Decryption method and apparatus for data page, computer device, readable storage medium, and program product

Abstract

The present application relates to a decryption method and apparatus for a data page, a computer device, a readable storage medium, and a program product. The method comprises: upon receiving an access request for accessing an encrypted target table, acquiring a master key, and a target value and a secondary key in a tablespace file corresponding to the target table, wherein the tablespace file comprises different data pages (202); acquiring a page identifier of a target data page among the data pages (204); on the basis of the page identifier and the target value, determining a target mode from among at least two candidate modes (206); and when the secondary key is decrypted using the master key so as to obtain a plaintext secondary key, decrypting the target data page on the basis of the target mode and the plaintext secondary key so as to obtain data corresponding to the target table (208).

Description

Data page decryption methods, devices, computer equipment, readable storage media, and program products

[0001] This application claims priority to Chinese Patent Application No. 202411632086X, filed on November 15, 2024, entitled "Method, Apparatus, Computer Equipment, and Readable Storage Medium for Decrypting Data Pages", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, readable storage medium, and program product for decrypting data pages. Background Technology

[0003] With the development of computer and internet technologies, a tablespace encryption algorithm has been developed for databases. This algorithm requires a master key and a secondary key to encrypt data pages. This encryption method effectively avoids the direct use of plaintext data on physical storage, ensuring that even if encrypted data files are stolen or lost, attackers cannot directly read the plaintext data. This greatly enhances data security and has been widely used in various databases.

[0004] However, current data page decryption methods based on the aforementioned tablespace encryption scheme require both a master key and a secondary key to decrypt the data page. In extreme cases, such as when both the encrypted data file and the database master key are stolen, attackers can use the master key to decrypt the data file, leading to the theft or loss of plaintext data. Therefore, improving the security of data in the database is a pressing issue that needs to be addressed. Summary of the Invention

[0005] According to various embodiments of this application, a method, apparatus, computer device, readable storage medium, and program product for decrypting data pages are provided.

[0006] In a first aspect, this application provides a method for decrypting a data page, the method comprising: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; obtaining a page identifier of a target data page among the data pages; determining a target method from at least two candidate methods based on the page identifier and the target value; and, if the secondary key is decrypted using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

[0007] In one embodiment, before obtaining the master key and the target value and secondary key in the tablespace file corresponding to the target table, the method further includes: randomly generating a hash value when creating the target table; the hash value belonging to a preset value range; storing the hash value as the target value in a preset position in the header of the tablespace file corresponding to the target table; determining a target method from at least two candidate methods based on the target value and the page identifier of the data page; encrypting the data page based on the target method and the plaintext secondary key, and encrypting the plaintext secondary key using the master key to obtain a secondary key, and storing the secondary key in the header of the tablespace file corresponding to the target table.

[0008] In one embodiment, obtaining the master key and the target value and secondary key in the tablespace file corresponding to the target table includes: obtaining the master key from memory; obtaining the secondary key from the header of the tablespace file corresponding to the target table; and obtaining the target value from a preset position in the header.

[0009] In one embodiment, the page identifier includes a page number; determining the target method from at least two candidate methods based on the page identifier and the target value includes: performing a modulo operation on the page number to obtain a remainder value; performing a bitwise operation between the remainder value and the target value to obtain a result value; and determining the target method from at least two candidate methods based on the result value.

[0010] In one embodiment, the candidate method includes candidate algorithms; the target method includes a target algorithm; determining the target method from at least two candidate methods based on the result value includes: when the result value is a first value, selecting a first candidate algorithm from at least two candidate algorithms as the target algorithm; wherein the first value is associated with the first candidate algorithm; and when the result value is not the first value, selecting other candidate algorithms from at least two candidate algorithms as the target algorithm.

[0011] In one embodiment, the access request carries a client identifier, and the method further includes: when the client corresponding to the client identifier accesses the target table for the first time, verifying the client identifier to obtain a verification result; when the verification result indicates that the verification is successful, sending a response message to the client to prompt for password information; and when the password information returned by the client is received, matching the password information with a preset password to obtain a matching result; after decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table, the method further includes: when the matching result indicates that the matching is successful, returning the data corresponding to the target table to the client corresponding to the client identifier.

[0012] In one embodiment, the method further includes: receiving a key rotation request; determining an updated master key based on the key rotation request; encrypting the plaintext secondary key using the updated master key to obtain an updated secondary key; and storing the updated secondary key in the header of the tablespace file corresponding to the target table.

