Data processing method and related apparatus

Abstract

Provided in the embodiments of the present application are a data processing method and a related apparatus. In the process of interaction between a server and a client, the server can selectively decrypt, on the basis of rules that SQL statements sent by the client satisfy, encrypted data corresponding to the SQL statements. Compared with decrypting encrypted data corresponding to all SQL statements received by a server, the present application reduces the performance overhead of servers.

Description

Data processing methods and related devices

[0001] This application claims priority to Chinese Patent Application No. 202411207490.2, filed with the State Intellectual Property Office of China on August 29, 2024, entitled “Data Processing Method and Related Apparatus”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of database technology, and in particular to a data processing method and related apparatus. Background Technology

[0003] With the development of internet technology, database applications are becoming increasingly widespread. Users can connect to a server-side database using database client tools (such as Navicat) and send Structured Query Language (SQL) statements to the server to perform database operations. To enhance database security, the client encrypts the SQL statements; however, the server typically needs to decrypt all encrypted SQL statements before executing them, resulting in significant performance overhead. Summary of the Invention

[0004] This application provides a data processing method and related apparatus that can selectively decrypt encrypted data corresponding to SQL statements sent by the client to reduce server-side performance overhead.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a data processing method is provided, applied on a server-side basis. The method includes: receiving a Structured Query Language (SQL) statement sent by a client; if the SQL statement satisfies a first rule, decrypting the first encrypted data corresponding to the SQL statement, and executing the SQL statement based on the decrypted first encrypted data to obtain a first data processing result; if the SQL statement does not satisfy the first rule, executing the SQL statement based on the first encrypted data corresponding to the SQL statement to obtain a second data processing result. During the interaction between the server and the client, the server can selectively decrypt the encrypted data corresponding to the SQL statement according to the rules satisfied by the SQL statement sent by the client. Compared to the server decrypting the encrypted data corresponding to all received SQL statements, this reduces server-side performance overhead.

[0007] Optionally, if an SQL statement includes an operator, the SQL statement satisfies the first rule if the operator satisfies the first rule, and the SQL statement does not satisfy the first rule if the operator does not satisfy the first rule.

[0008] In some possible implementations of the first aspect, the SQL statement includes multiple operators; the SQL statement satisfying the first rule includes: the multiple operators include a first operator that satisfies the first rule; decrypting the first encrypted data corresponding to the SQL statement includes: decrypting the first encrypted data corresponding to the first operator; the SQL statement not satisfying the first rule includes: the multiple operators do not include an operator that satisfies the first rule. That is, if the SQL statement includes multiple operators and satisfies the first rule, then at least one of the multiple operators of the SQL statement satisfies the first rule, and when executing the operator that satisfies the first rule, the encrypted data corresponding to that operator is decrypted; if the SQL statement does not satisfy the first rule, then none of the multiple operators of the SQL statement satisfy the first rule, that is, when executing multiple operators that do not satisfy the first rule, it is not necessary to decrypt the encrypted data corresponding to the operators. By determining the rule satisfied by each SQL statement at the operator granularity and decrypting the encrypted data corresponding to the first operator of the SQL statement that satisfies the first rule, selective decryption of the first encrypted data at the operator granularity is achieved, reducing server-side performance overhead.

[0009] In some possible implementations of the first aspect, the SQL statement includes a first operator and a second operator, the first operator corresponding to a first sub-encrypted data in the first encrypted data, and the second operator corresponding to a second sub-encrypted data in the first encrypted data; the SQL statement satisfies a first rule, including: the first operator satisfies the first rule, and the second operator does not satisfy the first rule; decrypting the first encrypted data corresponding to the SQL statement includes: decrypting the first sub-encrypted data; not decrypting the second sub-encrypted data; executing the SQL statement based on the decrypted first encrypted data includes: if the first operator is executed based on the decrypted first sub-encrypted data, then the second operator is executed based on the second sub-encrypted data.

[0010] Thus, during client-server interaction, since the SQL statement sent by the client to the server includes a first operator and a second operator, if the first operator has corresponding first sub-encrypted data and satisfies the first rule, then the first sub-encrypted data needs to be decrypted before executing the first operator; if the second operator does not satisfy the first rule but has corresponding second sub-encrypted data, then executing the second operator does not require decryption of the encrypted data. The encrypted data corresponding to each operator is decrypted according to the rules satisfied by each operator. This achieves decryption judgment of multiple encrypted data at the operator granularity, refining the granularity of decryption judgment and execution, thereby improving the flexibility of selective decryption. When executing operators, the decryption of the encrypted data corresponding to multiple operators in an SQL statement is independent of each other. For example, if an SQL statement includes two operators, both of which have corresponding encrypted data, and one of the operators satisfies the first rule, then the encrypted data is decrypted when that operator is executed; if the other operator does not satisfy the first rule, then the encrypted data does not need to be decrypted when that operator is executed. This achieves selective decryption of the encrypted data corresponding to multiple operators of an SQL statement that satisfy the first rule, thereby reducing the performance loss on the server side.

[0011] In some possible implementations of the first aspect, if the input of the first operator includes a non-equivalence symbol or the first operator includes a first input and a second input, and the data types of the first input and the second input are different, and the first operator is used to operate on the first input and the second input, then the first operator satisfies the first rule. Since the operator includes non-equivalence symbols, such as >, <, >=, and <=, these non-equivalence symbols are used to limit a range rather than a specific value. For example, when used to obtain rows where a is greater than 2, if a is encrypted data, it is impossible to determine whether a is greater than 2. Therefore, a needs to be decrypted before executing the operator, meaning the operator satisfies the first rule. If the operator is used to operate on two inputs, such as a+1, since a is encrypted data, it cannot be directly added. a needs to be decrypted before adding 1 to a can be performed. Therefore, operators containing these features also satisfy the first rule. Correspondingly, operators that do not satisfy the above features do not satisfy the first rule.

[0012] In some possible implementations of the first aspect, after receiving the Structured Query Language (SQL) statement sent by the client, the method further includes: determining a key value based on the SQL statement; determining an index page that matches the key value, wherein the key value is located within a key value range of the matching index page, the key value range being determined based on the maximum and minimum values ​​of the key values ​​in the index page; and obtaining the data to be processed for the SQL statement within the index page.

[0013] Thus, if the SQL statement includes a query operation on the data to be processed in the database, the index key value can be determined based on the SQL statement. Since the index key value includes encrypted data, decrypting the data to be processed before indexing would significantly impact server performance. Therefore, the maximum and minimum values ​​of the index key values ​​in each index page can be determined based on the index key values ​​in the database to define the key value range for each index page. If the key value falls within the key value range of the corresponding index page, then the index page matches the key value, and the data to be processed in the SQL statement can be found from that index page. This eliminates the need to decrypt the data on the index page, reducing server performance overhead. Optionally, the server can maintain the key value range for each index page. For example, if a specific position on each index page (e.g., the first and last entries) contains an index key value that includes encrypted data, the index key value at that specific position can be decrypted, and the index key value range for that index page can be obtained based on the maximum and minimum values ​​of the index key values ​​in the index page. If the index key value only includes one index page, then the index page corresponding to the SQL statement can be determined without decrypting the index key value.

