A method for implementing universal data encryption based on service grid

Abstract

The present invention relates to the field of computer technology and discloses a method for implementing universal data encryption based on a service grid, comprising: adding a corresponding sidecar container to a Pod when a first business system is deployed online; pulling first configuration information corresponding to the first business system from a control plane when the sidecar container starts: target database instance information, encryption algorithm, key, and encryption rules; the sidecar container adding iptables rules to the target database instance information; the first business system initiates a first business request; the sidecar container intercepts the first business request and parses the intercepted first business request according to the database binary protocol specification to obtain a first SQL statement; the sidecar container performs SQL parsing, SQL rewriting, and SQL execution on the first SQL statement. The present invention solves the technical problem in the prior art that keys and encryption rules are scattered across various systems and cannot be centrally managed, resulting in low security standards.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method for implementing universal data encryption based on a service grid. Background Art

[0002] In the context of information technology data security, especially in cloud computing, big data and other scenarios, secure storage of enterprise data is crucial, and data encryption has become one of the key means to protect enterprise data and user personal privacy information (ID card, mobile phone number, bank card number, etc.).

[0003] Existing technologies implement data encryption based on SDKs, specifically using AOP technology to reflectively obtain entity attributes and encrypt and decrypt their fields; data encryption and decryption is implemented based on native JDBC or an ORM framework; and the entire data file is encrypted. Encryption based on an ORM framework requires a strong coupling of the system to the encryption SDK, making maintenance and upgrades difficult, resulting in poor compatibility and limiting system flexibility. Keys and encryption rules are scattered across various systems and cannot be centrally managed, resulting in low security standards and the lack of unified standards, making data sharing impossible. Encryption of the entire file is based on encrypted storage of data files, but encryption of rows and columns in tables is not supported, resulting in inflexibility and limited business scenarios. It also makes it difficult to transform and upgrade legacy systems and systems written in heterogeneous languages. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method for implementing universal data encryption based on a service grid, so as to at least solve some of the above technical problems.

[0005] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0006] A method for implementing universal data encryption based on a service grid includes the following steps:

[0007] S1. When the first business system is deployed online, add the corresponding sidecar container to the Pod;

[0008] S2. When the sidecar container starts, it pulls the first configuration information corresponding to the first business system from the control plane. The first configuration information includes: target database instance information, encryption algorithm, key, and encryption rules;

[0009] S3. The sidecar container adds iptables rules to the target database instance information in the first configuration information.

[0010] S4. The first business system initiates a first business request;

[0011] S5. The sidecar container intercepts the first business request according to the iptables rule and parses the intercepted first business request according to the target database binary protocol specification to obtain the first SQL statement.

[0012] S6. The sidecar container determines whether the first SQL statement has a library table field encryption operation based on the encryption rules in the first configuration information. If a library table field encryption operation is required, the sidecar container performs SQL parsing, SQL rewriting, and SQL execution on the first SQL statement based on the encryption rules, encryption algorithm, and key in the first configuration information. Otherwise, the sidecar container performs SQL execution on the first SQL statement.

[0013] Furthermore, the process of performing SQL parsing, SQL rewriting, and SQL execution on the first SQL statement includes:

[0014] SQL parsing: converting the first SQL statement into corresponding first structured data through a parser;

[0015] SQL rewriting: obtaining the fields to be encrypted in the first structured data according to the encryption rules in the first configuration information; applying the encryption algorithm to the fields to be encrypted to obtain encrypted values; replacing the plaintext values ​​in the first SQL statement with the encrypted values ​​to generate a third SQL statement;

[0016] SQL execution: Parse the user name, password, driver type, and target database address in the first configuration information, establish a target database connection based on the user name, password, driver type, and target database address, execute the third SQL statement, and process the corresponding result set;

[0017] If there are fields in the result set that need to be decrypted, the fields in the result set that need to be decrypted are decrypted according to the corresponding encryption algorithm.

[0018] Furthermore, S1 also includes:

[0019] SA,For the second business system that cannot install the sidecar container, the sidecar is centrally deployed to form a proxy gateway;

[0020] When the SB and proxy gateways are started, they obtain the second configuration information corresponding to the second business system from the control plane. The second configuration information includes: target database instance information, encryption rules, encryption algorithms, and keys.

