Database plugin processing methods, equipment, media, and products

Abstract

This invention provides a method, device, medium, and product for processing database plugins. The method includes: obtaining the script file of the database plugin; identifying program objects in the script file and extracting the program body; encrypting the program body using a pre-built encryption key to obtain an encrypted program body; replacing the program body in the corresponding program object with the encrypted program body to obtain an encrypted program object; preprocessing the pre-built encryption key and embedding it into the binary file of the database plugin; recording the mapping relationship between the identifier code of the encrypted program object and the storage location of the pre-built encryption key to obtain an encrypted plugin package. The program body in the database plugin is converted into ciphertext, so users can only view the ciphertext and cannot directly view the original code, thus preventing the exposure of the developer's core business logic and protecting the developer's technology.

Description

Technical Field

[0001] This invention relates to the field of database technology, and in particular to a method, device, medium, and product for processing database plug-ins. Background Technology

[0002] In most database applications, developers are allowed to extend database functionality through database plugins. Specifically, developers can encapsulate complex business logic program objects into plugins, then install these plugins into the database, allowing the database to implement corresponding extended functions by calling the relevant program objects. However, after the plugin is installed, its script files are completely exposed, and users can directly view the source code of all program objects within the plugin. This not only leaves the developer's technical efforts unprotected but also makes the plugin's functionality vulnerable to tampering, posing a significant risk. Summary of the Invention

[0003] One object of the present invention is to provide a method, device, medium and product for processing database plugins that can improve the security of database plugins.

[0004] Specifically, the present invention provides a method for processing database plugins, comprising: Obtain the script file of the database plugin; Identify the program objects in the script file and extract the program body; The program body is encrypted using a pre-built encryption key to obtain an encrypted program body; The encrypted program object is obtained by replacing the program body in the corresponding program object with the encrypted program body. The pre-built encryption key is preprocessed and then embedded into the binary file of the database plugin; Record the mapping relationship between the identifier of the encryption program object and the storage location of the pre-built encryption key to obtain the encryption plugin package.

[0005] Optionally, the step of preprocessing the pre-built encryption key and embedding it into the binary file of the database plugin includes: The pre-built encryption key is divided into multiple key fragments; The multiple key fragments are embedded in different locations within the binary file of the database plugin; Return the storage location of each key fragment in the binary file.

[0006] Optionally, the step of dividing the pre-built encryption key into multiple key fragments includes: The pre-built encryption key is obfuscated using a preset obfuscation technique.

[0007] Optionally, the step of dividing the pre-built encryption key into multiple key fragments is followed by: Calculate the checksum of the pre-built encryption key; The checksum is embedded in the binary file of the database plugin; Return the storage location of the checksum in the binary file.

[0008] Optionally, the database receives the query statement; If an encryption program object is detected in the query statement, the corresponding encryption key is obtained based on the identifier code of the encryption program object. The encrypted program object is decrypted using the obtained encryption key; The decrypted program object content is stored in memory; Once the query statement is detected as completed, the contents of the program object in memory are released.

[0009] Optionally, the step of obtaining the corresponding encryption key based on the identifier of the encryption program object includes: Obtain multiple key fragments corresponding to the identifier of the encryption program object; The multiple key fragments are combined to obtain the corresponding encryption key.

[0010] Optionally, the step of combining the multiple key fragments to obtain the corresponding encryption key includes: Check whether the checksum of the combined encryption key is consistent with the checksum corresponding to the identifier of the encryption program object. If yes, execute the step of decrypting the encryption program object using the obtained encryption key. If no, output an error message.

[0011] According to another aspect of the present invention, a computer device is also provided, including a memory, a processor, and a computer executable program stored in the memory and running on the processor, wherein the processor, when executing the computer executable program, implements a processing method for a database plugin according to any of the preceding claims.

[0012] According to another aspect of the present invention, a computer-readable storage medium is also provided, on which a computer-executable program is stored, which, when executed by a processor, implements the processing method of the database plugin according to any one of the preceding claims.

[0013] According to another aspect of the present invention, a computer program product is also provided, comprising a computer executable program that, when executed by a processor, implements the processing method of the database plugin according to any one of the preceding claims.

