Data processing method and device, equipment, medium and program product
By using a second encryption algorithm and a key plaintext to encrypt plaintext data in a distributed database, the adaptability and flexibility issues of encryption technologies in existing technologies are resolved, thereby improving data security and compatibility.
Patent Information
- Application Number
- CN202511160128.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-19
- Publication Date
- 2025-11-21
AI Technical Summary
Existing encryption technologies are difficult to adapt to distributed databases with different architectures and rely on dedicated chips, which limits data security and flexibility.
The first key ciphertext is decrypted using a second encryption algorithm and the plaintext key, the plaintext data is encrypted using the first encryption algorithm, and the encrypted information is stored in the file format information of the storage medium. This avoids reliance on dedicated chips and is suitable for distributed databases with any architecture.
It improves the security of plaintext data, supports different encryption keys for different data tables, ensures the flexibility and compatibility of the data decryption process, and is suitable for distributed databases of any architecture.
Smart Images
Figure CN120995481A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data processing technology, and in particular to a data processing method, apparatus, device, medium, and program product. Background Technology
[0002] In the field of distributed databases, the security of static data is one of the core challenges. Current mainstream encryption technologies mostly employ internationally recognized algorithms, such as AES (Advanced Encryption Standard), or Chinese national cryptographic algorithms, such as SM4. However, both have limitations.
[0003] In the existing technology, some studies have attempted to implement dual-mode encryption of AES and SM4 algorithms through hardware circuits, but such solutions rely on dedicated chips and are difficult to adapt to distributed databases with different architectures. Summary of the Invention
[0004] This invention provides a data processing method, apparatus, device, medium, and program product to meet the data encryption and storage needs of distributed databases with different architectures.
[0005] In a first aspect, embodiments of the present invention provide a data processing method, executed by an encryption terminal, comprising:
[0006] By reading the metadata of the target data table, the encrypted information corresponding to the target data table is obtained; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext.
[0007] The target data plaintext is encrypted according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext, and the target data ciphertext is stored in the storage medium corresponding to the target data table;
[0008] The encrypted information is added to the file format information of the storage medium.
[0009] Secondly, embodiments of the present invention also provide a data processing apparatus configured at an encryption terminal, comprising:
[0010] The reading module is used to obtain the encrypted information corresponding to the target data table by reading the metadata of the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext;
[0011] An encryption module is used to encrypt the target data plaintext according to the second encryption algorithm identifier, the second key plaintext and the encryption information to obtain the target data ciphertext, and store the target data ciphertext in the storage medium corresponding to the target data table;
[0012] The information adding module is used to add the encrypted information to the file format information of the storage medium.
[0013] Thirdly, embodiments of the present invention also provide a data processing method, executed by a decryption terminal, comprising:
[0014] Encrypted information is obtained by reading the file format information of the storage medium corresponding to the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext;
[0015] Based on the second encryption algorithm identifier, the second key plaintext, and the encryption information, the target data ciphertext is decrypted to obtain the target data plaintext.
[0016] The target data ciphertext is obtained in the following way:
[0017] The target data plaintext is encrypted according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext.
[0018] Fourthly, embodiments of the present invention also provide a data processing apparatus configured at a decryption terminal, comprising:
[0019] The reading module is used to obtain encrypted information by reading the file format information of the storage medium corresponding to the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext;
[0020] The decryption module is used to decrypt the target data ciphertext according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data plaintext;
[0021] The target data ciphertext is obtained in the following way:
[0022] The target data plaintext is encrypted according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext.
[0023] Fifthly, embodiments of the present invention also provide an electronic device, comprising:
[0024] At least one processor; and
[0025] A memory that is communicatively connected to at least one processor; wherein
[0026] The memory stores instructions that can be executed by at least one processor, which enables the at least one processor to perform a data processing method provided in any embodiment of the present invention.
[0027] In a sixth aspect, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions that, when executed by a processor, implement a data processing method according to any embodiment of the present invention.
[0028] In a seventh aspect, embodiments of the present invention also provide a computer program product, characterized in that the computer program product includes a computer program, which, when executed by a processor, implements a data processing method according to any embodiment of the present invention.