[0013] Secondly, this application also provides a data page decryption apparatus, comprising: an acquisition module, configured to, upon receiving an access request for accessing an encrypted target table, acquire a master key and a target value and a secondary key in a tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; acquire a page identifier of a target data page among the data pages; a determination module, configured to, based on the page identifier and the target value, determine a target method from at least two candidate methods; and a decryption module, configured to, when decrypting the secondary key using the master key to obtain a plaintext secondary key, decrypt the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

[0014] Thirdly, this application also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor, when executing the computer program, performs the following steps: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; obtaining a page identifier of a target data page in the data pages; determining a target method from at least two candidate methods based on the page identifier and the target value; and, if the secondary key is decrypted using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

[0015] Fourthly, this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, performs the following steps: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; obtaining a page identifier of a target data page in the data pages; determining a target method from at least two candidate methods based on the page identifier and the target value; and, if the secondary key is decrypted using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

[0016] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps: upon receiving an access request for accessing an encrypted target table, obtaining a master key and a target value and a secondary key in a tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; obtaining a page identifier of a target data page in the data pages; determining a target method from at least two candidate methods based on the page identifier and the target value; and, if the secondary key is decrypted using the master key to obtain a plaintext secondary key, decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

[0017] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features and advantages of this application will become apparent from the specification, drawings, and claims. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 is an application environment diagram of the data page decryption method in one embodiment;

[0020] Figure 2 is a flowchart illustrating a data page decryption method in one embodiment;

[0021] Figure 3 is a schematic diagram of the encryption logic of the hybrid algorithm in one embodiment;

[0022] Figure 4 is a schematic diagram of encryption and decryption processing using the sm4 algorithm in one embodiment;

[0023] Figure 5 is a schematic diagram of the trusted authentication process in one embodiment;

[0024] Figure 6 is a structural block diagram of a data page decryption device in one embodiment;

[0025] Figure 7 is an internal structure diagram of a computer device in one embodiment. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0027] The data page decryption method provided in this application embodiment can be applied to the application environment shown in Figure 1. Terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated on server 104 or placed on a cloud or other network server. When server 104 receives an access request from terminal 102 for accessing an encrypted target table, server 104 obtains the master key and the target value and secondary key from the tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; further, server 104 obtains the page identifier of the target data page in the data pages, and determines the target method from at least two candidate methods based on the page identifier and the target value; if server 104 uses the master key to decrypt the secondary key to obtain a plaintext secondary key, server 104 decrypts the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table, and returns the obtained target table data to terminal 102. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0028] In an exemplary embodiment, as shown in FIG2, a method for decrypting a data page is provided, which is illustrated by example of being executed by the server in FIG1, and includes the following steps 202 to 208.

[0029] Step 202: Upon receiving an access request for accessing the encrypted target table, obtain the master key and the target value and secondary key in the tablespace file corresponding to the target table; wherein, the tablespace file includes different data pages.

[0030] The target table refers to a table in a database used to store data. For example, the target table in this application can be an encrypted data table, meaning that accessing the target table requires decryption before the corresponding data can be obtained.

[0031] The master key is the key used to encrypt the secondary key. For example, the encryption key for data page A is a randomly generated secondary key, which is encrypted by the master key and stored in the header of the tablespace file.

[0032] A tablespace file is a file used to store data pages. For example, the tablespace file in this application includes at least different data pages and a secondary key.

[0033] The target value refers to the value that is stored in a preset location in the tablespace file corresponding to the target table. For example, in this application, the target value may be a hash number that is randomly generated in advance when the target table is created.

[0034] A secondary key is a key used to encrypt (or decrypt) a data page. For example, for data page A, the server can encrypt data page A based on the secondary key and the target encryption algorithm to obtain the encrypted data page A.

[0035] A data page is a page in a database used to store actual data records. Pages in a database can be divided into several types, each with a different purpose. For example, page types include data pages, index pages, and log pages. It can be understood that different data pages in this application can be stored in the same tablespace file.

[0036] Optionally / exemplarily, when a client first establishes a connection with the server, or when a client first sends an access request to access the encrypted target table, the server can obtain the client identifier carried in the access request and perform trusted authentication based on the client identifier. Only when the trusted authentication is successful will the server trigger subsequent processing. That is, if the trusted authentication is successful, the server can obtain the master key and the target value and secondary key from the tablespace file corresponding to the target table. For example, the server can first obtain the master key from its own memory and obtain the secondary key and target value from the table header of the tablespace file corresponding to the target table. In this application, the tablespace file includes different data pages, such as data page A, data page B, and data page C.

