Encryption and decryption method and device based on distributed graph database

Abstract

The invention relates to the technical field of data security of graph databases, in particular to an encryption and decryption method and device based on a distributed graph database, and the method comprises the steps: obtaining a data encryption key according to a data key derivation factor, and storing a key id corresponding to the data encryption key in a page head of a page; symmetrically encrypting page data in the graph database through the data encryption key, and storing the encrypted ciphertext; when decryption is needed, the storage node reads the secret key id stored in the page head of the page to be decrypted; acquiring a data encryption key according to the read key id, and performing symmetric decryption on the encrypted page data by using the acquired data encryption key so as to restore the original page data; according to the method, the page in the graph database is taken as a basic encryption unit, the cost of brute force cracking of the graph database is increased by the characteristics of the data key derivation factor and the characteristics of the data encryption key, and the risk of brute force cracking of the graph database is reduced.

Description

Technical Field

[0001] The present invention relates to the field of data security technology of graph databases, and in particular to an encryption and decryption method and device based on a distributed graph database. Background Art

[0002] Graph database is a type of non-relational database, which mainly uses graph theory to store the relationship information between entities. The graph model used by distributed graph database is attribute graph, that is, vertices with the same attribute belong to the same label table, and edges with the same attribute belong to the same relationship table. The label table and relationship table must belong to the same graph, and a graph can have multiple labels and relationships. There can be multiple graphs in the system, and the data logic of each graph is isolated from each other.

[0003] Distributed graph data has many data dimensions (including graphs, shards, edges, labels, and minimum storage units). In current graph database engineering practices, multi-dimensional encryption is rarely achieved, mainly due to engineering issues. At the same time, graph databases are relatively new databases, so the risk of being cracked by brute force is also relatively high.

[0004] In view of this, overcoming the defects of the prior art is an urgent problem to be solved in the field of this technology. Summary of the invention

[0005] The technical problem to be solved by the present invention is how to improve the data security of a distributed graph database to reduce the risk of being cracked by brute force.

[0006] The present invention adopts the following technical solution:

[0007] In a first aspect, an encryption and decryption method based on a distributed graph database is provided, comprising:

[0008] The page in the graph database is used as the basic encryption unit. When encrypting a page, the data encryption key is obtained according to the data key derivation factor, and the key ID corresponding to the data encryption key is stored in the page header of the corresponding page;

[0009] Symmetrically encrypt the page data in the graph database using the data encryption key, and store the encrypted ciphertext;

[0010] When the encrypted page data needs to be decrypted, the storage node reads the secret key ID stored in the page header of the page to be decrypted;

[0011] The corresponding data encryption key is obtained according to the read key ID, and the encrypted page data is symmetrically decrypted using the obtained data encryption key to restore the original page data.

[0012] Preferably, the step of obtaining a data encryption key according to a data key derivation factor and storing a key ID corresponding to the data encryption key in a header of a corresponding page includes:

[0013] Get the data key derivation factor;

[0014] Query the key cache and match it with the data key derivation factor, and if there is a match, obtain the corresponding data encryption key;

[0015] If there is no match, a request is sent to the metadata management node. The metadata management node searches or generates a data encryption key based on the data key derivation factor, and returns the obtained data encryption key to the storage node through an encrypted channel. After receiving the data encryption key, the storage node stores it in the key cache.

[0016] Extract the key ID of the data encryption key and store it in the header of the corresponding page in plain text according to the header format specification.

[0017] Preferably, when encrypting the adjacency index data in the graph database, the method further includes:

[0018] When new adjacency information of a node appears, the adjacency information of the corresponding node is judged. If the total amount of the newly added adjacency information is less than one page, no encryption operation is performed, and the adjacency information is stored according to the conventional data storage process;

[0019] When the adjacency information of the corresponding node is accumulated and stored in a full page, the data encryption key is obtained through the data key derivation factor, and the key ID corresponding to the data encryption key is stored in the page header of the corresponding page;

[0020] The entire page is symmetrically encrypted once using the data encryption key, and the encrypted ciphertext is stored to complete the encryption of the adjacency index data.

[0021] Preferably, when decrypting the adjacency index data in the graph database, the method further includes:

[0022] When it is necessary to obtain the adjacency information of the corresponding node, a query operation is initiated to query the adjacency information of the corresponding node;

[0023] Determine the relevant index or storage location mapping relationship according to the requirements of the adjacency information of the corresponding node queried, determine the location of the page where the adjacency index data to be read is located according to the relevant index or storage location mapping relationship, and read the entire page;

[0024] The key ID is extracted from the page header of the read page, the corresponding data encryption key is obtained according to the read key ID, and the encrypted adjacency index data is symmetrically decrypted using the obtained data encryption key to restore the original adjacency index data.

[0025] Preferably, the step of obtaining the data encryption key according to the data key derivation factor further comprises:

[0026] Obtaining a root key and an authority key derived factor, and obtaining an authority key through the root key and the authority key derived factor;

[0027] A data encryption key is obtained according to the authority key and a data key derivation factor.

[0028] Preferably, the encryption and decryption method based on the distributed graph database further includes: initializing and loading the authority key during the database startup phase;

[0029] The initialization of the authority key includes:

[0030] Generate an RSA (Rivest-Shamir-Adleman) public-private key pair as the root key, enter the service password, symmetrically encrypt the root key with the service password, and store the root key ciphertext;

[0031] Obtaining an authority key derived factor, obtaining an authority key through the root key and the authority key derived factor, and symmetrically encrypting the authority key through the root key to obtain an authority key ciphertext;

[0032] The loading of the authority key includes:

[0033] Enter the service password, use the service password to symmetrically decrypt the root key ciphertext, and verify the MD5 (Message-Digest Algorithm 5) value of the decrypted root key to obtain the root key plaintext;

[0034] The authority key ciphertext is decrypted by the root key plaintext to obtain the authority key plaintext, and the authority key plaintext is verified by MD5 to obtain the authority key.

[0035] Preferably, obtaining the data encryption key according to the authority key and the data key derivation factor includes:

[0036] The authority key and the data key derived factor are concatenated to obtain a concatenation result, and then the concatenation result is processed by a mathematical function to obtain a unique data encryption key corresponding to the data key derived factor.