[0029] This invention improves the security of plaintext data by decrypting ciphertext with a first key using a second encryption algorithm and a second key plaintext. It further enhances security by encrypting plaintext data using the first key plaintext and the first encryption algorithm. By reading the first encryption algorithm identifier and the first key ciphertext from the metadata of the data table, and then encrypting and storing the plaintext data, this invention, compared to existing technologies, does not rely on dedicated chips and is applicable to data encryption in distributed databases of any architecture. Storing the encrypted information in the file format information of the storage medium also avoids affecting the database data stored in the storage medium. During decryption, the first key ciphertext and the first encryption algorithm identifier can be obtained by reading the data page information in the storage medium. This invention, compared to existing technologies, does not rely on dedicated chips and is applicable to data decryption in distributed databases of any architecture.
[0030] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description
[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0032] Figure 1A This is a flowchart of a data processing method provided according to Embodiment 1 of the present invention;
[0033] Figure 1B This is a schematic diagram of a file format with added encryption information and encryption identifier according to Embodiment 1 of the present invention;
[0034] Figure 2A This is a flowchart of a data processing method provided according to Embodiment 2 of the present invention;
[0035] Figure 2B This is a schematic diagram of a data processing flow architecture provided according to Embodiment 2 of the present invention;
[0036] Figure 3 This is a schematic diagram of the structure of a data processing device according to Embodiment 3 of the present invention;
[0037] Figure 4 This is a schematic diagram of the structure of a data processing device according to Embodiment 4 of the present invention;
[0038] Figure 5 This is a structural diagram of an electronic device that implements a data processing method according to an embodiment of the present invention. Detailed Implementation
[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0040] It should be noted that the terms "first," "second," and "target," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0041] In the technical solutions of the embodiments of the present invention, the acquisition, storage and application of plaintext data, encryption algorithm identifiers and keys, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0042] Example 1
[0043] Figure 1A This is a flowchart of a data processing method provided in Embodiment 1 of the present invention. This embodiment is applicable to the situation where plaintext data is encrypted and stored in a database. The method can be executed by a data processing device, which can be implemented in hardware and / or software and specifically configured in an electronic device, such as an encryption device.
[0044] See Figure 1A The data processing method shown is executed by the encryption end and includes:
[0045] S101. By reading the metadata of the target data table, the encrypted information corresponding to the target data table is obtained; the encrypted information includes the first encryption algorithm identifier and the first key ciphertext.
[0046] S102. Based on the second encryption algorithm identifier, the second key plaintext, and the encryption information, the target data plaintext is encrypted to obtain the target data ciphertext, and the target data ciphertext is stored in the storage medium corresponding to the target data table.
[0047] S103. Add the encrypted information to the file format information of the storage medium.
[0048] In this embodiment, the target data table can be a data table in a distributed database; the storage medium corresponding to the target data table can be used to store the encrypted target data plaintext, i.e., the target data ciphertext. The target data table can be used to organize and manage the target data plaintext stored in its corresponding storage medium.
[0049] The metadata of the target data table can be used to describe the table's attributes, such as the table name, field names, number of fields, data types of each field, and index information. The metadata of the target data table also includes encryption information; this encryption information may include, but is not limited to, a first encryption algorithm identifier and a first key ciphertext. The first encryption algorithm identifier can be used to uniquely identify the first encryption algorithm; the first key ciphertext can be the encryption result of the first key plaintext; the first encryption algorithm and the first key plaintext can be used to encrypt the target data plaintext. The second encryption algorithm identifier can be used to uniquely identify the second encryption algorithm; the second encryption algorithm and the second key plaintext can be used to encrypt the first key ciphertext.
[0050] The storage medium corresponding to the target data table can be a local storage medium or a remote storage medium, etc., and this invention does not limit the type of storage medium. File format information can be used to describe the storage structure, byte arrangement, identification information, and verification mechanism of the data in the storage medium, to ensure that the data in the storage medium can be correctly identified, read, parsed, and processed. File format information may include, but is not limited to, data area information, index area information, and footer area information.
[0051] Specifically, the first encryption algorithm identifier and the first key ciphertext are read from the target data table metadata; the target data plaintext is encrypted using a certain algorithm based on the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext, and the target data ciphertext is stored in the storage medium corresponding to the target data table; the encryption information is added to the file format information of the storage medium.
