Database operation method and device, equipment and storage medium

Abstract

The invention relates to the technical field of databases, and discloses a database operation method and device, equipment and a storage medium, and the method comprises the following steps: obtaining a first statement intercepted by a filtering plug-in; the first statement is used for executing a target function; if it is detected that a table field in the first statement meets an encryption and decryption condition, analyzing the first statement to generate a target syntax tree; and adding an encryption and decryption function to a table field meeting encryption and decryption conditions in the target syntax tree to convert the table field into a second statement, and executing the second statement through the database. According to the scheme, on the premise that program codes do not need to be modified, the encryption and decryption functions of the database fields are achieved, and the workload of database encryption is reduced.

Description

Technical Field

[0001] The present invention relates to the field of database technology, and in particular to a database operation method, device, equipment and storage medium. Background Art

[0002] In order to protect highly sensitive information, it is necessary to encrypt the highly sensitive information in the database. The current conventional implementation method is to encrypt the database table fields, that is, to encrypt the data when storing it in the database and to decrypt it when retrieving it from the database, that is, to add encryption and decryption logic to all database operations.

[0003] However, after the project development corresponding to the database is completed and delivered online, if the program is modified according to the fields to be encrypted, there will be many modification points, resulting in a large workload. Summary of the invention

[0004] In view of this, the present invention provides a database operation method, device, equipment and storage medium to reduce the workload of database encryption.

[0005] In a first aspect, the present invention provides a database operation method, the method is used for a target database, the target database is loaded with a filtering plug-in, the method comprises:

[0006] Obtaining a first statement intercepted by the filtering plug-in; the first statement is used to execute a target function;

[0007] If it is detected that the table field in the first statement meets the encryption and decryption conditions, the first statement is parsed to generate a target syntax tree;

[0008] An encryption and decryption function is added to the table field that meets the encryption and decryption conditions in the target syntax tree to convert it into a second statement, so as to execute the second statement through the database.

[0009] In a possible implementation manner, the target function includes at least one of selection, deletion, writing, selection, and update.

[0010] In a possible implementation, before parsing the first statement into a target syntax tree, the method further includes:

[0011] Detecting whether there is a wildcard in the first statement;

[0012] If there is a wildcard in the first statement, the wildcard is replaced with the target field.

[0013] In a possible implementation, obtaining the first statement intercepted by the filtering plug-in includes:

[0014] If the first statement is a precompiled SQL statement in the first interface, before executing the first statement, intercepting the first statement by using a first interception method;

[0015] Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the first statement is intercepted by a second interception method before the first statement is executed.

[0016] In a possible implementation, the first interception method and the second interception method are obtained by overriding in a target subclass; the target subclass is a subclass of a parent class created by the filter plug-in in the data connection pool.

[0017] In a possible implementation, executing the second statement through the database includes:

[0018] If the first statement is a precompiled SQL statement in the first interface, the second statement is used to replace the SQL input parameter variable in the first interception method, and the method of the parent class in the filtering plug-in is called back to execute the second statement;

[0019] Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the second statement replaces the SQL input parameter variable in the second interception method, and calls back the method of the parent class in the filtering plug-in to execute the second statement.

[0020] In a possible implementation manner, before obtaining the first statement intercepted by the filtering plug-in, the method further includes:

[0021] Obtain a configuration file; the configuration file is set in a directory of an application corresponding to the target database.

[0022] Parse the configuration file to obtain the encryption and decryption conditions and the encryption and decryption functions.

[0023] In a second aspect, a database operation device is provided, the device comprising:

[0024] An acquisition module, used for acquiring a first statement intercepted by the filtering plug-in; the first statement is used for executing a target function;

[0025] A parsing module, configured to parse the first statement to generate a target syntax tree if it is detected that the table field in the first statement satisfies the encryption and decryption conditions;

[0026] The execution module is used to add an encryption and decryption function to the table field that meets the encryption and decryption conditions in the target syntax tree to convert it into a second statement, so as to execute the second statement through the database.

