Quantum-safe database data synchronization method, device, equipment, and medium

Abstract

The embodiments of the present invention provide a method, apparatus, device and medium for database data synchronization based on quantum security. The method includes: in the process of switching from plaintext mode to ciphertext mode, writing the encrypted ciphertext data and the second plaintext data after the first plaintext data is encrypted into the second data table, executing the ciphertext-to-plaintext synchronization task to decrypt the encrypted first plaintext data and write it into the first data table; clearing the first plaintext data in the first data table; in the process of switching from ciphertext mode to plaintext mode, decrypting the ciphertext data and writing it into the first data table; executing the plaintext-to-ciphertext synchronization task to encrypt the decrypted ciphertext data and write the ciphertext data and the second plaintext data into the second data table. The embodiment of the present invention sets synchronization tasks and switchable plaintext and ciphertext modes by encrypting the sensitive data in the plaintext table and saving it into the ciphertext table. This allows the flexible switching and two-way synchronization of plaintext and ciphertext data to be completed without stopping the service when the business system goes online.

Description

Technical Field

[0001] The present invention relates to the field of data encryption technology, and in particular to a database data synchronization method and a database data synchronization device based on quantum security. Background Art

[0002] Existing database encryption products primarily rely on encrypting database storage files. This approach requires a brief suspension of service for business systems requiring encryption protection before the system's official launch to facilitate the deployment of the data encryption tool and its associated database plug-in. This operation not only increases system maintenance costs but also impacts user experience, as users are unable to access related services during the suspension. Furthermore, systems using this encryption method often suffer from poor disaster recovery performance. In the event of a failure, the complex and time-consuming process of recovering encrypted data can extend recovery times, impacting business continuity and stability. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a quantum-secure database data synchronization method and a corresponding quantum-secure database data synchronization device that overcome the above problems or at least partially solve the above problems.

[0004] According to a first aspect of an embodiment of the present invention, a method for quantum-safe database data synchronization is provided, the method comprising:

[0005] When the business system is in plaintext mode, obtaining plaintext data generated by the business system and writing the plaintext data into a first data table;

[0006] When the business system is in ciphertext mode, obtaining plaintext data generated by the business system, determining first plaintext data belonging to a target field and second plaintext data not belonging to the target field, encrypting the first plaintext data to obtain ciphertext data, and writing the ciphertext data and the second plaintext data into a second data table;

[0007] After the business system switches from the plaintext mode to the intermediate mode, obtaining plaintext data generated by the business system, writing ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and performing a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table;

[0008] After the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data in the first data table;

[0009] After the business system switches from the ciphertext mode to the intermediate mode, obtaining ciphertext data generated by the business system and encrypted from the first plaintext data, decrypting the ciphertext data and writing it into the first data table;

[0010] After the business system switches from the intermediate mode to the plaintext mode, a plaintext-to-ciphertext synchronization task is performed to encrypt the decrypted ciphertext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0011] Optionally, the method further includes:

[0012] When the business system goes online, determining the stock data in the first data table; the stock data is plain text data;

[0013] Creating the second data table;

[0014] Executing a stock data migration task, wherein the stock data migration task is to encrypt first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table;

[0015] Obtaining plaintext data generated by the business system, encrypting the first plaintext data to obtain ciphertext data, writing the ciphertext data and second plaintext data into the second data table, performing a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and writing the decrypted ciphertext data into the first data table;

[0016] Obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform a plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0017] Optionally, the obtaining of the plaintext data generated by the business system and writing the encrypted ciphertext data obtained by encrypting the first plaintext data and the second plaintext data into the second data table includes:

[0018] Obtaining first plaintext data generated by the business system;

[0019] Obtain an encryption policy and a quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption policy and the quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0020] Optionally, decrypting the first plaintext data encrypted in the second data table and writing the first plaintext data into the first data table includes:

[0021] Obtaining ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system;

[0022] Obtain an encryption policy and a quantum key corresponding to the first plaintext data, and decrypt ciphertext data corresponding to the first plaintext data according to the encryption policy and the quantum key corresponding to the first plaintext data and write the decrypted data into the first data table.