[0052] Optionally, the target data plaintext is encrypted according to the second encryption algorithm identifier, the second key plaintext, the first encryption algorithm identifier, and the first key ciphertext to obtain the target data ciphertext, including: decrypting the first key ciphertext according to the second key plaintext and the second encryption algorithm identifier to obtain the first key plaintext; and encrypting the target data plaintext according to the first encryption algorithm identifier and the first key plaintext to obtain the target data ciphertext.
[0053] Specifically, the second encryption algorithm can be identified by the second encryption algorithm identifier and the corresponding second decryption algorithm; the first key ciphertext can be decrypted according to the second decryption algorithm and the second key plaintext to obtain the first key plaintext; the first encryption algorithm identified by the first encryption algorithm identifier can be identified; the target data plaintext can be encrypted using the first encryption algorithm and the first key plaintext to obtain the target data ciphertext.
[0054] Optionally, the first encryption algorithm may differ from the second encryption algorithm.
[0055] It is understandable that by adopting the above technical solution, the first key ciphertext can be decrypted according to the second decryption algorithm and the second key plaintext to obtain the first key plaintext, thereby improving the security of the first key plaintext and then encrypting the target data ciphertext. This can prevent the leakage of the first key plaintext and improve the security of the target data ciphertext.
[0056] In an optional embodiment, a third key plaintext is also included; the third key plaintext can be represented in string form; the third key plaintext can be stored directly in plaintext form or in ciphertext form, and obtained by decrypting the third key ciphertext using the second encryption algorithm and the second key plaintext. After obtaining the first key plaintext, the final key plaintext is calculated based on the first key plaintext and the third key plaintext; the target data plaintext is encrypted using the first encryption algorithm and the final key plaintext to obtain the target data ciphertext; the third key plaintext can be set independently by technical personnel.
[0057] Optionally, before obtaining the encrypted information corresponding to the target data table by reading the metadata of the target data table, the method further includes: encrypting the first key plaintext using a second encryption algorithm and the second key plaintext to obtain the first key ciphertext; generating a first encryption algorithm identifier; and adding the first encryption algorithm identifier and the first key ciphertext as encrypted information to the metadata of the data table.
[0058] Furthermore, before obtaining the encrypted information corresponding to the target data table by reading the metadata of the target data table, the process also includes: entrusting the second encryption algorithm and the plaintext of the second key to a distributed service for management; the distributed database adopts a storage architecture that separates metadata from actual stored data, with the actual stored data stored in shards on distributed nodes to flexibly adapt to distributed databases with different architectures.
[0059] Optionally, an encryption identifier can be added to the file format information of the storage medium. This encryption identifier indicates that the data stored in the data page is encrypted, meaning the data stored in the data page is in a ciphertext state. It is understood that by using the above technical solution, by adding an encryption identifier to the file format information, the data page storing the target ciphertext can be identified, so that the target ciphertext can be decrypted when it is subsequently read.
[0060] Preferably, the encryption information and encryption identifier can be added to the footer information in the file format information to avoid affecting the database data or index information stored in the storage medium.
[0061] Optional, Figure 1B This is a structural diagram of a file format with added encryption information and encryption identifiers. For example... Figure 1B As shown, the file format structure includes a data region, an index region, and a footer. The data region includes an N-column structure: column a, column b, ..., column n. Each column contains multiple data pages (Page 0: Data Page). The index region includes an index column structure and a short key index structure; the index column region includes Bloom filter pages, bitmap pages, and ordinal index pages. The footer includes a file footer structure (FileFooterPB), an encryption information structure (EncryptionPB), a checksum structure (PB Checksum), a length structure (PB Length), and a identifier structure (MAGICCODE).
[0062] The encrypted information structure stores a first encryption algorithm identifier and a first key ciphertext. In an optional embodiment, after adding the encrypted information to the encrypted information structure in the footer area, the encrypted information structure can be serialized to make it more compact and improve encoding efficiency.
[0063] The checksum structure stores a checksum. After the target data is encrypted and stored in the storage medium, the 32-bit checksum of the full data stored in the storage medium can be calculated using the Cyclic Redundancy Check (CRC) algorithm, and the checksum in the checksum structure can be updated to this 32-bit checksum.
