Stock data encryption method and system and electronic equipment

Abstract

The invention provides a stock data encryption method and system and electronic equipment, and belongs to the technical field of data processing. The method is applied to a stock data encryption system, comprises a client, a database server, a management end and an encryption gateway, and comprises the following steps: a column management step: newly adding a ciphertext column in a target data table of the database server through the management end; a stock encryption step: calculating ciphertext data corresponding to the stock data of the plaintext column in the target data table through the management end, and correspondingly writing the ciphertext data into a ciphertext column; a synchronous control step: in the execution process of the stock encryption step, rewriting a write-in statement related to a plaintext column into a double-write statement which simultaneously writes in the plaintext column and a ciphertext column through an encryption gateway; and a ciphertext reading and writing step: after the stock encryption step is completed, rewriting the read-write statement related to the plaintext column into the read-write statement corresponding to the ciphertext column through the encryption gateway. According to the invention, the encryption conversion of the stock data can be completed without interrupting the operation of a client service system.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, system and electronic device for encrypting existing data. Background Technology

[0002] In the field of database security, database encryption gateways are commonly used to ensure data storage security. These gateways are deployed between user business systems and database servers, performing real-time conversion between plaintext and ciphertext on incoming data traffic. This allows the server to store encrypted data while the business system displays plaintext data. However, before enabling the encryption gateway, the database often already contains a large amount of historical data—existing data—that has not yet been encrypted. If the encryption gateway is enabled directly, it will be unable to correctly process this existing plaintext data, thus affecting the overall security and consistency of the system.

[0003] To address the aforementioned issues, existing technologies typically employ offline encryption to process existing data. Specifically, this involves first halting the user's business system, then temporarily adding a new column to the data table to store the ciphertext, setting its data type to be compatible with the ciphertext format. Next, the system scans the existing data row by row, reading the original plaintext column content, calculating its corresponding ciphertext, and writing it into the newly added ciphertext column. Once all existing data has been converted, the business system is restarted and the encryption gateway is activated. The reason for stopping the business system is that the existing data is in plaintext format, and the encrypted content often cannot be directly stored in the original column due to its format and length. Without adding a dedicated ciphertext column, data writing will fail or data corruption will occur. Conversely, if the business system continues to run during the conversion process, data read / write conflicts and inconsistencies between the old and new data may arise, affecting data integrity and business continuity.

[0004] However, in many real-world applications, user business systems often need to operate continuously around the clock, such as critical services like telecommunications billing systems and highway toll collection systems. Any interruption can impact service. Therefore, the offline encryption methods mentioned above, which require stopping business systems, have significant limitations. They cannot complete the encryption and conversion of existing data without interrupting business operations, thus restricting the application of database encryption gateways in scenarios where continuous service is essential. Therefore, how to securely and completely encrypt existing data without interrupting business systems has become a pressing technical problem to be solved. Summary of the Invention

[0005] The purpose of this application is to provide a method, system, and electronic device for encrypting existing data to solve the above-mentioned problems.

[0006] To achieve the above objectives, in a first aspect, this application proposes a method for encrypting existing data. The method is applied to an existing data encryption system, which includes a client, a database server, a management terminal, and an encryption gateway deployed between the client and the database server. The method includes: Column management steps: Add a encrypted column to the target data table on the database server through the management terminal; The existing data encryption step is as follows: The management terminal calculates the ciphertext data corresponding to the existing data in the plaintext column of the target data table, and writes the ciphertext data into the corresponding ciphertext column. Synchronization control step: During the execution of the existing encryption step, the encryption gateway enters dual-write mode, and rewrites the write statement involving the plaintext column in the real-time SQL statement sent by the client into a dual-write statement that simultaneously writes the plaintext column and the ciphertext column. Ciphertext read / write steps: After the existing encryption step is completed, the encryption gateway enters the ciphertext read / write mode. The encryption gateway rewrites the read / write statements involving the plaintext columns in the real-time SQL statements sent by the client into read / write statements corresponding to the ciphertext columns.

[0007] In some implementations, rewriting the write statement involving the plaintext column in the real-time SQL statement sent by the client through the encryption gateway into a dual-write statement that simultaneously writes to both the plaintext column and the ciphertext column includes: The encryption gateway receives real-time SQL statements sent by the client and extracts the target value of the write statement by parsing the write statement involving the plaintext column in the real-time SQL statement. Using the same preset encryption algorithm as the management terminal, calculate the encrypted value corresponding to the target value; The write statement is rewritten as a double write statement that simultaneously writes to both the plaintext column and the ciphertext column, and the double write statement is sent to the database server for execution, wherein the target value is written to the plaintext column and the encrypted value is written to the ciphertext column.

