data table;

[0034] The fifth writing module is used to perform a plaintext to ciphertext synchronization task after the business system switches from the intermediate mode to the plaintext mode, so as to encrypt the decrypted ciphertext data in the first data table and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0035] Optionally, the device further comprises:

[0036] A first determination module is used to determine the stock data in the first data table when the business system goes online; the stock data is plain text data;

[0037] A first creation module, used for creating the second data table;

[0038] a sixth writing module, configured to execute a stock data migration task, wherein the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table;

[0039] a seventh writing module, configured to obtain the plaintext data generated by the business system, encrypt the first plaintext data to obtain ciphertext data, write the ciphertext data and the second plaintext data into the second data table, perform a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and write the decrypted ciphertext data into the first data table;

[0040] The eighth writing module is used to obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0041] Optionally, the third writing module includes:

[0042] A first acquisition submodule, used to acquire first plaintext data generated by the business system;

[0043] The first writing submodule is used to obtain the encryption strategy and quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0044] Optionally, the third writing module further includes:

[0045] A second acquisition submodule, used to acquire ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system;

[0046] The second writing submodule is used to obtain the encryption strategy and quantum key corresponding to the first plaintext data, and decrypt the ciphertext data corresponding to the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data and write the ciphertext data into the first data table.

[0047] Optionally, the first data table and the second data table include multiple fields; before creating the second data table, the device further includes:

[0048] A first setting module, used to set an encryption policy for first plaintext data in multiple fields;

[0049] A first acquisition module, used to acquire the quantum key corresponding to the first plaintext data;

[0050] The first encryption module is used to encrypt the quantum key corresponding to the first plaintext data according to the encryption strategy and then save it.

[0051] Optionally, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0052] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the quantum-secure database data synchronization method as described in any one of the above items are implemented.

[0053] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the method for quantum-secure database data synchronization as described in any one of the above are implemented.

[0054] The technical solution provided by the embodiments of the present invention may have the following beneficial effects:

[0055] The embodiment of the present invention provides a database data synchronization method based on quantum security, which writes the encrypted ciphertext data and the second plaintext data into the second data table during the process of switching from plaintext mode to ciphertext mode, performs the ciphertext-to-plaintext synchronization task, decrypts the encrypted first plaintext data and writes it into the first data table; clears the first plaintext data in the first data table; decrypts the ciphertext data and writes it into the first data table during the process of switching from ciphertext mode to plaintext mode; performs the plaintext-to-ciphertext synchronization task, encrypts the decrypted ciphertext data, and writes the ciphertext data and the second plaintext data into the second data table. The embodiment of the present invention sets the synchronization task and the switchable plaintext and ciphertext mode by encrypting the sensitive data of the plaintext table and saving it to the ciphertext table, so that the business system can complete the flexible switching and two-way synchronization of plaintext and ciphertext data without stopping the service when it goes online. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 is a flowchart of a method for quantum-safe database data synchronization provided by an embodiment of the present invention;

[0057] Figure 2 is a flowchart of another method for database data synchronization based on quantum security provided by an embodiment of the present invention;

[0058] Figure 3 This is a structural block diagram of a database data synchronization device based on quantum security provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] One of the core concepts of the embodiments of the present invention is to set synchronization tasks and switchable plaintext and ciphertext modes by encrypting the plaintext table data and saving it in the underlying logic of the ciphertext table, so that the business system can complete flexible switching and two-way synchronization of plaintext and ciphertext data without stopping the service when it goes online.

[0061] Reference Figure 1 , shows a flowchart of a method for quantum-safe database data synchronization provided by an embodiment of the present invention, wherein the method may specifically include the following steps:

[0062] Step 101, when the business system is in plain text mode, obtaining plain text data generated by the business system, and writing the plain text data into a first data table;

[0063] The first data table is a plaintext table, and the second data table is a ciphertext table. After the stock data of the business system is migrated from the first data table to the second data table, if the business system is still running in plaintext mode, in order to maintain data consistency and integrity, the system will write the plaintext data into the first data table.