[0037] Preferably, the encryption and decryption method based on a distributed graph database also includes: obtaining the data key derivation factor according to the database name, user attributes, data type and real-time rotation factor; obtaining the authority key derivation factor according to the user identity, role information and department to which he belongs.

[0038] In a second aspect, an encryption and decryption device based on a distributed graph database is provided, wherein the encryption and decryption device based on a distributed graph database comprises: a processor and a memory for storing processor executable instructions;

[0039] Among them, the processor is configured to execute the encryption and decryption method based on the distributed graph database described in the first aspect.

[0040] In a third aspect, a non-volatile computer storage medium is provided, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the encryption and decryption method based on the distributed graph database described in the first aspect.

[0041] In a fourth aspect, a chip is provided, comprising: a processor and an interface, for calling and running a computer program stored in the memory from a memory, and executing the encryption and decryption method based on a distributed graph database as described in the first aspect.

[0042] In a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed on a computer or a processor, the computer or the processor executes the encryption and decryption method based on a distributed graph database as described in the first to fourth aspects and any one of them.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] The present invention uses the page in the graph database as the basic encryption unit. The storage node obtains the data encryption key based on the data key derivation factor. The characteristics of the data key derivation factor and the data encryption key can greatly increase the cost of brute force cracking of the graph database, thereby reducing the risk of brute force cracking and improving the data security of the distributed graph database. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1It is a flowchart of an encryption and decryption method based on a distributed graph database provided by an embodiment of the present invention;

[0047] Figure 2 It is a data structure for storing graph data, adjacency index data and WAL data in a minimum storage unit provided by an embodiment of the present invention;

[0048] Figure 3 It is a schematic diagram of a process for obtaining a data encryption key provided by an embodiment of the present invention;

[0049] Figure 4 It is a schematic diagram of a process for encrypting adjacency index data in a graph database provided by an embodiment of the present invention;

[0050] Figure 5 It is a schematic diagram of a process for decrypting adjacency index data in a graph database provided by an embodiment of the present invention;

[0051] Figure 6 It is a schematic diagram of a data encryption key management process provided by an embodiment of the present invention;

[0052] Figure 7 It is a schematic diagram of a startup process of a multi-level key management system provided by an embodiment of the present invention;

[0053] Figure 8 It is a schematic diagram of a data encryption key generation process provided by an embodiment of the present invention;

[0054] Fig. 9 It is a schematic diagram of a process for generating an authority key provided by an embodiment of the present invention;

[0055] Fig.10 It is a data structure diagram of a root key ciphertext storage provided by an embodiment of the present invention;

[0056] Fig.11 It is a flowchart of a data encryption key initialization operation and a data encryption key loading operation provided by an embodiment of the present invention;

[0057] Fig.12 It is a data structure diagram of a data encryption key ciphertext storage provided by an embodiment of the present invention;

[0058] Fig.13 It is a structural diagram of an encryption and decryption device based on a distributed graph database provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0060] Unless the context requires otherwise, throughout the specification and claims, the term "including" is to be interpreted as open inclusion, that is, "including, but not limited to". In the description of the specification, the terms "one embodiment", "some embodiments", "exemplary embodiments", "examples", "specific examples" or "some examples" and the like are intended to indicate that specific features, structures, materials or characteristics associated with the embodiment or example are included in at least one embodiment or example of the present disclosure. The schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, the specific features, structures, materials or characteristics may be included in any one or more embodiments or examples in any appropriate manner, that is, although they may be carried in the embodiments or examples of the above terms due to reasons such as the order and position of appearance, it is not limited to that they can be carried in combination by one embodiment or example.

[0061] In the description of the present invention, the terms "first" and "second" are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "multiple" is two or more. In addition, for example, the same type of nouns may be described as two independent individuals by adding "A" and "B" at the end. In this case, the corresponding features defined as "A" and "B" are only used to distinguish the same type of individuals for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features.

[0062] When describing some embodiments, the expressions "coupling", "coupling" and "connection" and their derivatives may be used. For example, when describing some embodiments, the term "connection" may be used to indicate that two or more components are in direct physical or electrical contact with each other. For another example, when describing some embodiments, the term "coupling" may be used to indicate that two or more components are in direct physical or electrical contact. However, the terms "connection" or "coupling" may also refer to two or more components that are not in direct contact with each other, but still cooperate or interact with each other, such as "optical path coupling", "wireless connection", etc. The embodiments disclosed herein are not necessarily limited to the contents of the present invention.

[0063] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0064] Embodiment 1:

[0065] In order to reduce the risk of brute force cracking of distributed graph database data and ensure the data security of the graph database, an embodiment of the present invention provides an encryption and decryption method based on a distributed graph database, such as Figure 1 As shown, including:

[0066] Step 101: Taking the page in the graph database as the basic encryption unit, when encrypting the page, the data encryption key is obtained according to the data key derivation factor, and the key ID corresponding to the data encryption key is stored in the page header of the corresponding page.

[0067] Among them, Figure 2 The figure shows the data structure of the smallest storage unit of page data in the graph database. The storage unit is page, which is the basic organizational form of graph database data storage. Using it as the basic encryption unit helps the system to be uniformly managed and operated.

[0068] Step 102: The page data in the graph database is symmetrically encrypted using the data encryption key, and the encrypted ciphertext is stored.

[0069] Among them, page data includes graph data and write-ahead logging (WAL) data. Graph data is the core content of graph databases. In graph databases, data is organized and stored in the form of graphs. Graphs are composed of nodes and edges. Nodes can represent various entities. For example, in social networks, nodes can be users; in knowledge graphs, nodes can be concepts, entities (such as people, places, events, etc.). Edges are used to describe the relationship between nodes. For example, in social networks, edges can represent friendships and relatives between users; in knowledge graphs, edges may represent semantic relationships between entities, such as "belongs to", "located in", "invented", etc. Taking a social network graph as an example, suppose there is a social platform where users A, B, and C are nodes. If user A and user B are friends, and user B and user C are colleagues, then there will be two edges, one connecting A and B, marked as a "friend" relationship, and the other connecting B and C, marked as a "colleague" relationship. The information of nodes and edges, including the attributes of nodes (such as user A's name and age) and the attributes of edges (such as the time when the friend relationship was established), together constitute the graph data.

