A method for automatically encrypting and decrypting sensitive data based on configuration

Abstract

The present application relates to the technical field of data security processing, and discloses a method for automatically encrypting and decrypting sensitive data based on configuration, which comprises the following steps: obtaining a sensitive field configuration set, splitting and matching a database column name, an object attribute name and a field data type, establishing a field identification mapping relationship, and making the database field and the object attribute form a corresponding basis; then analyzing an SQL abstract syntax tree, determining a parameter field corresponding relationship according to a semantic node, correcting the parameter field corresponding relationship according to the field identification mapping relationship when a precompiled statement object parameter is written, obtaining a ciphertext field identification and a ciphertext data type, and making the sensitive field encryption position adjustable with the SQL structure; and determining a field to be decrypted and restoring a plaintext value according to a result set column label, an object attribute mapping, a ciphertext data type and a ciphertext field identification, so as to reduce the parameter field identification deviation and improve the ciphertext return consistency.

Description

Technical Field

[0001] This invention relates to the field of data security processing technology, and more specifically, to a configuration-based method for automatic encryption and decryption of sensitive data. Background Technology

[0002] In enterprise-level information systems, database access processes typically require the storage protection of sensitive fields such as mobile phone numbers, ID card numbers, and bank card numbers, while maintaining the availability of these fields during business reads. Existing technologies often employ methods such as field configuration judgment, business layer encryption and decryption encapsulation, persistence layer interception processing, and result field conversion to achieve sensitive data protection. These methods are generally suitable for access scenarios where the source of fields is clear, the semantics of parameters are stable, and the query return structure is fixed.

[0003] In database write scenarios based on placeholder parameters, the correspondence between parameter numbers and field identifiers changes with the statement type and field arrangement. In query return scenarios, the mapping between column name identifiers of encrypted fields and business objects also changes with the result structure. These factors can cause deviations between field configuration determination and parameter write positions, and lead to inconsistencies in the recovery of encrypted results when returned to the business layer, thus affecting the bidirectional automatic protection of sensitive fields. Therefore, the technical problem that needs to be solved is how to ensure bidirectional automatic protection of sensitive fields while reducing parameter field identification deviations and enhancing the consistency of encrypted return.

[0004] In view of this, the present invention proposes a configuration-based method for automatic encryption and decryption of sensitive data to solve the above problems. Summary of the Invention

[0005] To overcome the aforementioned shortcomings of the prior art, the present invention provides a configuration-based method for automatic encryption and decryption of sensitive data.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A configuration-based method for automatically encrypting and decrypting sensitive data is provided, including: Obtain the sensitive field configuration set, split the database column names into column name character fields by underscores, split the object attribute names into attribute character fields by camelCase boundaries, and establish field identifier mapping relationships based on column name character fields, attribute character fields, and field data types. The sensitive field configuration set includes database column names, object attribute names, and field data types. Parse the SQL statement to be executed to obtain the SQL abstract syntax tree, read the semantic node to which the SQL abstract syntax tree belongs, and obtain the correspondence between parameter fields based on the semantic node to which the tree belongs; When writing parameters to the precompiled statement object, the correspondence between parameter fields is corrected according to the field identifier mapping relationship to obtain the ciphertext field identifier and ciphertext data type. Obtain the column labels and object attribute mappings of the result set. Determine the fields to be decrypted based on the column labels, object attribute mappings, ciphertext data types, and ciphertext field identifiers. Determine the plaintext values ​​based on the fields to be decrypted.

[0007] In some embodiments, a field identifier mapping relationship is established based on the column name field, attribute field, and field data type, including: Write the database column name, object property name, and field data type from the same configuration item into the configuration field record; Split the database column names in the configuration field records into column name fields using underscores, and split the object attribute names in the configuration field records into attribute fields using camelCase boundaries. Create a field concatenation record based on the order of the column name field and attribute field in the configuration field record; Establish a field identifier mapping relationship based on the character field connection record and the field data type.

[0008] In some embodiments, a field concatenation record is established based on the order of the column name field and the attribute field in the configuration field record, including: Read the column name field and attribute field from the configuration field record, and write the column name field's position relative to the database column name into the column name position record; Write the position of the attribute character field relative to the object attribute name into the attribute character position record, and associate the column name character position record with the attribute character position record and store them in a temporary association record; By connecting the column name character position record and the attribute character position record in the temporary associated record with the same arrangement position, a character segment connection record is obtained.

[0009] In some embodiments, the semantic node of the SQL abstract syntax tree is read, and the correspondence between parameter fields is obtained based on the semantic node, including: Read the placeholder parameter nodes in the SQL abstract syntax tree and write the order in which the placeholder parameter nodes appear in the SQL statement to be executed into the parameter sequence number record; Read the semantic node along the connection between the placeholder parameter node and the parent node, and write the node type of the semantic node into the semantic node record; Extract the field identifier based on the node type of the semantic node to obtain the placeholder parameter field record; By associating the parameter sequence number record, semantic node record, and placeholder parameter field record according to the placeholder parameter node, the corresponding relationship of the parameter fields can be obtained.

