WO2024087312A1 - Database access method, computing device and server - Google Patents

Abstract

A database access method, a computing device and a server. The method comprises: sending a first access request for a database to a database server, wherein the first access request comprises a preset character which is used for replacing a first parameter value of a first parameter, and a data table, access to which is requested by means of the first access request, comprises a ciphertext parameter value of the first parameter; receiving response information from the server, wherein mode information of the data table is stored in the server, the mode information comprises an identifier of an encryption algorithm corresponding to ciphertext data in the data table, the response information is generated on the basis of the mode information and the first access request, and the response information is used for indicating that the first parameter value corresponds to a first encryption algorithm; encrypting the first parameter value on the basis of the first encryption algorithm, so as to obtain a first ciphertext parameter value; and sending the first ciphertext parameter value to the server, so as to access the data table.

Description

A database access method, computing device and server

This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on October 28, 2022, with application number 202211337813.0 and application name “A Database Access Method, Computing Device and Server”, the entire contents of which are incorporated by reference in this application.

Technical Field

The embodiments of the present specification belong to the field of database technology, and more particularly, relate to a database access method, a computing device, and a server.

Background technique

In an encrypted database, sensitive content contained in sensitive columns can be selectively encrypted to avoid data leakage and destruction by attacks. Similar to non-encrypted databases, encrypted database operations involve components such as applications, database drivers, and database servers. The applications and database drivers are deployed in computing devices, and the database servers are deployed in database servers. The application is unaware of the encryption and decryption process and only provides the driver with the keys required for encryption. The driver and the database server communicate through a specific encryption protocol. The encryption protocol defines how Structured Query Language (SQL) statements such as insert, query, update, and delete are converted from plain text to ciphertext-based operations.

Summary of the invention

The object of the present invention is to provide a database access method to save computing resources and storage resources on the computing device side.

A first aspect of the present specification provides a database access method, comprising:

Sending a first access request to a database server, wherein the first access request includes a preset character used to replace a first parameter value of a first parameter, and the data table accessed by the first access request includes a ciphertext parameter value of the first parameter;

receiving response information from the server, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter, wherein the response information is generated based on the mode information and the first access request, and wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

Encrypting the first parameter value based on the first encryption algorithm to obtain a first ciphertext parameter value;

The first ciphertext parameter value is sent to the server for accessing the data table.

A second aspect of the present specification provides a database access method, which is executed by a database server and includes:

receiving a first access request from a computing device, the first access request including a preset character for replacing a first parameter value of a first parameter, the data table accessed by the first access request including the ciphertext parameter value of the first parameter, the server storing mode information of the data table, the mode information including an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter;

determining response information according to the first access request and the mode information, the response information being used to indicate that the first parameter value corresponds to a first encryption algorithm;

sending the response information to the computing device;

receiving a first ciphertext parameter value from the computing device, the first ciphertext parameter value being obtained by encrypting the first parameter value based on the first encryption algorithm;

The data table is accessed based on the first access request and the first ciphertext parameter value.

A third aspect of the present specification provides a computing device, including:

a sending unit, configured to send a first access request to a database server, wherein the first access request includes a preset character used to replace a first parameter value of a first parameter, and a data table accessed by the first access request includes a ciphertext parameter value of the first parameter;

a receiving unit, configured to receive response information from the server, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter, wherein the response information is generated based on the mode information and the first access request, and wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

an encryption unit, configured to encrypt the first parameter value based on the first encryption algorithm to obtain a first ciphertext parameter value;

The sending unit is further used to send the first ciphertext parameter value to the server for accessing the data table.

A fourth aspect of the present specification provides a database server, comprising:

a receiving unit, configured to receive a first access request from a computing device, wherein the first access request includes a preset character for replacing a first parameter value of a first parameter, wherein a data table to be accessed by the first access request includes a ciphertext parameter value of the first parameter, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter;

a determining unit, configured to determine response information according to the first access request and the mode information, wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

A sending unit, configured to send the response information to the computing device;

The receiving unit is further configured to receive a first ciphertext parameter value from the computing device, where the first ciphertext parameter value is obtained by encrypting the first parameter value based on the first encryption algorithm;

An access unit, configured to access the data table based on the first access request and the first ciphertext parameter value.

