Encryption and decryption strategy processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an encryption and decryption strategy processing method and device, electronic equipment and a storage medium. The method comprises the following steps: vectorizing a password transformation description text to obtain a first text vector, and obtaining a second text vector obtained by vectorizing a first preset query text; the first preset query text is used for querying key data fields defined in the password transformation description text. And retrieving a text vector matched with the second text vector from the first text vector as a target text vector. And identifying a table field matched with the key data field indicated by the target text vector from table fields of the to-be-transformed system as a target table field. And selecting a target encryption and decryption strategy adaptive to the target table field from preset encryption and decryption strategies based on the field related characteristics of the target table field. In this way, the processing efficiency can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a method, device, electronic device and storage medium for processing encryption and decryption strategies. Background Art

[0002] With the continuous development of computer technology, database applications are becoming more and more widespread. For example, a network operator may build a database system for an application program. To ensure the security of the database in the database system, the database system needs to be password modified.

[0003] In the prior art, when performing password modification, manual analysis of the password modification description text is performed to determine which table fields in the modified system to be transparently encrypted and decrypted, and to manually select transparent encryption and decryption strategies for these table fields. This processing method is inefficient. Summary of the Invention

[0004] The present invention provides a method, device, electronic device and storage medium for processing encryption and decryption strategies to solve the technical problem of low processing efficiency.

[0005] In a first aspect, the present invention provides a method for processing encryption and decryption policies, the method comprising:

[0006] performing vectorization processing on the password transformation description text to obtain a first text vector, and obtaining a second text vector obtained by vectorizing a first preset query text, wherein the first preset query text is used to query a key data field defined in the password transformation description text;

[0007] Retrieving a text vector that matches the second text vector from the first text vector as a target text vector;

[0008] Identify, from the table fields of the system to be transformed, a table field that matches the key data field indicated by the target text vector as a target table field;

[0009] Based on the field-related characteristics of the target table field, a target encryption and decryption strategy adapted to the target table field is selected from preset encryption and decryption strategies.

[0010] In a second aspect, the present invention provides a device for processing encryption and decryption strategies, the device comprising:

[0011] a processing module configured to vectorize the password transformation description text to obtain a first text vector, and to obtain a second text vector obtained by vectorizing a first preset query text, wherein the first preset query text is used to query a key data field defined in the password transformation description text;

[0012] a retrieval module, configured to retrieve a text vector matching the second text vector from the first text vector as a target text vector;

[0013] an identification module, configured to identify, from table fields of the system to be transformed, table fields that match the key data fields indicated by the target text vector, as target table fields;

[0014] The selection module is configured to select a target encryption and decryption strategy adapted to the target table field from preset encryption and decryption strategies based on the field-related characteristics of the target table field.

[0015] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements a processing method for the above-mentioned encryption and decryption strategy when executing the program.

[0016] In a fourth aspect, the present invention provides a readable storage medium, which, when the instructions in the readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the processing method of the above-mentioned encryption and decryption strategy.

[0017] In an embodiment of the present invention, a password transformation description text is vectorized to obtain a first text vector, and a second text vector obtained by vectorizing a first preset query text is obtained; the first preset query text is used to query the key data field defined in the password transformation description text. A text vector that matches the second text vector is retrieved from the first text vector as a target text vector. A table field that matches the key data field indicated by the target text vector is identified from the table field of the system to be transformed as a target table field. Based on the field-related features of the target table field, a target encryption and decryption strategy that is adapted to the target table field is selected from the preset encryption and decryption strategies. In this way, the target table field that needs to be transparently encrypted and decrypted is automatically determined, and based on the field-related features of the target table field, an adapted target encryption and decryption strategy is automatically selected for the target table field without manual processing, thereby improving processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present invention;

[0020] Figure 2 It is a processing flow diagram in the prior art;

[0021] Figure 3 This is a flowchart of a method for processing an encryption and decryption strategy provided by an embodiment of the present invention;

[0022] Figure 4 This is a schematic diagram of a processing process provided by an embodiment of the present invention;

[0023] Figure 5 is another processing process schematic diagram provided by an embodiment of the present invention;

[0024] Figure 6 This is a structural diagram of a processing device for an encryption and decryption strategy provided by an embodiment of the present invention;

[0025] Figure 7 This is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0027] First, an application scenario of the embodiment of the present invention is described. The method for processing encryption and decryption strategies provided by the embodiment of the present invention can be applied to a scenario where password modification is performed on a database system. Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present invention. The encryption and decryption policy processing method can be executed by a password modification system. The password modification system can be deployed on a local electronic device (e.g., a server) or in the cloud. When the password modification of the system to be modified is required, the password modification system in the cloud can be called to execute the encryption and decryption policy processing method. The system to be modified is any database system that requires password modification. In the field of information technology (IT) software and development, database systems are developed for application programs. A database system is a system consisting of a database and its management software.

[0028] Data security is becoming increasingly important. If certain data (for example, data from important industries and sectors such as public communications and information services, energy, transportation, water conservancy, finance, public services, and e-government) is compromised, loses functionality, or is leaked, it could seriously endanger critical information infrastructure related to public safety, the economy, people's livelihoods, and the public interest. To prioritize data protection and ensure network data security, the Multi-Level Protection (MLP) system has emerged. Network operators must fulfill their security obligations in accordance with the MLP system, protecting their networks from interference, disruption, or unauthorized access, and preventing network data leaks, theft, and tampering. Accordingly, in order for database systems to pass the MLP assessment (MLP assessment) and comply with the MLP system and cryptographic compliance requirements, they must undergo cryptographic modification. This process, also known as cryptographic modification, involves determining the database table fields requiring transparent encryption and decryption, as well as the transparent encryption and decryption policies to be used, according to a cryptographic modification plan (also known as a password modification report or system cryptographic modification plan). The system then configures the transparent encryption and decryption policies for these database table fields, thereby implementing the cryptographic modification. Password modification enables the database system to pass security assessments. Transparent encryption and decryption is a security technology and service based on encryption algorithms. Transparent encryption and decryption automatically encrypts and decrypts data in the background of the system, without affecting users' normal operations and use of data.

[0029] In the existing technology, the table fields for transparent encryption and decryption and the selection of transparent encryption and decryption strategies are determined manually. This method often requires the collaboration of multiple professionals to complete the password modification work, which is time-consuming and labor-intensive, has low processing efficiency, and is also accompanied by other problems. Specifically, Figure 2 It is a processing flow diagram in the prior art, such as Figure 2As shown, professional cryptographic reviewers must first conduct a comprehensive analysis and interpretation of the cryptographic transformation plan. For example, they must manually decipher key steps, key scoring points, and critical information. This analysis, combined with the table fields of the system to be transformed, will determine which table fields require transparent encryption and decryption. Cryptography engineers from the cryptographic vendor will then design the encryption algorithm and encryption process. Specifically, they will select encryption and decryption strategies for the table fields to be transparently encrypted and decrypted, and create a transparent encryption and decryption configuration document. Next, general system developers will need to study the transparent encryption and decryption configuration document provided by the vendor and configure the transparent encryption and decryption strategies. Because the cryptographic transformation plan contains a large amount of information and covers a wide range of topics, manual interpretation is labor-intensive and labor-intensive. Furthermore, existing technologies require professionals to possess specialized knowledge of cryptographic transformation, algorithms, and system development. Therefore, the technical threshold is high. Furthermore, this approach relies on the technical experience and expertise of the technicians, and manual methods are prone to omissions and imperfections, which can lead to failure of the cryptographic review, affecting the final project acceptance, resulting in repeated rework, and wasted processing resources and labor.

