A database encryption and decryption method, device and equipment based on user-defined functions and a medium

Abstract

This application discloses a database encryption / decryption method, apparatus, device, and medium based on user-defined functions (UDFs), relating to the field of computer technology. It includes: acquiring an initial SQL statement sent by a client and parsing the initial SQL statement to extract database information, table information, and field information; using a preset strategy matching engine to perform encryption strategy matching based on the field information; if the field information matches successfully, modifying the initial SQL statement using a preset UDF function according to the matching result and the type of the initial SQL statement; sending the modified SQL statement to the database, so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption / decryption operations on the target data, and returning the execution result to the client. This improves the encryption coverage during database encryption, avoids data security blind spots, and reduces performance overhead.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a database encryption and decryption method, apparatus, device, and medium based on user-defined functions. Background Technology

[0002] In enterprise information systems, databases serve as core assets, carrying a large amount of high-value data, encompassing sensitive information such as customer privacy, financial information, and business logic. If this data is leaked or tampered with, it can not only lead to economic losses for the enterprise but also trigger a chain reaction of legal disputes and reputational crises. Therefore, encrypting and protecting critical data in enterprise databases has become one of the core means of ensuring information security.

[0003] Currently, the industry widely adopts the following technologies to achieve transparent encryption and decryption functions for databases: 1. Transparent encryption and decryption schemes based on JDBC driver replacement: By replacing the application's database driver, the encryption and decryption logic is implemented at the driver layer, transparently encrypting and decrypting the communication traffic between the application and the database. 2. Encryption schemes based on proxy gateways: A proxy gateway is deployed between the application and the database to parse the database communication protocol and modify the traffic content to achieve data encryption and decryption. 3. Encryption schemes based on deep modification of the application system: Data encryption and decryption logic is implemented by modifying business code or database stored procedures. While the above schemes can achieve basic encryption functions, they have significant shortcomings in terms of compatibility with complex queries, adaptability to multi-brand databases, performance overhead, and maintenance costs. For example, the encryption coverage is limited; transparent encryption schemes based on JDBC drivers and proxy gateways cannot handle data generated internally by the database. Because new data is generated internally by the database and does not pass through the driver or proxy layer, the encryption logic fails, creating a data security blind spot. Significant performance bottlenecks exist because JDBC-based proxy and proxy gateway technologies require parsing and caching large amounts of response data for encryption / decryption operations. This is particularly problematic under high concurrency, where the decryption logic can easily become a single point of performance bottleneck. Reducing implementation complexity and development difficulty is crucial. Existing technologies (such as JDBC-based proxy and proxy gateway) require bidirectional parsing of communication traffic (uplink and downlink), which is extremely difficult, especially for the downlink protocol of closed-source databases. Furthermore, caching large amounts of response data for encryption / decryption operations results in high development and maintenance costs.

[0004] As can be seen from the above, how to improve the encryption coverage, avoid creating blind spots in data security, and reduce performance loss during the database encryption process is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a database encryption and decryption method, apparatus, device, and medium based on user-defined functions, which can improve the encryption coverage during database encryption, avoid data security blind spots, and reduce performance loss. The specific solution is as follows: Firstly, this application provides a database encryption / decryption method based on user-defined functions, applied to a proxy layer, including: Obtain the initial SQL statement sent by the client, and parse the initial SQL statement to extract the database information, table information and field information in the initial SQL statement; An encryption strategy matching engine is used to perform encryption strategy matching based on the field information. If the field information is successfully matched, the initial SQL statement is modified using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain the modified SQL statement. The preset UDF function includes a preset UDF encryption function and a preset UDF decryption function. The modified SQL statement is sent to the database so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data and return the execution result to the client; the target data includes the plaintext data to be encrypted in the initial SQL statement and the encrypted data stored in the database.

[0006] Optionally, if the initial SQL statement is of type data write, the step of modifying the initial SQL statement using a preset UDF function based on the matching result and the type of the initial SQL statement to obtain the modified SQL statement includes: Based on the matching results, the sensitive fields in the initial SQL statement are determined, and the plaintext data of the sensitive fields is wrapped using a preset UDF encryption function to obtain the modified SQL statement.

[0007] Optionally, if the initial SQL statement is of type data write, the database calls the preset UDF function based on the modified SQL statement to perform corresponding encryption / decryption operations on the target data, including: The database calls the preset UDF encryption function based on the modified SQL statement to encrypt the plaintext data to obtain the corresponding encrypted data, and persists the encrypted data to the preset storage space in the database.