[0064] Step 102, when the business system is in ciphertext mode, obtaining plaintext data generated by the business system, determining first plaintext data belonging to the target field and second plaintext data not belonging to the target field, encrypting the first plaintext data to obtain ciphertext data, and writing the ciphertext data and the second plaintext data into a second data table;

[0065] By storing the target fields of the newly generated plaintext data in the second data table in ciphertext form, and storing the non-target fields in the second data table in plaintext form, it is possible to effectively prevent sensitive data from being illegally accessed or leaked during transmission and storage, improve the overall security of the data, ensure that all newly generated data maintains the same encryption format as the migrated existing data, avoid the situation where plaintext and ciphertext are mixed in the data table, and simplify data management and query operations. The business system runs in ciphertext mode, which means that all data processing logic has been adapted to the encryption algorithm. Writing ciphertext data directly into the ciphertext table can seamlessly connect to the existing system, reduce additional data conversion steps, and improve the overall efficiency of the system. Many industry standards and laws and regulations require encryption of sensitive data to ensure the security of data during storage and transmission. By writing ciphertext data directly into the ciphertext table, these compliance requirements can be better met and legal risks can be reduced.

[0066] Step 103, after the business system switches from the plaintext mode to the intermediate mode, obtain the plaintext data generated by the business system, write the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table, and write the first plaintext data into the first data table;

[0067] After the business system switches from plaintext mode to intermediate mode, the system needs to ensure the integrity and consistency of the data. The system will obtain the plaintext data generated by the business system. In order to protect the security of the data, the system will encrypt the first plaintext data belonging to the target field in these plaintext data. The data in the target field is sensitive data, and write the encrypted ciphertext data together with the second plaintext data into the second data table, that is, the ciphertext table, which has the encrypted ciphertext data of the first plaintext data and the second plaintext data. This step ensures that sensitive data will not be accessed by unauthorized persons during storage and transmission.

[0068] However, in order to maintain the normal operation of the business system and the availability of data, the system also needs to perform a synchronization task from ciphertext to plaintext. The purpose of this task is to decrypt the plaintext data encrypted in the second data table, restore it to its original plaintext form, and write these plaintext data into the first data table, i.e., the plaintext table. In this way, the system can ensure real-time synchronization and consistency of data without affecting business logic and user experience. The design of this dual-table structure allows the system to protect data security while ensuring data availability and consistency when switching modes. Through the process of encryption and decryption, the system can seamlessly switch between different modes while meeting the dual goals of data security and business needs.

[0069] Step 104, after the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data in the first data table;

[0070] After the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data belonging to the target field in the first data table is a key step to ensure data security and system integrity. The intermediate mode is usually a transitional stage that allows the system to synchronize and convert data between plaintext and ciphertext. However, once the system is fully switched to the ciphertext mode, the existence of plaintext data may pose a security risk. The existence of sensitive fields of plaintext data means that sensitive information is stored in the system without encryption protection, which increases the risk of sensitive data leakage. Even if the system has encrypted the data and stored it in the second data table, the remnants of the plaintext data may be exploited by unauthorized access or malicious attackers, resulting in data leakage or tampering. After the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data belonging to the target field in the first data table is a necessary step to ensure data security, system integrity and management simplification. It can ensure that only ciphertext data is stored in the underlying storage of sensitive data. Through this operation, the system can better protect sensitive information, ensure data consistency, and simplify subsequent maintenance and management work.

[0071] Step 105, after the business system switches from the ciphertext mode to the intermediate mode, obtain the ciphertext data generated by the business system and encrypted from the first plaintext data, decrypt the ciphertext data and write it into the first data table;

[0072] After the business system switches from ciphertext mode to intermediate mode, the system needs to ensure the availability and consistency of the data. In ciphertext mode, sensitive data is encrypted to protect the security of sensitive information. However, when the system switches to intermediate mode, some business logic and user operations may need to directly access plaintext data to ensure the normal operation of the business and the smoothness of the user experience. By decrypting the ciphertext data and writing it to the first data table, the system can flexibly switch between different modes, which not only meets the needs of data security, but also ensures business continuity and user experience. This design allows the system to ensure the availability and consistency of data while protecting sensitive information, thereby achieving a balance between security and efficiency.