[0030] The following describes in detail the method for processing the encryption and decryption strategy provided by the embodiment of the present invention.

[0031] Figure 3 This is a flowchart of a method for processing an encryption and decryption strategy provided by an embodiment of the present invention. Figure 3 As shown, the method may include:

[0032] Step 101: vectorize the password transformation description text to obtain a first text vector, and obtain a second text vector obtained by vectorizing a first preset query text; the first preset query text is used to query the key data fields defined in the password transformation description text.

[0033] Step 102: Retrieve a text vector that matches the second text vector from the first text vector as a target text vector.

[0034] Step 103: Identify, from the table fields of the system to be transformed, a table field that matches the key data field indicated by the target text vector and uses it as the target table field.

[0035] Step 104: Based on the field-related characteristics of the target table field, a target encryption and decryption strategy adapted to the target table field is selected from preset encryption and decryption strategies.

[0036] In the embodiments of the present invention, the password modification description text is the aforementioned password modification plan. The password modification plan can be issued by a professional password assessment agency. The password modification plan includes text describing the system to be modified, the industry to which the system to be modified belongs, the password security level, and the key data fields to be protected. The password modification plan for the system to be modified can be used as the password modification description text and input into the password modification system, where it can be processed according to the method provided in the embodiments of the present invention.

[0037] Furthermore, the password modification description text can be vectorized based on text-to-vector (text2vec) technology to obtain a first text vector. There can be multiple first text vectors, each of which is a vector representation of the text content in the password modification description text. For example, since the password modification plan includes text describing information such as an introduction to the system to be modified, the industry to which the system to be modified belongs, the password security level, and key data fields that need to be protected (e.g., username, password, key, etc.), the first text vector includes text vectors describing information such as an introduction to the system to be modified, the industry to which the system to be modified belongs, the password security level, and the key data fields that need to be protected. For example, the vectorization can be performed on a sentence basis. For example, assuming that the password modification plan includes the sentence "Key data fields of the system to be modified: identity identification," then after vectorization, a first text vector representing "Key data fields of the system to be modified: identity identification" is obtained.

[0038] The first preset query text can be vectorized based on the text2vec technology to obtain a second text vector, and the second text vector is a vector representation of the first preset query text. The first preset query text can be pre-set by the developer. For example, the first preset query text can be "What are the key data fields of the system to be transformed?" Then, after vectorization, a second text vector representing "What are the key data fields of the system to be transformed?" is obtained. It should be noted that the operation of vectorizing the first preset query text to obtain the second text vector can be performed in advance, and accordingly, the second text vector generated before can be directly read. Alternatively, the first preset query text can be read and vectorized when executing step 101, and the embodiment of the present invention does not limit this.

[0039] Furthermore, a first text vector similar to the second text vector can be retrieved as a target text vector. Since the second text vector is a vector representation of the query text for querying the key data field defined in the password transformation description text, the first text vector similar to the second text vector is a vector representation of the text content representing the key data field in the password transformation description text. Accordingly, since the key data field defined in the password transformation description text represents the field that needs to be transparently encrypted and decrypted for this password transformation. Therefore, based on the key data field indicated by the target text vector, it can be determined from the table fields of the system to be transformed which table fields of the system to be transformed need to be transparently encrypted and decrypted. There can be multiple target table fields, and a table field that matches the key data field indicated by the target text vector is a target table field. The target table field is the table field that needs to be transparently encrypted and decrypted in the transformation system.

[0040] Among them, the table fields of the system to be transformed can be predetermined based on the table structure of the system to be transformed. For example, the database table structure of the system to be transformed can be imported into the password transformation system in advance, and the password transformation system can parse the database table structure to extract the table field information therein to obtain the table fields of the system to be transformed. Among them, the table structure of the system to be transformed is the table structure of the database in the system to be transformed. The table structure defines the organization method of storing data in the database table, including which fields (i.e., table fields) are in the table, the data type of each field, and the relationship between the fields. Among them, the table fields are the basic elements that constitute the database table and are used to store specific information of data records. The table fields of the system to be transformed are the fields recorded in the database of the system to be transformed.

[0041] In an embodiment of the present invention, the target table field represents a table field that needs to be transparently encrypted and decrypted, and the table field that matches the key data field indicated by the target text vector is the target table field. For any target table field, the target encryption and decryption strategy is selected based on the field-related features of the target table field and the preset encryption and decryption strategy. The field-related features of the target table field can be used to represent the characteristics of the target table field, so that the selected target encryption and decryption strategy can be more suitable for the target table field. There can be multiple preset encryption and decryption strategies. A preset encryption and decryption strategy defines an encryption and decryption algorithm and an encryption and decryption algorithm process.

[0042] In summary, the method for processing encryption and decryption strategies provided by the embodiment of the present invention vectorizes the password transformation description text to obtain a first text vector, and obtains a second text vector obtained by vectorizing the first preset query text; the first preset query text is used to query the key data field defined in the password transformation description text. A text vector that matches the second text vector is retrieved from the first text vector as the target text vector. A table field that matches the key data field indicated by the target text vector is identified from the table field of the system to be transformed as the target table field. Based on the field-related features of the target table field, a target encryption and decryption strategy that is adapted to the target table field is selected from the preset encryption and decryption strategies. In this way, the target table field that needs to be transparently encrypted and decrypted is automatically determined, and based on the field-related features of the target table field, an adapted target encryption and decryption strategy is automatically selected for the target table field without manual processing, thereby improving processing efficiency.

[0043] At the same time, since there is no need for manual processing by technical personnel, the large workload and high labor costs of manual interpretation can be avoided, the technical threshold can be lowered, and omissions and imperfections caused by insufficient experience and professionalism of technical personnel can be avoided, thereby avoiding the resulting failure to pass the confidential review, affecting the final acceptance of the project, and causing repeated rework, waste of processing resources and labor.

[0044] Optionally, in the embodiment of the present invention, the vectorization processing of the password modification description text to obtain the first text vector may specifically include:

[0045] Step 1011: Divide the password modification description text into multiple text blocks according to a preset number of words.

[0046] Step 1012: Identify text blocks belonging to the same document title among the multiple text blocks, and merge the text blocks belonging to the same document title.

[0047] Step 1013: perform vectorization processing on the text block to obtain the first text vector.

[0048] In this embodiment of the present invention, the password modification description text is automatically segmented according to a preset word count and document title, and then automatically identified, parsed, and vectorized. In specific application scenarios, password modification description texts often follow a common template, which sets different document titles based on the eight aspects of password assessment (for example, physical and environmental security, network and communication security, equipment and computing security, application and data security, management system, personnel management, construction and operation, and emergency response).