[0023] Optionally, the first data table and the second data table include multiple fields; before creating the second data table, the method further includes:

[0024] Setting an encryption policy for first plaintext data of a target field among the multiple fields;

[0025] Obtaining a quantum key corresponding to the first plaintext data;

[0026] The quantum key corresponding to the first plaintext data is encrypted using the encryption strategy and then saved.

[0027] Optionally, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0028] According to a second aspect of an embodiment of the present invention, a quantum-safe database data synchronization device is provided, the device comprising:

[0029] A first writing module is used to obtain plaintext data generated by the business system when the business system is in plaintext mode, and write the plaintext data into a first data table;

[0030] a second writing module, configured to, when the business system is in ciphertext mode, obtain plaintext data generated by the business system, determine first plaintext data belonging to a target field, and second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table;

[0031] a third writing module, configured to, after the business system switches from the plaintext mode to the intermediate mode, obtain the plaintext data generated by the business system, write the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table;

[0032] a first clearing module, configured to clear the first plaintext data in the first data table after the business system switches from the intermediate mode to the ciphertext mode;

[0033] a fourth writing module, configured to, after the business system switches from the ciphertext mode to the intermediate mode, obtain ciphertext data generated by the business system and encrypted from the first plaintext data, decrypt the ciphertext data, and write the ciphertext data into the first data table;

[0034] The fifth writing module is used to perform a plaintext to ciphertext synchronization task after the business system switches from the intermediate mode to the plaintext mode, so as to encrypt the decrypted ciphertext data in the first data table and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0035] Optionally, the device further includes:

[0036] A first determination module is configured to determine the stock data in the first data table when the business system goes online; the stock data is plain text data;

[0037] A first creation module, configured to create the second data table;

[0038] a sixth writing module, configured to execute a stock data migration task, wherein the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table;

[0039] a seventh writing module, configured to obtain plaintext data generated by the business system, encrypt the first plaintext data to obtain ciphertext data, write the ciphertext data and the second plaintext data into the second data table, perform a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and write the decrypted ciphertext data into the first data table;

[0040] The eighth writing module is used to obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0041] Optionally, the third writing module includes:

[0042] A first acquisition submodule, used to acquire first plaintext data generated by the business system;

[0043] The first writing submodule is configured to obtain an encryption policy and a quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption policy and the quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0044] Optionally, the third writing module further includes:

[0045] A second acquisition submodule is used to obtain ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system;

[0046] The second writing submodule is used to obtain the encryption strategy and quantum key corresponding to the first plaintext data, decrypt the ciphertext data corresponding to the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data, and write the ciphertext data into the first data table.

[0047] Optionally, the first data table and the second data table include multiple fields; before creating the second data table, the device further includes:

[0048] A first setting module, configured to set an encryption policy for first plaintext data in a plurality of fields;

[0049] A first acquisition module, configured to acquire a quantum key corresponding to the first plaintext data;

[0050] The first encryption module is configured to encrypt the quantum key corresponding to the first plaintext data using the encryption strategy and then save the encrypted data.

[0051] Optionally, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0052] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the quantum-secure database data synchronization method as described in any one of the above items are implemented.

[0053] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the quantum-secure database data synchronization method as described in any one of the above are implemented.

[0054] The technical solutions provided by the embodiments of the present invention may have the following beneficial effects:

[0055] An embodiment of the present invention provides a quantum-safe database data synchronization method. During the process of switching from plaintext mode to ciphertext mode, the encrypted ciphertext data of the first plaintext data and the second plaintext data are written into a second data table, and a ciphertext-to-plaintext synchronization task is executed to decrypt the encrypted first plaintext data and write it into the first data table; the first plaintext data in the first data table is cleared; during the process of switching from ciphertext mode to plaintext mode, the ciphertext data is decrypted and written into the first data table; and a plaintext-to-ciphertext synchronization task is executed to encrypt the decrypted ciphertext data and write the ciphertext data and the second plaintext data into the second data table. By implementing the underlying logic of encrypting sensitive data in the plaintext table and saving it to the ciphertext table, the embodiment of the present invention sets synchronization tasks and switchable plaintext and ciphertext modes, so that the flexible switching and two-way synchronization of plaintext and ciphertext data can be completed without stopping the service when the business system goes online. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flowchart of a quantum-safe database data synchronization method provided by an embodiment of the present invention;

[0057] Figure 2 This is a flowchart of another method for quantum-safe database data synchronization provided by an embodiment of the present invention;

[0058] Figure 3 This is a structural block diagram of a quantum-secure database data synchronization device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0060] One of the core concepts of the embodiments of the present invention is to set synchronization tasks and switchable plaintext and ciphertext modes by encrypting the plaintext table data and saving it in the underlying logic of the ciphertext table, so that the business system can complete flexible switching and two-way synchronization of plaintext and ciphertext data without stopping the service when it goes online.

