Data secrecy method, device, equipment, medium and program product

Abstract

The invention provides a data secrecy method which can be applied to the technical field of information security. The data secrecy method comprises the following steps: acquiring an internal master key plaintext, a first external key plaintext and a second external key plaintext from a local table; based on the internal master key plaintext, the first external key plaintext and the second external key plaintext, an internal encryption key ciphertext is decrypted to obtain an internal encryption key plaintext, and the first external key and the second external key are generated by an external device; and encrypting disk data based on the internal encryption key plaintext to obtain storage data. The invention further provides a data secrecy device and equipment, a storage medium and a program product.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information security, in particular to a data security method, device, equipment, medium and program product. BACKGROUND

[0002] With the acceleration of digitalization, databases have become the storage carriers of core data of enterprises, involving high-sensitive information such as financial transactions and personal privacy. However, data leakage incidents occur frequently, especially when physical storage media (such as hard disks and backup files) are lost, traditional protection methods are difficult to guarantee the security of static data.

[0003] The risk of data leakage is further intensified when the financial industry moves from centralized to distributed, and traditional application layer encryption technology cannot meet the encryption protection of a large amount of data. In order to cope with the protection of massive database data, through a transparent and automated encryption mechanism, it has become the mainstream solution for database static data protection and has been widely applied in various sensitive data protection scenarios in the financial industry.

[0004] However, the existing database static data protection still has deficiencies, resulting in insufficient key security protection and still existing data leakage risks. SUMMARY

[0005] In view of the above problems, the present disclosure provides a data security method, device, equipment, medium and program product for improving data security.

[0006] According to a first aspect of the present disclosure, a data security method is provided, comprising: obtaining an internal master key plaintext, a first external key plaintext and a second external key ciphertext from a local table; decrypting an internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext to obtain an internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device; and encrypting disk data based on the internal encryption key plaintext to obtain storage data.

[0007] According to an embodiment of the present disclosure, the method further comprises: obtaining an internal master key plaintext, a first external key plaintext and a second external key ciphertext from a local table; decrypting an internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext to obtain an internal encryption key plaintext; and decrypting storage data based on the internal encryption key plaintext to obtain disk data.

[0008] According to an embodiment of the present disclosure, the decrypting the internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext to obtain the internal encryption key plaintext comprises: transmitting the first external key plaintext and the second external key ciphertext to an external device to decrypt, by the external device, the second external key ciphertext based on the first external key plaintext to obtain a second external key plaintext; receiving the second external key plaintext from the external device; and decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext.

[0009] According to an embodiment of the present disclosure, the decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext comprises: decrypting the internal encryption key ciphertext based on the second external key plaintext to obtain a first internal encryption key ciphertext; and obtaining the internal encryption key plaintext based on the internal master key plaintext and the first internal encryption key ciphertext.

[0010] According to an embodiment of the present disclosure, the decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext further comprises: decrypting the internal encryption key ciphertext based on the internal master key plaintext to obtain a second internal encryption key ciphertext; and obtaining the internal encryption key plaintext based on the second external key plaintext and the second internal encryption key ciphertext.

[0011] According to an embodiment of the present disclosure, the internal master key, the first external key, the second external key and the internal encryption key are generated by a symmetric encryption algorithm.

[0012] A second aspect of the present disclosure provides a data security device, characterized in that the device comprises: an acquisition module configured to acquire an internal master key plaintext, a first external key plaintext and a second external key ciphertext from a local table; a key decryption module configured to decrypt an internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext to obtain an internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device; and a data encryption module configured to encrypt disk landing data based on the internal encryption key plaintext to obtain storage data.

[0013] According to an embodiment of the present disclosure, the device further comprises: a data encryption module, the acquisition module is further configured to acquire an internal master key plaintext, a first external key plaintext and a second external key ciphertext from a local table; the key decryption module is further configured to decrypt an internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext to obtain an internal encryption key plaintext; and the data encryption module is configured to decrypt storage data based on the internal encryption key plaintext to obtain disk landing data.

