CN111291402A

CN111291402A - Database transparent encryption method and system

Info

Publication number: CN111291402A
Application number: CN202010396498.3A
Authority: CN
Inventors: 戴林; 宋健龙
Original assignee: Visualsec Beijing Technology Co ltd
Current assignee: Visualsec Beijing Technology Co ltd
Priority date: 2020-05-12
Filing date: 2020-05-12
Publication date: 2020-06-16

Abstract

The invention relates to a transparent encryption method and system for a database, and belongs to the technical field of information security. The invention comprehensively utilizes the function mechanisms provided by the database management system (DBMS) such as the function virtual column, the virtual column index, the view, the trigger, the User Defined Function (UDF) and the like, and realizes the efficient and diversified transparent encryption of the database on the premise of not additionally increasing the storage requirement. Compared with the prior art, the system of the invention has small invasion and high reliability; the system operation efficiency and the storage efficiency are improved; complex indexes such as joint indexes and bitmap indexes can be supported, and the connection operation between tables is very efficient; support for specific encryption algorithms such as the cryptographic SM1, the cryptographic SM4 and the like can be realized.

Description

Database transparent encryption method and system

Technical Field

The invention relates to a database transparent encryption method and a software system, in particular to a database transparent encryption method and a database transparent encryption system based on function virtual columns and virtual column indexes, and belongs to the technical field of data security and database encryption.

Background

Data security is becoming increasingly important. Database encryption, i.e., encryption of sensitive columns in a database, is a very important security means. Database encryption needs to solve the problems of transparent access and ciphertext indexing, otherwise, an application program is required to be modified, and the access efficiency is seriously reduced, so that the usability of the database is influenced. To implement database encryption, the industry has conducted certain research.

Patent CN106934030B proposes a ciphertext indexing method for database encryption columns, and an in-library database encryption system implemented based on this method. The principle is that the order-preserving index is used as the ciphertext index, and meanwhile, the ciphertext and the ciphertext index are stored separately, so that the influence of encryption on performance is reduced on the premise of not leaking plaintext information and the partial order relation of the plaintext information.

Such a method and system have the following problems:

1) additional index columns are needed to explicitly store the order-preserving index values, which are then indexed on the index columns. This consumes additional storage space and requires additional maintenance work on the index column, so that both the operation efficiency and the storage efficiency are reduced.

2) It needs to realize the extended index interface and establish the index logic. This not only reduces the efficiency of indexing, but also does not support complex indexes such as multi-column joint indexing, bitmap indexing, and the like.

3) The inter-table connection operation is very inefficient.

The invention aims to solve the technical defects of the ciphertext indexing and encryption system partially or completely, and provides a database column encryption method and a database encryption system based on the method.

Disclosure of Invention

The invention aims to provide a database transparent encryption method and system based on function virtual columns and virtual column indexes, aiming at the technical defects of the existing database encryption system.

The principle of the invention is that the function mechanism provided by a database management system (DBMS) such as a function virtual column, a virtual column index, a view, a trigger, a User Defined Function (UDF) and the like is used, and efficient and diversified transparent encryption of the database is realized on the premise of not additionally increasing the storage requirement.

The purpose of the invention is realized by the following technical scheme:

in a first aspect, an embodiment of the present invention provides a database transparent encryption method, including the following steps:

1) for a column F1 to be encrypted of the table T1, deleting the index on the F1 if the index exists; deleting the table T1 and creating a table T1 _havingthe same structure as the table T1, or renaming the T1 as T1_, and the column to be encrypted F1 is renatured as F1 in the T1 _; the F1 is stored in the F1 _afterbeing encrypted by using an encryption function ENC (X);

2) establishing a view T1 with the same structure as the table T1, wherein the value of the column F1 is a function virtual column F11, and the F11 is established on the table T1_ or the view T1 (in this case, F1 is the function virtual column F11); the defined function of the F11 is a decryption function DEC (F1_) corresponding to the encryption function;

3) establishing an index for the F11, wherein the index is the same as the index on the F1;

4) establishing a trigger on the view T1, and writing a ciphertext ENC (F1) into an F1_ column of the T1_ after encrypting a new value of the F1 when a new record is inserted and an updated record is updated; the corresponding record on the T1_ is deleted when the deletion operation is performed.

Preferably, the method further comprises establishing a user-defined function (UDF) for the database, for implementing a user-defined encryption and decryption algorithm and key management method.