[0008] In some implementations, during the execution of the existing encryption step, the encryption gateway is also used to pass through the query statements involving the plaintext columns in the real-time SQL statements sent by the client.

[0009] In some implementations, prior to the existing data encryption step, the following is included: The encryption gateway is in transparent transmission mode, through which the real-time SQL statements sent by the client and the return results from the database server are transparently transmitted.

[0010] In some implementations, the synchronization control step further includes: Before the existing encryption step is executed, the management terminal sends a first control command to the encryption gateway to trigger the encryption gateway to switch from transparent mode to dual-write mode. After the existing data encryption step is completed, a second control command is sent from the management terminal to the encryption gateway to trigger the encryption gateway to switch from dual-write mode to encrypted read-write mode.

[0011] In some implementations, sending the first control command to the encryption gateway via the management terminal includes: The management terminal detects whether the newly added encrypted column exists in the target data table; If so, after confirming that the data type of the ciphertext column is compatible with the ciphertext format output by the preset encryption algorithm, a first control command is sent to the encryption gateway. After sending the first control command to the encryption gateway through the management terminal, the method further includes: After receiving the feedback signal from the encryption gateway in response to the first control command, the management terminal executes the existing encryption step.

[0012] In some implementations, the step of calculating the ciphertext data corresponding to the existing data in the plaintext column of the target data table through the management terminal, and writing the ciphertext data into the corresponding ciphertext column, includes: The management terminal scans the target data table row by row, reading the existing data in the plaintext column of each record. Calculate the ciphertext data corresponding to the plaintext column of each row record, and write the ciphertext data into the ciphertext column of the corresponding row record using an update statement.

[0013] In some implementations, the update statement includes the existing data of the plaintext column in the corresponding row record as the update condition; when the number of affected rows is zero after the update statement is executed, the management terminal determines that the corresponding row record has been modified by the client and skips the row record modified by the client; wherein, the row record modified by the client is synchronously updated by the encryption gateway in dual-write mode with the corresponding plaintext column and ciphertext column.

[0014] Secondly, to achieve the above objectives, this application also proposes a system for encrypting existing data, the system comprising: Client; Database server; The management terminal connected to the database server is used to add a ciphertext column to the target data table of the database server; send a first control command to the encryption gateway to trigger the encryption gateway to switch from pass-through mode to dual-write mode; calculate the ciphertext data corresponding to the existing data in the plaintext column of the target data table, and write the ciphertext data into the ciphertext column accordingly; and send a second control command to the encryption gateway to trigger the encryption gateway to switch from dual-write mode to ciphertext read-write mode. An encryption gateway deployed between the client and the database server is used to rewrite the write statements involving the plaintext column in the real-time SQL statements sent by the client into dual-write statements that simultaneously write to both the plaintext column and the ciphertext column in dual-write mode; and to rewrite the read and write statements involving the plaintext column in the real-time SQL statements sent by the client into read and write statements corresponding to the ciphertext column in ciphertext read and write mode.

[0015] Thirdly, to achieve the above objectives, this application also proposes an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the existing data encryption method as described above.

[0016] Compared with existing technologies, the beneficial effects of this application include: This application enables the management end to independently complete the batch encrypted writing of existing data, while simultaneously rewriting the real-time write statements in dual-write mode through an encryption gateway. This ensures that newly added data during the existing data encryption process can be synchronously stored in both plaintext and ciphertext columns, thereby achieving seamless connection and consistency assurance between existing and real-time data while the client (business system) continues to provide services. Compared to existing technologies that require the business system to be shut down for offline encryption, this application significantly improves the business continuity capabilities in database encryption deployment scenarios, and is particularly suitable for critical business systems in telecommunications, finance, transportation, and other industries with extremely high service availability requirements. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation on the scope of this application.

