Fully-encrypted database file calling method based on trusted execution environment, fully-encrypted database server and storage medium

Abstract

The invention discloses a full-secret-state database file calling method based on a trusted execution environment, a full-secret-state database server and a storage medium, and relates to the technical field of data security. The method comprises the following steps: receiving encryption operation data sent by a client security agent through a network management service of a host machine; decrypting the encrypted operation data into plaintext operation data through a server security agent in the trusted execution environment; decrypting the encrypted database file read by the secret state storage module into a plaintext database file through a database engine in the trusted execution environment, and generating a plaintext execution result; and encrypting the plaintext execution result into an encrypted execution result through the server security agent, sending the encrypted execution result to the client security agent through the network management server, and returning the encrypted execution result to the business system after the client security agent decrypts the encrypted execution result. Therefore, full-life-cycle secret state protection of data transmission, calculation and storage is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a full-mesh database file calling method based on a trusted execution environment, a full-mesh database server and a storage medium. BACKGROUND

[0002] In the current high-speed development of digital economy, data has gradually become the core production factor driving the innovation and development of various industries, widely penetrating various fields such as e-commerce, and supporting a series of key activities such as enterprise business operation. As the core carrier of data storage and management, the safe and stable operation of the database is directly related to the integrity, confidentiality and availability of data assets. In order to cope with database security risks, a variety of traditional database encryption schemes have been formed, including but not limited to: Application encryption, this scheme realizes data encryption by intercepting and rewriting structured query statements on the application side, and technical personnel need to sort out structured query statements in the application one by one, and design rewriting rules for complex structured query statements. If the business needs to transmit data from the current application to other related applications, and these applications are not deployed with the same data encryption rules, the current application needs to decrypt the ciphertext into plaintext before transmission, at which time the data in the transmission link exists in plaintext form, which has a risk of leakage.

[0003] Database native encryption, taking transparent data encryption (TDE) as an example, the encryption range of this encryption method is limited to disk storage, data is encrypted when written to disk, but must be decrypted into plaintext when read and used, so data runs in plaintext form in memory, which is difficult to resist attacks on memory.

[0004] These traditional database encryption schemes do not realize the full life cycle security protection of data collection, transmission, storage and use, and it is difficult to guarantee the safe and stable operation of the database.

[0005] Therefore, the prior art still needs to be improved and developed. SUMMARY

[0006] The technical problem to be solved by the present application is to provide a full-mesh database file calling method based on a trusted execution environment, a full-mesh database server and a storage medium, aiming at solving the problem that the existing database encryption scheme does not realize the full life cycle security protection of data collection, transmission, storage and use, and it is difficult to guarantee the safe and stable operation of the database.

[0007] The technical scheme adopted by the present application to solve the problem is as follows: In a first aspect, the present application provides a full-mesh database file calling method based on a trusted execution environment, which is applied to a full-mesh database server, and the method comprises: Receive encrypted operation data sent by the client security agent through a network management service of the host computer, wherein the encrypted operation data is obtained by encrypting clear operation data provided by a business system based on the client security agent; and the operation data comprises a query statement; Decrypt the encrypted operation data into clear operation data through a server security agent in a trusted execution environment; Read an encrypted database file based on a ciphertext storage module through a database engine in the trusted execution environment; decrypt the encrypted database file into a clear database file in the trusted execution environment, and execute a corresponding data processing task based on the clear database file and the clear operation data to obtain a clear execution result; Encrypt the clear execution result into an encrypted execution result through the server security agent, and send the encrypted execution result to the client security agent through the network management service, so that the client security agent decrypts the encrypted execution result and returns it to the business system.

[0008] In an embodiment, the data encryption and decryption operations of the client security agent and the server security agent are both performed based on a symmetric encryption key negotiated, and a method for generating the symmetric encryption key comprises: Receive the public key and identity certificate of a user sent by the client security agent through the server security agent, and return the public key and device certificate of the trusted execution environment to the client security agent; Make the server security agent and the client security agent perform key exchange based on their respective private keys and the public key of the other party through an asymmetric encryption algorithm, and generate a symmetric encryption key through negotiation; Verify the legality of the identity certificate based on a trusted execution environment remote authentication mechanism through the server security agent, and make the client security agent verify the validity of the device certificate; After both parties pass the verification, establish an encrypted communication connection through the symmetric encryption key.

