CN116436682A

CN116436682A - Data processing method, device and system

Info

Publication number: CN116436682A
Application number: CN202310459424.3A
Authority: CN
Inventors: 高继强
Original assignee: Zhejiang eCommerce Bank Co Ltd
Current assignee: Zhejiang eCommerce Bank Co Ltd
Priority date: 2023-04-23
Filing date: 2023-04-23
Publication date: 2023-07-14

Abstract

The embodiment of the specification provides a data processing method and a device, wherein the method is applied to target equipment and comprises the following steps: receiving first encryption information which is sent by a client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by target equipment; decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information; encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server. The shared secret key is sent to the client in advance, encryption information based on the encryption of the shared secret key is received, encryption transmission of the information between the client and the target equipment is ensured, the encryption information is decrypted, the decryption result is re-encrypted according to a preset encryption method, the data exist in a ciphertext form in the whole transmission process, and the data are encrypted by using different secret keys respectively, so that the risk of data leakage is effectively reduced, and the data security is improved.

Description

Data processing method, device and system

Technical Field

The embodiment of the specification relates to the technical field of computers, in particular to a data processing method and system.

Background

With the rapid development of mobile internet and computing technology, the improvement of the technological innovation capability of enterprises makes the digital transformation to present an accelerating trend, and various institutions generate a large amount of data in daily production and operation activities, and the data often bear the core assets of the enterprises. Database systems, which are the most widespread and important carriers of information society, are often managed and maintained by personnel within a company or by related authorized technicians to ensure security compliance with the use and storage of confidential data.

However, in recent years, data security events are endless at home and abroad, and data security and privacy protection are also becoming hot concerns of various circles. Because the implementation of the current privacy protection technology depends on a large number of complex calculations, a database system has a large performance bottleneck, and the data transmission process cannot be better ensured, a data protection method is needed to improve the safety of data in the transmission and storage processes.

Disclosure of Invention

In view of this, the present embodiments provide a data processing method. One or more embodiments of the present specification also relate to a data processing apparatus, a computing device, a computer-readable storage medium, and a computer program that solve the technical drawbacks of the prior art.

According to a first aspect of embodiments of the present disclosure, there is provided a data processing method, applied to a target device, including:

receiving first encryption information which is sent by a client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by target equipment;

decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information;

encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server.

According to a second aspect of embodiments of the present specification, there is provided a data processing method, applied to a server, including:

receiving second encryption information sent by target equipment;

processing the second encryption information to obtain an encryption execution result;

judging whether to return the encryption execution result to the target equipment according to the type of the second encryption information;

if yes, determining the encryption execution result as feedback information, and sending the feedback information to the target equipment.

According to a third aspect of embodiments of the present specification, there is provided a data processing method, applied to a target device, including:

receiving a first encryption structured query statement sent by a client and based on shared key encryption, wherein the shared key is sent to the client in advance by target equipment;

Decrypting the first encryption structured query statement based on the shared key to obtain a first plaintext structured query statement corresponding to the first encryption structured query statement;

encrypting the first plaintext structured query sentence according to a preset encryption method to obtain a second encrypted structured query sentence, and sending the second encrypted structured query sentence to the server.

According to a fourth aspect of embodiments of the present specification, there is provided a data processing system comprising a client, a target device and a server;

the target device is configured to receive first encryption information which is sent by the client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by the target device; decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information; encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server;

the server is configured to receive second encryption information sent by the target device; and processing the second encryption information to obtain an encryption execution result.

According to a fifth aspect of embodiments of the present specification, there is provided a data processing apparatus configured to a target device, including:

The first receiving module is configured to receive first encryption information which is sent by the client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by the target equipment;

the first decryption module is configured to decrypt the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information;

the first encryption module is configured to encrypt the first plaintext information according to a preset encryption method to obtain second encrypted information, and send the second encrypted information to the server.

According to a sixth aspect of embodiments of the present specification, there is provided a data processing apparatus configured to a server, comprising:

the second receiving module is configured to receive second encryption information sent by the target equipment;

the processing module is configured to process the second encryption information to obtain an encryption execution result;

the judging module is configured to judge whether to return the encryption execution result to the target equipment according to the type of the second encryption information;

and the second sending module is configured to determine that the encryption execution result is feedback information if the encryption execution result is yes, and send the feedback information to the target equipment.

According to a seventh aspect of embodiments of the present specification, there is provided a data processing apparatus configured to a target device, including:

The third receiving module is configured to receive a first encryption structured query statement which is sent by the client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by the target equipment;

the third decryption module is configured to decrypt the first encryption structured query statement based on the shared key to obtain a first plaintext structured query statement corresponding to the first encryption structured query statement;

the third encryption module is configured to encrypt the first plaintext structured query statement according to a preset encryption method to obtain a second encrypted structured query statement, and send the second encrypted structured query statement to the server.

According to a eighth aspect of embodiments of the present specification, there is provided a computing device comprising:

a memory and a processor;

the memory is configured to store computer executable instructions that, when executed by the processor, perform the steps of the data processing method described above.

According to a ninth aspect of embodiments of the present specification, there is provided a computer readable storage medium storing computer executable instructions which, when executed by a processor, implement the steps of the data processing method described above.

One embodiment of the present disclosure implements receiving first encryption information sent by a client and encrypted based on a shared key, where the shared key is sent to the client in advance by a target device; decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information; encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server. The method comprises the steps of sending a shared secret key to a client in advance, receiving first encryption information based on the shared secret key encryption sent by the client, ensuring the encryption transmission of the information between the client and target equipment, decrypting the first encryption information into first plaintext information, and re-encrypting the first plaintext information according to a preset encryption method to obtain second encryption information, so that the data exist in a ciphertext form in the whole transmission process, and are encrypted by using different secret keys respectively, thereby effectively reducing the risk of data leakage and improving the data security.

Drawings

FIG. 1 is a flow chart of a data processing method provided in one embodiment of the present disclosure;

FIG. 2 is a flow chart of a method of data processing provided in one embodiment of the present disclosure;

FIG. 3 is a flow chart of a method of data processing provided in one embodiment of the present disclosure;

FIG. 4 is a schematic diagram of a data processing method according to an embodiment of the present disclosure;

FIG. 5 is a system diagram of a data processing system according to one embodiment of the present disclosure;

FIG. 6 is a process flow diagram of a data processing method according to one embodiment of the present disclosure;

FIG. 7 is a schematic diagram of a data processing apparatus according to one embodiment of the present disclosure;

FIG. 8 is a schematic diagram of a data processing apparatus according to one embodiment of the present disclosure;

FIG. 9 is a schematic diagram of a data processing apparatus according to one embodiment of the present disclosure;

FIG. 10 is a block diagram of a computing device provided in one embodiment of the present description.

Detailed Description

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present description. This description may be embodied in many other forms than described herein and similarly generalized by those skilled in the art to whom this disclosure pertains without departing from the spirit of the disclosure and, therefore, this disclosure is not limited by the specific implementations disclosed below.

The terminology used in the one or more embodiments of the specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of the specification. As used in this specification, one or more embodiments and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used in one or more embodiments of the present specification refers to and encompasses any or all possible combinations of one or more of the associated listed items.