A fifth aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first aspect or the second aspect.

A sixth aspect of the present specification provides a computer device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect or the second aspect is implemented.

Through the database access method provided in the embodiment of this specification, the server determines the encryption algorithm corresponding to the parameter value in the SQL statement based on the SQL statement and the schema, and sends the determination result to the driver end, so that the driver end does not need to store the schema or rewrite the SQL statement according to the schema, saving storage resources and computing resources.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

FIG1 is a system structure diagram of an embodiment of this specification;

FIG2 is a flow chart of a database access method in an embodiment of the present specification;

FIG3 is a flow chart of a method for performing a query operation on a database in an embodiment of this specification;

FIG4 is an architecture diagram of a computing device according to an embodiment of the present specification;

FIG. 5 is an architecture diagram of a database server in an embodiment of this specification.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be described clearly and completely below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

FIG1 is a system structure diagram in an embodiment of the present specification. As shown in FIG1 , the system includes a computing device 101 and a server 102. The computing device 101 is, for example, an application server for running an application. A driver of a database is deployed in the computing device 101. The application can send an access request to the server 102 by calling the driver to access the database. The access to the database includes, for example, operations such as insert, query, update, and delete. The server 102 includes an encrypted data table and a database schema corresponding to the encrypted data table. At least some of the columns in the encrypted data table involving privacy data include ciphertext data.

The database schema can be understood as the data model in the database, which can be used to describe the metadata of the data object in the database. Specifically, the database schema includes information related to the data table and the attributes of the data in the data table. For example, the schema may include information such as the table name, the number of columns in the data table, the column name, the plaintext column name corresponding to the ciphertext column, the encryption and decryption type corresponding to the ciphertext column, and the query type corresponding to the encryption and decryption type.

Table 1 is a schematic diagram of a plaintext data table.

Table 1

Among them, "Customers" is the table name, and "ID" and "Name" are the column names of the two columns in the data table.

Table 2 is a schematic diagram of a ciphertext data table corresponding to Table 1 and stored in the server.

Table 2

In Table 2, "ID" in ID-method1 is the plaintext column name corresponding to the ciphertext column, and "method1" in ID-method1 is the encryption algorithm type or identifier, which is used to indicate the method1 encryption algorithm, indicating that the ciphertext of the column is generated by encrypting the corresponding data in the plaintext data table using method1. For example, "0x8asasub" in the ID-method1 column in Table 2 is generated by encrypting "312" in the ID column in Table 1 using method1.

In order to facilitate the retrieval of data in the ciphertext data table, different encryption algorithms can be used to encrypt the same plaintext data in the ciphertext data table. For example, as shown in Table 2, for the ID column in the plaintext, three ciphertext columns are included, namely, ID-method1, ID-method2, and ID-method3. These three ciphertext columns respectively include ciphertexts obtained by encrypting the plaintext data in the ID column of the plaintext data table using different encryption algorithms. Among them, method1 is suitable for equal value query, method2 is suitable for unequal value query, and method3 is suitable for arithmetic calculation query, etc. Among them, equal value query refers to the SQL statement that connects the parameter name to be queried with the parameter value of the parameter with an equal sign, such as "select name from Customers where ID＝312", and method1 can support equal value comparison of ciphertext. Unequal value query refers to the SQL statement that connects the parameter name to be queried with the parameter value of the parameter with an unequal sign, such as "select name from Customers where ID>312", and method2 can support unequal value comparison of ciphertext. Arithmetic calculation query means that after calculating the parameter values in the SQL statement, the query is performed based on the calculation results. For example, method3 is a homomorphic encryption algorithm that supports homomorphic calculations between ciphertexts.