[0009] In an embodiment, the encrypted database file is a database file encrypted based on a symmetric encryption algorithm.

[0010] In an embodiment, executing a corresponding data processing task based on the clear database file and the clear operation data to obtain a clear execution result comprises: Verify the clear database file through a hash algorithm; After the verification passes, execute a corresponding data processing task based on the clear database file and the clear operation data to obtain a clear execution result, and verify the clear execution result through the hash algorithm.

[0011] In an implementation, the method further comprises: In the initial deployment migration phase, the full-encryption database server is synchronized with the plaintext database by a preset migration tool according to the plaintext database, and consistency verification is performed after the synchronization is completed.

[0012] In an implementation, the use priorities of the full-encryption database server and the plaintext database correspondingly are determined based on current traffic.

[0013] In an implementation, the method further comprises: If the current traffic is lower than a preset threshold, the use priority of the full-encryption database server is higher than that of the plaintext database. If the use priority is switched when the use priority of the full-encryption database server is higher than that of the plaintext database, before the switching, the plaintext database is synchronized with the full-encryption database server by the preset migration tool, and consistency verification is performed after the synchronization is completed.

[0014] In an implementation, the method further comprises: When the original device corresponding to the trusted execution environment is damaged, the key of a new device is recovered by key backup, and the encrypted database file on the full-encryption database server is synchronized to the new device.

[0015] In a second aspect, the embodiments of the present application further provide a full-encryption database server, which comprises: A network management service of a host computer, configured to receive encrypted operation data sent by a client security agent; wherein the encrypted operation data is obtained by encrypting plaintext operation data provided by a business system based on the client security agent; and the operation data comprises a query statement. A server security agent in a trusted execution environment, configured to decrypt the encrypted operation data into plaintext operation data. A database engine in the trusted execution environment, configured to read an encrypted database file through a full-encryption storage module; decrypt the encrypted database file into a plaintext database file in the trusted execution environment; execute a corresponding data processing task according to the plaintext database file and the plaintext operation data, and obtain a plaintext execution result. The server security agent is further configured to encrypt the plaintext execution result into an encrypted execution result. The network management service is further configured to send the encrypted execution result to the client security agent, so that the client security agent decrypts the encrypted execution result and returns it to the business system.

[0016] In a third aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a plurality of instructions, the instructions being suitable for being loaded and executed by a processor to implement the steps of the method for calling a full-mechanism database file based on a trusted execution environment as described in any of the above.

[0017] The present application has the following beneficial effects: The embodiments of the present application receive encrypted operation data sent by a client security agent through a network management service of a host computer; decrypt the encrypted operation data into plaintext operation data through a server security agent in a trusted execution environment; decrypt an encrypted database file read through a mechanism storage module into a plaintext database file and generate a plaintext execution result through a database engine in the trusted execution environment; encrypt the plaintext execution result into encrypted execution result through the server security agent and send the encrypted execution result to the client security agent through the network management service, and the client security agent decrypts the encrypted execution result and returns it to a business system. Thus, full-life-cycle mechanism protection of data transmission, calculation and storage is realized. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort based on these drawings.

[0019] Figure 1 is a flowchart of the method for calling a full-mechanism database file based on a trusted execution environment provided by the embodiments of the present application.

[0020] Figure 2 is a functional module of a full-mechanism database server and an interaction diagram of the full-mechanism database server and a database client provided by the embodiments of the present application. DETAILED DESCRIPTION

[0021] The present application discloses a method for calling a full-mechanism database file based on a trusted execution environment, a full-mechanism database server and a storage medium. In order to make the purpose, technical solutions and effects of the present application more clear and explicit, the following will further describe the present application in detail with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0022] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or wireless coupling. The term “and / or” as used herein includes all or any units and all combinations of one or more associated listed items.