[0014] The database plugin processing method of this invention obtains the script file of the database plugin, identifies the program objects in the script file and extracts the program body, encrypts the program body using a pre-built encryption key to obtain an encrypted program body, and replaces the program body in the corresponding program object with the encrypted program body to obtain an encrypted program object. The pre-processed encryption key is embedded in the binary file of the database plugin, and the mapping relationship between the identifier code of the encrypted program object and the storage location of the pre-built encryption key is recorded to obtain an encrypted plugin package. In this way, the program body in the database plugin is converted into ciphertext, and users can only view the ciphertext, not the original code, thus avoiding the exposure of the developer's core business logic and protecting the developer's technology. Moreover, it helps prevent the functionality of the data plugin from being tampered with, ensuring that the database plugin can perform normal business functions. Therefore, this solution effectively improves the security of the database plugin. In addition, the encryption process can be automatically completed as part of the plugin compilation process, without requiring developers to learn new programming standards or change their development habits, thus not adding extra burden to developers and ensuring plugin development efficiency.

[0015] The above and other objects, advantages and features of the present invention will become more apparent to those skilled in the art from the following detailed description of specific embodiments of the invention in conjunction with the accompanying drawings. Attached Figure Description

[0016] The following sections will describe some specific embodiments of the invention in a detailed manner by way of example and not limitation, with reference to the accompanying drawings. The same reference numerals in the drawings denote the same or similar parts or portions. Those skilled in the art should understand that these drawings are not necessarily drawn to scale. In the drawings: Figure 1 This is a schematic flowchart of a database plugin processing method according to an embodiment of the present invention; Figure 2 This is a schematic flowchart illustrating the encryption of the program body in a database plugin processing method according to an embodiment of the present invention; Figure 3 This is a schematic flowchart illustrating the encryption of the program body in a database plugin processing method according to another embodiment of the present invention; Figure 4 This is a schematic flowchart of a database plugin processing method according to another embodiment of the present invention; Figure 5 This is a schematic flowchart illustrating the process of obtaining an encryption key in a database plugin processing method according to another embodiment of the present invention. Figure 6 This is a schematic diagram of a computer device according to an embodiment of the present invention; Figure 7 This is a schematic diagram of a computer-readable storage medium according to an embodiment of the present invention; Figure 8 This is a schematic diagram of a computer program product according to an embodiment of the present invention. Detailed Implementation

[0017] Those skilled in the art should understand that the embodiments described below are merely a part of the embodiments of the present invention, and not all of the embodiments of the present invention. These partial embodiments are intended to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention. Based on the embodiments provided by the present invention, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of the present invention.

[0018] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0019] The flowcharts provided in this invention are not intended to indicate that the operations of the method will be performed in any particular order, or that all operations of the method are included in every case. Furthermore, the method may include additional operations. Within the scope of the technical concept provided by the method in this embodiment, additional variations can be made to the above method.

[0020] like Figure 1 As shown, in one embodiment, the database plugin processing method generally includes: Step S101: Obtain the database plugin's script file. Specifically, obtain an unencrypted script file written in its original form. Specifically, this is done using procedural languages ​​such as PL / PGSQL or PL / SQL.

[0021] Step S102: Identify program objects in the script file and extract the program body. Specifically, program objects include functions or stored procedures. The program body is the core logical definition part of the program object. All program objects in the script file can be found and their corresponding program bodies extracted by identifying keywords or special delimiters.

[0022] Step S103: Encrypt the program body using the pre-built encryption key to obtain the encrypted program body. Specifically, the program body is encrypted sequentially using the pre-built encryption key to obtain the corresponding encrypted program body.

[0023] It should be noted that all program objects within a script file can use the same key, or each program object within a script file can use a separate key. Furthermore, the encryption method can be the AES-256-GCM algorithm.

[0024] Step S104: Replace the program body in the corresponding program object with the encrypted program body to obtain an encrypted program object. Specifically, replace the original program body in the corresponding program object with the encrypted program body to obtain an encrypted program object in which the program body containing the core business logic is encrypted.

[0025] For example, an encrypted function: CREATE OR REPLACE FUNCTION calculate_revenue(INT) RETURNS DECIMAL AS 'ENCRYPTED_FUNCTION_BODY:gAAAAABfQ... (encrypted data)' LANGUAGE plpgsql; In other words, the original function body is replaced with encrypted code: ENCRYPTED_FUNCTION_BODY:gAAAAABfQ….

[0026] Step S104: The pre-built encryption key is preprocessed and then embedded into the binary file of the database plugin.