It should be understood that, although the terms first, second, etc. may be used in one or more embodiments of this specification to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first may also be referred to as a second, and similarly, a second may also be referred to as a first, without departing from the scope of one or more embodiments of the present description. The word "if" as used herein may be interpreted as "at … …" or "at … …" or "responsive to a determination", depending on the context.

Furthermore, it should be noted that, user information (including, but not limited to, user equipment information, user personal information, etc.) and data (including, but not limited to, data for analysis, stored data, presented data, etc.) according to one or more embodiments of the present disclosure are information and data authorized by a user or sufficiently authorized by each party, and the collection, use, and processing of relevant data is required to comply with relevant laws and regulations and standards of relevant countries and regions, and is provided with corresponding operation entries for the user to select authorization or denial.

First, terms related to one or more embodiments of the present specification will be explained.

SSH key (secure access credential): the SSH key is a secure access credential used in the Secure Shell (SSH) protocol. Secure and scalable authentication methods are provided based on keys of Public Key Infrastructure (PKI) technology. The automation of large-scale connection flows, single Sign On (SSO), identity and access management required by today's enterprises can be achieved.

TEE (Trusted execution environment trusted execution environment): TEE is a stand-alone processing environment with arithmetic and storage functions that provides security and integrity protection. The TEE is to allocate an isolated memory for the secret data in the hardware, all the computation of the secret data is performed in the isolated memory, and other parts of the hardware except the authorized interface cannot access the information in the isolated memory, so that the privacy computation of the secret data is realized.

RND (Random, random encryption): the RND encrypts the data by adopting the random number, can provide the strongest security assurance, and has indistinguishability.

DET (Deterministic), deterministic encryption): DET encrypts data with certain numbers, which is also highly secure, and can deterministically generate the same ciphertext for the same plaintext.

HOM (Homomorphic encryption ): HOM is a probabilistic encryption scheme that allows a server to make ciphertext queries, the end result of which is decrypted by a proxy server.

OPE (Order-preserving encryption), order-preserving encryption): the ciphertext after OPE encryption is sequentially consistent with the plaintext, thus allowing a range query to be performed directly on the ciphertext.

Secret data: the secret state data is a complete propagation link from the data entering circulation to sharing and calculation until destruction, the whole data process is kept in an encryption state without plaintext, the data use right is separated from the holding right, and the cross-domain management of the data use right is realized, so that the whole process of the data circulation is ensured to be safe and controllable.

The database system security is based and ensured by taking cloud computing as an application background, and in recent years, data security events are endless at home and abroad, and data security and privacy protection are also becoming hot spot problems of concern in various circles. At present, enterprise data leakage mainly comes from two channels, namely from database operators in the company and from external network attacks. To thoroughly protect the security of the database system, it is necessary to achieve complete encrypted storage and encrypted transmission of data, but at the same time, the use efficiency and the calculation overhead cannot be excessively affected due to the problem of ciphertext expansion. Because the implementation of the current privacy protection technology depends on a large number of complex calculations, a database system has a large performance bottleneck, and the data transmission process cannot be better ensured.

Illustratively, currently, computer technicians mainly design a pre-proxy encryption scheme and an application system retrofit encryption scheme to ensure user data security.

The pre-proxy encryption scheme adds a security proxy service in front of the database to be used through the pre-proxy and encryption gateway technology, a user performs operations such as adding and inquiring the database, the user needs to pass through the security proxy gateway, the security proxy gateway is responsible for encrypting data and then sending the data to the server, the execution result returned by the server also passes through the security proxy gateway, and the security proxy gateway is responsible for decrypting the data and then sending the data to the client. The method cannot guarantee the security of data transmission between the client and the security proxy gateway, and the risk of data leakage can exist in a complex network environment. Moreover, since the data encryption and decryption service is fully responsible by the security proxy gateway, the risk of contacting plaintext data exists for the internal personnel responsible for developing the security proxy service, and the risk of revealing the data from the inside easily results in doubtful calculation credibility of the security proxy service by the user.

And the application system reforms an encryption scheme, and an encryption and decryption API interface is developed in the application system by reforming an application layer of the system, so that encryption and decryption of sensitive data are realized. The obvious problem brought by the scheme is that the application layer is modified to cause the application system to become heavy, and any logic change related to encryption and decryption can cause the application system to modify the code layer and redeploy the production environment. The development cost of the application system is high, the encryption algorithm which can be realized by the API interface is single, various query requirements of the database can not be met, and the expandability is not flexible enough.

Based on the above, one embodiment of the present disclosure implements receiving first encryption information based on shared key encryption sent by a client, where a shared key is sent to the client in advance by a target device; decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information; encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server. The method comprises the steps of sending a shared secret key to a client in advance, receiving first encryption information based on the shared secret key encryption sent by the client, ensuring the encryption transmission of the information between the client and target equipment, decrypting the first encryption information into first plaintext information, and re-encrypting the first plaintext information according to a preset encryption method to obtain second encryption information, so that the data exist in a ciphertext form in the whole transmission process, and are encrypted by using different secret keys respectively, thereby effectively reducing the risk of data leakage and improving the data security.

In the present specification, a data processing method is provided, and the present specification relates to a data processing system, a data processing apparatus, a computing device, and a computer-readable storage medium, one by one, in the following embodiments.

Referring to fig. 1, fig. 1 shows a flowchart of a data processing method according to an embodiment of the present disclosure, which is applied to a target device, and specifically includes the following steps.

Step 102: and receiving first encryption information which is sent by the client and is encrypted based on the shared key, wherein the shared key is sent to the client in advance by the target equipment.

In practical applications, the client may interact with the server by sending information. Because of the complexity of the network environment, the client sends the plaintext information to the server, and the plaintext information is easily revealed due to hacking, script crawling, firewall loopholes and other reasons in the transmission process. Therefore, the client can agree with the encryption key with the server, encrypt the information and send the information, ensure that the information is in an encrypted state in the transmission process, and add a layer of security protection for the information.

It is easy to understand that both the client and the server store the encryption key, and thus the risk of leakage of the encryption key is increased, and no matter which end of the client and the server is broken, leakage of information may be caused. In order to further improve the data security, the security transmission and storage of the data information are usually ensured by continuously improving the cracking difficulty of an encryption algorithm or a password protocol.

However, in the practical application scenario, the encryption algorithm or the cryptographic protocol which depends on a large number of complex calculations increases the system overhead and kernel load, which easily results in too long response time to the user request, and the feedback to the client cannot be performed in time, or the feedback result is inaccurate, so that many encryption algorithms or cryptographic protocols with better confidentiality cannot be applied in a large scale in the practical application scenario.

Based on the above problems, in one or more embodiments of the present disclosure, by adding a target device for deploying a Trusted Execution Environment (TEE) in an interaction process between a client and a server, encrypting and decrypting information in the target device, on the basis of guaranteeing data security, the server system overhead is reduced, and, due to isolation of the TEE itself, secure computation of memory isolation can be implemented based on a CPU of hardware security, computation of privacy protection can be completed on the premise of guaranteeing computation efficiency, so that the target device can satisfy requirements of users for data security protection, and data security is improved from both internal and external aspects.