[0027] In a possible implementation manner, the target function includes at least one of selection, deletion, writing, selection, and update.

[0028] In a possible implementation, the parsing module is further used to detect whether there is a wildcard in the first statement;

[0029] If there is a wildcard in the first statement, the wildcard is replaced with the target field.

[0030] In a possible implementation, the parsing module is further configured to query the target database for a target field corresponding to the wildcard.

[0031] In a possible implementation, the acquisition module is further used to:

[0032] If the first statement is a precompiled SQL statement in the first interface, before executing the first statement, intercepting the first statement by using a first interception method;

[0033] Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the first statement is intercepted by a second interception method before the first statement is executed.

[0034] In a possible implementation, the first interception method and the second interception method are obtained by overriding in a target subclass; the target subclass is a subclass of a parent class created by the filter plug-in in the data connection pool.

[0035] In a possible implementation, the execution module is further configured to:

[0036] If the first statement is a precompiled SQL statement in the first interface, the second statement is used to replace the SQL input parameter variable in the first interception method, and the method of the parent class in the filtering plug-in is called back to execute the second statement;

[0037] Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the second statement replaces the SQL input parameter variable in the second interception method, and calls back the method of the parent class in the filtering plug-in to execute the second statement.

[0038] In a possible implementation, the acquisition module is further used to:

[0039] Obtaining a configuration file; wherein the configuration file is set in a directory of an application corresponding to the target database;

[0040] Parse the configuration file to obtain the encryption and decryption conditions and the encryption and decryption functions.

[0041] In a third aspect, a computer device is provided, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the above-mentioned database operation method by executing the computer instructions.

[0042] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the above-mentioned database operation method.

[0043] In a fifth aspect, a computer program product is provided, comprising computer instructions for causing a computer to execute the above-mentioned database operation method.

[0044] The technical solution provided by this application may have the following beneficial effects:

[0045] If it is necessary to encrypt the data in the target database, a filter plug-in can be loaded in the target database. At this time, the filter plug-in will intercept the first statement used to execute the target function when the application requests the target database. If it is detected that the table field in the first statement meets the encryption and decryption conditions, the first statement needs to be parsed to generate a syntax tree, and then the encryption and decryption functions are added to the table fields that meet the encryption and decryption conditions in the target syntax tree, so as to convert the first statement into a second statement. At this time, the database executes the second statement to realize the encryption and decryption of the database field during the operation of the target database. The above scheme parses the statement that executes the target function into a syntax tree, and then adds the encryption and decryption function to the syntax tree to convert it into the second statement, so that the encryption and decryption function of the database field is realized without modifying the program code, thereby reducing the workload of encrypting the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 The diagram is a flow chart of a method for operating a database according to an exemplary embodiment.

[0048] Figure 2 The diagram is a flow chart of a method for operating a database according to an exemplary embodiment.

[0049] Figure 3 A logic block diagram of SQL statement conversion involved in an embodiment of the present application is shown.

[0050] Figure 4 A loading flow chart of SQL rewriting to implement database field encryption and decryption according to an embodiment of the present application is shown.

[0051] Figure 5 A flowchart of database field encryption and decryption processing involved in an embodiment of the present application is shown.

[0052] Figure 6 It is a structural diagram of a database operation device provided in an embodiment of the present application.

[0053] Figure 7 It is a structural schematic diagram of a computer device provided by an optional embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0055] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between two items, or an association relationship between the two items, or a relationship between indication and being indicated, configuration and being configured, and the like.

[0056] Figure 1 is a method flow chart of a database operation method according to an exemplary embodiment. The method is executed by a computer device, and the method applies a target database, and a filter plug-in is loaded in the target database. Figure 1 As shown, the database operation method may include the following steps:

[0057] Step 101, obtaining a first statement intercepted by the filtering plug-in; the first statement is used to execute a target function.

[0058] In the embodiment of the present application, the target database is loaded with a filtering plug-in, so during the application or database interaction process, the SQL statement corresponding to the database will be intercepted by the filtering plug-in. Optionally, the filtering plug-in can filter the first statement used to execute the target function, and specifically can filter by keywords in the SQL statement (such as SELECT, INSERT, UPDATE), intercepting SQL statements of functions such as selection, deletion, writing, selection and update, so as to obtain the first statement.

