Data processing method and related device

Abstract

According to the data processing method and the related device, in the interaction process of a server side and a client side, the server side can selectively decrypt encrypted data corresponding to SQL statements according to rules met by the SQL statements sent by the client side. Compared with encryption of the encrypted data corresponding to all the SQL statements received by the server, the performance loss of the server is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database, and particularly relates to a data processing method and related device. BACKGROUND

[0002] With the development of Internet technology, database applications are more and more widely used. A user can connect a database of a server through a database client tool (such as Navicat) and send a structured query language (SQL) statement to the server through the client to implement operations on the database. In order to improve the security of the database, the client encrypts the SQL statement, and the server needs to decrypt all encrypted SQL statements to execute the SQL statement, which causes a large performance loss of the server. SUMMARY

[0003] The present application provides a data processing method and related device, which selectively decrypts encrypted data corresponding to a SQL statement sent by a client to reduce the performance loss of a server.

[0004] To achieve the above object, the present application adopts the following technical scheme:

[0005] In a first aspect, a data processing method is provided, applied to a server, and the method comprises: receiving a structured query language (SQL) statement sent by a client; if the SQL statement satisfies a first rule, decrypting first encrypted data corresponding to the SQL statement, and executing the SQL statement based on the decrypted first encrypted data to obtain a first data processing result; if the SQL statement does not satisfy the first rule, executing the SQL statement based on the first encrypted data corresponding to the SQL statement to obtain a second data processing result. In the interaction process between the server and the client, the server selectively decrypts encrypted data corresponding to a SQL statement sent by the client according to a rule satisfied by the SQL statement. Compared with the server decrypting all encrypted data corresponding to received SQL statements, the performance loss of the server is reduced.

[0006] Optionally, if the SQL statement includes an operator, if the operator satisfies the first rule, the SQL statement satisfies the first rule; if the operator does not satisfy the first rule, the SQL statement does not satisfy the first rule.

[0007] In some possible implementation manners of the first aspect, the SQL statement includes a plurality of operators; the SQL statement satisfying the first rule includes that a first operator included in the plurality of operators satisfies the first rule; the decrypting the first encrypted data corresponding to the SQL statement includes decrypting first encrypted data corresponding to the first operator; and the SQL statement not satisfying the first rule includes that no operator included in the plurality of operators satisfies the first rule. That is, the SQL statement includes a plurality of operators, the SQL statement satisfies the first rule, at least one operator included in the plurality of operators of the SQL statement satisfies the first rule, and the encrypted data corresponding to the operator satisfying the first rule is decrypted when the operator is executed; if the SQL statement does not satisfy the first rule, none of the plurality of operators of the SQL statement satisfies the first rule, that is, when the plurality of operators not satisfying the first rule are executed, the encrypted data corresponding to the operators need not be decrypted. The rule satisfied by each SQL statement is determined from the operator granularity, and the encrypted data corresponding to the first operator of the SQL statement satisfying the first rule is decrypted, so that the first encrypted data is selectively decrypted from the operator granularity, and the performance loss of the server is reduced.

[0008] In some possible implementation manners of the first aspect, the SQL statement includes a first operator and a second operator, the first operator corresponds to first sub-encrypted data in the first encrypted data, and the second operator corresponds to second sub-encrypted data in the first encrypted data; the SQL statement satisfying the first rule includes that the first operator satisfies the first rule and the second operator does not satisfy the first rule; the decrypting the first encrypted data corresponding to the SQL statement includes decrypting the first sub-encrypted data and not decrypting the second sub-encrypted data; and the executing the SQL statement based on the decrypted first encrypted data includes executing the first operator based on the decrypted first sub-encrypted data, and executing the second operator based on the second sub-encrypted data.

[0009] Thus, in the process of interaction between the client and the server, since the SQL statement sent by the client to the server includes the first operator and the second operator, if the first operator has corresponding first sub-encrypted data and the first operator satisfies the first rule, the first sub-encrypted data needs to be decrypted before the first operator is executed; if the second operator does not satisfy the first rule and has corresponding second sub-encrypted data, the second operator does not need to be decrypted before being executed. The encrypted data corresponding to each operator is decrypted according to the rule satisfied by the operator. Thus, the decryption judgment of multiple encrypted data is realized from the granularity of the operator, the granularity of decryption judgment and execution is refined, and the flexibility of selective decryption is improved. When the operator is executed, whether the encrypted data corresponding to the multiple operators of the SQL statement is decrypted is independent of each other, for example, the SQL statement includes two operators, both of which have corresponding encrypted data, and one of the operators satisfies the first rule, so that the encrypted data is decrypted when the operator is executed; the other operator does not satisfy the first rule, so that the encrypted data does not need to be decrypted when the operator is executed, realizing selective decryption of the encrypted data corresponding to the multiple operators of the SQL statement that satisfies the first rule, so as to reduce the performance loss of the server.

[0010] In some possible implementation manners of the first aspect, if the input of the first operator includes a non-equality symbol or the first operator includes a first input and a second input, the data types of the first input and the second input are different, and the first operator is used to operate the first input and the second input, the first operator satisfies the first rule. Since the non-equality symbol is included in the operator, for example, >, <, >=, <=, that is, the non-equality symbol is used to define a range instead of a specific value, for example, used to obtain the row where a is greater than 2, if a is encrypted data, it is impossible to judge whether a is greater than 2, and thus a needs to be decrypted before the operator is executed, that is, the operator satisfies the first rule; if the operator is used to operate two inputs, for example, a+1, since a is encrypted data, it is impossible to directly perform the addition operation, and thus a needs to be decrypted before the operation of adding 1 to a is performed, and thus the operator including the feature satisfies the first rule, and correspondingly, the operator not satisfying the feature does not satisfy the first rule.

[0011] In some possible implementation manners of the first aspect, after the structured query language (SQL) statement sent by the client is received, the method further includes: determining a key value according to the SQL statement; determining an index page matched with the key value, the key value being located in a key value range of the matched index page, the key value range being determined according to a maximum value and a minimum value of the key values in the index page; and obtaining to-be-processed data of the SQL statement in the index page.

[0012] Thus, if the SQL statement includes a query operation on the data to be processed in the database, the index key value can be determined according to the SQL statement. Since the index key value includes encrypted data, if the data to be processed is decrypted before the index, the performance of the server is greatly reduced. The maximum value and the minimum value of the index key value in each index page in the database can be determined according to the index key value, to determine the key value range of each index page; if the key value is in the key value range of the corresponding index page, it is determined that the index page matches the key value, and then the data to be processed of the SQL statement can be found from the index page. Without decrypting the data of the index page, the query operation can be implemented to reduce the performance loss of the server. Alternatively, the server can maintain the key value range of each index page, for example, a specific position (such as the first entry and the last entry of the index page) of each index page has an index key value including encrypted data, the index key value of the specific position can be decrypted, and the index key value range of the index page can be obtained according to the maximum value and the minimum value of the index key value in the index page. If the index key value only includes one index page, the index key value does not need to be decrypted, and the index page corresponding to the SQL statement can be determined.