[0014] Optionally, if the index page that matches the key value includes at least one leaf page, the leaf pages of that index page can be matched to determine the leaf page that matches the key value, until no leaf page matches the key value, and then the data to be processed for the SQL statement is searched from the last leaf page that matches the key value.

[0015] In some possible implementations of the first aspect, the server includes a Database Management System (DBMS) located in a trusted execution environment (TEE). The DBMS executes the SQL statements to obtain either the first data processing result or the second data processing result. Thus, since the DBMS is located in a trusted execution environment, database operations on the server are executed within a TEE, enhancing data operation security. Furthermore, the DBMS can execute the data processing described in this application, i.e., the aforementioned data processing procedure, without interacting with an untrusted execution environment (e.g., a Rich Execution Environment, REE) on the server, reducing performance overhead during data processing.

[0016] In some possible implementations of the first aspect, if the SQL statement includes multiple operators, and the input of the top-level operator depends on the output of at least one other operator, the method further includes: if the first data processing result or the second data processing result includes data to be encrypted, then the data to be encrypted is encrypted to obtain a confidential data processing result, wherein the first data processing result or the second data processing result is the execution result of the top-level operator. Thus, if multiple operators corresponding to the SQL statement are nested, i.e., the output of at least one operator depends on the output of another operator, the execution result of the top-level operator is the SQL statement. Encryption of the execution result of the top-level operator yields the confidential data processing result corresponding to the SQL statement. The execution results of other operators (not the top-level operator) do not need to be encrypted or decrypted. Optionally, the data processing result (first data processing result or second data processing result) of the top-level operator can be encrypted using the encryption key corresponding to the top-level operator to obtain the confidential data processing result corresponding to the SQL statement. Optionally, if each operator has a corresponding encryption key and at least two operators have different encryption keys, then the key corresponding to the top-level operator can be selected from the at least two encryption keys, and the data processing result of the top-level operator can be encrypted based on the key to obtain the confidential data processing result corresponding to the SQL statement.

[0017] In some possible implementations of the first aspect, where the first encrypted data includes multiple sub-encrypted data, each sub-encrypted data corresponding to an encryption key, and at least two sub-encrypted data corresponding to at least two different encryption keys, the method further includes: determining a target encrypted data among the multiple sub-encrypted data based on a preset rule; encrypting the first data processing result or the second data processing result based on the encryption key corresponding to the target encrypted data to obtain a confidential data processing result. Optionally, the preset rule may be that among multiple operators, the encryption key corresponding to the last executed operator is the target encryption key corresponding to the target encrypted data. Thus, the first encrypted data includes multiple sub-encrypted data, and the multiple sub-encrypted data correspond to at least two different encryption keys. The target encryption key can be determined through agreed-upon rules so that the client and server determine the same encryption key according to the agreed-upon rules.

[0018] In some possible implementations of the first aspect, the method further includes: encrypting the log information and sending the encrypted log information to the target server.

[0019] A second aspect provides a data processing system, the data processing system including a client and a server; the server is used to execute the data processing method according to any one of the first aspects; the server is also used to send a confidential data processing result to the client, the confidential data processing result being obtained by the server encrypting the first data processing result or the second data processing result.

[0020] In some possible implementations of the second aspect, the client is further configured to: obtain the initial SQL statement input by the user;

[0021] The data to be encrypted in the initial SQL statement is determined based on the operation type corresponding to the initial SQL statement.

[0022] The data to be encrypted in the initial SQL statement is encrypted to obtain the SQL statement.

[0023] In some possible implementations of the second aspect, if the initial SQL statement includes an INSERT statement, then the data inserted by the INSERT statement is determined to be data to be encrypted; if the initial SQL statement includes an UPDATE statement, a DELETE statement, or a SELECT statement, then the conditional data in the conditional clauses of the UPDATE statement, the DELETE statement, or the SELECT statement is determined to be data to be encrypted; if the initial SQL statement includes an UPDATE statement, then the data written by the UPDATE statement and the conditional data in the conditional clauses are data to be encrypted.

[0024] Optionally, after determining the data to be encrypted, the client identifies the sensitive data within the data to be encrypted, encrypts the sensitive data, and obtains the SQL statement.

[0025] Thirdly, a computer is provided, comprising: a memory including computer-readable instructions; and a processor communicating with the memory, the processor being configured to execute the computer-readable instructions, causing the computer to perform the data processing method described in any one of the first aspects.

[0026] Fourthly, a computer-readable storage medium is provided, including a program or instructions that, when executed by a processor, implement the data processing method as described in any one of the first aspects.

[0027] Fifthly, a chip is provided, including a processor for retrieving and executing instructions stored in a memory, causing a computer equipped with the chip to perform the data processing method described in any one of the first aspects.

[0028] Sixthly, a computer program product is provided, the computer program product comprising instructions that, when executed by a computer, implement the method as described in any one of the first aspects.

[0029] The beneficial effects of each possible implementation of the data processing method provided in the second aspect of the embodiments of this application, the computer provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, the chip provided in the fifth aspect, and the computer program product provided in the sixth aspect can be referred to the descriptions of the various possible implementations in the first aspect, and will not be repeated here. Attached Figure Description

[0030] Figure 1 is a schematic diagram of a data processing system provided in an embodiment of this application;

[0031] Figure 2 is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0032] Figure 3 is a schematic diagram of a client encryption / decryption process provided in an embodiment of this application;

[0033] Figure 4 is a schematic diagram of a server-side encryption / decryption process provided in an embodiment of this application;

[0034] Figure 5 is a schematic diagram of the architecture of a data processing system provided in an embodiment of this application;

[0035] Figure 6 is a schematic diagram of data transmission provided in an embodiment of this application;

[0036] Figure 7 is a schematic diagram of the modules of a data processing system provided in an embodiment of this application;

[0037] Figure 8 is a schematic diagram of the structure of a computer provided in an embodiment of this application. Detailed Implementation

[0038] The technical solutions in this application will now be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments in this specification, and not all of them.

[0039] With the development of internet technology, the data involved in various applications and tools is growing exponentially. To facilitate the storage and management of this data, databases have emerged. Users can connect to databases using database client tools (such as Navicat) and send SQL statements to the server to perform database operations. To improve the security of data in the database, the client encrypts the target data (such as sensitive information) in the SQL statement; however, the server usually needs to decrypt all encrypted SQL statements before executing them, which incurs a significant performance penalty on the server side.

[0040] To address the aforementioned issues, this application provides a data processing method in which a user sends SQL statements to a server via a client to perform various operations on the database; the server selectively decrypts the encrypted data corresponding to the SQL statements to reduce the performance overhead of server-side data processing.

[0041] Please refer to Figure 1, which is a schematic diagram of a data processing system provided in an embodiment of this application. The data processing system in Figure 1 includes a client and a server. The client and the server establish a communication connection based on a communication protocol.

[0042] The client can be any computing device with a certain computing capability. The basic structure of the client may include at least one processor. The number of processors depends on the client's configuration and type. The client may also include memory, which can be volatile, such as RAM, or non-volatile, such as read-only memory (ROM), flash memory, or both. The memory typically stores the operating system (OS), one or more applications, and may also store program data. In addition to the processing unit and memory, the client also includes some basic configurations, such as a network interface card (NIC) chip, I / O bus, display components, and some peripheral devices. Optionally, some peripheral devices may include, for example, a keyboard, mouse, pen, printer, etc. Other peripheral devices are well known in the art and will not be described in detail here. Optionally, the client can be a PC (personal computer), a terminal, etc.