[0059] At this time, since the first statement is to perform a specific operation, such as querying user information, updating database records, etc., it is assumed that there is a need to encrypt a field in the target database. In the database query or update operation, some fields need to be encrypted when stored, or decrypted when queried. The filter plug-in is used to monitor and process these operations.

[0060] Step 102: If it is detected that the table field in the first statement meets the encryption and decryption conditions, the first statement is parsed to generate a target syntax tree.

[0061] In the embodiment of the present application, it is necessary to determine whether the fields in the SQL statement need to be encrypted or decrypted according to the preset encryption and decryption rules (such as table field name, data type or other tag information). For example, some fields are marked as encrypted fields in the database table, or it can be determined which fields need to be encrypted or decrypted according to the configuration file of the application layer.

[0062] When a field that needs to be encrypted or decrypted is detected, the SQL parser can be used to convert the SQL statement into a target syntax tree (AST, Abstract Syntax Tree). The syntax tree is an abstract representation of the SQL statement, which can decompose the structure of the SQL statement into various components (such as tables, fields, operators, etc.), making it easier to modify specific parts later.

[0063] Step 103: Add encryption and decryption functions to the table fields that meet the encryption and decryption conditions in the target syntax tree to convert them into second statements, so as to execute the second statements through the database.

[0064] In an embodiment of the present application, after the first statement is converted into a target syntax tree, the target syntax tree can be modified by adding encryption and decryption functions to the corresponding fields therein. The encryption and decryption functions are encryption functions or decryption functions; if the field needs to be encrypted (for example, to store a user password), the encryption function is applied to the corresponding field; if the field needs to be decrypted (for example, to read an encrypted field during a query), the decryption function is applied to the corresponding field.

[0065] When the target syntax tree is modified, the modified target syntax tree can be converted into a second statement. At this time, the second statement contains functions for encryption and decryption operations. The modified SQL statement will be executed by the database engine to implement operations with encryption and decryption processing.

[0066] In summary, if it is necessary to encrypt the data in the target database, a filter plug-in can be loaded in the target database. At this time, the filter plug-in will intercept the first statement used to execute the target function when the application requests the target database. If it is detected that the table field in the first statement meets the encryption and decryption conditions, then the first statement needs to be parsed to generate a syntax tree, and then the encryption and decryption function is added to the table field that meets the encryption and decryption conditions in the target syntax tree, so as to convert the first statement into a second statement. At this time, the database executes the second statement to realize the encryption and decryption of the database field during the operation of the target database. The above scheme, by parsing the statement that executes the target function into a syntax tree, and then adding the encryption and decryption function to the syntax tree to convert it into the second statement, realizes the encryption and decryption function of the database field without modifying the program code, thereby reducing the workload of encrypting the database.

[0067] Figure 2 is a method flow chart of a database operation method according to an exemplary embodiment. The method is executed by a computer device, and the method applies a target database, and a filter plug-in is loaded in the target database. Figure 2 As shown, the database operation method may include the following steps:

[0068] Step 201, obtaining a configuration file.

[0069] In an embodiment of the present application, when the relevant software needs to use the target database, it is necessary to first determine the database type, table fields to be encrypted and decrypted, and encryption and decryption functions used by the relevant software. If a standard encryption algorithm is used, the corresponding plug-in must be installed in the database system in advance.

[0070] The above content can be placed in a configuration file, and the configuration file is set in the directory of the application corresponding to the target database.