[0010] In some embodiments, the field identifier is extracted based on the node type of the semantic node to obtain the placeholder parameter field record, including: Read the node types in the semantic node records and assign the insert field nodes, update assignment nodes, equality condition nodes and IN list nodes to different read branches; In the read branch corresponding to the inserted field node, the list of inserted fields and the list of inserted values ​​are read. The placeholder parameter nodes in the list of inserted values ​​are associated with the inserted fields in the same arrangement position to obtain the inserted field records. In the read branches corresponding to the update assignment node and the equivalence condition node, the left-hand field item of the update assignment node and the field item in the equivalence condition node that is opposite to the placeholder parameter node are read respectively to obtain the assignment condition field record. In the read branch corresponding to the IN list node, read the left-hand field items in the IN list node, and associate the left-hand field items with each placeholder parameter node in the IN list node to obtain the IN list field records; Write the inserted field record, assignment condition field record, and IN list field record into the corresponding placeholder parameter node to obtain the placeholder parameter field record.

[0011] In some embodiments, the left-hand field items in the IN list node are read, and the left-hand field items are associated with each placeholder parameter node in the IN list node to obtain the IN list field records, including: Read the left-hand field items in the IN list node, and read the order in which each placeholder parameter node in the IN list node appears in the SQL statement to be executed; Generate parameter numbers according to the order in which each placeholder parameter node appears in the SQL statement to be executed, and write the parameter numbers into the IN list parameter record; Write the left-hand field items into the field identifier position corresponding to each parameter number in the IN list parameter record, and retain the association between the IN list node and the parameter number; Write the parameter sequence number, the left-hand field item, and the association between the IN list node into the same record to obtain the IN list field record.

[0012] In some embodiments, the parameter field correspondence is corrected according to the field identifier mapping relationship to obtain the ciphertext field identifier and the ciphertext data type, including: Read the parameters of the precompiled statement object and write them into the call information. Then, write the parameter sequence number and parameter value in the call information into the parameter writing record. Read the field identifier from the parameter field correspondence based on the parameter sequence number, and write the field identifier, parameter sequence number and parameter value into the record of the field to be corrected; Based on the field identifier mapping relationship, the field identifiers in the record of the field to be corrected are corrected to obtain the corrected field record; The field identifier in the corrected field record is identified as the ciphertext field identifier, and the field data type in the corrected field record is identified as the ciphertext data type, thus obtaining the ciphertext field identifier and the ciphertext data type.

[0013] In some embodiments, the field identifiers in the record to be corrected are corrected according to the field identifier mapping relationship to obtain the corrected field record, including: Read the field identifier from the record of the field to be corrected, split the field identifier into the character field of the field to be corrected, and read the parameter sequence number from the record of the field to be corrected; Read the mapping item containing the character field of the field to be corrected from the field identifier mapping relationship, and write the database column name, object attribute name and field data type in the mapping item into the candidate correction record; Based on the field identifier mapping relationship, the database column name or object attribute name in the candidate correction record is converted into the corresponding encrypted field identifier, and the encrypted field identifier, field data type and parameter sequence number are mapped and assembled to obtain the correction field record.

[0014] In some embodiments, the field to be decrypted is determined based on the result set column labels, object attribute mapping, ciphertext data type, and ciphertext field identifier, including: Read the result set column labels and object attribute mappings, and write the object attribute names from the result set column labels and object attribute mappings into the returned field records; Split the column labels of the result set into the column name field by underscores, and split the object property names into the property field by camelCase boundaries; Match the corresponding encrypted field identifiers based on the column labels and object attribute mappings in the result set, and read the column name field and attribute field corresponding to the encrypted field identifiers. Then, write the returned column name field, returned attribute field, and encrypted data type into the field record to be verified. Based on the correspondence between the returned column name character field and the column name character field corresponding to the ciphertext field identifier in the field to be verified, and the correspondence between the returned attribute character field and the attribute character field corresponding to the ciphertext field identifier, the field to be decrypted is obtained.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention obtains a set of sensitive field configurations, splits database column names into column name segments by underscores, and splits object attribute names into attribute segments by camelCase boundaries. It then establishes a field identifier mapping relationship based on field data types, creating a correspondence between database fields and object attributes. Next, it parses the SQL statement to be executed to obtain an SQL abstract syntax tree, and determines the parameter field correspondence based on the semantic nodes, establishing an association between parameter numbers and actual fields. When writing object parameters in the pre-compiled statement, it corrects the parameter field correspondence based on the field identifier mapping relationship, obtaining ciphertext field identifiers and ciphertext data types, allowing the encryption position of sensitive fields to be adjusted according to changes in the SQL structure. Simultaneously, it determines the fields to be decrypted based on the result set column labels, object attribute mapping, ciphertext data types, and ciphertext field identifiers, and restores the plaintext values, thereby reducing parameter field identification bias, improving ciphertext return consistency, and achieving bidirectional automatic protection of sensitive fields. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the automatic encryption and decryption method for sensitive data based on configuration in this invention. Figure 2 This is a schematic diagram of the process for generating the correspondence between parameter fields based on the SQL abstract syntax tree in this invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. In the following detailed description, many specific details are set forth to provide a thorough understanding of the exemplary embodiments described. However, it will be apparent to those skilled in the art that the described embodiments may be practiced without some or all of these specific details. In other exemplary embodiments, well-known structures have not been described in detail to avoid unnecessarily obscuring the concepts of this disclosure. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention. Furthermore, the various aspects described in the embodiments may be combined arbitrarily without conflict.