In a second aspect, an embodiment of the present invention provides a database transparent encryption system, including:

an encryption table T1_, containing all encrypted columns and unencrypted columns in the table T1 to be encrypted, wherein the encrypted column F1 is renamed to F1_, and is used for storing the ciphertext of the column F1 in the T1;

a view T1, which is of the same name and column as the table to be encrypted, takes over access to the table to be encrypted;

a virtual decryption function column of the encrypted column, located on the encryption table T1_ or the view T1, on which an index corresponding to the encrypted column is established;

a trigger, configured to take over requests for adding, modifying, and deleting the view T1, and when an INSERT request, an UPDATE request, and a DELETE request include the encrypted column content, perform the following processing respectively:

(1) for an INSERT request, the trigger calls an encryption function, calculates a ciphertext value of an encrypted column inserted into a record, and INSERTs the ciphertext value into the T1 together with a value of the non-encrypted column;

(2) for the UPDATAE request, the trigger calls the encryption function, calculates a ciphertext value of a new value of an encrypted column in an update record, and updates the encrypted column of a corresponding record in the T1_ with the ciphertext value;

(3) for a DELETE request, the trigger DELETEs the corresponding record in the T1 _.

Preferably, the database transparent encryption system further comprises a user-defined function (UDF) for implementing a user-defined encryption/decryption function and/or a key management method.

In a third aspect, an embodiment of the present invention provides an electronic device, including: at least one processor; and the number of the first and second groups,

a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the database transparent encryption method of the first aspect or any implementation manner of the first aspect.

In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, which is characterized by storing computer instructions for causing a computer to execute the database transparent encryption method according to the first aspect or any implementation manner of the first aspect.

In a fifth aspect, an embodiment of the present invention provides a computer program product, where the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions, when executed by a computer, cause the computer to execute the database transparent encryption method according to the first aspect or any implementation manner of the first aspect.

Advantageous effects

Compared with the existing ciphertext indexing method and database encryption system, the database transparent encryption method and system based on the function virtual column and the virtual column index have the following gain effects:

(1) the transparent encryption and ciphertext indexing of the database fields are realized based on a function virtual column, a virtual column index, a view, a trigger, a User Defined Function (UDF) and the like of a database management system (DBMS), the system intrusion is very small, and the reliability is very high;

(2) by using an index mechanism of the database, an additional column dominant storage index value is not needed, so that the operation efficiency and the storage efficiency are greatly improved;

(3) complex indexes such as joint indexes and bitmap indexes can be supported, and the connection operation between tables is very efficient;

(4) specific encryption algorithms such as the cryptographic SM1, the cryptographic SM4 and the like can be realized.

Drawings

Fig. 1 is a schematic flowchart of a database transparent encryption method based on function virtual columns and virtual column indexes according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a structure of a database transparent encryption system based on function virtual columns and virtual column indexes when the function virtual columns are located in an encryption table according to an embodiment of the present invention;

fig. 3 is a schematic structural diagram of a view of a function virtual column of a database transparent encryption system based on function virtual columns and virtual column indexes according to an embodiment of the present invention;

fig. 4 is a schematic diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The following describes a database transparent encryption method and system based on function virtual columns and virtual column indexes in detail with reference to the accompanying drawings and embodiments.

The embodiments of the present disclosure are described below with specific examples, and other advantages and effects of the present disclosure will be readily apparent to those skilled in the art from the disclosure in the specification. It is to be understood that the described embodiments are merely illustrative of some, and not restrictive, of the embodiments of the disclosure. The disclosure may be embodied or carried out in various other specific embodiments, and various modifications and changes may be made in the details within the description without departing from the spirit of the disclosure. It is to be noted that the features in the following embodiments and examples may be combined with each other without conflict. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

It is noted that various aspects of the embodiments are described below within the scope of the appended claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms and that any specific structure and/or function described herein is merely illustrative. Based on the disclosure, one skilled in the art should appreciate that one aspect described herein may be implemented independently of any other aspects and that two or more of these aspects may be combined in various ways. For example, an apparatus may be implemented and/or a method practiced using any number of the aspects set forth herein. Additionally, such an apparatus may be implemented and/or such a method may be practiced using other structure and/or functionality in addition to one or more of the aspects set forth herein.