[0061] Reference Figure 1 , shows a flowchart of a method for quantum-safe database data synchronization provided by an embodiment of the present invention. The method may specifically include the following steps:

[0062] Step 101: When the business system is in plaintext mode, obtain plaintext data generated by the business system and write the plaintext data into a first data table;

[0063] The first data table is a plaintext table, and the second data table is a ciphertext table. After the business system's existing data is migrated from the first data table to the second data table, if the business system is still running in plaintext mode, the system will write the plaintext data to the first data table to maintain data consistency and integrity.

[0064] Step 102: When the business system is in ciphertext mode, obtain plaintext data generated by the business system, determine first plaintext data belonging to a target field and second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table;

[0065] By storing the target fields of newly generated plaintext data in ciphertext in a second data table, and non-target fields in plaintext in the second data table, this effectively prevents unauthorized access or leakage of sensitive data during transmission and storage, improving overall data security. This ensures that all newly generated data maintains the same encryption format as the migrated existing data, preventing the mixing of plaintext and ciphertext within the data tables and simplifying data management and query operations. Operating the business system in ciphertext mode means that all data processing logic has been adapted to the encryption algorithm. Writing ciphertext data directly to the ciphertext table allows for seamless integration with existing systems, eliminating additional data conversion steps and improving overall system efficiency. Many industry standards and laws and regulations require encryption of sensitive data to ensure data security during storage and transmission. Writing ciphertext data directly to the ciphertext table can better meet these compliance requirements and reduce legal risks.

[0066] Step 103: After the business system switches from the plaintext mode to the intermediate mode, obtain the plaintext data generated by the business system, write the encrypted ciphertext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table.

[0067] After the business system switches from plaintext mode to intermediate mode, it must ensure data integrity and consistency. The system obtains the plaintext data generated by the business system and, to protect data security, encrypts the first plaintext data belonging to the target field. The data in the target field is sensitive data. The encrypted ciphertext data, along with the second plaintext data, is written to a second data table, the ciphertext table, which contains both the encrypted ciphertext data of the first plaintext data and the second plaintext data. This step ensures that sensitive data is protected from unauthorized access during storage and transmission.

[0068] However, to maintain the normal operation of the business system and data availability, the system also needs to perform a ciphertext-to-plaintext synchronization task. The purpose of this task is to decrypt the encrypted plaintext data in the second data table, restore it to its original plaintext form, and write this plaintext data to the first data table, i.e., the plaintext table. In this way, the system can ensure real-time synchronization and consistency of data without affecting business logic and user experience. This dual-table structure design allows the system to protect data security while ensuring data availability and consistency when switching modes. Through the encryption and decryption process, the system can seamlessly switch between different modes, while meeting the dual goals of data security and business needs.

[0069] Step 104: after the business system switches from the intermediate mode to the ciphertext mode, clear the first plaintext data in the first data table;

[0070] After the business system switches from intermediate mode to ciphertext mode, clearing the first plaintext data belonging to the target field in the first data table is a critical step to ensure data security and system integrity. Intermediate mode is typically a transitional phase, allowing the system to synchronize and convert data between plaintext and ciphertext. However, once the system fully switches to ciphertext mode, the presence of plaintext data can pose security risks. The presence of sensitive fields in plaintext data means that sensitive information is stored in the system without encryption protection, increasing the risk of sensitive data leakage. Even if the system has encrypted the data and stored it in the second data table, residual plaintext data could be exploited by unauthorized access or malicious attackers, leading to data leakage or tampering. After the business system switches from intermediate mode to ciphertext mode, clearing the first plaintext data belonging to the target field in the first data table is a necessary step to ensure data security, system integrity, and simplified management. This ensures that only ciphertext data is stored in the underlying storage of sensitive data. This operation can better protect sensitive information, ensure data consistency, and simplify subsequent maintenance and management.