[0037] For example, suppose the server receives an access request from client A to access the encrypted target table 1. The server can obtain the client identifier (client A102) carried in the access request and perform trusted authentication based on this client identifier (client A102). Only if the trusted authentication is successful will the server execute the subsequent processing flow. That is, if the trusted authentication is successful, the server first retrieves the master key Q from its own memory and retrieves the secondary key M and the target value S=53 from the header of the tablespace file corresponding to target table 1. The tablespace file includes at least data page A, data page B, and data page C.

[0038] Step 204: Obtain the page identifier of the target data page in the data page.

[0039] The target data page refers to one or more data pages determined from the different data pages included in the tablespace file. For example, if the tablespace file includes at least data page A, data page B, and data page C, then the target data page can be data page A selected from data pages A, B, and C.

[0040] A page identifier is an identifier used to identify a unique data page. For example, in this application, a page identifier can be a page number.

[0041] Step 206: Determine the target method from at least two candidate methods based on the page identifier and the target value.

[0042] Here, candidate methods refer to pre-configured encryption / decryption methods or algorithms. For example, candidate methods in this application include, but are not limited to: encryption methods using the SM4 algorithm and encryption methods using the AES algorithm.

[0043] The target method refers to a specific encryption / decryption method or algorithm determined from the candidate methods. For example, the target method in this application could be an encryption method using the SM4 algorithm, determined from the candidate methods. It is understood that both the candidate methods and the target method in this application are methods used for encryption (or decryption).

[0044] Optionally / exemplarily, after obtaining the master key and the target value and secondary key in the tablespace file corresponding to the target table, the server can obtain the page identifier of the target data page from different data pages in the tablespace file. For example, the server can obtain the page number of the target data page as 002 from the tablespace file. Further, the server can determine the target method from at least two candidate methods based on the page identifier and the target value. For example, the server can perform a modulo operation on the page number of the target data page to obtain a remainder value, and then perform a bitwise operation between the obtained remainder value and the target value to obtain a result value. The server can then determine the target method from at least two candidate methods based on the result value.

[0045] For example, the server first retrieves the master key Q from its own memory, and then obtains the secondary key M and the target value S = 33 (corresponding to binary 0x0000000000010001) from the header of the tablespace file corresponding to target table 1. Assuming that the tablespace file corresponding to target table 1 contains at least data page A, data page B, and data page C, the server can obtain the page number p = 50 of the target data page, i.e., data page B, from the tablespace file. Further, based on the page identifier (p = 50) and the target value (S = 53), the server performs a modulo operation on the page number p = 50, i.e., 50 mod 16, to obtain a remainder of 2. This remainder 2 is then bitwise operated with the target value S = 33 (corresponding to binary 0x00000000000010001) to obtain the result value R. Based on the result value R, the server determines the target method from at least two candidate methods: encryption using the AES algorithm.

[0046] Step 208: After decrypting the secondary key using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

[0047] In this context, the plaintext secondary key refers to the actual key obtained by decrypting the encrypted secondary key. For example, if the encrypted secondary key is As, decrypting the (encrypted) secondary key As yields the actual key 098999, which is the plaintext secondary key.

[0048] Optionally / exemplarily, after determining the target method from at least two candidate methods based on the page identifier and the target value, the server can use the obtained master key to decrypt the secondary key to obtain the plaintext secondary key. Furthermore, with the plaintext secondary key obtained, the server can decrypt the target data page based on the determined target method and the plaintext secondary key to obtain the plaintext data, i.e., the actual data, corresponding to the target table from the target data page.

[0049] For example, suppose the server determines the target method from at least two candidate methods as follows: after using the AES algorithm for encryption, the server can use the obtained master key Q to decrypt the secondary key M to obtain the plaintext secondary key m. Furthermore, with the plaintext secondary key m, the server can decrypt the target data page based on the determined target method, i.e., using the AES algorithm and the plaintext secondary key m, to obtain the plaintext data corresponding to the target table from the target data page, i.e., the actual data, and respond to the access request by returning the plaintext data corresponding to the target table to the client that sent the access request.