[0018] Figure 1 This is a flowchart illustrating a method for encrypting existing data in one embodiment; Figure 2 This is a schematic diagram of multi-terminal interaction of a method for encrypting existing data in one embodiment; Figure 3This is a schematic diagram of the electronic device involved in the existing data encryption method in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] All terms used in this application (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0021] For example, the terms "first," "second," etc., used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element. For instance, without departing from the scope of this application, the first element may be referred to as the second element, and similarly, the second element may be referred to as the first element. Both the first element and the second element are elements, but they are not the same element.

[0022] For example, the terms "comprising" or "including" used in this application indicate the presence of features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0023] As mentioned earlier, existing technologies typically employ offline encryption to process existing data. Specifically, this involves first halting the user's business system, then temporarily adding a new column to the data table to store the ciphertext, setting the column's data type to be compatible with the ciphertext format. Next, the system scans the existing data row by row, reading the original plaintext column content, calculating its corresponding ciphertext, and writing it into the newly added ciphertext column. Once all existing data has been converted, the business system is restarted and the encryption gateway is enabled.

[0024] However, in many real-world applications, user business systems often need to operate continuously around the clock, such as critical services like telecommunications billing systems and highway toll collection systems. Any interruption can impact service. Therefore, the offline encryption methods mentioned above, which require stopping business systems, have significant limitations. They cannot complete the encryption and conversion of existing data without interrupting business operations, thus restricting the application of database encryption gateways in scenarios where continuous service is essential. Therefore, how to securely and completely encrypt existing data without interrupting business systems has become a pressing technical problem to be solved.

[0025] To this end, this application proposes a method, system, and electronic device for encrypting existing data. By setting up a management terminal and an encryption gateway to work together, the encryption conversion of existing data can be completed without interrupting the operation of the user's business system.

[0026] like Figure 1 As shown in the figure, the present application provides a method for encrypting existing data, which is applied to an existing data encryption system. The system includes a client, a database server, a management terminal, and an encryption gateway deployed between the client and the database server.

[0027] In this context, the client refers to the user's business system, i.e., the application or service that continuously accesses the database during daily operation. It is responsible for initiating data read and write requests and is the main entity that needs to maintain uninterrupted operation throughout the encryption process. The database server is the carrier for persistent data storage, responsible for managing data tables, executing SQL statements, and returning results. It is the target object protected by encryption in this embodiment. The encryption gateway is a network proxy component deployed between the client and the database server. It receives all SQL statements issued by the client, parses, rewrites, or transmits the SQL statements according to the current mode, forwards the rewritten statements to the database server, and processes the database server's return results before returning them to the client, thereby realizing flow control and data encryption / decryption conversion between the client and the database server. The management terminal is a control entity independent of the client and the encryption gateway. It establishes a direct database connection with the database server without going through the encryption gateway. It is used to perform management operations related to the encryption of existing data, including adding columns to the database, scanning existing data, calculating ciphertext and writing it to the database, and sending stage switching instructions (first control instruction and second control instruction) to the encryption gateway to coordinate the state progression of the entire encryption process.

[0028] like Figure 1 and Figure 2 As shown, the method includes the following steps: In column management step S10, a ciphertext column is added to the target data table of the database server through the management terminal.

[0029] In some implementations, the management end determines the data table to be encrypted, i.e., the target data table. By invoking the database's native data definition language commands, a new column is added to the target data table as a ciphertext column to store the ciphertext data corresponding to the existing data in the plaintext column. It should be noted that the data type of the ciphertext data needs to be selected based on the ciphertext format output by the preset encryption algorithm. For example, if the encryption algorithm outputs a fixed-length hexadecimal string or encoded binary data, the data type of the ciphertext column can be configured as a variable-length string or a binary large object to ensure that it can fully accommodate the encrypted data.

[0030] For example, in phase two as shown in Figure 2, the management end ( Figure 2 In step A), by calling the database's native Data Definition Language (DDL) command, a new column `column2` is added to the target data table `t1` as a ciphertext column to store the ciphertext data corresponding to `column1`. After adding the new column `column2`, it will be empty. Taking PostgreSQL as an example, the DDL command is: ALTER TABLE t1 ADD COLUMN column2 VARCHAR(50) During the execution of step S10, the encryption gateway is in transparent transmission mode. The encryption gateway is used to transparently transmit the real-time SQL statements sent by the client and the return results from the database server. That is, the client's business system ( Figure 2 In step B), the process is always running, and reading and writing remain in plaintext. The encryption gateway does not modify the real-time SQL statements sent by the client and forwards them directly to the database server.