[0049] Specifically, the preset number of characters can be predefined. For example, the preset number of characters can be 100, 200, or the like, which is not limited in the embodiments of the present invention. The preset number of characters can be represented by m. Starting from the starting position of the password modification description text, each m characters can be considered as a text block, thereby obtaining multiple text blocks. It should be noted that after the text blocks are divided, the text blocks can also be cleaned. For example, irrelevant characters (e.g., special symbols, numbers, etc.) and repeated characters can be removed from the text blocks. Furthermore, document titles often use a format different from the main text. Text that conforms to a preset document title format can be identified from the password modification description text to obtain the document title. For example, the preset document title format can be a format defined in a universal template, which can include the position, font, and font size of the document title. For any document title, the text block between the document title and the next document title is determined as the text block belonging to the document title. If there are multiple text blocks belonging to the document title, these multiple text blocks are merged into a single text block. If there is only one text block belonging to the document title, no merging is performed.

[0050] Then, the text blocks are respectively used as inputs of a preset vectorization model, and the output of the vectorization model is used as the first text vector. The preset vectorization model can be selected according to actual needs. For example, the preset vectorization model can be an embedding model. The embedding model is a technology that maps discrete objects to a continuous vector space. These vectors can capture the semantic and syntactic characteristics of the objects. In the fields of natural language processing (NLP) and information retrieval, the embedding model is widely used in text representation and analysis. For example, the embedding model can first perform word embedding, map the word segments in the text block to word vectors, and then average the vectors of each word segment in the sentence to obtain the vector representation of the sentence. Alternatively, sentence embedding can be performed directly, mapping the entire sentence to the vector space to obtain the vector representation of the sentence, that is, obtaining a first text vector. It should be noted that in an embodiment of the present invention, after obtaining the first text vector, the first text vector can be stored in a preset vector database (also referred to as a vector knowledge base). For example, the vector database can be a faiss vector database to achieve vectorized storage. It should be noted that, when the first preset query text is vectorized, the first preset query text may be input into a preset vectorization model, and the output of the preset vectorization model may be used as the second text vector.

[0051] In an embodiment of the present invention, texts belonging to the same document title often have similar semantics. Therefore, after being divided according to a preset number of words, they are merged according to the document title to avoid the texts belonging to the same document title being cut into different text blocks, that is, to ensure that the same information is cut into the same paragraph, thereby ensuring the vectorization effect of the text block.

[0052] Optionally, the above step 102 may include:

[0053] Step 1021: Determine the vector similarity between each of the first text vectors and the second text vector.

[0054] Step 1022: Determine the first text vector whose vector similarity meets the preset vector similarity condition as the target text vector.

[0055] In an embodiment of the present invention, a vector similarity algorithm can be used to retrieve and recall the first text vectors stored in the vector database to find the first text vectors that are similar in content to the second text vector. Among them, for any first text vector, the vector similarity between the first text vector and the second text vector is an indicator that measures the degree of similarity between the two text vectors in the vector space. The higher the vector similarity, the closer the direction and size of the two text vectors in the vector space, and accordingly, the more similar the text content represented by the two text vectors is. Exemplarily, the cosine similarity between the first text vector and the second text vector can be calculated based on the cosine similarity algorithm as the vector similarity between the two.

[0056] Furthermore, the preset vector similarity condition can be pre-set. For example, the preset vector similarity condition can be the maximum vector similarity. Accordingly, the first text vector with the maximum vector similarity can be selected from the multiple first text vectors as the target text vector. Alternatively, the preset vector similarity condition can be the vector similarity being greater than a preset similarity threshold, which is not limited in this embodiment of the present invention.

[0057] In the embodiment of the present invention, the vector similarity between each first text vector and the second text vector is first determined, and then the first text vector whose vector similarity meets the preset vector similarity condition is selected to obtain the target text vector. In this way, the efficiency of determining the target text vector can be ensured to a certain extent.

[0058] Optionally, the step of identifying, from the table fields of the system to be transformed, a table field that matches the key data field indicated by the target text vector as the target table field may specifically include:

[0059] Step 1031 : Determine the semantic similarity between each of the table fields of the system to be transformed and the key data field, and determine the table field whose semantic similarity is greater than a preset semantic similarity threshold as the target table field.

[0060] And / or, step 1032: performing regular expression matching on each of the table fields of the system to be transformed based on the key data field, and determining the matched table field as the target table field.

[0061] For step 1031, each table field of the system to be transformed can be vectorized to obtain a vector representation of each table field. Among them, the method of vectorizing the table field can refer to the aforementioned method of vectorization, which will not be repeated here. Then, the vector similarity between the vector representation of the table field and the target text vector is calculated. Among them, the implementation method of calculating the vector similarity can refer to the aforementioned description, which will not be repeated here. For any table field, if the vector similarity between the vector representation of the table field and the target text vector is greater than the preset similarity threshold, it is determined that the semantic similarity between the table field and the key data field is greater than the preset semantic similarity threshold. Accordingly, the table field is determined as a target table field. In an embodiment of the present invention, by determining the semantic similarity between each table field and the key data field, the target table field can be determined based on the semantic similarity. Therefore, processing efficiency can be ensured to a certain extent.

[0062] In step 1032, regular expressions are used for matching and alignment to determine the target table field. Specifically, vector-to-text technology can be used to convert the target text vector into text to obtain the target text. The process of converting the text vector back into text is called the inverse process of vectorization and can be implemented based on existing conversion tools. Next, the target text is segmented to obtain the words included in the target text. Then, the auxiliary words in the words are removed, and the remaining words are used as characters in the regular expression. The regular expression is used to perform regular matching on each table field. The remaining words can represent key data fields. If the match is successful, the table field is determined as a target table field. In an embodiment of the present invention, regular matching technology is used to perform regular matching on each table field based on the key data field to determine the target table field. This provides more feasible solutions for determining the target table field and can ensure processing efficiency to a certain extent. In the case of including steps 1031 and 1032, the target table field can be determined more comprehensively.

[0063] It should be noted that, in the case of including step 1031 and step 1032, the target table fields determined by each of step 1031 and step 1032 may be repeated, and therefore, the target table fields finally obtained can be deduplicated. In an embodiment of the present invention, a first tag can also be added to each target table field to implement the addition of a "key data" attribute to the target table field. A second tag is added to other table fields (i.e., table fields that are not determined as target table fields) to implement the addition of a "non-key data" attribute to other table fields. Among them, the first tag and the second tag can be pre-set, and illustratively, the first tag can be "1" and the second tag can be "0". By adding the first tag and the second tag, the subsequent identification of the target table field can be facilitated. For example, the table field with the first tag added can be stored in a vector knowledge base for subsequent reading.

[0064] Optionally, after the above step 104, the embodiment of the present invention may further include: step S21, setting a transparent encryption and decryption component for the system to be modified, and adding target configuration information representing the target table field and the target encryption and decryption strategy to the transparent encryption and decryption component.