[0018] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0019] Figure 1 This disclosure illustrates at least one embodiment of a configuration-based automatic encryption / decryption method for sensitive data, including: S10: Obtain the sensitive field configuration set, split the database column name into column name character field by underscore, split the object attribute name into attribute character field by camelCase boundary, establish field identifier mapping relationship based on column name character field, attribute character field and field data type, and the sensitive field configuration set includes database column name, object attribute name and field data type; In this embodiment, the sensitive field configuration set refers to the field configuration set loaded during system operation. The sensitive field configuration set is used to record the database column names, object attribute names, and field data types that need to be encrypted or decrypted. The database column name is the physical column identifier of the field in the database table, the object attribute name is the attribute identifier in the entity object, business object, or result mapping object, and the field data type is the data type that the field value is based on when the processor assigns it, such as the string type.

[0020] Understandably, in business systems built on Spring Boot and MyBatis-Plus, the sensitive field configuration set can be provided by Sm4SecretColumnConfig. The configuration items can include field identifiers such as contacts_phone, id_card, card_no, contactsPhone, and phone. Since contacts_phone and contactsPhone may correspond to the same contact phone number field, and id_card and idCard in the entity object may correspond to the same ID card number field, relying solely on the complete field string for matching can easily lead to database column names and object attribute names being identified as different fields.

[0021] It should be noted that splitting database column names into column name fields by underscores is to separate contacts_phone into comparable field fragments such as contacts and phone. Similarly, splitting object attribute names into attribute fields by camelCase boundaries is to separate contactsPhone into comparable field fragments such as contacts and phone. By establishing a field identification mapping relationship through column name fields, attribute fields, and field data types, the same sensitive fields can be identified consistently during subsequent parameter writing and result return stages, avoiding field identification errors caused by differences in database naming conventions and object naming conventions.

[0022] Establish field identifier mapping relationships based on column name field, attribute field, and field data type, including: Write the database column name, object property name, and field data type from the same configuration item into the configuration field record; Split the database column names in the configuration field records into column name fields using underscores, and split the object attribute names in the configuration field records into attribute fields using camelCase boundaries. Create a field concatenation record based on the order of the column name field and attribute field in the configuration field record; Establish a field identifier mapping relationship based on the character field connection record and the field data type.

[0023] Furthermore, a configuration field record refers to an intermediate record that carries the database column name, object attribute name, and field data type of the same configuration item. Configuration field records ensure that the expression of the same sensitive field on the database side, object side, and type side is within the same data carrier. For example, for the contact phone number field, the database column name contacts_phone, the object attribute name contactsPhone, and the string type can be written into the same configuration field record; for the ID card number field, the database column name id_card, the object attribute name idCard, and the string type can be written into the same configuration field record.

[0024] In this embodiment, after the configuration field record is generated, the system splits the database column name and object attribute name in the configuration field record respectively. Taking contacts_phone and contactsPhone as examples, contacts_phone is split into contacts and phone, and contactsPhone is split into contacts and phone; taking card_no and cardNo as examples, card_no is split into card and no, and cardNo is split into card and no. The column name field and attribute field obtained after splitting no longer depend on the original naming form, but are transformed into field that can be connected according to the order of arrangement.

[0025] Understandably, the character field concatenation record is used to record the correspondence between column name character fields and attribute character fields. The field data type is used to prevent different fields from being incorrectly merged when their character field expressions are similar. For example, under the same string type, contacts correspond to contacts, phone corresponds to phone, and a field identifier mapping relationship can be established for the contact's mobile phone number; card corresponds to card, no corresponds to no, and a field identifier mapping relationship can be established for the bank card number. Thus, the field identifier mapping relationship includes both the field character structure and the field data type, so that subsequent write encryption and query decryption can call the same field identification basis.

[0026] Create a field concatenation record based on the order of the column name field and attribute field in the configuration field record, including: Read the column name field and attribute field from the configuration field record, and write the column name field's position relative to the database column name into the column name position record; Write the position of the attribute character field relative to the object attribute name into the attribute character position record, and associate the column name character position record with the attribute character position record and store them in a temporary association record; By connecting the column name character position record and the attribute character position record in the temporary associated record with the same arrangement position, a character segment connection record is obtained.

[0027] It should be noted that the column name character position record is used to indicate the position of the column name character field in the database column name, the attribute character position record is used to indicate the position of the attribute character field in the object attribute name, and the temporary association record is used to temporarily store the association between the column name character position record and the attribute character position record. Taking contacts_phone and contactsPhone as examples, in the column name character position record, contacts is in the first position and phone is in the second position, and in the attribute character position record, contacts is in the first position and phone is in the second position.