The server 102 stores a schema corresponding to Table 1 and Table 2, and the schema is shown in Table 3, for example:

table 3

Table Name	Customers
Original number of columns	2
The field name of the original column 1	ID
The number of ciphertext columns of original column 1	3

Field name of ciphertext column 1 of original column 1	ID-method1
Encryption algorithm for the ciphertext column 1 of the original column 1	Method1
Query type of ciphertext column 1 of original column 1	Equivalence query
The field name of the ciphertext column 2 of the original column 1	ID-method2
Encryption algorithm for ciphertext column 2 of original column 1	Method2
Query type of ciphertext column 2 of original column 1	Unequal value query
Field name of ciphertext column 3 of original column 1	ID-method3
Encryption algorithm for ciphertext column 3 of original column 1	Method3
Query type of ciphertext column 3 of original column 1	Arithmetic Calculation Query
…	The

Among them, the original columns in Table 3 are the columns in Table 1, such as the ID column and the Name column, and the ciphertext columns of the original columns in Table 3 represent the ciphertext columns corresponding to the original columns in Table 2, such as the ID-method1 column, the ID-method2 column, and the ID-method3 column corresponding to the ID column in Table 1.

It can be understood that Table 3 only schematically illustrates some items in the schema. In practice, the schema may also include other attribute items related to the data table, such as the column length, character set, data type and other attributes of the original column, which are not shown in Table 3.

In the related art, the driver synchronizes the schema of the data table shown in Table 3 from the server. When the application needs to access the database, for example, the application sends a plaintext query request to the driver, which is, for example, an SQL statement "select name from Customers where id = 312". After receiving the query request, the driver perceives the SQL statement, and determines that the id parameter corresponds to the three encryption algorithms method1, method2 and method3 according to the schema table shown in Table 3, and determines that method1 should be used to encrypt the parameter value "312" according to the equivalent query type of the SQL statement. Afterwards, the driver uses the method1 encryption algorithm to encrypt the parameter value "312" to obtain the ciphertext parameter value "0x8asasub", rewrites the plaintext SQL statement into the ciphertext SQL statement "select name from Customers where id＝0x8asasub", and sends the ciphertext SQL statement to the server. Based on the ciphertext SQL statement, the server can determine that the plaintext column name queried by the ciphertext SQL statement is "id", and because the SQL statement is an equal value query type, it can be determined that the ciphertext SQL statement corresponds to "method1". Therefore, the server can find the row including "0x8asasub" in the id-method1 column in Table 2, and return the ciphertext 0xggsqh23 in the name-method1 column in the row to the driver. After receiving the ciphertext 0xggsqh23 from the server, the driver can determine that the ciphertext 0xggsqh23 is obtained by encrypting the name plaintext using method1 based on the plaintext SQL statement and the schema table. The driver can receive the decryption key corresponding to the name column and method1 from the application, use the decryption key to decrypt 0xggsqh23 based on the method1 algorithm to obtain the plaintext "Alice", and return "Alice" to the application as the query result.

In this related technology, the driver side needs to synchronize and store the schema table from the server, which takes up a large amount of storage resources. At the same time, the driver side needs to rewrite the SQL statement according to the schema table, which has complex logic and is difficult to implement.

The embodiment of this specification provides a database access method, in which the server determines the encryption algorithm corresponding to the parameter value in the SQL statement based on the SQL statement and the schema, and sends the determination result to the driver end, so that the driver end does not need to store the schema or rewrite the SQL statement according to the schema, saving storage resources and computing resources.

FIG2 is a flowchart of a database access method in an embodiment of the present specification. The method can be executed by the computing device 101 and the server 102 in FIG1 . More specifically, the computing device side can be executed by the driver end in the computing device. It can be understood that the method on the computing device side is not limited to being executed by the driver end, for example, it can also be executed by other modules, or it can be executed by a module included in the application program, and this is not limited.

As shown in FIG. 2 , first, in step S201 , the driver in the computing device receives the SQL1 statement from the application program.

The SQL1 statement may be a statement for indicating any database access operation such as insert, query, update, delete, etc. The SQL1 statement includes at least the name of the data table to be accessed, the name of the parameter to be operated, and the corresponding parameter value of the parameter. For example, taking the operation of inserting a row in Table 1 as an example, the SQL1 statement may be "insert into Customers (ID, Name) values (314, Carl)", where Customers in SQL1 is the name of the data table to be accessed, (ID, Name) is the name of the parameter to be operated, and (314, Carl) is the parameter value of each parameter. The SQL1 statement is used to insert a row of data in Table 1. In the data of the inserted row, the value of ID is 314 and the value of Name is Carl.