[0014] According to an embodiment of the present disclosure, the key decryption module is specifically used to transmit a first external key plaintext and a second external key ciphertext to an external device, so that the external device decrypts the second external key ciphertext based on the first external key plaintext to obtain the second external key plaintext; receives the second external key plaintext from the external device; and decrypts the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext.

[0015] According to an embodiment of the present disclosure, the key decryption module is specifically used to decrypt the internal encryption key ciphertext based on the second external key plaintext to obtain the first internal encryption key ciphertext; and to decrypt the first internal encryption key ciphertext based on the internal master key plaintext to obtain the internal encryption key plaintext.

[0016] According to an embodiment of the present disclosure, the key decryption module is further specifically used to decrypt the internal encryption key ciphertext based on the internal master key plaintext to obtain the second internal encryption key ciphertext; and to decrypt the second internal encryption key ciphertext based on the second external key plaintext to obtain the internal encryption key plaintext.

[0017] According to an embodiment of the present disclosure, the internal master key, the first external key, the second external key, and the internal encryption key are generated by a symmetric encryption algorithm.

[0018] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0019] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0020] The fifth aspect of the present disclosure further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0021] This is to address the technical problem of poor security of transparent database encryption in the prior art. In the embodiments of the present disclosure, by introducing a first external key and a second external key generated in an external device, combined with an internal master key and an internal encryption key, the data written to the disk is encrypted and stored. In the embodiments of the present disclosure, the device that introduces the external password enhances key protection. By working in conjunction with the external device, the protection of the internal encryption key of the data is completed, ultimately ensuring that the internal encryption key of the data will not be leaked in plain text due to disk data theft, and also ensuring that the plain text of the internal encryption key of the data will not be leaked even if the external device is controlled. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0023] Figure 1 A diagram illustrating an application scenario of a data security method according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 2 A flowchart of a data security method according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 3 A flowchart of another data security method according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 4 An architecture diagram of a data security method is schematically shown;

[0027] Figure 5 A full flowchart of a data security method is schematically shown;

[0028] Figure 6 A structural block diagram of a data security apparatus according to an embodiment of the present disclosure is schematically shown; and

[0029] Figure 7 A block diagram of an electronic device suitable for implementing a data security method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary and is intended to provide a thorough understanding of the present disclosure. The following description, given together with the accompanying drawings, is intended to provide a thorough understanding of the present disclosure. However, it is apparent that one or more embodiments can be implemented without the specific details, as is apparent to those skilled in the art.

[0031] The terms used herein are merely used to describe specific embodiments, and are not intended to limit the present disclosure. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0032] All terms used herein, including technical and scientific terms, have the meanings commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted in a manner consistent with the context of the specification, and should not be interpreted in an idealized or overly formal manner.

[0033] In the case of using expressions such as "at least one of A, B, and C, etc.", it is generally intended to mean any of A, B, C, etc. individually, A and B together, A and C together, B and C together, or A, B, and C together, etc. In the case of using the expression "one or more of A, B, and C, etc.", it is generally intended to mean any of A, B, C, etc. individually, A and B together, A and C together, B and C together, or A, B, and C together, etc.

[0034] Before the embodiments of the present disclosure are disclosed in detail, key technical terms involved in the embodiments of the present disclosure are disclosed in detail as follows:

[0035] Transparent data encryption (TDE) is a technology of performing real-time input / output encryption and decryption on data files at the bottom of a database. The transparent data encryption technology generally involves two key keys: 1. Encryption key (also known as table space encryption key), each encrypted table space has a unique encryption key for encrypting / decrypting the data of the table space, wherein one table or multiple tables can belong to a table space; 2. Master key, used for encrypting / decrypting the encryption key.

[0036] The existing database transparent encryption technology generally has a password module in the database product, and the database calls the key generation function of the password module to generate the master key and the encryption key when starting the service for the first time. These keys are stored in the system table of the database.

[0037] The embodiments of the present disclosure provide a data security method, comprising: obtaining an internal master key plaintext, a first external key plaintext, and a second external key ciphertext from a local table; decrypting an internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain an internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device; and encrypting the disk data based on the internal encryption key plaintext to obtain storage data.