[0031] Step S10 provides an independent storage space for the ciphertext data of the existing data, avoiding the problem of data format incompatibility or data corruption caused by the ciphertext data directly overwriting the original plaintext column.

[0032] In the existing data encryption step S20, the management terminal calculates the ciphertext data corresponding to the existing data in the plaintext column of the target data table, and writes the ciphertext data into the corresponding ciphertext column.

[0033] In some implementations, step S20 includes: scanning the target data table row by row through the management terminal, reading the existing data in the plaintext column of each row record; calculating the ciphertext data corresponding to the existing data in the plaintext column of each row record using a preset encryption algorithm (this embodiment does not limit the specific encryption algorithm used), and writing the ciphertext data into the ciphertext column of the corresponding row record using an update statement. The management terminal executes the above process repeatedly until the ciphertext columns of all rows in the target data table are filled, thereby completing the encryption conversion of the existing data.

[0034] For example, such as Figure 2 In the third stage shown, the management end ( Figure 2 In step A), the target data table t1 is scanned row by row. The plaintext content (existing data) of column1 in each row is read, the corresponding ciphertext data is calculated using a preset encryption algorithm, and the ciphertext data is written to column2 of the corresponding row. Taking a row record with primary key id as 1 as an example, the following update statement is executed: UPDATE t1 SET column2=ciphertext WHERE column1=plaintext AND id=1 Management terminal ( Figure 2 In step A), traverse the target data table t1 until all rows in t1 have updated the data in column2, which indicates that the encryption of the existing data is complete.

[0035] In some implementations, the update statement includes the existing data of the plaintext column in the corresponding row record as the update condition. When the number of affected rows is zero after the update statement is executed, that is, the content of the plaintext column of the corresponding row record in the target data table does not meet the condition judgment of the previously read existing data, the update statement does not update the ciphertext column, and the number of affected rows is zero. At this time, the management terminal determines that the corresponding row record was modified by the client after being read by the management terminal but before being updated, and skips the row record modified by the client. The row record modified by the client is updated by the encryption gateway in dual-write mode with the corresponding plaintext column and ciphertext column simultaneously to ensure that the data related to the row record modified by the client is finally written to the ciphertext by the encryption gateway through the dual-write mechanism, avoiding data inconsistency.

[0036] At this point, the management terminal can also add the row records modified by the client to the list to be reviewed. After completing the row-by-row scanning of all existing data, the row records in the list to be reviewed are processed a second time. The second processing includes rereading the plaintext column values ​​of the row records in the list to be reviewed, calculating the corresponding ciphertext data, and writing it into the ciphertext column of the corresponding row record.

[0037] It should be noted that during the execution of the existing data encryption step S20, the encryption gateway is also used to pass through the query statements involving the plaintext columns in the real-time SQL statements sent by the client.

[0038] Synchronization control step S30, during the execution of step S20, that is, as... Figure 2 In Phase 3, the encryption gateway enters a dual-write mode, rewriting the write statements involving the plaintext column in the real-time SQL statements sent by the client into dual-write statements that simultaneously write to both the plaintext and ciphertext columns.

[0039] In some implementations, the encryption gateway receives real-time SQL statements sent by the client, and extracts the target value of the write statement by parsing the write statement involving the plaintext column in the real-time SQL statement; calculates the encrypted value corresponding to the target value using the same preset encryption algorithm as the management terminal; rewrites the write statement into a double-write statement that simultaneously writes to the plaintext column and the ciphertext column, and sends the double-write statement to the database server for execution, wherein the target value is written to the plaintext column and the encrypted value is written to the ciphertext column.

[0040] In other words, the encryption gateway rewrites the write statement involving the plaintext column (column1), turning the original single-column write of the plaintext column (column1) into a double-column write of both the plaintext and ciphertext columns (column1 and column2).

[0041] For example, the original statement is: UPDATE t1 SET column1=plain text WHERE id=1 The rewritten double-write statement is as follows: UPDATE t1 SET column1=plaintext, column2=ciphertext WHERE id=1 It should be noted that the mode switching of the encryption gateway occurs once, before the execution of the existing encryption step S20, when the management terminal sends a first control command to the encryption gateway, triggering the encryption gateway to switch from transparent mode to dual-write mode. In some embodiments, the management terminal can detect whether the newly added ciphertext column exists in the target data table; if so, after confirming that the data type of the ciphertext column is compatible with the ciphertext format output by the preset encryption algorithm, it sends the first control command to the encryption gateway. In some embodiments, after receiving the feedback signal from the encryption gateway in response to the first control command, the management terminal executes the existing encryption step S30 to ensure state synchronization between the encryption gateway and the management terminal, avoiding data access anomalies caused by command loss or delay.

