A micro-service-based database encryption control method and system

Abstract

The application discloses a database encryption control method and system based on micro services, and relates to the technical field of distributed database security; a password device distribution service, a certificate key management service and a dynamic load balancing service are created according to a micro service architecture; the password device distribution service distributes password devices when the password devices are applied to be used by the outside world, and provides a calling interface; the certificate key management service uniformly manages certificates and keys in the password devices, and can migrate the certificates and the keys between the password devices; and the dynamic load balancing service dynamically distributes the password devices to nodes according to usage information of the nodes on the password devices.

Description

Technical Field

[0001] This invention discloses a database encryption control method and system based on microservices, which relates to the field of distributed database security technology. Background Technology

[0002] Existing distributed databases require each node to be individually connected to a cryptographic card, cryptographic machine, and ukey to implement encryption and decryption functions. Because distributed databases can flexibly add or remove nodes, the number of cryptographic devices must increase proportionally with the number of distributed nodes, thus limiting the flexibility of distributed databases.

[0003] Distributed databases also possess high availability characteristics, enabling them to continue providing services even when a node fails, ensuring system high availability. If a node fails, the cryptographic devices it connects to have no nodes to continue using, resulting in wasted resources. Furthermore, if the cryptographic devices connected to a node fail, the node will be unable to provide services normally. Therefore, the high availability of distributed databases is limited by the reliability of the cryptographic devices.

[0004] In existing distributed databases, certificates and keys are managed separately by each node, which makes it impossible to migrate certificates and keys and limits the high availability of distributed databases. Summary of the Invention

[0005] This invention addresses the problems of existing technologies by providing a database encryption control method and system based on microservices. It features strong versatility, ease of implementation, and broad application prospects.

[0006] The specific solution proposed in this invention is as follows:

[0007] This invention provides a database encryption control method based on microservices, which creates a cryptographic device allocation service, a certificate and key management service, and a dynamic load balancing service according to the microservice architecture.

[0008] The cryptographic device allocation service allocates cryptographic devices when an external party requests their use and provides an API for access; the certificate and key management service centrally manages the certificates and keys within the cryptographic devices and enables the migration of certificates and keys between cryptographic devices; the dynamic load balancing service dynamically allocates cryptographic devices to nodes based on their usage information.

[0009] The process for implementing database encryption control is as follows:

[0010] S1: The cryptographic device allocation service receives a connection request from a node client or server, allocates a cryptographic device according to the connection request, and provides a call interface;

[0011] S2: The Certificate and Key Management Service receives the certificate and key information of the cryptographic device sent by the Cryptographic Device Allocation Service;

[0012] S3: The dynamic load balancing service receives cryptographic device information and connected node information sent by the cryptographic device allocation service, and periodically detects the cryptographic device operating status and node usage hotspot information;

[0013] S4: If a cryptographic device fails, is not in use, or is used by a large number of nodes, the dynamic load balancing service will re-plan the cryptographic device usage schedule and send the cryptographic device usage schedule to the cryptographic device allocation service.

[0014] S5: The cryptographic device allocation service sends the certificate and key information of the new cryptographic device to the certificate and key management service according to the cryptographic device usage plan, performs certificate and key migration, and after the migration is completed, the certificate and key management service returns the information to the cryptographic device allocation service to complete the cryptographic device reallocation process.

[0015] Furthermore, the cryptographic device allocation service of the microservice-based database encryption control method includes cryptographic cards, cryptographic machines, and ukey encryption devices, and the cryptographic devices support the national cryptographic algorithms SM2, SM3, and SM4.

[0016] Furthermore, the certificate key management service of the microservice-based database encryption control method supports X.509 format certificates, and the supported keys include RSA keys, SM2 key pairs, and SM4 keys.

[0017] Furthermore, the dynamic load balancing service of the microservice-based database encryption control method stores node information and cryptographic device usage information. The node information includes the node IP, node port, and encryption algorithm used. The cryptographic device usage information includes the cryptographic device name, device status, cryptographic device IP, cryptographic device port, and encryption algorithm used.

[0018] The dynamic load balancing service plan includes a list of cryptographic device names assigned to nodes, the maximum number of nodes supported by each cryptographic device, node number, node IP, node port, cryptographic device name, cryptographic device IP, and cryptographic device port.

[0019] This invention also provides a microservice-based database encryption control system, including a cryptographic device allocation service component, a certificate and key management service component, and a dynamic load balancing service component.

[0020] The cryptographic device allocation service component allocates cryptographic devices when external requests for their use and provides a calling interface; the certificate and key management service component centrally manages the certificates and keys within the cryptographic devices and can migrate certificates and keys between cryptographic devices; the dynamic load balancing service component dynamically allocates cryptographic devices to nodes based on their usage information.