[0021] The SC and the second business system initiate a second business request;

[0022] The SD and the proxy gateway parse the second service request according to the target database binary protocol specification to obtain a second SQL statement;

[0023] SE and the proxy gateway determine whether the second SQL statement has a library table field encryption operation based on the encryption rules in the second configuration information; if there is a library table field encryption operation, the second SQL statement is SQL parsed, SQL rewritten, and SQL executed based on the encryption rules, encryption algorithm, and key in the second configuration information; otherwise, the second SQL statement is SQL executed.

[0024] Furthermore, the process of performing SQL parsing, SQL rewriting, and SQL execution on the second SQL statement includes:

[0025] SQL parsing: converting the second SQL statement into corresponding second structured data through a parser;

[0026] SQL rewriting: obtaining the fields to be encrypted in the second structured data according to the encryption rules in the second configuration information; applying the encryption algorithm to the fields to be encrypted to obtain encrypted values; replacing the plaintext values ​​in the second SQL statement with the encrypted values ​​to generate a fourth SQL statement;

[0027] SQL execution: parsing the user name, password, driver type, and target database address in the second configuration information, establishing a target database connection based on the user name, password, driver type, and target database address, executing the fourth SQL statement, and processing the corresponding result set;

[0028] If there are fields in the result set that need to be decrypted, the fields in the result set that need to be decrypted are decrypted according to the corresponding encryption algorithm.

[0029] Furthermore, the first SQL statement or the second SQL statement is parsed into a first abstract syntax tree or a second abstract syntax tree through the JSqlParser parser.

[0030] Furthermore, S2 also includes: according to obtaining multiple encryption algorithms from the control plane, each encryption algorithm corresponds to a plug-in package, and the sidecar container downloads and dynamically loads the plug-in package corresponding to the encryption algorithm from the control plane.

[0031] Furthermore, the dynamic loading method is the Java SPI mechanism.

[0032] Furthermore, the encryption algorithms include: MD5, RSA, AES, and SM4.

[0033] Furthermore, the target databases include: MySQL, DB2, Oracle, and TiDB.

[0034] Furthermore, the second business system includes a first client that can only be deployed on a host, the first client includes: Go app1, Java app2; the second business system also includes a second client with a database protocol, the second client includes: dbeaver, mysql CLI and mysql GUI.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] The present invention completes the interception of the first business request of the first business system through the sidecar container and performs target database binary protocol specification analysis on the intercepted first business request to obtain a first SQL statement, and then performs SQL analysis, SQL rewriting, SQL execution, or SQL execution based on the first configuration information obtained from the control plane to complete data encryption and decryption. The present invention also receives the second business request of the second business system through the proxy gateway and performs target database binary protocol specification analysis on the second business request to obtain a second SQL statement, and then performs SQL analysis, SQL rewriting, SQL, or SQL execution based on the second configuration information obtained from the control plane to complete data encryption and decryption. The first configuration information and the second configuration information loaded by the sidecar container and the proxy gateway respectively are uniformly managed and issued by the control plane, which solves the technical problems in the prior art that keys and encryption rules are scattered in various systems and cannot be centrally managed, and the security standards are low. In addition, the business can complete seamless access to different databases without any modification, realizing data encryption in various scenarios.

[0037] In the present invention, multiple encryption algorithms are obtained from the control plane, each encryption algorithm corresponds to a plug-in package, and the sidecar container downloads and dynamically loads the plug-in package corresponding to the encryption algorithm from the control plane, which can achieve dynamic configuration and good scalability, and realize high availability and scalability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of the steps of the present invention. DETAILED DESCRIPTION

[0039] Explanation of terms:

[0040] Pod is the smallest deployment unit in Kubernetes and can contain one or more containers;

[0041] Iptables is a tool used to configure firewall rules in Linux systems;

[0042] SQL is a standard programming language for managing relational databases;

[0043] Statement is an object used to execute SQL statements;

[0044] PreparedStatement is a sub-interface of Statement;

[0045] JSqlParser is a Java library;

[0046] Java SPI is a service provider interface mechanism that allows third parties to implement or extend the functionality of an application.