[0027] Reference Figure 2 As shown, in one embodiment, this step includes: Step S201: Divide the pre-built encryption key into multiple key fragments.

[0028] Specifically, this involves splitting the complete string of the original pre-built encryption key into multiple character fragments.

[0029] Step S202 involves embedding multiple key fragments into different locations within the binary file of the database plugin. These key fragments are spaced apart from each other.

[0030] Step S203: Return the storage location of each key fragment in the binary file. After all key fragments are embedded, return the storage location of each key fragment in the binary file.

[0031] It should be noted that in some other embodiments, before the step of dividing the pre-built encryption key into multiple key fragments, the following may be included: obfuscating the pre-built encryption key using a preset obfuscation technique. Specifically, obfuscation techniques such as XOR operation, byte rearrangement, and adding random noise may be used to obfuscate the pre-built encryption key.

[0032] Step S105: Record the mapping relationship between the identifier code of the encryption program object and the storage location of the pre-built encryption key to obtain the encryption plugin package.

[0033] Specifically, all program objects in the database plugin are encrypted into encrypted program objects, and a pre-built encryption key is embedded in the binary file. The mapping relationship between the identifier of the encrypted program object and the storage location of the pre-built encryption key is then recorded in the plugin package of the database plugin. The final result is the encrypted plugin package provided to the database application.

[0034] The method of storing pre-built encryption keys in segments means that a mapping relationship is established between the identifier of the encryption program object and all storage locations of the pre-built encryption keys.

[0035] In this embodiment, the script file of the database plugin is obtained, the program objects in the script file are identified and the program body is extracted. The program body is encrypted using a pre-built encryption key to obtain an encrypted program body. The encrypted program body is then used to replace the program body in the corresponding program object to obtain an encrypted program object. After preprocessing the pre-built encryption key, it is embedded in the binary file of the database plugin. The mapping relationship between the identifier code of the encrypted program object and the storage location of the pre-built encryption key is recorded to obtain an encrypted plugin package. In this way, the program body in the database plugin is converted into ciphertext, and users can only view the ciphertext and cannot directly view the original code, thus avoiding the exposure of the developer's core business logic and protecting the developer's technology. Moreover, it helps to prevent the functionality of the data plugin from being tampered with, ensuring that the database plugin can perform normal business functions. Therefore, this solution effectively improves the security of the database plugin. In addition, the encryption process can be automatically completed as part of the plugin compilation process, without requiring developers to learn new programming standards or change their development habits, without adding extra burden to developers, and ensuring plugin development efficiency.

[0036] Furthermore, by dividing the pre-built encryption key into multiple key fragments and embedding these fragments into different locations within the database plugin's binary file, the difficulty of extracting the original key is increased, reducing the risk of attackers obtaining the original key and thus improving key confidentiality. Moreover, by obfuscating the pre-built encryption key using pre-defined obfuscation techniques before dividing it into multiple fragments, the difficulty of static analysis to identify and locate the original key is increased, further enhancing key security.

[0037] like Figure 3 As shown, in one embodiment, after the step of segmenting the pre-built encryption key into multiple key fragments, the following is included: Step S301: Calculate the checksum of the pre-built encryption key. Specifically, the hash value of the pre-built encryption key can be calculated using a relevant hash algorithm.

[0038] Step S302: Embed the checksum into the binary file of the database plugin. Specifically, the checksum is also embedded into the binary file of the database plugin.

[0039] Step S303: Return the storage location of the checksum in the binary file. After embedding is complete, return the storage location of the checksum in the binary file. Thus, while recording the mapping relationship between the identifier of the encryption program object and the storage location of the pre-built encryption key, it is also possible to record the mapping relationship between the identifier of the encryption program object and the storage location of the checksum of the corresponding pre-built encryption key.

[0040] In this way, during subsequent operation, the original pre-built encryption key can be checked for tampering, enhancing the risk perception of malicious behavior and further improving the security of database plugin usage.

[0041] like Figure 4 As shown, in one embodiment, the database plugin processing method generally includes: In step S401, the database receives the query statement. Specifically, after the database plugin is installed in the database, the database receives the query statement from the client.

[0042] Step S402: An encryption program object is detected in the query statement. The corresponding encryption key is obtained based on the identifier code of the encryption program object.

[0043] Specifically, this step can be accomplished by configuring hook functions. Alternatively, you can determine if a program object is an encrypted program object by its object name or program body content. If an encrypted program object from the encrypted database plugin is found in the query statement, the corresponding encryption key can be obtained based on the mapping relationship between the encrypted program object's identifier and the pre-built encryption key storage location.