[0021] The process for implementing database encryption control is as follows:

[0022] S1: The cryptographic device allocation service component receives a connection request from a node client or server, allocates a cryptographic device according to the connection request, and provides a call interface;

[0023] S2: The Certificate and Key Management Service component receives the certificate and key information of the cryptographic device sent by the Cryptographic Device Allocation Service;

[0024] S3: The dynamic load balancing service component receives cryptographic device information and connected node information sent by the cryptographic device allocation service, and periodically detects the cryptographic device running status and node usage hotspot information;

[0025] S4: If a cryptographic device fails, is not in use, or is used by a large number of nodes, the dynamic load balancing service component will re-plan the cryptographic device usage plan and send the cryptographic device usage plan to the cryptographic device allocation service component.

[0026] S5: The cryptographic device allocation service component sends the certificate and key information of the new cryptographic device to the certificate and key management service component according to the cryptographic device usage plan, performs certificate and key migration, and after the migration is completed, the certificate and key management service component returns the information to the cryptographic device allocation service component to complete the cryptographic device reallocation process.

[0027] Furthermore, the cryptographic devices allocated by the cryptographic device allocation service component of the microservice-based database encryption control system include cryptographic cards, cryptographic machines, and ukey encryption devices, and the cryptographic devices support the national cryptographic algorithms SM2, SM3, and SM4.

[0028] Furthermore, the certificate key management service component of the microservice-based database encryption control system supports X.509 format certificates, and the supported keys include RSA keys, SM2 key pairs, and SM4 keys.

[0029] Furthermore, the dynamic load balancing service component of the microservice-based database encryption control system stores node information and cryptographic device usage information. The node information includes the node IP, node port, and the encryption algorithm used. The cryptographic device usage information includes the cryptographic device name, device status, cryptographic device IP, cryptographic device port, and the encryption algorithm used.

[0030] The dynamic load balancing service component plans the cryptographic device usage plan, including the list of cryptographic device names assigned to nodes, the maximum number of nodes supported by the cryptographic device, node number, node IP, node port, cryptographic device name, cryptographic device IP, and cryptographic device port.

[0031] The advantages of this invention are:

[0032] Decoupling: The database server and client do not connect directly to the cryptographic device, thus avoiding the impact of changes to the cryptographic device on the database.

[0033] Independence: Encryption control modules such as cryptographic device allocation, certificate key management, and dynamic load balancing are split into independent microservices. Each microservice component can be developed, started, deployed, and run independently, avoiding the problem of single point of failure causing overall service unavailability and system resource contention.

[0034] Maintainability: The small size of each microservice functional component allows for quick problem fixing and the rollout of new features, resulting in lower maintenance and repair costs.

[0035] Scalability: Each microservice functional component can be scaled independently as needed to meet traffic and performance requirements.

[0036] High availability: When a cryptographic device is in an abnormal state, the dynamic load balancing service will reschedule the use of the cryptographic device without affecting the database.

[0037] High performance: The dynamic load balancing service plans a better usage schedule for cryptographic devices based on node hotspot usage, avoiding performance loss caused by excessive usage pressure on a single cryptographic device. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the microservice logical architecture application of the present invention.

[0039] Figure 2 This is a schematic diagram of the process for creating a new connection using the method of the present invention.

[0040] Figure 3 This is a flowchart illustrating the certificate key migration process. Detailed Implementation

[0041] Microservices, also known as microservice architecture, is a software development methodology that breaks down an application into a set of small, autonomous services. Each microservice focuses on performing a specific business function and can be deployed and scaled independently. These microservices interact with each other through lightweight communication mechanisms, commonly including RESTful APIs and messaging. In recent years, due to their independence, maintainability, scalability, and technological diversity, microservices have led to an increasing number of database systems adopting microservice architecture to improve business agility and performance.

[0042] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0043] Example 1

[0044] This invention provides a database encryption control method based on microservices, which creates a cryptographic device allocation service, a certificate and key management service, and a dynamic load balancing service according to the microservice architecture.

[0045] The cryptographic device allocation service allocates cryptographic devices when external parties apply for their use and provides a calling interface. The cryptographic devices allocated by the cryptographic device allocation service include cryptographic cards, cryptographic machines, and ukey encryption devices, and the cryptographic devices support the national cryptographic algorithms SM2, SM3, and SM4.

[0046] The Certificate Key Management Service centrally manages certificates and keys within cryptographic devices and enables the migration of certificates and keys between cryptographic devices. The Certificate Key Management Service supports X.509 format certificates and supports keys including RSA keys, SM2 key pairs, and SM4 keys.

[0047] The dynamic load balancing service dynamically allocates cryptographic devices to nodes based on their usage information. The service stores node information and cryptographic device usage information. Node information includes the node IP address, node port, and the encryption algorithm used. Cryptographic device usage information includes the cryptographic device name, device status, cryptographic device IP address, cryptographic device port, and the encryption algorithm used.