[0070] WAL data is log data in the database system. In a graph database, WAL data records the details of all write operations to the database (such as insert, update, delete, etc.), and these records are written to the log before the actual data modification operation. The main purpose is for database fault recovery and data consistency maintenance. Suppose a new user node D and its relationship with other nodes are inserted into the graph database. During this operation, the WAL data will first record the details of the insertion operation, including the inserted node information, relationship information, etc. If the database system suddenly crashes after the insertion operation is completed, then when the database is restarted, the records in the WAL data can be read and the write operation can be re-executed to restore to the state before the crash and ensure data consistency.

[0071] After obtaining the data encryption key, the storage node will use the data encryption key to symmetrically encrypt the page data in the graph database. Symmetric encryption means that the same key is used for encryption and decryption. The data encryption key obtained through the previous steps is used to encrypt all data in the page according to the established symmetric encryption algorithm, and the original plaintext page data is converted into ciphertext. After completing the symmetric encryption of the page data, the storage node will store the encrypted ciphertext according to the storage rules of the graph database. The ciphertext is usually stored in a specific location on the corresponding storage medium (such as a disk, etc.) so that it can be read again and decrypted and other related operations can be performed when needed. During the storage process, the integrity and accuracy of the ciphertext data storage must be ensured, and the security of the storage medium must also be considered to prevent the ciphertext data from being tampered with or lost.

[0072] Step 103: When the encrypted page data needs to be decrypted, the storage node reads the key ID stored in the page header of the page to be decrypted.

[0073] The page to be decrypted contains page data. When there is a need to decrypt the encrypted page data, the corresponding page to be decrypted must first be accurately found in the storage medium of the distributed graph database. The specific location of the page to be decrypted is determined based on the user's query request, data index information, or other related positioning mechanisms. After determining the location of the page to be decrypted, the storage node reads the data of the page from the storage medium. Since the key ID of the data encryption key has been stored in the page header during encryption, the storage node will read the stored key ID from the page header according to the pre-set page data reading rules and format.

[0074] Step 104: Obtain the corresponding data encryption key according to the read key ID, and use the obtained data encryption key to symmetrically decrypt the encrypted page data to restore the original page data.

[0075] According to the key ID read in step 103, the storage node will obtain the corresponding data encryption key. The storage node will interact with the key management system or key cache, and find and obtain the complete data encryption key that matches the key ID. After obtaining the data encryption key, the storage node will use the data encryption key to perform a symmetric decryption operation on the encrypted page data according to the same symmetric decryption algorithm as when it was encrypted. By performing corresponding operations on the ciphertext data and the data encryption key, the ciphertext is restored to the original page data, thereby satisfying the user's need to obtain the original data.

[0076] In summary, this embodiment implements encryption and decryption operations on distributed graph database data using page as the basic encryption unit. This method helps to improve data security, reduce the risk of data being cracked by brute force, and ensure the data security of the graph database.

[0077] In one embodiment, Figure 3 As shown, the step 101 specifically includes:

[0078] Step 1011: Obtain data key derivation factor.

[0079] In one embodiment, the data key derivation factor is obtained according to the graph database name, user attributes, data type and real-time rotation factor.

[0080] When encrypting a page, the storage node obtains the data encryption key based on the data key derivation factor. The data key derivation factor usually contains a variety of data-related information, such as database name, user attributes, and data type. The data key derivation factor is the key basis for generating the data encryption key. It integrates multiple information, such as database name, user attributes (such as user ID, role, organization, etc.), data type (distinguishing between graph data, WAL data, and adjacency index data in graph data), and real-time rotation factor. For example, the database name can be used as a basic identifier, combined with the user's role information. Users of different roles may generate different key parts based on the same database name. In addition, the real-time rotation factor (based on the timestamp or the random change sequence within the system) makes the obtained data encryption key change at different times or in different operation scenarios, which increases the security and cracking difficulty of the data encryption key.

[0081] Step 1012: query the key cache and match it with the data key derivation factor, and if there is a match, obtain the corresponding data encryption key.

[0082] In one embodiment, if the data encryption key for the same requirement has been obtained and cached before, it can be directly obtained from the key cache, so as to improve the efficiency of obtaining the data encryption key, specifically including: when the storage node needs the data encryption key, it will first search the key cache to see if there is a data encryption key that matches the current data key derivation factor. If the corresponding data encryption key is found in the key cache, it can be used directly without the need for a complicated interaction process with the metadata management node, thereby greatly saving the time overhead of key acquisition. However, if a suitable key is not found in the key cache, the storage node will obtain the data encryption key according to the process of interacting with the metadata management node in step 1013 below, and after successful acquisition, the obtained data encryption key will be stored in the key cache so that it can be quickly obtained when the same or similar requirements are met in the future.

[0083] Step 1013: If there is no match, a request is sent to the metadata management node. The metadata management node searches for or generates a data encryption key based on the data key derivation factor, and returns the obtained data encryption key to the storage node through an encrypted channel. After receiving the data encryption key, the storage node stores it in the key cache.

[0084] In one embodiment, the metadata management node usually centrally manages various types of key resources, specifically including: after the storage node passes the data key derivation factor to the metadata management node, the metadata management node processes it according to its internal complex key management logic. Based on the received data key derivation factor, a pre-set key generation algorithm is used or a matching key is searched in the stored key library. If a new data encryption key needs to be generated, various factors will be combined to calculate and generate it; if an existing data encryption key needs to be found, the corresponding data encryption key will be located in the key library based on key information such as the database name, user attributes and data type. The metadata management node then securely returns the found or generated data encryption key to the storage node.

[0085] Step 1014: extract the key ID of the data encryption key, and store it in plain text in the header of the corresponding page according to the header format specification.

[0086] After obtaining the data encryption key, the storage node will store the key id corresponding to the obtained data encryption key in the header of the corresponding page. The page header is an area for storing metadata information related to the page. Storing the key id here facilitates the subsequent rapid location and acquisition of the corresponding data encryption key during decryption. In one embodiment, it should be noted that the page header is stored in plain text and cannot be encrypted. This is because in the subsequent decryption process and some data management operations, it is necessary to be able to directly read the key id in the header to obtain the corresponding data encryption key for decryption and other operations. If the header is encrypted, it may not be possible to successfully obtain the information required for decryption.