[0050] In this embodiment, upon receiving an access request for accessing an encrypted target table, the master key and the target value and secondary key in the tablespace file corresponding to the target table are obtained; wherein, the tablespace file includes different data pages; further, the page identifier of the target data page in the data page is obtained, and based on the page identifier and the target value, the target method is determined from at least two candidate methods; if the secondary key is decrypted using the master key to obtain the plaintext secondary key, the target data page is decrypted based on the target method and the plaintext secondary key to obtain the data corresponding to the target table. Because the target value and secondary key are pre-stored in the tablespace file, upon receiving an access request for accessing the encrypted target table, the target value and secondary key can be directly obtained from the tablespace file corresponding to the target table. Based on the target value and the page identifiers of different data pages in the same tablespace file, the target method for different data pages is determined from at least two candidate methods. When the master key is used to decrypt the secondary key to obtain the plaintext secondary key, the target data page is decrypted based on the target method and the plaintext secondary key to obtain the actual data corresponding to the target table. This enables different data pages within the same tablespace to be decrypted using different target methods, thereby effectively improving the security of data in the database.

[0051] In an exemplary embodiment, before obtaining the target value and secondary key in the tablespace file corresponding to the master key and the target table, the method further includes:

[0052] When creating the target table, a hash value is randomly generated; the hash value belongs to a preset value range.

[0053] Store the hash value as the target value in a preset position in the header of the tablespace file corresponding to the target table;

[0054] Based on the target value and the page identifier of the data page, determine the target method from at least two candidate methods;

[0055] The data page is encrypted based on the target method and the plaintext secondary key. The plaintext secondary key is then encrypted using the master key to obtain the secondary key, which is stored in the header of the tablespace file corresponding to the target table.

[0056] The table header of a tablespace file refers to the first n rows of data in the tablespace file. For example, the first and second rows of the tablespace file can be used as the table header, which is used to store the secondary key and the target value.

[0057] The preset position in the table header can be a specific position that is set in advance. For example, 2 bytes of space can be reserved in the table header to store the target value.

[0058] Specifically, as shown in Figure 3, this is a schematic diagram of the encryption logic of the hybrid algorithm. As shown in Figure 3, when creating the target table to be encrypted, the server can randomly generate a hash value within a preset range (0-65535). For example, the server can randomly generate a value between 0 and 65535 and record this value as S_RAND. Furthermore, the server can store this value S_RAND as the target value in a preset position in the header of the tablespace file corresponding to the target table. For example, the server can store this value S_RAND as the target value in a reserved 2-byte space in the header of the tablespace file corresponding to the target table. Further, the server can determine the target method from at least two candidate methods based on the target value S_RAND and the page identifier (page number) of the data page. For example, the server can perform a modulo operation on the page number of each data page to obtain a remainder value. This remainder value is then bitwise operated with the target value S_RAND to obtain a result value R. Based on the result value R, the server determines the target encryption method for each data page from at least two candidate methods. This allows the server to encrypt each data page using the determined target encryption method and the plaintext secondary key, and then encrypt the plaintext secondary key using the master key to obtain the encrypted secondary key. The encrypted secondary key is then stored in the header of the tablespace file corresponding to the target table. This allows for the dynamic determination of the encryption method for different data pages using page identifiers and randomly generated target values. This enables the mixed use of SM4 and AES algorithms for different data pages within the same tablespace, effectively improving the security of data in the database.

[0059] In an exemplary embodiment, the step of obtaining the target value and secondary key in the tablespace file corresponding to the master key and the target table includes:

[0060] Retrieve the master key from memory;

[0061] Obtain the secondary key from the header of the tablespace file corresponding to the target table, and obtain the target value from a preset position in the header.

[0062] Specifically, when the server receives an access request for accessing the encrypted target table for the first time, it can read the master key from either local or remote storage and load it into memory. This allows the server to directly read the master key from memory for subsequent accesses, effectively avoiding the time overhead of rereading the master key from the remote storage every time the encrypted table is accessed, thus improving execution and data processing efficiency. Furthermore, the server can obtain the secondary key from the header of the tablespace file corresponding to the target table, and the target value from a preset location within the header. For example, assuming that when creating the target table to be encrypted, the server stores the randomly generated hash value S_RAND as the target value in a reserved 2-byte space in the header of the tablespace file corresponding to the target table, and also stores the encrypted secondary key in the header of the tablespace file corresponding to the target table, the server can obtain the target value S_RAND from the reserved 2-byte space in the header of the tablespace file corresponding to the target table, and also obtain the encrypted secondary key from the header of the tablespace file corresponding to the target table. This allows the encryption method of different data pages to be dynamically determined by using the page identifier of different data pages and the randomly generated target value. This enables the use of a mixed encryption method of SM4 and AES algorithms for different data pages within the same tablespace, thereby effectively improving the security of data in the database.