It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present disclosure, and the drawings only show the components related to the present disclosure rather than the number, shape and size of the components in actual implementation, and the type, amount and ratio of the components in actual implementation may be changed arbitrarily, and the layout of the components may be more complicated.

In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects may be practiced without these specific details.

The embodiment of the disclosure provides a database transparent encryption method. The database transparent encryption method provided by the embodiment can be executed by a computing device, the computing device can be implemented as software, or implemented as a combination of software and hardware, and the computing device can be integrated in a server, a terminal device and the like.

The terminal in the embodiments of the present disclosure may include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a vehicle terminal (e.g., a car navigation terminal), and the like, and a fixed terminal such as a digital TV, a desktop computer, a file server, a database server, and the like.

Embodiment 1, database transparent encryption method and database transparent encryption system based on function virtual columns and virtual column indexes

As shown in fig. 1, a database transparent encryption method based on function virtual columns and virtual column indexes is described by taking an example that a certain column or a certain attribute in an existing database needs to be encrypted, when a plurality of attributes of a plurality of tables need to be transparently encrypted, the method of the present invention is repeated, and the specific encryption steps are as follows:

1) for the specified to-be-encrypted column F1 of the specified table T1, the index thereon is deleted. The encryption is performed using a specified encryption function enc (x). The encrypted table is named T1_, and the encrypted column F1 is named F1 _; those skilled in the art will appreciate that the T1 is not a real database Table name, but is a symbolic representation for descriptive convenience, and may refer to any Table (Table) in any Database (DB), and similarly, F1 is a symbolic representation of columns or attributes that need to be encrypted. Of course, those skilled in the art will appreciate that this could also be achieved by creating the encryption table T1_, and deleting the original table T1, instead of renaming the original table T1 as T1 _.

2) A virtual column of functions F11 is established for T1, which has the following main characteristics:

a) this column corresponds to the new column of T1, which defines the function DEC (F1). Function dec (x) is able to correctly decrypt the content encrypted using enc (x), i.e., the value of F11 is the plaintext value before encryption of F1;

b) the column is a logic column, has no actual storage consumption, and is generated in real time when needed;

c) various indexes may be built to the column.

3) Indexes are established for the virtual column F11, and the indexes are the same as the indexes on the original F1, and include but are not limited to single-column indexes, joint indexes, bitmap indexes and the like. The function of the method is to realize ciphertext index, namely to realize efficient retrieval of the encrypted column.

4) A view T1 is established that is identical in structure to the pre-encryption T1, with the column F1 taking the value of the virtual column F11. All queries to the original table T1 at this time will be taken over by the view T1. The view is filled in at query time with the virtual column F11, and F11 is filled in by F1_ real time decryption.

5) To achieve transparency of the insert, delete, update, etc. operations, a trigger is established on view T1. After encrypting the new value of F1 at the time of inserting the new record and updating the record, the ciphertext ENC (F1) is written into the F1_ column of table T1-. The virtual column index will then be automatically updated based on the plaintext value of F1. The corresponding record on the encryption table T1_ is deleted when the deletion operation is performed.

The above is the implementation process of the method of the present invention, and it is obvious to those skilled in the art that T1, T1_ and F1, F1_ and F11 are symbolic expressions for descriptive convenience, and different symbols or names may be assigned according to situations when constructing a specific transparent database.

Of course, enc (x) is also a generalized representation of the encryption function, which may be any existing encryption function, such as AES/3DES with its own database, etc.

Preferably, on the basis of the above method, in order to better adapt to the need of autonomous control, user-defined functions (UDF) may be further established for the database, and these user-defined functions implement specific encryption and decryption algorithms and/or key management methods, such as implementing domestic cryptographic algorithms and/or key management methods, for example, SM1, SM4, and the like, for encrypting and decrypting the columns or attributes to be encrypted. The specific implementation of the encryption and decryption functions of enc (x) and dec (x) is the SM1 or SM4 algorithm, and the key management of SM1 or SM4 can also be implemented by a customized key management method.

The database transparent encryption system is constructed according to the method. As shown in fig. 2 and 3, the system generates an encryption table T1 _basedon the encrypted original table T1, and includes a view T1 having a column with the same name as the encrypted original table, a function virtual column of the same type as the encrypted column, a ciphertext index based on the virtual column index, a trigger for implementing transparency of addition and deletion, and functions for implementing encryption, decryption and key management, such as encryption function, decryption function, and key generation, storage, distribution, and destruction.