[0043] A server refers to a device that provides computing and processing services in a virtual network environment, typically referring to a server that utilizes the network for information planning. In physical implementation, a server can be any device capable of providing computing services, responding to service requests, and processing data; examples include conventional servers, cloud servers, cloud hosts, and virtual data centers. The main components of a server include a processor, hard drive, memory, and system bus, similar to a general computer architecture.

[0044] As can be easily understood, the data processing system in Figure 1 includes a client and a server. In other embodiments, the data processing system may include multiple clients and / or multiple servers.

[0045] Optionally, the client sends an SQL statement to the server; the server receives the SQL statement, which contains corresponding encrypted data; the server selectively decrypts the encrypted data according to the rules satisfied by the SQL statement to reduce performance overhead on the server side. The encrypted data corresponding to the SQL statement can be either the encrypted data carried by the SQL statement itself or encrypted data from the database that the SQL statement is processing.

[0046] Optionally, the server in Figure 1 can run a confidential virtual machine or a confidential container. Confidential virtual machines and confidential containers can provide a trusted execution environment. The server can improve the security of data processing by executing SQL statements provided by the client in the trusted execution environment.

[0047] In this context, confidential virtual machines (VMs) on the server side can provide a trusted execution environment, and confidential containers on the server side can provide a trusted execution environment. By isolating other devices from accessing data within the trusted execution environment, data security is enhanced. For example, confidential VMs or confidential containers can isolate the host machine's registers, memory, network cards, hard drives, or prohibit cross-system access.

[0048] Please refer to Figure 2, which is a schematic flowchart of a data processing method provided in an embodiment of this application. The following description applies the data processing method of Figure 2 to the data processing system of Figure 1. The data processing method in Figure 2 includes: S201 to S202.

[0049] S201, The client sends an SQL statement to the server.

[0050] Optionally, users can send SQL statements to the server through the client to perform operations such as querying, deleting, updating, and adding data on the server.

[0051] In some embodiments, the SQL statement sent by the client corresponds to a database on the server, and the SQL statement is used to operate on the data stored in the database.

[0052] Optionally, the first encrypted data may be data carried in an SQL statement. For example, if the SQL statement includes INSERT into t1 values(1,2,'abc'), the first encrypted data may be 'abc'. Optionally, the first encrypted data may also be data to be processed by the SQL statement on the server side, such as data stored in a database. For example, if the SQL statement includes SELECT * FROM employees, the first encrypted data may be the content of the employees table in the database. Of course, in other embodiments, the first encrypted data may also include both data carried in the SQL statement and data to be processed by the SQL statement in the database.

[0053] S202. If the SQL statement satisfies the first rule, the server decrypts the first encrypted data and executes the SQL statement based on the decrypted first encrypted data to obtain the first data processing result; if the SQL statement does not satisfy the first rule, the server executes the SQL statement based on the first encrypted data to obtain the second data processing result.

[0054] Optionally, the first rule can be a rule set according to the category of the SQL statement. For example, query statements satisfy the first rule, while non-query statements do not. The first rule can also be a rule set for the object processed by the SQL statement. For example, if the SQL statement is used to process encrypted sensitive data in the database, the first rule is not satisfied; if the SQL statement is used to process encrypted non-sensitive data in the database, the first rule is satisfied. Of course, the first rule can also be a rule set by other users.

[0055] In some embodiments, if the first encrypted data is data carried in an SQL statement and the SQL statement satisfies the first rule, then the first encrypted data is decrypted and the SQL statement is executed. For example, if the SQL statement includes `DELETE from t1 where a>M;` and M is the first encrypted data, then M is decrypted to obtain `DELETE from t1 where a>1;`, and then the rows corresponding to `a>1` in `t1` are deleted. Optionally, if the first encrypted data is data stored in a database and the SQL statement satisfies the first rule, then the first encrypted data in the database is decrypted, and the decrypted first encrypted data is processed according to the SQL statement to obtain the corresponding execution result.

[0056] Optionally, to ensure the security of data processing, the server executes the data processing method shown in Figure 2 in a trusted execution environment.

[0057] In this way, when the client processes data on the server, the server can selectively decrypt the first encrypted data based on the rules satisfied by the SQL statement, avoiding the decryption of all first encrypted data, thereby improving data processing efficiency and reducing data processing loss.

[0058] In some embodiments, the positions of the fields to be encrypted in the SQL statements corresponding to different operation types are different. Before S201, the client obtains the initial SQL statement input by the user, determines the data to be encrypted in the initial SQL statement according to the operation type of the initial SQL statement, and then encrypts the data to be encrypted in the initial SQL statement to obtain the SQL statement. The SQL statement includes the encrypted data, such as the first encrypted data. Since the operation types of the SQL statements are different, the positions of the data to be encrypted in the SQL statements are also different. The client can determine the data to be encrypted in the SQL statement according to the operation type of the SQL statement; then the client encrypts the data to be encrypted and replaces the data to be encrypted in the SQL statement with the encrypted data. The structure of the SQL statement is not changed, so that the SQL statement containing encrypted data can be adapted to the corresponding database without additional modification.

[0059] For example, if the initial SQL statement includes `DELETE FROM students WHERE age<18`, used to delete rows that meet the condition (age is less than 18), then the data to be encrypted is "age<18". If the initial SQL statement includes `INSERT INTO Students(Name,Age,Gender)VALUES('Alice',22,'Female')`, used to insert `VALUES('Alice',22,'Female')` at the (Name,Age,Gender) position in the Students table, then both the table position and the inserted value are the data to be encrypted.

[0060] In some embodiments, the data to be encrypted in the initial SQL statement is encrypted to obtain the SQL statement, including:

[0061] The client identifies sensitive and non-sensitive data within the data to be encrypted. It encrypts the sensitive data but leaves the non-sensitive data unencrypted, resulting in an SQL statement. For example, the initial SQL statement might include `INSERT INTO Students(Name,Age,Gender)VALUES('Alice',22,'Female')`, where the data to be encrypted is `('Alice',22,'Female')`. Since the name is sensitive information, the statement encrypts "Alice" within `('Alice',22,'Female')`, resulting in `INSERT INTO Students(Name,Age,Gender)VALUES('Dolifh',22,'Female')`. In other words, after determining the data to be encrypted, the client identifies sensitive data, encrypts the sensitive data, and leaves the non-sensitive data unencrypted.

[0062] In some embodiments, if the initial SQL statement includes an INSERT statement, the data written by the INSERT statement is the data to be encrypted.

[0063] If the initial SQL statement includes a DELETE or SELECT statement, then the conditional data in the conditional clauses of the initial SQL statement is the data to be encrypted.