[0038] In order to solve the technical problem of poor security of database transparent encryption in the prior art. In the embodiments of the present disclosure, the first external key and the second external key generated by the external device are introduced, combined with the internal master key and the internal encryption key, and the disk data is encrypted for storage. In the embodiments of the present disclosure, the external password device is introduced to enhance the key protection, and through the cooperation with the external device, the protection of the internal encryption key of the data is completed, so that the internal encryption key of the data is finally ensured not to be leaked plaintext due to disk data theft, and even if the external device is controlled, the internal encryption key plaintext of the data is also ensured not to be leaked.

[0039] Figure 1 An application scenario diagram of the data privacy method according to an embodiment of the present disclosure is shown schematically.

[0040] As shown in Figure 1 The application scenario 100 according to this embodiment can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or optical fiber cables, and the like.

[0041] A user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, and the like. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, and the like (only as examples).

[0042] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, and the like.

[0043] The server 105 can be a server providing various services, such as a background management server supporting a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can analyze and process received user requests and the like, and feed back the processing results (such as web pages, information, or data, and the like obtained or generated according to user requests) to the terminal device.

[0044] It should be noted that the data privacy method provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the data privacy apparatus provided by the embodiments of the present disclosure can generally be arranged in the server 105. The data privacy method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Accordingly, the data privacy apparatus provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0045] It should be understood that Figure 1 The number of terminal devices, networks and servers in the above-mentioned scenario is only illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0046] The data privacy method according to the embodiments of the present disclosure will be described below based on Figure 1 the scenario described above, by Figures 2-5 detailed description.

[0047] Figure 2 A flowchart of a data privacy method according to an embodiment of the present disclosure is illustratively shown.

[0048] As Figure 2 shown, the data privacy method of this embodiment includes operations S210-S230, which can be performed by the server 105.

[0049] In operation S210, an internal master key plaintext, a first external key plaintext and a second external key ciphertext are obtained from a local table.

[0050] The internal master key is used to encrypt and decrypt an internal encryption key, and the internal master key can be stored in the local table of the internal device in the form of plaintext.

[0051] The first external key and the second external key are generated by an external device, the first external key is used to encrypt and decrypt the second external key, the first external key can be stored in the local table of the internal device in the form of plaintext, and the second external key can be stored in the local table of the internal device in the form of ciphertext.

[0052] According to the embodiments of the present disclosure, the above-mentioned internal master key, first external key, second external key and internal encryption key are formed by a symmetric encryption algorithm.

[0053] Specifically, the internal master key, first external key, second external key and internal encryption key involved in the embodiments of the present disclosure are all keys formed by a symmetric encryption algorithm. For example, the symmetric encryption algorithm includes commonly used encryption algorithms such as the data encryption standard algorithm, the triple data encryption standard algorithm and the advanced encryption standard. The internal master key, first external key, second external key and internal encryption key can be generated by the same symmetric encryption algorithm or different symmetric encryption algorithms.

[0054] In operation S220, the internal encryption key ciphertext is decrypted based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext to obtain the internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device.

[0055] The internal encryption key is generated by the internal device, and the internal encryption key is used for encryption and decryption of database data to improve the confidentiality of the data. The internal encryption key can be stored in the local table of the internal device in the form of ciphertext.

[0056] Specifically, the second external key ciphertext is decrypted by the first external key plaintext to obtain the second external key plaintext, and then the internal encryption key ciphertext is decrypted based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext.

[0057] According to an embodiment of the present disclosure, the operation S220 specifically includes: transmitting the first external key plaintext and the second external key ciphertext to the external device, so that the external device decrypts the second external key ciphertext based on the first external key plaintext to obtain the second external key plaintext; receiving the second external key plaintext from the external device; and decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext.

[0058] Specifically, the second external key ciphertext can only be decrypted by the external device, and the first external key plaintext and the second external key ciphertext stored in the internal device are transmitted to the external device, so that the external device decrypts the second external key ciphertext based on the first external key plaintext to obtain the second external key plaintext, and then transmits the second external key plaintext back to the internal device, and the internal encryption key ciphertext is decrypted based on the internal master key plaintext and the second external key plaintext.