[0065] Among them, the transparent encryption and decryption component is essentially a transparent encryption and decryption library. The transparent encryption and decryption component can also be called a transparent encryption and decryption dependency package or a transparent encryption and decryption tool. The transparent encryption and decryption component is used to transparently encrypt and decrypt the table fields defined in the configuration information according to the encryption and decryption strategy defined in the configuration information. Therefore, in an embodiment of the present invention, target configuration information representing the target table fields and the target encryption and decryption strategy can be added to the transparent encryption and decryption component, so that the transparent encryption and decryption component can transparently encrypt and decrypt the target table fields according to the target encryption and decryption strategy. Specifically, the target configuration information can be added to the project file of the transparent encryption and decryption component, thereby realizing the integration of the target encryption and decryption strategy into the transparent encryption and decryption component. The target configuration information can be a configuration code that defines the target table fields and the target encryption and decryption strategy adapted to the target table fields. The project file of the transparent encryption and decryption component can be integrated into the system to be modified to introduce a transparent encryption and decryption dependency package into the system to be modified.

[0066] Specifically, in response to a data write request sent by a user, the system to be modified can call a transparent encryption and decryption component, and the transparent encryption and decryption component encrypts the data to be written (i.e., the data requested to be written by the data write request) in the target table field based on the encryption algorithm in the target encryption and decryption policy, according to the encryption process in the target encryption and decryption policy. The system to be modified writes the encrypted data to be written into the database. In response to a data read request, the system to be modified can call a transparent encryption and decryption component, and the transparent encryption and decryption component decrypts the data to be read (i.e., the data requested to be read) in the target table field based on the decryption algorithm in the target encryption and decryption policy, according to the decryption process in the target encryption and decryption policy. The system to be modified returns the decrypted data to be read to the user (i.e., the requester). In this way, the password modification is completed. Among them, the encryption and decryption algorithm defined in the preset encryption and decryption policy can be a correct and compliant encryption algorithm, for example, a domestic encryption and decryption algorithm, to ensure the security of the data.

[0067] In the prior art, system developers need to master the relevant middleware in the system to be modified, be familiar with the principles of domestic encryption and decryption algorithms, the usage processes and operational details of national secret products, etc., before they can complete the password modification work on the system to be modified. In addition, the system to be modified may require a large amount of reconstruction and modification. Therefore, the technical threshold and implementation cost are relatively high. In the processing process of the embodiment of the present invention, no human intervention is required, and the generation of password policies is automatically completed. First, the target table fields and target encryption and decryption policies are automatically determined. Further, by introducing a transparent encryption and decryption component and integrating target configuration information for the transparent encryption and decryption component, the password modification work of the system is completed, thereby improving the efficiency of the transparent encryption and decryption policy configuration of the database during the password modification process. The degree of automation and intelligence is higher, and based on this method, various problems in the password modification work can be solved in one stop. Therefore, it can save labor costs, reduce modification costs, shorten the project modification cycle, and further reduce the technical threshold and implementation cost of the transparent encryption and decryption policy configuration of the database during the password modification process.

[0068] Optionally, before selecting a target encryption / decryption strategy adapted to the target table field from preset encryption / decryption strategies based on the field-related characteristics of the target table field, the embodiment of the present invention may further include:

[0069] Step S31: Determine the industry information and password security level information defined in the password transformation description text.

[0070] Step S32: Based on the target table field, the industry information, and the password security level information, query the characteristics of at least two dimensions of the target table field as the field-related characteristics.

[0071] In an embodiment of the present invention, industry information is used to characterize the industry to which the system to be modified belongs, and password security level information is used to characterize the password security level required to be met by the system to be modified. For example, the password security level can be divided into Level 1, Level 2, and Level 3. The types of features in at least two dimensions can be pre-set, and the features in at least two dimensions can be used as field-related features. When subsequently selecting a target encryption and decryption strategy, matching can be performed through multi-dimensional features, and automatic selection can be made based on the characteristics of the field itself, the security level requirement, and the industry characteristics, thereby determining the rationality of the selected target encryption and decryption strategy to a certain extent.

[0072] Furthermore, in the prior art, due to the influence of individual skills, the selected encryption and decryption strategy may be unreasonable, which in turn may lead to a decrease in the performance of the business system, or even cause the business system password transformation to fail to meet the requirements. In an embodiment of the present invention, by first determining the industry information and password security level information defined in the password transformation description text, and combining the target table field, industry information, and password security level information of multiple dimensions, the field-related features of the target table field are determined. In this way, when subsequently selecting an encryption and decryption strategy based on the field-related features, the industry information and password security level information can be taken into account. To a certain extent, the selected encryption and decryption strategy can be applied to the field that needs to be encrypted and decrypted, the industry to which it belongs, and the password security level that needs to be met, thereby making the selected encryption and decryption strategy more reasonable and improving the rationality of the database transparent encryption and decryption strategy configuration during the password transformation process.

[0073] Optionally, the step of querying the characteristics of at least two dimensions of the target table field based on the target table field, the industry information, and the password security level may specifically include:

[0074] Step S32a: Generate a graph query statement based on the target table fields, the industry information, and the password security level information.

[0075] Step S32b: Based on the graph query statement, query the characteristics of at least two dimensions of the target table field from the preset knowledge graph; the preset knowledge graph includes characteristics of different industries, different password security levels, different table fields, and at least two dimensions of different table fields, and the characteristics of at least two dimensions include important program characteristics and usage frequency characteristics.

[0076] The preset knowledge graph is a pre-built knowledge base based on the professional knowledge of the secret review. The preset knowledge graph includes features of different industries, different password security levels, different table fields, and at least two dimensions of different table fields. It should be noted that the features of at least two dimensions, in addition to important program features and usage frequency features, may also include other features, such as information about the field itself (data type, length, etc.), which is not limited in the embodiments of the present invention.

[0077] For example, table fields from database systems with multiple password security levels across multiple industries, as well as features of at least two dimensions for each table field, can be pre-acquired. Then, by defining node types, edge types, and attributes, a structured knowledge graph is constructed as the pre-set knowledge graph. Nodes are the basic elements of a knowledge graph and can represent different entities. Edges connect different nodes and represent the relationships between them. Attributes are characteristics of nodes or edges and are used to provide more detailed information. This pre-set knowledge graph is used to manage different industries, password security levels, table fields, and features of at least two dimensions.

[0078] Taking at least two dimensions of features including important program features and usage frequency features as an example, we can first define the node types: Industry node, SecurityLevel node, TableFieldnode, Importance node and UsageFrequency node. Among them, Industry node corresponds to industry node, which can represent different industries, such as medical, finance, etc. SecurityLevel node corresponds to password security level node, which can represent different password security levels, such as level 1, level 2, level 3, etc. TableField node corresponds to table field node, which can represent different table fields, such as identity, name, etc. Importance node corresponds to importance node, which can represent different importance of fields, such as high, medium, and low. UsageFrequency node corresponds to usage frequency node, which can represent different usage frequencies of fields, such as frequent, occasional, etc.

[0079] Define edge types: HasSecurityLevel (Has a security level), ContainsField (Contains a field), FieldSecurityLevel (Field security level), FieldImportance (Field importance), and FieldUsageFrequency (Field usage frequency). HasSecurityLevel connects industry nodes and password security level nodes. ContainsField connects industry nodes and table field nodes. FieldSecurityLevel connects table field nodes and password security level nodes. FieldImportance connects table field nodes and importance nodes. FieldUsageFrequency connects table field nodes and usage frequency nodes.