[0047] DBA is a platform for managing and monitoring databases;

[0048] MD5 is a hash function;

[0049] RSA is an asymmetric encryption algorithm;

[0050] AES is a symmetric encryption algorithm;

[0051] SM4 is a domestically produced symmetric encryption algorithm;

[0052] Mysql is a popular open source relational database management system;

[0053] DB2 is a relational database management system developed by IBM;

[0054] Oracle is an enterprise-level relational database management system;

[0055] Tidb is a distributed relational database;

[0056] Go app1 is a client application written in Go language;

[0057] Java app2 is a client application written in Java;

[0058] DBeaver is a multi-database management tool;

[0059] mysql CLI is the command-line tool for MySQL;

[0060] MySQL GUI is a graphical management tool for MySQL;

[0061] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0062] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have a specific orientation or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0063] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; of course, they may also refer to mechanical connections or electrical connections; in addition, they may refer to direct connections, indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0064] like Figure 1 As shown, a method for implementing universal data encryption based on a service grid includes the following steps:

[0065] S1. When the first business system is deployed online, add the corresponding sidecar container to the Pod;

[0066] S2. When the sidecar container starts, it pulls the first configuration information corresponding to the first business system from the control plane. The first configuration information includes: target database instance information, encryption algorithm, key, and encryption rules;

[0067] S3. The sidecar container adds iptables rules to the target database instance information in the first configuration information.

[0068] S4. The first business system initiates a first business request;

[0069] S5. The sidecar container intercepts the first business request according to the iptables rule and parses the intercepted first business request according to the target database binary protocol specification to obtain the first SQL statement.

[0070] S6. The sidecar container determines whether the first SQL statement has a library table field encryption operation based on the encryption rules in the first configuration information. If a library table field encryption operation is required, the sidecar container performs SQL parsing, SQL rewriting, and SQL execution on the first SQL statement based on the encryption rules, encryption algorithm, and key in the first configuration information. Otherwise, the sidecar container performs SQL execution on the first SQL statement.

[0071] Encryption algorithms include: MD5, RSA, AES, and SM4.

[0072] Target databases include: MySQL, DB2, Oracle, and TiDB.

[0073] In this embodiment, the sidecar container intercepts a first business request from a first business system and parses the intercepted first business request according to the target database's binary protocol specification to obtain a first SQL statement. Data encryption and decryption is then performed based on the first configuration information obtained from the control plane by performing SQL parsing, SQL rewriting, SQL execution, or SQL execution. The first configuration information loaded by the sidecar container is centrally managed and distributed by the control plane, resolving the existing technical issues of keys and encryption rules being dispersed across various systems and unable to be centrally managed, resulting in low security standards. Furthermore, the service can seamlessly access different databases without any modification, enabling data encryption in a variety of scenarios.

[0074] The present invention implements a method for universal data encryption based on a service grid. In one embodiment, the process of performing SQL parsing, SQL rewriting, and SQL execution on a first SQL statement includes:

[0075] SQL parsing: converting the first SQL statement into corresponding first structured data through a parser;

[0076] SQL rewriting: obtaining the fields to be encrypted in the first structured data according to the encryption rules in the first configuration information; applying the encryption algorithm to the fields to be encrypted to obtain encrypted values; replacing the plaintext values ​​in the first SQL statement with the encrypted values ​​to generate a third SQL statement;

[0077] SQL execution: Parse the user name, password, driver type, and target database address in the first configuration information, establish a target database connection based on the user name, password, driver type, and target database address, execute the third SQL statement, and process the corresponding result set;

[0078] If there are fields in the result set that need to be decrypted, the fields in the result set that need to be decrypted are decrypted according to the corresponding encryption algorithm.

[0079] In this embodiment, SQL rewriting implements encryption of rows and columns in a table. Compared with the prior art that does not support encryption of rows and columns in a table, this embodiment is more flexible and applicable to a wider range of business scenarios.

[0080] The present invention implements a method for universal data encryption based on a service grid. In one embodiment, S1 further includes:

[0081] SA,For the second business system that cannot install the sidecar container, the sidecar is centrally deployed to form a proxy gateway;

[0082] When the SB and proxy gateways are started, they obtain the second configuration information corresponding to the second business system from the control plane. The second configuration information includes: target database instance information, encryption rules, encryption algorithms, and keys.

[0083] The SC and the second business system initiate a second business request;

[0084] The SD and the proxy gateway parse the second service request according to the target database binary protocol specification to obtain a second SQL statement;

[0085] SE and the proxy gateway determine whether the second SQL statement has a library table field encryption operation based on the encryption rules in the second configuration information; if there is a library table field encryption operation, the second SQL statement is SQL parsed, SQL rewritten, and SQL executed based on the encryption rules, encryption algorithm, and key in the second configuration information; otherwise, the second SQL statement is SQL executed.