The encryption table T1_ contains the encrypted column F1_ of F1 and other columns, where F1_ is used to store the ciphertext of column F1;

the view T1 with the same name and column as the encrypted original table is used to take over all the access to the encrypted original table instead of the encrypted original table, so that the external users and applications do not feel the process of encrypting and decrypting the data and do not need to rewrite the query, thereby realizing transparent encryption and decryption. Where transparent decryption is done by the definition of the view. To implement transparent queries, the encrypted columns are first decrypted and then filled with virtual columns, which in turn are used to fill the view.

The ciphertext index is used to implement efficient encrypted column queries. Since the content of the dummy column is the plaintext value of the encrypted column, the index to the dummy column is the index to the encrypted column. In the invention, the ciphertext index is directly realized by using the virtual column index of the database. I.e. to add to the dummy column an index of the same type as the original field F1. Since these indexes do not store the real column contents, only contain the size relationship between records, the real column contents cannot be restored by the indexes.

The trigger is used for taking over requests of adding, modifying, deleting and the like to T1, and the transparency of the operations of adding, modifying, deleting and the like to the columns is realized. When the contents of the encrypted column F1 are included in the INSERT request, the UPDATE request and the DELETE request, the following processes are respectively performed:

(1) for an INSERT request, a trigger calls the encryption function, calculates the ciphertext value of the encrypted column F1 inserted into the record, and INSERTs the ciphertext value into a ciphertext table T1_ together with the values of all other columns;

(2) for the UPDATAE request, the trigger calls the encryption function, calculates a ciphertext value of a new value of the encrypted column F1 in the update record, and updates the encrypted column F1 _ofthe corresponding record in T1 _withthe ciphertext value;

(3) for the DELETE request, the trigger DELETEs the corresponding record in T1 _.

Further, in order to make the present invention suitable for autonomous controllability, to meet the requirements of localization, or to meet the special needs of different industries, the database transparent encryption system further includes a user-defined function for implementing a specific encryption/decryption algorithm and a key management method, such as implementing a domestic cryptographic algorithm and/or a key management method. The encryption function maps the encrypted column contents to a ciphertext value from which the actual contents of the encrypted column cannot be deduced without knowing the decryption algorithm and key. When decryption is needed, the encrypted value is decrypted by using the corresponding decryption function and the key to obtain the encrypted content. The key management method realizes management of key generation, storage, distribution, destruction and the like.

Embodiment 2 implementation of database encryption System with function dummy columns in encryption tables

This embodiment details the implementation of the function dummy column in the encryption table of the database transparent encryption method based on the function dummy column and the dummy column index according to the present invention, as shown in fig. 2. In this case, the database is required to support a Virtual Columns (Virtual Columns) property. There are many databases that support virtual columns, such as Oracle, dreams, Mysql, etc. The virtual columns in these databases are used to implement the function virtual columns in this embodiment 1, that is, when the virtual columns are defined as decryption functions of ciphertext columns, the virtual columns become the function virtual columns. The present embodiment is described based on an Oracle database.

Table 1 shows the original data table T1 before encryption in this embodiment. Including four column IDs, C1, C2, and C3. Column ID is the primary key, C1 is a character-type column, and is a non-sensitive column, which does not need to be encrypted. C2 and C3 are numeric columns, which are columns to be encrypted.

Table 1: data table T1 before encryption

ID	C1	C2	C3
				1	Apple	1	20010411
2	Bee	2	19891024
				3	Cat	3	19940507
4	Dog	4	20030915

A database transparent encryption method based on function virtual columns and virtual column indexes is realized as follows:

firstly, the method comprises the following steps: and establishing a safe view.

Firstly, a table T1 (ID, C1, C2 and C3) where an original encryption column C2 is located is renamed to an encryption table T1_, a column C2 is renamed to C2_, a value in C2_ is encrypted, at this time, a ciphertext obtained by encrypting an original C2 plaintext is stored in C2_, a column C3 is renamed to C3_, a value in C3_ is encrypted, and at this time, a ciphertext obtained by encrypting the original C3 plaintext is stored in C3 _.