[0064] The length structure stores the data page length. After the target data ciphertext is stored in the storage medium, the new data page length can be calculated, and the data page length in the length structure can be updated to the calculated new data page length.
[0065] The identifier structure may store an encrypted identifier to distinguish between storage media that store encrypted data and storage media that do not store encrypted data. For example, when reading data from a storage medium, if an encrypted identifier is found in the identifier structure of the storage medium's file format, it is determined that the storage medium stores encrypted data, which needs to be decrypted subsequently. If no encrypted identifier is found in the identifier structure of the storage medium's file format, it is determined that the storage medium stores plaintext data.
[0066] Understandable Figure 1B The file format structure shown, compared to the traditional file format structure in existing technologies, adds an encryption information structure and an identifier structure to the footer area, which are used to store encryption information and encryption identifiers respectively. The content of the footer area provides a file reading method, and no other structures in the file format structure are modified, ensuring the integrity of the data area structure and the index area structure; it can ensure the normal use of other functions of the database while the plaintext data is encrypted, and achieves read and write compatibility for plaintext and encrypted data.
[0067] This invention decrypts the first key ciphertext using a second encryption algorithm and the second key plaintext to obtain the first key plaintext. Then, it encrypts the plaintext data using the first key plaintext and the first encryption algorithm, improving the security of the plaintext data. By reading the first encryption algorithm identifier and the first key ciphertext from the metadata of the data table, and then encrypting and storing the plaintext data, compared to existing technologies, this invention does not rely on dedicated chips and is applicable to data encryption in distributed databases of any architecture. Furthermore, it supports different encryption keys for different data tables within the same database, further enhancing data security. Storing the encrypted information in the file format information of the storage medium also avoids affecting the database data stored in the storage medium. During the decryption process, the first key ciphertext and the first encryption algorithm identifier can be obtained by reading the data page information in the storage medium. Compared to existing technologies, this invention does not rely on dedicated chips and is applicable to data decryption in distributed databases of any architecture.
[0068] Example 2
[0069] Figure 2A This is a flowchart of a data processing method provided in Embodiment 2 of the present invention. This embodiment is applicable to the decryption of encrypted data stored in a database. The method can be executed by a data processing device, which can be implemented in hardware and / or software and specifically configured in an electronic device, such as a decryption device.
[0070] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.
[0071] See Figure 2A The data processing method shown is executed by the decryption end and includes:
[0072] S201. By reading the file format information of the storage medium corresponding to the target data table, the encrypted information is obtained; the encrypted information includes the first encryption algorithm identifier and the first key ciphertext.
[0073] S202. Obtain the encrypted target data stored in the storage medium corresponding to the target data table.
[0074] S203. Decrypt the target data ciphertext according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data plaintext; the target data ciphertext is obtained by encrypting the target data plaintext according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext.
[0075] In this embodiment, the target data table can be a data table in a distributed database; the storage medium corresponding to the target data table can be used to store the encrypted target data plaintext, i.e., the target data ciphertext. The target data table can be used to organize and manage the target data plaintext stored in its corresponding storage medium.
[0076] The encrypted information may include, but is not limited to, a first encryption algorithm identifier and a first key ciphertext. The first encryption algorithm identifier can be used to uniquely identify the first encryption algorithm; the first key ciphertext can be the encrypted result of the first key plaintext; the first encryption algorithm and the first key plaintext can be used to encrypt the target data plaintext. The second encryption algorithm identifier can be used to uniquely identify the second encryption algorithm; the second encryption algorithm and the second key plaintext can be used to encrypt the first key ciphertext.
[0077] The storage medium corresponding to the target data table can be a local storage medium or a remote storage medium, etc., and this invention does not limit the type of storage medium. File format information can be used to describe the storage structure, byte arrangement, identification information, and verification mechanism of the data in the storage medium, to ensure that the data in the storage medium can be correctly identified, read, parsed, and processed. File format information may include, but is not limited to, data area information, index area information, and footer area information.
[0078] Specifically, encrypted information is obtained by reading the file format information of the storage medium corresponding to the target data table; the encrypted information includes the first encryption algorithm identifier and the first key ciphertext; the target data ciphertext stored in the storage medium corresponding to the target data table is obtained; and the target data ciphertext is decrypted using a certain algorithm based on the second encryption algorithm identifier, the second key plaintext, and the encrypted information to obtain the target data plaintext.