[0064] If the initial SQL statement includes an UPDATE statement, the data written in the UPDATE statement and the data conditional in the conditional clause are the data to be encrypted. Similarly, if the initial SQL statement includes an INSERT statement, the data inserted (i.e., written) in the INSERT statement is the data to be encrypted; if the initial SQL statement includes a DELETE or SELECT statement, the data conditional in the initial SQL statement is the data to be encrypted; and if the initial SQL statement includes an UPDATE statement, the data written in the UPDATE statement and the data conditional in the conditional clause are the data to be encrypted. Based on the different operation types of the SQL statement, the data to be encrypted in that SQL statement is determined, and then the data to be encrypted is encrypted.

[0065] Optionally, the conditional clause can be a WHERE clause. For example, in DELETE FROM t1 WHERE a = 1, the conditional clause is WHERE a = 1, where a = 1 is the conditional data in the conditional clause, i.e., the data to be encrypted.

[0066] Optionally, when interacting with the server's database, the client loads the corresponding driver on the database side, such as Java Database Connectivity (JDBC) or Open Database Connectivity (ODBC). This driver connects the application (e.g., a Java application) to the database system. After receiving the initial SQL statement input by the user on the client side, the driver determines the data to be encrypted in the initial SQL statement based on the operation type of the initial SQL statement, then identifies sensitive data within the data to be encrypted and encrypts the sensitive data to obtain the SQL statement. By automatically identifying and encrypting the data to be encrypted in the initial SQL statement through the corresponding database driver, the SQL statement input by the user through the client does not need to be encrypted; the driver automatically encrypts it, and the encrypted SQL statement is compatible with the corresponding database.

[0067] Please refer to Figure 3, which is a schematic diagram of a client-side encryption / decryption process provided in an embodiment of this application. In Figure 3, the client's parser parses the SQL statement passed by the user; if the SQL statement includes an INSERT statement, the statement processor identifies sensitive data in the inserted data of the INSERT statement, and the encryption / decryption processor encrypts the sensitive data in the inserted data; if the SQL statement includes a DELETE statement or a SELECT statement, the statement processor identifies sensitive data in the WHERE clause of the DELETE statement or SELECT statement, and the encryption / decryption processor encrypts the sensitive data in the WHERE clause; if the SQL statement includes an UPDATE statement, the statement processor identifies sensitive data in the WHERE clause of the UPDATE statement and sensitive data in the write statement, and the encryption / decryption processor encrypts the sensitive data.

[0068] Optionally, after the server executes the SQL statement, it obtains the data processing result. The server can then send the data processing result to the client. After the client's parser parses the data processing result, it identifies the corresponding encrypted data based on the result and decrypts it. In other words, the user can only read the decrypted data processing result after the client has decrypted it. Unauthorized users can only read the encrypted data or cannot read the data processing result at all.

[0069] Optionally, after receiving the data processing result sent by the server, if the operator corresponding to the data processing result belongs to the target operator type, then the data processing result is decrypted; if the operator corresponding to the data processing result does not belong to the target operator type, then the data processing result does not need to be decrypted.

[0070] As shown in Figure 3, if the data processing result received by the client is the execution result of a SELECT statement, the result processing module identifies the data to be decrypted in the data processing result, and the encryption processor decrypts the data to be decrypted; if the data processing result received by the client is the execution result of an UPDATE statement, DELETE statement, or INSERT statement, then there is no need to decrypt the data processing result.

[0071] Optionally, an SQL statement may include an operator. If the operator satisfies the first rule, then the SQL statement satisfies the first rule; if the operator does not satisfy the first rule, then the SQL statement satisfies the first rule.

[0072] For example, if an SQL statement includes an operator, such as `delete from t1 where a>1` (deletes all rows from table t1 where the value of column a is greater than 1), and `delete` satisfies the first rule, then the SQL statement satisfies the first rule.

[0073] In some embodiments, an SQL statement includes multiple operators; the SQL statement satisfying a first rule includes: the multiple operators include a first operator that satisfies the first rule; decrypting the first encrypted data corresponding to the SQL statement includes: decrypting the first encrypted data corresponding to the first operator; the SQL statement not satisfying the first rule includes: the multiple operators do not include an operator that satisfies the first rule. That is, if an SQL statement includes multiple operators and satisfies the first rule, then at least one of the multiple operators of the SQL statement satisfies the first rule, and when executing the operator that satisfies the first rule, the encrypted data corresponding to that operator is decrypted; if the SQL statement does not satisfy the first rule, then none of the multiple operators of the SQL statement satisfy the first rule, meaning that when executing the multiple operators of the SQL statement, it is not necessary to decrypt the encrypted data corresponding to the multiple operators. This allows for determination of whether the SQL statement satisfies the first rule at the operator granularity. When executing an SQL statement that satisfies the first rule, the encrypted data corresponding to the operator that satisfies the first rule is decrypted, thereby achieving selective decryption and reducing server-side performance overhead.

[0074] For example, if the SQL statement is `update t1 set a = M where a > N`, and the SQL statement includes two operators `update` and `set`, where `update` satisfies the first rule and `set` does not, meaning the SQL statement satisfies the first rule, then `N` is decrypted before executing `update`, and the `update` operator is executed after decryption. As another example, if the SQL statement is `update t1 set b = n where a = m`, and the SQL statement includes two operators `update` and `set`, where both `update` and `set` do not satisfy the first rule, meaning the SQL statement does not satisfy the first rule, then `a` and `b` do not need to be decrypted before executing the `set` and `update` operators.

[0075] Optionally, the SQL statement includes a first operator and a second operator. The first operator corresponds to the first sub-encrypted data in the first encrypted data, and the second operator corresponds to the second sub-encrypted data in the first encrypted data. In S202, the first operator satisfies a first rule, including: the first operator satisfies the first rule, and the second operator does not satisfy the first rule.

[0076] S202 decrypts the first encrypted data corresponding to the SQL statement, including:

[0077] If the first operator satisfies the first rule, then the first sub-encrypted data is decrypted; the second sub-encrypted data is not decrypted.

[0078] S202 executes SQL statements based on the decrypted first encrypted data, including:

[0079] The first operator is executed based on the first sub-encrypted data after decryption, and the second operator is executed based on the second sub-encrypted data.

[0080] Thus, an SQL statement includes at least one operator. Before executing the operator, the rules it satisfies are determined, and based on these rules, the rules satisfied by the SQL statement can be identified. During SQL statement execution, based on the rules satisfied by the operators, the corresponding sub-encrypted data is selectively decrypted, thereby achieving operator-level selective decryption of sub-encrypted data to reduce server-side performance overhead. If the SQL statement includes multiple independent operators, and if the SQL statement includes a first operator and a second operator, and the first operator satisfies the first rule while the second operator does not, then the first sub-encrypted data corresponding to the first operator is decrypted, and the first operator is executed based on the decrypted first sub-encrypted data; if the second operator does not satisfy the first rule, then the second operator is executed based on the second sub-encrypted data. This avoids the need to decrypt all encrypted data, further reducing server-side performance overhead.

[0081] For example, if the SQL statement is update t1 set a = M where a > N; the SQL statement includes two operators update and set. The SQL statement satisfies the first rule. update satisfies the first rule, but set does not satisfy the first rule. Then, the operator set is executed based on a = M. Before executing update, N is decrypted, and then the operator update is executed.