[0071] Specifically, add encryption and decryption algorithm functions and encryption and decryption field configurations in the Druid configuration section of the configuration file of the relevant software. The configuration parameters are as follows:

[0072] *.druid.ext.encryptionFunction = aes_encrypt (configure according to actual needs) # encryption function;

[0073] *.druid.ext.decryptionFunction = aes_decrypt (configure according to actual needs) #decryption function;

[0074] *.druid.ext.secretKey=a123456 (configure according to actual needs) #key;

[0075] *.druid.ext.secretField=TabA.FieldA,TabA.FieldB#The table and field to be encrypted are separated by "," and the table and table fields are separated by .;

[0076] *.druid.ext.dbType=mysql#database type;

[0077] The interception component in Druid serves as an optional filtering plug-in in the embodiment of the present application; and Druid is a data connection pool involved in the embodiment of the present application. When the application needs to access the target database, it can obtain an available connection from the data connection pool and return it to the data connection pool after use.

[0078] When the application is released and run, the above configuration file is placed in the same directory as the running package, so that the encryption and decryption configuration in the configuration file can be configured on demand. The configuration file loading depends on the relevant software infrastructure framework. According to the configuration parameters, an entity class is defined as the carrier of the encryption and decryption configuration value. According to the relevant software architecture, the configuration parameters are assigned to the configuration parameter entity class at startup.

[0079] Step 202: parse the configuration file to obtain encryption and decryption conditions and encryption and decryption functions.

[0080] When the database enables the filtering plug-in in Druid to intercept SQL statements, it is necessary to parse the configuration file to obtain the encryption and decryption conditions and encryption and decryption functions pre-set in the configuration file.

[0081] In an embodiment of the present application, a "SQL encryption and decryption conversion component" can be developed based on the Druid extension interface to implement the encryption and decryption functions of SQL statements. The "SQL encryption and decryption conversion component" inherits the FilterEventAdapter class and implements the Filter interface.

[0082] In the embodiment of the present application, when the first statement is intercepted by the filtering plug-in, different interception methods may be adopted according to different types of the first statement. In addition, in the data connection pool involved in the embodiment of the present application, different statement types may also be transmitted using different interfaces.

[0083] If the first statement is a precompiled SQL statement in the first interface, the first statement can be intercepted by the first interception method before the first statement is executed. A precompiled SQL statement is an SQL statement executed in the PreparedStatement mode; in this case, the SQL statement executed in the PreparedStatement mode can be intercepted by overriding the connection_prepareStatement() method (that is, the first interception method, which means interception before executing the precompiled statement).

[0084] If the second statement is a non-precompiled SQL statement in the second interface, the first statement can be intercepted by the second interception method before the first statement is executed. A non-precompiled SQL statement is an SQL statement executed in the Statement mode; in this case, the SQL statement executed in the Statement mode can be intercepted by overriding the statementExecuteBefore() method (i.e., the second interception method, which means intercepting before the non-precompiled statement is executed);

[0085] Specifically, rewrite the init() method to assign configuration parameters to the properties of the "SQL encryption and decryption component", determine the data type, and rewrite the connection_prepareStatement() method to intercept SQL statements executed in PreparedStatement mode. Rewrite the statementExecuteBefore() method to intercept SQL statements executed in Statement mode. The "SQL encryption and decryption conversion component" writes encryption and decryption processing methods for the delete syntax tree, insert syntax tree, update syntax tree, and select syntax tree according to different databases and JDBC's PreparedStatement and Statement execution modes.

[0086] Taking the MySQL database as an example, the "SQL encryption and decryption conversion component" needs to provide the following processing methods shown in Table 1:

[0087]

[0088] Table 1

[0089] Step 203, obtaining a first statement intercepted by the filtering plug-in; the first statement is used to execute the target function.

[0090] In the embodiment of the present application, the first statement is a SQL statement.

[0091] After the relevant software is started, it will send various SQL statements to the target database. At this time, the "SQL encryption and decryption conversion component" intercepts all SQL to be executed (that is, SELECT, INSERT, UPDATE, DELETE, etc.) of the jdbc prepareStatement and statement interfaces through connection_prepareStatement() and statementExecuteBefore().

[0092] Step 204: If it is detected that the table field in the first statement meets the encryption and decryption conditions, it is detected whether there is a wildcard in the first statement.

[0093] Step 205: If there is a wildcard in the first statement, replace the wildcard with the target field.