[0071] Step 105: After the business system switches from the ciphertext mode to the intermediate mode, ciphertext data generated by the business system and encrypted from the first plaintext data is obtained, the ciphertext data is decrypted, and written into the first data table;

[0072] After the business system switches from ciphertext mode to intermediate mode, the system needs to ensure data availability and consistency. In ciphertext mode, sensitive data is encrypted to protect the security of sensitive information. However, when the system switches to intermediate mode, some business logic and user operations may need to directly access plaintext data to ensure the normal operation of the business and the smoothness of the user experience. By decrypting the ciphertext data and writing it to the first data table, the system can flexibly switch between different modes, which not only meets the needs of data security, but also ensures business continuity and user experience. This design allows the system to ensure data availability and consistency while protecting sensitive information, thereby achieving a balance between security and efficiency.

[0073] Step 106, after the business system switches from the intermediate mode to the plaintext mode, performs a plaintext to ciphertext synchronization task to encrypt the decrypted ciphertext data in the first data table, and writes the encrypted ciphertext data and the second plaintext data into the second data table.

[0074] After a business system switches from intermediate mode to plaintext mode, synchronization from plaintext to ciphertext is performed to ensure data security and consistency. Intermediate mode is typically a transitional phase, allowing the system to synchronize and convert data between plaintext and ciphertext. However, once the system fully switches to plaintext mode, all data will be stored and processed in plaintext, which may pose security risks.

[0075] To protect sensitive information, the system needs to encrypt the decrypted ciphertext data in the first data table and write the encrypted data to the second data table. This step ensures that sensitive data is still encrypted and protected even in plaintext mode, thereby reducing the risk of data leakage. By performing plaintext to ciphertext synchronization tasks, the system can seamlessly switch between different modes while maintaining data security and consistency. In addition, this synchronization task also helps to simplify system maintenance and management. In plaintext mode, system administrators can focus on optimizing business logic and user experience without worrying about data security. The encrypted data is stored in the second data table, providing an additional layer of security for the system, ensuring that sensitive information is not accessed by unauthorized users during storage and transmission.

[0076] In one embodiment, the method further includes: when the business system goes online, determining the stock data in the first data table; the stock data is plaintext data; creating the second data table; executing the stock data migration task, the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table; obtaining the plaintext data generated by the business system, encrypting the first plaintext data to obtain ciphertext data, writing the ciphertext data and the second plaintext data into the second data table, executing the ciphertext to plaintext synchronization task to decrypt the ciphertext data in the second data table, and writing the decrypted ciphertext data into the first data table; obtaining the plaintext data generated by the business system, writing the plaintext data into the first data table, executing the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and writing the encrypted ciphertext data and the second plaintext data into the second data table.

[0077] Reference Figure 2 , shows a flowchart of the steps of another quantum-safe database data synchronization method provided by an embodiment of the present invention.

[0078] When the business system goes online, after obtaining the table structure of the business database, the existing plaintext data in the first data table is determined. The second data table created at this time is an empty ciphertext table. The existing data migration task is also called the existing data synchronization task. New plaintext data is generated during the execution of the existing data migration task. Therefore, it is necessary to create ciphertext-to-plaintext synchronization tasks and plaintext-to-ciphertext synchronization tasks to monitor data changes in the plaintext and ciphertext tables in real time. Therefore, the ciphertext-to-plaintext synchronization task is also called the ciphertext-to-plaintext real-time synchronization task, and the plaintext-to-ciphertext synchronization task is also called the plaintext-to-ciphertext real-time synchronization task to maintain the consistency of the plaintext and ciphertext data. Furthermore, when switching between plaintext and ciphertext modes, the plaintext-to-ciphertext real-time synchronization task needs to be paused and resumed to ensure that only ciphertext data is stored in the underlying storage of sensitive data. Specifically, the plaintext-to-ciphertext real-time synchronization task does not execute in ciphertext mode, so the data in the ciphertext table does not change, and the ciphertext-to-plaintext real-time synchronization task does not execute.

[0079] Specifically, when the business system goes online, it is crucial to ensure the integrity and security of the data. First, the system needs to determine the existing data in the first data table. These existing data are plaintext data, that is, original data that has not been encrypted. These data may include sensitive information such as user information and transaction records, so measures must be taken to protect their security. To achieve this goal, the system will create a second data table to store encrypted data. Next, the system will perform the existing data migration task. The core of this task is to encrypt the first plaintext data belonging to the target field in the existing data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table. This step ensures that the existing data will not be accessed by unauthorized access during the migration process, thereby protecting the security of sensitive information.

