A Transparent Encryption Method and System Based on Proxy Pattern

Abstract

This invention provides a transparent encryption method and system based on a proxy model, comprising: a proxy module intercepting data packets sent from an SQL client to a database; parsing and reassembling the intercepted data packets to obtain reassembled data packets; obtaining the source IP address of the SQL client and a preset encryption algorithm sequence table; modifying the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table; obtaining the current encryption period of the proxy module; obtaining a target encryption algorithm based on the encryption period and the modified algorithm sequence table; encrypting the reassembled data packets based on the target encryption algorithm; and storing the encrypted reassembled data packets in the database. In this invention, the proxy module can automatically intercept and implement transparent encryption of data packets, while improving data security by dynamically adjusting the encryption algorithm.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a transparent encryption method and system based on a proxy model. Background Technology

[0002] With the rapid development of information technology, data security has become a key focus for enterprises and organizations. As the data storage center of an information system, the security of the database directly affects the stability and reliability of the entire system. Traditional data protection measures typically focus on network and application layer security, such as using firewalls and intrusion detection systems to prevent unauthorized access. However, these measures often cannot directly protect the sensitive data within the database from the risk of leakage or tampering.

[0003] To further enhance data security, various data encryption technologies have emerged in recent years. Among them, Transparent Data Encryption (TDE) is a commonly used method that can encrypt data in a database without modifying application code, thereby effectively protecting sensitive data.

[0004] However, most current encryption solutions employ fixed encryption algorithms, making it difficult to adapt to the ever-changing security threat environment. The selection of encryption algorithms in existing technologies is typically static, failing to dynamically adjust to address new security challenges based on actual circumstances. Summary of the Invention

[0005] The main objective of this invention is to provide a transparent encryption method and system based on a proxy model, which aims to overcome the shortcomings of existing transparent encryption schemes that cannot be dynamically adjusted.

[0006] To achieve the above objectives, the present invention provides a transparent encryption method based on a proxy model, comprising the following steps:

[0007] The proxy module intercepts data packets sent to the database by the SQL client; it parses and reassembles the intercepted data packets to obtain reassembled data packets.

[0008] Obtain the source IP address of the SQL client and a preset encryption algorithm sequence table; modify the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table;

[0009] Obtain the current encryption period of the proxy module, and based on the encryption period and the change algorithm sequence table, obtain the target encryption algorithm;

[0010] The reconstructed data packet is encrypted using the target encryption algorithm, and the encrypted reconstructed data packet is stored in the database.

[0011] Furthermore, after storing the encrypted reassembled data packet in the database, the process further includes:

[0012] When a data packet query request is received from the SQL client, the query request is intercepted, and the target data packet corresponding to the query request is retrieved from the database;

[0013] The target data packet is decrypted, and the decrypted target data packet is sent to the SQL client.

[0014] Furthermore, the encryption algorithm sequence list includes multiple encryption algorithm names arranged in a preset order, and each encryption algorithm name is different from the others, with each encryption algorithm name having a corresponding sequence number.

[0015] Further, the step of modifying the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table includes:

[0016] Extract all numeric characters from the source IP address and combine them sequentially to obtain a combination of numeric characters;

[0017] The combination of numeric characters is divided into four groups of numbers according to a preset rule, and the average value of each number in each group is calculated.

[0018] Based on the average values, the encryption algorithm sequence list is reordered to obtain a modified algorithm sequence list.

[0019] Further, the step of reordering the encryption algorithm sequence list based on each of the aforementioned average values ​​to obtain a modified algorithm sequence list includes:

[0020] The average values ​​are deduplicated to obtain the deduplicated average value.

[0021] Obtain the encryption algorithm name corresponding to the target sequence number from the encryption algorithm sequence table; wherein, the target sequence number is the same as the number corresponding to the deduplication average value;

[0022] The encryption algorithm name corresponding to the target sequence number is shifted to the end of the encryption algorithm sequence list, and the remaining encryption algorithm names are shifted forward to fill the complete encryption algorithm sequence list, thus obtaining the modified algorithm sequence list.

[0023] Further, obtaining the target encryption algorithm based on the encryption period and the change algorithm sequence list includes:

[0024] Obtain the numerical value corresponding to the encryption period; wherein, the database stores a mapping relationship between the encryption period and the numerical value; the encryption period is the stage in the encryption algorithm iteration cycle of the current encryption time;

[0025] Based on the stated values, a simulated curve is generated. Based on the simulated curve and the modified algorithm sequence list, the target encryption algorithm is obtained.

[0026] Further, the step of generating a simulated curve based on the numerical value, and obtaining the target encryption algorithm based on the simulated curve and the modified algorithm sequence list, includes:

[0027] Establish a two-dimensional coordinate system, and use the value as the slope to draw a simulated straight line passing through the origin of the coordinate system; wherein the value is a positive number;

[0028] The encryption algorithm names in the change algorithm sequence table are added to the data table one by one in sequence to obtain the encryption algorithm data table; wherein, the row height and column width of each cell in the encryption algorithm data table are the same;

[0029] The encryption algorithm data table is superimposed on the two-dimensional coordinate system, and the lower left corner of the encryption algorithm data table coincides with the origin of the coordinate system;

[0030] Obtain the line segment of the simulated straight line located in the encryption algorithm data table, and obtain the center point of the line segment; take the cell where the center point is located as the target cell, and take the encryption algorithm corresponding to the encryption algorithm name in the target cell as the target encryption algorithm.