[0073] Step 106, after the business system switches from the intermediate mode to the plaintext mode, executes a plaintext to ciphertext synchronization task to encrypt the decrypted ciphertext data in the first data table, and writes the encrypted ciphertext data and the second plaintext data into the second data table.

[0074] After the business system switches from intermediate mode to plaintext mode, the synchronization task from plaintext to ciphertext is performed to ensure the security and consistency of the data. Intermediate mode is usually a transitional stage that allows the system to synchronize and convert data between plaintext and ciphertext. However, once the system is completely switched to plaintext mode, all data will be stored and processed in plaintext, which may pose a security risk.

[0075] To protect sensitive information, the system needs to encrypt the decrypted ciphertext data in the first data table and write the encrypted data to the second data table. This step ensures that sensitive data is still protected by encryption even in plaintext mode, thereby reducing the risk of data leakage. By performing plaintext to ciphertext synchronization tasks, the system can seamlessly switch between different modes while maintaining data security and consistency. In addition, this synchronization task also helps to simplify system maintenance and management. In plaintext mode, system administrators can focus on optimizing business logic and user experience without worrying about data security. The encrypted data is stored in the second data table, providing an additional layer of security for the system, ensuring that sensitive information is not accessed by unauthorized users during storage and transmission.

[0076] In one embodiment, the method also includes: when the business system is online, determining the stock data in the first data table; the stock data is plaintext data; creating the second data table; executing the stock data migration task, the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table; obtaining the plaintext data generated by the business system, encrypting the first plaintext data to obtain ciphertext data, writing the ciphertext data and the second plaintext data into the second data table, executing the ciphertext to plaintext synchronization task to decrypt the ciphertext data in the second data table, and writing the decrypted ciphertext data into the first data table; obtaining the plaintext data generated by the business system, writing the plaintext data into the first data table, executing the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and writing the encrypted ciphertext data and the second plaintext data into the second data table.

[0077] Reference Figure 2 , shows a step flow chart of another quantum-secure database data synchronization method provided by an embodiment of the present invention.

[0078] When the business system is online, after obtaining the table structure of the business database, the plaintext stock data in the first data table is determined. At this time, the second data table created is an empty ciphertext table. The stock data migration task is also called the stock data synchronization task. New plaintext data will be generated during the execution of the stock data migration task, so it is necessary to create a ciphertext-to-plaintext synchronization task and a plaintext-to-ciphertext synchronization task to monitor the data changes of the plaintext and ciphertext tables in real time. Therefore, the ciphertext-to-plaintext synchronization task is also called the ciphertext-to-plaintext real-time synchronization task, and the plaintext-to-ciphertext synchronization task is also called the plaintext-to-ciphertext real-time synchronization task to maintain the consistency of the plaintext and ciphertext data. At the same time, when switching between plaintext and ciphertext modes, in order to ensure that the underlying storage of sensitive data contains only ciphertext data, the plaintext-to-ciphertext real-time synchronization task needs to be suspended and resumed. Specifically, when in ciphertext mode, the plaintext-to-ciphertext real-time synchronization task is not executed, so the data in the ciphertext table will not change, and the ciphertext-to-plaintext real-time synchronization task is not executed.

[0079] Specifically, when the business system goes online, it is crucial to ensure the integrity and security of the data. First, the system needs to determine the stock data in the first data table. These stock data are plain text data, that is, original data that has not been encrypted. These data may include sensitive information such as user information and transaction records, so measures must be taken to protect their security. To achieve this goal, the system will create a second data table to store encrypted data. Next, the system will perform the stock data migration task. The core of this task is to encrypt the first plain text data belonging to the target field in the stock data in the first data table, and write the encrypted ciphertext data and the second plain text data into the second data table. This step ensures that the stock data will not be accessed by unauthorized access during the migration process, thereby protecting the security of sensitive information.