[0080] While the existing data migration task is in progress, the system also needs to ensure that newly generated data can be seamlessly encrypted and decrypted. Specifically, the system obtains the encrypted ciphertext data of the first plaintext data belonging to the target field in the plaintext data generated by the business system and writes this ciphertext data, along with the second plaintext data that does not belong to the target field, to the second data table. The system then executes a ciphertext-to-plaintext synchronization task, which decrypts the ciphertext data in the second data table and writes the decrypted plaintext data to the first data table. In this way, the system ensures real-time synchronization and consistency of new data during the existing data migration process. Furthermore, the system also obtains plaintext data generated by the business system and writes this plaintext data to the first data table. To protect this newly generated plaintext data, the system executes a plaintext-to-ciphertext synchronization task, which encrypts the first plaintext data belonging to the target field in the first data table and writes the encrypted plaintext data, along with the second plaintext data that does not belong to the target field, to the second data table. In this way, the system ensures the encryption of new data during the existing data migration process, further improving data security.

[0081] In one embodiment, obtaining the plaintext data generated by the business system and writing the encrypted ciphertext data and the second plaintext data into the second data table includes: obtaining the first plaintext data generated by the business system; obtaining the encryption policy and quantum key corresponding to the first plaintext data, encrypting the first plaintext data according to the encryption policy and quantum key corresponding to the first plaintext data, and writing the encrypted ciphertext data and the second plaintext data into the second data table.

[0082] First, the system retrieves the first plaintext data belonging to the target field generated by the business system. These target fields often contain sensitive information, such as user identity information and financial data, and therefore require encryption to prevent unauthorized access. Next, the system retrieves the encryption policy and quantum key corresponding to the target field. The encryption policy defines how data is encrypted, while the quantum key provides a highly secure encryption key, ensuring the strength and reliability of the encryption process. The use of quantum keys further enhances data security because they are unclonable and resistant to theft, thus preventing the key leakage risks associated with traditional encryption methods. Specifically, the system connects to a quantum cryptographic machine using an SO (Software Object) algorithm file to obtain the quantum key. The obtained quantum key is encrypted using the encryption policy and returned. The encrypted quantum key is then persisted in the business system. Finally, the system encrypts the plaintext data corresponding to the target field based on the obtained encryption policy and quantum key, and writes the encrypted data, along with the second plaintext data not belonging to the target field, into a second data table. This step ensures that sensitive data is highly encrypted during storage and transmission, thereby reducing the risk of data leakage and unauthorized access.

[0083] In one embodiment, decrypting the first plaintext data encrypted in the second data table and writing the first plaintext data into the first data table includes: obtaining ciphertext data corresponding to the first plaintext data in the plaintext data generated by the business system; obtaining the encryption policy and quantum key corresponding to the first plaintext data, and decrypting the ciphertext data corresponding to the first plaintext data according to the encryption policy and quantum key corresponding to the first plaintext data and writing the ciphertext data into the first data table.

[0084] First, the system retrieves the ciphertext data corresponding to the first plaintext data in the target field from the plaintext data generated by the business system. This ciphertext data is stored in the second data table and typically contains sensitive information, such as user identity information and financial data. To ensure the availability of this data in business logic and user operations, the system needs to decrypt it. Next, the system retrieves the encryption policy and quantum key corresponding to the target field. The encryption policy defines how the data is decrypted, while the quantum key provides a highly secure decryption key, ensuring the robustness and reliability of the decryption process. The use of quantum keys further enhances data security because they are unclonable and resistant to theft, thus mitigating the key leakage risks associated with traditional decryption methods. Finally, the system decrypts the ciphertext data corresponding to the target field based on the obtained encryption policy and quantum key and writes the decrypted plaintext data to the first data table. This step ensures the availability of sensitive data in business operations while maintaining data consistency and integrity.

[0085] In one embodiment, the first data table and the second data table include multiple fields; before creating the second data table, the method further includes: setting an encryption policy for first plaintext data of a target field among the multiple fields; obtaining a quantum key corresponding to the first plaintext data; and encrypting the quantum key corresponding to the first plaintext data using the encryption policy and then saving the encrypted data.