[0042] Another instance is that after the existing data encryption step S20 is completed, a second control command is sent from the management terminal to the encryption gateway, triggering the encryption gateway to switch from dual-write mode to encrypted read-write mode.

[0043] In the encrypted read / write step S40, after step S20 is completed, the encryption gateway enters the encrypted read / write mode and rewrites the read / write statements involving the plaintext columns in the real-time SQL statements sent by the client into read / write statements corresponding to the encrypted columns.

[0044] In this embodiment, read / write statements include query statements and write statements. In encrypted read / write mode, the encryption gateway rewrites query statements involving plaintext columns sent by the client into query statements for the corresponding encrypted columns, and decrypts the encrypted data read from the database server back to plaintext in real time before returning it to the client. For write statements involving plaintext columns sent by the client, the gateway rewrites them into write statements for the corresponding encrypted columns, and encrypts the plaintext target value to be written into encrypted data in real time before storing it in the encrypted column.

[0045] In other words, after all existing data has been encrypted, the encryption gateway rewrites the SQL statements involving the plaintext column (column1). The rewriting principle is to change the reading and writing of the plaintext column (column1) in the original statement to reading and writing of the ciphertext column (column2).

[0046] Example 1, the original write statement is: UPDATE t1 SET column1=plain text WHERE id=1 The encrypted gateway rewrites it as: UPDATE t1 SET column2=ciphertextWHERE id=1 Example 2, the original query statement is: SELECT column1 FROM t1 The encrypted gateway rewrites it as: SELECT column2 FROM t1 It should be noted that the reason why read and write statements involving plaintext columns are rewritten as read and write statements for the corresponding ciphertext columns is that the ciphertext columns already contain all the data, and the content of the plaintext columns may be deleted later (to ensure the encryption effect).

[0047] In the existing data encryption method proposed in this application, the management terminal independently completes the batch encryption and writing of existing data. Simultaneously, the encryption gateway rewrites the real-time write statements in dual-write mode, ensuring that newly added data during the existing data encryption process can be synchronously stored in both plaintext and ciphertext columns. This achieves seamless connection and consistency assurance between existing and real-time data while the client (business system) continues to provide services. Compared to existing technologies that require the business system to be stopped for offline encryption, this application significantly improves business continuity capabilities in database encryption deployment scenarios, and is particularly suitable for critical business systems in telecommunications, finance, and transportation sectors with extremely high service availability requirements.

[0048] In one embodiment, this application also proposes a system for encrypting existing data, the system comprising: Client; Database server; The management terminal connected to the database server is used to add a ciphertext column to the target data table of the database server; send a first control command to the encryption gateway to trigger the encryption gateway to switch from pass-through mode to dual-write mode; calculate the ciphertext data corresponding to the existing data in the plaintext column of the target data table, and write the ciphertext data into the ciphertext column accordingly; and send a second control command to the encryption gateway to trigger the encryption gateway to switch from dual-write mode to ciphertext read-write mode. An encryption gateway deployed between the client and the database server is used to rewrite the write statements involving the plaintext column in the real-time SQL statements sent by the client into dual-write statements that simultaneously write to both the plaintext column and the ciphertext column in dual-write mode; and to rewrite the read and write statements involving the plaintext column in the real-time SQL statements sent by the client into read and write statements corresponding to the ciphertext column in ciphertext read and write mode.

[0049] In some implementations, rewriting the write statement involving the plaintext column in the real-time SQL statement sent by the client into a dual-write statement that simultaneously writes to both the plaintext column and the ciphertext column includes: The encryption gateway receives real-time SQL statements sent by the client and extracts the target value of the write statement by parsing the write statement involving the plaintext column in the real-time SQL statement. Using the same preset encryption algorithm as the management terminal, calculate the encrypted value corresponding to the target value; The write statement is rewritten as a double write statement that simultaneously writes to both the plaintext column and the ciphertext column, and the double write statement is sent to the database server for execution, wherein the target value is written to the plaintext column and the encrypted value is written to the ciphertext column.