[0023] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0024] To address the aforementioned deficiencies in existing technologies, this invention provides a fully encrypted database file retrieval method based on a trusted execution environment (TEA). The method includes: receiving encrypted operation data sent by a client security agent through a host machine's network management service; wherein the encrypted operation data is obtained by the client security agent from encrypted plaintext operation data provided by a business system; the operation data includes a query statement; decrypting the encrypted operation data into plaintext operation data through a server-side security agent in the TEA; reading an encrypted database file based on a encrypted storage module through a database engine in the TEA; decrypting the encrypted database file into a plaintext database file in the TEA; executing a corresponding data processing task based on the plaintext database file and the plaintext operation data to obtain a plaintext execution result; encrypting the plaintext execution result into an encrypted execution result through the server-side security agent, and sending the encrypted execution result to the client security agent via the network management service, so that the client security agent decrypts the encrypted execution result and returns it to the business system. This invention employs a four-layer architecture—client-side security proxy, server-side security proxy, database engine within a trusted execution environment, and encrypted storage module—combined with data encryption and decryption algorithms, to achieve end-to-end encryption and plaintext processing within a trusted execution environment for database queries. This provides encrypted protection throughout the entire lifecycle of data transmission, computation, and storage, with final decryption only performed on the client side. It is suitable for scenarios with high data privacy protection requirements and can solve the problem of confidentiality protection for sensitive data throughout its entire lifecycle.

[0025] like Figure 1 As shown, the method is applied to a fully encrypted database server, and the method specifically includes: Step S100: Receive encrypted operation data sent by the client security agent through the host machine's network management service; wherein the encrypted operation data is obtained by the client security agent through encryption of plaintext operation data provided by the business system; the operation data includes query statements.

[0026] Specifically, the client's business system first outputs plaintext operation data for database operations, such as a structured query statement (SQL statement) for querying user orders. The client security agent, acting as the front-end encryption entry point, receives this plaintext operation data, encrypts it, and generates encrypted operation data. Subsequently, the client security agent sends this encrypted operation data to the fully encrypted database server to ensure that the operation data is encrypted before entering the transmission link, preventing the data itself from being leaked. Afterwards, the host machine's network management service receives this encrypted operation data. This network management service is only responsible for receiving the encrypted operation data sent by the client and does not parse the content of the encrypted operation data.

[0027] Step S200: Decrypt the encrypted operation data into plaintext operation data through the server-side security proxy in the trusted execution environment.

[0028] The network management service transmits encrypted operation data to a server-side security agent deployed within a Trusted Execution Environment (TEE). The server-side security agent resides within this isolated and trusted hardware-level protected area of ​​the TEE, preventing unauthorized access to data from external programs. Upon receiving the encrypted operation data, the server-side security agent decrypts it within the TEE, restoring the original plaintext operation data from the business system. At this point, the plaintext operation data exists only within the TEE and is not leaked to the external environment. This achieves secure access of encrypted operation data from the external network to the TEE, preventing data tampering or theft during transmission.

[0029] In one implementation, both the client-side security proxy and the server-side security proxy perform data encryption and decryption operations based on a negotiated symmetric encryption key, wherein the method for generating the symmetric encryption key includes: The server-side security proxy receives the user's public key and identity certificate sent by the client-side security proxy, and returns the public key and device certificate of the trusted execution environment to the client-side security proxy. Using an asymmetric encryption algorithm, the server-side security agent and the client-side security agent exchange keys based on their respective private keys and the other party's public key, and negotiate to generate a symmetric encryption key. The server-side security agent verifies the legitimacy of the identity certificate through a remote authentication mechanism based on a trusted execution environment, and the client-side security agent verifies the validity of the device certificate. After both parties verify the connection, they establish an encrypted communication connection using the symmetric encryption key.

[0030] Key negotiation is fundamental to establishing a secure connection. It primarily involves the client agent and server security agent exchanging keys based on a key negotiation algorithm to generate a symmetric encryption key for subsequent data transmission encryption and decryption. The key negotiation algorithm can employ asymmetric encryption, such as the Elliptic Curve Public Key Cryptography (SM2) algorithm. This step establishes a trusted encrypted communication connection between the client and server security agents, preventing subsequent data transmission from being tampered with. Specifically, the client security agent first sends its public key and identity certificate to the server security agent, which returns the Trusted Execution Environment's public key (e.g., the SPU public key, where SPU stands for Data Security Processing Unit) and device certificate. Then, both parties negotiate and generate a symmetric encryption key using an asymmetric encryption algorithm. Afterward, both parties verify each other's identity and the authenticity of their environments: the server security agent verifies the client's legitimacy through the Trusted Execution Environment's remote authentication mechanism, such as verifying the validity of the certificate signature, the certificate's expiration date, and the user's status on the authorized list. The client verifies the validity of the trusted execution environment's device certificate to confirm its trustworthiness. This includes verifying whether the certificate was issued by a legitimate authority, whether the device hardware identifier matches the certificate, and whether the trusted execution environment has been tampered with. Finally, after successful authentication, an encrypted communication connection is established, and all data between the client and server is transmitted encrypted using the negotiated symmetric encryption key.