[0087] In one embodiment, adjacency index data is a data structure used to improve the query efficiency of a graph database. Similar to the catalog of a book, by extracting and organizing certain key information in the graph data, the database system can locate and access the required data more quickly. In a graph database, indexes can be constructed based on node attributes, edge attributes, or the relationship between nodes and edges. Taking a social network as an example, if you often need to query users in a certain city, you can build an index based on the attributes of the city where the user is located. This index may be a data structure similar to a hash table or a tree, where the key (Key) is the city name and the value (Value) is a pointer to the storage location of all user nodes in the city in the graph data. In this way, when querying "users in Beijing", the database can quickly locate the location of the relevant user node through the index without traversing the entire graph data.

[0088] According to the characteristics of the above-mentioned adjacency index data, it can be obtained that the encryption and decryption operations of the adjacency index data in the graph database are very frequent, which has a great impact on the performance of the system's central processing unit (CPU) and IO (In / Out) performance. In order to ensure the stability of the IO performance and CPU performance of the distributed graph database, in one embodiment, Figure 4 As shown, when the adjacency index data in the graph database is encrypted, the method further includes:

[0089] Step 201: When new adjacency information of a node appears, the adjacency information of the corresponding node is judged. If the total amount of the newly added adjacency information is less than one page, no encryption operation is performed, and the adjacency information is stored according to the conventional data storage process.

[0090] Among them, adjacency index data is a data structure used to store and organize adjacency information. Adjacency information is the specific content about the connection relationship between nodes in the graph, and adjacency index data organizes and indexes adjacency information so that it can be queried and used more efficiently. For example, in a social network graph database, adjacency information may include specific relationship content such as user A and user B are friends, user A and user C are relatives, etc. Adjacency index data stores adjacency information in the database according to certain rules (such as node ID sorting) and establishes an index so that when all adjacency relationships of user A need to be queried, relevant information can be quickly located.

[0091] In a graph database, page is the basic unit of data storage and has a specific capacity. When new adjacency information appears on a node, the system calculates the total amount of the new information. For example, in a social network graph database, nodes represent users, and adjacency information represents connection information such as friend relationships between users. If a user continues to add new friends, each addition of a friend will generate some related adjacency information (such as the friend's ID, addition time, etc.), and the adjacency information will be accumulated and calculated. If the total amount of new adjacency information is less than the capacity of a page, it means that encryption operations at this time may waste system resources, because encryption and decryption operations themselves consume computing resources. Therefore, in this case, the system chooses not to perform encryption operations, but to store the adjacency information directly in the corresponding page according to the conventional data storage process. This can avoid unnecessary encryption overhead and improve the overall performance of the system.

[0092] Traditional methods may perform frequent encryption regardless of the amount of data. For example, some early database encryption schemes encrypt every small change in each data record, which will result in a large number of encryption operations. This embodiment determines whether to encrypt by judging whether the adjacency information is full of pages, which greatly reduces the number of encryption operations. In large-scale graph database applications, such as social networking platforms with a large number of users and complex interpersonal networks, if traditional frequent encryption methods are used, the system's CPU and IO resources will be consumed in large quantities during the encryption and decryption process, resulting in a slow system response or even freezing. The step 201 can effectively avoid this situation, making the system more efficient when processing adjacency index data.

[0093] Step 202: When the adjacency information of the corresponding node is accumulated and stored in a full page, the data encryption key is obtained through the data key derivation factor, and the key ID corresponding to the data encryption key is stored in the page header of the corresponding page.

[0094] When the adjacency information of the corresponding node is accumulated and stored in a page, the page needs to be encrypted, and the system obtains the data encryption key through the data key derivation factor. The data key derivation factor contains multiple elements, such as database name, user attributes, data type (here explicitly adjacency index data), and possible real-time rotation factors. The specific implementation process is similar to step 101, which can be simply derived and will not be explained in detail here.

[0095] Step 203: The entire page is symmetrically encrypted once using the data encryption key, and the encrypted ciphertext is stored to complete the encryption of the adjacency index data.

[0096] The entire page is symmetrically encrypted using the data encryption key obtained in step 202. For example, the common AES (Advanced Encryption Standard) symmetric encryption algorithm is used to encrypt all adjacent index data in the page as a whole, and the original plaintext data is converted into ciphertext data.

[0097] After encryption is completed, the encrypted ciphertext is stored in the corresponding storage medium (such as a disk array, etc.) according to the storage rules of the graph database. During the storage process, the integrity and accuracy of the ciphertext data must be ensured, and the security of the storage medium must be considered.

[0098] In one embodiment, Figure 5 As shown, when decrypting the adjacency index data in the graph database, the method further includes:

[0099] Step 301: When it is necessary to obtain the adjacency information of the corresponding node, a query operation is initiated to query the adjacency information of the corresponding node.

[0100] When you need to gain a deeper understanding of the connection relationship of a node in the graph database, that is, to obtain the adjacency information of the corresponding node, you first initiate a query operation. For example, in a social network graph database, if you want to know all of user A's friends (i.e., adjacent points) and the specific relationship between them and other adjacent information, you need to initiate an operation to query the adjacency information of the node of user A. The query operation is initiated by the user through the query interface provided by the database. For example, in the background of a social network application, when a user views his or her friend list page, the application will automatically initiate a query operation for the adjacency information of the currently logged-in user node in the background, so that the user's friend list and related information can be accurately displayed.

[0101] Step 302: Determine the relevant index or storage location mapping relationship according to the requirements of the adjacency information of the corresponding node queried, determine the location of the page where the adjacency index data to be read is located according to the relevant index or storage location mapping relationship, and read the entire page.

[0102] Among them, in order to be able to quickly and accurately find the required data, the graph database will establish a series of indexes and storage location mapping relationships. After initiating an operation to query the adjacency information of the corresponding node, according to the query requirements, the system will determine the location of the page where the adjacency index data to be read is located based on the pre-established index (such as an index based on node identification, an index based on relationship type, etc.) and the storage location mapping relationship (recording information such as the approximate storage area where different types of data are located). For example, in an enterprise organizational chart database, if you want to query the adjacency information of a department head node, the system will first quickly locate the approximate storage area of ​​the department head node related data through an index based on node identification, and then determine the specific page location containing its adjacency information to be read based on a more detailed storage location mapping relationship.