[0079] Optionally, the target data ciphertext is decrypted according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data plaintext, including: decrypting the first key ciphertext using the second decryption algorithm corresponding to the second encryption algorithm identifier and the second key plaintext to obtain the first key plaintext; and decrypting the target data ciphertext using the first decryption algorithm corresponding to the first encryption algorithm identifier and the first key plaintext to obtain the target data plaintext.
[0080] It is understandable that by adopting the above technical solution, the first key ciphertext is decrypted according to the second decryption algorithm and the second key plaintext to obtain the first key plaintext, thereby improving the security of the first key plaintext and then decrypting it to obtain the target data ciphertext. This can prevent the leakage of the first key plaintext and improve the security of the target data ciphertext.
[0081] In an optional embodiment, a third key plaintext is also included; the third key plaintext can be represented in string form; the third key plaintext can be stored directly in plaintext form or in ciphertext form, and obtained by decrypting the third key ciphertext using the second encryption algorithm and the second key plaintext. After obtaining the first key plaintext, the final key plaintext is calculated based on the first key plaintext and the third key plaintext; the target data ciphertext is decrypted using the first encryption algorithm to identify the corresponding first decryption algorithm and the final key plaintext, thus obtaining the target data plaintext; the third key plaintext can be set independently by technical personnel.
[0082] Optional, Figure 2B This is a schematic diagram of a data processing workflow. For example... Figure 2B As shown, it includes the FileSystem abstraction layer, FileReader, FileWriter, Encrypt, Decrypt, LocalFileSystem, and RemoteFileSystem.
[0083] The FileSystem, as the core component, manages data read and write operations and supports different file systems to meet diverse data storage needs. When reading or writing data, the FileSystem creates corresponding file read or write handles for the operation. The creation process reads the metadata of the data table; the successfully created handle holds encrypted information, namely the first encryption algorithm identifier and the first key ciphertext, used to call the corresponding encryption or decryption interfaces. The LocalFileSystem and RemoteFileSystem handle the actual read and write operations for local and remote storage, respectively. The encryption and decryption interfaces provide encryption and decryption functions based on the handle information.
[0084] During the data reading process, data flows from the storage medium to the file system abstraction layer, and then to the file read handle. During file writing, data flows from the file write handle to the file system abstraction layer, and then to the storage medium. Encryption and decryption operations occur between the file system abstraction layer and the storage medium. Because data is sent to the corresponding file system via the file system abstraction layer, the encryption and decryption operations are transparent to the file system, ensuring the original design's scalability for the file system and adapting to the flexibility of distributed databases on different platforms.
[0085] Furthermore, the encryption interface can provide encryption algorithms for both data and key encryption. It can connect to Open Secure Sockets Layer (OpenSSL) components to support various encryption algorithms, including AES and SM4. During encryption, the target data is pre-assembled into a complete block of memory, reducing the overhead of encryption interface calls and further optimizing subsequent data transmission to the file system.
[0086] The decryption interface writes the decrypted plaintext data into the cache, which speeds up database reading and reduces the overhead of calling the decryption interface.
[0087] This invention improves the security of plaintext data by decrypting ciphertext of the first key using a second encryption algorithm and a second key plaintext. Furthermore, it decrypts ciphertext using the first key plaintext and the first encryption algorithm. The first key ciphertext and the first encryption algorithm identifier can be obtained by reading data page information from the storage medium. Compared to existing technologies, this invention does not rely on dedicated chips and is applicable to data decryption in distributed databases with any architecture.
[0088] Example 3
[0089] Figure 3 This is a schematic diagram of a data processing device according to Embodiment 3 of the present invention. This embodiment of the present invention is applicable to situations where plaintext data is encrypted and stored in a database. The device can execute a data processing method and can be implemented in hardware and / or software. The device can be configured in an electronic device, such as an encryption device.
[0090] See Figure 3 The data processing device shown includes a reading module 301, an encryption module 302, and an information adding module 303, wherein...