[0059] According to an embodiment of the present disclosure, the operation S220 specifically includes: transmitting the first external key plaintext and the second external key ciphertext to the external device, so that the external device decrypts the second external key ciphertext based on the first external key plaintext to obtain the second external key plaintext; receiving the second external key plaintext from the external device; and decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext.

[0060] Specifically, the internal encryption key ciphertext can be decrypted by the second external key plaintext first, and then decrypted by the internal master key plaintext, and finally the internal encryption key plaintext is obtained. It can be understood that correspondingly, when the internal encryption key plaintext is encrypted, it is first encrypted by the internal master key plaintext to obtain the first internal encryption key ciphertext, and then the first internal encryption key ciphertext is encrypted by the second external key plaintext to obtain the internal encryption key ciphertext.

[0061] According to an embodiment of the present disclosure, the operation S220 further specifically includes: decrypting the internal encryption key ciphertext based on the internal master key plaintext to obtain the second internal encryption key ciphertext; and decrypting the second internal encryption key ciphertext based on the second external key plaintext to obtain the internal encryption key plaintext.

[0062] Specifically, the internal encryption key ciphertext can be decrypted by the internal master key plaintext first, and then decrypted by the second external key plaintext, and finally the internal encryption key plaintext is obtained. It can be understood that, correspondingly, when encrypting the internal encryption key plaintext, it is first encrypted by the second external key plaintext to obtain the second internal encryption key ciphertext, and then the second internal encryption key ciphertext is encrypted by the internal master key plaintext to obtain the internal encryption key ciphertext.

[0063] In operation S230, the on-disk data is encrypted based on the internal encryption key plaintext to obtain the storage data.

[0064] Specifically, the embodiments of the present disclosure are used to convert data into ciphertext form and store in the database, and the on-disk data is plaintext data to be stored in the database. After the plaintext data is converted into ciphertext form to form storage data, the operation of writing the data table is performed.

[0065] Figure 3 The flowchart of another data security method according to an embodiment of the present disclosure is schematically shown.

[0066] As Figure 3 shown, the data security method of this embodiment includes operations S310-S330.

[0067] In operation S310, the internal master key plaintext, the first external key plaintext, and the second external key ciphertext are obtained from the local table.

[0068] In operation S320, the internal encryption key ciphertext is decrypted based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain the internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device.

[0069] In operation S330, the storage data is decrypted based on the internal encryption key plaintext to obtain the on-disk data.

[0070] Specifically, the embodiments of the present disclosure are used to read and use the ciphertext data in the database, and decrypt the obtained storage data from the data table to obtain the on-disk data that can be used.

[0071] In order to solve the technical problem of poor security of database transparent encryption in the prior art. In the embodiments of the present disclosure, the first external key and the second external key generated by the external device are introduced, combined with the internal master key and the internal encryption key, and the on-disk data is encrypted and stored. In the embodiments of the present disclosure, the device of the introduced external password enhances the key protection, and through the cooperation with the external device, the protection of the data internal encryption key is completed, and finally it is ensured that the data internal encryption key will not be leaked plaintext due to disk data theft, and it is also ensured that even if the external device is controlled, the data internal encryption key plaintext will not be leaked.

[0072] Figure 4 An architecture diagram of a data security method is schematically shown.

[0073] As Figure 4 shown, the architecture diagram includes a database core module, an internal cryptographic module unit, an extensible module unit, and an external cryptographic module unit. The database core module unit calls a user of a cryptographic service. The internal cryptographic module unit is used to directly interact with the database core module and provide direct cryptographic services for the database core module. The extensible module unit provides extension services for the internal cryptographic module and completes adaptation docking with the external cryptographic module. The external cryptographic module unit provides key generation, encryption and decryption cryptographic services.

[0074] In combination Figure 4 with the above, embodiments of the present disclosure introduce an external cryptographic module of an external device to enhance key protection, and protect an internal encryption key (i.e., Encryption Key in Figure 4 ). Meanwhile, two elements for implementing encryption and decryption of the internal encryption key include a master key (i.e., Master key in Figure 4 ) and a second external key (i.e., s in Figure 4 ) generated by the external device, wherein the second external key is further encrypted and decrypted by a first external key (i.e., ks in Figure 4 ), and only when the internal device and the external device are simultaneously available, the internal encryption key can be correctly obtained.