[0086] Encryption algorithms include: MD5, RSA, AES, and SM4.

[0087] Target databases include: MySQL, DB2, Oracle, and TiDB.

[0088] The second business system includes a first client that can only be deployed on the host. The first client includes: Go app1 and Java app2. The second business system also includes a second client that supports database protocols. The second client includes: dbeaver, MySQL CLI, and MySQL GUI. The first client is a client that is written in heterogeneous languages ​​or cannot be containerized and can only be deployed on the host. This solves the technical problem of the existing technology that is difficult to retrofit and upgrade legacy systems and heterogeneous languages.

[0089] In this embodiment, a second business request of a second business system is received through a proxy gateway, and the second business request is parsed according to the target database binary protocol specification to obtain a second SQL statement. Then, based on the second configuration information obtained from the control plane, SQL parsing, SQL rewriting, SQL or SQL execution are performed to complete data encryption and decryption. The second configuration information loaded by the proxy gateway is uniformly managed and issued by the control plane, which solves the technical problems in the prior art that keys and encryption rules are scattered in various systems and cannot be centrally managed, resulting in low security standards. In addition, the business can complete seamless access to different databases without any modification, realizing data encryption in multiple scenarios.

[0090] The present invention implements a method for universal data encryption based on a service grid. In one embodiment, the process of performing SQL parsing, SQL rewriting, and SQL execution on the second SQL statement includes:

[0091] SQL parsing: converting the second SQL statement into corresponding second structured data through a parser;

[0092] SQL rewriting: obtaining the fields to be encrypted in the second structured data according to the encryption rules in the second configuration information; applying the encryption algorithm to the fields to be encrypted to obtain encrypted values; replacing the plaintext values ​​in the second SQL statement with the encrypted values ​​to generate a fourth SQL statement;

[0093] SQL execution: parsing the user name, password, driver type, and target database address in the second configuration information, establishing a target database connection based on the user name, password, driver type, and target database address, executing the fourth SQL statement, and processing the corresponding result set;

[0094] If there are fields in the result set that need to be decrypted, the fields in the result set that need to be decrypted are decrypted according to the corresponding encryption algorithm.

[0095] In this embodiment, SQL rewriting implements encryption of rows and columns in a table. Compared with the prior art that does not support encryption of rows and columns in a table, this embodiment is more flexible and applicable to a wider range of business scenarios.

[0096] Preferably, the first SQL statement or the second SQL statement is parsed into a first abstract syntax tree or a second abstract syntax tree by a JSqlParser parser.

[0097] The present invention implements a method for implementing universal data encryption based on a service grid. In one embodiment, S2 further includes: obtaining multiple encryption algorithms from a control plane, each corresponding to a plug-in package, and downloading and dynamically loading the plug-in package corresponding to the encryption algorithm from the control plane in a sidecar container. The dynamic loading method uses the Java SPI mechanism.

[0098] In this embodiment, based on obtaining multiple encryption algorithms from the control plane, each encryption algorithm corresponds to a plug-in package. The sidecar container downloads and dynamically loads the plug-in package corresponding to the encryption algorithm from the control plane, which can achieve dynamic configuration and good scalability, and realize high availability and scalability of the system.

[0099] Preferably, the dynamic loading method is the Java SPI mechanism.

[0100] Finally, it should be noted that the above embodiments are merely preferred embodiments of the present invention and are intended to illustrate the technical solutions of the present invention, rather than limiting them, and certainly not limiting the patent scope of the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some or all of the technical features therein may be replaced by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention. In other words, any changes or refinements made to the main design concept and spirit of the present invention that have no substantive significance, provided that the technical problems they solve are still consistent with those of the present invention, should be included in the protection scope of the present invention. In addition, the direct or indirect application of the technical solutions of the present invention to other related technical fields should also be included in the patent protection scope of the present invention.