[0031] Further, the step of generating a simulated curve based on the numerical value, and obtaining the target encryption algorithm based on the simulated curve and the modified algorithm sequence list, includes:

[0032] Establish a two-dimensional coordinate system;

[0033] Using the stated value as the radius of the circle, draw a simulated circle centered at the origin of the coordinate system.

[0034] The encryption algorithm names in the change algorithm sequence table are added to the data table one by one in sequence to obtain the encryption algorithm data table; wherein, the row height and column width of each cell in the encryption algorithm data table are the same, and the total column width of the encryption algorithm data table is a preset value, which is greater than the value;

[0035] The encryption algorithm data table is superimposed on the two-dimensional coordinate system, and the lower left corner of the encryption algorithm data table coincides with the origin of the coordinate system.

[0036] Obtain the curve segment on the simulated circle located in the encryption algorithm data table, and obtain the center point of the curve segment; take the cell where the center point is located as the target cell, and take the encryption algorithm corresponding to the encryption algorithm name in the target cell as the target encryption algorithm.

[0037] This invention also provides a transparent encryption system based on a proxy model, comprising:

[0038] The interception unit is used to intercept data packets sent to the database by the SQL client through the proxy module; and to parse and reassemble the intercepted data packets to obtain reassembled data packets.

[0039] The modification unit is used to obtain the source IP address of the SQL client and a preset encryption algorithm sequence table; and modify the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table.

[0040] The algorithm determination unit is used to obtain the current encryption period of the proxy module and, based on the encryption period and the change algorithm sequence list, obtain the target encryption algorithm;

[0041] An encryption unit is used to encrypt the reconstructed data packet based on the target encryption algorithm and store the encrypted reconstructed data packet in a database.

[0042] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described above.

[0043] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the methods described above.

[0044] The present invention provides a transparent encryption method and system based on a proxy model, comprising: a proxy module intercepting data packets sent from an SQL client to a database; parsing and reassembling the intercepted data packets to obtain reassembled data packets; obtaining the source IP address of the SQL client and a preset encryption algorithm sequence table; modifying the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table; obtaining the current encryption period of the proxy module, and obtaining a target encryption algorithm based on the encryption period and the modified algorithm sequence table; encrypting the reassembled data packets based on the target encryption algorithm, and storing the encrypted reassembled data packets in the database. In this invention, the proxy module can automatically intercept and implement transparent encryption of data packets, while improving data security by dynamically adjusting the encryption algorithm. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the steps of a transparent encryption method based on proxy mode in one embodiment of the present invention;

[0046] Figure 2 This is a block diagram of a transparent encryption system based on the proxy mode in one embodiment of the present invention;

[0047] Figure 3 This is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0048] The implementation, functional features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0050] Reference Figure 1 One embodiment of the present invention provides a transparent encryption method based on a proxy mode, comprising the following steps:

[0051] Step S1: The proxy module intercepts data packets sent to the database by the SQL client; it parses and reassembles the intercepted data packets to obtain reassembled data packets;

[0052] Step S2: Obtain the source IP address of the SQL client and a preset encryption algorithm sequence table; modify the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table;

[0053] Step S3: Obtain the current encryption period of the proxy module, and obtain the target encryption algorithm based on the encryption period and the change algorithm sequence table;

[0054] Step S4: Encrypt the reconstructed data packet based on the target encryption algorithm, and store the encrypted reconstructed data packet in the database.

[0055] In this embodiment, as described in step S1 above, the proxy module is a middleware located between the SQL client and the database server, responsible for handling the transmission of all data packets.

[0056] When an SQL client sends data to the database, the proxy module intercepts these data packets, preventing them from reaching the database directly. The proxy module parses the intercepted packets, extracting the payload (the actual data to be transmitted) and analyzing the packet structure and content. To facilitate subsequent encryption, the proxy module reassembles or formats the payload, resulting in a reconstructed data packet.

[0057] In one embodiment, the above parsing and recombination process includes:

[0058] Packet parsing: Parses the header information of data packets, such as source IP address, destination IP address, port number, etc.

[0059] Payload extraction: Extracting the actual data content, i.e., the payload, from the data packet.

[0060] Protocol analysis: Parsing SQL commands or other protocol-specific information in data packets to better understand the purpose and structure of the data packets.

[0061] Data packet reassembly:

[0062] Format adjustment: Adjust the data format as needed to meet encryption requirements.

[0063] Data cleanup: Reorganize the extracted payload as needed, for example, by sorting it according to a specific field order.

[0064] Add metadata: Some additional metadata needs to be added, such as encryption algorithm identifiers, key IDs, etc., to support subsequent encryption operations.

[0065] As described in step S2 above, the proxy module records the source IP address of the SQL client that sent the data packet, which helps identify the source of the data packet. During system initialization, a list containing multiple encryption algorithms is preset, arranged in a specific order. For example, the list may include multiple different algorithms such as AES, RSA, and Blowfish.