[0050] In some implementations, the encryption gateway, in dual-write mode, is also used to pass through the query statements involving the plaintext columns in the real-time SQL statements sent by the client.

[0051] In some implementations, the encryption gateway, in transparent transmission mode, is also used to transparently transmit the real-time SQL statements sent by the client and the return results from the database server.

[0052] In some implementations, sending the first control command to the encryption gateway includes: The management terminal detects whether the newly added encrypted column exists in the target data table; If so, after confirming that the data type of the ciphertext column is compatible with the ciphertext format output by the preset encryption algorithm, a first control command is sent to the encryption gateway. After sending the first control command to the encryption gateway, the method further includes: After receiving the feedback signal from the encryption gateway in response to the first control command, the management terminal executes the existing encryption step.

[0053] In some implementations, calculating the ciphertext data corresponding to the existing data in the plaintext column of the target data table and writing the ciphertext data into the corresponding ciphertext column includes: The target data table is scanned row by row, and the existing data of the plaintext column in each row is read. Calculate the ciphertext data corresponding to the plaintext column of each row record, and write the ciphertext data into the ciphertext column of the corresponding row record using an update statement.

[0054] In some implementations, the update statement includes the existing data of the plaintext column in the corresponding row record as the update condition; when the number of affected rows is zero after the update statement is executed, the management terminal determines that the corresponding row record has been modified by the client and skips the row record modified by the client; wherein, the row record modified by the client is synchronously updated by the encryption gateway in dual-write mode with the corresponding plaintext column and ciphertext column.

[0055] The existing data encryption system proposed in this application constructs a complete technical architecture capable of encrypting existing data while the client's business system continues to operate, through the organic collaboration of four core components: client, database server, management terminal, and encryption gateway. The management terminal independently performs batch encryption writing of existing data, while the encryption gateway rewrites real-time write statements in dual-write mode, ensuring that newly added data during the encryption process is simultaneously stored in both plaintext and ciphertext columns. This achieves seamless connection and consistency assurance between existing and real-time data while the client (business system) continues to provide services. Compared to existing technologies that require the business system to be stopped for offline encryption, this application significantly improves business continuity capabilities in database encryption deployment scenarios, making it particularly suitable for critical business systems in telecommunications, finance, and transportation sectors with extremely high service availability requirements.

[0056] In one embodiment, an electronic device is also provided, including one or more processors; and a memory storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the steps in the above method embodiments.

[0057] In one embodiment, such as Figure 3The diagram illustrates the structure of an electronic device used to implement an embodiment of this application. The electronic device includes a central processing unit (CPU) 101, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 102 or a program loaded from a storage portion 108 into a random access memory (RAM) 103. The RAM 103 also stores various programs and data required for the operation of the electronic device 100. The CPU 101, ROM 102, and RAM 103 are interconnected via a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.

[0058] The following components are connected to I / O interface 105: an input section 106 including a keyboard, mouse, etc.; an output section 107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 108 including a hard disk, etc.; and a communication section 109 including a network interface card such as a LAN card, modem, etc. The communication section 109 performs communication processing via a network such as the Internet. A drive 110 is also connected to I / O interface 105 as needed. A removable medium 111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 110 as needed so that computer programs read from it can be installed into storage section 108 as needed.

[0059] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer-readable medium carrying instructions that, in such embodiments, can be downloaded and installed from a network via communication section 109, and / or installed from removable medium 111. When the instructions are executed by central processing unit (CPU) 101, the various method steps described in this application are performed.

[0060] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0061] Furthermore, those skilled in the art will understand that although some embodiments herein include certain features included in other embodiments but not others, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, any of the embodiments or implementations claimed above can be used in any combination. The information disclosed in this background section is intended only to enhance the understanding of the general background of this application and should not be construed as an admission or in any way implying that such information constitutes prior art known to those skilled in the art.

Claims

1. A method for encrypting existing data, characterized in that, The method is applied to an existing data encryption system, the system including a client, a database server, a management terminal, and an encryption gateway deployed between the client and the database server, the method including: Column management steps: Add a encrypted column to the target data table on the database server through the management terminal; The existing data encryption step is as follows: The management terminal calculates the ciphertext data corresponding to the existing data in the plaintext column of the target data table, and writes the ciphertext data into the corresponding ciphertext column. Synchronization control step: During the execution of the existing encryption step, the encryption gateway enters dual-write mode, and rewrites the write statement involving the plaintext column in the real-time SQL statement sent by the client into a dual-write statement that simultaneously writes the plaintext column and the ciphertext column. Ciphertext read / write steps: After the existing encryption step is completed, the encryption gateway enters the ciphertext read / write mode. The encryption gateway rewrites the read / write statements involving the plaintext columns in the real-time SQL statements sent by the client into read / write statements corresponding to the ciphertext columns.