[0044] Reference Figure 5 As shown, specifically, this step includes: Step S501: Obtain multiple key fragments corresponding to the identifier of the encryption program object. Specifically, find the multiple key fragments corresponding to the identifier of the encryption program object and the storage locations of multiple fragments of the pre-built encryption key.

[0045] Step S502: Combine multiple key fragments to obtain the corresponding encryption key. It should be noted that if the original key fragments have undergone obfuscation, they need to be combined first, and then processed according to the deobfuscation algorithm to obtain the encryption key.

[0046] Step S503: Check whether the checksum of the combined encryption key is consistent with the checksum corresponding to the identifier code of the encryption program object. If yes, proceed to step S504; otherwise, proceed to step S505.

[0047] Specifically, the same hash algorithm is used to calculate the checksum of the combined encryption key, and it is checked whether it is the same as the checksum generated by the original pre-built encryption key.

[0048] Step S504: Decrypt the encrypted program object using the obtained encryption key. Specifically, if the checksum matches, it means that the recombined encryption key is the same as the original pre-built encryption key, and the obtained encryption key can be used to decrypt the encrypted program object.

[0049] Step S505: Output an error message. Specifically, if the checksum is inconsistent, it means that the recombined encryption key is different from the original pre-built encryption key, and the original key may have been tampered with, so an error message is output.

[0050] Step S403: Decrypt the encrypted program object using the obtained encryption key. After obtaining the correct encryption key, decrypt the encrypted program object using the encryption key to obtain the decrypted program object.

[0051] Step S404: Store the decrypted program object content in memory. After decrypting the encrypted program object, the complete decrypted program object content is stored in memory, and the database can retrieve the corresponding program object from memory during execution.

[0052] Step S405: Upon detecting that the query statement has completed execution, the program object content in memory is released. After the query statement execution is complete, the program object content stored in memory is released; the program object content is not written to disk or logs.

[0053] In this embodiment, if an encrypted program object is detected in the query statement, the encrypted program object is decrypted using the obtained encryption key. The decrypted program object content is stored in memory. Once the query statement execution is complete, the program object content in memory is released. The system can automatically process encrypted program objects, and the user does not need to be aware of the decryption process. The decrypted original program object content is stored only in volatile memory and released immediately after the query execution is completed, ensuring that the plaintext source code is never written to disk, logs, or any persistent storage. This fundamentally eliminates attack paths that could lead to the theft of source code by analyzing memory dumps, system logs, or temporary files, greatly improving security during dynamic runtime.

[0054] This embodiment also provides a computer device and a computer-readable storage medium. Figure 6 This is a schematic diagram of a computer device 10 according to an embodiment of the present invention. Figure 7 This is a schematic diagram of a computer-readable storage medium 20 according to an embodiment of the present invention.

[0055] The computer device 10 may include a memory 110, a processor 120, and a computer-executable program 11 stored on the memory 110 and running on the processor 120. When the processor 120 executes the computer-executable program 11, it implements the processing method of the database plugin of any of the above embodiments.

[0056] The computer-readable storage medium 20 stores a computer-executable program 11 thereon, which, when executed by a processor, implements the database plugin processing method of any of the above embodiments.

[0057] This embodiment also provides a computer program product. Figure 8 This is a schematic diagram of a computer program product 30 according to an embodiment of the present invention. The computer program product 30 includes a computer executable program 11, which, when executed by a processor 120, implements any of the database plugin processing methods described above.

[0058] Specifically, the computer executable program 11 used to perform the operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, computer instructions, computer-related instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages.

[0059] For the purposes of this embodiment, the computer-readable storage medium 20 can be any means capable of containing, storing, communicating, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, the computer-readable storage medium 20 can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0060] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system.

[0061] Computer device 10 can be, for example, a server, desktop computer, laptop computer, tablet computer, or smartphone. In some examples, computer device 10 can be a cloud acquisition node. Computer device 10 can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., that perform specific tasks or implement specific abstract data types. Computer device 10 can be implemented in a distributed cloud acquisition environment where tasks are performed by remote processing devices linked via a communication network. In a distributed cloud acquisition environment, program modules can reside on local or remote acquisition system storage media, including storage devices.