[0082] Optionally, if an SQL statement includes one operator, the execution result of that operator is the execution result of the SQL statement; if an SQL statement includes multiple operators that are not nested (e.g., the execution result of one operator is not the input of another operator), the execution result of the multiple operators is the execution result of the SQL statement; if an SQL statement includes multiple operators that are nested (e.g., the execution result of one operator is the input of at least one other operator), the execution result of the top-level operator is the execution result of the SQL statement; if there are multiple top-level operators (e.g., multiple top-level operators are not nested), the execution result of the multiple top-level operators is the execution result of the SQL statement.

[0083] The top-level operator, also known as the root operator, is the outermost operator among multiple operators in the database. It integrates and summarizes the data processed by the other operators. For example, in a grouped aggregation query, the top-level operator receives the intermediate results calculated by the sub-operators of each group and then performs the final global summary and organization.

[0084] For example, the SQL statement: INSERT into t1 SELECT * from t2; selects all data from table t2 and inserts this data into table t1. The SQL statement includes two operators, INSERT and SELECT. The output of SELECT serves as the input of INSERT. Therefore, INSERT is the top-level operator of the SQL statement, and the execution result of INSERT is the execution result of the SQL statement.

[0085] It's easy to understand that each operator's input can include one or more symbols. If the execution condition only includes an equality condition, the equality condition is specified using the equality operator (= or ==). For example, `DELETE from t1 where a = M` finds all records in table `t1` where the value of column `a` is equal to 1 and deletes these records from the table. Since the operator's input only includes the symbol "=", there's no need to decrypt `M` to delete all records where the value of column `a` is equal to 1. `DELETE from t1 where a > 1` deletes all records in table `t1` in the database where the value of column `a` is greater than 1. Because this operator's input includes the non-equality symbol ">", the input "all values ​​in column `a` are greater than 1" is a range, not a specific value. Therefore, before executing this statement, `a` in the database needs to be decrypted. Therefore, if the input of an operator includes non-equivalent symbols, the encrypted data corresponding to the operator must be decrypted before the operator can be executed. Non-equivalent symbols can include arithmetic operators (such as addition, subtraction, multiplication, and division), comparison operators (such as >, <, >=, and <=), bitwise operators (such as &, |, ^, and ~), string operators (such as string comparison and string concatenation), aggregation operators (such as summation and averaging), and regular expression symbols. In other words, if the input of an operator includes one or more symbols, one of which is a non-equivalent symbol, then the operator satisfies the first rule.

[0086] For example, the operator `SELECT t1.a,t2.b from t1,t2 where t1.a=t2.b` combines each row in table `t1` with each row in table `t2` (i.e., performs a Cartesian product). Then, the `WHERE` clause filters these combinations, retaining only records where `t1.a=t2.b`. Ultimately, the query result will only contain the values ​​of columns `a` and `b` for rows where the values ​​in columns `a` and `b` are equal in both tables. Since the `a` field in table `t1` is encrypted, causing a data type mismatch between `a` and `b` fields in table `t2`, `a` in `t1` needs to be decrypted to match the fields in both tables before the operator can be executed. Another example is `SELECT b+1,a+b from t1 where a=2`; this operator iterates through each row in table `t1`, checking if the value in column `a` is equal to 2. For each row that meets the conditions, calculate the values ​​of b+1 and a+b, and return these values ​​as a row to the queryer. If b or a is encrypted data, or the data types of b and 1 do not match, then "b+1 and a+b" cannot be executed. Therefore, before executing this operator, b and a need to be decrypted to ensure that the decrypted data types match, so that the operator can be executed. Thus, if the operator includes a first input and a second input, and the data types of the first and second inputs are different, the operator is used to operate on the first and second inputs. This operation is a joint operation on the first and second inputs, such as arithmetic operations (addition, subtraction, multiplication, division) or aggregation operations. Since this operation requires the participation of the first and second inputs, it is an operation applied to the first and second inputs. If the data types of the first and second inputs do not match, then the operator satisfies the first rule, that is, the encrypted data in the first input and / or the second input needs to be decrypted to ensure that the first and second inputs match.

[0087] In some embodiments, if the input of the second operator only includes an equality symbol and the data type of the input of the second operator matches (or in other words, the input of the second operator includes one data type), then the second operator does not satisfy the first rule. Thus, after the server receives the SQL statement, since the SQL statement includes at least one operator, the encrypted data can be decrypted at the operator level. The server can determine the rules satisfied by the operator based on the symbol and / or data type of the operator's input, and selectively decrypt the encrypted data based on the satisfied rules, thereby improving data processing efficiency and reducing server performance overhead.

[0088] In some embodiments, if the input of the second operator does not include non-equivalence symbols and the input of the second operator includes only one data type, then the second operator does not satisfy the first rule. For example, INSERT into t1 values(1,2); the input of the operator is 1,2, does not include non-equivalence symbols and the input of the operator includes only one data type.

[0089] In some embodiments, after the SQL statement is executed on the server side, a data processing result (such as the first processing result or the second processing result described above) is obtained. For the security of the data processing result, the server side may encrypt the data processing result to obtain a confidential data processing result and send the confidential data processing result to the client.

[0090] In some embodiments, if the SQL statement includes multiple operators, the corresponding processing result can be obtained after each operator is executed; if the execution result of each operator is independent of each other, that is, the multiple operators are not nested, for example, the output of each operator is not used as the input of another operator, then after the server obtains the execution results of multiple operators, it encrypts the data to be encrypted in each execution result to obtain multiple encrypted execution results, that is, confidential data processing results.

[0091] Optionally, if an SQL statement includes multiple operators, where the execution result of at least one operator serves as the input of another operator, and these multiple operators form a hierarchical structure, or are executed nestedly, then the outermost operator among the multiple operators can be called the top-level operator. The output of at least one other operator among the multiple operators serves as the input of the top-level operator. Since the multiple operators corresponding to the SQL statement are executed nested, the execution result of the top-level operator is the execution result of the SQL statement. Therefore, the above method further includes:

[0092] If the first data processing result or the second data processing result includes data to be encrypted, then the data to be encrypted is encrypted to obtain a confidential data processing result, and the confidential data processing result is sent to the client. The execution result is either the first data processing result or the second data processing result is the execution result of the top-level operator.

[0093] If the execution result of the top-level operator does not include the data to be encrypted, the server sends the first data processing result or the second data processing result to the client.

[0094] If the operator is not a top-level operator, then the execution result of the operator does not need to be encrypted, regardless of whether it includes the data to be encrypted.

[0095] If the SQL statement satisfies the first rule, the execution result of the top-level operator is the first data processing result; if the SQL statement does not satisfy the first rule, the execution result of the top-level operator is the second data processing result.

[0096] Thus, for multiple nested operators, the execution result of the top-level operator is the execution result of the SQL statement. Only the execution result of the top-level operator needs to be encrypted. For the execution results of non-top-level operators, since the execution result is an intermediate execution result, regardless of whether the intermediate execution result includes the data to be encrypted, there is no need to encrypt the intermediate execution result, thereby improving data processing efficiency.

[0097] Optionally, if each operator has a corresponding encryption key, and different operators correspond to different encryption keys, the server obtains the encryption key corresponding to the top-level operator, and encrypts the execution result according to the encryption key to obtain the confidential data processing result.