2. The method for encrypting existing data according to claim 1, characterized in that, The step of rewriting the write statement involving the plaintext column in the real-time SQL statement sent by the client through the encryption gateway into a dual-write statement that simultaneously writes to both the plaintext and ciphertext columns includes: The encryption gateway receives real-time SQL statements sent by the client and extracts the target value of the write statement by parsing the write statement involving the plaintext column in the real-time SQL statement. Using the same preset encryption algorithm as the management terminal, calculate the encrypted value corresponding to the target value; The write statement is rewritten as a double write statement that simultaneously writes to both the plaintext column and the ciphertext column, and the double write statement is sent to the database server for execution, wherein the target value is written to the plaintext column and the encrypted value is written to the ciphertext column.

3. The method for encrypting existing data according to claim 1, characterized in that, During the execution of the existing encryption step, the encryption gateway is also used to pass through the query statements involving the plaintext columns in the real-time SQL statements sent by the client.

4. The method for encrypting existing data according to claim 1, characterized in that, Prior to the existing data encryption step, the following steps are included: The encryption gateway is in transparent transmission mode, through which the real-time SQL statements sent by the client and the return results from the database server are transparently transmitted.

5. The method for encrypting existing data according to claim 4, characterized in that, The synchronization control steps also include: Before the existing encryption step is executed, the management terminal sends a first control command to the encryption gateway to trigger the encryption gateway to switch from transparent mode to dual-write mode. After the existing data encryption step is completed, a second control command is sent from the management terminal to the encryption gateway to trigger the encryption gateway to switch from dual-write mode to encrypted read-write mode.

6. The method for encrypting existing data according to claim 5, characterized in that, Sending the first control command to the encryption gateway through the management terminal includes: The management terminal detects whether the newly added encrypted column exists in the target data table; If so, after confirming that the data type of the ciphertext column is compatible with the ciphertext format output by the preset encryption algorithm, a first control command is sent to the encryption gateway. After sending the first control command to the encryption gateway through the management terminal, the method further includes: After receiving the feedback signal from the encryption gateway in response to the first control command, the management terminal executes the existing encryption step.

7. The method for encrypting existing data according to claim 1, characterized in that, The step of calculating the ciphertext data corresponding to the existing data in the plaintext column of the target data table through the management terminal, and writing the ciphertext data into the corresponding ciphertext column, includes: The management terminal scans the target data table row by row, reading the existing data in the plaintext column of each record. Calculate the ciphertext data corresponding to the plaintext column of each row record, and write the ciphertext data into the ciphertext column of the corresponding row record using an update statement.

8. The method for encrypting existing data according to claim 7, characterized in that, The update statement includes the existing data of the plaintext column in the corresponding row record as the update condition; When the number of affected rows is zero after the update statement is executed, the management terminal determines that the corresponding row record has been modified by the client and skips the row record modified by the client; wherein, the row record modified by the client is synchronously updated by the encryption gateway in dual-write mode with the corresponding plaintext column and ciphertext column.

9. A system for encrypting existing data, characterized in that, The system includes: Client; Database server; The management terminal connected to the database server is used to add a ciphertext column to the target data table of the database server; send a first control command to the encryption gateway to trigger the encryption gateway to switch from pass-through mode to dual-write mode; calculate the ciphertext data corresponding to the existing data in the plaintext column of the target data table, and write the ciphertext data into the ciphertext column accordingly; and send a second control command to the encryption gateway to trigger the encryption gateway to switch from dual-write mode to ciphertext read-write mode. An encryption gateway deployed between the client and the database server is used to rewrite the write statements involving the plaintext column in the real-time SQL statements sent by the client into dual-write statements that simultaneously write to both the plaintext column and the ciphertext column in dual-write mode; and to rewrite the read and write statements involving the plaintext column in the real-time SQL statements sent by the client into read and write statements corresponding to the ciphertext column in ciphertext read and write mode.

10. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the existing data encryption method as described in any one of claims 1 to 8.

Images