[0075] In combination Figure 5 with the above, embodiments of the present disclosure can at least achieve the following beneficial effects:

[0076] 1. Feasibility principle: The database transparent encryption itself has a security component module, which can complete access of the external cryptographic module through the customized component module, and can be connected in series before and after the existing internal key processing; at the same time, the system table structure of the database can be customized to store key index information of the external cryptographic module.

[0077] 2. Strengthen the protection mechanism: by using the external cryptographic module, first, a random symmetric key first external key is generated to protect the database, which is used as a higher level key to protect the internal encryption key plaintext; second, the second external key, an element of the internal encryption key, is generated by the external cryptographic module, and then the final internal encryption key plaintext is calculated by the internal master key in the database; finally, the internal encryption key is encrypted by the first external key before being stored.

[0078] 3. Security protection principle: (a) The first external key is generated by the external password module, and only the external password module can identify and use it, and it cannot be used anywhere else; (b) The second external key, an element of the internal encryption key, is randomly generated by the external password module, and the internal encryption key plaintext is obtained by symmetric encryption and decryption calculation with the internal master key in the database, solving the problem that the original internal encryption key plaintext can be obtained only with the internal master key; (c) The final plaintext of the internal encryption key only appears in the memory of the database system, and even if the external master has the first external key plaintext and the second external key, it cannot calculate the internal encryption key plaintext.

[0079] Figure 5 The full flowchart of the data security method is schematically shown.

[0080] As shown in Figure 6 , the specific operation steps are as follows:

[0081] Step S501: Database transparent encryption function initialization: the database core module requests the internal master key of the symmetric key and the first external key of the symmetric key.

[0082] Step S502: The internal password module generates the internal master key plaintext, and further calls the extensible module to request the generation of the first external key.

[0083] Step S503: The extensible module encapsulates the call of the external password module to generate the first external key plaintext (this key can only be recognized and used by the external password module), and returns it to the internal password module.

[0084] Step S504: The internal password module returns the internal master key and the first external key to the database core module, and the core module stores the internal master key and the first external key in the system table.

[0085] Step S505: If the key element corresponding to the table space is empty, the database core module calls the internal password module to send the first external key information to request the generation of the second external key ciphertext, wherein the second external key ciphertext is obtained by encrypting the first external key plaintext.

[0086] Step S506: The internal password module calls the extensible module to send the first external key plaintext, and the extensible module calls the external password module to generate the second external key.

[0087] Step S507: The internal password module returns the second external key ciphertext to the database core module, and the core module stores the second external key ciphertext in the system table.

[0088] Step S508: The database core module requests the internal password module to calculate the internal encryption key plaintext using the internal master key plaintext, the first external key plaintext, and the second external key ciphertext.

[0089] Step S509: The internal password module invokes the extensible module to request the calculation of the second external key plaintext using the first external key plaintext and the second external key ciphertext, and the extensible module invokes the external password service to obtain the second external key plaintext.

[0090] Step S510: The internal password module calculates the internal encryption key plaintext using the internal master key plaintext and the second external key plaintext, and returns the plaintext to the database core module.

[0091] Step S511: The database core module places the internal encryption key plaintext into the memory for subsequent table data encryption and decryption until the key is invalidated or the system triggers an update.

[0092] Based on the above data security method, the present disclosure further provides a data security device. The following will be described in detail in combination with Figure 6 The device is described in detail.

[0093] Figure 6 The structure block diagram of the data security device according to the embodiment of the present disclosure is schematically shown.

[0094] As Figure 7 shown, the data security device 600 of the embodiment includes an acquisition module 610, a key decryption module 620, and a data encryption module 630.

[0095] The acquisition module 610 is configured to acquire the internal master key plaintext, the first external key plaintext, and the second external key ciphertext from the local table. In an embodiment, the acquisition module 610 can be configured to perform the operation S210 described above, and details are not repeated here.

[0096] The key decryption module 620 is configured to decrypt the internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain the internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device. In an embodiment, the key decryption module 620 can be configured to perform the operation S220 described above, and details are not repeated here.