[0062] Computer device 10 may include a processor 120 adapted to execute stored instructions and a memory 110 that provides temporary storage space for the operation of said instructions during operation. Processor 120 may be a single-core processor, a multi-core processor, an acquisition cluster, or any other configuration. Memory 110 may include random access memory (RAM), read-only memory, flash memory, or any other suitable storage system.

[0063] The processor 120 can be connected via a system interconnect (e.g., PCI, PCI-Express, etc.) to an I / O interface (input / output interface) suitable for connecting the computer device 10 to one or more I / O devices (input / output devices). I / O devices may include, for example, a keyboard and indicating devices, where indicating devices may include a touchpad or touchscreen, etc. I / O devices may be built into the computer device 10 or may be external devices connected to the acquisition device.

[0064] The processor 120 may also be linked via a system interconnect to a display interface suitable for connecting the computer device 10 to a display device. The display device may include a display screen that is a built-in component of the computer device 10. The display device may also include an external computer monitor, television, or projector connected to the computer device 10. Furthermore, a network interface controller (NIC) may be adapted to connect the computer device 10 to a network via a system interconnect. In some embodiments, the NIC may use any suitable interface or protocol (such as an Internet Minicomputer System Interface) to transmit data. The network may be a cellular network, a radio network, a wide area network (WAN), a local area network (LAN), or the Internet, etc. Remote devices may connect to the computer device via the network.

[0065] Therefore, those skilled in the art should recognize that although numerous exemplary embodiments of the present invention have been shown and described in detail herein, many other variations or modifications conforming to the principles of the present invention can be directly determined or derived from the disclosure of the present invention without departing from the spirit and scope of the invention. Thus, the scope of the present invention should be understood and construed as covering all such other variations or modifications.

Claims

1. A method for processing a database plugin, comprising: Obtain the script file of the database plugin; Identify the program objects in the script file and extract the program body; The program body is encrypted using a pre-built encryption key to obtain an encrypted program body; The encrypted program object is obtained by replacing the program body in the corresponding program object with the encrypted program body. The pre-built encryption key is preprocessed and then embedded into the binary file of the database plugin; Record the mapping relationship between the identifier of the encryption program object and the storage location of the pre-built encryption key to obtain the encryption plugin package.

2. The database plugin processing method according to claim 1, wherein... The step of preprocessing the pre-built encryption key and embedding it into the binary file of the database plugin includes: The pre-built encryption key is divided into multiple key fragments; The multiple key fragments are embedded in different locations within the binary file of the database plugin; Return the storage location of each key fragment in the binary file.

3. The database plugin processing method according to claim 2, wherein... Prior to the step of dividing the pre-built encryption key into multiple key fragments, the following is included: The pre-built encryption key is obfuscated using a preset obfuscation technique.

4. The database plugin processing method according to claim 2, wherein... The step of dividing the pre-built encryption key into multiple key fragments includes: Calculate the checksum of the pre-built encryption key; The checksum is embedded in the binary file of the database plugin; Return the storage location of the checksum in the binary file.

5. The database plugin processing method according to claim 4, wherein... The database received the query statement; If an encryption program object is detected in the query statement, the corresponding encryption key is obtained based on the identifier code of the encryption program object. The encrypted program object is decrypted using the obtained encryption key; The decrypted program object content is stored in memory; Once the query statement is detected as completed, the contents of the program object in memory are released.

6. The database plugin processing method according to claim 5, wherein... The step of obtaining the corresponding encryption key based on the identifier of the encryption program object includes: Obtain multiple key fragments corresponding to the identifier of the encryption program object; The multiple key fragments are combined to obtain the corresponding encryption key.

7. The database plugin processing method according to claim 6, wherein... The step of combining the multiple key fragments to obtain the corresponding encryption key includes: Check whether the checksum of the combined encryption key is consistent with the checksum corresponding to the identifier of the encryption program object. If yes, execute the step of decrypting the encryption program object using the obtained encryption key. If no, output an error message.

8. A computer device comprising a memory, a processor, and a computer-executable program stored in the memory and running on the processor, wherein the processor, when executing the computer-executable program, implements the processing method of a database plugin according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer-executable program stored thereon, wherein the computer-executable program, when executed by a processor, implements the processing method of the database plugin according to any one of claims 1 to 7.

10. A computer program product comprising a computer executable program, wherein the computer executable program, when executed by a processor, implements the processing method of the database plugin according to any one of claims 1 to 7.

Images