[0103] In one embodiment, after determining the location of the page where the adjacent index data to be read is located, the system will read the data of the entire page from a storage medium (such as a disk, etc.). Because the encryption operation is performed on the entire page during the encryption of the adjacent index data, the entire page also needs to be read during decryption for subsequent decryption processing. During the reading process, the accuracy and completeness of the reading operation must be ensured to avoid incomplete or erroneous reading of page data due to hardware failure, software error, etc., thereby affecting subsequent decryption work.

[0104] Step 303: extract the key ID from the page header of the read page, obtain the corresponding data encryption key according to the read key ID, and use the obtained data encryption key to symmetrically decrypt the encrypted adjacency index data to restore the original adjacency index data.

[0105] After the data of the page is successfully read, the key ID is extracted from the header of the page. Because when the adjacency index data is encrypted before, the unique identifier (key ID) of the key used to encrypt the page data is stored in the header of the page. According to the format and layout of the page data, the key ID is extracted from the header. According to the extracted key ID, the system will obtain the corresponding data encryption key. Usually, it interacts with the key management system or key cache, and finds and obtains the matching complete data encryption key according to the key ID. After obtaining the data encryption key, the encrypted adjacency index data is symmetric decrypted using the data encryption key. Because the same key is used for encryption and decryption (i.e., symmetric encryption), the encrypted adjacency index data is processed with the obtained data encryption key according to the corresponding symmetric decryption algorithm (the same as the algorithm used for encryption), so as to restore the ciphertext to the original adjacency index data. In this way, the adjacency information of the queried node can be accurately obtained, which meets the purpose of initiating the query operation in the first place.

[0106] In summary, the adjacency list in the adjacency index data is encrypted as a data block and then decrypted, which reduces the number of encryption and decryption operations, improves the efficiency of encryption and decryption, and improves the performance and stability of CPU and IO in the graph database. At the same time, all types of data stored in the graph database (including graph data, adjacency index data, and WAL data) are encrypted to ensure the security of all-round data stored in the distributed graph database.

[0107] In one embodiment, Figure 6 As shown, the data encryption key management process includes:

[0108] Step 401: Start the distributed graph database, metadata management node and key management system.

[0109] Among them, starting a distributed graph database involves initializing its core components, such as the database engine, storage management module, network communication module, etc. The database engine is responsible for processing data storage, query, update and other operations; the storage management module manages the distribution and storage of data on each storage node; the network communication module ensures effective data transmission and communication between different nodes.

[0110] The metadata management node is responsible for managing and maintaining the metadata information of the entire database in the distributed graph database. When the metadata management node is started, its own configuration file will be loaded, which contains the node's identification, connection parameters with other nodes, storage location and other setting information. At the same time, related system services will be initialized, such as network services for communicating with other nodes, storage services for managing metadata storage, etc., to ensure that the metadata management node can operate normally and interact with other components in the distributed graph database.

[0111] The key management system is an important part of ensuring data security and is responsible for managing data encryption keys. When the key management system is started, a series of initialization operations will be performed, such as loading previously stored key-related information (if any), including key identification, generation algorithm, storage location, etc. At the same time, the access rights of the key management system itself will be set according to the pre-set security policy to ensure that only authorized users or system components can access and operate the key resources in the key management system.

[0112] Step 402: Start the storage node and synchronize the data encryption key managed in the metadata management node, synchronize the data encryption key, and ensure that the data encryption key is not stored on the disk.

[0113] The storage node is mainly responsible for storing the actual data in the distributed graph database. When it starts, it loads its own configuration file, which contains the relevant settings of the storage node, such as storage path, node identification, connection parameters with other nodes, etc. At the same time, it will initialize its own storage service, network service and other system services to ensure that it can normally receive and store data and communicate with other nodes.

[0114] After the storage node is started, it will immediately interact with the metadata management node to synchronize the data encryption keys managed in the metadata management node. The synchronization process is carried out through a secure communication channel to ensure that the data encryption keys are not stolen or tampered with during transmission. The synchronization operation will be performed according to certain rules and formats, such as accurate matching and transmission based on the key's identification, type and other information to ensure that the storage node obtains the correct data encryption key. Although the data encryption key is synchronized, the data encryption key cannot be temporarily stored on the disk in the storage node (that is, it cannot be directly stored on a storage medium such as a hard disk). In order to prevent the data encryption key from being lost or damaged due to storage medium failure or other unexpected circumstances when the storage node is not fully ready. The synchronized data encryption key is usually temporarily stored in a specific area in the memory, awaiting further processing and operation.

[0115] Step 403: After the distributed graph database is successfully started, a request for adding a new data encryption key is initiated to the metadata management node. After the new request is successful, the data encryption key is synchronized to the storage node. The storage node obtains the latest data encryption key and performs encryption and decryption services.

[0116] After the distributed graph database is successfully started, when a new data encryption key is needed due to business needs (such as a certain type of data that requires a special encryption key for encryption), the relevant system components or users will initiate a request to the metadata management node to add a new data encryption key. The request will contain some necessary information, such as the purpose of the new key, the factors based on which it is generated (such as a specific data type, user attributes, etc.), so that the metadata management node can accurately generate a suitable data encryption key based on this information.

[0117] After receiving a request to add a new data encryption key, the metadata management node will process it according to its own key generation and management logic. If the addition is successful, a new data encryption key will be generated, and its related information (such as key identification, generation algorithm, instructions for use, etc.) will be stored in its own key management system. At the same time, the newly generated data encryption key will be immediately synchronized to the storage node. During the synchronization process, a secure communication channel will also be used to ensure that the key data is not stolen or tampered with during the transmission from the metadata management node to the storage node, and it will be transmitted according to certain rules and formats to ensure that the storage node can accurately receive and use the newly generated data encryption key.

[0118] The storage node will continue to pay attention to the key update of the metadata management node. When a new data encryption key is synchronized, the storage node will obtain the latest key data in a timely manner. During the acquisition process, the key data will be checked for integrity, for example, by calculating the checksum or hash value of the data and comparing it with the corresponding value sent by the metadata management node to ensure that the acquired key data is complete. Once the storage node obtains the latest data encryption key, it can use the obtained data encryption key to perform encryption and decryption services. For the specific encryption and decryption process, please refer to the above embodiment and will not be repeated here.