[0031] Step S300: Read the encrypted database file based on the encrypted storage module through the database engine in the trusted execution environment; decrypt the encrypted database file into a plaintext database file in the trusted execution environment; execute the corresponding data processing task according to the plaintext database file and the plaintext operation data to obtain the plaintext execution result.

[0032] This embodiment pre-constructs a hardware isolation environment based on a Trusted Execution Environment (TEE). The database engine is fully deployed within this TEE, blocking access to plaintext data by the host operating system and external applications, thus resisting side-channel attacks and memory scraping. Specifically, the database engine within the TEE reads pre-stored encrypted database files (i.e., encrypted database files) through a secure storage module. These database files remain encrypted during storage, and the decryption process after reading is also confined within the TEE, where the database engine decrypts the encrypted database files into plaintext database files. Because the plaintext database files only circulate within the TEE, external attackers cannot obtain them through memory scraping. The database engine directly executes corresponding data processing tasks within the TEE, such as data querying, filtering, association, and calculation, ultimately obtaining plaintext execution results. The entire data processing process is completed within the secure isolation boundary of the TEE, preventing the exposure of plaintext data in untrusted memory during data use.

[0033] Furthermore, the database engine can implement the following functions: Supports Structured Query Standard (SQL Standard): The database engine is compatible with industry-standard structured query syntax. Existing structured query statements written by enterprises can be used directly without modification, avoiding business logic modifications caused by incompatibility with structured query syntax.

[0034] Supports ACID properties for transactions: ACID is an acronym for the four fundamental properties of a database transaction: Atomicity, Consistency, Isolation, and Durability. Database engines that support ACID properties for transactions can meet the needs of scenarios with high data consistency requirements, such as e-commerce.

[0035] Supports complex queries and index building: Complex queries include, but are not limited to, fuzzy queries, range queries, and aggregation calculations. The role of indexes is to accelerate data retrieval and quickly locate target data. The database engine supports index building, ensuring both security and query efficiency. Building an index in an encrypted state requires additional encryption of the indexed fields, and decryption is necessary during queries, a cumbersome and time-consuming process. Building a plaintext index in an untrusted environment poses a risk of data leakage. This embodiment builds plaintext indexes within a trusted execution environment. On one hand, the strong isolation of the trusted execution environment prevents plaintext indexes from being stolen externally; on the other hand, plaintext indexes do not require additional encryption / decryption operations and can be directly used for query matching, significantly reducing performance overhead during the query process. The combination of plaintext index building and hardware-accelerated computation effectively controls encryption performance overhead.

[0036] Supports mainstream engines: This embodiment supports transparent access to mainstream database engines such as Oracle, MySQL, and TDSQL, without requiring modification of the engine kernel or business system transformation, thus achieving zero migration cost.

[0037] In one implementation, the encrypted database file is a database file encrypted using a symmetric encryption algorithm.

[0038] Symmetric encryption refers to using the same key for both encryption and decryption. Symmetric encryption eliminates the need for complex key pairing calculations, and its encryption and decryption logic is simple, making it suitable for handling massive amounts of data such as database files. Furthermore, symmetric encryption can be combined with block ciphers. Block ciphers divide the original database file into fixed-length blocks, encrypt each block individually, and then concatenate all the encrypted blocks to obtain the complete encrypted database file. This method avoids loading the entire database file into memory for encryption at once, reducing server memory load and flexibly handling scenarios where the database file continuously expands, preventing encryption process lag or failure due to excessively large files. In practical applications, the SM4 algorithm (a block symmetric cipher algorithm) can be used to encrypt database files.

[0039] In one implementation, a corresponding data processing task is executed based on the plaintext database file and the plaintext operation data to obtain a plaintext execution result, including: The plaintext database file is verified using a hash algorithm; After the verification is passed, the corresponding data processing task is executed according to the plaintext database file and the plaintext operation data to obtain the plaintext execution result, and the plaintext execution result is verified by the hash algorithm.