[0008] Optionally, if the initial SQL statement is of the data query type, modifying the initial SQL statement using a preset UDF function to obtain a modified SQL statement includes: Based on the matching results, the encrypted fields in the initial SQL statement are determined, and the encrypted fields are wrapped using a preset UDF decryption function to obtain the modified SQL statement.

[0009] Optionally, if the initial SQL statement is a data query type, the database calls the preset UDF function based on the modified SQL statement to perform corresponding encryption / decryption operations on the target data, including: The database calls the preset UDF decryption function based on the modified SQL statement to decrypt the data stored in the database corresponding to the encrypted field, so as to obtain the corresponding decrypted data, and assembles the decrypted data into a query response.

[0010] Optionally, the preset encryption strategy is a field-level encryption strategy that supports dynamic configuration and updates.

[0011] Optionally, obtaining the initial SQL statement sent by the client includes: The text content of the initial SQL statement is obtained by parsing the application layer data in the database communication protocol.

[0012] Secondly, this application provides a database encryption / decryption device based on user-defined functions, comprising: The SQL statement acquisition module is used to acquire the initial SQL statement sent by the client and parse the initial SQL statement to extract the database information, table information and field information in the initial SQL statement; The SQL statement adjustment module is used to perform encryption strategy matching based on the field information using a preset strategy matching engine. If the field information is successfully matched, the initial SQL statement is modified using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain the modified SQL statement. The preset UDF function includes a preset UDF encryption function and a preset UDF decryption function. The SQL statement execution module is used to send the modified SQL statement to the database, so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data, and return the execution result to the client; the target data includes the plaintext data to be encrypted in the initial SQL statement and the encrypted data stored in the database.

[0013] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned database encryption and decryption method based on user-defined functions.

[0014] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned database encryption / decryption method based on user-defined functions.

[0015] This application provides a database encryption / decryption method based on user-defined functions. The method involves obtaining an initial SQL statement sent by a client and parsing it to extract database information, table information, and field information. A preset strategy matching engine is used to perform encryption strategy matching based on the field information. If the field information matches successfully, the initial SQL statement is modified using a preset UDF function based on the matching result and the type of the initial SQL statement to obtain a modified SQL statement. The preset UDF function includes a preset UDF encryption function and a preset UDF decryption function. The modified SQL statement is then sent to the database, allowing the database to call the preset UDF function based on the modified SQL statement to perform corresponding operations and return the execution result to the client.

[0016] As can be seen from the above, this application achieves full-coverage encryption for data operations, including various complex statements, by parsing and modifying SQL statements at the proxy layer and executing the encryption / decryption logic internally within the database via UDF functions. This eliminates data security blind spots in traditional solutions. Simultaneously, since the proxy layer only needs to process the upstream SQL statements without parsing the downstream result set protocol returned by the database, it significantly reduces dependence on closed-source database protocols and the complexity of system development and maintenance, while also reducing network transmission and data caching overhead. This improves overall system performance while ensuring business transparency. Therefore, it can increase encryption coverage during database encryption, avoid creating data security blind spots, and reduce performance loss. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 This is a flowchart of a database encryption / decryption method based on user-defined functions disclosed in this invention; Figure 2 This is a timing diagram of a database encryption method based on user-defined functions disclosed in this invention; Figure 3This is a timing diagram of a database decryption method based on user-defined functions disclosed in this invention; Figure 4 This is a schematic diagram of a database encryption / decryption device based on user-defined functions disclosed in this invention; Figure 5 This is a structural diagram of an electronic device disclosed in this invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] In enterprise information systems, databases, as core assets, carry a large amount of high-value data, covering sensitive content such as customer privacy, financial information, and business logic. If this data is leaked or tampered with, it can not only lead to economic losses for the enterprise but also trigger a chain reaction of legal disputes and reputational crises. Therefore, encrypting and protecting critical data in enterprise databases has become one of the core means of ensuring information security. Currently, the industry widely uses the following technologies to achieve transparent encryption and decryption functions for databases: transparent encryption and decryption schemes based on JDBC driver replacement, encryption schemes based on proxy gateways, and encryption schemes based on deep modification of application systems. While these schemes can achieve basic encryption functions, they all have significant shortcomings in terms of compatibility with complex queries, adaptability to multi-brand databases, performance overhead, and maintenance costs. For example, the encryption coverage is limited; without passing through a driver or proxy layer, the encryption logic may fail, creating a data security blind spot; performance bottlenecks are significant, especially under high concurrency, where the decryption logic can easily become a single point of performance bottleneck; and development and maintenance costs are high. Therefore, this application provides a database encryption and decryption scheme based on user-defined functions, which can improve the encryption coverage during the database encryption process, avoid creating data security blind spots, and reduce performance losses.