In practical application, the target device may receive the first encrypted information sent by the client and encrypted based on the shared key, so that the first encrypted information may be processed in the TEE module, and the processed data security information may be sent to the server.

Specifically, the target device may be a third party device independent of the client and the server, may be a chip, or may be a software structure deployed inside the client or the server. The target device is provided with a Trusted Execution Environment (TEE), and the processing operation on the secret data can be executed in the Trusted Execution Environment (TEE).

It should be noted that the trusted execution environment may have the characteristics of data independence, time isolation, information flow control, fault isolation, etc., and is an untampered execution environment, so that the security, authentication and integrity of the internal code of the trusted execution environment may be ensured; it may prove its security to a third party; the method has better resistance to software attacks and physical attacks of the main system, and can effectively stop the attacks developed by utilizing the security holes. The data independent is mainly reflected in that the data stored in a certain partition cannot be read or tampered by other partitions; time isolation is mainly embodied in that data in a common resource region does not reveal data information in any partition. The information flow control is mainly characterized in that communication cannot be carried out among all the subareas unless special permission exists; fault isolation is primarily manifested in that security vulnerabilities in one partition cannot be propagated to other partitions.

The shared key may be sent to the client in advance by the target device, or may be generated by the client and sent to the target device in advance before the information is transmitted. The first encryption information can be understood as information which the client wants to send to the server, and the information is obtained by encrypting a shared key agreed by the client and the target device, so that the information is in a ciphertext form in a transmission state, and the security in the data transmission process can be ensured. The content of the information that the client wants to send to the server may be various, may be a specific instruction, may be an interactive request, for example, a query request, etc., and the specific content may be according to the actual situation, which is not limited in this specification.

It should be noted that, because the trusted execution environment has strong confidentiality to the outside and isolation to computer technicians, it can be ensured that internal technicians such as developers and maintenance personnel cannot acquire plaintext data from the trusted execution environment, so that the encryption key is generated in the trusted execution environment, the security of the key can be ensured, and the security of data information is improved.

Based on this, in one or more embodiments of the present disclosure, before the client performs information transmission with the target device, the client may verify the security of the target device, and obtain the shared key between the client and the target device from the trusted execution environment of the target device, which may specifically include the following steps:

Receiving a verification request sent by a client, wherein the verification request is used for verifying whether a trusted execution environment is configured in target equipment;

generating a shared key for the client in the trusted execution environment in the case that the target device is configured with the trusted execution environment;

the shared key is sent to the client.

In particular, the verification request may be understood as a request for verifying whether a trusted execution environment is configured in the target device, i.e. whether the target device is secure and trusted.

In practical application, before the client establishes communication connection with the target device and starts data transmission, the client can initiate a verification request for the target device to verify whether a trusted execution environment is deployed in the target device. The target device receives the verification request sent by the client, can verify the trusted execution environment therein, and in the case of configuring the trusted execution environment, securely generates a shared key for the client in the trusted execution environment and sends the shared key to the client.

Illustratively, the client may verify that the target device has loaded the correct code into the trusted execution environment by executing the remote authentication protocol of the SGX, and after verification is successful, the user obtains the shared key; the client will then authenticate its credentials (e.g., a password or SSH key) through the established secure channel to the trusted execution environment, and this shared key is used as the client's session key after the trusted execution environment successfully authenticates the client credentials. The target device here supports management of multiple users.

The shared key may be dynamically generated, or may be stored in the storage area in the form of a storage state after the first generation. In one or more embodiments of the present disclosure, in order to further improve security and confidentiality of the shared key, in a trusted execution environment, a shared key that can only be applied to a dynamic form during the present communication may be generated for the present communication connection according to unique identification information of the client, such as an IP address, or the like. Further, the method for generating the shared key in the trusted execution environment may be implemented by an encryption algorithm such as a symmetric encryption algorithm or a national encryption algorithm, and may be specific according to the actual situation, which is not limited in this specification.

Before communication connection is established, the trusted execution environment in the target equipment is verified, a shared secret key between the target equipment and the client is generated under the condition that the trusted execution environment is deployed in the target equipment, and the shared secret key is sent to the client, so that the safety of the target equipment can be ensured, the client and the target equipment can be supported to be verified, and the data safety is further ensured. And the target equipment supports multiple users, can generate different shared secret keys according to different clients and different communication connections, can realize the safety protection of data to the greatest extent, and ensures the safety somatosensory of the users.

After the client establishes a secure connection channel with the target device that can be used for communication, the client can encrypt information that is desired to be sent to the server based on the shared key, and then send the encrypted information to the target device, and the target device receives the first encrypted information sent by the client and encrypted based on the shared key.

By carrying out encryption transmission on the information based on the shared secret key, the data can be ensured to exist in the form of ciphertext in the transmission process, and the security of the data in the transmission process is improved based on the security of the encrypted data and the shared secret key.

Step 104: and decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information.

In practical application, after receiving the first encrypted information, the target device may directly send the first encrypted information to the server, decrypt the first encrypted information by the server, and execute a corresponding operation according to a result obtained by decrypting; if the target device is disposed inside the server, the data transmission between the target device and the server is relatively secure, and the first encrypted information can be decrypted by the target device and then the decrypted data is sent to the server, so that the server can directly execute corresponding operations based on the result obtained by decryption. However, the shared key is sent to the server in advance, and there is a risk of leakage from the outside, and there is a possibility that a worker inside the server acquires the shared key, and thus there is also a risk of leakage of data from the inside. The target devices are deployed inside the server, for example, in the same cloud service, or are deployed in the intranet of the company, so that the operation pressure and maintenance cost inside the server can be increased, and although the attack from the outside can be resisted, the data are stored in the server in a clear text form, so that the theft or leakage of personnel inside cannot be prevented.

Optionally, in one or more embodiments of the present disclosure, in order to further improve the security of the whole process of data in the storage state and the transmission state, after decrypting the first encrypted information based on the shared key to obtain the first plaintext information corresponding to the first encrypted information, the method may further include the following steps:

analyzing the first plaintext information to obtain an analysis result corresponding to the first plaintext information;

and determining a preset encryption method corresponding to the first plaintext information according to the analysis result.

In practical application, after the target device decrypts the first plaintext information based on the shared key, the target device may parse the first plaintext information to obtain a parsing result corresponding to the first plaintext information, and determine a preset encryption method corresponding to the first plaintext information according to the parsing result.

Specifically, the first plaintext information is obtained after the target device decrypts the first encrypted information based on the shared key.

The analysis result can be understood as a result of analyzing the first plaintext information, and further, the target device can call the analysis module to analyze the received first plaintext information in the trusted execution environment.

The preset encryption method can be understood as an encryption method different from the shared key, and based on the preset encryption method, the first plaintext information can be re-encrypted, and the first plaintext information is encrypted to obtain second encrypted information different from the first encrypted information. Therefore, the second encryption information cannot be obtained through decryption of the shared key, and in the transmission process of the data, different encryption methods can be used for encryption at different transmission stages respectively, so that the security of the encrypted data is further improved.