[0094] In security design, it is necessary to perform encryption and decryption operations on specific fields. If a specific field may contain a wildcard "*", it is necessary to refer to a specific field according to a certain rule. However, during the parsing of the statement, the "*" blurs the field range. For example, the common SELECT* in SQL query statements will cause unclear fields, making subsequent parsing and encryption and decryption difficult. In an embodiment of the present application, after intercepting a SQL statement, it is necessary to first replace the field "*" in the SQL statement.

[0095] In the embodiment of the present application, the target field corresponding to the wildcard can be searched in the target database, and then the wildcard "*" is replaced with the target field.

[0096] Step 206: parse the first statement to generate a target syntax tree.

[0097] In the embodiment of the present application, the dbtype parameter value may be used to generate a syntax tree using the Druid corresponding SQLStatementParser syntax parsing class.

[0098] Step 207: Add encryption and decryption functions to the table fields that meet the encryption and decryption conditions in the target syntax tree to convert them into second statements, so as to execute the second statements through the database.

[0099] After obtaining the target syntax tree, the syntax tree type can be determined, and the corresponding program method can be called to modify the syntax tree and then regenerate a new SQL statement (that is, the second statement).

[0100] In the embodiment of the present application, the first interception method and the second interception method are obtained by rewriting in the target subclass; and the target subclass is a subclass of the parent class created by the filtering plug-in in the data connection pool.

[0101] Specifically, the first interception method (connection_prepareStatement()) and the second interception method (statementExecuteBefore()) are obtained by overriding the method of the parent class in the target subclass. In the embodiment of the present application, the parent class can be a FilterEventAdapter created by the filter plug-in of Durid, and the target subclass can intercept the first statement by inheriting the parent class and overriding the relevant methods.

[0102] At this time, after the first statement is encrypted and decrypted to generate the second statement, if the first statement is a precompiled SQL statement in the first interface, the second statement replaces the SQL input parameter variable in the first interception method, and calls back the method of the parent class in the filtering plug-in to execute the second statement;

[0103] If the first statement is a non-precompiled SQL statement in the second interface, the second statement replaces the SQL input parameter variable in the second interception method, and calls back the method of the parent class in the filter plug-in to execute the second statement.

[0104] Specifically, the SQL input parameter variable in the connection_prepareStatement() or statementExecuteBefore() method is replaced with the newly generated second statement, and the connection_prepareStatement() or statementExecuteBefore() method of the parent class is called back, so that Durid can execute the second statement that has been encrypted and decrypted.

[0105] Please refer to Figure 3 , which shows a logic block diagram of a SQL statement conversion involved in an embodiment of the present application. Figure 3 As shown, when the original SQL, that is, the first statement in the above steps, is obtained, the SQL encryption and decryption configuration can be read through the pre-set "SQL encryption and decryption component", so that the first statement is converted into a target syntax tree and then an encryption and decryption function is added (such as steps 203 to 207) to obtain the converted SQL, that is, the second statement. In addition, in the embodiment of the present application, the SQL encryption and decryption configuration is read from a preset SQL encryption and decryption configuration file, so the embodiment of the present application can change the SQL encryption and decryption configuration file as required, thereby modifying the corresponding SQL encryption and decryption configuration rules, so that the SQL encryption and decryption conversion component can perform encryption and decryption operations on the original SQL through different SQL encryption and decryption configuration rules.

[0106] Please refer to Figure 4 , which shows a loading flow chart of SQL rewriting to implement database field encryption and decryption involved in an embodiment of the present application. Figure 4As shown, in the embodiment of the present application, when the relevant software of the target database is running, the Druid connection pool is initialized, and then the Druid extension program, that is, the above-mentioned SQL encryption and decryption conversion component is initialized, thereby intercepting and processing SQL, and Druid executes the processed SQL to realize field encryption and decryption during SQL execution. Please refer to Figure 5 , which shows a flowchart of the database field encryption and decryption process involved in the embodiment of the present application. Figure 5 As shown in the figure, Druid intercepts the SQL to be executed and replaces the wildcard "*" in the SQL statement with the target field. At this time, the SQL is converted into the target syntax tree through the corresponding database type parsing class provided by Druid. Then, the corresponding method can be selected to process the syntax tree according to the execution mode, statement type, etc., that is, encryption and decryption functions are added to the corresponding fields of the syntax tree to generate new SQL. At this time, the new SQL is assigned to the SQL input parameter of the rewrite method, and then by calling the parent class rewrite method, Druid can execute the SQL that has been encrypted and decrypted.