Using Oracle's virtual column property, add to T1 a functional virtual column C21= DEC (C2), C31= DEC (C3):

altertable T1_ add (C21 as (DEC(C2_)) virtual, C31 as (DEC(C3_))virtual);

then, a view T1 is established, which is the same name as the encrypted original table T1 and has the same column ID, C1, C2 and C3, where C2 is read from column C21 in table T1_ and the value of C21 is generated from C2_ decryption when needed, C3 is read from column C31 in table T1_ and the value of C31 is generated from C3_ decryption when needed. T1 is defined as:

CREATE VIEW T1 AS SELECT ID, C1, C21 AS C2, C31 AS C3FROM T1_;

so far, when the user accesses the original table T1 in the database using SQL statements, it will actually act on the T1 view. For a query operation, the T1 view fills the view by reading the column ID, C1, and virtual columns C21, C31 from T1 — and feeds back to the user. While the user does not perceive the existence of the actual encryption and decryption process.

II, secondly: and establishing a ciphertext index.

Since the Oracle database allows indexes to be created for virtual columns and maintained automatically according to the definition function of the virtual columns, the ciphertext indexes are implemented in this embodiment directly by creating exactly the same indexes for the virtual columns C21, C31 as on the original C2, C3 columns.

Thirdly, the method comprises the following steps: and establishing a trigger to realize transparent support of the operations of insertion, deletion and update.

(1) INSTEAD OF TRIGGER FOR INSERT ON T1, an INSTEAD OF type TRIGGER FOR INSERT operations, built ON view T1. This trigger is triggered to execute when data is inserted into view T1. The flip-flop will encrypt columns C2 and C3 for each row of data inserted on T1, generate a new record { ID, C1, C2_, C3_ } that is inserted into encryption table T1 _. The value of the dummy column C21 need not be filled in here.

(2) INSTEAD OF TRIGGER FOR DELETE ON T1, an INSTEAD OF type TRIGGER FOR DELETE operations that is established ON view T1. This trigger is triggered to execute when data is deleted from view T1. The trigger will delete the corresponding record in the encryption table T1-for each row of data deleted from T1.

(3) INSTEAD OF TRIGGER FOR UPDATE ON T1, an INSTEAD OF type TRIGGER FOR UPDATE operations that is built ON view T1. This trigger is triggered to execute when data is updated onto view T1. The trigger will, for each row of data updated at T1, if the updated data relates to C2 or C3, call the encryption function to encrypt column C2 or C3 to its ciphertext value, and update the encrypted column C2_ or C3_ in the T1_ table with the ciphertext value.

Further: and establishing a user-defined function.

The user-defined function in this embodiment implements encryption and decryption of encrypted columns, and key management. In this embodiment, the user-defined function not only calls the function package provided by ORACLE itself to implement the international standard encryption algorithm (AES, 3DES, etc.), but also implements the support for the national encryption algorithm (including SM1, SM4, etc.), and the key management kms (keymanagement system) conforming to the national encryption standard.

Taking SM4 as an example, the encryption and decryption logic of SM4 is implemented in an encryption and decryption function:

1.create or replace function DEC(plaintext in varchar, keyid in number)

2.return varchar

3.as

4.begin

5.return sm4_encryption(plaintext, keyid);

the end function name;

where SM4_ encryption (keyid) is the decryption logic of the SM4 algorithm, and the key number used is the keyid.

1.create or replace function ENC(ciphertextin varchar, keyid innumber)

2.return varchar

3.as

4.begin

5.return sm4_decryption(ciphertext, keyid);

The end function name;

where SM4_ decryption (keypert, keyid) is the encryption logic of the SM4 algorithm, and the key number used is the keyid.

In conclusion, the support of international standard algorithms, national cryptographic algorithms, key management methods, even encryption and decryption algorithms in special industries or user-created algorithms can be realized through the user-defined functions, and the practical scene of the invention is extended.

A database transparent encryption system based on function virtual columns and virtual column indexes comprises an encryption table T1 _generatedbased on an encrypted original table, a view T1 with the same name as the encrypted original table, function virtual columns, virtual column indexes and triggers; wherein, the view T1 is respectively connected with the T1_, the function virtual column and the trigger; the function virtual column is also connected with the virtual column index;

t1_ comprises ID, C1, C2_, C3_ four columns and two virtual columns of C21 and C31, wherein C2 _andC 3_ are respectively used for storing ciphertext of C2 and C3 columns of the original table, and the virtual columns C21 and C31 are used for obtaining plaintext of C2 _andC 3_ columns;

view T1 includes four columns of ID, C1, C2, C3, the content originating from ID, C1, C21, C31 of T1_ respectively;

the same indexes on the virtual columns C21 and C31 as the columns C2 and C3 of the original table;

and triggers aiming at addition, modification and deletion requests on the view T1 are respectively used for processing an INSERT request, an UPDATE request and a DELETE request, when the addition and modification requests relate to the C2 and/or C3 columns, an encryption function is called to calculate corresponding ciphertext values, the corresponding ciphertext values are inserted or updated into the encryption table T1_ together with the values of all other columns, and when the addition and modification requests are deleted, corresponding records in the T1_ are directly deleted.