In step S203, the driver rewrites the SQL1 statement to hide the plain text parameter value, and obtains the SQL2 statement.

After receiving the SQL1 statement, the driver displays the SQL1 statement to the user to instruct the user to provide the location information of the parameter values (i.e., "314" and "Carl") in the SQL1 statement. After obtaining the location information of the parameter values input by the user, the driver can replace the plain text parameter values with preset characters (or placeholders, such as "?") according to the location information to hide the plain text parameter values, thereby obtaining the SQL2 statement, "insert into Customers (ID, Name) values (?,?)". It can be understood that the embodiments of this specification are not limited to replacing the plain text parameter values with the same placeholders. For example, (314, Carl) can be replaced with (1,2) to use "1" and "2" to distinguish 314 from Carl.

In the embodiment of this specification, the driver and the server access the database based on the binary protocol process. The binary protocol process includes a preparation phase, an encryption phase, and an execution phase. Among them, steps S205-S209 in Figure 2 belong to the preparation phase, steps S211-S213 belong to the encryption phase, and step S215 belongs to the execution phase.

In step S205, the driver sends the SQL2 statement to the server.

The driver sends the SQL2 statement to the server, so that the server cannot obtain the plain text parameter value in SQL1. While protecting the plain text data, the server can access the database based on the SQL2 statement.

In step S207, the server determines response information according to the SQL2 statement and the schema, and the response information includes the encryption algorithm type corresponding to the plain text parameter value.

After receiving the SQL2 statement, when the server determines that the SQL2 statement is, for example, an insert statement, according to Table 2, the server side needs to store multiple ciphertext parameter values corresponding to each parameter value to be inserted (including "314" and "Carl") and multiple columns in Table 2. Therefore, the response information on the server side should include the following information: three encryption algorithm types corresponding to the plaintext parameter value "314" of the parameter ID, namely "method1", "method2" and "method3"; and two encryption algorithm types corresponding to the plaintext parameter value "Carl" of the parameter Name, namely "method1" and "method2".

Specifically, the response information may include the attribute information of the original column where each plaintext parameter value is located, and the attribute information includes an encryption attribute field, and the value of the encryption attribute field is, for example, a 16-bit binary number, which is used to indicate which encryption algorithms should be used to encrypt the corresponding plaintext parameter value. For example, for a plaintext parameter value in the SQL1 statement, if the value of the i-th bit in the value of the encryption attribute field of the original column of the plaintext parameter value in the response information is 1, it indicates that the i-th encryption algorithm among the preset 16 encryption algorithms should be used to encrypt the plaintext parameter value. For example, corresponding to the parameter value in the SQL1 statement, the response information includes an ID column encryption attribute field, and the value of the encryption attribute field is, for example, 0000000000000111, which is used to indicate that the parameter value "314" of the parameter ID should be encrypted using the first encryption algorithm (for example, method1), the second encryption algorithm (for example, method2), and the third encryption algorithm (for example, method3). Similarly, corresponding to the parameter value "Carl" in the SQL1 statement, the response information may also include an encryption attribute field of the Name column. The value of the encryption attribute field is, for example, 0000000000000011, which is used to indicate that the parameter value "Carl" of the parameter Name should be encrypted using the first encryption algorithm (for example, method1) and the second encryption algorithm (for example, method2).

It can be understood that the response information is not limited to only including the encryption algorithm type corresponding to the plaintext parameter value. For example, the response information can also include at least part of the information such as the table name of the data table shown in Table 1, the column name of the original column where the plaintext parameter value is located, the column length of the original column where the plaintext parameter value is located, the character set of the original column where the plaintext parameter value is located, and the data type of the original column where the plaintext parameter value is located.

In step S209, the server sends the response information to the driver.

In step S211, the driver encrypts the plaintext parameter value according to the response information to obtain the ciphertext parameter value.