Optionally, a first cryptographic algorithm module may be configured in the trusted execution environment, and multiple cryptographic algorithms with different degrees of confidentiality and different functions are maintained through the first cryptographic algorithm module. Illustratively, four different encryption algorithms RND, DET, HOM and OPE may be stored in the first cryptographic algorithm module. According to the analysis result of the first plaintext information, a preset encryption method can be determined from the first cryptographic algorithm module, and as the encryption method aiming at the first plaintext information, the alternative encryption method is not a single encryption method, so that the flexibility of the encryption method can be improved, the difficulty of cracking the ciphertext is further improved, and the data security is improved.

It should be noted that, the encryption algorithm stored in the first cryptographic algorithm module is not fixed, and the encryption algorithm stored in the first cryptographic algorithm module can be updated and optimized continuously according to the research and development of a developer on a new encryption algorithm. Accordingly, the above examples are merely provided to assist the skilled person in better understanding the embodiments provided in this specification and are not intended to be limiting in detail on the encryption algorithm.

Optionally, in one or more embodiments of the present disclosure, analyzing the first plaintext information to obtain an analysis result corresponding to the first plaintext information may include the following steps:

And analyzing the first plaintext information to obtain at least one piece of first plaintext sub-information and attribute information corresponding to each piece of first plaintext sub-information.

In practical application, not all data have sensitivity, and part of information is possible for users to have no risk of confidential leakage, so that different types of information can have different security levels, and encryption algorithms with different complexity are selected according to the different security levels, so that the computing resources and the system cost can be saved, and the data processing efficiency is further improved.

In particular, the first plaintext information may be understood as a part of all information included in the first plaintext information. For example, two data processing instructions may be included in the first plaintext information, and the first plaintext sub-information may correspond to the two data processing instructions, respectively. The attribute information corresponding to the first plaintext sub-information may be understood as information describing the first plaintext sub-information, for example, information identifying the security level of the first plaintext sub-information, and the attribute information may be in various forms, for example, a user may add a security mark ENC to the sub-information with higher security before transmitting the information, so that the target device may determine an encryption algorithm corresponding to the first plaintext sub-information according to the attribute information.

By analyzing the first plaintext information to obtain at least one piece of first plaintext information and attribute information corresponding to each piece of first plaintext information, information transmitted by a user can be subdivided, and data can be encrypted on finer granularity, so that different pieces of information in the information can be respectively encrypted through different encryption algorithms, the security of ciphertext information is improved, unnecessary data encryption can be reduced, and system overhead caused by encryption and decryption is reduced.

Correspondingly, according to the analysis result, determining the preset encryption method corresponding to the first plaintext information may include the following steps:

determining an initial encryption method corresponding to each first plaintext sub-information according to the attribute information corresponding to each first plaintext sub-information;

and determining a preset encryption method corresponding to the first plaintext information according to the initial encryption method corresponding to each piece of first plaintext sub-information.

Specifically, the initial encryption method may be any encryption method in the encryption algorithm module in the trusted execution environment, or may be an encryption method determined according to the attribute information corresponding to each first plaintext sub-information and conforming to a preset rule.

In practical application, the first plaintext information can be divided into finer granularity, an initial encryption method corresponding to each first plaintext sub-information is determined according to the attribute information corresponding to each first plaintext sub-information, and then a preset encryption method corresponding to the first plaintext information is determined based on the determined initial encryption method.

The initial encryption method corresponding to each first plaintext sub-information is determined according to the attribute information corresponding to each first plaintext sub-information, and the preset encryption method is determined based on a plurality of initial encryption methods, so that fine-grained data security assurance can be provided for users, and system performance and data processing efficiency can be improved.

Optionally, determining the initial encryption method corresponding to each first plaintext sub-information according to the attribute information corresponding to each first plaintext sub-information may include the following steps:

determining at least one reference encryption method corresponding to target attribute information from a preset encryption algorithm table according to target attribute information corresponding to target first plaintext sub-information, wherein the target first plaintext sub-information is any one of the at least one first plaintext sub-information;

and determining an initial encryption method corresponding to the target first plaintext sub-information in at least one reference encryption method based on a preset rule.

Specifically, the target first plaintext sub-information is any one of at least one first plaintext sub-information, and the target attribute information is attribute information corresponding to the target first plaintext sub-information. The preset encryption algorithm table can be understood as a storage structure for classifying, storing and maintaining different encryption algorithms, or can only store unique identification information corresponding to different encryption algorithms, and does not store specific encryption algorithms. The preset encryption algorithm table may specifically be a database table, txt document, outer table, or a data structure capable of storing a corresponding relationship such as an index table. For example, the preset encryption algorithm table may store and maintain different encryption algorithms according to different security levels corresponding to the different encryption algorithms: the preset encryption algorithm table can be classified into level 1, level 2 and level 3 according to the security level, wherein the level 1 classification can comprise encryption algorithms A1, A2 and A3; the encryption algorithms B1, B2, B3 may be included under class 2 classification; encryption algorithms C1, C2, C3. may be included under the class 3 classification; ....

It should be noted that, the target device may preset an attribute information storage table, and set different encryption methods for different types of attribute information correspondingly. Illustratively, the encryption level corresponding to the ENC1 attribute information is highest, so that an encryption algorithm with relatively highest confidentiality can be determined for the first plaintext sub-information with the attribute information ENC1 as an initial encryption method; the encryption grade corresponding to the ENC2 attribute information is the next highest, and an encryption algorithm with relatively high confidentiality can be determined for the first plaintext sub-information with the attribute information of ENC2 and used as an initial encryption method; the first plaintext sub-information that does not carry any attribute information may be identified as non-sensitive information and thus may not be encrypted using any encryption algorithm or a less confidentiality, less overhead encryption algorithm may be determined as an initial encryption method for such first plaintext sub-information.

In practical application, an initial encryption method corresponding to the target first plaintext sub-information may be determined in at least one reference encryption method based on a preset rule.

Specifically, the reference encryption method is one encryption method determined from the initial encryption methods. The preset rule may be determined according to an actual application scenario and a user requirement, for example, the preset rule may be that one initial encryption method is selected randomly from a plurality of initial encryption methods to be used as a reference encryption method, or may be that according to current calculation cost of a system, if the current calculation cost of the system is smaller, one initial encryption method with complex calculation is selected to be used as the reference encryption method, if the calculation cost of the current system is larger, one initial encryption method with smaller cost is selected to be used as the reference encryption method, and so on.

To further improve data security, in one or more embodiments of the present disclosure, the attribute information may include priority information;

correspondingly, according to the initial encryption method corresponding to each first plaintext sub-information, determining the preset encryption method corresponding to the first plaintext information may include the following steps:

and determining a preset encryption method corresponding to the first plaintext information from the initial encryption methods according to the priority information corresponding to the first plaintext information.

Specifically, the priority information may be understood as a security level, according to the priority information corresponding to each first plaintext sub-information, one first plaintext sub-information with the highest security level may be determined from the priority information corresponding to each first plaintext sub-information, and the reference encryption method corresponding to the first plaintext sub-information may be determined as the preset encryption method corresponding to the first plaintext information.

By taking the encryption method corresponding to the first plaintext sub-information with the highest confidentiality level in the first plaintext information as the preset encryption method for the whole first plaintext information, the security guarantee of the first plaintext information can be increased, and the security and confidentiality of the first plaintext information are improved in the data transmission and storage processes.