[0080] Define node attributes for nodes. For example, define a Name attribute for an Industry node to indicate the specific industry it represents. Define a Level attribute for a Password Security Level node to indicate the specific password security level it represents. Define a Name attribute for a Table Field node to indicate the specific table field it represents. Define a Degree attribute for an Importance node to indicate the specific importance it represents. Define a Frequency attribute for a Usage Frequency node to indicate the specific frequency it represents.

[0081] Next, you can define the relationship and hierarchical structure between each entity (node). For example, the industry node is used as the top-level node and connected to multiple password security level nodes. The password security level node is connected to multiple table field nodes. The table field node is connected to the importance and frequency of use nodes. In this way, subsequent queries can be performed in the order of industry, password security level, and field. Alternatively, you can also define edge types: BELONGS_TO, HAS_FIELD, HAS_IMPORTANCE, HAS_FREQUENCY. Among them, BELONGS_TO represents the edge from the industry node to the password security level node. HAS_FIELD represents the edge from the password security level node to the table field node. HAS_IMPORTANCE represents the edge from the table field node to the importance node. HAS_FREQUENCY represents the edge from the table field node to the frequency of use node. Accordingly, when designing the hierarchical structure, the industry node can be used as the top-level node, and each industry node can have multiple child nodes, representing different password security levels and table fields in the industry. The password security level nodes connected under the industry node represent the different security levels under the industry. The Password Security Level node is connected to a Table Field node, representing the different table fields under that security level. The Table Field node is also connected to an Importance node and a Frequency of Use node. This allows subsequent queries to be performed in the order of industry, field, and password security level. Finally, a pre-defined graph database (e.g., Neo4j) can be used to construct a knowledge graph based on the defined nodes, edges, attributes, and hierarchical structure.

[0082] A table field with a first tag can be extracted from the vector knowledge base, and the industry information and password security level information can be combined with the table field with the first tag. Specifically, for any target table field, the industry information and password security level information can be combined with the target table field. This combination then serves as the input to a graph query statement generation model, and the output of the graph query statement generation model serves as the graph query statement. The combination can be performed according to a preset format: (target table field) combined with (industry) at password security level (password security level information). Assuming the target table field, password security level information, and industry information are: identity, level 3, and financial industry, respectively, the sum of the combinations yields: identity in the financial industry with password security level 3. The graph query statement generation model can utilize a large language model from existing technologies, such as the ChatGLM3-6B-Base model. The graph query statement generation model can utilize Text2Cypher technology to generate a corresponding knowledge graph query language based on the model input, thereby obtaining a graph query statement. Text2Cypher is a tool that uses a large language model to convert natural language queries into graph query language (Cypher). The query order in the generated knowledge graph query language can be: industry, field, password security level. Alternatively, it can also be: industry, password security level, field. This embodiment of the present invention does not limit this.

[0083] Accordingly, a query can be performed on the pre-set knowledge graph based on the graph query statement to retrieve the specific values ​​of the importance and usage frequency of the target table field for the password security level indicated by the password security level information within the industry indicated by the industry information. For the above example, a graph query can obtain the importance and usage frequency of the field "Identity in the financial industry with password security level information 3".

[0084] In this embodiment, natural language processing and knowledge graph technologies are utilized to eliminate the need for professional cryptography engineers and cryptographic review professionals in traditional password modification. Knowledge graph technology is combined with matching technology to generate a graph query statement based on target table fields, industry information, and password security level information. This query statement is then used to query a pre-set knowledge graph, yielding features for at least two dimensions of the target table fields. This allows for highly efficient feature acquisition.

[0085] Optionally, the above step of determining the industry information and password security level information defined in the password transformation description text may specifically include:

[0086] Step S31a: Obtain a third text vector obtained by vectorizing the second preset query text, and obtain a fourth text vector obtained by vectorizing the third preset query text; the second preset query text is used to query the industry information, and the third preset query text is used to query the password security level information;

[0087] Step S32b: Retrieve text vectors that match the third text vector and the fourth text vector respectively from the first text vector to obtain a fifth text vector and a sixth text vector;

[0088] Step S32c: using the text indicated by the fifth text vector as the industry information, and using the text indicated by the sixth text vector as the password security level information.

[0089] In an embodiment of the present invention, the second and third preset query texts can be vectorized using text2vec technology to produce third and fourth text vectors, respectively. The third text vector is a vector representation of the second preset query text, and the fourth text vector is a vector representation of the third preset query text. The second and third preset query texts can be queries pre-set by a developer. In this embodiment of the present invention, password modification can be completed by simply pre-setting query texts and training models.

[0090] For example, the second preset query text may be "What industry does the system to be modified belong to?". After vectorization processing, a third text vector representing "What industry does the system to be modified belong to" is obtained. The third preset query text may be "What is the password security level requirement for the system to be modified?". After vectorization processing, a fourth text vector representing "What is the password security level requirement for the system to be modified" is obtained. For example, the second and third preset query texts can be input into a preset vectorization model, respectively, and the outputs of the preset vectorization model for these two texts are used as the third and fourth text vectors.

[0091] It should be noted that the operation of the third text vector obtained by vectorizing the second preset query text and the operation of the fourth text vector obtained by vectorizing the third preset query text can be performed in advance, and accordingly, the third text vector and the fourth text vector generated before can be directly read. Alternatively, the second preset query text and the third preset query text can be read and vectorized separately when executing step S31a, and the embodiment of the present invention does not limit this. The industry information and password security level information of different target table fields can be the same. Therefore, after determining the industry information and password security level information once, the industry information and password security level information can be reused for other target table fields.

[0092] Furthermore, by calculating vector similarity, a first text vector similar to the third text vector can be retrieved as the fifth text vector. Since the third text vector is a vector representation of the query text used to query the industry information defined in the password transformation description text, the first text vector similar to the third text vector is a vector representation of the text content representing the industry information in the password transformation description text. By calculating vector similarity, a first text vector similar to the fourth text vector can be retrieved as the sixth text vector. Since the fourth text vector is a vector representation of the query text used to query the password security level information defined in the password transformation description text, the first text vector similar to the fourth text vector is a vector representation of the text content representing the password security level information in the password transformation description text. The implementation methods for retrieving first text vectors similar to the third text vector and retrieving first text vectors similar to the fourth text vector by calculating vector similarity can refer to the aforementioned implementation method for retrieving first text vectors similar to the second text vector and will not be further described here.

[0093] Furthermore, vector-to-text technology can be used to convert the fifth text vector into text to obtain industry information. The sixth text vector can also be converted into text using vector-to-text technology to obtain password security level information. In this embodiment of the present invention, vector retrieval is performed using the second and third preset query texts. Based on the retrieved fifth and sixth text vectors, industry information and password security level information can be obtained. This ensures information acquisition efficiency to a certain extent.