[0080] While the stock data migration task is in progress, the system also needs to ensure that the newly generated data can be encrypted and decrypted seamlessly. Specifically, the system will obtain the encrypted ciphertext data of the first plaintext data belonging to the target field in the plaintext data generated by the business system, and write these ciphertext data together with the second plaintext data that does not belong to the target field into the second data table. Subsequently, the system will perform the ciphertext-to-plaintext synchronization task, the purpose of which is to decrypt the ciphertext data in the second data table and write the decrypted plaintext data into the first data table. In this way, the system can ensure the real-time synchronization and consistency of new data during the stock data migration process. In addition, the system will also obtain the plaintext data generated by the business system and write these plaintext data into the first data table. In order to protect these newly generated plaintext data, the system will perform the plaintext-to-ciphertext synchronization task, the purpose of which is to encrypt the first plaintext data belonging to the target field in the first data table, and write the encrypted plaintext data together with the second plaintext data that does not belong to the target field into the second data table. In this way, the system can ensure the encryption processing of new data during the stock data migration process, thereby further improving the security of the data.

[0081] In one embodiment, obtaining the plaintext data generated by the business system and writing the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table includes: obtaining the first plaintext data generated by the business system; obtaining the encryption strategy and quantum key corresponding to the first plaintext data, encrypting the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data, and writing the encrypted ciphertext data and the second plaintext data into the second data table.

[0082] First, the system obtains the first plaintext data belonging to the target field generated by the business system. These target fields usually contain sensitive information, such as user identity information, financial data, etc., so encryption processing is required to prevent unauthorized access. Next, the system obtains the encryption policy and quantum key corresponding to the target field. The encryption policy defines how to encrypt the data, while the quantum key provides a highly secure encryption key to ensure the strength and reliability of the encryption process. The use of quantum keys further enhances the security of the data, because quantum keys are non-copyable and non-stealable, thereby preventing the key leakage risk that may exist in traditional encryption methods. Specifically, the quantum key can be obtained by connecting to the quantum cryptographic machine through the SO (SoftwareObject) algorithm file, and the obtained quantum key is encrypted and returned through the encryption policy. After that, the obtained encrypted quantum key is persisted in the business system. Finally, the system encrypts the plaintext data corresponding to the target field according to the obtained encryption policy and quantum key, and writes the encrypted data together with the second plaintext data that does not belong to the target field into the second data table. This step ensures that sensitive data is highly encrypted and protected during storage and transmission, thereby reducing the risk of data leakage and unauthorized access.

[0083] In one embodiment, decrypting the first plaintext data encrypted in the second data table and writing the first plaintext data into the first data table includes: obtaining ciphertext data corresponding to the first plaintext data in the plaintext data generated by the business system; obtaining the encryption strategy and quantum key corresponding to the first plaintext data, and decrypting the ciphertext data corresponding to the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data and writing the ciphertext data into the first data table.

[0084] First, the system obtains the ciphertext data corresponding to the first plaintext data belonging to the target field in the plaintext data generated by the business system. These ciphertext data are stored in the second data table and usually contain sensitive information, such as user identity information, financial data, etc. In order to ensure the availability of these data in business logic and user operations, the system needs to decrypt them. Next, the system obtains the encryption policy and quantum key corresponding to the target field. The encryption policy defines how to decrypt the data, while the quantum key provides a highly secure decryption key to ensure the strength and reliability of the decryption process. The use of quantum keys further enhances the security of the data because quantum keys are non-copyable and non-stealable, thereby preventing the risk of key leakage that may exist in traditional decryption methods. Finally, the system decrypts the ciphertext data corresponding to the target field according to the obtained encryption policy and quantum key, and writes the decrypted plaintext data into the first data table. This step ensures the availability of sensitive data in business operations while maintaining the consistency and integrity of the data.