[0028] Furthermore, the system connects the column name character position records and attribute character position records in the temporary association records based on the same arrangement position, to obtain the character segment connection records for contacts corresponding to contacts and phone corresponding to phone. Through these character segment connection records, the database column name contacts_phone and the object attribute name contactsPhone can be included in the same field identification mapping relationship; similarly, the database column name id_card and the object attribute name idCard, and the database column name card_no and the object attribute name cardNo can also establish a correspondence based on the character segment arrangement position and field data type.

[0029] S20: Parse the SQL statement to be executed to obtain the SQL abstract syntax tree, read the semantic node to which the SQL abstract syntax tree belongs, and obtain the correspondence between parameter fields based on the semantic node to which the tree belongs; In this embodiment, the SQL statement to be executed refers to the SQL text generated by the MyBatis persistence layer before performing database access. The semantic node refers to the node in the SQL abstract syntax tree that has a connection relationship with the placeholder parameter node and can represent the SQL semantic position of the placeholder parameter. Since the placeholder parameters in the pre-compiled SQL usually only represent the parameter position and do not directly carry the database column name, MyBatis can intercept the setParameters method of ParameterHandler to read the SQL statement to be executed in BoundSql before executing the parameter binding, and parse the SQL statement to be executed into an SQL abstract syntax tree.

[0030] Understandably, the SQL Abstract Syntax Tree (ASST) can decompose INSERT, UPDATE, ALTER TABLE, and IN clause queries into semantically hierarchical node structures. This allows placeholder parameters to no longer exist merely as isolated question mark parameters. For example, in an INSERT statement, placeholder parameters correspond to the order of the INSERT field list; in an UPDATE statement, they correspond to the left-hand fields in the UPDATE assignment node; in an ALTER TABLE query, they correspond to the relative field fields; and in an IN clause query, multiple placeholder parameters correspond to the left-hand fields in the IN list node. By reading the semantic nodes of the SQL ASST, the parameter field correspondences can be obtained before the parameters are written, providing a basis for subsequently correcting the parameter field correspondences and determining the ciphertext field identifiers.

[0031] Read the semantic node of the SQL abstract syntax tree, and obtain the parameter field correspondence based on the semantic node, including: Read the placeholder parameter nodes in the SQL abstract syntax tree and write the order in which the placeholder parameter nodes appear in the SQL statement to be executed into the parameter sequence number record; Read the semantic node along the connection between the placeholder parameter node and the parent node, and write the node type of the semantic node into the semantic node record; Extract the field identifier based on the node type of the semantic node to obtain the placeholder parameter field record; By associating the parameter sequence number record, semantic node record, and placeholder parameter field record according to the placeholder parameter node, the corresponding relationship of the parameter fields can be obtained.

[0032] Furthermore, placeholder parameter nodes are nodes in the SQL abstract syntax tree used to represent the position of parameters to be bound. Parameter sequence number records are used to indicate the order in which placeholder parameters appear in the SQL statement to be executed. Semantic node records are used to indicate the type of the node to which the placeholder parameter node belongs. Placeholder parameter field records are used to indicate the correspondence between placeholder parameter nodes and field identifiers. When MyBatis uses prepared SQL to execute database access, the downstream parameter writing process is usually executed according to the parameter sequence number. Therefore, the parameter sequence number record needs to be stored together with the placeholder parameter field record to avoid the inability to determine the field identifier when the prepared statement object only receives the parameter sequence number.

[0033] It should be noted that the correspondence between parameter fields is not directly inferred from the field names of business objects, but is determined by the placeholder parameter node, the semantic node to which it belongs, and the parameter sequence number. For example, when the SQL statement writes the contact phone number contacts_phone to the member user table, the placeholder parameter node can be mapped to contacts_phone through the insert field node; when the SQL statement queries the member applicant table based on the phone number phone, the placeholder parameter node can be mapped to phone through the equality condition node. By associating the parameter sequence number record, the semantic node record, and the placeholder parameter field record by the placeholder parameter node, the field identifier corresponding to the current parameter can be determined based on the parameter sequence number in the subsequent parameter writing stage, thereby reducing parameter field identification errors.

[0034] Based on the node type of the semantic node, extract the field identifier to obtain the placeholder parameter field record, including: Read the node types in the semantic node records and assign the insert field nodes, update assignment nodes, equality condition nodes and IN list nodes to different read branches; In the read branch corresponding to the inserted field node, the list of inserted fields and the list of inserted values ​​are read. The placeholder parameter nodes in the list of inserted values ​​are associated with the inserted fields in the same arrangement position to obtain the inserted field records. In the read branches corresponding to the update assignment node and the equivalence condition node, the left-hand field item of the update assignment node and the field item in the equivalence condition node that is opposite to the placeholder parameter node are read respectively to obtain the assignment condition field record. In the read branch corresponding to the IN list node, read the left-hand field items in the IN list node, and associate the left-hand field items with each placeholder parameter node in the IN list node to obtain the IN list field records; Write the inserted field record, assignment condition field record, and IN list field record into the corresponding placeholder parameter node to obtain the placeholder parameter field record.