[0094] Optionally, the step of selecting a target encryption and decryption strategy adapted to the target table field from preset encryption and decryption strategies based on the field-related characteristics of the target table field may specifically include:

[0095] Step 1041: Generate model input information based on the field-related features of the target table field, and input the model input information into a preset encryption and decryption strategy classification model; wherein the encryption and decryption strategy classification model is trained based on the field-related features of the sample table field and the sample encryption and decryption strategy label, and the sample encryption and decryption strategy label is used to indicate the preset encryption and decryption strategy.

[0096] Step 1042: Obtain the encryption / decryption policy label output by the encryption / decryption policy classification model, and use the preset encryption / decryption policy indicated by the encryption / decryption policy label as the target encryption / decryption policy.

[0097] In an embodiment of the present invention, an encryption / decryption strategy classification model is used to select a preset encryption / decryption strategy for a target table field from preset encryption / decryption strategies based on input field-related features, and output an encryption / decryption strategy label representing the preset encryption / decryption strategy. The encryption / decryption strategy classification model may be pre-trained, with the training data comprising multiple training data pairs, each of which includes field-related features of a sample table field and a sample encryption / decryption strategy label for the sample table field. The sample encryption / decryption strategy label for the sample table field may be pre-set based on expert knowledge and historical data.

[0098] The sample table fields in these multiple training data pairs include the table fields in the system to be modified, and the sample encryption and decryption policy labels in the multiple training data pairs cover all preset encryption and decryption policies, that is, the multiple sample encryption and decryption policy labels include sample encryption and decryption policies that represent multiple preset encryption and decryption policies. Exemplarily, the encryption and decryption policy label can be a vector, the length of the encryption and decryption policy label is the same as the number of preset encryption and decryption policies, and one bit in the vector represents a preset encryption and decryption policy. Assuming that there are three preset encryption and decryption policies, the encryption and decryption policy labels of these three preset encryption and decryption policies are: 100, 010, and 001, respectively. Then, the training data includes a training data pair with a sample encryption and decryption policy label of 100, a training data pair with a sample encryption and decryption policy label of 010, and a training data pair with a sample encryption and decryption policy label of 001. In this way, it can be ensured that the trained encryption and decryption policy classification model can learn the ability to intelligently select and match from a variety of preset encryption and decryption policies.

[0099] The preset encryption and decryption policies can include multiple preset encryption and decryption policies provided by different cryptographic vendors to reduce the possibility of policy cracking. This allows the model to be deeply integrated with the vendor's transparent encryption and decryption products, automatically outputting tags that can directly execute and take effect on the encryption and decryption policies. This allows the processing method provided by the embodiments of the present invention to be integrated with different cryptographic vendors.

[0100] Furthermore, when generating model input information based on the field-related features of the target table field, the field-related features of the target table field can be directly used as the model input information. Alternatively, the field-related features are processed according to a preset combination or transformation method to obtain the model input information. For example, the features of at least two dimensions in the field-related features are spliced ​​to obtain the model input information. In this way, by combining or transforming the features in the field-related features, higher-level features can be extracted to further improve the prediction ability of the model. In an embodiment of the present invention, features that have a great influence on the selection of encryption and decryption strategies can be selected in advance through feature engineering as field-related features. When constructing a knowledge graph, model training, and model application, the pre-selected field-related features can be used. Exemplarily, based on the feature importance evaluation function of the Extreme Gradient Boosting (XGBoost) model, features with an importance higher than a preset threshold can be selected from all the features of the field as field-related features.

[0101] The encryption and decryption strategy classification model can select a reasonable encryption and decryption strategy for the target table field based on the model input information, and output the final encryption and decryption strategy result (i.e., encryption and decryption strategy label). For example, assuming that the model output is 010, the preset encryption and decryption strategy represented by 010 can be determined as the target encryption and decryption strategy adapted to the target table field. In an embodiment of the present invention, the encryption and decryption strategy classification model can be an XGBoost model. In this way, the trained XGBoost model will eventually automatically complete the selection of the encryption and decryption strategy for each target table field.

[0102] The XGBoost model is an optimization algorithm based on gradient boosting decision trees. During the training process, the objective function is minimized by iteratively adding new decision trees and continuously adjusting the structure and weights of the decision trees. In each iteration, a new decision tree is trained based on the difference between the predicted value and the true value of the current model (i.e., the residual), and this new decision tree is added to the model. Through continuous iteration, the model can gradually approach the true value. When the preset end condition is reached (for example, the number of iterations reaches the preset number threshold. The value of the objective function reaches the preset numerical threshold), the training ends. The objective function consists of two parts: the loss function and the regularization term. The loss function is used to measure the difference between the model's predicted value and the true value. The regularization term is used to control the complexity of the model and prevent overfitting. The objective function can be expressed as:

[0103]

[0104] Among them, the objective function represents the predicted value output by the model for the sample table field in the i-th training data pair (i.e., the output encryption and decryption strategy label), yi represents the true value of the i-th training data pair (i.e., the sample encryption and decryption strategy label in the i-th training data pair), n represents the total number of samples (i.e., the total number of training data pairs), K represents the number of decision trees, Ω(f k ) represents the regularization term of the k-th decision tree, which is used to control the complexity of the k-th decision tree.

[0105] In an embodiment of the present invention, in one implementation, a softmax cross entropy loss function suitable for multi-classification problems is selected as the loss function in the objective function. Alternatively, in another implementation, a custom loss function can be used as the loss function in the objective function. Among them, the custom loss function adds a security calculation item for measuring the security differences between strategies, and a performance calculation item for measuring the performance differences on the basis of the conventional softmax cross entropy loss function (that is, loss function = original softmax cross entropy loss function + security calculation item + performance calculation item). In this way, by introducing security and performance factors, the difference between the encryption and decryption strategy predicted by the model and the actual encryption and decryption strategy can be more accurately measured, as well as security and performance can be measured, thereby ensuring the effectiveness and security of the selection results of the trained model.

[0106] The security calculation item is used to impose a weighted penalty on the encryption and decryption strategies with prediction errors according to security. For example, a security weight is pre-set for each encryption and decryption strategy. The higher the security of the encryption and decryption strategy, the higher the security weight. For example, Wsi means The security weight of the encryption and decryption strategy in the algorithm. Accordingly, if an encryption and decryption strategy has a high security, but the model makes an incorrect prediction, the calculated loss value will be larger. The performance calculation item is used to perform a weighted penalty on the strategy with incorrect prediction based on the strategy performance. For example, if an encryption and decryption strategy has a high strategy performance, but the model makes an incorrect prediction, the loss value will be larger. For example, Wpi means The performance weight of the encryption and decryption strategy. The higher the complexity of the encryption and decryption strategy, the lower the strategy performance.

[0107] Compared to the selection method based on experience and rules, in an embodiment of the present invention, model input information is generated based on the field-related features of the target table fields, and the model input information is input into a preset encryption and decryption policy classification model. The encryption and decryption policy label output by the encryption and decryption policy classification model is obtained, and the preset encryption and decryption policy indicated by the encryption and decryption policy label is used as the target encryption and decryption policy. Since the encryption and decryption policy classification model is trained based on the field-related features of the sample table fields and the sample encryption and decryption policy label used to indicate the preset encryption and decryption policy, the selection can be more scientific through the automation of the encryption and decryption policy classification model, thereby ensuring the accuracy, reliability, professionalism and selection efficiency of the target encryption and decryption policy to a certain extent.