[0107] The following further describes the embodiment of the present application in detail by specifying condition parameters in combination with the implementation method. The relevant software database uses the mysql database, the database connection pool uses Druid, and the Druid execution chain has loaded the "SQL encryption and decryption component". The database has a tab_a table, and the table structure is shown in Table 2 below.

[0108] Fields type Is it a primary key? id Bigint yes yphone Varchar(600) Yes (encrypted field) yname Varchar(600) Yes (encrypted field)

[0109] Table 2

[0110] In the embodiment of the present application, different types of statements obtained by different interface methods use different method names. Specifically, in the embodiment of the present application, the method names used for encryption and decryption conversion processing of statements collected by the Statement interface method and the method names used for encryption and decryption conversion processing of statements collected by the preperStatement interface method can be found in Table 1 above. The following two specific embodiments illustrate how to perform encryption and decryption conversion processing on statements collected by the two interface methods.

[0111] First, the encryption and decryption conversion method when using statement query is as follows:

[0112] Use the jdbc Statement interface to execute select id,yphone,yname from tab_awhere yname = 'user name'. The processing steps of the "SQL encryption and decryption component" are as follows.

[0113] Step 1: The statementExecuteBefore() rewritten by the "SQL encryption and decryption component" will get the original SQL statement before the SQL is executed.

[0114] Step 2: Since the dbtype parameter value is mysql, the "SQL encryption and decryption component" enables the MySqlStatementParser() that comes with druid to generate a syntax tree.

[0115] Step 3: After determining that the syntax tree type is SQLSelectStatement, force the syntax tree to be converted into the MySqlDeleteStatement type, and call mysql_statement_select() of the "SQL Encryption and Decryption Component" to process the syntax tree.

[0116] Step 4: The mysql_preparedStatement_select() method obtains the MySqlSelectQueryBlock of the outermost select query statement, parses the MySqlSelectQueryBlock, and extracts the where condition (SQLExpr), query field (SQLSelectItem), and query table (SQLTableSource). Traverse each condition in the "where condition" expression to determine whether SQLBinaryOpExpr needs to be decrypted. If necessary, modify the syntax tree. Traverse the "query field" expression to obtain the column name, alias, and table alias to determine whether decryption is required. If the column name needs to be modified, add the decryption function and key before the column name. Traverse the "queried table" to determine whether it is a single-table query or a multi-table query, and determine whether there are fields in the table that need to be decrypted. If the "select query statement" contains a subquery, it is processed recursively.

[0117] Step 5: Traverse the AST syntax tree and regenerate SQL. New SQL statement: Finally, the original SQL is modified to: selectid,aes_decrypt(yphone,'a123456')as yphone,aes_decrypt(yna me,'a123456')as yname from tab_a where aes_decrypt(yname,'a123456')='Username'.

[0118] Step 6: Return the newly generated SQL to Druid for execution.

[0119] The encryption and decryption conversion method when using the preperStatement method for querying is as follows:

[0120] Use the jdbc PrepreStatement interface to execute select id,yphone,yname from tab_a where yname=? The "SQL encryption and decryption component" processing steps are as follows.

[0121] Step 1: The () rewritten by the "SQL encryption and decryption component" will get the original SQL statement before the SQL is executed.

[0122] Step 2: Since the dbtype parameter value is mysql, the "SQL encryption and decryption component" enables the MySqlStatementParser() that comes with druid to generate a syntax tree.

[0123] Step 3: After determining that the syntax tree type is SQLSelectStatement, force the syntax tree to be converted to MySqlDeleteStatement type, and call mysql_preparedStatement_select() of the "SQL Encryption and Decryption Component" to process the syntax tree.