[0035] In this embodiment, different read branches are used to adapt to the connection method between placeholder parameters and field identifiers in different SQL statements. The read branch corresponding to the insert field node is suitable for insert statements, the read branch corresponding to the update assignment node is suitable for update statements, the read branch corresponding to the equality condition node is suitable for equality query conditions, and the read branch corresponding to the IN list node is suitable for list query conditions. Since the fields corresponding to placeholder parameters in the above statements are determined in different ways, if the same read method is used, it is easy to confuse the insert field, update field, and query condition field.

[0036] Furthermore, in insert statements, the list of inserted fields and the list of inserted values ​​are usually aligned by position, so placeholder parameter nodes in the list of inserted values ​​can be associated with the inserted fields in the same position. In update statements, placeholder parameters are usually located on the right side of the assignment expression, so the left-hand field items of the update assignment node can be read. In equality condition nodes, placeholder parameters and field items are located on both sides of the equality relationship, so the field items opposite to the placeholder parameter nodes can be read. In IN list nodes, multiple placeholder parameters correspond to the left-hand field items, so the same left-hand field item needs to be associated with each placeholder parameter node in the IN list node. The resulting placeholder parameter field records can cover MyBatis access scenarios such as insert, update, equality query, and IN query.

[0037] Optionally, in a membership business scenario, if the SQL statement to be executed is used to insert contacts_phone, id_card, or card_no into the member user table, the inserted field record can map different parameter numbers to the contact's mobile phone number, ID card number, or bank card number field, respectively. If the SQL statement to be executed is used to perform an equality query or IN list query based on phone, the assignment condition field record or IN list field record can map the query parameters to the phone field. By writing the inserted field record, assignment condition field record, and IN list field record into the corresponding placeholder parameter node, placeholder parameter field records can be generated, allowing subsequent field identifier mapping relationships to continue to correct the parameter field correspondence.

[0038] Read the left-hand field items from the IN list node, and associate each left-hand field item with a placeholder parameter node in the IN list node to obtain the IN list field records, including: Read the left-hand field items in the IN list node, and read the order in which each placeholder parameter node in the IN list node appears in the SQL statement to be executed; Generate parameter numbers according to the order in which each placeholder parameter node appears in the SQL statement to be executed, and write the parameter numbers into the IN list parameter record; Write the left-hand field items into the field identifier position corresponding to each parameter number in the IN list parameter record, and retain the association between the IN list node and the parameter number; Write the parameter sequence number, the left-hand field item, and the association between the IN list node into the same record to obtain the IN list field record.

[0039] It should be noted that the IN list node is used to represent query conditions where a field value belongs to multiple candidate parameters. The left-hand field items in the IN list node correspond to the same database column or field identifier. Each placeholder parameter node in the IN list node corresponds to multiple parameters to be bound. Unlike the equality condition node, the multiple placeholder parameters in the IN list node do not correspond to multiple different fields, but rather to the same left-hand field item in the IN list node. Therefore, the left-hand field items need to be written into the field identifier positions corresponding to the parameter numbers.

[0040] In this embodiment, taking the query of member applicant information by multiple mobile phone numbers as an example, the phonein(?,?,?) in the SQL statement can form an IN list node in the SQL abstract syntax tree, where phone is the left-hand field item. The three placeholder parameter nodes have different appearance orders. The system generates three parameter numbers according to the appearance order and writes phone into the field identifier position corresponding to the three parameter numbers, so that the three parameter numbers can be recognized as query parameters corresponding to the mobile phone number field.

[0041] Furthermore, by writing the association between the parameter sequence number, the left-hand field item, and the IN list node into the same record, the IN list field record can be obtained. This IN list field record retains the relationship between the same IN list node and multiple parameter sequences, which can avoid identifying only the first placeholder parameter or incorrectly assigning multiple placeholder parameters to different fields in list queries. This provides a stable parameter field basis for the subsequent determination of encrypted field identifiers and encrypted data types.

[0042] S30: When writing parameters to a precompiled statement object, the parameter field correspondence is corrected according to the field identifier mapping relationship to obtain the ciphertext field identifier and ciphertext data type. In this embodiment, the precompiled statement object refers to the statement object that carries the parameters to be bound during database access. When the parameter binding is performed in the MyBatis persistence layer, the downstream usually writes the parameter value into the precompiled statement object according to the parameter sequence number through setString, setObject or other parameter writing methods. Since the parameter writing call information usually directly exposes the parameter sequence number and parameter value, rather than the database column name or object property name, it is necessary to combine the aforementioned parameter field correspondence with the field identifier mapping relationship to correct the field identifier corresponding to the current parameter sequence number.

[0043] Understandably, the parameter field mapping relationship comes from the semantic node in the SQL abstract syntax tree, which can explain the field identifier corresponding to a certain parameter number in the SQL statement to be executed; the field identifier mapping relationship comes from the sensitive field configuration set, which can explain the correspondence between database column names, object attribute names and field data types. Combining the two, the field identifiers in the parameter field mapping relationship can be corrected to ciphertext field identifiers that can be used for encryption processing, and the ciphertext data type can be obtained simultaneously, thus providing a basis for subsequent selection of string type processors, invocation of SM4 encryption logic and writing of ciphertext parameters into the database.