[0066] Depending on the source IP address, the proxy module changes the order of the encryption algorithm list. This means that even if two different clients use the same encryption algorithm sequence list, the encryption results will be different due to the different order, increasing the complexity and security of the encryption.

[0067] As described in step S3 above, the proxy module has a periodic encryption algorithm update mechanism to periodically change the encryption algorithm. This period can be time-based (e.g., changing it every four days) or event-based (e.g., changing it after processing a certain number of data packets).

[0068] The proxy module determines a specific encryption algorithm as the target encryption algorithm based on the current encryption cycle and the modified encryption algorithm sequence list. For example, in one embodiment, if the current cycle is the third cycle, the proxy module can select the third algorithm in the modified algorithm sequence as the target encryption algorithm.

[0069] As described in step S4 above, the proxy module encrypts the reassembled data packet using the selected target encryption algorithm. During encryption, the data is converted into an unreadable form, which can only be decrypted by someone with the correct key. After encryption, the proxy module sends the encrypted data packet to the database for storage. The database receives the encrypted data, not the original data.

[0070] In the above encryption process, the client and database do not need to know the specific details of the encryption; they can send and receive data as usual, thus achieving transparent data encryption. The choice of the encryption algorithm is not static but dynamically changes based on the source IP address and encryption period, making it difficult for attackers to predict or crack the encryption algorithm. By combining the source IP address and encryption period to determine the encryption algorithm, the unpredictability of the encryption process is increased, improving the overall security of the system. The proxy module can adjust the order and period of the encryption algorithm according to different needs and situations, improving the system's flexibility and adaptability. Through the above steps and technical features, this solution can effectively protect data security during database communication, and is particularly suitable for application scenarios requiring high data confidentiality.

[0071] In one embodiment, after storing the encrypted reconstructed data packet in the database, the method further includes:

[0072] When a data packet query request is received from the SQL client, the query request is intercepted, and the target data packet corresponding to the query request is retrieved from the database;

[0073] The target data packet is decrypted, and the decrypted target data packet is sent to the SQL client.

[0074] In this embodiment, when an SQL client sends a data packet query request, the proxy module also intercepts these requests. The proxy module parses the query request to understand the specific content the client wants to query. Based on the content of the query request, the proxy module searches the database for the corresponding encrypted data packet. The proxy module then uses the reverse decryption process to decrypt the found target data packet, restoring its original form.

[0075] After decryption, the proxy module sends the decrypted data packet back to the SQL client, enabling the client to receive readable data.

[0076] In this embodiment, through the above steps, the technical solution can not only provide transparent encryption when writing data, but also provide transparent decryption service when querying data, ensuring the security of data throughout its entire lifecycle.

[0077] In one embodiment, the encryption algorithm sequence list includes multiple encryption algorithm names arranged in a preset order, and each encryption algorithm name is different from the others, and each encryption algorithm name has a corresponding sequence number.

[0078] In this embodiment, the encryption algorithm sequence list is a list containing multiple encryption algorithm names, which are arranged in a preset order, and each algorithm name is unique.

[0079] Each entry in the list represents a cryptographic algorithm name, such as AES, RSA, Blowfish, etc. Each cryptographic algorithm name has a corresponding serial number to identify its position in the list.

[0080] In one embodiment, modifying the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table includes:

[0081] Extract all numeric characters from the source IP address and combine them sequentially to obtain a combination of numeric characters;

[0082] The combination of numeric characters is divided into four groups of numbers according to a preset rule, and the average value of each number in each group is calculated.

[0083] Based on the average values, the encryption algorithm sequence list is reordered to obtain a modified algorithm sequence list.

[0084] In this embodiment, all numeric characters are first extracted from the source IP address and then combined in the order they appear. For example, for the source IP address 192.168.0.1, the extracted numeric character combination is 19216801.

[0085] The combination of numeric characters is divided into four groups of numbers according to a preset rule. For the example above, the numeric character combination 19216801 can be divided into 19, 21, 68, 01. Alternatively, it can be divided into 192, 1, 680, 1. The separation method can be preset, which will not be elaborated upon here.

[0086] For each group of numbers, calculate the average of the individual numbers. For example, for the first group of numbers 19, the average is (1 + 9) / 2 = 5. In this embodiment, the above averages are all rounded to integers. For example, for the number 21, its average is 1.5, which is rounded to the integer 2.

[0087] Finally, for each average value, the sequence list of encryption algorithms is modified based on that average value.

[0088] For example, for an average of 4, the fourth encryption algorithm name in the encryption algorithm sequence list can be selected and moved to the end of the list. For an average of 1, the first encryption algorithm name, AES, can be selected and moved to the end of the list.

[0089] In this embodiment, the following beneficial effects are achieved:

[0090] Dynamic nature: The changes to the encryption algorithm sequence list are based on numeric characters in the source IP address, which gives the algorithm selection a degree of randomness and increases security.

[0091] Flexibility: By moving the positions of the encryption algorithm names based on average values, the order of encryption algorithms can be flexibly changed, allowing different algorithms to be used for each encryption.

[0092] Transparency: The encryption process of the encryption algorithm described above is transparent to both the SQL client and the database; they only need to send and receive data in the usual way.

[0093] Through the above methods, the above technical solutions can effectively improve the security of data transmission and ensure the security of data during storage.