After the preset encryption method is determined, the first plaintext information can be encrypted based on the preset encryption method, so that data can be encrypted by using different encryption methods in different transmission processes, the ciphertext cracking difficulty of the encrypted data is improved, and the risk of leakage of all plaintext data due to leakage of a key in a certain link can be avoided.

Step 106: encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server.

In practical application, the first plaintext information may be encrypted by using a data key corresponding to a preset encryption method by using a rewrite function, so as to obtain second encrypted information obtained based on the encryption of the first plaintext information. Optionally, the operation of calling the rewrite function may be recorded in an embedded database of the memory of the encryption and decryption module included in the trusted execution environment for assisting subsequent rewrite and decryption operations.

Specifically, the second encryption information is encryption information obtained by encrypting the first plaintext information according to a preset encryption method. The second encrypted information is different from the first encrypted information, and cannot be decrypted by the shared key corresponding to the first encrypted information.

In order to realize fine-grained security guarantee for different data, one or more embodiments of the present disclosure encrypt the first plaintext information according to a preset encryption method to obtain second encrypted information, and may include the following steps:

determining a target initial encryption method corresponding to target first plaintext sub-information, wherein the target first plaintext sub-information is any one of at least one plaintext sub-information;

encrypting the target first plaintext sub-information according to a target initial encryption method to obtain target sub-encryption information corresponding to the target first plaintext sub-information;

and obtaining second encryption information according to each piece of sub encryption information.

Specifically, the target first plaintext sub-information is any one of the at least one plaintext sub-information; the target initial encryption method is an encryption method corresponding to the target first plaintext sub-information; the target sub-encryption information is sub-encryption information obtained by encrypting the target first plaintext sub-information according to a target initial encryption method. The first plaintext information includes first plaintext sub-information 1, first plaintext sub-information 2, and first plaintext sub-information 3, an encryption method corresponding to the first plaintext sub-information 1 is A1, an encryption method corresponding to the first plaintext sub-information 2 is B2, and an encryption method corresponding to the first plaintext sub-information 3 is C3, and then the first plaintext sub-information 1 is encrypted according to A1 to obtain sub-encrypted information 1; encrypting the first plaintext sub-information 2 according to B2 to obtain sub-encrypted information 2; and encrypting the first plaintext sub-information 3 according to the C3 to obtain sub-encrypted information 3, and splicing the sub-encrypted information 1, the sub-encrypted information 2 and the sub-encrypted information 3 to obtain second encrypted information.

The first plaintext sub-information is respectively encrypted by the encryption methods corresponding to the different first plaintext sub-information to obtain sub-encryption information, the second encryption information corresponding to the first plaintext information can be obtained by splicing the sub-encryption information, and in the second encryption information, different data can be used by different encryption methods or the same encryption method, and the second encryption information can be specifically determined according to attribute information corresponding to the data. By dividing the first plaintext data into fine grains and re-encrypting the first plaintext data by using a plurality of encryption algorithms, the system overhead can be saved and the data processing efficiency can be improved on the basis of improving the information security, thereby improving the user experience.

It should be noted that, depending on the type of information sent by the client, there are two possibilities of returning information and no returning information in the server. For example, if the information sent by the client is a deletion instruction for a record in the database in the server, after the server performs the deletion operation based on the second encrypted information, no information may be returned to the client, or only a message indicating that the instruction is successfully executed and that no encryption is required may be returned to the client, where no sensitive data is carried in the message. If the information sent by the client is the ID information in a certain form in the query database, the server needs to return the queried ID information.

Correspondingly, encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and after the second encrypted information is sent to the server, further comprising:

under the condition that the feedback information is returned by the server based on the second encryption information, decrypting the feedback information according to a preset encryption method to obtain second plaintext information corresponding to the feedback information;

and encrypting the second plaintext information based on the shared secret key to obtain third encrypted information, and transmitting the third encrypted information to the client.

In practical application, when receiving feedback information returned by the server based on the second encryption information, the feedback information may be decrypted according to a preset encryption method to obtain second plaintext information corresponding to the feedback information, and the second plaintext information is encrypted based on the shared key to obtain third encryption information, and the third encryption information is sent to the client.

Specifically, the feedback information is information returned based on the encryption execution result after the server processes the second encryption information. The second plaintext information is obtained by decrypting the feedback information according to a preset encryption method, and the second plaintext information can be understood as a result which is required to be obtained after the client sends the information.

In order to improve confidentiality of data in the server and prevent leakage of user data by internal personnel, in one or more real-time examples of the present disclosure, an encryption algorithm module corresponding to an encryption algorithm module in a target device may be set in the server, where the data is stored in a ciphertext manner in the server, and the internal personnel cannot directly contact with plaintext. Therefore, based on the second encrypted information obtained by encrypting the trusted execution environment of the target equipment, decryption is not needed in the server, and the server can directly process the second encrypted information to obtain an encrypted execution result.

The feedback information may be an initial encryption result obtained after processing according to the second encryption information, or may be an encryption execution result obtained by encrypting the initial encryption result again through an encryption/decryption module in the server. The encryption execution result can carry the encryption algorithm identification, so that the target device can correspondingly decrypt the encryption operation executed by the database according to the encryption algorithm identification.

Specifically, the third encryption information is encryption information obtained by encrypting the second plaintext information based on the shared key, in order to ensure the security of data transmission between the target device and the client, the target device decrypts the feedback information into the plaintext information through the trusted execution environment, encrypts the plaintext information through the shared key which can be decrypted by the client, and sends the encrypted third encryption information to the client, so that primary information interaction between the client and the server is completed.

The feedback information sent by the server is decrypted in the trusted execution environment, and the decryption result is encrypted again by using the shared key which can be decrypted by the client, so that the whole process of the data in the transmission state can be ensured to exist in a ciphertext form, the data security is greatly improved, and the data cannot be leaked from the inside and the outside.

Referring to fig. 2, fig. 2 shows a flowchart of a data processing method according to an embodiment of the present disclosure, which is applied to a server, and specifically includes the following steps.

Step 202: and receiving second encryption information sent by the target equipment.

In practical application, the server may receive the interaction information sent by the client, and process the information sent by the client. In order to improve the security of data stored in the server, in one or more embodiments of the present disclosure, the server may receive the second encrypted information sent by the target device, and return a processing result for the second encrypted information to the target device.

Step 204: and processing the second encryption information to obtain an encryption execution result.

In one or more embodiments of the present description, the server may be internally provided with a second cryptographic algorithm module similar to the first cryptographic algorithm module in the target device. Specifically, after a computer technician develops a new encryption algorithm, the new encryption algorithm may be added to the first and second cryptographic algorithm modules, respectively. Thus, the server can directly process the second encryption information without decrypting the second encryption information, and an encryption execution result is obtained.

In one or more embodiments of the present disclosure, in order to further improve security of data storage in a server, reduce risk of cracking of ciphertext by internal personnel, and adapt to output requirements of encrypted data in different query scenarios, when the data is stored in the server, the ciphertext may be further encrypted in multiple layers by using a target encryption model.