[0044] Based on the field identifier mapping relationship, the parameter field correspondence is corrected to obtain the ciphertext field identifier and ciphertext data type, including: Read the parameters of the precompiled statement object and write them into the call information. Then, write the parameter sequence number and parameter value in the call information into the parameter writing record. Read the field identifier from the parameter field correspondence based on the parameter sequence number, and write the field identifier, parameter sequence number and parameter value into the record of the field to be corrected; Based on the field identifier mapping relationship, the field identifiers in the record of the field to be corrected are corrected to obtain the corrected field record; The field identifier in the corrected field record is identified as the ciphertext field identifier, and the field data type in the corrected field record is identified as the ciphertext data type, thus obtaining the ciphertext field identifier and the ciphertext data type.

[0045] Furthermore, the parameter write record is used to store the parameter sequence number and parameter value provided by the precompiled statement object when writing parameters. The field to be corrected record is used to put the parameter sequence number, parameter value, and field identifier read from the parameter field correspondence into the same processing record. Taking writing the contact's mobile phone number in the member user table as an example, if the first placeholder parameter in the SQL statement to be executed corresponds to contacts_phone, then the parameter write record stores the first parameter sequence number and the mobile phone number parameter value. The field to be corrected record further stores contacts_phone, the parameter sequence number, and the mobile phone number parameter value.

[0046] It should be noted that the corrected field record is the record obtained after correcting the field identifier in the record to be corrected according to the field identifier mapping relationship. If the field identifier read from the parameter field correspondence is contactsPhone, and both contacts_phone and contactsPhone exist in the sensitive field configuration set, then the field identifier mapping relationship can convert contactsPhone to the ciphertext field identifier corresponding to the same sensitive field, and read its field data type as string. The ciphertext field identifier and ciphertext data type obtained in this way can be handed over to ProcessEncrypt for processor assignment, and Sm4StringSecretHandler will perform SM4 encryption processing on the string sensitive field.

[0047] Based on the field identifier mapping relationship, the field identifiers in the record to be corrected are corrected to obtain the corrected field record, including: Read the field identifier from the record of the field to be corrected, split the field identifier into the character field of the field to be corrected, and read the parameter sequence number from the record of the field to be corrected; Read the mapping item containing the character field of the field to be corrected from the field identifier mapping relationship, and write the database column name, object attribute name and field data type in the mapping item into the candidate correction record; Based on the field identifier mapping relationship, the database column name or object attribute name in the candidate correction record is converted into the corresponding encrypted field identifier, and the encrypted field identifier, field data type and parameter sequence number are mapped and assembled to obtain the correction field record.

[0048] In this embodiment, the character segment of the field to be corrected refers to the character segment obtained by splitting the field identifier in the record of the field to be corrected. When the field identifier is contactsPhone, it can be split into contacts and phone by camelCase boundaries; when the field identifier is contacts_phone, it can be split into contacts and phone by underscores. By reading the mapping item containing the character segment of the field to be corrected in the field identifier mapping relationship, the database column name, object attribute name and field data type corresponding to the current parameter field can be found.

[0049] Optionally, in the member applicant table, if the conditional query uses the object attribute name "phone", and the sensitive field configuration set is configured with the database column name "contacts_phone" or "phone", the system can read the mapping item containing the "phone" character field based on the field identifier mapping relationship, and determine that the field belongs to the string type sensitive field based on the field data type. Subsequently, the database column name or object attribute name in the candidate correction record is converted into the corresponding ciphertext field identifier, and the ciphertext field identifier, field data type and parameter sequence number are mapped and assembled to form the correction field record. In this way, when writing parameters to the precompiled statement object, even if the parameter source is an object attribute name, it can be corrected to the ciphertext field identifier consistent with the database storage side, reducing the impact of parameter field identification deviation on encrypted writing.

[0050] S40: Obtain the result set column labels and object attribute mappings, determine the fields to be decrypted based on the result set column labels, object attribute mappings, ciphertext data types, and ciphertext field identifiers, and determine the plaintext values ​​based on the fields to be decrypted.

[0051] In this embodiment, the result set column label refers to the column name or column alias used to identify the returned column in the database query result set. The object attribute mapping refers to the correspondence between the result column and the entity object attribute established by MyBatis or MyBatis-Plus during the result mapping process. The field to be decrypted refers to the field that needs to be restored from ciphertext to plaintext during the query return stage. Since the database stores encrypted sensitive field values, while the business layer, control layer, or front-end output usually still needs to use plaintext data such as mobile phone number, ID card number, and bank card number, it is necessary to re-identify the field to be decrypted based on the result set column label and object attribute mapping during the query return stage.

[0052] Understandably, in the specific implementation, the system can intercept the handleResultSets method of ResultSetHandler during the query return phase and proxy the getResultSet call of the Statement object. When the result mapping process reads the field value by column name through ResultSet, the system reads the corresponding result set column label. Combined with the ciphertext field identifier and ciphertext data type obtained in the aforementioned write phase, it can determine whether the fields such as contacts_phone, id_card, card_no, and phone in the result set belong to sensitive fields that have been encrypted and stored, and further call the decryption processor that matches the ciphertext data type to determine the plaintext value.