[0119] In order to ensure the fine-grained permission control and key security of the distributed graph database, a multi-level key management system technology is used in the distributed database. In one embodiment, Figure 7As shown, data encryption keys are managed through a multi-level key management system, and the startup process of the multi-level key management system includes: determining whether encryption has been started in the graph database, and if encryption has been started, initializing the service password or entering the service password; if it is the first startup or reinitialization of the service password, initializing the service password; after the service password is initialized, performing multi-level permission key initialization operations and data encryption key initialization operations to complete the key management system startup process; if the service password has been set, entering the service password, and verifying after entering the service password, if the verification fails, the process ends; if the verification is successful, performing multi-level permission key loading operations and data encryption key loading operations to complete the key management system startup process.

[0120] In one embodiment, it can be determined whether the graph database has started encryption by checking the relevant configuration files, system parameters or specific operation status flags of the database. If it is determined that the graph database has started encryption, the service password initialization operation or service password input operation is required next.

[0121] The initialization of the service password operation includes: when the multi-level key management system is started for the first time and the service password has not been set before, the service password needs to be initialized. The system administrator or personnel with corresponding permissions generates the service password according to the pre-set password strength requirements. The input service password operation includes: if the service password has been set before, but the graph database is not currently encrypted, you need to enter the correct service password.

[0122] In one embodiment, Figure 8 As shown, the specific process of obtaining the data encryption key includes:

[0123] Step 501: Obtain a root key and an authority key derived factor, and obtain an authority key through the root key and the authority key derived factor.

[0124] The authority key derivation factor may be obtained according to the user identity, role information and department to which the user belongs.

[0125] In one embodiment, during the database startup phase, the authority key is initialized and loaded; Fig. 9 As shown, the initialization of the authority key includes steps 5011 and 5012; the loading of the authority key includes steps 5013 and 5014.

[0126] Step 5011: Generate an RSA public-private key pair as the root key, enter the service password, symmetrically encrypt the root key using the service password, and store the root key ciphertext.

[0127] Among them, RSA is a common asymmetric encryption algorithm. In the process of generating the RSA public-private key pair, the public key and private key are calculated according to a specific mathematical formula by selecting a suitable large prime number and other operations. In one embodiment, the generated RSA private key is selected as the root key (the public key may also be selected as the root key in some special designs, depending on the system requirements).

[0128] After entering the service password, a symmetric encryption algorithm (such as the common AES algorithm, etc.) is used to encrypt the root key. The characteristic of symmetric encryption is that the same key is used for encryption and decryption. Here, the input service password is used as the same key to convert the root key into ciphertext form. In this way, even if the root key storage medium is illegally obtained, the plaintext content of the root key cannot be restored without the correct service password, thereby greatly improving the security of the root key. After completing the symmetric encryption operation on the root key, the generated root key ciphertext is stored in the corresponding storage location. In one embodiment, the data structure for storing the root key ciphertext is as follows: Fig.10 shown.

[0129] Step 5012: Obtain an authority key derivative factor, obtain an authority key through the root key and the authority key derivative factor, and symmetrically encrypt the authority key through the root key to obtain an authority key ciphertext.

[0130] Among them, the authority key derivation factors usually include various attribute information related to the user, such as the user's identity (such as user name, user ID), role information (such as administrator, ordinary user, read-only user, etc.), department, etc. The above information is an important basis for generating authority keys. By combining the attributes of different users, authority keys that match the authority of each user can be generated, thereby realizing refined authority management.

[0131] In combination with the root key generated and encrypted and stored in step 501 and the obtained authority key derivative factor, an authority key is generated through a specific key generation algorithm. The generation process may involve a variety of mathematical operations. For example, the root key and the authority key derivative factor may be concatenated in some form, and then the concatenated result may be hashed or processed by other specific functions to finally obtain the authority key corresponding to different user permissions. The authority key generated in this way can accurately reflect the user's authority status in the system, so that access to data can be controlled according to user permissions in the future.

[0132] After the permission key is generated, the root key is used again to encrypt the newly generated permission key using a symmetric encryption algorithm (such as AES). Since the root key is in a basic and trusted position in the entire key system, using it as an encryption key to encrypt the permission key can ensure the security of the permission key during storage and transmission. After encrypting the permission key into ciphertext form, the permission key ciphertext is stored in a secure storage location. At this point, the multi-level permission key initialization operation is completed, and a multi-level permission key system based on the root key and permission key derivative factors is successfully constructed, providing strong support for subsequent permission management and data access control.

[0133] Step 5013: Enter the service password, symmetrically decrypt the root key ciphertext using the service password, and verify the MD5 value of the decrypted root key to obtain the root key plaintext.

[0134] When loading a multi-level permission key, you must first enter the service password. Use the entered service password as the symmetric decryption key to perform a symmetric decryption operation on the previously stored root key ciphertext. For example, if the root key ciphertext was previously encrypted using the AES algorithm, then use the AES algorithm here as well, using the service password as the decryption key, to restore the root key ciphertext to plaintext.

[0135] After decrypting the root key plaintext, in order to ensure that the root key has not been tampered with during storage and transmission, it is necessary to calculate the MD5 value of the decrypted root key and verify it with the pre-stored root key MD5 value. MD5 is a hash function that obtains a fixed-length summary by performing specific mathematical operations on data. If the calculated MD5 value is the same as the stored MD5 value, it means that the root key is complete and has not been tampered with. In this way, the root key plaintext obtained is reliable and can be used for subsequent operations.

[0136] The verified root key plaintext will be saved in memory. It should be noted that the root key plaintext is generally not stored on disk (i.e., it cannot be directly stored on a storage medium such as a hard disk). This is to prevent the root key plaintext from being accidentally leaked or maliciously obtained. Because once the root key plaintext is stored on the disk, if the disk is stolen or attacked, the root key will be leaked, thereby threatening the security of the entire system. In one embodiment, the data structure for storing the root key plaintext is as follows: Fig.10 shown.

[0137] Step 5014: Decrypt the authority key ciphertext using the root key plaintext to obtain the authority key plaintext, and perform MD5 verification on the authority key plaintext to obtain the authority key.

[0138] In the above steps, the root key ciphertext has been symmetrically decrypted by entering the service password, and the reliable root key plaintext has been verified and saved in the memory.