[0094] In one embodiment, reordering the encryption algorithm sequence list based on each of the average values ​​to obtain a modified algorithm sequence list includes:

[0095] The average values ​​are deduplicated to obtain the deduplicated average value.

[0096] Obtain the encryption algorithm name corresponding to the target sequence number from the encryption algorithm sequence table; wherein, the target sequence number is the same as the number corresponding to the deduplication average value;

[0097] The encryption algorithm name corresponding to the target sequence number is shifted to the end of the encryption algorithm sequence list, and the remaining encryption algorithm names are shifted forward to fill the complete encryption algorithm sequence list, thus obtaining the modified algorithm sequence list.

[0098] In this embodiment, the average values ​​are first deduplicated to remove duplicate values. For each deduplicated average value, a corresponding target number needs to be determined. This target number is the same as the number of the deduplicated average value. For example, for a deduplicated average value of 3, the target number is 3.

[0099] For each target sequence number, shift the encryption algorithm name corresponding to the target sequence number to the end of the encryption algorithm sequence list, and shift the remaining encryption algorithm names forward.

[0100] For example: For target sequence number 3, the corresponding encryption algorithm name is Blowfish, so move it to the end. For target sequence number 2, the corresponding encryption algorithm name is RSA, so move it to the end. If the encryption algorithm name corresponding to the target sequence number is the last one, then no movement is needed. After moving, there will be empty spaces in the original positions. At this time, moving other algorithms forward will fill the above sequence list completely. It should be noted that the encryption algorithm names before the empty spaces do not need to be moved.

[0101] In this embodiment, the change of the encryption algorithm sequence list is based on the calculation of the average value and deduplication, which makes the algorithm selection somewhat random and increases security. By shifting the position of the encryption algorithm names, the order of the encryption algorithms can be flexibly changed, so that different algorithms can be used for each encryption. For SQL clients and databases, the entire encryption process of determining the encryption algorithm is transparent; they only need to send and receive data in the usual way. Through the above methods, this technical solution can effectively improve the security of data transmission and ensure the security of data during storage.

[0102] In one embodiment, obtaining the target encryption algorithm based on the encryption period and the change algorithm sequence list includes:

[0103] Obtain the numerical value corresponding to the encryption period; wherein, the database stores a mapping relationship between the encryption period and the numerical value; the encryption period is the stage in the encryption algorithm iteration cycle of the current encryption time;

[0104] Based on the stated values, a simulated curve is generated. Based on the simulated curve and the modified algorithm sequence list, the target encryption algorithm is obtained.

[0105] In this embodiment, the first step is to query the database to find the mapping relationship between the encryption period and the numerical value. The encryption period refers to the stage in the entire encryption algorithm iteration cycle where the current encryption time is located.

[0106] The database stores the mapping relationship between encryption cycles and numerical values. For example, the encryption cycle is the third cycle stage in the encryption algorithm iteration cycle, and its corresponding numerical value in the database is 6 (determined according to the mapping relationship in the database).

[0107] The current encryption cycle can be determined using system time. For example, if the encryption algorithm iterates once a month, and it is currently three months, then this is the third encryption cycle. The encryption cycle can be adjusted adaptively according to actual needs, and will not be limited or elaborated here.

[0108] Then, based on the obtained values, a simulated curve can be generated. This simulated curve can be a sine wave, cosine wave, straight line, circle, or other form of function. The specific shape of the simulated curve depends on the requirements of the actual application; its purpose is to introduce additional variables and further increase the unpredictability of the encryption algorithm selection.

[0109] Finally, a point on the simulated curve (e.g., a numerical point corresponding to a period) is used as a reference point. Combined with the modified encryption algorithm sequence list, the final target encryption algorithm is determined based on the characteristics of the simulated curve. For example, the numerical value on the simulated curve can be used as an index or weight to select a specific encryption algorithm from the modified algorithm sequence list as the target encryption algorithm.

[0110] In this embodiment, because the encryption period changes over time, the target encryption algorithm also changes dynamically, enhancing the security of the encryption system. Introducing a simulation curve increases the unpredictability of the encryption algorithm selection; even if an attacker knows the algorithm sequence list has been changed, it is difficult to predict the specific encryption algorithm used. By adjusting the form of the simulation curve, it can be adapted to different security requirements and application scenarios. In summary, by combining the encryption period and the algorithm sequence list, and using a simulation curve to determine the target encryption algorithm, the security and unpredictability of the encryption process can be effectively enhanced.

[0111] In one embodiment, generating a simulated curve based on the numerical value, and obtaining the target encryption algorithm based on the simulated curve and the modified algorithm sequence list, includes:

[0112] Establish a two-dimensional coordinate system, and use the value as the slope to draw a simulated straight line passing through the origin of the coordinate system; wherein the value is a positive number;

[0113] The encryption algorithm names in the change algorithm sequence table are added to the data table one by one in sequence to obtain the encryption algorithm data table; wherein, the row height and column width of each cell in the encryption algorithm data table are the same;

[0114] The encryption algorithm data table is superimposed on the two-dimensional coordinate system, and the lower left corner of the encryption algorithm data table coincides with the origin of the coordinate system.