Illustratively, the first layer encryption algorithm may be designed to be order-preserving encryption, and the second layer encryption algorithm may be designed to be random number encryption, in response to a query scenario in which ciphertext is ordered and searched.

By designing different target encryption models aiming at different inquiry scenes, the data can be encrypted layer by layer, the safety of the data in the storage process can be further improved, and the risk of data leakage from the inside is reduced.

Accordingly, in one or more embodiments of the present disclosure, processing the second encryption information to obtain an encryption execution result may include the following steps:

processing the second encryption information to obtain an initial encryption result;

determining a target encryption model corresponding to the initial encryption result according to the type of the second encryption information, wherein the target encryption model comprises at least one layer of encryption algorithm;

And encrypting the initial encryption result according to the target encryption model to obtain an encryption execution result.

Specifically, the initial encryption result is an execution result obtained by processing the second encryption information by the server. The encryption execution result is an encryption result obtained after the initial encryption result is encrypted according to the target encryption model. The target encryption module can be an onion model and the like, comprises at least one layer of encryption algorithm model, and can realize multi-layer encryption of data, so that the security of the data in the whole process of a storage state and a transmission state is improved.

In practical application, a target encryption model corresponding to the second encryption information can be determined according to the type of the second encryption information, and the initial encryption result is encrypted through the target encryption model, so that the data security is further improved.

Step 206: and judging whether to return the encryption execution result to the target equipment according to the type of the second encryption information.

In practical application, whether to return the encryption execution result to the target device can be judged according to the type of the second encryption information, if the information sent by the user does not need to return the user data with practical significance, the server can return only one message which can represent that the server processes successfully after the second encryption information is processed, or not return any message.

Step 208: if yes, determining the encryption execution result as feedback information, and sending the feedback information to the target equipment.

In practical application, when it is determined that the data processing result needs to be returned to the client, the encryption execution result may be determined as feedback information, and the feedback information may be sent to the target device.

It should be noted that, since the encryption execution result is a result obtained by directly processing the second encrypted data, the feedback information returned to the target device is data obtained by encrypting the second encrypted data by an encryption algorithm corresponding to the preset encryption method, and the feedback information cannot be directly decrypted by the client, so that the target device can decrypt the feedback information according to the preset encryption algorithm to obtain the plaintext data information.

According to one embodiment of the specification, the second encryption information sent by the target equipment is received; processing the second encryption information to obtain an encryption execution result; judging whether to return the encryption execution result to the target equipment according to the type of the second encryption information; if yes, determining the encryption execution result as feedback information, and sending the feedback information to the target equipment.

By processing the second encryption information, the plaintext information can be ensured to be invisible to staff in the server, the risk of data leakage from the inside is avoided, the safety of the data in a storage state is improved, and the encryption execution result is returned to the target equipment under the condition of a return result, so that the safety of the data in the transmission process can be ensured.

Referring to fig. 3, fig. 3 shows a flowchart of a data processing method according to an embodiment of the present disclosure, which is applied to a target device, and specifically includes the following steps.

Step 302: receiving a first encryption structured query statement sent by a client and based on shared key encryption, wherein a shared key is sent to the client in advance by the target equipment;

with the development of technology, the innovation capability of enterprises is gradually improved, so that the digital transformation presents an acceleration trend, and various institutions can generate a large amount of data in daily production, operation and activities, and the data often bear the core assets of the enterprises. In a practical application scenario, more and more enterprises store and maintain large amounts of data related to the enterprises through database systems. Databases used by enterprises may typically be provided by a server, for example, a database service may be provided by a cloud server for a large number of clients, the database being capable of supporting structured query statement requests in response to multiple users.

In practical application, the client may encrypt the structured query statement based on the shared key to obtain a first encrypted structured query statement. Structured query language may be understood as a database query and programming language for accessing data and querying, updating and managing databases.

The database may be a database such as Mysql, sql server, etc., and the structured query term sent by the client may include various terms such as insert, find, query, delete, etc., which may be specific according to the actual situation, and this specification does not limit the description.

Step 304: decrypting the first encryption structured query statement based on the shared key to obtain a first plaintext structured query statement corresponding to the first encryption structured query statement;

in practical application, after receiving the first encrypted structured query statement, the target device may decrypt the first encrypted structured query statement based on the shared key to obtain a first plaintext structured query statement corresponding to the first encrypted structured query statement.

Decrypting the ciphertext based on the shared key encryption into the plaintext, and performing secondary encryption on the plaintext through a preset encryption method, so that the flexibility of the encryption method can be improved, the risk of cracking the encryption method is reduced, and the data security is improved.

Illustratively, the query statement select (ID, NAME) from (table A) includes three fields, ID, NAME, and table A, respectively. Because the user can set different security levels for different data, and the calculation costs corresponding to different encryption algorithms are different, in one or more embodiments of the present disclosure, different fields in the structured query statement may be encrypted by different methods respectively through fine granularity division of the data.

Therefore, the first encryption structured query statement is decrypted based on the shared key, and after the first plaintext structured query statement corresponding to the first encryption structured query statement is obtained, the first plaintext structured query statement can be analyzed to obtain an analysis result corresponding to the first plaintext structured query statement; and determining a preset encryption method corresponding to the first plaintext structured query statement according to the analysis result.

Optionally, in one or more embodiments of the present disclosure, parsing the first plaintext structured query term to obtain a parsing result corresponding to the first plaintext structured query term may be implemented by parsing the first plaintext structured query term to obtain at least one piece of first plaintext field information and attribute information corresponding to each piece of first plaintext field information.

In practical application, a user can add marks to each field in the structured query statement through encryption identification before sending the structured query statement according to the security level of different data. Illustratively, in the query statement select (ID, NAME) from (table a), the security level of the ID is higher for the user, and thus a security tag can be added to the ID, resulting in the tagged query statement select (enc1_id, NAME) from (table a).

Optionally, according to the analysis result, determining the preset encryption method corresponding to the first plaintext structured query term may be implemented by the following steps:

determining an initial encryption method corresponding to each piece of first plaintext field information according to the encryption mark corresponding to each piece of first plaintext field information;

and determining a preset encryption method corresponding to the first plaintext structured query statement according to the initial encryption method corresponding to each piece of first plaintext field information.

Optionally, determining the initial encryption method corresponding to each piece of first plaintext field information according to the encryption flag corresponding to each piece of first plaintext field information may be implemented by:

determining at least one reference encryption method corresponding to the target encryption mark from a preset encryption algorithm table according to the target encryption mark corresponding to the target first plaintext field information, wherein the target first plaintext field information is any one of the at least one first plaintext field information;

and determining an initial encryption method corresponding to the target first plaintext field information in at least one reference encryption method based on a preset rule.

In particular, the encryption flag may be used to characterize a priority level of security for the field, e.g., ENC1 corresponds to the highest security level, ENC2 corresponds to the next highest security level, etc. For users, the insensitive data can not use the encryption mark, and the target equipment can encrypt only the field added with the encryption mark, so that the system resources are saved, and the data processing efficiency of the system is improved. And different fields are encrypted according to different encryption algorithms, so that the diversity and flexibility of ciphertext can be improved, data leakage caused by the single ciphertext is avoided, and the data security is improved.