[0063] In an exemplary embodiment, the page identifier includes a page number; the step of determining the target method from at least two candidate methods based on the page identifier and the target value includes:

[0064] Perform a modulo operation on the page number to obtain the remainder value;

[0065] Perform a bitwise operation between the remainder and the target value to obtain the result value;

[0066] Based on the result value, the target method is determined from at least two candidate methods.

[0067] Specifically, assuming the server obtains the master key Q from its own memory, and obtains the secondary key M and the target value S = 33 (corresponding to binary 0x0000000000010001) from the header of the tablespace file corresponding to the target table 1, and obtains the page number p = 50 of the target data page (i.e., data page B) from the tablespace file, as shown in Figure 3, the server can perform a modulo operation on the page number p = 50 of the target data page based on the page identifier (p = 50) and the target value (S = 53), i.e., 50 mod 16, to obtain the remainder value 2. Then, the server performs a bitwise operation with the target value S = 33 (corresponding to binary 0x00000000000010001) to obtain the result value R. Based on the result value R, the server determines the target method from at least two candidate methods as: encryption using the AES algorithm.

[0068] In this embodiment, the result value R can be calculated using the following formula: R = S_RAND | (1 << (PAGE_NO mod 16))

[0069] Where R is 1, the sm4 algorithm is used; otherwise, the aes algorithm is used. S_RAND is the target value stored in the table header, and PAGE_NO is the page number of the data page.

[0070] In this embodiment, the encryption algorithm for different data pages can be dynamically determined by the page identifier of the data page and the randomly generated target value. This realizes the encryption method of using SM4 and AES algorithms in combination for different data pages in the same tablespace, thereby effectively improving the security of data in the database.

[0071] In an exemplary embodiment, the candidate methods include candidate algorithms; the target method includes a target algorithm; the step of determining the target method from at least two candidate methods based on the result value includes:

[0072] When the result value is the first value, the first candidate algorithm is selected as the target algorithm from at least two candidate algorithms; wherein, the first value and the first candidate algorithm are related.

[0073] If the result value is not the first value, select other candidate algorithms from at least two candidate algorithms as the target algorithm.

[0074] The first value can be 1 or 5. The relationship between the first value and the first candidate algorithm can be a pre-set mapping relationship. For example, when the result value is the first value, the first candidate algorithm, i.e., the sm4 algorithm, is used.

[0075] Specifically, Figure 4 illustrates the encryption and decryption process using the SM4 algorithm. Assuming the candidate algorithms include two encryption algorithms, SM4 and AES, and the first value is associated with the SM4 algorithm, when the result value R is the first value, the server can select the first candidate algorithm (SM4) as the target algorithm from at least two candidate algorithms (SM4 and AES). The first value (1 or 5) is associated with the first candidate algorithm (SM4). When the result value R is not the first value, the server selects another candidate algorithm (AES) as the target algorithm from at least two candidate algorithms (SM4 and AES). This allows the encryption algorithm for different data pages to be dynamically determined using the page identifier and randomly generated target value, enabling the mixed use of SM4 and AES encryption algorithms across different data pages within the same tablespace, thereby effectively improving the security of data in the database.

[0076] In one exemplary embodiment, the access request carries a client identifier, and the method further includes:

[0077] When the client corresponding to the client identifier accesses the target table for the first time, the client identifier is validated to obtain the validation result;

[0078] When the verification result indicates that the verification is successful, a response message prompting the client to enter the password information is sent.

[0079] When the password information returned by the client is received, it is matched with the preset password to obtain the matching result;

[0080] After decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table, the method further includes:

[0081] When the matching result indicates a successful match, the data corresponding to the target table is returned to the client identified by the client identifier.

[0082] When the matching result indicates that the match failed, an access denied message is returned.

[0083] Specifically, as shown in Figure 5, this is a schematic diagram of the trusted authentication process. When the server receives an initial access request from a client to access an encrypted target table, the server can obtain the client identifier carried in the access request. That is, when the client corresponding to this client identifier first establishes an interaction with the server or accesses data for the first time, the server needs to verify the client identifier and obtain the verification result. When the verification result indicates that the verification is successful, the server can send a response message to the client prompting for password information. When the server receives the password information returned by the client, it can match the password information returned by the client with a preset password to obtain a matching result. When the matching result indicates a successful match, it means that the client has passed trusted authentication, and the server can subsequently return the data corresponding to the target table obtained after decryption to the client corresponding to the client identifier. When the matching result indicates a failed match, it means that the client cannot pass trusted authentication, and the server can return an access denied message. In this way, by configuring a password authentication process for accessing encrypted tables, the server achieves the management of the granular visibility range of encrypted data. Users who cannot pass password authentication do not have permission to view the data, further improving data security.