[0086] The encryption policy defines how data is encrypted and decrypted, ensuring the security of data during storage and transmission. By setting encryption policies, the system can adopt different encryption methods for different fields, thereby improving the overall security and flexibility of the data. Quantum keys are highly secure and non-replicable, effectively preventing the risk of key leakage that may exist in traditional encryption methods. By obtaining quantum keys, the system can ensure the strength and reliability of the encryption process, further improving data security. The system encrypts the quantum key corresponding to the first plaintext data belonging to the target field according to the encryption policy and saves it. This step ensures the security of quantum keys during storage and transmission, preventing unauthorized access and theft. By encrypting and storing quantum keys, the system can effectively protect the security of sensitive data and ensure the integrity and confidentiality of data in different links.

[0087] In one embodiment, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0088] In business systems, the selection of an encryption strategy is crucial for ensuring data security and integrity. Encryption strategies typically include multiple algorithms to address different security requirements and data types. Hash-based encryption strategies and block cipher-based encryption strategies are two common encryption methods, each with unique advantages and applicable scenarios. Hash-based encryption strategies can be SM3 (Hash Algorithm 3), while block cipher-based encryption strategies can be SM4 (Block Cipher Algorithm 4). Hash-based encryption strategies are primarily used for data integrity verification and identity authentication. Hash algorithms map data of arbitrary length to a fixed-length hash value, which is irreversible and unique. By using hash algorithms, the system can ensure data integrity and prevent data tampering during transmission or storage. Hash algorithms can also be used to generate hash values ​​for passwords, thereby protecting user passwords. Block cipher-based encryption strategies are primarily used for data encryption and decryption. Block cipher algorithms divide data into fixed-length blocks and encrypt each block. Using block ciphers, the system can encrypt sensitive data, ensuring confidentiality during storage and transmission. Block cipher algorithms are highly secure and efficient and are suitable for encryption and decryption operations of large-scale data.

[0089] An embodiment of the present invention provides a quantum-safe database data synchronization method. After the existing data of a business system is migrated from a first data table to a second data table, during the process of switching from plaintext mode to ciphertext mode, the encrypted ciphertext data and the second plaintext data are written into the second data table, and a ciphertext-to-plaintext synchronization task is executed to decrypt the encrypted first plaintext data and write it into the first data table; the first plaintext data in the first data table is cleared; during the process of switching from ciphertext mode to plaintext mode, the ciphertext data is decrypted and written into the first data table; and a plaintext-to-ciphertext synchronization task is executed to encrypt the decrypted ciphertext data and write the ciphertext data and the second plaintext data into the second data table. The embodiment of the present invention uses the underlying logic of encrypting sensitive data in the plaintext table and saving it in the ciphertext table, setting synchronization tasks and switchable plaintext and ciphertext modes, so that the business system can complete flexible switching and two-way synchronization of plaintext and ciphertext data without stopping service when it goes online.

[0090] It should be noted that for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0091] Reference Figure 3 , shows a structural block diagram of a quantum-secure database data synchronization device provided by an embodiment of the present invention.

[0092] A first writing module 301 is configured to, when the business system is in plaintext mode, obtain plaintext data generated by the business system and write the plaintext data into a first data table;

[0093] A second writing module 302 is configured to, when the business system is in ciphertext mode, obtain plaintext data generated by the business system, determine first plaintext data belonging to a target field and second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table;

[0094] a third writing module 303 configured to, after the business system switches from the plaintext mode to the intermediate mode, obtain the plaintext data generated by the business system, write the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table;

[0095] A first clearing module 304, configured to clear the first plaintext data in the first data table after the business system switches from the intermediate mode to the ciphertext mode;

[0096] A fourth writing module 305 is configured to, after the business system switches from the ciphertext mode to the intermediate mode, obtain ciphertext data generated by the business system and encrypted from the first plaintext data, decrypt the ciphertext data, and write the ciphertext data into the first data table;

[0097] The fifth writing module 306 is used to perform a plaintext to ciphertext synchronization task after the business system switches from the intermediate mode to the plaintext mode, so as to encrypt the decrypted ciphertext data in the first data table and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0098] In one embodiment, the apparatus further comprises:

[0099] A first determination module is configured to determine the stock data in the first data table when the business system goes online; the stock data is plain text data;

[0100] A first creation module, configured to create the second data table;

[0101] a sixth writing module, configured to execute a stock data migration task, wherein the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table;

[0102] a seventh writing module, configured to obtain plaintext data generated by the business system, encrypt the first plaintext data to obtain ciphertext data, write the ciphertext data and the second plaintext data into the second data table, perform a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and write the decrypted ciphertext data into the first data table;

[0103] The eighth writing module is used to obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0104] In one embodiment, the third writing module includes:

[0105] A first acquisition submodule, used to acquire first plaintext data generated by the business system;

[0106] The first writing submodule is configured to obtain an encryption policy and a quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption policy and the quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

[0107] In one embodiment, the third writing module further includes:

[0108] A second acquisition submodule is used to obtain ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system;

[0109] The second writing submodule is used to obtain the encryption strategy and quantum key corresponding to the first plaintext data, decrypt the ciphertext data corresponding to the first plaintext data according to the encryption strategy and quantum key corresponding to the first plaintext data, and write the ciphertext data into the first data table.

[0110] In one embodiment, the first data table and the second data table include multiple fields; before creating the second data table, the apparatus further includes:

[0111] A first setting module, configured to set an encryption policy for first plaintext data in a plurality of fields;

[0112] A first acquisition module, configured to acquire a quantum key corresponding to the first plaintext data;

[0113] The first encryption module is configured to encrypt the quantum key corresponding to the first plaintext data using the encryption strategy and then save the encrypted data.

[0114] In one embodiment, the encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

[0115] An embodiment of the present invention provides a quantum-safe database data synchronization method. During the process of switching from plaintext mode to ciphertext mode, the encrypted ciphertext data of the first plaintext data and the second plaintext data are written into a second data table, and a ciphertext-to-plaintext synchronization task is executed to decrypt the encrypted first plaintext data and write it into the first data table; the first plaintext data in the first data table is cleared; during the process of switching from ciphertext mode to plaintext mode, the ciphertext data is decrypted and written into the first data table; and a plaintext-to-ciphertext synchronization task is executed to encrypt the decrypted ciphertext data and write the ciphertext data and the second plaintext data into the second data table. By implementing the underlying logic of encrypting sensitive data in the plaintext table and saving it to the ciphertext table, the embodiment of the present invention sets synchronization tasks and switchable plaintext and ciphertext modes, so that the flexible switching and two-way synchronization of plaintext and ciphertext data can be completed without stopping the service when the business system goes online.

[0116] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0117] An embodiment of the present invention further provides an electronic device, including:

[0118] The system includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned quantum-safe database data synchronization method embodiment are implemented, and the same technical effects can be achieved. To avoid repetition, they are not described here.

[0119] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the various processes of the above-mentioned quantum-secure database data synchronization method embodiment are implemented, and the same technical effects can be achieved. To avoid repetition, they are not described here.

[0120] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0121] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0122] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0125] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0126] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0127] The above describes in detail a quantum-secure database data synchronization method and a quantum-secure database data synchronization device provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the method and core concept of the present invention. At the same time, for those skilled in the art, according to the concept of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A quantum-safe database data synchronization method, characterized in that: The method comprises: When the business system is in plaintext mode, obtaining plaintext data generated by the business system and writing the plaintext data into a first data table; When the business system is in ciphertext mode, obtaining plaintext data generated by the business system, determining first plaintext data belonging to a target field and second plaintext data not belonging to the target field, encrypting the first plaintext data to obtain ciphertext data, and writing the ciphertext data and the second plaintext data into a second data table; After the business system switches from the plaintext mode to the intermediate mode, obtaining plaintext data generated by the business system, writing ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and performing a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table; After the business system switches from the intermediate mode to the ciphertext mode, clearing the first plaintext data in the first data table; After the business system switches from the ciphertext mode to the intermediate mode, obtaining ciphertext data generated by the business system and encrypted from the first plaintext data, decrypting the ciphertext data and writing it into the first data table; After the business system switches from the intermediate mode to the plaintext mode, a plaintext-to-ciphertext synchronization task is performed to encrypt the decrypted ciphertext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