[0040] Specifically, hash algorithms can be used for data verification before task execution: a base hash value corresponding to the original plaintext database file is pre-stored. This base hash value can be calculated and encrypted in a trusted execution environment after the database file is first generated or updated. When the encrypted database file is decrypted into a plaintext database file within the trusted execution environment, a query is not executed directly. Instead, the same hash algorithm is used to recalculate the hash value of this decrypted plaintext database file, and then the recalculated hash value is compared with the pre-stored base hash value. If the two are completely identical, it means the file has not been tampered with; if they are inconsistent, it is determined that the file has been tampered with, and the subsequent query process is terminated.

[0041] Hash algorithms can also be used for result verification after task execution: When the database engine executes a corresponding data processing task based on a plaintext database file and obtains the plaintext execution result, it immediately calculates the hash value of the plaintext execution result using a hash algorithm. This hash value can be stored synchronously with the plaintext execution result or used for matching with the recipient's verification actions. For example, when the server-side security agent subsequently sends the encrypted execution result to the client, it can simultaneously attach the hash value of the plaintext execution result; after the client decrypts the plaintext execution result, it recalculates the hash value using a hash algorithm and compares it with the attached hash value to confirm that the execution result has not been tampered with during transmission or processing. In practical applications, the SM3 algorithm (SM3 is a cryptographic hash function standard) can be used to verify the data integrity of the plaintext database file.

[0042] Step S400: The plaintext execution result is encrypted into an encrypted execution result through the server-side security proxy, and the encrypted execution result is sent to the client-side security proxy via the network management service, so that the client-side security proxy decrypts the encrypted execution result and returns it to the business system.

[0043] Specifically, the server-side security agent encrypts the plaintext execution result within the trusted execution environment to generate an encrypted execution result. The encrypted execution result is then sent back to the client-side security agent via the host machine's network management service. The client-side security agent decrypts the result and returns the plaintext execution result to the business system, completing the entire operation process. In this embodiment, all plaintext operations, such as query statement decryption, database file decryption, query execution, and result generation, are confined to the trusted execution environment. As a hardware-level trusted environment, the trusted execution environment possesses strong isolation, preventing external attackers from breaching its boundaries and obtaining plaintext data through memory scraping tools, malware, or other means. After the data processing task is completed, only the encrypted execution result is output, preventing plaintext data from leaking out of the trusted execution environment, thus resolving the security issue of plaintext exposure after decryption during data usage.

[0044] Taking the data query process as an example, the complete process steps include: First, the client sends a plaintext query statement to the client security agent. The client security agent encrypts the plaintext query statement using a symmetric key and sends the encrypted query statement to the server security agent. Subsequently, the server-side security proxy decrypts the encrypted query statement and forwards it to the database engine within the trusted execution environment; Then, the database engine reads the encrypted database file through the encrypted storage module, decrypts it into a plaintext database file within the trusted execution environment, executes the query operation, and obtains the plaintext execution result; Next, the database engine encrypts the plaintext execution result using a symmetric key, and then forwards the encrypted execution result to the client security proxy via the server-side security proxy. Finally, the client security agent decrypts the encrypted execution result and returns it to the client's business system.

[0045] In one implementation, the method further includes: During the initial deployment and migration phase, a preset migration tool is used to synchronize data with the fully encrypted database server based on the plaintext database, and a consistency check is performed after the data synchronization is completed.

[0046] Specifically, the initial deployment migration phase refers to the process of deploying a fully encrypted database from a traditional plaintext database, which typically refers to the existing business database. The default migration tool can be a non-disruptive migration tool, meaning a data migration tool that supports uninterrupted business operations. During the initial deployment migration phase, the fully encrypted database server is used as a backup database. The plaintext database data is synchronized using the default migration tool, and consistency is verified after synchronization to ensure the integrity and accuracy of the migrated data.

[0047] In one implementation, the usage priorities of the fully encrypted database server and the plaintext database are determined based on the current traffic volume.