[0091] The reading module 301 is used to obtain the encrypted information corresponding to the target data table by reading the metadata of the target data table; the encrypted information includes the first encryption algorithm identifier and the first key ciphertext;
[0092] The encryption module 302 is used to encrypt the target data plaintext according to the second encryption algorithm identifier, the second key plaintext and encryption information to obtain the target data ciphertext, and store the target data ciphertext in the storage medium corresponding to the target data table;
[0093] The information adding module 303 is used to add encrypted information to the file format information of the storage medium.
[0094] This invention improves the security of plaintext data by decrypting ciphertext with a first key using a second encryption algorithm and a second key plaintext. It further enhances security by encrypting plaintext data using the first key plaintext and the first encryption algorithm. By reading the first encryption algorithm identifier and the first key ciphertext from the metadata of the data table, and then encrypting and storing the plaintext data, this invention, compared to existing technologies, does not rely on dedicated chips and is applicable to data encryption in distributed databases of any architecture. Storing the encrypted information in the file format information of the storage medium also avoids affecting the database data stored in the storage medium. During decryption, the first key ciphertext and the first encryption algorithm identifier can be obtained by reading the data page information in the storage medium. This invention, compared to existing technologies, does not rely on dedicated chips and is applicable to data decryption in distributed databases of any architecture.
[0095] Optional, encryption module 302, specifically used for:
[0096] Based on the plaintext of the second key and the identifier of the second encryption algorithm, the ciphertext of the first key is decrypted to obtain the plaintext of the first key;
[0097] Based on the first encryption algorithm identifier and the first key plaintext, the target data plaintext is encrypted to obtain the target data ciphertext.
[0098] Optionally, the device may also include:
[0099] The identifier addition module is used to add an encryption identifier to the file format information of the storage medium.
[0100] The data processing apparatus provided in this embodiment of the invention can execute a data processing method provided in any embodiment of the invention, and has the functional modules and beneficial effects corresponding to executing a data processing method.
[0101] Example 4
[0102] Figure 4 This is a schematic diagram of a data processing device according to Embodiment 3 of the present invention. This embodiment of the present invention is applicable to the decryption of encrypted data stored in a database. The device can execute a data processing method and can be implemented in hardware and / or software. The device can be configured in an electronic device, such as a decryption device.
[0103] See Figure 4 The data processing device shown includes a reading module 401, an acquisition module 402, and a decryption module 403, wherein...
[0104] The reading module 401 is used to obtain encrypted information by reading the file format information of the storage medium corresponding to the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext;
[0105] Module 402 retrieves the encrypted target data stored in the storage medium corresponding to the target data table;
[0106] The decryption module 403 is used to decrypt the target data ciphertext according to the second encryption algorithm identifier, the second key plaintext and encryption information to obtain the target data plaintext;
[0107] The target data ciphertext is obtained in the following way:
[0108] The target data plaintext is encrypted based on the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext.
[0109] This invention improves the security of plaintext data by decrypting ciphertext of the first key using a second encryption algorithm and a second key plaintext. Furthermore, it decrypts ciphertext using the first key plaintext and the first encryption algorithm. The first key ciphertext and the first encryption algorithm identifier can be obtained by reading data page information from the storage medium. Compared to existing technologies, this invention does not rely on dedicated chips and is applicable to data decryption in distributed databases with any architecture.
[0110] Optional, decryption module 403, specifically used for:
[0111] The first key ciphertext is decrypted using the second encryption algorithm identifier, the corresponding second decryption algorithm, and the second key plaintext to obtain the first key plaintext;
[0112] The target data ciphertext is decrypted using the first encryption algorithm identifier and the corresponding first decryption algorithm and first key plaintext to obtain the target data plaintext.
[0113] The data processing apparatus provided in this embodiment of the invention can execute a data processing method provided in any embodiment of the invention, and has the functional modules and beneficial effects corresponding to executing a data processing method.
[0114] Example 5
[0115] Figure 5A schematic diagram of a data processing device 510 that can be used to implement embodiments of the present invention is shown. A data processing device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. A data processing device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.
[0116] like Figure 5 As shown, a data processing device 510 includes at least one processor 511 and a memory, such as a read-only memory (ROM) 512 or a random access memory (RAM) 513, communicatively connected to the at least one processor 511. The memory stores computer programs executable by the at least one processor. The processor 511 can perform various appropriate actions and processes based on the computer program stored in the ROM 512 or loaded from storage unit 518 into the RAM 513. The RAM 513 may also store various programs and data required for the operation of the data processing device 510. The processor 511, ROM 512, and RAM 513 are interconnected via a bus 514. An input / output (I / O) interface 515 is also connected to the bus 514.