After receiving the response information, the driver uses method1, method2 and method3 to encrypt the parameter value "314" according to the response information, and obtains three ciphertext parameter values corresponding to the three columns ID-method1, ID-method2 and ID-method3 in Table 2, and uses method1 and method2 to encrypt the parameter value "Carl", and obtains two ciphertext parameter values corresponding to the two columns Name-method1 and Name-method2 in Table 2.

In step S213, the driver sends the encrypted parameter value to the server.

After obtaining the three ciphertext parameter values of "314" and the two ciphertext parameter values of "Carl", the driver can send the three ciphertext parameter values and the two ciphertext parameter values to the server in a preset arrangement order, so that the server can determine the storage location of each ciphertext parameter value in the data table Customers shown in Table 2 according to the order. Alternatively, the driver can mark the corresponding encryption algorithm type and parameter name for the three ciphertexts of "314" and the corresponding encryption algorithm type and parameter name for the two ciphertexts of "Carl" to indicate the storage location of each ciphertext parameter value in the data table Customers shown in Table 2. In the implementation method in which "1" replaces "314" and "2" replaces "Carl" in the aforementioned SQL2 statement, the driver can bind the three ciphertexts of "314" to "1" and the two ciphertexts of "Carl" to "2", and send them to the server, so that the server can determine based on the binding that the three ciphertext parameter values bound to "1" are the three ciphertext parameter values corresponding to the parameter ID, and the two ciphertext parameter values bound to "2" are the two ciphertext parameter values corresponding to the parameter Name.

In step S215, the server accesses the database according to the SQL statement and the ciphertext parameter value.

After receiving the three ciphertext parameter values of the plaintext parameter value "314" and the two ciphertext parameter values of the plaintext parameter value "Carl", the server performs an insert operation according to the SQL2 statement, inserts a new row into the data table shown in Table 2, and stores the three ciphertext parameter values of "314" in the ID-method1, ID-method2 and ID-method3 columns of the inserted row according to the arrangement order or position indication information of the three ciphertext parameter values, and similarly stores the two ciphertext parameter values of "Carl" in the Name-method1 and Name-method2 columns of the inserted row. Thus, the access to the database is completed.

FIG. 2 describes the database access scheme in the embodiment of the present specification by taking the insert operation on the database as an example. It can be understood that the embodiment of the present specification is not limited to the insert operation on the database, but can be similarly applied to other database access operations. Other access operations to the database can be performed by a method flow similar to the method flow shown in FIG. 2. For example, for a write operation to rewrite a parameter value in a data table, the server can also return to the driver a plurality of encryption algorithms corresponding to the plaintext column where the parameter value is located according to the schema of the data table, so that the driver can obtain a plurality of ciphertext parameter values of the parameter value according to the plurality of encryption algorithms, thereby writing the plurality of ciphertext parameter values into the data table. For a query operation based on a parameter value in the data table to query other data in the data table, the server can determine the encryption algorithm corresponding to the parameter value and the encryption algorithm corresponding to the query result according to the query type (equal value query type or unequal value query type, etc.) of the specific query operation, so that the driver encrypts the parameter value based on the encryption algorithm, and sends the ciphertext parameter value to the server for data query based on the ciphertext parameter value.

The following will describe the method flow of querying a database in an embodiment of this specification with reference to FIG. 3 .

As shown in FIG3 , first, in step S301, the driver in the computing device receives an SQL3 statement for querying data from the application. As described above, the SQL3 statement is, for example, "select name from Customers where ID=312", and the SQL3 statement is used to query the name of ID=312 from the data table, and the SQL3 statement is an equal value query type query statement. The SQL3 statement is only an example of a query statement, and the embodiments of this specification may also include other types of query statements, such as unequal value query type, arithmetic calculation type, etc. In the encrypted database, different query types correspond to different encryption algorithms, so as to facilitate data query in the encrypted database based on the query type. For example, the encryption algorithm corresponding to the query statement of the unequal value query type makes: the size relationship of the ciphertext of the two parameters is consistent with the size relationship of the two parameters, so that the unequal value query operation can be directly performed based on the ciphertext of the parameter.

In step S303, the driver rewrites the SQL3 statement to hide the plain text parameter value, and obtains the SQL4 statement.