[0115] Obtain the line segment of the simulated straight line located in the encryption algorithm data table, and obtain the center point of the line segment; take the cell where the center point is located as the target cell, and take the encryption algorithm corresponding to the encryption algorithm name in the target cell as the target encryption algorithm.

[0116] In this embodiment, a two-dimensional coordinate system is first established, with the horizontal axis as the X-axis and the vertical axis as the Y-axis. The obtained values ​​are used as the slope of the simulated straight line. The simulated straight line is a straight line passing through the origin (0,0) of the coordinate system, and its equation can be expressed as y=mx, where m is the obtained value.

[0117] Next, a table is created, and the names of the encryption algorithms in the algorithm sequence list are added to the table sequentially. Each cell in this table has the same row height and column width to ensure consistent cell size. The encryption algorithm data table is then overlaid on a two-dimensional coordinate system, with the bottom left corner of the table coinciding with the origin of the coordinate system.

[0118] Obtain the intersection line segment between the simulated straight line and the encryption algorithm data table, and find the center point of this line segment. The cell containing the center point is the target cell. The encryption algorithm corresponding to the encryption algorithm name in the target cell is the target encryption algorithm. For example, if the center point is located in the second row and second column, and the encryption algorithm name in the second row and second column is DES, then the target encryption algorithm corresponding to the encryption algorithm name in the target cell is DES.

[0119] In this embodiment, the above technical solution can bring the following beneficial effects:

[0120] Dynamic changes: Because the encryption period changes over time, the target encryption algorithm also changes dynamically, which enhances the security of the encryption system.

[0121] Unpredictability: By introducing simulated straight lines, the unpredictability of the choice of encryption algorithm is increased, making it difficult for attackers to predict the specific encryption algorithm used even if they know to change the algorithm sequence list.

[0122] Flexibility: By adjusting the slope of the simulated straight line, it can adapt to different safety requirements and application scenarios.

[0123] In summary, by combining the numerical values ​​of the encryption cycle to generate a simulated straight line and interacting with the encryption algorithm data table, the security and unpredictability of the encryption process can be effectively enhanced.

[0124] In one embodiment, generating a simulated curve based on the numerical value, and obtaining the target encryption algorithm based on the simulated curve and the modified algorithm sequence list, includes:

[0125] Establish a two-dimensional coordinate system;

[0126] Using the stated value as the radius of the circle, draw a simulated circle centered at the origin of the coordinate system.

[0127] The encryption algorithm names in the change algorithm sequence table are added to the data table one by one in sequence to obtain the encryption algorithm data table; wherein, the row height and column width of each cell in the encryption algorithm data table are the same, and the total column width of the encryption algorithm data table is a preset value, which is greater than the value;

[0128] The encryption algorithm data table is superimposed on the two-dimensional coordinate system, and the lower left corner of the encryption algorithm data table coincides with the origin of the coordinate system.

[0129] Obtain the curve segment on the simulated circle located in the encryption algorithm data table, and obtain the center point of the curve segment; take the cell where the center point is located as the target cell, and take the encryption algorithm corresponding to the encryption algorithm name in the target cell as the target encryption algorithm.

[0130] In this embodiment, firstly, a two-dimensional coordinate system is defined on the plane, typically with the horizontal direction as the x-axis, the vertical direction as the y-axis, and the intersection of the two axes as the origin (0,0).

[0131] Based on the above values, we take them as the radius r of the circle. We then draw a circle with radius r at the origin (0,0) as the simulated curve.

[0132] The encryption algorithm names in the algorithm sequence list are arranged sequentially in a table to form an encryption algorithm data table. Each cell in the table has the same row height and column width. The total width of the entire table is set to a preset value, which is greater than the aforementioned value (i.e., the radius of a circle).

[0133] Next, the encryption algorithm data table is placed in a two-dimensional coordinate system. The lower left corner of the data table coincides with the origin (0,0). Then, the portion of the simulated circle that intersects with the encryption algorithm data table is identified—that is, the part of the curve on the circle that lies within the data table. The center point of this curve segment is calculated, and the cell containing this center point is determined; this cell is called the target cell. The encryption algorithm corresponding to the name of the encryption algorithm in the target cell is the target encryption algorithm.

[0134] By employing the methods described above, different encryption algorithms can be selected for different scenarios or conditions. Since the encryption period changes over time, the target encryption algorithm also changes dynamically, enhancing the security of the encryption system. Introducing a simulation curve increases the unpredictability of the encryption algorithm selection; even if an attacker knows the algorithm sequence list has been changed, it is difficult to predict the specific encryption algorithm used. By adjusting the form of the simulation curve, it can be adapted to different security requirements and application scenarios. In summary, by combining the encryption period and the algorithm sequence list, and using simulation curves to determine the target encryption algorithm, the security and unpredictability of the encryption process can be effectively enhanced.

[0135] In one embodiment, encrypting the reconstructed data packet based on the target encryption algorithm includes:

[0136] Extract the data fingerprint of the reconstructed data packet, and perform an XOR operation with the numeric characters of the source IP address and the value corresponding to the current encryption period to obtain the dynamic perturbation factor; based on the dynamic perturbation factor, perform a nonlinear offset on the core parameters of the target encryption algorithm to form a personalized encryption algorithm;

[0137] The reassembled data packet is split into odd-numbered blocks and even-numbered blocks; the odd-numbered blocks are encrypted using the personalized encryption algorithm, and the even-numbered blocks are pseudo-decrypted using the inverse operation of the target encryption algorithm.