[0013] Alternatively, if the index page matching the key value includes at least one leaf page, the leaf pages of the index page can be matched to determine the leaf page matching the key value, until there is no leaf page matching the key value, and then the data to be processed of the SQL statement is found from the last leaf page matching the key value.

[0014] In some possible implementation ways of the first aspect, the server includes a database management system (DBMS), the DBMS is located in a trusted execution environment (TEE), and the DBMS is configured to execute the SQL statement to obtain the first data processing result or the second data processing result. Thus, the DBMS is located in the TEE, and the operation on the database in the server is performed in the TEE, which improves the security of the data operation. In addition, the DBMS can perform the data processing in the application, that is, the above-mentioned data processing process, without interacting with the untrusted execution environment (for example, a rich execution environment (REE)) in the server, thereby reducing the performance loss in the data processing process.

[0015] In some possible implementations of the first aspect, if the SQL statement includes multiple operators, and the input of the top-level operator depends on the output of at least one other operator, the method further includes: if the first data processing result or the second data processing result includes data to be encrypted, then the data to be encrypted is encrypted to obtain a confidential data processing result, wherein the first data processing result or the second data processing result is the execution result of the top-level operator. Thus, if multiple operators corresponding to the SQL statement are nested, i.e., the output of at least one operator depends on the output of another operator, the execution result of the top-level operator is the SQL statement. Encryption of the execution result of the top-level operator yields the confidential data processing result corresponding to the SQL statement. The execution results of other operators (not the top-level operator) do not need to be encrypted or decrypted. Optionally, the data processing result (first data processing result or second data processing result) of the top-level operator can be encrypted using the encryption key corresponding to the top-level operator to obtain the confidential data processing result corresponding to the SQL statement. Optionally, if each operator has a corresponding encryption key and at least two operators have different encryption keys, then the key corresponding to the top-level operator can be selected from the at least two encryption keys, and the data processing result of the top-level operator can be encrypted based on the key to obtain the confidential data processing result corresponding to the SQL statement.

[0016] In some possible implementations of the first aspect, the first encrypted data includes multiple sub-encrypted data, each of which corresponds to an encryption key. At least two different encryption keys corresponding to the multiple sub-encrypted data are different. The method further includes: determining a target encrypted data among the multiple sub-encrypted data based on a preset rule; encrypting the first data processing result or the second data processing result based on the encryption key corresponding to the target encrypted data to obtain a confidential data processing result. Optionally, the preset rule may be that among multiple operators, the encryption key corresponding to the last executed operator is the target encryption key corresponding to the target encrypted data. Thus, the first encrypted data includes multiple sub-encrypted data, each corresponding to at least two different encryption keys. The target encryption key can be determined by an agreed-upon rule so that the client and server determine the same encryption key according to the agreed-upon rule.

[0017] In some possible implementations of the first aspect, the method further includes: encrypting the log information and sending the encrypted log information to the target server.

[0018] A second aspect provides a data processing system, the data processing system including a client and a server; the server is used to execute the data processing method according to any one of the first aspects; the server is also used to send a confidential data processing result to the client, the confidential data processing result being obtained by the server encrypting the first data processing result or the second data processing result.

[0019] In some possible implementations of the second aspect, the client is further configured to: obtain the initial SQL statement input by the user;

[0020] The data to be encrypted in the initial SQL statement is determined based on the operation type corresponding to the initial SQL statement.

[0021] The data to be encrypted in the initial SQL statement is encrypted to obtain the SQL statement.

[0022] In some possible implementations of the second aspect, if the initial SQL statement includes an INSERT statement, then the data inserted by the INSERT statement is determined to be data to be encrypted; if the initial SQL statement includes an UPDATE statement, a DELETE statement, or a SELECT statement, then the conditional data in the conditional clauses of the UPDATE statement, the DELETE statement, or the SELECT statement is determined to be data to be encrypted; if the initial SQL statement includes an UPDATE statement, then the data written by the UPDATE statement and the conditional data in the conditional clauses are data to be encrypted.

[0023] Optionally, after determining the data to be encrypted, the client identifies the sensitive data within the data to be encrypted, encrypts the sensitive data, and obtains the SQL statement.

[0024] Thirdly, a computer is provided, comprising: a memory including computer-readable instructions; and a processor communicating with the memory, the processor being configured to execute the computer-readable instructions, causing the computer to perform the data processing method described in any one of the first aspects.

[0025] Fourthly, a computer-readable storage medium is provided, including a program or instructions that, when executed by a processor, implement the data processing method as described in any one of the first aspects.

[0026] Fifthly, a chip is provided, including a processor for retrieving and executing instructions stored in a memory, causing a computer equipped with the chip to perform the data processing method described in any one of the first aspects.

[0027] Sixthly, a computer program product is provided, the computer program product comprising instructions that, when executed by a computer, implement the method as described in any one of the first aspects.

[0028] The beneficial effects of each possible implementation of the data processing method provided in the second aspect of the embodiments of this application, the computer provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, the chip provided in the fifth aspect, and the computer program product provided in the sixth aspect can be referred to the descriptions of the various possible implementations in the first aspect, and will not be repeated here. Attached Figure Description

[0029] Figure 1 A schematic diagram of a data processing system provided in an embodiment of this application;

[0030] Figure 2 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0031] Figure 3 A schematic diagram illustrating a client-side encryption / decryption process provided in an embodiment of this application;

[0032] Figure 4 A schematic diagram illustrating a server-side encryption / decryption process provided in an embodiment of this application;

[0033] Figure 5 This application provides a schematic diagram of the architecture of a data processing system.

[0034] Figure 6 A schematic diagram illustrating data transmission as provided in an embodiment of this application;

[0035] Figure 7 This is a schematic diagram of the modules of a data processing system provided in an embodiment of this application;

[0036] Figure 8 This is a schematic diagram of the structure of a computer provided in an embodiment of this application. Detailed Implementation

[0037] The technical solutions in this application will now be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments in this specification, and not all of them.

[0038] With the development of internet technology, the data involved in various applications and tools is growing exponentially. To facilitate the storage and management of this data, databases have emerged. Users can connect to databases using database client tools (such as Navicat) and send SQL statements to the server to perform database operations. To improve the security of data in the database, the client encrypts the target data (such as sensitive information) in the SQL statement; however, the server usually needs to decrypt all encrypted SQL statements before executing them, which incurs a significant performance penalty on the server side.

[0039] To address the aforementioned issues, this application provides a data processing method in which a user sends SQL statements to a server via a client to perform various operations on the database; the server selectively decrypts the encrypted data corresponding to the SQL statements to reduce the performance overhead of server-side data processing.

[0040] Please see Figure 1 , Figure 1 This is a schematic diagram of a data processing system provided in an embodiment of this application. Figure 1 The data processing system consists of a client and a server. The client and server establish a communication connection based on a communication protocol.

[0041] The client can be any computing device with a certain computing capability. The basic structure of the client may include at least one processor. The number of processors depends on the client's configuration and type. The client may also include memory, which can be volatile, such as RAM, or non-volatile, such as read-only memory (ROM), flash memory, or both. The memory typically stores the operating system (OS), one or more applications, and may also store program data. In addition to the processing unit and memory, the client also includes some basic configurations, such as a network interface card (NIC) chip, I / O bus, display components, and some peripheral devices. Optionally, some peripheral devices may include, for example, a keyboard, mouse, pen, printer, etc. Other peripheral devices are well known in the art and will not be described in detail here. Optionally, the client can be a PC (personal computer), a terminal, etc.