This step may refer to the above description of step S203 and will not be described again here.

In step S305, the driver sends the SQL4 statement to the server.

In step S307, the server determines response information according to the SQL4 statement and the schema. The response information includes the type of encryption algorithm corresponding to the plain text parameter value and the type of encryption algorithm corresponding to the query result.

After receiving the SQL4 statement, the server determines that the SQL4 statement is a query statement. The server first determines that the parameter column corresponding to the parameter value in the SQL4 is the ID column in Table 1, and the query result column is the Name column in Table 1. The server can determine from Table 3 that the encryption algorithms corresponding to the ID column include method1, method2 and method3, and the encryption algorithms corresponding to the Name column include method1 and method2. After that, the server determines that the query statement is a query statement of equal value type according to SQL4, so it can be determined that the encryption algorithm types corresponding to the ID column and the Name column in the SQL4 statement are both method1. Therefore, the server can generate a response message, which includes the encryption algorithm type (i.e., method1 type) of the parameter column (i.e., ID column) and the result column (i.e., Name column). The response message can also include at least part of the information such as the table name of the data table shown in Table 1, the column names of the parameter column and the result column, the column lengths of the parameter column and the result column, the character sets of the parameter column and the result column, and the data types of the parameter column and the result column.

In step S309, the server sends the response information to the driver.

In step S311, the driver encrypts the plaintext parameter value according to the response information to obtain the ciphertext parameter value.

After receiving the response information, the driver uses the method1 encryption algorithm to encrypt the plaintext parameter value "312" in SQL3 according to the encryption algorithm type of the parameter column, and obtains the ciphertext parameter value "0x8asasub".

In step S313, the driver sends the encrypted parameter value to the server.

In step S315, the server accesses the database according to the SQL4 statement and the ciphertext parameter value to obtain the ciphertext query result.

After receiving the ciphertext parameter value "0x8asasub", the server reads the ciphertext query result "0xggsqh23" in the Name-method1 column in the row including "0x8asasub" in the ID-method1 column according to the SQL4 statement.

In step S317, the server returns the encrypted query result to the driver.

In step S319, the driver decrypts the ciphertext query result according to the encryption algorithm type corresponding to the query result to obtain the plaintext query result.

After receiving the ciphertext query result "0xggsqh23", the driver decrypts the ciphertext "0xggsqh23" based on the encryption algorithm type corresponding to the result column in the response information and the decryption algorithm included in the method1 encryption algorithm, thereby obtaining the corresponding plaintext "Alice" as the query result of the SQL3 statement. The driver can return the query result "Alice" to the application.

The embodiments of this specification propose a database access method based on a binary encryption protocol, which realizes a lightweight driver end, and the encryption and decryption control process and schema information are stored by the database server. The driver end only needs to obtain encryption and decryption related metadata (such as public key, private key, encryption and decryption algorithm) according to the protocol to complete the encryption and decryption of the data. The driver end does not need to be completely transformed, and only needs to integrate the encryption and decryption algorithm. By recording the encryption type of the ciphertext column, the server can return the ciphertext query result and the encryption type corresponding to the query result according to the encryption type of the ciphertext column and the SQL operation type, so that the driver end can obtain the plaintext query result. The driver end does not need to perceive the content of the SQL statement, but only needs to perform encryption and decryption operations based on the encryption and decryption type returned in the preparation stage and the encryption and decryption algorithm.

FIG4 is an architecture diagram of a computing device in an embodiment of this specification, including:

A sending unit 41 is used to send a first access request to a database server, wherein the first access request includes a preset character used to replace a first parameter value of a first parameter, and the data table accessed by the first access request includes a ciphertext parameter value of the first parameter;

a receiving unit 42, configured to receive response information from the server, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter, wherein the response information is generated based on the mode information and the first access request, and wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

An encryption unit 43, configured to encrypt the first parameter value based on the first encryption algorithm to obtain a first ciphertext parameter value;

The sending unit 41 is further used to send the first ciphertext parameter value to the server for accessing the database.