[0098] Optionally, if the SQL statement includes at least one operator, the first encrypted data includes multiple sub-encrypted data, each sub-encrypted data corresponding to an encryption key, and at least two sub-encrypted data correspond to different encryption keys, then the method further includes:

[0099] The target encrypted data is determined from multiple sub-encrypted data based on preset rules;

[0100] Based on the encryption key corresponding to the target encrypted data, the first data processing result or the second data processing result is encrypted to obtain a confidential data processing result. Since the target sub-data corresponding to the operator includes multiple encrypted data, and since each encrypted data is encrypted by the server or client based on a corresponding encryption key, and each encrypted data has a corresponding encryption key, the multiple encrypted data correspond to at least two different encryption keys. Therefore, at least two of the multiple encrypted data have different encryption keys. After executing the operator, the execution result is obtained. The execution result can be encrypted (or the data to be encrypted in the execution result can be encrypted) according to the agreed encryption key (target encryption key) among the at least two encryption keys, so that the client and server can decrypt or encrypt the execution result according to the agreed encryption key.

[0101] Optionally, if the operator corresponds to multiple encrypted data, the default rule is to use the last encrypted data processed among the multiple encrypted data as the target encrypted data; for example, the SQL statement is SELECT sum((b+1)-a),a+b from t1 where a=2; when executing SELECT, first decryption is performed according to the encryption keys corresponding to a and b, and then the execution result is encrypted with the encryption key corresponding to a; if the last encrypted data processed includes at least two, the default rule is to use the encrypted data at a specific position among the at least two encrypted data as the target encrypted data, for example, the specific position value can be the first or last encrypted data among the at least two encrypted data as the target encrypted data.

[0102] Please refer to Figure 4. Figure 4 is a schematic diagram of a server-side decryption process provided in an embodiment of this application. In Figure 4, after the server receives the SQL statement sent by the client, the SQL statement includes at least one operator, the first encrypted data includes at least one first sub-encrypted data, and at least one operator has corresponding first sub-encrypted data.

[0103] First, the server determines whether the operator satisfies the first rule or not;

[0104] If the operator does not satisfy the first rule and the operator has corresponding first sub-encrypted data, the server does not need to decrypt the first sub-encrypted data and can execute the operator through the ciphertext to obtain the data processing result;

[0105] If the operator satisfies the first rule, the first sub-encrypted data corresponding to the operator is decrypted to convert the ciphertext in the target sub-data into plaintext and / or convert the data type of the target sub-data; then the operator is executed based on the plaintext data to obtain the data processing result (i.e., the unencrypted data processing result); then it is determined whether the operator has a parent node; if a parent node exists, the operator corresponding to the parent node is executed; then until the operator has no parent node; if no parent node exists, the unencrypted data processing result is encrypted to obtain the encrypted data processing result;

[0106] Then, the results are processed. The server can send the data processing results to the client, or it can store the data processing results in encrypted form.

[0107] It is easy to understand that if the server needs to index the location of the data processed by the SQL statement in the database before executing the SQL statement, indexing can improve the query speed in the database. However, if the index key value is encrypted data, then in order to accurately find the data to be processed, it is usually necessary to decrypt the data in the database. Since the amount of data stored in the database is large, decryption of the data in the database affects the performance of the server. Therefore, this application uses key-value indexing to improve the efficiency of data processing. In some embodiments, after S201, the method further includes:

[0108] The server determines the index key value based on the SQL statement and identifies the index page that matches the index key value. The index key value is within the key value range of that index page, which is determined by the maximum and minimum values ​​of the index key values ​​on that index page. The index key value includes the second encrypted data. The server then retrieves the SQL statement to be processed from the index page.

[0109] Thus, since the SQL statement determines that the index key value includes encrypted data, the index table stores encrypted data, making it impossible to directly execute the index operation corresponding to the SQL statement. This application determines the key value range of each index page, which is determined by the maximum and minimum key values ​​of that index page. By comparing the index key value corresponding to the SQL statement with the key value range of each index page, the index page corresponding to the index key value is determined. That is, if the index key value is within the key value range, the statement to be processed in the SQL statement is located on that index page, thereby achieving indexing.

[0110] As is easily understood, since index pages are determined based on index key values, different index pages correspond to different indexes depending on whether the database indexes by province or by city. Therefore, if the index key value is determined, the corresponding index page can also be determined. For example, if the index key value is province P of country X, it will include a maximum of two index pages (country X includes 24 provinces). Since these two index pages are determined based on the index key value, and the index page contains the index key value, data at a specific location within the index page can be decrypted to obtain the corresponding index key value. The range of index key values ​​for the index page is then determined based on the maximum and minimum index key values. It is then checked whether the index key value corresponding to the SQL statement falls within this range. If the index key value of the SQL statement is within the range, the two match, meaning the data to be processed corresponding to the SQL statement is within that index page. The indexing process only requires decrypting a portion of the fields on the index page corresponding to the index key value to determine the key value range for each index page, which improves data processing efficiency compared to decrypting all data on all pages.

[0111] Optionally, the server can also maintain the key value range of the index pages corresponding to the index key values. For example, when the server receives an SQL statement, it determines the index key value based on the SQL statement, and then retrieves the index page corresponding to the index key value. Since the index key value includes encrypted data, if there is only one index page, then this index page is the index page of the SQL statement, and the data to be processed in the database for the SQL statement can be retrieved from this index page. If there are multiple index pages, the index pages can be matched with the index key values ​​of the SQL statements. Specific positions on an index page contain index key values, and the index key values ​​at specific positions can be decrypted to obtain the index key value range of that index page. These specific positions can be the first and last entries of the index page, the page header, etc.

[0112] It's easy to understand that index keys in a database are usually pre-defined by the user. For example, if P represents cities in province A, and province A includes 23 cities, setting P as the index key will result in 3 index pages. During the execution of an SQL statement, the input can include a key value. For example, `update t1 set a = 1 where a = 2` updates table t1, changing the value of column 'a' in records where column 'a' is 2 to 1. If 'a' is a key value, the index page corresponding to key value a = 2 can be queried, and the value of column 'a' in the corresponding page can be changed to 1. Of course, in some embodiments, the SQL statement can include multiple key values. For example, `DELETE from t1 where a = 1 and b = 1`, where both 'a' and 'b' are pre-defined key values, can select the one with the least index consumption as the final key value.

[0113] Optionally, the key value range of each index page can be determined by the key value corresponding to the first entry and the key value corresponding to the last entry of the index page, or it can be determined based on other methods. For example, if the page header of each index page includes information such as the object ID of the page of the index page, the key value range of the index page can also be determined based on the page header information of the index page.

[0114] Optionally, if the current index page also includes leaf pages, then the index page matching the key value is determined, and the data to be processed corresponding to the SQL statement within the index page is obtained, including:

[0115] The leaf page matching the key value is identified, and the data to be processed corresponding to the SQL statement within that leaf page is retrieved. Thus, if the index page matching the key value has a leaf page, it can be determined whether the leaf page matches the key value. If they match, the leaf page matching the key value is identified. If the leaf page has subpages, the matching of the subpages continues until the entries on the subpages do not match the key value. The last matching index page is then used as the index page matching the key value.