[0021] See Figure 1 As shown in the figure, this application discloses a database encryption / decryption method based on user-defined functions, including: Step S11: Obtain the initial SQL statement sent by the client, and parse the initial SQL statement to extract the database information, table information and field information in the initial SQL statement.

[0022] In this embodiment, a two-tier architecture system employing a proxy layer and a database UDF module in collaboration is used for database encryption and decryption. See also Figure 2As shown, the system includes a client application, a proxy layer, and a database server. The database server has a pre-built UDF encryption / decryption module, which is integrated into the database engine as a plugin, providing specific implementations of encryption functions (such as encrypt()) and decryption functions (such as decrypt()). The proxy layer is deployed as an independent service, primarily used for protocol parsing, policy matching, and SQL rewriting.

[0023] In this embodiment, the proxy layer is deployed in the communication link between the client and the database server to intercept and parse database requests initiated by the client. Specifically, obtaining the initial SQL statement sent by the client may include: obtaining the text content of the initial SQL statement by parsing application-layer data in the database communication protocol (e.g., MySQL, PostgreSQL, etc.). After extracting the text, the proxy layer parses the statement to identify the operation type (e.g., SELECT, INSERT, UPDATE, CREATE TABLE AS SELECT, etc.), the target database name, the table name, and the specific field names involved.

[0024] It's worth noting that the proxy layer's parsing process only targets uplink network traffic from the client to the database server, aiming to extract SQL command text, without needing to perform protocol parsing or data decryption on downlink traffic returned by the database server (such as query result sets). This significantly reduces the difficulty of reverse engineering closed-source database protocols and the overall development complexity.

[0025] Step S12: Use a preset strategy matching engine to perform encryption strategy matching based on the field information. If the field information is successfully matched, modify the initial SQL statement using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain the modified SQL statement.

[0026] In this embodiment, the preset UDF functions include preset UDF encryption functions (such as encrypt()) and preset UDF decryption functions (such as decrypt()). These preset UDF functions need to be defined and registered in advance in the UDF module of the database server. The preset encryption strategy is a field-level encryption strategy, for example, it can be configured as "the id_card field of the user table in database db1 needs to be encrypted." This strategy supports dynamic configuration and updates and takes effect without restarting the service.

[0027] Furthermore, for different types of initial SQL statements, it is necessary to select and modify the corresponding preset UDF functions. For details, see [link to relevant documentation]. Figure 2As shown, if the type of the initial SQL statement is a data writing type (such as INSERT, UPDATE, and complex statements like CREATE TABLE AS SELECT FROM..., INSERT INTO... SELECT... etc. that generate data internally by the database), modifying the initial SQL statement using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain a modified SQL statement may include: determining sensitive fields in the initial SQL statement based on the matching result, and wrapping the plaintext data of the sensitive fields with a preset UDF encryption function to obtain a modified SQL statement. For example, the original insert statement is INSERT INTO user (name, id_card) VALUES ('张三', '510123199001011234'). If the policy matches that the id_card field needs to be encrypted, it is rewritten as INSERT INTO user (name, id_card) VALUES ('张三', encrypt('510123199001011234')); for the complex original statement CREATE TABLE user_backup AS SELECT FROM user, when the proxy layer recognizes that the id_card field in SELECT needs to be encrypted, it can be rewritten as CREATE TABLE user_backup AS SELECT name, encrypt(id_card) AS id_card FROM user (assuming that id_card is already encrypted in the source table, this is a schematic logic; if the source table is in plaintext, this operation encrypts the data in the new table), thus eliminating the encryption blind spot of the traditional solution for such statements. See Figure 3 As shown, if the type of the initial SQL statement is a data query type (such as SELECT), modifying the initial SQL statement using a preset UDF function to obtain a modified SQL statement may include: determining encrypted fields in the initial SQL statement based on the matching result, and wrapping the encrypted fields with a preset UDF decryption function to obtain a modified SQL statement. For example, the original query statement is SELECT name, id_card FROM user WHERE age > 18. If the policy matches that the id_card field is already encrypted, it is rewritten as SELECT name, decrypt(id_card) AS id_card FROM user WHERE age > 18.