In one embodiment, the first access request includes a query request, the database stores data to be queried corresponding to the query request in association with the first ciphertext parameter value, the data to be queried includes ciphertext data, and the response information is further used to indicate that the query result of the query request corresponds to the second encryption algorithm.

The receiving unit is also used to receive the ciphertext data from the server;

The receiving device also includes: a decryption unit, configured to decrypt the ciphertext data based on the second encryption algorithm to obtain plaintext data.

In one embodiment, the first access request includes a second access request for requesting to write data to a database, and the response information is used to indicate a plurality of first encryption algorithms corresponding to the first parameter value.

The sending unit is further used to send a plurality of first ciphertext parameter values respectively corresponding to the plurality of first encryption algorithms to the server.

In one implementation, the mode information also includes different query types corresponding to different encryption algorithm types, and the response information is generated based on the mode information and the query type of the first access request.

In one embodiment, the receiving unit is also used to: receive a third access request from an application, the third access request including the first parameter value, receive position information of the first parameter value in the third access request provided by a user, and replace the first parameter value in the third access request with the preset character according to the position information to obtain the first access request.

FIG5 is an architecture diagram of a database server in an embodiment of this specification, including:

A receiving unit 51 is configured to receive a first access request from a computing device, wherein the first access request includes a preset character used to replace a first parameter value of a first parameter, wherein a data table accessed by the first access request includes a ciphertext parameter value of the first parameter, and wherein mode information of the data table is stored in the server, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter;

a determining unit 52, configured to determine response information according to the first access request and the mode information, wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

A sending unit 53, configured to send the response information to the computing device;

The receiving unit 51 is further configured to receive a first ciphertext parameter value from the computing device, where the first ciphertext parameter value is obtained by encrypting the first parameter value based on the first encryption algorithm;

The access unit 54 is configured to access a database based on the first access request and the first ciphertext parameter value.

In one implementation, the first access request includes a query request, the response information is further used to indicate that the query result of the query request corresponds to a second encryption algorithm, the database stores data to be queried corresponding to the query request in association with the first ciphertext parameter value, the data to be queried includes ciphertext data, and the server further includes:

an acquiring unit, configured to acquire the ciphertext data according to the first ciphertext parameter value and the first access request;

A returning unit is used to return the ciphertext data to the computing device.

In one embodiment, the first access request includes a second access request for writing data to the database, the response information is used to indicate multiple first encryption algorithms corresponding to the first parameter value, and the receiving unit is specifically used to: receive multiple first ciphertext parameter values corresponding to the multiple first encryption algorithms from the computing device, and the access unit is specifically used to store the multiple first ciphertext parameter values in the database in association with the identifiers of the multiple first encryption algorithms.

The embodiments of this specification also provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method shown in FIG. 2 or FIG. 3 .

A sixth aspect of the present specification provides a computer device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method shown in FIG. 2 or FIG. 3 is implemented.

In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many of the improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing programs. The original code before compilation must also be written in a specific programming language, which is called Hardware Description Language (HDL). There is not only one kind of HDL, but many kinds. Such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that realizes the logical method flow.

The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer readable medium storing a computer readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that in addition to implementing the controller in a purely computer readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the means for implementing various functions included therein may also be considered as a structure within the hardware component. Or even, the means for implementing various functions may be considered as both a software module for implementing the method and a structure within the hardware component.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and/or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

The present invention is described with reference to the flowcharts and/or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the processes and/or boxes in the flowchart and/or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

In a typical configuration, a computing device includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims (13)

1. A database access method, comprising:

   Sending a first access request to a database server, wherein the first access request includes a preset character used to replace a first parameter value of a first parameter, and the data table accessed by the first access request includes a ciphertext parameter value of the first parameter;

   receiving response information from the server, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter, wherein the response information is generated based on the mode information and the first access request, and wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

   Encrypting the first parameter value based on the first encryption algorithm to obtain a first ciphertext parameter value;

   The first ciphertext parameter value is sent to the server for accessing the data table.
2. According to the method of claim 1, the first access request includes a query request, the data table stores data to be queried corresponding to the query request in association with the first ciphertext parameter value, the data to be queried includes ciphertext data, the response information is further used to indicate that the query result of the query request corresponds to a second encryption algorithm, and the method further includes:

   receiving the ciphertext data from the server;

   The ciphertext data is decrypted based on the second encryption algorithm to obtain plaintext data.
3. According to the method of claim 1, the first access request includes a second access request for requesting to write data to the data table, and the response information is used to indicate a plurality of first encryption algorithms corresponding to the first parameter value.