Further, the database transparent encryption system further comprises a user-defined function which is respectively connected with the view T1 and the function virtual column, and the user-defined function is used for realizing support for a national cryptographic algorithm, support for a key management KMS conforming to the national cryptographic standard and support for an international standard encryption algorithm or a special industry encryption and decryption algorithm. Theoretically, any algorithm of a database user can be supported through the user-defined function.

Those skilled in the art will appreciate that the above system only relates to tables in the database that require transparent encryption and decryption, and therefore only this part will be described in detail, and the system is not described, i.e. remains the same, for content that does not require transparent encryption. Moreover, this example takes the case that there are 2 columns in one table that require transparent encryption and decryption, and those skilled in the art can process this similarly for the case of single column or more columns.

Through the realization of all parts of the system composition, the transparent encryption and ciphertext indexing of database systems such as ORACLE and the like can be realized, the encryption storage of sensitive data is realized, the overhead of additional storage is avoided, and the high increasing, deleting, modifying and searching efficiency and the support for the autonomous controllable domestic encryption and decryption algorithm and key management are ensured.

Example 3: implementation of database encryption system when virtual function column is in view

This embodiment details the implementation of the function virtual column in view based on the database transparent encryption method of the present invention, as shown in fig. 3. This approach requires the database to support indexing of fields on the view, i.e., indexing the view. Databases supporting indexed views are also numerous, such as Microsoft SQL Server, etc. The present embodiment is described based on the SQL Server database.

The difference from embodiment 1 is that in the index view-based implementation, the function virtual column is a column defined on the view, not a virtual column defined on the table. This column on the view is filled using a decryption function, that is to say the value of this column on the view is the decrypted plaintext value of the encrypted column. Taking table 2 as an example, the following differences are realized:

table 2: data table T1 before encryption

ID	C1	C2
			1	Apple	1
2	Bee	2
			3	Cat	3
4	Dog	4

Firstly, the method comprises the following steps: and establishing a view.

Firstly, a table T1 (ID, C1 and C2) in which the original encrypted column C2 is located is renamed to an encryption table T1_, a column C2 is renamed to C2_, and encrypted ciphertext of the original C2 plaintext is stored in C2 _.

Of course, those skilled in the art will appreciate that this can also be achieved by creating the encryption table T1_, and deleting the original table T1.

Then, a view T1 is created, which is the same name as the original table T1 being encrypted and has the same column ID, C1 and C2, where C2 is decrypted from column C2_ in table T1 _. T1 is defined as:

CREATE VIEW T1 AS SELECT ID, C1, DEC(C2_) AS C2 FROM T1_;

the virtual column C2 of the function is a column in the view, which does not store the real value itself, and calls the decryption function to fill it when it is queried.

II, secondly: and establishing a ciphertext index.

An index is created for the function column C2 of view T1:

CREATE INDEX IX_C2 ON T1(C2);

the database will automatically maintain the index according to the defined function of C2 at this point.

This example is exemplified by the presence of 1 column in a table that requires transparent encryption and decryption, which can be handled by one skilled in the art in the same way for the case of multiple columns.

It is well within the skill of those in the art to implement encryption for other types of columns and to implement the method and system on other databases using similar methods.

In summary, those skilled in the art know that the method is implemented by using the characteristics of the virtual columns of the functions, the virtual column indexes, the views, the triggers, the user-defined functions and the like provided by the database, and the system intrusion degree is low. The function virtual column and the index ciphertext index on the virtual column are used, so that the extra storage consumption is avoided, the operation efficiency is improved, and more index types can be supported.

When the function virtual column and the index thereof are positioned in the encrypted table, the function virtual column is realized based on the virtual column (virtual column) characteristic of the database; when the function virtual column and the index thereof are positioned in the view with the same name as the original table, the method is realized based on the index view characteristic of the database.