[0042] A server refers to a device that provides computing and processing services in a virtual network environment, typically referring to a server that utilizes the network for information planning. In physical implementation, a server can be any device capable of providing computing services, responding to service requests, and processing data; examples include conventional servers, cloud servers, cloud hosts, and virtual data centers. The main components of a server include a processor, hard drive, memory, and system bus, similar to a general computer architecture.

[0043] in, Figure 1 The data processing system includes a client and a server. As is easily understood, in other embodiments, the data processing system may include multiple clients and / or multiple servers.

[0044] Optionally, the client sends an SQL statement to the server; the server receives the SQL statement, which contains corresponding encrypted data; the server selectively decrypts the encrypted data according to the rules satisfied by the SQL statement to reduce performance overhead on the server side. The encrypted data corresponding to the SQL statement can be either the encrypted data carried by the SQL statement itself or encrypted data from the database that the SQL statement is processing.

[0045] Optionally, Figure 1 The server can run confidential virtual machines or confidential containers. Confidential virtual machines and confidential containers provide a trusted execution environment. The server improves the security of data processing by executing SQL statements provided by the client in the trusted execution environment.

[0046] In this context, confidential virtual machines (VMs) on the server side can provide a trusted execution environment, and confidential containers on the server side can provide a trusted execution environment. By isolating other devices from accessing data within the trusted execution environment, data security is enhanced. For example, confidential VMs or confidential containers can isolate the host machine's registers, memory, network cards, hard drives, or prohibit cross-system access.

[0047] Please see Figure 2 , Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The following is an example... Figure 2 Data processing methods applied Figure 1 The data processing system will be explained. Figure 2 The data processing methods include: S201 to S202.

[0048] S201, The client sends an SQL statement to the server.

[0049] Optionally, users can send SQL statements to the server through the client to perform operations such as querying, deleting, updating, and adding data on the server.

[0050] In some embodiments, the SQL statement sent by the client corresponds to a database on the server, and the SQL statement is used to operate on the data stored in the database.

[0051] Optionally, the first encrypted data may be data carried in an SQL statement. For example, if the SQL statement includes INSERT INTO t1 values(1,2,'abc'), the first encrypted data may be 'abc'. Optionally, the first encrypted data may also be data to be processed by the SQL statement on the server side, such as data stored in a database. For example, if the SQL statement includes SELECT * FROM employees, the first encrypted data may be the content of the employees table in the database. Of course, in other embodiments, the first encrypted data may also include both data carried in the SQL statement and data to be processed by the SQL statement in the database.

[0052] S202. If the SQL statement satisfies the first rule, the server decrypts the first encrypted data and executes the SQL statement based on the decrypted first encrypted data to obtain the first data processing result; if the SQL statement does not satisfy the first rule, the server executes the SQL statement based on the first encrypted data to obtain the second data processing result.

[0053] Optionally, the first rule can be a rule set according to the category of the SQL statement. For example, query statements satisfy the first rule, while non-query statements do not. The first rule can also be a rule set for the object processed by the SQL statement. For example, if the SQL statement is used to process encrypted sensitive data in the database, the first rule is not satisfied; if the SQL statement is used to process encrypted non-sensitive data in the database, the first rule is satisfied. Of course, the first rule can also be a rule set by other users.

[0054] In some embodiments, if the first encrypted data is data carried in an SQL statement and the SQL statement satisfies the first rule, then the first encrypted data is decrypted and the SQL statement is executed. For example, if the SQL statement includes `DELETE from t1 where a>M;` and M is the first encrypted data, then M is decrypted to obtain `DELETE from t1 where a>1;`, and then the rows corresponding to `a>1` in t1 are deleted. Optionally, if the first encrypted data is data stored in a database and the SQL statement satisfies the first rule, then the first encrypted data in the database is decrypted, and the decrypted first encrypted data is processed according to the SQL statement to obtain the corresponding execution result.

[0055] Optionally, to ensure data processing security, the server executes... Figure 2The data processing method shown is performed in a trusted execution environment.

[0056] In this way, when the client processes data on the server, the server can selectively decrypt the first encrypted data based on the rules satisfied by the SQL statement, avoiding the decryption of all first encrypted data, thereby improving data processing efficiency and reducing data processing loss.

[0057] In some embodiments, the positions of the fields to be encrypted in the SQL statements corresponding to different operation types are different. Before S201, the client obtains the initial SQL statement input by the user, determines the data to be encrypted in the initial SQL statement according to the operation type of the initial SQL statement, and then encrypts the data to be encrypted in the initial SQL statement to obtain the SQL statement. The SQL statement includes the encrypted data, such as the first encrypted data. Since the operation types of the SQL statements are different, the positions of the data to be encrypted in the SQL statements are also different. The client can determine the data to be encrypted in the SQL statement according to the operation type of the SQL statement; then the client encrypts the data to be encrypted and replaces the data to be encrypted in the SQL statement with the encrypted data. The structure of the SQL statement is not changed, so that the SQL statement containing encrypted data can be adapted to the corresponding database without additional modification.

[0058] For example, if the initial SQL statement includes `DELETE FROM students WHERE age<18`, used to delete rows that meet the condition (age is less than 18), then the data to be encrypted is "age<18". If the initial SQL statement includes `INSERT INTO Students(Name,Age,Gender)VALUES('Alice',22,'Female')`, used to insert `VALUES('Alice',22,'Female')` at the (Name,Age,Gender) position in the Students table, then both the table position and the inserted value are the data to be encrypted.

[0059] In some embodiments, the data to be encrypted in the initial SQL statement is encrypted to obtain the SQL statement, including:

[0060] The client identifies sensitive and non-sensitive data within the data to be encrypted. It encrypts the sensitive data but not the non-sensitive data, resulting in an SQL statement. For example, the initial SQL statement includes `INSERT INTO Students(Name,Age,Gender)VALUES('Alice',22,'Female')`, where the data to be encrypted is `('Alice',22,'Female')`. Since the name is sensitive information, the statement encrypts "Alice" within `('Alice',22,'Female')`, resulting in `INSERT INTO Students(Name,Age,Gender)VALUES('Dolifh',22,'Female')`. In other words, after determining the data to be encrypted, the client identifies the sensitive data, encrypts the sensitive data, and leaves the non-sensitive data unencrypted.

[0061] In some embodiments, if the initial SQL statement includes an INSERT statement, the data written by the INSERT statement is the data to be encrypted.

[0062] If the initial SQL statement includes a DELETE or SELECT statement, then the conditional data in the conditional clauses of the initial SQL statement is the data to be encrypted.

[0063] If the initial SQL statement includes an UPDATE statement, the data written in the UPDATE statement and the data conditional in the conditional clause are the data to be encrypted. Similarly, if the initial SQL statement includes an INSERT statement, the data inserted (i.e., written) in the INSERT statement is the data to be encrypted; if the initial SQL statement includes a DELETE or SELECT statement, the data conditional in the initial SQL statement is the data to be encrypted; and if the initial SQL statement includes an UPDATE statement, the data written in the UPDATE statement and the data conditional in the conditional clause are the data to be encrypted. Based on the different operation types of the SQL statement, the data to be encrypted in that SQL statement is determined, and then the data to be encrypted is encrypted.