[0085] In one embodiment, the first data table and the second data table include multiple fields; before creating the second data table, it also includes: setting an encryption strategy for the first plaintext data of the target field among the multiple fields; obtaining the quantum key corresponding to the first plaintext data; and encrypting the quantum key corresponding to the first plaintext data according to the encryption strategy and saving it.

[0086] The encryption policy defines how to encrypt and decrypt data to ensure the security of data during storage and transmission. By setting encryption policies, the system can use different encryption methods for different fields, thereby improving the overall security and flexibility of data. Quantum keys are highly secure and non-replicable, and can effectively prevent the risk of key leakage that may exist in traditional encryption methods. By obtaining quantum keys, the system can ensure the strength and reliability of the encryption process and further improve the security of data. The system encrypts the quantum key corresponding to the first plaintext data belonging to the target field through the encryption policy and saves it. This step ensures the security of quantum keys during storage and transmission, preventing unauthorized access and theft. By encrypting and saving quantum keys, the system can effectively protect the security of sensitive data and ensure the integrity and confidentiality of data in different links.

[0087] In one embodiment, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0088] In business systems, the selection of encryption strategies is crucial to ensure the security and integrity of data. Encryption strategies usually include multiple algorithms to cope with different security requirements and data types. Hash algorithm-based encryption strategies and block cipher algorithm-based encryption strategies are two common encryption methods, each with its own unique advantages and applicable scenarios. The hash algorithm-based encryption strategy can be SM3 (SM3 Hash Algorithm 3), and the block cipher algorithm-based encryption strategy can be SM4 (SM4 Block Cipher Algorithm 4). The hash algorithm-based encryption strategy is mainly used for data integrity verification and identity authentication. The hash algorithm maps data of any length to a fixed-length hash value, which is irreversible and unique. By using the hash algorithm, the system can ensure the integrity of the data and prevent the data from being tampered with during transmission or storage. In addition, the hash algorithm can also be used to generate the hash value of the password, thereby protecting the security of the user's password. The block cipher algorithm-based encryption strategy is mainly used for data encryption and decryption. The block cipher algorithm divides the data into blocks of fixed length and encrypts each block. By using the block cipher algorithm, the system can encrypt sensitive data to ensure the confidentiality of the data during storage and transmission. Block cipher algorithms are highly secure and efficient and are suitable for encryption and decryption operations of large-scale data.

[0089] The embodiment of the present invention provides a database data synchronization method based on quantum security, which is performed by writing the encrypted ciphertext data and the second plaintext data into the second data table after the stock data of the business system is migrated from the first data table to the second data table in the process of switching from the plaintext mode to the ciphertext mode, performing the ciphertext-to-plaintext synchronization task to decrypt the encrypted first plaintext data and write it into the first data table; clearing the first plaintext data in the first data table; in the process of switching from the ciphertext mode to the plaintext mode, decrypting the ciphertext data and writing it into the first data table; performing the plaintext-to-ciphertext synchronization task to encrypt the decrypted ciphertext data and write the ciphertext data and the second plaintext data into the second data table. The embodiment of the present invention sets the synchronization task and the switchable plaintext and ciphertext mode by encrypting the sensitive data of the plaintext table and saving it to the ciphertext table, so that the business system can complete the flexible switching and two-way synchronization of plaintext and ciphertext data without stopping the service when it goes online.

[0090] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0091] Reference Figure 3 , shows a structural block diagram of a database data synchronization device based on quantum security provided by an embodiment of the present invention.