[0048] Specifically, the priority of use reflects which database is the primary database and which is the backup database between the fully encrypted database server and the plaintext database. The dynamic switching between the primary and backup databases is implemented based on the key indicator of current business volume, so as to leverage the security advantages of the fully encrypted database while avoiding the impact of encryption performance degradation on data processing stability during peak business periods, thereby balancing system data security and business continuity.

[0049] In one implementation, the method further includes: If the current business volume is lower than a preset threshold, the use priority of the fully encrypted database server is higher than that of the plaintext database. If a priority switch is performed when the usage priority of the fully encrypted database server is higher than that of the plaintext database, the plaintext database is synchronized using the preset migration tool before the switch, and a consistency check is performed after the data synchronization is completed.

[0050] Specifically, if the current business volume is below a preset threshold, indicating a low-peak period, the priority of the fully encrypted database server will be set higher than that of the plaintext database, effectively switching the fully encrypted database server to the primary database. If a rollback to the plaintext database (i.e., switching the plaintext database to the primary database) is required, the fully encrypted database data must be synchronized using a preset migration tool. After synchronization, a consistency check must be performed. Only after the check passes can the primary database be switched to ensure business continuity.

[0051] In one implementation, the method further includes: When the original device corresponding to the trusted execution environment is damaged, the key of the new device is restored through key backup, and the encrypted database file on the encrypted database server is synchronized to the new device.

[0052] This embodiment also proposes a key security management mechanism to enable emergency recovery after a trusted execution environment (TEE) device failure. The processing logic is to first recover the key, then synchronize encrypted data. Through pre-prepared key backups and data synchronization operations, the mechanism addresses the potential data loss and business interruption issues caused by TEE device failure, thereby achieving seamless reuse of the fully encrypted database on new devices. Specifically, this embodiment supports user-defined cryptographic machine management keys. Combined with a multi-backup strategy, keys and configuration information are pre-stored on independent carriers such as user cryptographic machines and backup devices, preventing key loss along with the original TEE device when it fails. Therefore, when the original TEE device fails, the key can still be recovered through injection: the backed-up key is securely injected into the new TEE device to restore the new device's key. Afterwards, encrypted data files are synchronized to the new device, achieving seamless migration.

[0053] For ease of understanding, Figure 2 This demonstrates the interaction process between a fully encrypted database server and a database client, with the interaction logic and functions of each key module as follows: 1. Database client security proxy (deployed in the user environment), with the following functions: Trusted connection establishment: Two-way authentication is performed with the server-side security proxy based on the SM2 algorithm, a symmetric encryption key is negotiated, and a trusted communication channel is established; Data encryption and decryption: The client's structured query statements and business data are encrypted with the negotiated key and sent to the server-side security agent. The encryption execution result returned by the server-side security agent is received, decrypted into plaintext, and fed back to the business system.

[0054] 2. Database server-side security proxy (deployed within a trusted execution environment), with the following functions: Data encryption / decryption: Receives encrypted operation data from the client security agent, such as encrypted query statements or encrypted requests, decrypts it using a symmetric key, and forwards it to the database engine within the trusted execution; receives the plaintext execution results returned by the database engine, encrypts them, and returns them to the client security agent.

[0055] 3. Database engine within the Trusted Execution Environment (fully deployed within the Trusted Execution Environment), with features including: Plaintext computation: The encrypted database file is loaded and decrypted into plaintext within the trusted execution environment, and data processing operations such as structured query, transaction processing, and index building (index nodes do not need to be encrypted) are performed. During the data processing, the plaintext data is not leaked outside the trusted execution environment. Integrity verification: The database files and execution results are verified using the SM3 algorithm to prevent data tampering.

[0056] 4. Confidential storage module (deployed on the host machine's disk and managed by the trusted execution environment), its functions include: Encrypted storage: Database files (data files and log files) are encrypted using the SM4 algorithm before being written to disk. The key is managed by a trusted execution environment or a user cryptographic machine. Key synchronization: Supports key synchronization between devices in multiple trusted execution environments, and supports key migration when a device fails; Data backup: A multi-backup strategy (also known as a multi-copy strategy) is adopted to store encrypted database files in different physical locations to ensure data availability.