[0053] The fields to be decrypted are determined based on the result set column labels, object attribute mappings, ciphertext data types, and ciphertext field identifiers, including: Read the result set column labels and object attribute mappings, and write the object attribute names from the result set column labels and object attribute mappings into the returned field records; Split the column labels of the result set into the column name field by underscores, and split the object property names into the property field by camelCase boundaries; Match the corresponding encrypted field identifiers based on the column labels and object attribute mappings in the result set, and read the column name field and attribute field corresponding to the encrypted field identifiers. Then, write the returned column name field, returned attribute field, and encrypted data type into the field record to be verified. Based on the correspondence between the returned column name character field and the column name character field corresponding to the ciphertext field identifier in the field to be verified, and the correspondence between the returned attribute character field and the attribute character field corresponding to the ciphertext field identifier, the field to be decrypted is obtained.

[0054] Furthermore, the returned field record stores the column labels of the result set actually read during the query return phase, as well as the object attribute names corresponding to the result mapping. The field record to be verified stores the returned column name field, the returned attribute field, the encrypted data type, and the field field related to the encrypted field identifier. Taking a list query of the member user table as an example, the result set column label can be contacts_phone, and the object attribute name in the result mapping can be contactsPhone. By splitting contacts_phone into contacts and phone, and contactsPhone into contacts and phone, a field relationship corresponding to the encrypted field identifier can be formed in the field record to be verified.

[0055] It should be noted that the phrase "matching the corresponding ciphertext field identifier based on the result set column labels and object attribute mapping" does not mean determining whether decryption is needed solely based on the result set column labels themselves. Instead, it combines the result set column labels, object attribute mapping, and the ciphertext field identifier obtained during the aforementioned write phase. If the write phase has already corrected contacts_phone or contactsPhone to the same ciphertext field identifier and determined that the ciphertext data type is string, then even if the result set column label is contacts_phone and the result mapping is contactsPhone when the query returns, it can still be identified as the same field to be decrypted through the field records to be verified.

[0056] Optionally, in detail queries or result mapping scenarios, if the database returns a field named id_card or card_no, and the entity object's attribute name is idCard or cardNo, the system can also determine the field to be decrypted based on the correspondence between the returned column name field and the column name field corresponding to the ciphertext field identifier, and the correspondence between the returned attribute field and the attribute field corresponding to the ciphertext field identifier. This applies when the ciphertext data type of the field to be decrypted is a string. You can call Sm4StringSecretHandler to perform SM4 decryption on the field value to obtain the plaintext value corresponding to the mobile phone number, ID card number or bank card number, and then pass the plaintext value to the entity mapping or VO encapsulation process to return it to the business layer.

[0057] The detailed description above, in conjunction with the accompanying drawings, describes examples but does not represent all examples that can be implemented or fall within the scope of the claims. The terms “example” and “exemplary” are used in this specification to mean “serving as an example, instance or illustration” and do not mean “superior to or better than other examples”.

[0058] Throughout this specification, the phrase "an embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment of the invention. Therefore, the use of these phrases may refer to more than one embodiment. Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0059] It should also be noted that these embodiments may be described as processes depicted as flowcharts, structural diagrams, or block diagrams. Although a flowchart may describe the operations as sequential processes, many of these operations can be performed in parallel or concurrently, and the order of these operations may be rearranged.

Claims

1. A configuration-based method for automatic encryption and decryption of sensitive data, characterized in that, include: Obtain the sensitive field configuration set, split the database column names into column name character fields by underscores, split the object attribute names into attribute character fields by camelCase boundaries, and establish field identifier mapping relationships based on column name character fields, attribute character fields, and field data types. The sensitive field configuration set includes database column names, object attribute names, and field data types. Parse the SQL statement to be executed to obtain the SQL abstract syntax tree, read the semantic node to which the SQL abstract syntax tree belongs, and obtain the correspondence between parameter fields based on the semantic node to which the tree belongs; When writing parameters to the precompiled statement object, the correspondence between parameter fields is corrected according to the field identifier mapping relationship to obtain the ciphertext field identifier and ciphertext data type. Obtain the column labels and object attribute mappings of the result set; determine the fields to be decrypted based on the column labels, object attribute mappings, ciphertext data types, and ciphertext field identifiers; and determine the plaintext values ​​based on the fields to be decrypted. Read the semantic node of the SQL abstract syntax tree, and obtain the parameter field correspondence based on the semantic node, including: Read the placeholder parameter nodes in the SQL abstract syntax tree and write the order in which the placeholder parameter nodes appear in the SQL statement to be executed into the parameter sequence number record; Read the semantic node along the connection between the placeholder parameter node and the parent node, and write the node type of the semantic node into the semantic node record; Extract the field identifier based on the node type of the semantic node to obtain the placeholder parameter field record; Associating parameter sequence number records, semantic node records, and placeholder parameter field records by placeholder parameter nodes yields the parameter field correspondence. Based on the node type of the semantic node, extract the field identifier to obtain the placeholder parameter field record, including: Read the node types in the semantic node records and assign the insert field nodes, update assignment nodes, equality condition nodes and IN list nodes to different read branches; In the read branch corresponding to the inserted field node, the list of inserted fields and the list of inserted values ​​are read. The placeholder parameter nodes in the list of inserted values ​​are associated with the inserted fields in the same arrangement position to obtain the inserted field records. In the read branches corresponding to the update assignment node and the equivalence condition node, the left-hand field item of the update assignment node and the field item in the equivalence condition node that is opposite to the placeholder parameter node are read respectively to obtain the assignment condition field record. In the read branch corresponding to the IN list node, read the left-hand field items in the IN list node, and associate the left-hand field items with each placeholder parameter node in the IN list node to obtain the IN list field records; Write the inserted field record, the assignment condition field record, and the IN list field record into the corresponding placeholder parameter node to obtain the placeholder parameter field record; Read the left-hand field items from the IN list node, and associate each left-hand field item with a placeholder parameter node in the IN list node to obtain the IN list field records, including: Read the left-hand field items in the IN list node, and read the order in which each placeholder parameter node in the IN list node appears in the SQL statement to be executed; Generate parameter numbers according to the order in which each placeholder parameter node appears in the SQL statement to be executed, and write the parameter numbers into the IN list parameter record; Write the left-hand field items into the field identifier position corresponding to each parameter number in the IN list parameter record, and retain the association between the IN list node and the parameter number; Write the parameter sequence number, the left-hand field item, and the association between the IN list node into the same record to obtain the IN list field record.