[0048] The dynamic load balancing service plan includes a list of cryptographic device names assigned to nodes, the maximum number of nodes supported by each cryptographic device, node number, node IP, node port, cryptographic device name, cryptographic device IP, and cryptographic device port.

[0049] The encryption / decryption, hashing, certificate key management, and dynamic load balancing functions in the database encryption module are broken down into microservices that can be started, deployed, and run independently. The database forwards encryption device usage requests to the cryptographic device allocation service to obtain API interfaces for using encryption / decryption and hashing functions; it forwards certificate key information to the certificate key management service for unified management; and it forwards cryptographic device usage information to the dynamic load balancing service for flexible allocation of cryptographic device usage.

[0050] The process for implementing database encryption control is as follows:

[0051] S1: The cryptographic device allocation service receives a connection request from a node client or server, allocates a cryptographic device according to the connection request, and provides a call interface;

[0052] S2: The Certificate and Key Management Service receives the certificate and key information of the cryptographic device sent by the Cryptographic Device Allocation Service;

[0053] S3: The dynamic load balancing service receives cryptographic device information and connected node information sent by the cryptographic device allocation service, and periodically detects the cryptographic device operating status and node usage hotspot information;

[0054] S4: If a cryptographic device fails, is not in use, or is used by a large number of nodes, the dynamic load balancing service will re-plan the cryptographic device usage schedule and send the cryptographic device usage schedule to the cryptographic device allocation service.

[0055] S5: The cryptographic device allocation service sends the certificate and key information of the new cryptographic device to the certificate and key management service according to the cryptographic device usage plan, performs certificate and key migration, and after the migration is completed, the certificate and key management service returns the information to the cryptographic device allocation service to complete the cryptographic device reallocation process.

[0056] Example 2

[0057] This invention also provides a microservice-based database encryption control system, including a cryptographic device allocation service component, a certificate and key management service component, and a dynamic load balancing service component.

[0058] The cryptographic device allocation service component allocates cryptographic devices when external requests for their use and provides a calling interface; the certificate and key management service component centrally manages the certificates and keys within the cryptographic devices and can migrate certificates and keys between cryptographic devices; the dynamic load balancing service component dynamically allocates cryptographic devices to nodes based on their usage information.

[0059] The process for implementing database encryption control is as follows:

[0060] S1: The cryptographic device allocation service component receives a connection request from a node client or server, allocates a cryptographic device according to the connection request, and provides a call interface;

[0061] S2: The Certificate and Key Management Service component receives the certificate and key information of the cryptographic device sent by the Cryptographic Device Allocation Service;

[0062] S3: The dynamic load balancing service component receives cryptographic device information and connected node information sent by the cryptographic device allocation service, and periodically detects the cryptographic device running status and node usage hotspot information;

[0063] S4: If a cryptographic device fails, is not in use, or is used by a large number of nodes, the dynamic load balancing service component will re-plan the cryptographic device usage plan and send the cryptographic device usage plan to the cryptographic device allocation service component.

[0064] S5: The cryptographic device allocation service component sends the certificate and key information of the new cryptographic device to the certificate and key management service component according to the cryptographic device usage plan, performs certificate and key migration, and after the migration is completed, the certificate and key management service component returns the information to the cryptographic device allocation service component to complete the cryptographic device reallocation process.

[0065] The information interaction and execution process between the modules in the above system are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0066] Similarly, the advantages of the system of the present invention are:

[0067] Decoupling: The database server and client do not connect directly to the cryptographic device, thus avoiding the impact of changes to the cryptographic device on the database.

[0068] Independence: Encryption control modules such as cryptographic device allocation, certificate key management, and dynamic load balancing are split into independent microservices. Each microservice component can be developed, started, deployed, and run independently, avoiding the problem of single point of failure causing overall service unavailability and system resource contention.

[0069] Maintainability: The small size of each microservice functional component allows for quick problem fixing and the rollout of new features, resulting in lower maintenance and repair costs.

[0070] Scalability: Each microservice functional component can be scaled independently as needed to meet traffic and performance requirements.

[0071] High availability: When a cryptographic device is in an abnormal state, the dynamic load balancing service will reschedule the use of the cryptographic device without affecting the database.

[0072] High performance: The dynamic load balancing service plans a better usage schedule for cryptographic devices based on node hotspot usage, avoiding performance loss caused by excessive usage pressure on a single cryptographic device.

[0073] It should be noted that not all steps and modules in the above processes and system structures are mandatory; some steps or modules can be omitted as needed. The execution order of the steps is not fixed and can be adjusted as required. The system structures described in the above embodiments can be physical or logical structures. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be implemented by certain components in multiple independent devices.