[0138] Personalized encryption results are alternately spliced ​​with pseudo-decryption results to generate encrypted mixed data packets.

[0139] In this embodiment, the data fingerprint of the reconstructed data packet is first extracted. This data fingerprint is generated by concatenating the length, field type checksum, and timestamp hash value of the reconstructed data packet, and can uniquely identify the core features of the data packet. Then, the data fingerprint, the numeric character combination corresponding to the source IP address, and the value corresponding to the current encryption period are XORed bit by bit to obtain a dynamic perturbation factor. This factor changes in real time due to differences in data packets, source IP addresses, and encryption periods, and has strong uniqueness and dynamism. Based on the dynamic perturbation factor, the core parameters of the target encryption algorithm are nonlinearly offset. The core parameters include the initial vector of the encryption key, the number of round function iterations, and the S-box replacement rule. The nonlinear offset is implemented through a logarithmic mapping algorithm, which allows the core parameters to be personalized while maintaining the basic framework of the target encryption algorithm. Finally, a personalized encryption algorithm that is fully adapted to the current encryption scenario is formed, ensuring that the encryption logic in different scenarios cannot be reused or cracked.

[0140] Next, the reconstructed data packet is divided equally using a fixed-length fragmentation rule. If the total length of the reconstructed data packet cannot be divided by the fixed length, random redundant bytes are padded to the end of the last data block to meet the fragmentation requirements. After fragmentation, N (N≥2) data blocks are obtained, which are marked as block 1, block 2, ..., block N in the order of fragmentation. The data blocks are classified according to the parity of their serial numbers: odd-numbered blocks are marked as odd-numbered blocks, and even-numbered blocks are marked as even-numbered blocks. The personalized encryption algorithm constructed above is used to perform a complete encryption process on all odd-numbered blocks, converting the original data into ciphertext data that cannot be directly interpreted. The inverse operation of the target encryption algorithm is used to perform pseudo-decryption on all even-numbered blocks. That is, the original even-numbered blocks are first operated on according to the decryption logic of the target encryption algorithm, but the real decryption key is not introduced during the operation. The data is format converted and feature obfuscated only by the reverse execution of the algorithm flow, so that the processed even-numbered blocks are neither the original plaintext nor the standard ciphertext, forming an obfuscated data form between plaintext and ciphertext.

[0141] Finally, following the original splitting order of the reconstructed data packet, the odd-numbered blocks of ciphertext data after personalized encryption and the even-numbered blocks of obfuscated data after pseudo-decryption are alternately spliced ​​together. If the total number of data blocks after splitting is odd, the last data block ends with an odd-numbered block of ciphertext. During the splicing process, a 1-byte separator can be embedded at the junction of every two data blocks. This separator is generated by XORing the last byte of the dynamic perturbation factor with the last byte of the current timestamp and is used for block segmentation identification during decryption. After splicing, the final encrypted hybrid data packet is generated. This data packet integrates personalized ciphertext and pseudo-decrypted obfuscated data, and the inter-block connection identifier is dynamic, completely breaking the single form and fixed structure of traditional encrypted data.

[0142] In this embodiment, through the innovative logic of dynamic factor customization algorithm + odd and even block differentiation processing + alternating splicing and obfuscation, the encrypted data presents a complex form of ciphertext-obfuscated data intertwined. Attackers not only face the challenge of cracking personalized encryption algorithms, but also cannot accurately identify valid ciphertext fragments due to interference from pseudo-decryption data. Even if some odd-numbered blocks of data are cracked, the lack of obfuscated data in even-numbered blocks will prevent the complete data from being restored. This achieves a breakthrough security effect of non-reusable algorithms, unrecognizable data form, and unachievable complete restoration.

[0143] In one embodiment, encrypting the reconstructed data packet based on the target encryption algorithm includes:

[0144] Extract the semantic features of the fields in the reconstructed data packet, identify the core sensitive field set and the associated auxiliary field set, and divide the core sensitive field set into multiple semantic clusters;

[0145] The base key is generated based on the target encryption algorithm. The combination of numeric characters from the source IP address is used as a perturbation factor to dynamically offset the base key, resulting in a cluster key that matches the number of semantic clusters. The offset of the cluster key iterates by a prime multiple with the encryption cycle.

[0146] A unique cluster key is assigned to each semantic cluster, and the encryption dimension is determined based on the value corresponding to the encryption period. After each semantic cluster is encrypted according to the corresponding encryption dimension, the encrypted semantic cluster is recombined with the associated auxiliary field set to obtain the recombined encrypted data packet. The recombining order is dynamically generated by the modulo operation result of the average value of the number combination in the source IP address and the encryption period value.