[0092] A first writing module 301 is used to obtain plaintext data generated by the business system when the business system is in plaintext mode, and write the plaintext data into a first data table;

[0093] A second writing module 302 is used to, when the business system is in ciphertext mode, obtain plaintext data generated by the business system, determine first plaintext data belonging to a target field, and second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table;

[0094] A third writing module 303 is used to obtain the plaintext data generated by the business system after the business system switches from the plaintext mode to the intermediate mode, write the ciphertext data encrypted by the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table;

[0095] A first clearing module 304, configured to clear the first plaintext data in the first data table after the business system switches from the intermediate mode to the ciphertext mode;

[0096] A fourth writing module 305 is used to obtain the ciphertext data generated by the business system and obtained by encrypting the first plaintext data after the business system switches from the ciphertext mode to the intermediate mode, decrypt the ciphertext data and write it into the first data table;

[0097] The fifth writing module 306 is used to perform a plaintext to ciphertext synchronization task after the business system switches from the intermediate mode to the plaintext mode, so as to encrypt the decrypted ciphertext data in the first data table and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0098] In one embodiment, the device further comprises:

[0099] A first determination module is used to determine the stock data in the first data table when the business system goes online; the stock data is plain text data;

[0100] A first creation module, used for creating the second data table;

[0101] a sixth writing module, configured to execute a stock data migration task, wherein the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table;

[0102] a seventh writing module, configured to obtain the plaintext data generated by the business system, encrypt the first plaintext data to obtain ciphertext data, write the ciphertext data and the second plaintext data into the second data table, perform a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and write the decrypted ciphertext data into the first data table;

[0103] The eighth writing module is used to obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0104] In one embodiment, the third writing module includes:

[0105] A first acquisition submodule, used to acquire first plaintext data generated by the business system;

[0106] The first writing submodule is used to obtain the encryption strategy and quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0107] In one embodiment, the third writing module further includes:

[0108] A second acquisition submodule, used to acquire ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system;

[0109] The second writing submodule is used to obtain the encryption strategy and quantum key corresponding to the first plaintext data, and decrypt the ciphertext data corresponding to the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data and write the ciphertext data into the first data table.

[0110] In one embodiment, the first data table and the second data table include a plurality of fields; before creating the second data table, the apparatus further includes:

[0111] A first setting module, used to set an encryption policy for first plaintext data in multiple fields;

[0112] A first acquisition module, used to acquire the quantum key corresponding to the first plaintext data;

[0113] The first encryption module is used to encrypt the quantum key corresponding to the first plaintext data according to the encryption strategy and then save it.

[0114] In one embodiment, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0115] The embodiment of the present invention provides a database data synchronization method based on quantum security, which writes the encrypted ciphertext data and the second plaintext data into the second data table during the process of switching from plaintext mode to ciphertext mode, performs the ciphertext-to-plaintext synchronization task, decrypts the encrypted first plaintext data and writes it into the first data table; clears the first plaintext data in the first data table; decrypts the ciphertext data and writes it into the first data table during the process of switching from ciphertext mode to plaintext mode; performs the plaintext-to-ciphertext synchronization task, encrypts the decrypted ciphertext data, and writes the ciphertext data and the second plaintext data into the second data table. The embodiment of the present invention sets the synchronization task and the switchable plaintext and ciphertext mode by encrypting the sensitive data of the plaintext table and saving it to the ciphertext table, so that the business system can complete the flexible switching and two-way synchronization of plaintext and ciphertext data without stopping the service when it goes online.

[0116] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0117] An embodiment of the present invention further provides an electronic device, including:

[0118] The invention comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, each process of the above-mentioned quantum-safe database data synchronization method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0119] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the above-mentioned quantum-secure database data synchronization method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0120] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0121] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0122] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0125] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0126] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0127] A quantum-secure database data synchronization method and a quantum-secure database data synchronization device provided by the present invention are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for database data synchronization based on quantum security, characterized in that: The method comprises: When the business system is in plaintext mode, obtaining plaintext data generated by the business system, and writing the plaintext data into a first data table; When the business system is in ciphertext mode, obtaining plaintext data generated by the business system, determining first plaintext data belonging to a target field and second plaintext data not belonging to the target field, encrypting the first plaintext data to obtain ciphertext data, and writing the ciphertext data and the second plaintext data into a second data table; After the business system switches from the plaintext mode to the intermediate mode, obtaining the plaintext data generated by the business system, writing the ciphertext data encrypted by the first plaintext data and the second plaintext data into the second data table, and performing a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table, and writing the first plaintext data into the first data table; After the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data in the first data table; After the business system switches from the ciphertext mode to the intermediate mode, obtaining ciphertext data generated by the business system and encrypted from the first plaintext data, decrypting the ciphertext data and writing it into the first data table; After the business system switches from the intermediate mode to the plaintext mode, a plaintext-to-ciphertext synchronization task is performed to encrypt the decrypted ciphertext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