[0108] In another implementation, strategy matching can be performed based on the field-related features of the target table field. For example, a selection threshold can be pre-set for each preset encryption and decryption strategy, with the higher the complexity of the encryption and decryption strategy, the higher the selection threshold. Accordingly, a selection score can be calculated for the target table field based on the field-related features of the target table field. For example, the calculation can be performed in a manner such that the field-related features of the target table field are positively correlated with the selection score. For example, the higher the importance and frequency of use of the field-related features, the greater the selection score. Alternatively, the calculation can be performed in a manner such that the importance is positively correlated with the selection score, while the frequency of use is negatively correlated with the selection score. For example, the higher the importance, the greater the selection score, and the higher the frequency of use, the lower the selection score. Then, among the encryption and decryption strategies whose selection threshold is not greater than the selection score, the encryption and decryption strategy with the highest threshold is selected as the target encryption and decryption strategy.

[0109] Figure 4 This is a schematic diagram of a processing process provided by an embodiment of the present invention. Figure 4 As shown, for the password transformation description text, the text can be cut first, and then vectorized to obtain the first text vector. Among them, the specific process of obtaining the first text vector can refer to the above description, which will not be repeated here. The preset query text (i.e. the above-mentioned first preset query text, the second preset query text and the third preset query text) is vectorized to obtain the second text vector, the third text vector and the fourth text vector. Then, based on the second text vector, the third text vector and the fourth text vector, a search is performed with the first text vector according to the vector similarity to extract the key information for encryption and decryption, i.e. the target text vector, industry information and password security level information, and the target table field is determined based on the target text vector. Among them, the process of determining the target table field, industry information and password security level information can refer to the above description, which will not be repeated here. Then, a preset knowledge graph matching link is performed to obtain field-related features. Finally, an XGBoost model classification link is performed to determine the target transparent encryption and decryption strategy.

[0110] Figure 5 This is another processing diagram provided by an embodiment of the present invention. Figure 5 As shown, after text cutting and vectorization processing are performed on the password transformation scheme, a first text vector can be obtained and stored in a vector knowledge base. Then, the preset query text (i.e., the above-mentioned first preset query text, the second preset query text, and the third preset query text) is vectorized. Next, a vector similarity comparison is performed to obtain a target text vector. Content blocks are recalled to obtain key data fields, industry information, and password security level information. Among them, the specific implementation process of obtaining key data fields, industry information, and password security level information can refer to the relevant description in the aforementioned step 1031 and step S31. Based on the database table structure, the table fields are extracted, and then the fields of the key data are aligned, that is, the table fields that match the key data fields indicated by the target text vector are identified as target table fields. Next, a graph query statement is generated based on the large language model, and the preset knowledge graph is queried based on the graph query statement to obtain field-related features. Next, the target encryption and decryption strategy is intelligently selected based on the pre-trained XGboost model. Integrate a transparent encryption and decryption tool for the system to be transformed, and integrate a target encryption and decryption strategy (i.e., add target configuration information) into the transparent encryption and decryption tool to achieve the transformation.

[0111] In an embodiment of the present invention, natural language processing, knowledge base, and machine learning technologies are applied to the password modification process, so that the password modification system can understand and process text information more intelligently, thereby more accurately identifying and extracting key data fields, industry information, and password security level information from unstructured or semi-structured texts, and further more accurately determining the corresponding encryption and decryption strategies. This processing method has higher flexibility and accuracy. In addition, intelligent means are used to automatically implement the system's password modification work to meet the relevant requirements of password assessment, thereby improving the work efficiency and accuracy of the system's password modification, as well as the overall security of the system. For system R&D engineers, the password modification method in the embodiment of the present invention is simpler and easier to use, thereby reducing learning costs and operational difficulty, and improving work efficiency and user experience.

[0112] It's important to note that as data volumes and security requirements continue to increase, the knowledge graph and encryption / decryption strategy classification model integrated into the password transformation system can be updated based on newly added table fields and pre-set encryption / decryption strategies for the system to be transformed. Simultaneously, pre-set encryption / decryption strategies can be adjusted and optimized to adapt to the database systems and encryption algorithms in new application scenarios. This approach offers greater flexibility and ensures that user security needs are consistently met.

[0113] Figure 6: is a structural diagram of a device for processing encryption and decryption strategies provided by an embodiment of the present invention. The device may include:

[0114] Processing module 201 is configured to vectorize a password modification description text to obtain a first text vector, and obtain a second text vector obtained by vectorizing a first preset query text, wherein the first preset query text is used to query a key data field defined in the password modification description text;

[0115] A retrieval module 202 is configured to retrieve a text vector matching the second text vector from the first text vector as a target text vector;

[0116] Identification module 203, used to identify, from the table fields of the system to be transformed, a table field that matches the key data field indicated by the target text vector as a target table field;

[0117] The selection module 204 is configured to select a target encryption and decryption strategy adapted to the target table field from preset encryption and decryption strategies based on the field-related characteristics of the target table field.

[0118] Optionally, the device further comprises:

[0119] A determination module, configured to determine the industry information and password security level information defined in the password transformation description text;

[0120] A query module is used to query the characteristics of at least two dimensions of the target table field based on the target table field, the industry information and the password security level information as the field-related characteristics.

[0121] Optionally, the determining module is specifically configured to:

[0122] Obtaining a third text vector obtained by vectorizing a second preset query text, and obtaining a fourth text vector obtained by vectorizing the third preset query text; the second preset query text is used to query the industry information, and the third preset query text is used to query the password security level information;

[0123] Retrieving text vectors that match the third text vector and the fourth text vector respectively from the first text vector to obtain a fifth text vector and a sixth text vector;

[0124] The text indicated by the fifth text vector is used as the industry information, and the text indicated by the sixth text vector is used as the password security level information.

[0125] Optionally, the query module is specifically configured to:

[0126] Generate a graph query statement based on the target table field, the industry information, and the password security level information;

[0127] Based on the graph query statement, the characteristics of at least two dimensions of the target table field are queried from the preset knowledge graph; the preset knowledge graph includes characteristics of different industries, different password security levels, different table fields and at least two dimensions of different table fields, and the characteristics of at least two dimensions include important program characteristics and usage frequency characteristics.

[0128] Optionally, the identification module 203 is specifically configured to:

[0129] respectively determining the semantic similarity between each of the table fields of the system to be transformed and the key data field, and determining the table fields having a semantic similarity greater than a preset semantic similarity threshold as the target table fields;

[0130] And / or, performing regular expression matching on each of the table fields of the system to be transformed based on the key data field, and determining the matched table field as the target table field.

[0131] Optionally, the selection module 204 is specifically configured to:

[0132] Generate model input information based on the field-related features of the target table field, and input the model input information into a preset encryption and decryption strategy classification model; wherein the encryption and decryption strategy classification model is trained based on the field-related features of the sample table field and the sample encryption and decryption strategy label, and the sample encryption and decryption strategy label is used to indicate the preset encryption and decryption strategy;

[0133] An encryption / decryption policy label output by the encryption / decryption policy classification model is obtained, and a preset encryption / decryption policy indicated by the encryption / decryption policy label is used as the target encryption / decryption policy.