[0064] Optionally, the conditional clause can be a WHERE clause. For example, in DELETE FROM t1 WHERE a = 1, the conditional clause is WHERE a = 1, where a = 1 is the conditional data in the conditional clause, i.e., the data to be encrypted.

[0065] Optionally, when interacting with the server's database, the client loads the corresponding driver on the database side, such as Java Database Connectivity (JDBC) or Open Database Connectivity (ODBC). This driver connects the application (e.g., a Java application) to the database system. After receiving the initial SQL statement input by the user on the client side, the driver determines the data to be encrypted in the initial SQL statement based on the operation type of the initial SQL statement, then identifies sensitive data within the data to be encrypted and encrypts the sensitive data to obtain the SQL statement. By automatically identifying and encrypting the data to be encrypted in the initial SQL statement through the corresponding database driver, the SQL statement input by the user through the client does not need to be encrypted; the driver automatically encrypts it, and the encrypted SQL statement is compatible with the corresponding database.

[0066] Please see Figure 3 , Figure 3 This is a schematic diagram of a client-side encryption / decryption process provided in an embodiment of this application. Figure 3 The client's parser parses the SQL statement passed in by the user. If the SQL statement includes an INSERT statement, the statement processor identifies sensitive data in the inserted data and the encryption / decryption processor encrypts the sensitive data. If the SQL statement includes a DELETE or SELECT statement, the statement processor identifies sensitive data in the WHERE clause of the DELETE or SELECT statement and the encryption / decryption processor encrypts the sensitive data in the WHERE clause. If the SQL statement includes an UPDATE statement, the statement processor identifies sensitive data in the WHERE clause of the UPDATE statement and sensitive data in the write statement, and the encryption / decryption processor encrypts the sensitive data.

[0067] Optionally, after the server executes the SQL statement, it obtains the data processing result. The server can then send the data processing result to the client. After the client's parser parses the data processing result, it identifies the corresponding encrypted data based on the result and decrypts it. In other words, the user can only read the decrypted data processing result after the client has decrypted it. Unauthorized users can only read the encrypted data or cannot read the data processing result at all.

[0068] Optionally, after receiving the data processing result sent by the server, if the operator corresponding to the data processing result belongs to the target operator type, then the data processing result is decrypted; if the operator corresponding to the data processing result does not belong to the target operator type, then the data processing result does not need to be decrypted.

[0069] like Figure 3 If the data processing result received by the client is the execution result of a SELECT statement, the result processing module identifies the data to be decrypted in the data processing result, and the encryption processor decrypts the data to be decrypted; if the data processing result received by the client is the execution result of an UPDATE statement, DELETE statement, or INSERT statement, then there is no need to decrypt the data processing result.

[0070] Optionally, an SQL statement may include an operator. If the operator satisfies the first rule, then the SQL statement satisfies the first rule; if the operator does not satisfy the first rule, then the SQL statement satisfies the first rule.

[0071] For example, if an SQL statement includes an operator, such as `delete from t1 where a>1` (deletes all rows from table t1 where the value of column a is greater than 1), and `delete` satisfies the first rule, then the SQL statement satisfies the first rule.

[0072] In some embodiments, an SQL statement includes multiple operators; the SQL statement satisfying a first rule includes: the multiple operators include a first operator that satisfies the first rule; decrypting the first encrypted data corresponding to the SQL statement includes: decrypting the first encrypted data corresponding to the first operator; the SQL statement not satisfying the first rule includes: the multiple operators do not include an operator that satisfies the first rule. That is, if an SQL statement includes multiple operators and satisfies the first rule, then at least one of the multiple operators of the SQL statement satisfies the first rule, and when executing the operator that satisfies the first rule, the encrypted data corresponding to that operator is decrypted; if the SQL statement does not satisfy the first rule, then none of the multiple operators of the SQL statement satisfy the first rule, meaning that when executing the multiple operators of the SQL statement, it is not necessary to decrypt the encrypted data corresponding to the multiple operators. This allows for determination of whether the SQL statement satisfies the first rule at the operator granularity. When executing an SQL statement that satisfies the first rule, the encrypted data corresponding to the operator that satisfies the first rule is decrypted, thereby achieving selective decryption and reducing server-side performance overhead.

[0073] For example, if the SQL statement is `update t1 set a = M where a > N`, and the SQL statement includes two operators `update` and `set`, where `update` satisfies the first rule and `set` does not, meaning the SQL statement satisfies the first rule, then `N` is decrypted before executing `update`, and the `update` operator is executed after decryption. As another example, if the SQL statement is `update t1 set b = n where a = m`, and the SQL statement includes two operators `update` and `set`, where both `update` and `set` do not satisfy the first rule, meaning the SQL statement does not satisfy the first rule, then `a` and `b` do not need to be decrypted before executing the `set` and `update` operators.

[0074] Optionally, the SQL statement includes a first operator and a second operator. The first operator corresponds to the first sub-encrypted data in the first encrypted data, and the second operator corresponds to the second sub-encrypted data in the first encrypted data. In S202, the first operator satisfies a first rule, including: the first operator satisfies the first rule, and the second operator does not satisfy the first rule.

[0075] S202 decrypts the first encrypted data corresponding to the SQL statement, including:

[0076] If the first operator satisfies the first rule, then the first sub-encrypted data is decrypted; the second sub-encrypted data is not decrypted.

[0077] S202 executes SQL statements based on the decrypted first encrypted data, including:

[0078] The first operator is executed based on the first sub-encrypted data after decryption, and the second operator is executed based on the second sub-encrypted data.

[0079] Thus, an SQL statement includes at least one operator. Before executing the operator, the rules it satisfies are determined, and based on these rules, the rules satisfied by the SQL statement can be identified. During SQL statement execution, based on the rules satisfied by the operators, the corresponding sub-encrypted data is selectively decrypted, thereby achieving operator-level selective decryption of sub-encrypted data to reduce server-side performance overhead. If the SQL statement includes multiple independent operators, and if the SQL statement includes a first operator and a second operator, and the first operator satisfies the first rule while the second operator does not, then the first sub-encrypted data corresponding to the first operator is decrypted, and the first operator is executed based on the decrypted first sub-encrypted data; if the second operator does not satisfy the first rule, then the second operator is executed based on the second sub-encrypted data. This avoids the need to decrypt all encrypted data, further reducing server-side performance overhead.

[0080] For example, if the SQL statement is update t1 set a = M where a > N; the SQL statement includes two operators update and set. The SQL statement satisfies the first rule. update satisfies the first rule, but set does not satisfy the first rule. Then, the operator set is executed based on a = M. Before executing update, N is decrypted, and then the operator update is executed.