[0147] In this embodiment, firstly, a pre-trained BERT semantic classification model is used to extract features from all fields of the reconstructed data packet. These field semantic features include semantic vectors for field names, data type features for field values, and functional association features of fields in the business scenario. By calculating the semantic similarity and functional dependency between fields, a core sensitive field set and an associated auxiliary field set are identified from all fields. The core sensitive field set consists of fields involving privacy data or core business data that would pose a security risk if leaked. The associated auxiliary field set consists of fields used for data association queries and logical verification that do not possess independent sensitive attributes. Based on the semantic association and data flow of each field in the core sensitive field set, a hierarchical clustering algorithm is used to divide it into multiple semantic clusters. Fields within each semantic cluster satisfy a semantic similarity threshold ≥ 0.85, and the same semantic cluster corresponds to the same business logic unit, ensuring that fields within a cluster have indivisible business associations.

[0148] Next, a fixed-length base key is generated based on the key generation mechanism of the target encryption algorithm. The base key contains the core encryption factor of the algorithm and initial verification information. The combination of numeric characters corresponding to the source IP address is extracted, converted into a decimal value, and used as a key perturbation factor. The base key is segmented and offset using a nonlinear offset algorithm. The nonlinear offset algorithm is based on a logarithmic mapping function, that is, for each segment of byte data of the base key, a logarithmic offset is calculated according to the value corresponding to the perturbation factor to generate a cluster key consistent with the number of semantic clusters. Each cluster key contains an independent key identifier and a check code. The offset of the cluster key is dynamically iterated with the encryption cycle. The iteration rule is offset = initial offset × prime number corresponding to the current encryption cycle (the prime number is determined by the numerical mapping of the encryption cycle, different encryption cycles correspond to unique prime numbers, and the prime number sequence is arranged in ascending order), ensuring that the cluster keys of the same semantic cluster under different encryption cycles are completely heterogeneous.

[0149] Then, the encryption dimension is determined based on the value corresponding to the encryption period. If the value corresponding to the encryption period is odd, a two-dimensional encryption method of field content encryption + field association encryption is adopted. Field content encryption executes the target encryption algorithm using the cluster key, while field association encryption is achieved by shuffling the storage order of fields within the cluster and recording the mapping relationship. If the value corresponding to the encryption period is even, a two-dimensional encryption method of field content encryption + field verification information encryption is adopted. The field content encryption logic is consistent with that of odd-numbered periods, while field verification information encryption is achieved by encrypting and obfuscating the checksum and length information of the fields. A unique identifier is assigned to each semantic cluster. A key cluster is used to execute the complete encryption process corresponding to the encryption dimension, resulting in encrypted semantic cluster data. The sum of the average values ​​of all deduplicated combinations of numbers in the source IP address is calculated and moduloed with the value corresponding to the current encryption cycle (the modulo value is the total number of fields in the core sensitive field set and the associated auxiliary field set), resulting in a dynamic recombination factor. Based on the dynamic recombination factor, a recombination sequence is generated in an alternating order of encrypted semantic clusters and associated auxiliary fields. All encrypted semantic clusters and associated auxiliary field sets are sequentially concatenated according to this sequence. During the concatenation process, a dynamic separator generated based on the recombination factor is embedded at the junction of each field set, ultimately resulting in an encrypted recombined data packet.

[0150] In this embodiment, breaking through the conventional logic of independent encryption at the field level or overall encryption, the design takes semantic association clustering as the core and combines prime-multiple iterative cluster keys with periodic adaptive encryption switching and modular operation dynamic recombination. This makes the encryption logic deeply bound to business semantics and dynamic environmental parameters. Attackers cannot deduce the overall data by cracking a single field, nor can they predict the encryption dimension and recombination order. This achieves a breakthrough security effect that is indivisible at the semantic level, non-reusable at the key level, and unpredictable at the structural level.

[0151] Reference Figure 2 In one embodiment of the present invention, a transparent encryption system based on a proxy mode is also provided, comprising:

[0152] The interception unit is used to intercept data packets sent to the database by the SQL client through the proxy module; and to parse and reassemble the intercepted data packets to obtain reassembled data packets.

[0153] The modification unit is used to obtain the source IP address of the SQL client and a preset encryption algorithm sequence table; and modify the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table.

[0154] The algorithm determination unit is used to obtain the current encryption period of the proxy module and, based on the encryption period and the change algorithm sequence list, obtain the target encryption algorithm;

[0155] An encryption unit is used to encrypt the reconstructed data packet based on the target encryption algorithm and store the encrypted reconstructed data packet in a database.

[0156] In this embodiment, the specific implementation of each unit in the above system embodiment is described in the above method embodiment, and will not be repeated here.

[0157] Reference Figure 3 This invention also provides a computer device, which can be a server, and its internal structure can be as follows: Figure 3 As shown, the computer device includes a processor, memory, display screen, input device, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores the data corresponding to this embodiment. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the above-described method.

[0158] Those skilled in the art will understand that Figure 3 The structures shown are merely block diagrams of some structures related to the present invention and do not constitute a limitation on the computer devices on which the present invention is applied.

[0159] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method. It is understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0160] In summary, the transparent encryption method and system based on proxy mode provided in this embodiment of the invention includes: a proxy module intercepting data packets sent from an SQL client to a database; parsing and reassembling the intercepted data packets to obtain reassembled data packets; obtaining the source IP address of the SQL client and a preset encryption algorithm sequence table; modifying the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table; obtaining the current encryption period of the proxy module; obtaining a target encryption algorithm based on the encryption period and the modified algorithm sequence table; encrypting the reassembled data packets based on the target encryption algorithm; and storing the encrypted reassembled data packets in the database. In this invention, the proxy module can automatically intercept and implement transparent encryption of data packets, while improving data security by dynamically adjusting the encryption algorithm.