[0028] Step S13: Send the modified SQL statement to the database so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data, and return the execution result to the client.

[0029] In this embodiment, the target data includes the plaintext data to be encrypted in the initial SQL statement and the encrypted data stored in the database, which needs to be determined based on the type of the initial SQL statement. Specifically, see [link to documentation]. Figure 2 As shown, if the initial SQL statement is of the data write type, the database calls the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data. This may include: the database server parses and executes the received modified SQL statement; when the `encrypt()` function is executed, its internal UDF encryption function is called to encrypt the passed plaintext parameter (e.g., '510123199001011234') using a pre-configured key and algorithm; and then the resulting ciphertext data is persistently stored in a specified field (e.g., `id_card`) of the target table. The encryption process is completed internally within the database engine using the database's own computing resources. See also... Figure 3 As shown, if the initial SQL statement is of the data query type, the database calls the preset UDF function to perform corresponding encryption and decryption operations on the target data based on the modified SQL statement. This may include: the database server executes the modified query statement, and when it processes the decrypt() function, it calls its internal UDF decryption function to read the ciphertext data of the corresponding field (e.g., id_card) from the storage, performs decryption operations, recovers the plaintext data, and uses the plaintext data as the value of the corresponding field (e.g., id_card) column, and assembles it together with other column data into a query result set.

[0030] Furthermore, the database server returns the execution results to the client. It's important to note that for write operations, the database server returns the execution status in plaintext to the client. For query operations, the database server returns a result set containing the decrypted plaintext data to the client. The proxy layer only needs to pass this result set to the client; it doesn't need to perform any decryption or parse the downlink result set protocol itself, thus avoiding the performance bottlenecks and complex logic of traditional proxy gateway solutions at this point.

[0031] As can be seen from the above, this application's embodiment achieves transparent field-level encryption and decryption of all SQL statements, including internal database operations, through a two-layer collaborative mechanism of "proxy layer SQL parsing and rewriting" and "internal database UDF execution," completely resolving the industry pain point of incomplete encryption coverage. Simultaneously, by offloading core encryption and decryption calculations to the database and avoiding proxy layer processing of downlink protocols and data, system performance overhead and development / maintenance complexity are significantly reduced, achieving a balance between security and efficiency.

[0032] See Figure 4 As shown in the figure, this application discloses a database encryption / decryption device based on user-defined functions, including: The SQL statement acquisition module 11 is used to acquire the initial SQL statement sent by the client and parse the initial SQL statement to extract the database information, table information and field information in the initial SQL statement.

[0033] The SQL statement adjustment module 12 is used to perform encryption strategy matching based on the field information using a preset strategy matching engine. If the field information is successfully matched, the initial SQL statement is modified using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain the modified SQL statement. The preset UDF function includes a preset UDF encryption function and a preset UDF decryption function. The preset encryption strategy is a field-level encryption strategy that supports dynamic configuration and updates.

[0034] SQL statement execution module 13 is used to send the modified SQL statement to the database, so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data, and return the execution result to the client; the target data includes the plaintext data to be encrypted in the initial SQL statement and the encrypted data stored in the database.

[0035] In some specific embodiments, the SQL statement acquisition module 11 may specifically include: The SQL statement parsing unit is used to obtain the text content of the initial SQL statement by parsing application layer data in the database communication protocol.

[0036] In some specific implementations, the SQL statement adjustment module 12 may specifically include: The first SQL statement adjustment unit is used to determine the sensitive fields in the initial SQL statement based on the matching result if the type of the initial SQL statement is data writing type, and to wrap the plaintext data of the sensitive fields with a preset UDF encryption function to obtain the modified SQL statement. The second SQL statement adjustment unit is used to determine the encrypted fields in the initial SQL statement based on the matching result if the type of the initial SQL statement is a data query type, and to wrap the encrypted fields with a preset UDF decryption function to obtain the modified SQL statement.