[0097] The data encryption module 630 is configured to encrypt the disk data based on the internal encryption key plaintext to obtain the storage data. In an embodiment, the data encryption module 630 can be configured to perform the operation S230 described above, and details are not repeated here.

[0098] In order to solve the technical problem of poor security of database transparent encryption in the prior art, in the embodiment of the present disclosure, the first external key and the second external key generated by the external device are introduced, combined with the internal master key and the internal encryption key, and the on-disk data is encrypted and stored. In the embodiment of the present disclosure, the device of the introduced external password enhances the protection of the key, cooperates with the external device, completes the protection of the internal encryption key of the data, and finally ensures that the internal encryption key of the data will not leak the plaintext due to disk data theft, and also ensures that even if the external device is controlled, the internal encryption key plaintext of the data will not be leaked.

[0099] According to the embodiment of the present disclosure, the device further comprises: a data encryption module, the acquisition module is further used to acquire the internal master key plaintext, the first external key plaintext and the second external key ciphertext from the local table; the key decryption module is further used to decrypt the internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext and the second external key ciphertext, to obtain the internal encryption key plaintext; and the data encryption module is used to decrypt the storage data based on the internal encryption key plaintext, to obtain the on-disk data.

[0100] According to the embodiment of the present disclosure, the key decryption module is specifically used to transmit the first external key plaintext and the second external key ciphertext to the external device, so that the external device decrypts the second external key ciphertext based on the first external key plaintext to obtain the second external key plaintext; the second external key plaintext from the external device is received; and the internal encryption key ciphertext is decrypted based on the internal master key plaintext and the second external key plaintext, to obtain the internal encryption key plaintext.

[0101] According to the embodiment of the present disclosure, the key decryption module is specifically used to decrypt the internal encryption key ciphertext based on the second external key plaintext, to obtain the first internal encryption key ciphertext; and the first internal encryption key ciphertext is decrypted based on the internal master key plaintext, to obtain the internal encryption key plaintext.

[0102] According to the embodiment of the present disclosure, the key decryption module is further specifically used to decrypt the internal encryption key ciphertext based on the internal master key plaintext, to obtain the second internal encryption key ciphertext; and the second internal encryption key ciphertext is decrypted based on the second external key plaintext, to obtain the internal encryption key plaintext.

[0103] According to the embodiment of the present disclosure, the internal master key, the first external key, the second external key and the internal encryption key are formed by using a symmetric encryption algorithm.

[0104] According to an embodiment of the present disclosure, any of the modules of the obtaining module 610, the key decryption module 620 and the data encryption module 630 can be combined in one module, or any of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of the modules can be combined with at least part of the functions of the other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the obtaining module 610, the key decryption module 620 and the data encryption module 630 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. in hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the obtaining module 610, the key decryption module 620 and the data encryption module 630 can be at least partially implemented as a computer program module which, when executed, can perform the corresponding functions.

[0105] Figure 7 A block diagram of an electronic device suitable for implementing the data security method according to an embodiment of the present disclosure is schematically shown.

[0106] As shown in ​ The electronic device 900 according to an embodiment of the present disclosure includes a processor 901 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 902 or loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 can include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special purpose microprocessor (e.g., an application specific integrated circuit (ASIC)), etc. The processor 901 can also include an on-board memory for cache use. The processor 901 can include a single processing unit or multiple processing units for executing different actions of the method processes according to embodiments of the present disclosure.

[0107] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902 and the RAM 903 are connected to each other through a bus 904. The processor 901 performs various operations of the method processes according to embodiments of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs can also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 can also perform various operations of the method processes according to embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0108] According to an embodiment of the present disclosure, the electronic device 900 can further include an input / output (I / O) interface 905 that is also connected to the bus 904. The electronic device 900 can further include one or more of the following components connected to the input / output (I / O) interface 905: an input part 906 including a keyboard, a mouse, etc.; an output part 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 908 including a hard disk, etc.; and a communication part 909 including a network interface card such as a LAN card, a modem, etc. The communication part 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as necessary. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is mounted on the drive 910 as necessary, so that a computer program read out therefrom is installed in the storage part 908 as necessary.

[0109] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which when executed, implement the method according to the embodiments of the present disclosure.