Optionally, according to the initial encryption method corresponding to each piece of first plaintext field information, determining the preset encryption method corresponding to the first plaintext structured query term may be implemented by:

and determining a preset encryption method corresponding to the first plaintext structured query statement from the initial encryption methods according to the priority information corresponding to the first plaintext field information.

Illustratively, if the security level of ENC1 is higher than ENC2 and the security level of ENC2 is higher than ENC3 in the query statement select (enc1_id, enc2_name) from (enc3_table a), the security of encryption algorithm a is higher than encryption algorithm b, and the security of encryption algorithm b is higher than encryption algorithm c in encryption algorithms a, b, and c respectively determined according to ENC1, ENC2, and ENC 3. The encryption algorithm a with the highest security can be determined as the preset encryption method corresponding to the query statement, so that the security of the ciphertext is guaranteed to the greatest extent.

Step 306: encrypting the first plaintext structured query sentence according to a preset encryption method to obtain a second encrypted structured query sentence, and sending the second encrypted structured query sentence to a server.

Optionally, encrypting the first plaintext structured query term according to a preset encryption method to obtain a second encrypted structured query term, which may be implemented by the following steps:

Determining a target initial encryption method corresponding to target first plaintext field information, wherein the target first plaintext field information is any one of at least one plaintext field information;

encrypting the target first plaintext field information according to a target initial encryption method to obtain target field encryption information corresponding to the target first plaintext field information;

and obtaining second encryption information according to the encryption information of each field.

Illustratively, in the query sentence select (enc1_id, enc2_name) from (enc3_table a), if the encryption algorithm for ID is the encryption algorithm a, the encryption algorithm for NAME is the encryption algorithm b, and the encryption algorithm for table is the encryption algorithm c, which are determined according to enc1, enc2, enc3, respectively, then the ID may be encrypted by the encryption algorithm a, the NAME may be encrypted by the encryption algorithm b, the table may be encrypted by the encryption algorithm c, and the result of the encryption is spliced to obtain a second encrypted structured query sentence select ENCa (ID), and the ENCb (NAME) from table ENCc (a).

Optionally, under the condition that the server returns the encryption execution result based on the second encryption structured query statement, the encryption execution result can be decrypted according to a preset encryption method to obtain a plaintext execution result corresponding to the encryption execution result; encrypting the plaintext execution result based on the shared secret key to obtain a target encryption execution result, and sending the target encryption execution result to the client.

One embodiment of the present disclosure implements receiving first encryption information sent by a client and encrypted based on a shared key, where the shared key is sent to the client in advance by a target device; decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information; encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server.

The method comprises the steps of sending a shared secret key to a client in advance, receiving first encryption information based on the shared secret key encryption sent by the client, ensuring the encryption transmission of the information between the client and target equipment, decrypting the first encryption information into first plaintext information, and re-encrypting the first plaintext information according to a preset encryption method to obtain second encryption information, so that the data exist in a ciphertext form in the whole transmission process, and are encrypted by using different secret keys respectively, thereby effectively reducing the risk of data leakage and improving the data security.

Fig. 4 is a schematic diagram of a processing procedure of a data processing method according to an embodiment of the present disclosure.

The user may send a query statement ENC1 (select ID, NAME from table a) encrypted based on the shared key ENC1 to a trusted device that has deployed a trusted execution environment. After receiving the encrypted query statement, the trusted device may decrypt ENC1 (select ID, NAME from table a) into a plaintext statement select ID, NAME from table a based on the shared key by the encryption and decryption module, and then parse the plaintext statement select ID, NAME and table a by the parsing module to obtain field IDs, NAMEs and table a, and encryption levels corresponding to the fields respectively. According to the encryption levels corresponding to the fields, the encryption algorithm corresponding to the ID is determined to be ENC2, the encryption algorithm corresponding to the NAME is determined to be ENC3, and the encryption algorithm corresponding to the table A is determined to be ENC4.

Further, the trusted device may encrypt the ID, NAME, and table a based on ENC2, ENC3, ENC4, respectively, and send the encrypted query statement select ENC2 (ID), ENC3 (NAME) from table (ENC 4) a to the server, in a secret database supporting multiple cryptographic algorithms. The secret database executes according to the query statement to obtain query results ENC2 (1, 2) and ENC3 (Alice, bob), and in order to further improve data security, an encryption algorithm ENC5 may be used to encrypt ENC2 (1, 2) and ENC3 (Alice, bob) uniformly, and send the encrypted results to the trusted device.

The trusted device receives encrypted secret data ENC2 (1, 2) and ENC3 (Alice, bob) based on an encryption identifier ENC5, can decrypt the ENC5 through an encryption algorithm module, and respectively decrypts the ENC2 (1, 2) and the ENC3 (Alice, bob) through a recorded preset encryption method to obtain plaintext data (1, 2) and (Alice, bob). The trusted device may encrypt (1, 2) and (Alice, bob) based on the shared key ENC6, and send the encrypted data to the client. The client may decrypt the encrypted query result based on the shared key ENC 6.

Therefore, the data is protected through the trusted execution environment, the data can be ensured to be in a ciphertext form in the whole process of a transmission state and a storage state, the encryption algorithm is various, the data security can be improved, and the security and the sense of body of a user are ensured.

One embodiment of the present specification provides a data processing system including a client, a target device, and a server;

Optionally, the server is further configured to determine whether to return the encryption execution result to the target device according to the type of the second encryption information; if yes, determining an encryption execution result as feedback information, and sending the feedback information to target equipment;

the target device is further configured to decrypt the feedback information according to a preset encryption method under the condition that the feedback information is returned by the server based on the second encryption information, and obtain second plaintext information corresponding to the feedback information; and encrypting the second plaintext information based on the shared secret key to obtain third encrypted information, and transmitting the third encrypted information to the client.

Optionally, the client is configured to send a verification request to the target device, wherein the verification request is used for verifying whether the trusted execution environment is configured in the target device;

the target device is further configured to generate a shared key for the client in the trusted execution environment if the target device is configured with the trusted execution environment; the shared key is sent to the client.

FIG. 5 is a system diagram of a data processing system according to one embodiment of the present disclosure.

One embodiment of the present specification provides a data processing system that includes a client, a trusted device, and a database server, where the client may include a plurality of users, each of which may communicate with the trusted device in an encrypted manner under a secure mechanism. The user can encrypt the SQL statement through the exclusive shared key and then transmit the encrypted SQL statement to the trusted device, the trusted device can receive and decrypt the plaintext SQL, analyze the plaintext SQL, generate a confidential SQL statement available to the database, and send the confidential SQL statement to the database server.

The encryption method comprises the steps that a ciphertext SQL interpreter module, a cryptographic algorithm module and a secret state operation module are deployed in a database server, wherein a plurality of encryption algorithms are integrated in the cryptographic algorithm module, encryption methods for different data can be dynamically generated according to different inquiry scenes, the data in the database are stored in a ciphertext mode, and the risk of leakage of the data from the inside is reduced. The database server receives the secret SQL statement, can process the secret SQL statement in the secret operation module, encrypts the ciphertext result through the database key, and encrypts the ciphertext result to return to the trusted device.