[0134] Optionally, the processing module 201 is specifically configured to:

[0135] Dividing the password modification description text into a plurality of text blocks according to a preset number of words;

[0136] Identifying text blocks belonging to the same document title among the multiple text blocks, and merging the text blocks belonging to the same document title;

[0137] Vectorization is performed on the text block to obtain the first text vector.

[0138] Optionally, the retrieval module 202 is configured to:

[0139] respectively determining a vector similarity between each of the first text vectors and the second text vector;

[0140] The first text vector whose vector similarity meets the preset vector similarity condition is determined as the target text vector.

[0141] In summary, the encryption and decryption strategy processing device provided by the embodiment of the present invention performs vectorization processing on the password transformation description text to obtain a first text vector, and obtains a second text vector obtained by vectorizing the first preset query text; the first preset query text is used to query the key data field defined in the password transformation description text. The text vector that matches the second text vector is retrieved from the first text vector as the target text vector. The table field that matches the key data field indicated by the target text vector is identified from the table field of the system to be transformed as the target table field. Based on the field-related features of the target table field, the target encryption and decryption strategy that is adapted to the target table field is selected from the preset encryption and decryption strategy. In this way, the target table field that needs to be transparently encrypted and decrypted is automatically determined, and based on the field-related features of the target table field, the adapted target encryption and decryption strategy is automatically selected for the target table field without manual processing, thereby improving processing efficiency.

[0142] The present invention also provides an electronic device, see Figure 7 , including: a processor 901, a memory 902, and a computer program 9021 stored in the memory and executable on the processor, wherein when the processor executes the program, the processing method of the encryption and decryption strategy of the aforementioned embodiment is implemented.

[0143] The present invention also provides a readable storage medium. When the instructions in the readable storage medium are executed by a processor of an electronic device, the electronic device can execute the processing method of the encryption and decryption strategy of the aforementioned embodiment.

[0144] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0145] It should be noted that the various information and data obtained in the embodiments of the present invention are obtained with the authorization of the information / data holder. All actions to obtain signals, information, or data in this application are performed in compliance with the relevant data protection laws and policies of the country of residence and with the authorization of the corresponding device owner.

[0146] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0147] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0148] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the present invention.

[0149] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0150] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the sorting device according to the present invention. The present invention may also be implemented as an apparatus or device program for performing a portion or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0151] It should be noted that the above embodiments illustrate rather than limit the invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0152] The user information (including but not limited to the user's device information, user personal information, etc.) and related data involved in the present invention are all information authorized by the user or authorized by all parties.

[0153] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0154] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0155] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for processing encryption and decryption strategies, characterized in that: The method comprises: performing vectorization processing on the password transformation description text to obtain a first text vector, and obtaining a second text vector obtained by vectorizing a first preset query text, wherein the first preset query text is used to query a key data field defined in the password transformation description text; Retrieving a text vector that matches the second text vector from the first text vector as a target text vector; Identify, from the table fields of the system to be transformed, a table field that matches the key data field indicated by the target text vector as a target table field; Based on the field-related characteristics of the target table field, a target encryption and decryption strategy adapted to the target table field is selected from preset encryption and decryption strategies.

2. The method according to claim 1, characterized in that Before selecting a target encryption and decryption strategy adapted to the target table field from preset encryption and decryption strategies based on the field-related characteristics of the target table field, the method further includes: Determine the industry information and password security level information defined in the password transformation description text; Based on the target table field, the industry information, and the password security level information, features of at least two dimensions of the target table field are queried as the field-related features.

3. The method according to claim 2, characterized in that The determining of the industry information and password security level information defined in the password transformation description text includes: Obtaining a third text vector obtained by vectorizing a second preset query text, and obtaining a fourth text vector obtained by vectorizing the third preset query text; the second preset query text is used to query the industry information, and the third preset query text is used to query the password security level information; Retrieving text vectors that match the third text vector and the fourth text vector respectively from the first text vector to obtain a fifth text vector and a sixth text vector; The text indicated by the fifth text vector is used as the industry information, and the text indicated by the sixth text vector is used as the password security level information.

4. The method according to claim 2, characterized in that The querying of at least two dimensions of features of the target table field based on the target table field, the industry information, and the password security level information includes: Generate a graph query statement based on the target table field, the industry information, and the password security level information; Based on the graph query statement, the characteristics of at least two dimensions of the target table field are queried from the preset knowledge graph; the preset knowledge graph includes characteristics of different industries, different password security levels, different table fields and at least two dimensions of different table fields, and the characteristics of at least two dimensions include important program characteristics and usage frequency characteristics.

5. The method according to claim 1, wherein The step of identifying, from the table fields of the system to be transformed, a table field that matches the key data field indicated by the target text vector as the target table field includes: respectively determining the semantic similarity between each of the table fields of the system to be transformed and the key data field, and determining the table fields having a semantic similarity greater than a preset semantic similarity threshold as the target table fields; And / or, performing regular expression matching on each of the table fields of the system to be transformed based on the key data field, and determining the matched table field as the target table field.

6. The method according to claim 1, characterized in that The selecting, based on the field-related features of the target table field, a target encryption and decryption strategy adapted to the target table field from preset encryption and decryption strategies includes: Generate model input information based on the field-related features of the target table field, and input the model input information into a preset encryption and decryption strategy classification model; wherein the encryption and decryption strategy classification model is trained based on the field-related features of the sample table field and the sample encryption and decryption strategy label, and the sample encryption and decryption strategy label is used to indicate the preset encryption and decryption strategy; An encryption / decryption policy label output by the encryption / decryption policy classification model is obtained, and a preset encryption / decryption policy indicated by the encryption / decryption policy label is used as the target encryption / decryption policy.

7. The method according to any one of claims 1 to 6, characterized in that: The vectorization processing of the password transformation description text to obtain a first text vector includes: Dividing the password modification description text into a plurality of text blocks according to a preset number of words; Identifying text blocks belonging to the same document title among the multiple text blocks, and merging the text blocks belonging to the same document title; Vectorization is performed on the text block to obtain the first text vector.

8. The method according to any one of claims 1 to 6, characterized in that: The retrieving a text vector matching the second text vector from the first text vector as a target text vector includes: respectively determining a vector similarity between each of the first text vectors and the second text vector; The first text vector whose vector similarity meets the preset vector similarity condition is determined as the target text vector.

9. A device for processing encryption and decryption strategies, characterized in that: The device comprises: a processing module configured to vectorize the password transformation description text to obtain a first text vector, and to obtain a second text vector obtained by vectorizing a first preset query text, wherein the first preset query text is used to query a key data field defined in the password transformation description text; a retrieval module, configured to retrieve a text vector matching the second text vector from the first text vector as a target text vector; an identification module, configured to identify, from table fields of the system to be transformed, table fields that match the key data fields indicated by the target text vector, as target table fields; The selection module is configured to select a target encryption and decryption strategy adapted to the target table field from preset encryption and decryption strategies based on the field-related characteristics of the target table field.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the program.

11. A readable storage medium, characterized in that: When the instructions in the readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 8.

Images