[0081] Optionally, if an SQL statement includes one operator, the execution result of that operator is the execution result of the SQL statement; if an SQL statement includes multiple operators that are not nested (e.g., the execution result of one operator is not the input of another operator), the execution result of the multiple operators is the execution result of the SQL statement; if an SQL statement includes multiple operators that are nested (e.g., the execution result of one operator is the input of at least one other operator), the execution result of the top-level operator is the execution result of the SQL statement; if there are multiple top-level operators (e.g., multiple top-level operators are not nested), the execution result of the multiple top-level operators is the execution result of the SQL statement.

[0082] The top-level operator, also known as the root operator, is the outermost operator among multiple operators in the database. It integrates and summarizes the data processed by the other operators. For example, in a grouped aggregation query, the top-level operator receives the intermediate results calculated by the sub-operators of each group and then performs the final global summary and organization.

[0083] For example, the SQL statement: INSERT into t1 SELECT * from t2; selects all data from table t2 and inserts this data into table t1. The SQL statement includes two operators, INSERT and SELECT. The output of SELECT serves as the input of INSERT. Therefore, INSERT is the top-level operator of the SQL statement, and the execution result of INSERT is the execution result of the SQL statement.

[0084] It's easy to understand that each operator's input can include one or more symbols. If the execution condition only includes an equality condition, the equality condition is specified using the equality operator (= or ==). For example, `DELETE from t1 where a = M` finds all records in table `t1` where the value of column `a` is equal to 1 and deletes these records from the table. Since the operator's input only includes the symbol "=", there's no need to decrypt `M` to delete all records where the value of column `a` is equal to 1. `DELETE from t1 where a > 1` deletes all records in table `t1` in the database where the value of column `a` is greater than 1. Because this operator's input includes the non-equality symbol ">", the input "all values ​​in column `a` are greater than 1" is a range, not a specific value. Therefore, before executing this statement, `a` in the database needs to be decrypted. Therefore, if the input of an operator includes non-equivalent symbols, the encrypted data corresponding to the operator must be decrypted before the operator can be executed. Non-equivalent symbols can include arithmetic operators (such as addition, subtraction, multiplication, and division), comparison operators (such as >, <, >=, and <=), bitwise operators (such as &, |, ^, and ~), string operators (such as string comparison and string concatenation), aggregation operators (such as summation and averaging), and regular expression symbols. In other words, if the input of an operator includes one or more symbols, one of which is a non-equivalent symbol, then the operator satisfies the first rule.

[0085] For example, the operator `SELECT t1.a,t2.b from t1,t2 where t1.a=t2.b` combines each row in table `t1` with each row in table `t2` (i.e., performs a Cartesian product). Then, the `WHERE` clause filters these combinations, retaining only records where `t1.a=t2.b`. Ultimately, the query result will only contain the values ​​of columns `a` and `b` for rows where the values ​​in columns `a` and `b` are equal in both tables. Since the `a` field in table `t1` is encrypted, causing a data type mismatch between `a` and `b` fields in table `t2`, `a` in `t1` needs to be decrypted to match the fields in both tables before the operator can be executed. Another example is `SELECT b+1,a+b from t1 where a=2`; this operator iterates through each row in table `t1`, checking if the value in column `a` is equal to 2. For each row that meets the conditions, calculate the values ​​of b+1 and a+b, and return these values ​​as a row to the queryer. If b or a is encrypted data, or the data types of b and 1 do not match, then "b+1 and a+b" cannot be executed. Therefore, before executing this operator, b and a need to be decrypted to ensure that the decrypted data types match, so that the operator can be executed. Thus, if the operator includes a first input and a second input, and the data types of the first and second inputs are different, the operator is used to operate on the first and second inputs. This operation is a joint operation on the first and second inputs, such as arithmetic operations (addition, subtraction, multiplication, division) or aggregation operations. Since this operation requires the participation of the first and second inputs, it is an operation applied to the first and second inputs. If the data types of the first and second inputs do not match, then the operator satisfies the first rule, that is, the encrypted data in the first input and / or the second input needs to be decrypted to ensure that the first and second inputs match.

[0086] In some embodiments, if the input of the second operator only includes an equality symbol and the data type of the input of the second operator matches (or in other words, the input of the second operator includes one data type), then the second operator does not satisfy the first rule. Thus, after the server receives the SQL statement, since the SQL statement includes at least one operator, the encrypted data can be decrypted at the operator level. The server can determine the rules satisfied by the operator based on the symbol and / or data type of the operator's input, and selectively decrypt the encrypted data based on the satisfied rules, thereby improving data processing efficiency and reducing server performance overhead.

[0087] In some embodiments, if the input of the second operator does not include non-equivalence symbols and the input of the second operator includes only one data type, then the second operator does not satisfy the first rule. For example, INSERT into t1 values(1,2); the input of the operator is 1,2, does not include non-equivalence symbols and the input of the operator includes only one data type.

[0088] In some embodiments, after the SQL statement is executed on the server side, a data processing result (such as the first processing result or the second processing result described above) is obtained. For the security of the data processing result, the server side may encrypt the data processing result to obtain a confidential data processing result and send the confidential data processing result to the client.

[0089] In some embodiments, if the SQL statement includes multiple operators, the corresponding processing result can be obtained after each operator is executed; if the execution result of each operator is independent of each other, that is, the multiple operators are not nested, for example, the output of each operator is not used as the input of another operator, then after the server obtains the execution results of multiple operators, it encrypts the data to be encrypted in each execution result to obtain multiple encrypted execution results, that is, confidential data processing results.

[0090] Optionally, if an SQL statement includes multiple operators, where the execution result of at least one operator serves as the input of another operator, and these multiple operators form a hierarchical structure, or are executed nestedly, then the outermost operator among the multiple operators can be called the top-level operator. The output of at least one other operator among the multiple operators serves as the input of the top-level operator. Since the multiple operators corresponding to the SQL statement are executed nested, the execution result of the top-level operator is the execution result of the SQL statement. Therefore, the above method further includes:

[0091] If the first data processing result or the second data processing result includes data to be encrypted, then the data to be encrypted is encrypted to obtain a confidential data processing result, and the confidential data processing result is sent to the client. The execution result is either the first data processing result or the second data processing result is the execution result of the top-level operator.

[0092] If the execution result of the top-level operator does not include the data to be encrypted, the server sends the first data processing result or the second data processing result to the client.

[0093] If the operator is not a top-level operator, then the execution result of the operator does not need to be encrypted, regardless of whether it includes the data to be encrypted.

[0094] If the SQL statement satisfies the first rule, the execution result of the top-level operator is the first data processing result; if the SQL statement does not satisfy the first rule, the execution result of the top-level operator is the second data processing result.

[0095] Thus, for multiple nested operators, the execution result of the top-level operator is the execution result of the SQL statement. Only the execution result of the top-level operator needs to be encrypted. For the execution results of non-top-level operators, since the execution result is an intermediate execution result, regardless of whether the intermediate execution result includes the data to be encrypted, there is no need to encrypt the intermediate execution result, thereby improving data processing efficiency.

[0096] Optionally, if each operator has a corresponding encryption key, and different operators correspond to different encryption keys, the server obtains the encryption key corresponding to the top-level operator, and encrypts the execution result according to the encryption key to obtain the confidential data processing result.