[0116] Optionally, the SQL statement may include query operations, meaning the SQL statement can be used to find the data to be processed on a specific index page; the SQL statement may also include update (UPDATE), insert (INSERT), and delete (DELETE) operations, meaning that after finding the data to be processed on the index page through the index, the update, insert, or delete operation is performed. For example, if the SQL statement includes an insert operation, after determining the index page that matches the key value, the entry on the index page that matches the key value is determined, and then the insert operation is performed on that entry.

[0117] Please refer to Figure 5. Figure 5 is a schematic diagram of the architecture of a data processing system provided in an embodiment of this application. The data processing system in Figure 5 is similar to the data processing system in Figure 1, that is, the data processing system in Figure 5 can perform the functions of the data processing system in Figure 1. The difference is that the server in Figure 5 has a Trusted Execution Environment (TEE), and the Database Management System (DBMS) is located in the TEE. The DBMS can perform the functions of the server in Figure 1 in the above embodiment. For example, when the client sends an SQL statement to the server, after the server receives the SQL statement, if the SQL statement meets the first rule, the server decrypts the first encrypted data through the DBMS, and executes the SQL statement based on the decrypted first encrypted data to obtain the first data processing result; if the SQL statement does not meet the first rule, the server executes the SQL statement based on the first encrypted data through the DBMS to obtain the second data processing result. Then the server sends the execution result to the client through the DBMS. In Figure 5, the server executes SQL statements in a TEE to improve the security of data processing. The DBMS is also located in the TEE. The DBMS is used to execute SQL statements and send the execution results to the client. The above processing is performed in the TEE, eliminating the need to switch between the TEE and non-TEE on the server side, thus reducing performance loss.

[0118] Please refer to Figure 6, which is a schematic diagram of data transmission provided in an embodiment of this application. As shown in Figure 6, server B serves as a backup server for server A. Server A can encrypt its own data and then send the encrypted data to server B to achieve data backup within the server.

[0119] Optionally, server A can also encrypt the log information and send the encrypted log information to server B. Encrypting the log information during the log information synchronization process can improve the security of the log information and reduce the risk of data leakage. The log information is used to record modifications to the database.

[0120] Optionally, the log information may include a write-ahead logging (WAL) log, which is used to record the history of database modification operations.

[0121] Please refer to Figure 7, which is a schematic diagram of the modules of a data processing system provided in an embodiment of this application. The data processing system in Figure 7 includes a client including a key management module and a first encryption / decryption module, and a server including a second encryption / decryption module.

[0122] The key management module is used for key management, generating corresponding encryption and decryption keys for each user or each user's session, and sending these keys to the server through a secure data channel. This secure data channel can be a secure channel established between the client and server based on Internet Protocol Security (IPSec) or Secure Socket Layer (SSL), or other types of secure channels.

[0123] When a user processes data on the server side through the client, in order to ensure the security of communication between the client and the server, the first encryption / decryption module obtains the encryption / decryption key from the key management module and encrypts the SQL statement using the encryption / decryption key; after the server receives the SQL statement, the second encryption / decryption module decrypts the SQL statement according to the encryption / decryption key obtained from the key management module, and then executes the SQL statement to obtain the data processing result.

[0124] Optionally, the second encryption / decryption module identifies the data to be encrypted in the data processing result, encrypts the data, and then sends the encrypted data processing result to the client. The second encryption / decryption module then decrypts the encrypted data processing result using the encryption / decryption key, allowing the user to query the decrypted data processing result.

[0125] Optionally, to ensure the security of the encryption and decryption keys, the server can store the encryption and decryption keys in memory. When the user logs out of the client or exits a specific process, the server deletes the encryption and decryption keys stored in the second encryption and decryption module.

[0126] It should be understood that the above description is merely to help those skilled in the art better understand the embodiments of this application, and is not intended to limit the scope of the embodiments of this application. Based on the examples given above, those skilled in the art can obviously make various equivalent modifications or changes. For example, some steps in the various methods described above may be unnecessary, or new steps may be added. Alternatively, any combination of two or more of the above embodiments may be used. Such modifications, changes, or combinations also fall within the scope of the embodiments of this application.

[0127] It should also be understood that the methods, situations, categories, and classifications of embodiments in this application are for the convenience of description only and should not constitute a special limitation. Various methods, categories, situations, and features in embodiments can be combined without contradiction.

[0128] It should also be understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. The order of the process numbers described above does not imply the order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0129] It should also be understood that the above description of the embodiments of this application focuses on highlighting the differences between the various embodiments. Any similarities or differences not mentioned can be referred to each other. For the sake of brevity, they will not be repeated here.

[0130] The embodiments of the methods and systems provided in this application have been described above in conjunction with Figures 1-7. The computer provided in this application is described below.

[0131] This embodiment can divide the computer into functional modules according to the above method. For example, it can be divided into functional modules corresponding to various functions, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0132] It should be noted that the relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0133] The computer provided in this application embodiment is used to execute the data processing method provided in the above method embodiment, and thus can achieve the same effect as the above implementation method.

[0134] In other embodiments, when using integrated units, the computer may include a processing module, a storage module, and a communication module. The processing module can be used to control and manage the computer's operations. For example, it can be used to support the computer in executing steps performed by the processing unit. The storage module can be used to store program code and data, etc. The communication module can be used to support communication between the computer and other network devices or computers.

[0135] The processing module can be a processor or a controller. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination of functions that implement computing capabilities, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, or other devices that interact with other computers or network equipment.

[0136] Based on the same concept, this application also provides a computer. Referring to FIG8, FIG8 shows a schematic diagram of the structure of an exemplary computer of this application. The computer shown in FIG8 can execute the steps in any of the data processing methods executed by the client or server provided in the embodiments of this application.

[0137] The computer 800 includes at least one processor 801, a memory 803, and at least one network interface 804.

[0138] The processor 801 is, for example, a general-purpose CPU, a digital signal processor (DSP), a network processor (NP), a GPU, a neural network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASICs) used to implement the solutions of this application, a programmable logic device (PLD), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0139] Optionally, the computer 800 also includes a bus 802. The bus 802 is used to transmit information between the various components of the computer 800. The bus 802 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 802 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in Figure 8, but this does not indicate that there is only one bus or one type of bus.

[0140] Memory 803 may be, for example, read-only memory (ROM) or other types of storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 803 may exist independently and be connected to processor 801 via bus 802. Memory 803 may also be integrated with processor 801.

[0141] Network interface 804 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), or wireless local area network (WLAN). Network interface 804 can include wired network interfaces and wireless network interfaces. Specifically, network interface 804 can be an Ethernet interface, such as Fast Ethernet (FE), Gigabit Ethernet (GE), Asynchronous Transfer Mode (ATM), WLAN, cellular network, or combinations thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of this application, network interface 804 can be used by computer 800 to communicate with other devices.

[0142] In specific implementations, as some embodiments, processor 801 may include one or more CPUs. Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0143] In specific implementations, as some methods, computer 800 may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0144] In some embodiments, memory 803 is used to store program instructions for executing the present application's solution, and processor 801 can execute the program instructions stored in memory 803. That is, computer 800 can implement the method provided in the above embodiments through processor 801 and the program instructions in memory 803. The program instructions may include one or more software modules. Optionally, processor 801 itself may also store program instructions for executing the present application's solution.