[0139] Since the permission key is symmetrically encrypted and stored in the permission key ciphertext through the root key during the multi-level permission key initialization operation, the permission key ciphertext can now be decrypted using the root key plaintext that has been obtained. Specifically, according to the symmetric encryption algorithm used in the previous encryption (such as the common symmetric encryption algorithms such as AES, the encryption and decryption processes follow the same algorithm rules), the root key plaintext is used as the decryption key to perform corresponding operations on the stored permission key ciphertext, thereby restoring the permission key ciphertext to the permission key plaintext form. In this way, the plaintext content of the permission key in the original encrypted state is successfully obtained. After obtaining the permission key plaintext, in order to ensure that the permission key has not been tampered with during storage and transmission, it is necessary to perform an MD5 check on it (the specific operation is not explained in detail here). If the calculated MD5 value is the same as the pre-stored MD5 value, it means that the permission key plaintext is complete and has not been tampered with during the entire storage and transmission process. It is reliable and can be safely used for subsequent operations. On the contrary, if the two are different, it means that the permission key plaintext may have a problem in a certain link, such as storage medium failure causing data corruption or malicious tampering during transmission. In this case, further troubleshooting is required and the permission key plaintext cannot be used directly for subsequent operations.

[0140] After the MD5 check is completed and the permission key plaintext is confirmed to be reliable, the permission key plaintext will be saved. At this point, the multi-level permission key loading operation is completed and the permission key is obtained. The system can now use the loaded permission key to perform subsequent data access control and permission management operations, such as determining whether different users have the permission to access, modify, and perform other operations on specific data based on the permission keys corresponding to them, thereby ensuring the data security of the distributed graph database and the legitimacy of access.

[0141] In one embodiment, it is worth noting that the service passwords in the initialization and loading phases are consistent, that is, when initializing the secret key system, a service password needs to be set (the service passwords set for the two data verifications are consistent). When the database is restarted, the service password needs to be entered. Only after the service password verification is successful can the database be entered, the secret key system is loaded, data decryption is completed, and then the entire database is loaded. When the database is in encryption mode, the service password must be entered first, otherwise the entire database cannot be started normally and provide services.

[0142] Step 502: Obtain a data encryption key according to the authority key and a data key derivation factor.

[0143] The authority key and the data key derived factor are concatenated to obtain a concatenation result, and then the concatenation result is processed by a mathematical function to obtain a unique data encryption key corresponding to the data key derived factor.

[0144] In one embodiment, Fig.11 As shown, the specific process of data encryption key initialization operation and data encryption key loading operation includes:

[0145] Step 601: Generate a data encryption key based on the corresponding authority key and data key derivation factor in the memory.

[0146] Among them, the corresponding permission key in the memory has been processed and stored in the memory in the previous multi-level permission key related operations. It is associated with the user's permission level, and users of different permission levels correspond to different permission keys. Data key derivation factors usually include a lot of information related to the characteristics of the data itself, such as database name, user attributes, data type (such as graph data, index data, etc.) and possible real-time rotation factors. The above factors combined can provide a basis for generating specific data encryption keys that meet data security requirements.

[0147] Through a specific key generation algorithm, the permission key and data key derivative factors in the memory are used as input parameters for operation. For example, the permission key and data key derivative factors may be concatenated in some form, and then the concatenated result is hashed or processed with other specific mathematical functions to finally obtain a unique data encryption key. The data encryption key generated in this way is related to the user's permissions (reflected by the permission key) and is closely integrated with the characteristics of the data itself (reflected by the data key derivative factors), which can better meet the needs of encrypting different data in a distributed graph database environment.

[0148] Step 602: Symmetrically encrypt the data encryption key using the authority key to obtain the data encryption key ciphertext, thereby completing the data encryption key initialization operation.

[0149] Among them, the data encryption key is symmetrically encrypted using the authority key, and the data encryption key is calculated according to the algorithm rules through a specific symmetric encryption algorithm (such as the common AES algorithm, etc.) to convert it into a data encryption key ciphertext form. After the above-mentioned symmetric encryption operation, the obtained data encryption key ciphertext completes the key part of the data encryption key initialization operation. At this point, the data encryption key ciphertext will be properly stored in a secure storage location (such as a hardware security module or a specific storage area that is encrypted and protected, etc.) so that it can be loaded and used later when needed. The design of this initialization operation makes the data encryption key in an encrypted protection state after the initial generation, which increases its security and prevents unauthorized acquisition and use. In one embodiment, the data structure for storing the data encryption key ciphertext is as follows: Fig.12 shown.

[0150] Step 603: Decrypt the data encryption key ciphertext using the corresponding authority key in the memory to obtain the data encryption key plaintext, and save the data encryption key plaintext in the memory to complete the data encryption key loading operation.

[0151] When loading the data encryption key, the corresponding permission key in the memory must first be used to decrypt the stored data encryption key ciphertext. Because the data encryption key is symmetrically encrypted with the permission key during the initialization operation, the permission key is used as the decryption key based on the principle of symmetric encryption. The data encryption key ciphertext is operated according to the same symmetric encryption algorithm (such as AES algorithm) as that used for encryption, thereby restoring the data encryption key ciphertext to the data encryption key plaintext.

[0152] After obtaining the plaintext of the data encryption key, save it in a specific area in the memory. It should be noted that the plaintext of the data encryption key should not be stored on disk (that is, not directly stored on storage media such as hard disks). This is to prevent the plaintext of the data encryption key from being leaked when there is a problem with the storage medium (such as being stolen, attacked, etc.), thereby threatening the data security of the entire distributed graph database. By storing the plaintext of the data encryption key in memory and setting up corresponding protection mechanisms (such as restricting access rights, etc.), the security of the data encryption key can be maximized while ensuring that it can be used in a timely manner. At this time, the system can use the loaded plaintext of the data encryption key to perform subsequent data encryption and decryption services, thereby ensuring the security of data in the distributed graph database during storage and transmission.

[0153] Embodiment 2:

[0154] In Example 1, an encryption and decryption method based on a distributed graph database is provided. In this embodiment, an encryption and decryption device based on a distributed graph database is proposed. The encryption and decryption device based on a distributed graph database includes: a processor and a memory for storing processor executable instructions; wherein, the processor is configured to execute the encryption and decryption method based on a distributed graph database described in Example 1.

[0155] like Fig.13 As shown, the encryption and decryption device based on the distributed graph database includes a processor 21 and a memory 22, wherein the processor 21 and the memory 22 can be connected via a bus or other means.