[0057] The advantages of this invention include: 1. Significantly Enhanced Security: Through hardware isolation, layered architecture, and data encryption / decryption algorithms, a fully encrypted database is constructed. Data remains encrypted or resides in a trusted execution environment throughout its entire lifecycle (transmission, computation, and storage). The trusted execution environment can block access to plaintext from the host machine and external attacks through hardware isolation. Even if an attacker gains root privileges on the server (root privileges are the super administrator account privileges in the system) and steals disk files, they cannot decrypt the data because the key is stored in the trusted execution environment or the user's cryptographic machine. This fundamentally prevents data leakage or theft, solving the problem of encrypted data protection throughout its entire lifecycle.

[0058] 2. Performance and Compatibility Balance: By leveraging plaintext indexes within a trusted execution environment, combined with hardware-accelerated computing and optimized architecture, performance overhead can be effectively reduced. It supports transparent access to mainstream database engines and private deployment without requiring modifications to business systems or database architecture, lowering the barrier to entry and migration costs for enterprises. This resolves the issues of compatibility and migration costs.

[0059] 3. Functional integrity guarantee: Fully supports structured query standards, ACID transaction characteristics, complex queries and stored procedures, and can be directly applied to core business scenarios.

[0060] Based on the above embodiments, the present invention also provides a fully encrypted database server, such as... Figure 2 As shown, the fully encrypted database server includes: The host machine's network management service is used to receive encrypted operation data sent by the client security agent; wherein, the encrypted operation data is obtained by the client security agent through encryption based on plaintext operation data provided by the business system; the operation data includes query statements; A server-side security proxy in a trusted execution environment is used to decrypt the encrypted operation data into plaintext operation data; The database engine in the trusted execution environment is used to read the encrypted database file through the encrypted storage module; in the trusted execution environment, the encrypted database file is decrypted into a plaintext database file, and the corresponding data processing task is executed according to the plaintext database file and the plaintext operation data to obtain the plaintext execution result; The server-side security proxy is also used to encrypt the plaintext execution result into an encrypted execution result; The network management service is also used to send the encrypted execution result to the client security agent, so that the client security agent can decrypt the encrypted execution result and return it to the business system.

[0061] Based on the above embodiments, the present invention also provides a computer-readable storage medium storing a plurality of instructions adapted to be loaded and executed by a processor to implement the steps of the fully encrypted database file invocation method based on a trusted execution environment as described above. The computer-readable storage medium can be any other means that can contain, store, communicate, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. Any references to memory, storage, database, or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory.

[0062] More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections (electronic devices) with one or N wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable storage media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0063] In summary, this invention discloses a method for calling a fully encrypted database file based on a trusted execution environment, a fully encrypted database server, and a storage medium, relating to the field of data security technology. The method includes: receiving encrypted operation data sent by a client security agent through the host machine's network management service; wherein the encrypted operation data is obtained by the client security agent from encrypting plaintext operation data provided by the business system; the operation data includes a query statement; decrypting the encrypted operation data into plaintext operation data through a server-side security agent in the trusted execution environment; reading an encrypted database file based on a encrypted storage module through the database engine in the trusted execution environment; decrypting the encrypted database file into a plaintext database file in the trusted execution environment; executing a corresponding data processing task based on the plaintext database file and the plaintext operation data to obtain a plaintext execution result; encrypting the plaintext execution result into an encrypted execution result through the server-side security agent, and sending the encrypted execution result to the client security agent via the network management service, so that the client security agent decrypts the encrypted execution result and returns it to the business system. This invention employs a four-layer architecture—client-side security proxy, server-side security proxy, database engine within a trusted execution environment, and encrypted storage module—combined with data encryption and decryption algorithms, to achieve end-to-end encryption and plaintext processing within a trusted execution environment for database queries. This provides encrypted protection throughout the entire lifecycle of data transmission, computation, and storage, with final decryption only performed on the client side. It is suitable for scenarios with high data privacy protection requirements and can solve the problem of confidentiality protection for sensitive data throughout its entire lifecycle.