[0084] In one exemplary embodiment, the method further includes:

[0085] Receive key rotation request;

[0086] The master key is determined and updated based on the key rotation request;

[0087] The plaintext secondary key is encrypted using the updated master key to obtain the updated secondary key, which is then stored in the header of the tablespace file corresponding to the target table.

[0088] Among them, a key rotation request refers to a request to change the master key. For example, if the master key is insecure, a user (user or administrator) can initiate a key rotation request.

[0089] Specifically, the server receives a key rotation request from the client and determines the updated master key based on the request. For example, the server updates master key A to master key B, and uses the updated master key B to encrypt the plaintext secondary key Q, obtaining the encrypted updated secondary key B+Q. This encrypted updated secondary key B+Q is then stored in the header of the tablespace file corresponding to the target table, thus completing the key rotation and update. This allows the server to simply re-encrypt the secondary key update using the new master key, avoiding the significant overhead of re-encrypting all encrypted tablespace data pages in the database, effectively improving the processing efficiency of key updates.

[0090] In one exemplary embodiment, the method provided in this application can be applied to the decryption or encryption of data pages in various scenarios. The following example of encrypting and decrypting different data pages within the same tablespace in a database will be used to illustrate the data page decryption method provided in this application.

[0091] The problems and drawbacks of the traditional approach include:

[0092] Currently, a traditional tablespace encryption algorithm is used in the database field. A master key is stored on the server or elsewhere, and the actual encryption / decryption key for the data pages is a randomly generated secondary key (also called the tablespace key), which is encrypted with the master key and stored in the tablespace header. Encrypting data pages using the secondary key in the tablespace avoids directly writing plaintext data to disk, ensuring that even if data files are stolen or lost, attackers cannot directly read the plaintext data, greatly enhancing data security. This method has been widely used in various databases.

[0093] However, in extreme scenarios where both data files and master keys are stolen simultaneously, attackers can decrypt the data files simply by using default algorithms. This is unacceptable for users with high security requirements. In other words, if the database master key is stolen, attackers can directly decrypt the file data, leading to the theft or loss of plaintext data files. Therefore, improving the security of data in the database has become an urgent problem to be solved.

[0094] Therefore, to address the aforementioned issues, this application provides a more secure hybrid encryption method for data pages, building upon traditional tablespace encryption schemes. This method prevents attackers from decrypting plaintext data using the default encryption algorithm in scenarios where both the master key and data file are lost. It also provides trusted authentication capabilities, allowing only clients with authenticated passwords to query encrypted table data, further enhancing data security.

[0095] The purpose of this application is to provide a hybrid encryption method for data pages. By combining the page number inherent in the data page with a newly added random hash in the tablespace header, it enables the mixed use of SM4 and AES algorithms for encryption of different data pages within the same tablespace, thus achieving hybrid encryption. Simultaneously, trusted authentication is implemented on the server side, allowing configuration of password authentication for access to encrypted tables to further enhance data security.

[0096] As shown in Figure 3, an embodiment of this application provides a hybrid encryption method for data pages, specifically including:

[0097] 1. Master Key Acquisition Module: After the server reads the master key from the local or remote end, it loads the key information into memory, avoiding the overhead of rereading the key every time the encryption table is accessed, thus improving execution efficiency.

[0098] 2. Encryption / Decryption Module: Modify the tablespace header content by adding 2 bytes (16 bits) of space in the reserved area as a random hash. During encryption, the page number and this random value are used to determine whether to use the AES or SM4 algorithm for encryption / decryption of the data page. The specific process is as follows:

[0099] (1) When creating the table (encrypted table), a value between 0 and 65535 is randomly generated in the header of the table space, denoted as S_RAND, and stored in this location as a bitmap for subsequent arithmetic operations.

[0100] (2) Use the data page number, denoted as PAGE_NO, and take the remainder N when divided by 16. Then perform bit operations on the remainder N with the random number S_RAND. If the Nth bit from the right in the binary corresponding to S_RAND is 1, then use the sm4 algorithm; otherwise, use the aes algorithm. The overall formula is in the form R = S_RAND|(1<<(PAGE_NO mod 16)). The specific processing flow is shown in Figure 3.