[0037] In some specific implementations, the SQL statement execution module 13 may specifically include: The first SQL statement execution unit is used to, if the type of the initial SQL statement is data write type, call the preset UDF encryption function based on the modified SQL statement to encrypt the plaintext data to obtain the corresponding encrypted data, and persistently store the encrypted data in the preset storage space in the database. The second SQL statement execution unit is used to, if the type of the initial SQL statement is a data query type, call the preset UDF decryption function based on the modified SQL statement to decrypt the data stored in the database corresponding to the encrypted field, so as to obtain the corresponding decrypted data, and assemble the decrypted data into a query response.

[0038] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the database encryption / decryption method based on user-defined functions disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0039] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0040] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0041] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the database encryption / decryption method based on user-defined functions executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0042] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned database encryption / decryption method based on user-defined functions. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0043] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0044] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0045] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0046] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0047] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A database encryption / decryption method based on user-defined functions, characterized in that, Applied to the proxy layer, including: Obtain the initial SQL statement sent by the client, and parse the initial SQL statement to extract the database information, table information and field information in the initial SQL statement; An encryption strategy matching engine is used to perform encryption strategy matching based on the field information. If the field information is successfully matched, the initial SQL statement is modified using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain the modified SQL statement. The preset UDF function includes a preset UDF encryption function and a preset UDF decryption function. The modified SQL statement is sent to the database so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data and return the execution result to the client; the target data includes the plaintext data to be encrypted in the initial SQL statement and the encrypted data stored in the database.

2. The database encryption / decryption method based on user-defined functions according to claim 1, characterized in that, If the initial SQL statement is of type data write, the modification of the initial SQL statement using a preset UDF function based on the matching result and the type of the initial SQL statement to obtain the modified SQL statement includes: Based on the matching results, the sensitive fields in the initial SQL statement are determined, and the plaintext data of the sensitive fields is wrapped using a preset UDF encryption function to obtain the modified SQL statement.

3. The database encryption / decryption method based on user-defined functions according to claim 2, characterized in that, If the initial SQL statement is of type data write, the database calls the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data, including: The database calls the preset UDF encryption function based on the modified SQL statement to encrypt the plaintext data to obtain the corresponding encrypted data, and persists the encrypted data to the preset storage space in the database.

4. The database encryption / decryption method based on user-defined functions according to claim 1, characterized in that, If the initial SQL statement is of the data query type, the modification of the initial SQL statement using a preset UDF function to obtain the modified SQL statement includes: Based on the matching results, the encrypted fields in the initial SQL statement are determined, and the encrypted fields are wrapped using a preset UDF decryption function to obtain the modified SQL statement.

5. The database encryption / decryption method based on user-defined functions according to claim 4, characterized in that, If the initial SQL statement is a data query type, the database calls the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data, including: The database calls the preset UDF decryption function based on the modified SQL statement to decrypt the data stored in the database corresponding to the encrypted field, so as to obtain the corresponding decrypted data, and assembles the decrypted data into a query response.

6. The database encryption / decryption method based on user-defined functions according to claim 1, characterized in that, The preset encryption strategy is a field-level encryption strategy that supports dynamic configuration and updates.

7. The database encryption / decryption method based on user-defined functions according to any one of claims 1 to 6, characterized in that, The step of obtaining the initial SQL statement sent by the client includes: The text content of the initial SQL statement is obtained by parsing the application layer data in the database communication protocol.

8. A database encryption / decryption device based on user-defined functions, characterized in that, include: The SQL statement acquisition module is used to acquire the initial SQL statement sent by the client and parse the initial SQL statement to extract the database information, table information and field information in the initial SQL statement; The SQL statement adjustment module is used to perform encryption strategy matching based on the field information using a preset strategy matching engine. If the field information is successfully matched, the initial SQL statement is modified using a preset UDF function according to the matching result and the type of the initial SQL statement to obtain the modified SQL statement. The preset UDF function includes a preset UDF encryption function and a preset UDF decryption function. The SQL statement execution module is used to send the modified SQL statement to the database, so that the database can call the preset UDF function based on the modified SQL statement to perform corresponding encryption and decryption operations on the target data, and return the execution result to the client; the target data includes the plaintext data to be encrypted in the initial SQL statement and the encrypted data stored in the database.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the database encryption / decryption method based on user-defined functions as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, wherein the computer programs, when executed by a processor, implement the database encryption and decryption method based on user-defined functions as described in any one of claims 1 to 7.

Images