[0124] Step 4: The mysql_preparedStatement_select() method obtains the MySqlSelectQueryBlock of the outermost select query statement, parses the MySqlSelectQueryBlock, and extracts the where condition (SQLExpr), query field (SQLSelectItem), and query table (SQLTableSource). Traverse each condition in the "where condition" expression to determine whether SQLBinaryOpExpr needs to be decrypted. If necessary, modify the syntax tree. Traverse the "query field" expression to obtain the column name, alias, and table alias to determine whether decryption is required. If the column name needs to be modified, add the decryption function and key before the column name. Traverse the "queried table" to determine whether it is a single-table query or a multi-table query, and determine whether there are fields in the table that need to be decrypted. If the "select query statement" contains a subquery, it is processed recursively.

[0125] Step 5: Traverse the AST syntax tree and regenerate SQL. New SQL statement: Finally, the original SQL is modified to: selectid,aes_decrypt(yphone,'a123456')as yphone,aes_decrypt(yname,'a123456')as yname from tab_a where aes_decrypt(yname,'a123456')=? .

[0126] Step 6: Return the newly generated SQL to Druid for execution.

[0127] In summary, if it is necessary to encrypt the data in the target database, a filter plug-in can be loaded in the target database. At this time, the filter plug-in will intercept the first statement used to execute the target function when the application requests the target database. If it is detected that the table field in the first statement meets the encryption and decryption conditions, then the first statement needs to be parsed to generate a syntax tree, and then the encryption and decryption function is added to the table field that meets the encryption and decryption conditions in the target syntax tree, so as to convert the first statement into a second statement. At this time, the database executes the second statement to realize the encryption and decryption of the database field during the operation of the target database. The above scheme, by parsing the statement that executes the target function into a syntax tree, and then adding the encryption and decryption function to the syntax tree to convert it into the second statement, realizes the encryption and decryption function of the database field without modifying the program code, thereby reducing the workload of encrypting the database.

[0128] In the embodiments of the present application, a database operation device is also provided, which is used to implement the above embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0129] The present application embodiment provides a database operation device, Figure 6 : is a schematic diagram of the structure of a database operation device provided in an embodiment of the present application, the device comprising:

[0130] An acquisition module 601 is used to acquire a first statement intercepted by the filtering plug-in; the first statement is used to execute a target function;

[0131] A parsing module 602 is configured to parse the first statement to generate a target syntax tree if it is detected that the table field in the first statement meets the encryption and decryption conditions;

[0132] The execution module 603 is used to add an encryption and decryption function to the table field that meets the encryption and decryption conditions in the target syntax tree to convert it into a second statement, so as to execute the second statement through the database.

[0133] In a possible implementation manner, the target function includes at least one of selection, deletion, writing, selection, and update.

[0134] In a possible implementation, before parsing the first statement into a target syntax tree, the method further includes:

[0135] Detecting whether there is a wildcard in the first statement;

[0136] If there is a wildcard in the first statement, the wildcard is replaced with the target field.

[0137] In a possible implementation, obtaining the first statement intercepted by the filtering plug-in includes:

[0138] If the first statement is a precompiled SQL statement in the first interface, before executing the first statement, intercepting the first statement by using a first interception method;

[0139] Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the first statement is intercepted by a second interception method before the first statement is executed.

[0140] In a possible implementation, the first interception method and the second interception method are obtained by overriding in a target subclass; the target subclass is a subclass of a parent class created by the filter plug-in in the data connection pool.

[0141] In a possible implementation, executing the second statement through the database includes:

[0142] If the first statement is a precompiled SQL statement in the first interface, the second statement is used to replace the SQL input parameter variable in the first interception method, and the method of the parent class in the filtering plug-in is called back to execute the second statement;

[0143] Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the second statement replaces the SQL input parameter variable in the second interception method, and calls back the method of the parent class in the filtering plug-in to execute the second statement.