[0161] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the present invention and embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM, etc.

[0162] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0163] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A transparent encryption method based on a proxy pattern, characterized in that, Includes the following steps: The proxy module intercepts data packets sent to the database by the SQL client; it parses and reassembles the intercepted data packets to obtain reassembled data packets. Obtain the source IP address of the SQL client and a preset encryption algorithm sequence table; modify the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table; the encryption algorithm sequence table includes multiple encryption algorithm names arranged in a preset order, and each encryption algorithm name is different from the others, and each encryption algorithm name has a corresponding sequence number; The process involves obtaining the current encryption cycle of the proxy module and, based on the encryption cycle and the change algorithm sequence list, obtaining the target encryption algorithm. This includes: obtaining the numerical value corresponding to the encryption cycle; wherein, a database stores a mapping relationship between encryption cycles and numerical values; the encryption cycle is the stage of the current encryption time within the encryption algorithm iteration cycle; establishing a two-dimensional coordinate system, using the numerical value as the slope, and drawing a simulated straight line passing through the origin; wherein, the numerical value is positive; sequentially adding the encryption algorithm names from the change algorithm sequence list to a data table to obtain an encryption algorithm data table; wherein, the row height and column width of each cell in the encryption algorithm data table are the same; superimposing the encryption algorithm data table onto the two-dimensional coordinate system, with the lower left corner of the encryption algorithm data table coinciding with the origin; obtaining the line segment of the simulated straight line located in the encryption algorithm data table, and obtaining the center point of the line segment; using the cell containing the center point as the target cell, and using the encryption algorithm corresponding to the encryption algorithm name in the target cell as the target encryption algorithm. The reconstructed data packet is encrypted using the target encryption algorithm, and the encrypted reconstructed data packet is stored in the database.

2. The transparent encryption method based on proxy mode according to claim 1, characterized in that, After storing the encrypted reassembled data packet in the database, the process also includes: When a data packet query request is received from the SQL client, the query request is intercepted, and the target data packet corresponding to the query request is retrieved from the database; The target data packet is decrypted, and the decrypted target data packet is sent to the SQL client.

3. The transparent encryption method based on proxy mode according to claim 1, characterized in that, The step of modifying the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table includes: Extract all numeric characters from the source IP address and combine them sequentially to obtain a combination of numeric characters; The combination of numeric characters is divided into four groups of numbers according to a preset rule, and the average value of each number in each group is calculated. Based on the average values, the encryption algorithm sequence list is reordered to obtain a modified algorithm sequence list.

4. The transparent encryption method based on the proxy pattern according to claim 3, characterized in that, The step of reordering the encryption algorithm sequence list based on the average values ​​of each algorithm to obtain a modified algorithm sequence list includes: The average values ​​are deduplicated to obtain the deduplicated average value. Obtain the encryption algorithm name corresponding to the target sequence number from the encryption algorithm sequence table; wherein, the target sequence number is the same as the number corresponding to the deduplication average value; The encryption algorithm name corresponding to the target sequence number is shifted to the end of the encryption algorithm sequence list, and the remaining encryption algorithm names are shifted forward to fill the complete encryption algorithm sequence list, thus obtaining the modified algorithm sequence list.

5. A transparent encryption system based on a proxy model, characterized in that, include: The interception unit is used to intercept data packets sent to the database by the SQL client through the proxy module; The intercepted data packets are parsed and reassembled to obtain reassembled data packets; The modification unit is used to obtain the source IP address of the SQL client and a preset encryption algorithm sequence table; modify the encryption algorithm sequence table based on the source IP address to obtain a modified algorithm sequence table; the encryption algorithm sequence table includes multiple encryption algorithm names arranged in a preset order, and each encryption algorithm name is different from the others, and each encryption algorithm name has a corresponding sequence number; An algorithm determination unit is used to obtain the current encryption cycle of the proxy module and, based on the encryption cycle and the change algorithm sequence table, obtain the target encryption algorithm. This includes: obtaining the numerical value corresponding to the encryption cycle; wherein, a database stores a mapping relationship between encryption cycles and numerical values; the encryption cycle is the stage of the current encryption time within the encryption algorithm iteration cycle; establishing a two-dimensional coordinate system, using the numerical value as the slope, and drawing a simulated straight line passing through the origin; wherein, the numerical value is positive; sequentially adding the encryption algorithm names from the change algorithm sequence table to a data table to obtain an encryption algorithm data table; wherein, the row height and column width of each cell in the encryption algorithm data table are the same; superimposing the encryption algorithm data table onto the two-dimensional coordinate system, with the lower left corner of the encryption algorithm data table coinciding with the origin; obtaining the line segment of the simulated straight line located in the encryption algorithm data table, and obtaining the center point of the line segment; using the cell containing the center point as the target cell, and using the encryption algorithm corresponding to the encryption algorithm name in the target cell as the target encryption algorithm. An encryption unit is used to encrypt the reconstructed data packet based on the target encryption algorithm and store the encrypted reconstructed data packet in a database.

Images