[0101] (3) If the result R is 1, the SM4 algorithm is used; otherwise, the AES algorithm is used. After determining the algorithm to be used, the data page is then encrypted or decrypted. A simple example is as follows: S_RAND = 33 (corresponding to binary 0x0000000000010001). If PAGE_NO = 50, 50 mod 16 gives the number 2. Since the second bit from the right in the binary representation of S_RAND is 0, the AES algorithm is used. Similarly, if PAGE_NO = 49, the SM4 algorithm is used.

[0102] (4) When splitting and merging data pages, since the pages in memory are already decrypted, they can be decrypted and stored according to the rules in step 2.

[0103] 3. Key rotation module: If the user feels that the master key is not secure, the user can initiate a key rotation request. After receiving the request, the server only needs to re-encrypt the secondary key to update, avoiding the huge overhead of re-encrypting all encrypted tablespace data pages in the database.

[0104] 4. Trusted Authentication Module: After configuring password authentication for encrypted table access, as shown in Figure 5, when the server accesses the encrypted table for the first time in this session, it verifies whether the client is a trusted client. If trusted, it initiates a password authentication process, prompting the user to enter a password sent via SMS, and matches the user's password information with the password returned from the remote end. If the client is not trusted or the password authentication fails, the user cannot access the relevant content of the encrypted table. After successful authentication, the relevant operations on the encrypted table are audited. This operation refines the management of the visible scope of encrypted data, improving the security level of the encrypted table.

[0105] The hybrid encryption method for data pages provided by this invention has the following advantages:

[0106] 1. Because different data pages within the same tablespace use a mix of SM4 and AES encryption methods, even in the event of a data breach and loss of the master key, attackers cannot directly decrypt data pages using a single algorithm, resulting in higher security.

[0107] 2. Server-side trusted authentication is configured, which includes server-side trusted authentication configuration and client interaction logic. The management of the visibility scope of encrypted data is further refined. Users who cannot be authenticated by password do not have permission to view the data, thus further improving security.

[0108] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0109] Based on the same inventive concept, this application also provides a data page decryption apparatus for implementing the data page decryption method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more data page decryption apparatus embodiments provided below can be found in the limitations of the data page decryption method described above, and will not be repeated here.

[0110] In an exemplary embodiment, as shown in FIG6, a data page decryption device is provided, including: an acquisition module 602, a determination module 604, and a decryption module 606, wherein:

[0111] The acquisition module 602 is used to acquire, upon receiving an access request for accessing an encrypted target table, the master key and the target value and secondary key in the tablespace file corresponding to the target table; wherein the tablespace file includes different data pages; and to acquire the page identifier of the target data page in the data pages.

[0112] The determination module 604 is used to determine the target method from at least two candidate methods based on the page identifier and the target value.

[0113] The decryption module 606 is used to decrypt the target data page based on the target method and the plaintext secondary key, after decrypting the secondary key using the master key to obtain the plaintext secondary key, so as to obtain the data corresponding to the target table.

[0114] In one embodiment, the apparatus further includes: a generation module, configured to randomly generate a hash value when creating the target table; the hash value being within a preset value range; a storage module, configured to store the hash value as a target value in a preset position in the header of the tablespace file corresponding to the target table; a determination module, further configured to determine a target method from at least two candidate methods based on the target value and the page identifier of the data page; an encryption module, configured to encrypt the data page based on the target method and a plaintext secondary key, and encrypt the plaintext secondary key using the master key to obtain a secondary key; the storage module, further configured to store the secondary key in the header of the tablespace file corresponding to the target table.

[0115] In one embodiment, the acquisition module is further configured to acquire the master key from memory; acquire the secondary key from the header of the tablespace file corresponding to the target table; and acquire the target value from a preset position in the header.

[0116] In one embodiment, the page identifier includes a page number; the device further includes: a calculation module, configured to perform a modulo operation on the page number to obtain a remainder value; perform a bitwise operation on the remainder value and the target value to obtain a result value; the determination module is further configured to determine a target method from at least two candidate methods based on the result value.

[0117] In one embodiment, the candidate method includes candidate algorithms; the target method includes a target algorithm; the apparatus further includes: a selection module, configured to select a first candidate algorithm as the target algorithm from at least two candidate algorithms when the result value is a first value; wherein the first value is associated with the first candidate algorithm; and to select other candidate algorithms as the target algorithm from at least two candidate algorithms when the result value is not the first value.