[0144] In a possible implementation manner, before obtaining the first statement intercepted by the filtering plug-in, the method further includes:

[0145] Obtain a configuration file; the configuration file is set in a directory of an application corresponding to the target database.

[0146] Parse the configuration file to obtain the encryption and decryption conditions and the encryption and decryption functions.

[0147] In summary, if it is necessary to encrypt the data in the target database, a filter plug-in can be loaded in the target database. At this time, the filter plug-in will intercept the first statement used to execute the target function when the application requests the target database. If it is detected that the table field in the first statement meets the encryption and decryption conditions, then the first statement needs to be parsed to generate a syntax tree, and then the encryption and decryption function is added to the table field that meets the encryption and decryption conditions in the target syntax tree, so as to convert the first statement into a second statement. At this time, the database executes the second statement to realize the encryption and decryption of the database field during the operation of the target database. The above scheme, by parsing the statement that executes the target function into a syntax tree, and then adding the encryption and decryption function to the syntax tree to convert it into the second statement, realizes the encryption and decryption function of the database field without modifying the program code, thereby reducing the workload of encrypting the database.

[0148] The database operation device in the IB protocol in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0149] The embodiment of the present invention also provides a computer device, see Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display graphic information in a graphical user interface on an external input / output device (such as a display device coupled to an interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0150] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0151] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0152] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0153] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0154] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0155] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0156] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0157] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A database operation method, characterized in that: The method is used for a target database, the target database is loaded with a filtering plug-in, and the method comprises: Obtaining a first statement intercepted by the filtering plug-in; the first statement is used to execute a target function; If it is detected that the table field in the first statement meets the encryption and decryption conditions, the first statement is parsed to generate a target syntax tree; An encryption and decryption function is added to the table field that meets the encryption and decryption conditions in the target syntax tree to convert it into a second statement, so as to execute the second statement through the database.

2. The method according to claim 1, characterized in that The target function includes at least one of select, delete, write, select, and update.

3. The method according to claim 1, characterized in that Before parsing the first statement into a target syntax tree, the method further includes: Detecting whether there is a wildcard in the first statement; If there is a wildcard in the first statement, the wildcard is replaced with the target field.

4. The method according to any one of claims 1 to 3, characterized in that: The obtaining the first statement intercepted by the filtering plug-in includes: If the first statement is a precompiled SQL statement in the first interface, before executing the first statement, intercepting the first statement by using a first interception method; Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the first statement is intercepted by a second interception method before the first statement is executed.

5. The method according to claim 4, characterized in that The first interception method and the second interception method are obtained by rewriting in the target subclass; the target subclass is a subclass of the parent class created by the filtering plug-in in the data connection pool.

6. The method according to claim 5, characterized in that The executing the second statement through the database includes: If the first statement is a precompiled SQL statement in the first interface, the second statement is used to replace the SQL input parameter variable in the first interception method, and the method of the parent class in the filtering plug-in is called back to execute the second statement; Alternatively, if the first statement is a non-precompiled SQL statement in the second interface, the second statement replaces the SQL input parameter variable in the second interception method, and calls back the method of the parent class in the filtering plug-in to execute the second statement.

7. The method according to any one of claims 1 to 3, characterized in that: Before obtaining the first statement intercepted by the filter plug-in, the method further includes: Obtaining a configuration file; wherein the configuration file is set in a directory of an application corresponding to the target database; Parse the configuration file to obtain the encryption and decryption conditions and the encryption and decryption functions.

8. A database operation device, characterized in that: The device is used for a target database, the target database is loaded with a filtering plug-in, and the device includes: An acquisition module, used for acquiring a first statement intercepted by the filtering plug-in; the first statement is used for executing a target function; A parsing module, configured to parse the first statement to generate a target syntax tree if it is detected that the table field in the first statement satisfies the encryption and decryption conditions; The execution module is used to add an encryption and decryption function to the table field that meets the encryption and decryption conditions in the target syntax tree to convert it into a second statement, so as to execute the second statement through the database.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the database operation method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the database operation method according to any one of claims 1 to 7.

Images