   The sending the first ciphertext parameter value to the server includes: sending a plurality of first ciphertext parameter values respectively corresponding to the plurality of first encryption algorithms to the server.
4. According to the method according to claim 2, the mode information also includes different query types corresponding to different encryption algorithms, and the response information is generated based on the mode information and the query type of the query request.
5. The method according to claim 2 further includes: receiving a third access request from an application, the third access request including the first parameter value, receiving position information of the first parameter value in the third access request provided by a user, and replacing the first parameter value in the third access request with the preset character according to the position information to obtain the first access request.
6. The method according to claim 5 is executed by a database driver in the computing device where the application is located.
7. A database access method, executed by a database server, comprising:

   receiving a first access request from a computing device, the first access request including a preset character for replacing a first parameter value of a first parameter, the data table accessed by the first access request including the ciphertext parameter value of the first parameter, the server storing mode information of the data table, the mode information including an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter;

   determining response information according to the first access request and the mode information, the response information being used to indicate that the first parameter value corresponds to a first encryption algorithm;

   sending the response information to the computing device;

   receiving a first ciphertext parameter value from the computing device, the first ciphertext parameter value being obtained by encrypting the first parameter value based on the first encryption algorithm;

   The data table is accessed based on the first access request and the first ciphertext parameter value.
8. According to the method of claim 7, the first access request includes a query request, the response information is further used to indicate that the query result of the query request corresponds to a second encryption algorithm, the data table stores data to be queried corresponding to the query request in association with the first ciphertext parameter value, and the data to be queried includes ciphertext data, and the method further includes:

   Acquire the ciphertext data according to the first ciphertext parameter value and the first access request;

   The ciphertext data is returned to the computing device.
9. According to the method of claim 7, the first access request includes a second access request for writing data to the data table, the response information is used to indicate multiple first encryption algorithms corresponding to the first parameter value, and the receiving of the first ciphertext parameter value from the computing device includes: receiving multiple first ciphertext parameter values corresponding to the multiple first encryption algorithms respectively from the computing device; the accessing the data table based on the first access request and the first ciphertext parameter value includes: storing the multiple first ciphertext parameter values in the data table in association with the identifiers of the multiple first encryption algorithms respectively.
10. A computing device comprising:

    a sending unit, configured to send a first access request to a database server, wherein the first access request includes a preset character used to replace a first parameter value of a first parameter, and a data table accessed by the first access request includes a ciphertext parameter value of the first parameter;

    a receiving unit, configured to receive response information from the server, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter, wherein the response information is generated based on the mode information and the first access request, and wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

    an encryption unit, configured to encrypt the first parameter value based on the first encryption algorithm to obtain a first ciphertext parameter value;

    The sending unit is further used to send the first ciphertext parameter value to the server for accessing the data table.
11. A database server, comprising:

    a receiving unit, configured to receive a first access request from a computing device, wherein the first access request includes a preset character for replacing a first parameter value of a first parameter, wherein a data table to be accessed by the first access request includes a ciphertext parameter value of the first parameter, wherein the server stores mode information of the data table, wherein the mode information includes an identifier of an encryption algorithm corresponding to the ciphertext parameter value of the first parameter;

    a determining unit, configured to determine response information according to the first access request and the mode information, wherein the response information is used to indicate that the first parameter value corresponds to a first encryption algorithm;

    A sending unit, configured to send the response information to the computing device;

    The receiving unit is further configured to receive a first ciphertext parameter value from the computing device, where the first ciphertext parameter value is obtained by encrypting the first parameter value based on the first encryption algorithm;

    An access unit, configured to access the data table based on the first access request and the first ciphertext parameter value.
12. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in any one of claims 1 to 9.
13. A computer device comprises a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images