Example 4

Referring to fig. 4, an embodiment of the present invention further provides an electronic device 60, including:

at least one processor; and the number of the first and second groups,

a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform any of the embodiments described above.

Embodiments of the present invention also provide a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform any of the foregoing embodiments.

Embodiments of the present invention also provide a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform any of the preceding embodiments.

Referring now to FIG. 4, a block diagram of an electronic device 60 suitable for use in implementing embodiments of the present disclosure is shown. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., car navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. The electronic device shown in fig. 4 is only an example, and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 4, the electronic device 60 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 601 that may perform various appropriate actions and processes in accordance with a program stored in a Read Only Memory (ROM) 602 or a program loaded from a storage means 608 into a Random Access Memory (RAM) 603. In the RAM 603, various programs and data necessary for the operation of the electronic apparatus 60 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input/output (I/O) interface 605 is also connected to bus 604.

Generally, the following devices may be connected to the I/O interface 605: input devices 606 including, for example, a touch screen, touch pad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 607 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 608 including, for example, tape, hard disk, etc.; and a communication device 609. The communication means 609 may allow the electronic device 60 to communicate with other devices wirelessly or by wire to exchange data. While fig. 4 illustrates an electronic device 60 having various means, it is to be understood that not all illustrated means are required to be implemented or provided. More or fewer devices may alternatively be implemented or provided.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network via the communication means 609, or may be installed from the storage means 608, or may be installed from the ROM 602. The computer program, when executed by the processing device 601, performs the above-described functions defined in the methods of the embodiments of the present disclosure.

It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer readable signal medium may comprise a propagated data signal with computer readable program code embodied therein, either in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, optical cables, RF (radio frequency), etc., or any suitable combination of the foregoing.

The computer readable medium may be embodied in the electronic device; or may exist separately without being assembled into the electronic device.

The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring at least two internet protocol addresses; sending a node evaluation request comprising the at least two internet protocol addresses to node evaluation equipment, wherein the node evaluation equipment selects the internet protocol addresses from the at least two internet protocol addresses and returns the internet protocol addresses; receiving an internet protocol address returned by the node evaluation equipment; wherein the obtained internet protocol address indicates an edge node in the content distribution network.

Alternatively, the computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: receiving a node evaluation request comprising at least two internet protocol addresses; selecting an internet protocol address from the at least two internet protocol addresses; returning the selected internet protocol address; wherein the received internet protocol address indicates an edge node in the content distribution network.

Computer program code for carrying out operations for aspects of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + +, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in the embodiments of the present disclosure may be implemented by software or hardware. Where the name of a unit does not in some cases constitute a limitation of the unit itself, for example, the first retrieving unit may also be described as a "unit for retrieving at least two internet protocol addresses".

It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof.

The above description is only for the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A database transparent encryption method is characterized in that: the method comprises the following steps:

for a column F1 to be encrypted of the table T1, deleting the index on the F1 if the index exists; deleting the table T1 and creating a table T1 _havingthe same structure as the table T1, or renaming the T1 as T1_, and the column to be encrypted F1 is renatured as F1 in the T1 _; the F1 is stored in the F1 _afterbeing encrypted by using an encryption function ENC (X);

establishing a view T1 with the same structure as the table T1, wherein a column F1 takes values as a function virtual column F11, the F11 is established on the view T1 or on the table T1_, and the F11 defines a function as a decryption function DEC (F1_) corresponding to the encryption function;

establishing an index for the F11, wherein the index is the same as the index on the F1;

establishing a trigger on the view T1, and writing a ciphertext ENC (F1) into an F1_ column of the T1_ after encrypting a new value of the F1 when a new record is inserted and an updated record is updated; the corresponding record on the T1_ is deleted when the deletion operation is performed.

2. The method of claim 1, wherein: the method also comprises the step of establishing a user-defined function for the database, and the user-defined encryption and decryption algorithm and/or the key management method are/is realized.

3. A database transparent encryption system, characterized by: the method comprises the following steps:

4. The system of claim 3, wherein: the system also comprises a user-defined function which is used for realizing a user-defined encryption and decryption algorithm and/or a key management method.

5. An electronic device, characterized in that the electronic device comprises:

at least one processor; and the number of the first and second groups,

a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the database transparent encryption method of any one of claims 1-2.

6. A non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the database transparent encryption method according to any one of claims 1-2.

7. A computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the database transparent encryption method of any one of claims 1-2.