Claims

1. A method for implementing universal data encryption based on a service grid, characterized in that: The steps include: S1. When the first business system is deployed online, add the corresponding sidecar container to the Pod; S2. When the sidecar container starts, it pulls the first configuration information corresponding to the first business system from the control plane. The first configuration information includes: target database instance information, encryption algorithm, key, and encryption rules; S3. The sidecar container adds iptables rules to the target database instance information in the first configuration information. S4. The first business system initiates a first business request; S5. The sidecar container intercepts the first business request according to the iptables rule and parses the intercepted first business request according to the target database binary protocol specification to obtain the first SQL statement. S6. The sidecar container determines whether the first SQL statement has a table or field encryption operation based on the encryption rules in the first configuration information. If so, the sidecar container performs SQL parsing, SQL rewriting, and SQL execution on the first SQL statement based on the encryption rules, encryption algorithm, and key in the first configuration information. Otherwise, the sidecar container performs SQL execution on the first SQL statement. S1 also includes: SA,For the second business system that cannot install the sidecar container, the sidecar is centrally deployed to form a proxy gateway; When the SB and proxy gateways are started, they obtain the second configuration information corresponding to the second business system from the control plane. The second configuration information includes: target database instance information, encryption rules, encryption algorithms, and keys. The SC and the second business system initiate a second business request; The SD and the proxy gateway parse the second service request according to the target database binary protocol specification to obtain a second SQL statement; SE and the proxy gateway determine whether the second SQL statement has a library table field encryption operation based on the encryption rules in the second configuration information; if there is a library table field encryption operation, the second SQL statement is SQL parsed, SQL rewritten, and SQL executed based on the encryption rules, encryption algorithm, and key in the second configuration information; otherwise, the second SQL statement is SQL executed.

2. The method for implementing universal data encryption based on a service grid according to claim 1, characterized in that: The process of performing SQL parsing, SQL rewriting, and SQL execution on the first SQL statement includes: SQL parsing: converting the first SQL statement into corresponding first structured data through a parser; SQL rewriting: obtaining the fields to be encrypted in the first structured data according to the encryption rules in the first configuration information; applying the encryption algorithm to the fields to be encrypted to obtain encrypted values; replacing the plaintext values ​​in the first SQL statement with the encrypted values ​​to generate a third SQL statement; SQL execution: Parse the user name, password, driver type, and target database address in the first configuration information, establish a target database connection based on the user name, password, driver type, and target database address, execute the third SQL statement, and process the corresponding result set; If there are fields in the result set that need to be decrypted, the fields in the result set that need to be decrypted are decrypted according to the corresponding encryption algorithm.

3. The method for implementing universal data encryption based on a service grid according to claim 1, characterized in that: The process of performing SQL parsing, SQL rewriting, and SQL execution on the second SQL statement includes: SQL parsing: converting the second SQL statement into corresponding second structured data through a parser; SQL rewriting: obtaining the fields to be encrypted in the second structured data according to the encryption rules in the second configuration information; applying the encryption algorithm to the fields to be encrypted to obtain encrypted values; replacing the plaintext values ​​in the second SQL statement with the encrypted values ​​to generate a fourth SQL statement; SQL execution: parsing the user name, password, driver type, and target database address in the second configuration information, establishing a target database connection based on the user name, password, driver type, and target database address, executing the fourth SQL statement, and processing the corresponding result set; If there are fields in the result set that need to be decrypted, the fields in the result set that need to be decrypted are decrypted according to the corresponding encryption algorithm.

4. The method for implementing universal data encryption based on a service grid according to claim 3, characterized in that: The first SQL statement or the second SQL statement is parsed into a first abstract syntax tree or a second abstract syntax tree through the JSqlParser parser.

5. The method for implementing universal data encryption based on a service grid according to claim 1, characterized in that: S2 also includes: according to obtaining multiple encryption algorithms from the control plane, each encryption algorithm corresponds to a plug-in package, and the sidecar container downloads and dynamically loads the plug-in package corresponding to the encryption algorithm from the control plane.

6. The method for implementing universal data encryption based on a service grid according to claim 5, characterized in that: The dynamic loading method is the Java SPI mechanism.

7. The method for implementing universal data encryption based on a service grid according to claim 1, characterized in that: Encryption algorithms include: MD5, RSA, AES, and SM4.

8. The method for implementing universal data encryption based on a service grid according to claim 1, characterized in that: Target databases include: MySQL, DB2, Oracle, and TiDB.

9. The method for implementing universal data encryption based on a service grid according to claim 1, wherein: The second business system includes a first client that can only be deployed on a host, the first client includes: Go app1, Javaapp2; the second business system also includes a second client with a database protocol, the second client includes: dbeaver, mysql CLI and mysql GUI.

Images