2. The method according to claim 1, characterized in that The method further comprises: When the business system goes online, determine the stock data in the first data table; the stock data is plain text data; Creating the second data table; Execute a stock data migration task, wherein the stock data migration task is to encrypt first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table; Obtaining plaintext data generated by the business system, encrypting the first plaintext data to obtain ciphertext data, writing the ciphertext data and second plaintext data into the second data table, performing a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and writing the decrypted ciphertext data into the first data table; Obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform a plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

3. The method according to claim 2, characterized in that The obtaining of the plaintext data generated by the business system, and writing the encrypted ciphertext data obtained by encrypting the first plaintext data and the second plaintext data into the second data table includes: Obtaining first plaintext data generated by the business system; Obtain an encryption strategy and a quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption strategy and the quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

4. The method according to claim 2, characterized in that: The decrypting the first plaintext data encrypted in the second data table and writing the first plaintext data into the first data table comprises: Obtaining ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system; An encryption strategy and a quantum key corresponding to the first plaintext data are obtained, and according to the encryption strategy and the quantum key corresponding to the first plaintext data, ciphertext data corresponding to the first plaintext data is decrypted and written into the first data table.

5. The method according to claim 3 or 4, characterized in that: The first data table and the second data table include a plurality of fields; before creating the second data table, the method further includes: Setting an encryption policy for first plaintext data of a target field among the multiple fields; Obtaining a quantum key corresponding to the first plaintext data; The quantum key corresponding to the first plaintext data is encrypted using the encryption strategy and then saved.

6. The method according to claim 5, characterized in that The encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

7. A database data synchronization device based on quantum security, characterized in that: The device comprises: A first writing module, used for obtaining plaintext data generated by the business system when the business system is in plaintext mode, and writing the plaintext data into a first data table; A second writing module is used to, when the business system is in a ciphertext mode, obtain the plaintext data generated by the business system, determine the first plaintext data belonging to the target field, and the second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table; a third writing module, configured to obtain the plaintext data generated by the business system after the business system switches from the plaintext mode to the intermediate mode, write the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table, and write the first plaintext data into the first data table; A first clearing module, configured to clear the first plaintext data in the first data table after the business system switches from the intermediate mode to the ciphertext mode; A fourth writing module is used to obtain the ciphertext data generated by the business system and obtained by encrypting the first plaintext data after the business system switches from the ciphertext mode to the intermediate mode, decrypt the ciphertext data and write it into the first data table; The fifth writing module is used to perform a plaintext to ciphertext synchronization task after the business system switches from the intermediate mode to the plaintext mode, so as to encrypt the decrypted ciphertext data in the first data table and write the encrypted ciphertext data and the second plaintext data into the second data table.

8. The device according to claim 7, characterized in that The device also includes: A first determination module is used to determine the stock data in the first data table when the business system goes online; the stock data is plain text data; A first creation module, used for creating the second data table; a sixth writing module, configured to execute a stock data migration task, wherein the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table; a seventh writing module, configured to obtain the plaintext data generated by the business system, encrypt the first plaintext data to obtain ciphertext data, write the ciphertext data and the second plaintext data into the second data table, perform a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and write the decrypted ciphertext data into the first data table; The eighth writing module is used to obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the method for database data synchronization based on quantum security as claimed in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the quantum-secure database data synchronization method according to any one of claims 1 to 6 are implemented.

Images