2. The method according to claim 1, characterized in that The method further comprises: When the business system goes online, determining the stock data in the first data table; the stock data is plain text data; Creating the second data table; Executing a stock data migration task, wherein the stock data migration task is to encrypt first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table; Obtaining plaintext data generated by the business system, encrypting the first plaintext data to obtain ciphertext data, writing the ciphertext data and second plaintext data into the second data table, performing a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and writing the decrypted ciphertext data into the first data table; Obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform a plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

3. The method according to claim 2, characterized in that The obtaining of the plaintext data generated by the business system and writing the encrypted ciphertext data obtained by encrypting the first plaintext data and the second plaintext data into the second data table includes: Obtaining first plaintext data generated by the business system; Obtain an encryption policy and a quantum key corresponding to the first plaintext data, encrypt the first plaintext data according to the encryption policy and the quantum key corresponding to the first plaintext data, and write the encrypted ciphertext data and the second plaintext data into the second data table.

4. The method according to claim 2, characterized in that The decrypting the first plaintext data encrypted in the second data table and writing the first plaintext data into the first data table includes: Obtaining ciphertext data corresponding to the first plaintext data from the plaintext data generated by the business system; Obtain an encryption policy and a quantum key corresponding to the first plaintext data, and decrypt ciphertext data corresponding to the first plaintext data according to the encryption policy and the quantum key corresponding to the first plaintext data and write the decrypted data into the first data table.

5. The method according to claim 3 or 4, characterized in that The first data table and the second data table include multiple fields; before creating the second data table, the method further includes: Setting an encryption policy for first plaintext data of a target field among the multiple fields; Obtaining a quantum key corresponding to the first plaintext data; The quantum key corresponding to the first plaintext data is encrypted using the encryption strategy and then saved.

6. The method according to claim 5, characterized in that The encryption strategy includes: an encryption strategy based on a hash algorithm and an encryption strategy based on a block cipher algorithm.

7. A database data synchronization device based on quantum security, characterized in that: The device comprises: A first writing module is used to obtain plaintext data generated by the business system when the business system is in plaintext mode, and write the plaintext data into a first data table; a second writing module, configured to, when the business system is in ciphertext mode, obtain plaintext data generated by the business system, determine first plaintext data belonging to a target field, and second plaintext data not belonging to the target field, encrypt the first plaintext data to obtain ciphertext data, and write the ciphertext data and the second plaintext data into a second data table; a third writing module, configured to, after the business system switches from the plaintext mode to the intermediate mode, obtain the plaintext data generated by the business system, write the ciphertext data encrypted from the first plaintext data and the second plaintext data into the second data table, and perform a ciphertext-to-plaintext synchronization task to decrypt the first plaintext data encrypted in the second data table and write the first plaintext data into the first data table; a first clearing module, configured to clear the first plaintext data in the first data table after the business system switches from the intermediate mode to the ciphertext mode; a fourth writing module, configured to, after the business system switches from the ciphertext mode to the intermediate mode, obtain ciphertext data generated by the business system and encrypted from the first plaintext data, decrypt the ciphertext data, and write the ciphertext data into the first data table; The fifth writing module is used to perform a plaintext to ciphertext synchronization task after the business system switches from the intermediate mode to the plaintext mode, so as to encrypt the decrypted ciphertext data in the first data table and write the encrypted ciphertext data and the second plaintext data into the second data table.

8. The device according to claim 7, characterized in that The device further comprises: A first determination module is configured to determine the stock data in the first data table when the business system goes online; the stock data is plain text data; A first creation module, configured to create the second data table; a sixth writing module, configured to execute a stock data migration task, wherein the stock data migration task is to encrypt the first plaintext data of the stock data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table; a seventh writing module, configured to obtain plaintext data generated by the business system, encrypt the first plaintext data to obtain ciphertext data, write the ciphertext data and the second plaintext data into the second data table, perform a ciphertext-to-plaintext synchronization task to decrypt the ciphertext data in the second data table, and write the decrypted ciphertext data into the first data table; The eighth writing module is used to obtain the plaintext data generated by the business system, write the plaintext data into the first data table, perform the plaintext to ciphertext synchronization task to encrypt the first plaintext data in the first data table, and write the encrypted ciphertext data and the second plaintext data into the second data table.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the quantum-secure database data synchronization method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the quantum-secure database data synchronization method according to any one of claims 1 to 6 are implemented.

Images