[0117] A data processing device 510 includes multiple components connected to an I / O interface 515, including: an input unit 516, such as a keyboard or mouse; an output unit 517, such as various types of displays or speakers; a storage unit 518, such as a hard disk or optical disk; and a communication unit 519, such as a network interface card (NIC), a modem, or a wireless transceiver. The communication unit 519 allows the data processing device 510 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0118] Processor 511 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 511 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 511 performs the various methods and processes described above, such as a data processing method.
[0119] In some embodiments, a data processing method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 518. In some embodiments, part or all of the computer program may be loaded and / or installed on a data processing device 510 via ROM 512 and / or communication unit 519. When the computer program is loaded into RAM 513 and executed by processor 511, one or more steps of the data processing method described above may be performed. Alternatively, in other embodiments, processor 511 may be configured to perform a data processing method by any other suitable means (e.g., by means of firmware).
[0120] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0121] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0122] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on a data processing device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the data processing device. Other types of devices can also be used to provide interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0124] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.
[0125] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability.
[0126] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.
[0127] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
Claims
1. A data processing method, characterized in that, The method is executed by the encryption end, and the method includes: By reading the metadata of the target data table, the encrypted information corresponding to the target data table is obtained; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext. The target data plaintext is encrypted according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext, and the target data ciphertext is stored in the storage medium corresponding to the target data table; The encrypted information is added to the file format information of the storage medium.
2. The method according to claim 1, characterized in that, The step of encrypting the target data plaintext according to the second encryption algorithm identifier, the second key plaintext, the first encryption algorithm identifier, and the first key ciphertext to obtain the target data ciphertext includes: Based on the second key plaintext and the second encryption algorithm identifier, the first key ciphertext is decrypted to obtain the first key plaintext; The target data plaintext is encrypted according to the first encryption algorithm identifier and the first key plaintext to obtain the target data ciphertext.
3. The method according to claim 1, characterized in that, The method further includes: Add an encryption identifier to the file format information of the storage medium.
4. A data processing method, characterized in that, The method is executed by the decryption end, and the method includes: Encrypted information is obtained by reading the file format information of the storage medium corresponding to the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext; Retrieve the encrypted target data stored in the storage medium corresponding to the target data table; Based on the second encryption algorithm identifier, the second key plaintext, and the encryption information, the target data ciphertext is decrypted to obtain the target data plaintext. The target data ciphertext is obtained by the data processing method as described in any one of claims 1-3.
5. The method according to claim 4, characterized in that, The step of decrypting the target data ciphertext according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data plaintext includes: The first key ciphertext is decrypted using the second encryption algorithm identifier corresponding to the second decryption algorithm and the second key plaintext to obtain the first key plaintext; The target data ciphertext is decrypted using the first encryption algorithm identifier corresponding to the first decryption algorithm and the first key plaintext to obtain the target data plaintext.
6. A data processing apparatus, characterized in that, The device is configured at the encryption end, and the device includes: The reading module is used to obtain the encrypted information corresponding to the target data table by reading the metadata of the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext; An encryption module is used to encrypt the target data plaintext according to the second encryption algorithm identifier, the second key plaintext and the encryption information to obtain the target data ciphertext, and store the target data ciphertext in the storage medium corresponding to the target data table; The information adding module is used to add the encrypted information to the file format information of the storage medium.
7. A data processing apparatus, characterized in that, The device is configured at the decryption end, and the device includes: The reading module is used to obtain encrypted information by reading the file format information of the storage medium corresponding to the target data table; the encrypted information includes a first encryption algorithm identifier and a first key ciphertext; The decryption module is used to decrypt the target data ciphertext according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data plaintext; The target data ciphertext is obtained in the following way: The target data plaintext is encrypted according to the second encryption algorithm identifier, the second key plaintext, and the encryption information to obtain the target data ciphertext.
8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform a data processing method according to any one of claims 1-5.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute a data processing method according to any one of claims 1-5.
10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements a data processing method according to any one of claims 1-5.