[0097] Optionally, if the SQL statement includes at least one operator, the first encrypted data includes multiple sub-encrypted data, each encrypted data corresponding to an encryption key, and at least two sub-encrypted data correspond to different encryption keys, then the method further includes:

[0098] The target encrypted data is determined from multiple encrypted data based on preset rules;

[0099] Based on the encryption key corresponding to the target encrypted data, the first data processing result or the second data processing result is encrypted to obtain a confidential data processing result. Since the target sub-data corresponding to the operator includes multiple encrypted data, and since each encrypted data is encrypted by the server or client based on a corresponding encryption key, and each encrypted data has a corresponding encryption key, the multiple encrypted data correspond to at least two different encryption keys. Therefore, at least two of the multiple encrypted data have different encryption keys. After executing the operator, the execution result is obtained. The execution result can be encrypted (or the data to be encrypted in the execution result can be encrypted) according to the agreed encryption key (target encryption key) among the at least two encryption keys, so that the client and server can decrypt or encrypt the execution result according to the agreed encryption key.

[0100] Optionally, if the operator corresponds to multiple encrypted data, the default rule is to use the last encrypted data processed among the multiple encrypted data as the target encrypted data; for example, the SQL statement is SELECT sum((b+1)-a),a+b from t1 wherea=2; when executing SELECT, first decryption is performed according to the encryption keys corresponding to a and b, and then the execution result is encrypted with the encryption key corresponding to a; if the last encrypted data processed includes at least two, the default rule is to use the encrypted data at a specific position among the at least two encrypted data as the target encrypted data, for example, the specific position value can be the first or last encrypted data among the at least two encrypted data as the target encrypted data.

[0101] Please see Figure 4, Figure 4 This is a schematic diagram illustrating a server-side decryption process provided in an embodiment of this application. Figure 4 In the process, after the server receives the SQL statement sent by the client, the SQL statement includes at least one operator, the first encrypted data includes at least one first sub-encrypted data, and at least one operator has corresponding first sub-encrypted data.

[0102] First, the server determines whether the operator satisfies the first rule or not;

[0103] If the operator does not satisfy the first rule and the operator has corresponding first sub-encrypted data, the server does not need to decrypt the first sub-encrypted data and can execute the operator through the ciphertext to obtain the data processing result;

[0104] If the operator satisfies the first rule, the first sub-encrypted data corresponding to the operator is decrypted to convert the ciphertext in the target sub-data into plaintext and / or convert the data type of the target sub-data; then the operator is executed based on the plaintext data to obtain the data processing result (i.e., the unencrypted data processing result); then it is determined whether the operator has a parent node; if a parent node exists, the operator corresponding to the parent node is executed; then until the operator has no parent node; if no parent node exists, the unencrypted data processing result is encrypted to obtain the encrypted data processing result;

[0105] Then, the results are processed. The server can send the data processing results to the client, or it can store the data processing results in encrypted form.

[0106] It is easy to understand that if the server needs to index the location of the data processed by the SQL statement in the database before executing the SQL statement, indexing can improve the query speed in the database. However, if the index key value is encrypted data, then in order to accurately find the data to be processed, it is usually necessary to decrypt the data in the database. Since the amount of data stored in the database is large, decryption of the data in the database affects the performance of the server. Therefore, this application uses key-value indexing to improve the efficiency of data processing. In some embodiments, after S201, the method further includes:

[0107] The server determines the index key value based on the SQL statement and identifies the index page that matches the index key value. The index key value is within the key value range of that index page, which is determined by the maximum and minimum values ​​of the index key values ​​on that index page. The index key value includes the second encrypted data. The server then retrieves the SQL statement to be processed from the index page.

[0108] Thus, since the SQL statement determines that the index key value includes encrypted data, the index table stores encrypted data, making it impossible to directly execute the index operation corresponding to the SQL statement. This application determines the key value range of each index page, which is determined by the maximum and minimum key values ​​of that index page. By comparing the index key value corresponding to the SQL statement with the key value range of each index page, the index page corresponding to the index key value is determined. That is, if the index key value is within the key value range, the statement to be processed in the SQL statement is located on that index page, thereby achieving indexing.

[0109] As is easily understood, since index pages are determined based on index key values, different index pages correspond to different indexes depending on whether the database indexes by province or by city. Therefore, if the index key value is determined, the corresponding index page can also be determined. For example, if the index key value is province P of country X, it will include a maximum of two index pages (country X includes 24 provinces). Since these two index pages are determined based on the index key value, and the index page contains the index key value, data at a specific location within the index page can be decrypted to obtain the corresponding index key value. The range of index key values ​​for the index page is then determined based on the maximum and minimum index key values. It is then checked whether the index key value corresponding to the SQL statement falls within this range. If the index key value of the SQL statement is within the range, the two match, meaning the data to be processed corresponding to the SQL statement is within that index page. The indexing process only requires decrypting a portion of the fields on the index page corresponding to the index key value to determine the key value range for each index page, which improves data processing efficiency compared to decrypting all data on all pages.

[0110] Optionally, the server can also maintain the key value range of the index pages corresponding to the index key values. For example, when the server receives an SQL statement, it determines the index key value based on the SQL statement, and then retrieves the index page corresponding to the index key value. Since the index key value includes encrypted data, if there is only one index page, then this index page is the index page of the SQL statement, and the data to be processed in the database for the SQL statement can be retrieved from this index page. If there are multiple index pages, the index pages can be matched with the index key values ​​of the SQL statements. Specific positions on an index page contain index key values, and the index key values ​​at specific positions can be decrypted to obtain the index key value range of that index page. These specific positions can be the first and last entries of the index page, the page header, etc.

[0111] It's easy to understand that index keys in a database are usually pre-defined by the user. For example, if P represents cities in province A, and province A includes 23 cities, setting P as the index key will result in 3 index pages. During the execution of an SQL statement, the input can include a key value. For example, `update t1 set a = 1 where a = 2` updates table t1, changing the value of column 'a' in records where column 'a' is 2 to 1. If 'a' is a key value, the index page corresponding to key value a = 2 can be queried, and the value of column 'a' in the corresponding page can be changed to 1. Of course, in some embodiments, the SQL statement can include multiple key values. For example, `DELETE from t1 where a = 1 and b = 1`, where both 'a' and 'b' are pre-defined key values, can select the one with the lowest index consumption as the final key value.

[0112] Optionally, the key value range of each index page can be determined by the key value corresponding to the first entry and the key value corresponding to the last entry of the index page, or it can be determined based on other methods. For example, if the page header of each index page includes information such as the object ID of the page of the index page, the key value range of the index page can also be determined based on the page header information of the index page.

[0113] Optionally, if the current index page also includes leaf pages, then the index page matching the key value is determined, and the data to be processed corresponding to the SQL statement within the index page is obtained, including:

[0114] The leaf page matching the key value is identified, and the data to be processed corresponding to the SQL statement within that leaf page is retrieved. Thus, if the index page matching the key value has a leaf page, it can be determined whether the leaf page matches the key value. If they match, the leaf page matching the key value is identified. If the leaf page has subpages, the matching of the subpages continues until the entries on the subpages do not match the key value. The last matching index page is then used as the index page matching the key value.