[0074] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A database encryption control method based on microservices, characterized in that: Based on a microservice architecture, create a cryptographic device allocation service, a certificate and key management service, and a dynamic load balancing service. The cryptographic device allocation service allocates cryptographic devices when external users request their use and provides a API for this purpose; the certificate and key management service centrally manages the certificates and keys within the cryptographic devices and enables the migration of certificates and keys between cryptographic devices; the dynamic load balancing service dynamically allocates cryptographic devices to nodes based on their usage information. The process for implementing database encryption control is as follows: S1: The cryptographic device allocation service receives a connection request from a node client or server, allocates a cryptographic device according to the connection request, and provides a call interface; S2: The Certificate and Key Management Service receives the certificate and key information of the cryptographic device sent by the Cryptographic Device Allocation Service; S3: The dynamic load balancing service receives cryptographic device information and connected node information sent by the cryptographic device allocation service, and periodically detects the cryptographic device operating status and node usage hotspot information; S4: If a cryptographic device fails, is not in use, or is used by a large number of nodes, the dynamic load balancing service will re-plan the cryptographic device usage schedule and send the cryptographic device usage schedule to the cryptographic device allocation service. S5: The cryptographic device allocation service sends the certificate and key information of the new cryptographic device to the certificate and key management service according to the cryptographic device usage plan, performs certificate and key migration, and after the migration is completed, the certificate and key management service returns the information to the cryptographic device allocation service to complete the cryptographic device reallocation process.

2. The database encryption control method based on microservices according to claim 1, characterized in that: The cryptographic devices allocated by the cryptographic device allocation service include cryptographic cards, cryptographic machines, and ukey encryption devices, and the cryptographic devices support the national cryptographic algorithms SM2, SM3, and SM4.

3. The database encryption control method based on microservices according to claim 1, characterized in that the certificate... The key management service supports X.509 format certificates and supports RSA keys, SM2 key pairs, and SM4 keys.

4. The database encryption control method based on microservices according to claim 1, characterized in that it is dynamic. The load balancing service stores node information and cryptographic device usage information. Node information includes node IP, node port, and the encryption algorithm used. Cryptographic device usage information includes cryptographic device name, device status, cryptographic device IP, cryptographic device port, and the encryption algorithm used. The dynamic load balancing service plan includes a list of cryptographic device names assigned to nodes, the maximum number of nodes supported by each cryptographic device, node number, node IP, node port, cryptographic device name, cryptographic device IP, and cryptographic device port.

5. A microservice-based database encryption control system, characterized in that... This includes a cryptographic device allocation service component, a certificate and key management service component, and a dynamic load balancing service component. The cryptographic device allocation service component allocates cryptographic devices when external requests for their use and provides a calling interface; the certificate and key management service component centrally manages the certificates and keys within the cryptographic devices and can migrate certificates and keys between cryptographic devices; the dynamic load balancing service component dynamically allocates cryptographic devices to nodes based on their usage information. The process for implementing database encryption control is as follows: S1: The cryptographic device allocation service component receives a connection request from a node client or server, allocates a cryptographic device according to the connection request, and provides a call interface; S2: The Certificate and Key Management Service component receives the certificate and key information of the cryptographic device sent by the Cryptographic Device Allocation Service; S3: The dynamic load balancing service component receives cryptographic device information and connected node information sent by the cryptographic device allocation service, and periodically detects the cryptographic device running status and node usage hotspot information; S4: If a cryptographic device fails, is not in use, or is used by a large number of nodes, the dynamic load balancing service component will re-plan the cryptographic device usage plan and send the cryptographic device usage plan to the cryptographic device allocation service component. S5: The cryptographic device allocation service component sends the certificate and key information of the new cryptographic device to the certificate and key management service component according to the cryptographic device usage plan, performs certificate and key migration, and after the migration is completed, the certificate and key management service component returns the information to the cryptographic device allocation service component to complete the cryptographic device reallocation process.

6. A microservice-based database encryption control system according to claim 5, characterized in that: The cryptographic devices allocated by the cryptographic device allocation service component include cryptographic cards, cryptographic machines, and ukey encryption devices, and the cryptographic devices support the national cryptographic algorithms SM2, SM3, and SM4.

7. A microservice-based database encryption control system according to claim 5, characterized in that the certificate... The key management service component supports X.509 format certificates and supports RSA keys, SM2 key pairs, and SM4 keys.

8. A microservice-based database encryption control system according to claim 5, characterized in that it is dynamic. The load balancing service component stores node information and cryptographic device usage information. Node information includes node IP, node port, and the encryption algorithm used. Cryptographic device usage information includes cryptographic device name, device status, cryptographic device IP, cryptographic device port, and the encryption algorithm used. The dynamic load balancing service component plans the cryptographic device usage plan, including the list of cryptographic device names assigned to nodes, the maximum number of nodes supported by the cryptographic device, node number, node IP, node port, cryptographic device name, cryptographic device IP, and cryptographic device port.

Images