[0145] In specific implementation, the processor 801 in the computer 800 of this application reads the instructions in the memory 803, so that the computer 800 shown in FIG8 can execute all or part of the steps in the data processing method executed by the computer in the above embodiment.

[0146] In the above embodiments, each step of the method is implemented through integrated logic circuits in the hardware of the processor of the computer 800 or through software instructions. The steps of the method embodiments disclosed in this application can be directly implemented by the hardware processor, or implemented by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. Since the storage medium is located in memory, the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method embodiments; to avoid repetition, these will not be described in detail here.

[0147] It should be understood that the aforementioned processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting the Advanced Reduced Instruction Set Computing (RISC) machine (ARM) architecture.

[0148] Furthermore, in an alternative embodiment, the memory described above may include read-only memory and random access memory, and provide instructions and data to the processor. The memory may also include non-volatile random access memory. For example, the memory may also store device type information.

[0149] The memory can be volatile or non-volatile, or may include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0150] The computer provided in this embodiment can execute the above method embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0151] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the methods described in the above-described method embodiments.

[0152] This application also provides a computer program product that, when run on a computer, enables the computer to implement the methods described in the above-described method embodiments.

[0153] This application provides a chip, including a processor, for calling and executing instructions stored in a memory, causing a communication device with the chip installed to execute the method described in any of the computer embodiments of this application.

[0154] This application also provides a chip system including a processor coupled to a memory. The processor executes a computer program stored in the memory to implement the method described in the above-described method embodiments. The chip system may be a single chip or a chip module composed of multiple chips.

[0155] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, or magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0156] Those skilled in the art will understand that implementing all or part of the processes in the above embodiments can be accomplished by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium can include various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

[0157] The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical order indicated by the naming or numbering. The execution order of the named or numbered process steps can be changed according to the technical purpose to be achieved, as long as the same or similar technical effect can be achieved.

[0158] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0159] In the embodiments provided in this application, it should be understood that the disclosed apparatus / devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0160] It should be understood that in the description of this application and the appended claims, the terms "comprising," "including," "having," and any variations thereof are intended to cover a non-exclusive inclusion and mean "including but not limited to," unless otherwise specifically emphasized. For example, a process, method, system, product, or apparatus that includes a series of steps or modules is not necessarily limited to those steps or modules that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0161] In the description of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" in this application is used to describe the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural.

[0162] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0163] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0164] Furthermore, in the description of this application and the appended claims, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein; features defined as "first" or "second" may explicitly or implicitly include at least one of those features.

[0165] In the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0166] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A data processing method, characterized in that, Applied to the server side, the method includes: Receive Structured Query Language (SQL) statements sent by the client; If the SQL statement satisfies the first rule, then the first encrypted data corresponding to the SQL statement is decrypted, and the SQL statement is executed based on the decrypted first encrypted data to obtain the first data processing result; If the SQL statement does not satisfy the first rule, then the SQL statement is executed based on the first encrypted data corresponding to the SQL statement to obtain the second data processing result.

2. The method according to claim 1, characterized in that, The SQL statement includes multiple operators; The SQL statement satisfying the first rule includes: the plurality of operators include a first operator that satisfies the first rule; decrypting the first encrypted data corresponding to the SQL statement includes: decrypting the first encrypted data corresponding to the first operator; The SQL statement does not satisfy the first rule if: the plurality of operators does not include operators that satisfy the first rule.

3. The method according to claim 1, characterized in that, The SQL statement includes a first operator and a second operator, where the first operator corresponds to the first sub-encrypted data in the first encrypted data, and the second operator corresponds to the second sub-encrypted data in the first encrypted data. The SQL statement satisfies the first rule, including: the first operator satisfies the first rule, and the second operator does not satisfy the first rule; Decrypting the first encrypted data corresponding to the SQL statement includes: decrypting the first sub-encrypted data; not decrypting the second sub-encrypted data; Executing the SQL statement based on the decrypted first encrypted data includes: executing the first operator based on the decrypted first sub-encrypted data, and executing the second operator based on the second sub-encrypted data.

4. The method according to claim 2 or 3, characterized in that, If the input of the first operator includes a non-equivalent symbol or the first operator includes a first input and a second input, and the data types of the first input and the second input are different, and the first operator is used to operate on the first input and the second input, then the first operator satisfies the first rule.

5. The method according to any one of claims 1 to 4, characterized in that, After receiving the Structured Query Language (SQL) statement sent by the client, the method further includes: The index key value is determined based on the SQL statement, and the index key value includes the second encrypted data; Identify an index page that matches the index key value, wherein the index key value is within the key value range of the matching index page, and the key value range is determined based on the maximum and minimum values ​​of the index key values ​​in the index page; Retrieve the data to be processed for the SQL statement within the index page.

6. The method according to any one of claims 1 to 5, characterized in that, The server includes a database management system (DBMS), which is located in a trusted execution environment. The DBMS is used to execute the SQL statement to obtain the first data processing result or the second data processing result.

7. The method according to any one of claims 1 to 6, characterized in that, If the SQL statement includes multiple operators, and the input of the top-level operator depends on the output of at least one other operator, then the method further includes: If the first data processing result or the second data processing result includes data to be encrypted, then the data to be encrypted is encrypted to obtain a confidential data processing result. The first data processing result or the second data processing result is the execution result of the top-level operator.

8. The method according to any one of claims 1 to 7, characterized in that, The first encrypted data includes multiple sub-encrypted data, each sub-encrypted data corresponding to an encryption key, and at least two sub-encrypted data correspond to different encryption keys. Therefore, the method further includes: The target encrypted data is determined from among the multiple sub-encrypted data based on preset rules; The first data processing result or the second data processing result is encrypted using the encryption key corresponding to the target encrypted data to obtain the confidential data processing result.

9. The method according to any one of claims 1 to 8, characterized in that, The method further includes: The log information is encrypted and then sent to the target server.

10. A data processing system, characterized in that, The data processing system includes a client and a server; the server is used to execute the data processing method according to any one of claims 1 to 9. The server is also used to send confidential data processing results to the client, wherein the confidential data processing results are obtained by the server encrypting the first data processing result or the second data processing result.

11. The system according to claim 10, characterized in that, The client is used for: Get the initial SQL statement entered by the user; The data to be encrypted in the initial SQL statement is determined based on the operation type corresponding to the initial SQL statement. The data to be encrypted in the initial SQL statement is encrypted to obtain the SQL statement.

12. The system according to claim 11, characterized in that, If the initial SQL statement includes an INSERT statement, then the data written by the INSERT statement is the data to be encrypted; If the initial SQL statement includes a DELETE statement or a SELECT statement, then the conditional data in the conditional clause of the DELETE statement or the SELECT statement is the data to be encrypted. If the initial SQL statement includes an UPDATE statement, then the data written in the UPDATE statement and the conditional data in the conditional clause are the data to be encrypted.

13. A computer, characterized in that, include: The memory includes computer-readable instructions; A processor communicating with the memory, the processor being configured to execute the computer-readable instructions, causing the computer to perform the data processing method according to any one of claims 1-9.

14. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a computer, implement the method as described in any one of claims 1 to 9.

Images