[0110] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories such as the ROM 902 and / or the RAM 903 described above and / or one or more memory other than the ROM 902 and the RAM 903.

[0111] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the methods provided by the embodiments of the present disclosure.

[0112] The above-described functions of the system / device defined in the embodiments of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiments of the present disclosure, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0113] In one embodiment, the computer program can be stored in a tangible storage medium, such as an optical, magnetic, or other storage device. In another embodiment, the computer program can be transmitted over a network via a signal in a network medium, downloaded and installed, and / or installed from a removable medium 911 via the communication part 909. The computer program embodied in the computer program code can be transmitted using any suitable network medium, including, but not limited to, wireless, wired, or the like, or any suitable combination thereof.

[0114] In such an embodiment, the computer program can be downloaded and installed from a network via the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above-described functions of the system defined in the embodiments of the present disclosure are performed. According to the embodiments of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0115] According to the embodiments of the present disclosure, the program code for executing the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes, but is not limited to, such as Java, C++, python, "C" language, or similar programming language. The program code can be executed entirely on a user computing device, partially on a user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0116] The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions that, when executed, cause a processor of a computer-based system to perform any of the methods of the first aspect. The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions that, when executed, cause a processor of a computer-based system to perform any of the methods of the first aspect.

[0117] Those skilled in the art will understand that features recited in the various embodiments of the present disclosure can be combined and / or integrated in a variety of ways, even if such combinations or integrations have not been expressly contemplated in the present disclosure. In particular, features recited in the various embodiments of the present disclosure can be combined and / or integrated in a variety of ways without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations are within the scope of the present disclosure.

[0118] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each of the embodiments is described above separately, this does not mean that the measures in each of the embodiments cannot be used advantageously in combination. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications shall all fall within the scope of the present disclosure.

Claims

1. A data confidentiality method, characterized in that: The method comprises: Obtain the internal master key plaintext, the first external key plaintext, and the second external key ciphertext from the local table; decrypting the internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain the internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device; and The plaintext data written to the disk is encrypted based on the internal encryption key to obtain stored data.

2. The method according to claim 1, characterized in that The method further comprises: Obtain the internal master key plaintext, the first external key plaintext, and the second external key ciphertext from the local table; decrypting the internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain the internal encryption key plaintext; and The stored data is decrypted based on the internal encryption key to obtain the disk data.

3. The method according to claim 2, characterized in that The decrypting the internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain the internal encryption key plaintext includes: Transmitting the first external key plaintext and the second external key ciphertext to an external device, so that the external device decrypts the second external key ciphertext based on the first external key plaintext to obtain the second external key plaintext; receiving a second external key plaintext from an external device; and Based on the internal master key plaintext and the second external key plaintext, the internal encryption key ciphertext is decrypted to obtain the internal encryption key plaintext.

4. The method according to claim 3, characterized in that The decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext includes: decrypting the internal encryption key ciphertext based on the second external key plaintext to obtain the first internal encryption key ciphertext; and The first internal encryption key plaintext is ciphered based on the internal master key plaintext to obtain the internal encryption key plaintext.

5. The method according to claim 4, characterized in that The decrypting the internal encryption key ciphertext based on the internal master key plaintext and the second external key plaintext to obtain the internal encryption key plaintext further includes: decrypting the internal encryption key ciphertext based on the internal master key plaintext to obtain a second internal encryption key ciphertext; and The second internal encryption key plaintext is ciphered based on the second external key plaintext to obtain the internal encryption key plaintext.

6. The method according to any one of claims 1 to 5, characterized in that The internal master key, the first external key, the second external key and the internal encryption key are generated by a symmetric encryption algorithm.

7. A data security device, characterized in that: The device comprises: An acquisition module, configured to acquire the internal master key plaintext, the first external key plaintext, and the second external key ciphertext from a local table; a key decryption module, configured to decrypt an internal encryption key ciphertext based on the internal master key plaintext, the first external key plaintext, and the second external key ciphertext to obtain an internal encryption key plaintext, wherein the first external key and the second external key are generated by an external device; and The data encryption module is used to encrypt the plain text data written to the disk based on the internal encryption key to obtain stored data.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images