[0115] Optionally, the SQL statement may include query operations, meaning the SQL statement can be used to find the data to be processed on a specific index page; the SQL statement may also include update (UPDATE), insert (INSERT), and delete (DELETE) operations, meaning that after finding the data to be processed on the index page through the index, the update, insert, or delete operation is performed. For example, if the SQL statement includes an insert operation, after determining the index page that matches the key value, the entry on the index page that matches the key value is determined, and then the insert operation is performed on that entry.

[0116] Please seeFigure 5 , Figure 5 This is a schematic diagram of the architecture of a data processing system provided in an embodiment of this application. Figure 5 Chinese data processing system and Figure 1 Similar to Chinese data processing systems, namely Figure 5 The data processing system can execute Figure 1 The difference in functionality between Chinese and foreign data processing systems lies in: Figure 5 The server-side component has a Trusted Execution Environment (TEE), and the Database Management System (DBMS) resides within the TEE. The DBMS can execute the commands described in the above embodiments. Figure 1 The server-side functionality is as follows: For example, when a client sends an SQL statement to the server, after receiving the SQL statement, if the SQL statement meets the first rule, the server decrypts the first encrypted data using the DBMS and executes the SQL statement based on the decrypted first encrypted data to obtain the first data processing result; if the SQL statement does not meet the first rule, the server executes the SQL statement based on the first encrypted data using the DBMS to obtain the second data processing result. Then, the server sends the execution result back to the client through the DBMS. Figure 5 The server executes SQL statements within a TEE to enhance data processing security. The DBMS is also located within the TEE, where it executes SQL statements and sends the results to the client. Since all of these processes are performed within the TEE, there is no need to switch between the TEE and non-TEE on the server side, thus reducing performance overhead.

[0117] Please see Figure 6 , Figure 6 This is a schematic diagram of data transmission provided in an embodiment of this application, such as... Figure 6 If server B serves as a backup server for server A, then server A can encrypt its own data and send the encrypted data to server B to achieve data backup within the server.

[0118] Optionally, server A can also encrypt the log information and send the encrypted log information to server B. Encrypting the log information during the log information synchronization process can improve the security of the log information and reduce the risk of data leakage. The log information is used to record modifications to the database.

[0119] Optionally, the log information may include a write-ahead logging (WAL) log, which is used to record the history of database modification operations.

[0120] Please see Figure 7 , Figure 7 This is a schematic diagram of the modules of a data processing system provided in an embodiment of this application.Figure 7 The data processing system includes a client side comprising a key management module and a first encryption / decryption module, and a server side comprising a second encryption / decryption module.

[0121] The key management module is used for key management, generating corresponding encryption and decryption keys for each user or each user's session, and sending these keys to the server through a secure data channel. This secure data channel can be a secure channel established between the client and server based on Internet Protocol Security (IPSec) or Secure Socket Layer (SSL), or other types of secure channels.

[0122] When a user processes data on the server side through the client, in order to ensure the security of communication between the client and the server, the first encryption / decryption module obtains the encryption / decryption key from the key management module and encrypts the SQL statement using the encryption / decryption key; after the server receives the SQL statement, the second encryption / decryption module decrypts the SQL statement according to the encryption / decryption key obtained from the key management module, and then executes the SQL statement to obtain the data processing result.

[0123] Optionally, the second encryption / decryption module identifies the data to be encrypted in the data processing result, encrypts the data, and then sends the encrypted data processing result to the client. The second encryption / decryption module then decrypts the encrypted data processing result using the encryption / decryption key, allowing the user to query the decrypted data processing result.

[0124] Optionally, to ensure the security of the encryption and decryption keys, the server can store the encryption and decryption keys in memory. When the user logs out of the client or exits a specific process, the server deletes the encryption and decryption keys stored in the second encryption and decryption module.

[0125] It should be understood that the above description is merely to help those skilled in the art better understand the embodiments of this application, and is not intended to limit the scope of the embodiments of this application. Based on the examples given above, those skilled in the art can obviously make various equivalent modifications or changes. For example, some steps in the various methods described above may be unnecessary, or new steps may be added. Alternatively, any combination of two or more of the above embodiments may be used. Such modifications, changes, or combinations also fall within the scope of the embodiments of this application.

[0126] It should also be understood that the methods, situations, categories, and classifications of embodiments in this application are for the convenience of description only and should not constitute a special limitation. Various methods, categories, situations, and features in embodiments can be combined without contradiction.

[0127] It should also be understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. The order of the process numbers described above does not imply the order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0128] It should also be understood that the above description of the embodiments of this application focuses on highlighting the differences between the various embodiments. Any similarities or differences not mentioned can be referred to each other. For the sake of brevity, they will not be repeated here.

[0129] The above combination Figures 1-7 The embodiments of the methods and systems provided in this application have been described. The computer provided in the embodiments of this application is described below.

[0130] This embodiment can divide the computer into functional modules according to the above method. For example, it can be divided into functional modules corresponding to various functions, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0131] It should be noted that the relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0132] The computer provided in this application embodiment is used to execute the data processing method provided in the above method embodiment, and thus can achieve the same effect as the above implementation method.

[0133] In other embodiments, when using integrated units, the computer may include a processing module, a storage module, and a communication module. The processing module can be used to control and manage the computer's operations. For example, it can be used to support the computer in executing steps performed by the processing unit. The storage module can be used to store program code and data, etc. The communication module can be used to support communication between the computer and other network devices or computers.

[0134] The processing module can be a processor or a controller. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination of functions that implement computing capabilities, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, or other devices that interact with other computers or network equipment.

[0135] Based on the same concept, this application also provides a computer, see [link to relevant documentation]. Figure 8 , Figure 8 A schematic diagram of the structure of an exemplary computer according to this application is shown. Figure 8 The computer shown can execute the steps of any of the data processing methods performed by the client or server provided in the embodiments of this application.

[0136] The computer 800 includes at least one processor 801, a memory 803, and at least one network interface 804.

[0137] The processor 801 is, for example, a general-purpose CPU, a digital signal processor (DSP), a network processor (NP), a GPU, a neural network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASICs) used to implement the solutions of this application, a programmable logic device (PLD), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0138] Optionally, the computer 800 also includes a bus 802. The bus 802 is used to transfer information between the various components of the computer 800. The bus 802 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 802 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0139] Memory 803 may be, for example, read-only memory (ROM) or other types of storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 803 may exist independently and be connected to processor 801 via bus 802. Memory 803 may also be integrated with processor 801.

[0140] Network interface 804 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), or wireless local area network (WLAN). Network interface 804 can include wired network interfaces and wireless network interfaces. Specifically, network interface 804 can be an Ethernet interface, such as Fast Ethernet (FE), Gigabit Ethernet (GE), Asynchronous Transfer Mode (ATM), WLAN, cellular network, or combinations thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of this application, network interface 804 can be used by computer 800 to communicate with other devices.

[0141] In specific implementations, as some embodiments, processor 801 may include one or more CPUs. Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0142] In a specific implementation, as one possible approach, computer 800 may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores used for processing data (such as computer program instructions).