[0156] The processor 21 may be a central processing unit (CPU). The processor 21 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0157] The memory 22, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the encryption and decryption method based on the distributed graph database in Embodiment 1 of the present invention. The processor executes various functional applications and training processes of the processor by running the non-transitory software programs, instructions and modules stored in the memory.

[0158] The memory 22 may include a program storage area and a training storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the training storage area may store training created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 22 may optionally include a memory remotely located relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The one or more modules are stored in the memory 22, and when executed by the processor 21, execution such as Figure 1The encryption and decryption method based on the distributed graph database in the embodiment 1 is shown. The specific details of the encryption and decryption method based on the distributed graph database can be found in Figure 1 , Figure 2 and Figure 3 The corresponding descriptions and effects in the embodiments shown in the figure can be understood and will not be repeated here.

[0159] This embodiment also provides a computer storage medium, which stores a computer program. The computer program can be executed by a processor to complete the encryption and decryption method based on a distributed graph database described in Example 1.

[0160] The computer storage medium stores computer executable instructions, and the computer executable instructions can execute the encryption and decryption method based on the distributed graph database in any of the above method embodiments. Among them, the storage medium can be a disk, an optical disk, a read-only memory (Read-Only Memory, abbreviated as ROM), a random access memory (Random Access Memory, abbreviated as RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated as HDD) or a solid-state drive (Solid-State Drive, abbreviated as SSD), etc.; the storage medium can also include a combination of the above types of memory. The specific steps of the encryption and decryption method based on the distributed graph database are shown in Example 1, which will not be repeated in this embodiment.

[0161] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An encryption and decryption method based on a distributed graph database, characterized in that: include: The page in the graph database is used as the basic encryption unit. When encrypting a page, the data encryption key is obtained according to the data key derivation factor, and the key ID corresponding to the data encryption key is stored in the page header of the corresponding page; Symmetrically encrypt the page data in the graph database using the data encryption key, and store the encrypted ciphertext; When the encrypted page data needs to be decrypted, the storage node reads the secret key ID stored in the page header of the page to be decrypted; The corresponding data encryption key is obtained according to the read key ID, and the encrypted page data is symmetrically decrypted using the obtained data encryption key to restore the original page data.

2. The encryption and decryption method based on a distributed graph database according to claim 1 is characterized in that: The step of obtaining a data encryption key according to a data key derivation factor and storing a key ID corresponding to the data encryption key in a header of a corresponding page includes: Get the data key derivation factor; Query the key cache and match it with the data key derivation factor, and if there is a match, obtain the corresponding data encryption key; If there is no match, a request is sent to the metadata management node. The metadata management node searches or generates a data encryption key based on the data key derivation factor, and returns the obtained data encryption key to the storage node through an encrypted channel. After receiving the data encryption key, the storage node stores it in the key cache. Extract the key ID of the data encryption key and store it in the header of the corresponding page in plain text according to the header format specification.

3. The encryption and decryption method based on a distributed graph database according to claim 1 is characterized in that: When encrypting the adjacency index data in the graph database, the method further includes: When new adjacency information of a node appears, the adjacency information of the corresponding node is judged. If the total amount of the newly added adjacency information is less than one page, no encryption operation is performed, and the adjacency information is stored according to the conventional data storage process; When the adjacency information of the corresponding node is accumulated and stored in a full page, the data encryption key is obtained through the data key derivation factor, and the key ID corresponding to the data encryption key is stored in the page header of the corresponding page; The entire page is symmetrically encrypted once using the data encryption key, and the encrypted ciphertext is stored to complete the encryption of the adjacency index data.

4. The encryption and decryption method based on a distributed graph database according to claim 3 is characterized in that: When decrypting the adjacency index data in the graph database, the method further includes: When it is necessary to obtain the adjacency information of the corresponding node, a query operation is initiated to query the adjacency information of the corresponding node; Determine the relevant index or storage location mapping relationship according to the requirements of the adjacency information of the corresponding node queried, determine the location of the page where the adjacency index data to be read is located according to the relevant index or storage location mapping relationship, and read the entire page; The key ID is extracted from the page header of the read page, the corresponding data encryption key is obtained according to the read key ID, and the encrypted adjacency index data is symmetrically decrypted using the obtained data encryption key to restore the original adjacency index data.

5. The encryption and decryption method based on a distributed graph database according to claim 1 is characterized in that: The step of obtaining the data encryption key according to the data key derivation factor further includes: Obtaining a root key and an authority key derived factor, and obtaining an authority key through the root key and the authority key derived factor; A data encryption key is obtained according to the authority key and a data key derivation factor.

6. The encryption and decryption method based on a distributed graph database according to claim 5 is characterized in that: The encryption and decryption method based on the distributed graph database further includes: initializing and loading the authority key during the database startup phase; The initialization of the authority key includes: Generate an RSA public-private key pair as the root key, enter the service password, symmetrically encrypt the root key using the service password, and store the root key ciphertext; Obtaining an authority key derived factor, obtaining an authority key through the root key and the authority key derived factor, and symmetrically encrypting the authority key through the root key to obtain an authority key ciphertext; The loading of the authority key includes: Enter the service password, use the service password to symmetrically decrypt the root key ciphertext, and verify the MD5 value of the decrypted root key to obtain the root key plaintext; The authority key ciphertext is decrypted by the root key plaintext to obtain the authority key plaintext, and the authority key plaintext is verified by MD5 to obtain the authority key.

7. The encryption and decryption method based on a distributed graph database according to claim 5 is characterized in that: The obtaining of the data encryption key according to the authority key and the data key derivation factor comprises: The authority key and the data key derived factor are concatenated to obtain a concatenation result, and then the concatenation result is processed by a mathematical function to obtain a unique data encryption key corresponding to the data key derived factor.

8. The encryption and decryption method based on a distributed graph database according to claim 5 is characterized in that: The encryption and decryption method based on the distributed graph database also includes: The data key derivation factor is obtained according to the database name, user attributes, data type and real-time rotation factor; the authority key derivation factor is obtained according to the user identity, role information and department to which he belongs.

9. An encryption and decryption device based on a distributed graph database, characterized in that: The encryption and decryption device based on the distributed graph database includes: a processor and a memory for storing instructions executable by the processor; Wherein, the processor is configured to execute the encryption and decryption method based on a distributed graph database as described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the encryption and decryption method based on a distributed graph database as described in any one of claims 1-8.

Images