2. The method for automatic encryption and decryption of sensitive data based on configuration according to claim 1, characterized in that, Establish field identifier mapping relationships based on column name field, attribute field, and field data type, including: Write the database column name, object property name, and field data type from the same configuration item into the configuration field record; Split the database column names in the configuration field records into column name fields using underscores, and split the object attribute names in the configuration field records into attribute fields using camelCase boundaries. Create a field concatenation record based on the order of the column name field and attribute field in the configuration field record; Establish a field identifier mapping relationship based on the character field connection record and the field data type.

3. The method for automatic encryption and decryption of sensitive data based on configuration according to claim 2, characterized in that, Create a field concatenation record based on the order of the column name field and attribute field in the configuration field record, including: Read the column name field and attribute field from the configuration field record, and write the column name field's position relative to the database column name into the column name position record; Write the position of the attribute character field relative to the object attribute name into the attribute character position record, and associate the column name character position record with the attribute character position record and store them in a temporary association record; By connecting the column name character position record and the attribute character position record in the temporary associated record with the same arrangement position, a character segment connection record is obtained.

4. The method for automatic encryption and decryption of sensitive data based on configuration according to claim 1, characterized in that, Based on the field identifier mapping relationship, the parameter field correspondence is corrected to obtain the ciphertext field identifier and ciphertext data type, including: Read the parameters of the precompiled statement object and write them into the call information. Then, write the parameter sequence number and parameter value in the call information into the parameter writing record. Read the field identifier from the parameter field correspondence based on the parameter sequence number, and write the field identifier, parameter sequence number and parameter value into the record of the field to be corrected; Based on the field identifier mapping relationship, the field identifiers in the record of the field to be corrected are corrected to obtain the corrected field record; The field identifier in the corrected field record is identified as the ciphertext field identifier, and the field data type in the corrected field record is identified as the ciphertext data type, thus obtaining the ciphertext field identifier and the ciphertext data type.

5. The method for automatic encryption and decryption of sensitive data based on configuration according to claim 4, characterized in that, Based on the field identifier mapping relationship, the field identifiers in the record to be corrected are corrected to obtain the corrected field record, including: Read the field identifier from the record of the field to be corrected, split the field identifier into the character field of the field to be corrected, and read the parameter sequence number from the record of the field to be corrected; Read the mapping item containing the character field of the field to be corrected from the field identifier mapping relationship, and write the database column name, object attribute name and field data type in the mapping item into the candidate correction record; Based on the field identifier mapping relationship, the database column name or object attribute name in the candidate correction record is converted into the corresponding encrypted field identifier, and the encrypted field identifier, field data type and parameter sequence number are mapped and assembled to obtain the correction field record.

6. The method for automatic encryption and decryption of sensitive data based on configuration according to claim 1, characterized in that, The fields to be decrypted are determined based on the result set column labels, object attribute mappings, ciphertext data types, and ciphertext field identifiers, including: Read the result set column labels and object attribute mappings, and write the object attribute names from the result set column labels and object attribute mappings into the returned field records; Split the column labels of the result set into the column name field by underscores, and split the object property names into the property field by camelCase boundaries; Match the corresponding encrypted field identifiers based on the column labels and object attribute mappings in the result set, and read the column name field and attribute field corresponding to the encrypted field identifiers. Then, write the returned column name field, returned attribute field, and encrypted data type into the field record to be verified. Based on the correspondence between the returned column name character field and the column name character field corresponding to the ciphertext field identifier in the field to be verified, and the correspondence between the returned attribute character field and the attribute character field corresponding to the ciphertext field identifier, the field to be decrypted is obtained.

Images