[0143] In some embodiments, memory 803 is used to store program instructions for executing the present application's solution, and processor 801 can execute the program instructions stored in memory 803. That is, computer 800 can implement the method provided in the above embodiments through processor 801 and the program instructions in memory 803. The program instructions may include one or more software modules. Optionally, processor 801 itself may also store program instructions for executing the present application's solution.

[0144] In specific implementation, the processor 801 in the computer 800 of this application reads instructions from the memory 803, causing... Figure 8 The computer 800 shown is capable of performing all or part of the steps in the data processing method executed by the computer in the above embodiments.

[0145] In the above embodiments, each step of the method is implemented through integrated logic circuits in the hardware of the processor of the computer 800 or through software instructions. The steps of the method embodiments disclosed in this application can be directly implemented by the hardware processor, or implemented by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. Since the storage medium is located in memory, the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method embodiments; to avoid repetition, these will not be described in detail here.

[0146] It should be understood that the aforementioned processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting the Advanced Reduced Instruction Set Computing (RISC) machine (ARM) architecture.

[0147] Furthermore, in an alternative embodiment, the memory described above may include read-only memory and random access memory, and provide instructions and data to the processor. The memory may also include non-volatile random access memory. For example, the memory may also store device type information.

[0148] The memory can be volatile or non-volatile, or may include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0149] The computer provided in this embodiment can execute the above method embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0150] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the methods described in the above-described method embodiments.

[0151] This application also provides a computer program product that, when run on a computer, enables the computer to implement the methods described in the above-described method embodiments.

[0152] This application provides a chip, including a processor, for calling and executing instructions stored in a memory, causing a communication device with the chip installed to execute the method described in any of the computer embodiments of this application.

[0153] This application also provides a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in the above-described method embodiments. The chip system may be a single chip or a chip module composed of multiple chips.

[0154] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, or magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0155] Those skilled in the art will understand that implementing all or part of the processes in the above embodiments can be accomplished by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium can include various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

[0156] The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.

[0157] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0158] In the embodiments provided in this application, it should be understood that the disclosed apparatus / devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0159] It should be understood that in the description of this application and the appended claims, the terms "comprising," "including," "having," and any variations thereof are intended to cover a non-exclusive inclusion and mean "including but not limited to," unless otherwise specifically emphasized. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0160] In the description of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" in this application is used to describe the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural.

[0161] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0162] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0163] Furthermore, in the description of this application and the appended claims, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein; features defined as "first" or "second" may explicitly or implicitly include at least one of those features.

[0164] In the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0165] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0166] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A data processing method, characterized by, Applied to a server, the method comprises: receiving a structured query language (SQL) statement sent by a client; if the SQL statement satisfies a first rule, decrypting first encrypted data corresponding to the SQL statement, and executing the SQL statement based on the decrypted first encrypted data to obtain a first data processing result; if the SQL statement does not satisfy the first rule, executing the SQL statement based on the first encrypted data corresponding to the SQL statement to obtain a second data processing result.

2. The method of claim 1, wherein, The SQL statement comprises a plurality of operators; The SQL statement satisfies the first rule, comprising: the plurality of operators comprise a first operator satisfying the first rule; and the first encrypted data corresponding to the SQL statement is decrypted, comprising: the first encrypted data corresponding to the first operator is decrypted; The SQL statement does not satisfy the first rule, comprising: the plurality of operators do not comprise an operator satisfying the first rule.

3. The method of claim 1, wherein, The SQL statement comprises a first operator and a second operator, the first operator corresponds to first sub-encrypted data in the first encrypted data, and the second operator corresponds to second sub-encrypted data in the first encrypted data; The SQL statement satisfies the first rule, comprising: the first operator satisfies the first rule, and the second operator does not satisfy the first rule; The first encrypted data corresponding to the SQL statement is decrypted, comprising: the first sub-encrypted data is decrypted; and the second sub-encrypted data is not decrypted; The SQL statement is executed based on the decrypted first encrypted data, comprising: the first operator is executed based on the decrypted first sub-encrypted data, and the second operator is executed based on the second sub-encrypted data.

4. The method according to claim 2 or 3, characterized in that, If the input of the first operator comprises a non-equality symbol or the first operator comprises a first input and a second input, the data types of the first input and the second input are different, and the first operator is used to operate the first input and the second input, the first operator satisfies the first rule.

5. The method according to any one of claims 1 to 4, characterized in that, After receiving the SQL statement sent by the client, the method further comprises: determining an index key value according to the SQL statement, the index key value comprising second encrypted data; determining an index page matching the index key value, the index key value being located in a key value range of the matching index page, the key value range being determined according to a maximum value and a minimum value of index key values in the index page; obtaining to-be-processed data of the SQL statement in the index page.

6. The method according to any one of claims 1 to 5, characterized in that, The server comprises a database management system (DBMS), the DBMS being located in a trusted execution environment, and the DBMS being used to execute the SQL statement to obtain the first data processing result or the second data processing result.

7. The method according to any one of claims 1 to 6, characterized in that, If the SQL statement comprises a plurality of operators, and the input of a top-level operator in the plurality of operators depends on the output of at least one other operator, the method further comprises: If the first data processing result or the second data processing result includes to-be-encrypted data, the to-be-encrypted data is encrypted to obtain a confidential data processing result, and the first data processing result or the second data processing result is an execution result of the top-level operator.

8. The method according to any one of claims 1 to 7, characterized in that, The first encrypted data includes a plurality of sub-encrypted data, each of the encrypted data corresponds to an encryption key, and encryption keys corresponding to at least two of the sub-encrypted data are different, and the method further comprises: Determining a target encrypted data in the plurality of sub-encrypted data based on a preset rule; Encrypting the first data processing result or the second data processing result based on the encryption key corresponding to the target encrypted data to obtain a confidential data processing result.

9. The method according to any one of claims 1 to 8, characterized in that, The method further comprises: Encrypting the log information and sending the encrypted log information to a target server.

10. A data processing system, characterized by The data processing system includes a client and a server; the server is configured to execute the data processing method in any one of claims 1 to 9; The server is further configured to send a confidential data processing result to the client, wherein the confidential data processing result is obtained by encrypting the first data processing result or the second data processing result by the server.

11. The system of claim 10, wherein, The client is configured to: Obtain an initial SQL statement input by a user; Determine to-be-encrypted data in the initial SQL statement according to an operation type corresponding to the initial SQL statement; Encrypt the to-be-encrypted data in the initial SQL statement to obtain the SQL statement.

12. The system of claim 11, wherein, If the initial SQL statement includes an INSERT statement, the write data of the INSERT statement is to-be-encrypted data; If the initial SQL statement includes a DELETE statement or a SELECT statement, the condition data of the condition clause in the DELETE statement or the SELECT statement is to-be-encrypted data; If the initial SQL statement includes an UPDATE statement, the write data and the condition data in the condition clause of the UPDATE statement are to-be-encrypted data.

13. A computer, characterized in that Comprise: A memory including computer readable instructions; A processor in communication with the memory, the processor configured to execute the computer readable instructions to cause the computer to perform the data processing method of any one of claims 1-9.

14. A computer program product, characterised in that, The computer program product includes instructions that, when executed by a computer, implement the method of any one of claims 1 to 9.

Images