[0064] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for calling a fully encrypted database file based on a trusted execution environment, characterized in that, The method is applied to a fully encrypted database server, and the method includes: The host machine receives encrypted operation data sent by the client security agent through its network management service; wherein the encrypted operation data is obtained by the client security agent through encryption of plaintext operation data provided by the business system; the operation data includes query statements; The encrypted operation data is decrypted into plaintext operation data through a server-side security proxy in a trusted execution environment. The database engine in the trusted execution environment reads the encrypted database file based on the encrypted storage module; in the trusted execution environment, the encrypted database file is decrypted into a plaintext database file, and the corresponding data processing task is executed according to the plaintext database file and the plaintext operation data to obtain the plaintext execution result; The server-side security proxy encrypts the plaintext execution result into an encrypted execution result, and sends the encrypted execution result to the client-side security proxy via the network management service. The client-side security proxy then decrypts the encrypted execution result and returns it to the business system.

2. The fully encrypted database file calling method based on a trusted execution environment according to claim 1, characterized in that, Both the client-side security proxy and the server-side security proxy perform data encryption and decryption operations based on a negotiated symmetric encryption key. The method for generating the symmetric encryption key includes: The server-side security proxy receives the user's public key and identity certificate sent by the client-side security proxy, and returns the public key and device certificate of the trusted execution environment to the client-side security proxy. Using an asymmetric encryption algorithm, the server-side security agent and the client-side security agent exchange keys based on their respective private keys and the other party's public key, and negotiate to generate a symmetric encryption key. The server-side security agent verifies the legitimacy of the identity certificate through a remote authentication mechanism based on a trusted execution environment, and the client-side security agent verifies the validity of the device certificate. After both parties verify the connection, they establish an encrypted communication connection using the symmetric encryption key.

3. The fully encrypted database file calling method based on a trusted execution environment according to claim 1, characterized in that, The encrypted database file is a database file encrypted using a symmetric encryption algorithm.

4. The fully encrypted database file retrieval method based on a trusted execution environment according to claim 1, characterized in that, Based on the plaintext database file and the plaintext operation data, the corresponding data processing task is executed to obtain the plaintext execution result, including: The plaintext database file is verified using a hash algorithm; After the verification is passed, the corresponding data processing task is executed according to the plaintext database file and the plaintext operation data to obtain the plaintext execution result, and the plaintext execution result is verified by the hash algorithm.

5. The fully encrypted database file retrieval method based on a trusted execution environment according to claim 1, characterized in that, The method further includes: During the initial deployment and migration phase, a preset migration tool is used to synchronize data with the fully encrypted database server based on the plaintext database, and a consistency check is performed after the data synchronization is completed.

6. The method for calling a fully encrypted database file based on a trusted execution environment according to claim 5, characterized in that, The usage priorities of the fully encrypted database server and the plaintext database are determined based on the current business volume.

7. The method for calling a fully encrypted database file based on a trusted execution environment according to claim 6, characterized in that, The method further includes: If the current business volume is lower than a preset threshold, the use priority of the fully encrypted database server is higher than that of the plaintext database. If a priority switch is performed when the usage priority of the fully encrypted database server is higher than that of the plaintext database, the plaintext database is synchronized using the preset migration tool before the switch, and a consistency check is performed after the data synchronization is completed.

8. The method for calling a fully encrypted database file based on a trusted execution environment according to claim 1, characterized in that, The method further includes: When the original device corresponding to the trusted execution environment is damaged, the key of the new device is restored through key backup, and the encrypted database file on the encrypted database server is synchronized to the new device.

9. A fully encrypted database server, characterized in that, The fully encrypted database server includes: The host machine's network management service is used to receive encrypted operation data sent by the client security agent; wherein, the encrypted operation data is obtained by the client security agent through encryption based on plaintext operation data provided by the business system; the operation data includes query statements; A server-side security proxy in a trusted execution environment is used to decrypt the encrypted operation data into plaintext operation data; The database engine in the trusted execution environment is used to read the encrypted database file through the encrypted storage module; in the trusted execution environment, the encrypted database file is decrypted into a plaintext database file, and the corresponding data processing task is executed according to the plaintext database file and the plaintext operation data to obtain the plaintext execution result; The server-side security proxy is also used to encrypt the plaintext execution result into an encrypted execution result; The network management service is also used to send the encrypted execution result to the client security agent, so that the client security agent can decrypt the encrypted execution result and return it to the business system.

10. A computer-readable storage medium storing a plurality of instructions thereon, characterized in that, The instructions are applicable to being loaded and executed by a processor to implement the steps of the fully encrypted database file invocation method based on a trusted execution environment as described in any one of claims 1 to 8.

Images