[0118] In one embodiment, the access request carries a client identifier, and the device further includes: a verification module, configured to verify the client identifier when the client corresponding to the client identifier accesses the target table for the first time, and obtain a verification result; a sending module, configured to send a response message prompting the client to enter password information when the verification result indicates that the verification is successful; a matching module, configured to match the password information returned by the client with a preset password when the password information is received, and obtain a matching result; the sending module is further configured to return the data corresponding to the target table to the client corresponding to the client identifier when the matching result indicates that the matching is successful.

[0119] The modules in the aforementioned data page decryption device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0120] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 7. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores decrypted data for data pages. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data page decryption method.

[0121] Those skilled in the art will understand that the structure shown in Figure 7 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0122] In one exemplary embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0123] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0124] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0125] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0126] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0127] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0128] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method of decrypting a data page, wherein, The method includes: Upon receiving an access request for accessing an encrypted target table, the system obtains the master key and the target value and secondary key from the tablespace file corresponding to the target table; wherein the tablespace file includes different data pages. Obtain the page identifier of the target data page within the data page; Based on the page identifier and the target value, a target method is determined from at least two candidate methods; and, When the master key is used to decrypt the secondary key to obtain the plaintext secondary key, the target data page is decrypted based on the target method and the plaintext secondary key to obtain the data corresponding to the target table.

2. The method of claim 1, wherein, Before obtaining the master key and the target value and secondary key in the tablespace file corresponding to the target table, the method further includes: When creating the target table, a hash value is randomly generated; the hash value belongs to a preset value range. The hash value is stored as the target value in a preset position in the header of the tablespace file corresponding to the target table; Based on the target value and the page identifier of the data page, a target method is determined from at least two candidate methods; and, The data page is encrypted based on the target method and the plaintext secondary key, and the plaintext secondary key is encrypted using the master key to obtain the secondary key. The secondary key is then stored in the header of the tablespace file corresponding to the target table.

3. The method of claim 2, wherein, The step of obtaining the master key and the target value and secondary key in the tablespace file corresponding to the target table includes: Retrieve the master key from memory; and, The secondary key is obtained from the header of the tablespace file corresponding to the target table, and the target value is obtained from a preset position in the header.

4. The method according to any one of claims 1 to 3, wherein, The page identifier includes the page number; The step of determining the target method from at least two candidate methods based on the page identifier and the target value includes: Perform a modulo operation on the page number to obtain the remainder value; Perform a bitwise operation between the remainder value and the target value to obtain the result value; and, Based on the result value, the target method is determined from at least two candidate methods.

5. The method of claim 4, wherein, The candidate method includes candidate algorithms; the target method includes a target algorithm; The step of determining the target method from at least two candidate methods based on the result value includes: When the result value is a first value, a first candidate algorithm is selected as the target algorithm from at least two candidate algorithms; wherein the first value is correlated with the first candidate algorithm; and, When the result value is not the first value, other candidate algorithms are selected from at least two candidate algorithms as the target algorithm.

6. The method according to any one of claims 1 to 5, wherein, The access request carries a client identifier, and the method further includes: When the client corresponding to the client identifier accesses the target table for the first time, the client identifier is verified to obtain the verification result; When the verification result indicates that the verification passed, a response message prompting the client to enter password information is sent; and... When the password information returned by the client is received, the password information is matched with the preset password to obtain the matching result; After decrypting the target data page based on the target method and the plaintext secondary key to obtain the data corresponding to the target table, the method further includes: When the matching result indicates a successful match, the data corresponding to the target table is returned to the client corresponding to the client identifier.

7. A decryption apparatus of a data page, wherein, The device includes: The acquisition module is used to, upon receiving an access request for accessing an encrypted target table, acquire the master key and the target value and secondary key in the tablespace file corresponding to the target table; wherein, the tablespace file includes different data pages; and acquire the page identifier of the target data page in the data pages; The determination module is configured to determine a target method from at least two candidate methods based on the page identifier and the target value; and, The decryption module is used to decrypt the target data page based on the target method and the plaintext secondary key, after decrypting the secondary key using the master key to obtain the plaintext secondary key, so as to obtain the data corresponding to the target table.

8. A computer device comprising a memory and a processor, the memory storing a computer program, wherein, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, wherein, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images