The trusted device receives the ciphertext result returned by the database server, decrypts the ciphertext result through a recorded preset encryption method to obtain a plaintext result, encrypts the plaintext result by using a shared key of a user, and returns the encrypted result to the corresponding client.

The client may decrypt the encryption result locally based on the shared key based on the returned encryption result.

The following describes, with reference to fig. 6, an example of an application of the data processing method provided in the present specification to a database ciphertext retrieval system based on a trusted environment, where the data processing method is further described. Fig. 6 is a flowchart of a processing procedure of a data processing method according to an embodiment of the present disclosure, which specifically includes the following steps.

Step 602: a verification request is initiated.

Step 604: verifying the trusted execution environment of the target device and sending an encrypted sql statement to the target device.

Step 606: decrypting to obtain a plaintext sql statement, analyzing and rewriting the statement, generating a data key by using a master key, encrypting data in the statement, and storing the key.

Step 608: and sending the rewritten ciphertext sql statement to a database server.

Step 610: and calling a corresponding function to execute the ciphertext sql statement.

Step 612: and judging whether the result needs to be returned to the client.

Step 614: and the fetched data is sent to the target equipment.

Step 616: the data is decrypted using the stored database key.

Step 618: the data is encrypted using the key of the corresponding user.

Step 620: and returning the data to the client.

Step 622: the user decrypts the data locally.

Corresponding to the method embodiment, the present disclosure further provides an embodiment of a data processing apparatus, and fig. 7 shows a schematic structural diagram of the data processing apparatus provided in one embodiment of the present disclosure, configured to a target device. As shown in fig. 7, the apparatus includes:

a first receiving module 702 configured to receive first encryption information based on shared key encryption sent by a client, where the shared key is sent to the client in advance by a target device;

a first decryption module 704, configured to decrypt the first encrypted information based on the shared key, to obtain first plaintext information corresponding to the first encrypted information;

the first encryption module 706 is configured to encrypt the first plaintext information according to a preset encryption method, obtain second encrypted information, and send the second encrypted information to the server.

Optionally, the apparatus further comprises:

the analysis module is configured to analyze the first plaintext information and obtain an analysis result corresponding to the first plaintext information;

the determining module is configured to determine a preset encryption method corresponding to the first plaintext information according to the analysis result.

Optionally, the parsing module is further configured to:

Optionally, the determining module is further configured to:

Optionally, the attribute information includes priority information;

a determination module further configured to:

Optionally, the first encryption module 706 is further configured to:

Optionally, the apparatus further comprises:

the second decryption module is configured to decrypt the feedback information according to a preset encryption method under the condition that the feedback information is returned by the server based on the second encryption information, and obtain second plaintext information corresponding to the feedback information;

and the second encryption module is configured to encrypt the second plaintext information based on the shared secret key, obtain third encrypted information and send the third encrypted information to the client.

Optionally, the apparatus further comprises:

the request receiving module is configured to receive a verification request sent by the client, wherein the verification request is used for verifying whether a trusted execution environment is configured in the target equipment;

a generation module configured to generate a shared key for the client in the trusted execution environment if the target device is configured with the trusted execution environment;

and the first sending module is configured to send the shared secret key to the client.

Fig. 8 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present disclosure, configured in a server. As shown in fig. 8, the apparatus includes:

a second receiving module 802 configured to receive second encrypted information sent by the target device;

a processing module 804 configured to process the second encryption information to obtain an encryption execution result;

a judging module 806 configured to judge whether to return the encryption execution result to the target device according to the type of the second encryption information;

and the second sending module 808 is configured to determine that the encryption execution result is feedback information if yes, and send the feedback information to the target device.

Optionally, the processing module 804 is further configured to:

Fig. 9 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present disclosure, configured on a target device. As shown in fig. 9, the apparatus includes:

a third receiving module 902, configured to receive a first encrypted structured query statement sent by a client and based on encryption of a shared key, where the shared key is sent to the client in advance by a target device;

a third decryption module 904, configured to decrypt the first encrypted structured query statement based on the shared key, to obtain a first plaintext structured query statement corresponding to the first encrypted structured query statement;

the third encryption module 906 is configured to encrypt the first plaintext structured query term according to a preset encryption method, obtain a second encrypted structured query term, and send the second encrypted structured query term to the server.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for the data processing apparatus, since it is substantially similar to the data processing method embodiment, the description is relatively simple, and the relevant points are referred to in the description of the data processing method embodiment.

Fig. 10 illustrates a block diagram of a computing device 1000 provided in accordance with one embodiment of the present description. The components of the computing device 1000 include, but are not limited to, a memory 1010 and a processor 1020. Processor 1020 is coupled to memory 1010 via bus 1030 and database 1050 is used to store data.

Computing device 1000 also includes access device 1040, which access device 1040 enables computing device 1000 to communicate via one or more networks 1060. Examples of such networks include public switched telephone networks (PSTN, public Switched Telephone Network), local area networks (LAN, local Area Network), wide area networks (WAN, wide Area Network), personal area networks (PAN, personal Area Network), or combinations of communication networks such as the internet. The access device 1040 may include one or more of any type of network interface, wired or wireless, such as a network interface card (NIC, network interface controller), such as an IEEE802.11 wireless local area network (WLAN, wireless Local Area Network) wireless interface, a worldwide interoperability for microwave access (Wi-MAX, worldwide Interoperability for Microwave Access) interface, an ethernet interface, a universal serial bus (USB, universal Serial Bus) interface, a cellular network interface, a bluetooth interface, near field communication (NFC, near Field Communication).

In one embodiment of the present description, the above-described components of computing device 1000, as well as other components not shown in FIG. 10, may also be connected to each other, such as by a bus. It should be understood that the block diagram of the computing device illustrated in FIG. 10 is for exemplary purposes only and is not intended to limit the scope of the present description. Those skilled in the art may add or replace other components as desired.

Computing device 1000 may be any type of stationary or mobile computing device including a mobile computer or mobile computing device (e.g., tablet, personal digital assistant, laptop, notebook, netbook, etc.), mobile phone (e.g., smart phone), wearable computing device (e.g., smart watch, smart glasses, etc.), or other type of mobile device, or a stationary computing device such as a desktop computer or personal computer (PC, personal Computer). Computing device 1000 may also be a mobile or stationary server.

Wherein the processor 1020 is configured to execute computer-executable instructions that, when executed by the processor, perform the steps of the data processing method described above.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for computing device embodiments, the description is relatively simple, as it is substantially similar to data processing method embodiments, with reference to the partial description of data processing method embodiments.

An embodiment of the present disclosure also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the data processing method described above.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for computer readable storage medium embodiments, since they are substantially similar to data processing method embodiments, the description is relatively simple, and reference is made to the description of data processing method embodiments in part.

An embodiment of the present specification also provides a computer program, wherein the computer program, when executed in a computer, causes the computer to perform the steps of the data processing method described above.

In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for the computer program embodiments, the description is relatively simple, since it is substantially similar to the data processing method embodiments, and reference is made to the description of the data processing method embodiments in part.

The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The computer instructions include computer program code that may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), an electrical carrier signal, a telecommunications signal, a software distribution medium, and so forth. It should be noted that the computer readable medium contains content that can be appropriately scaled according to the requirements of jurisdictions in which such content is subject to legislation and patent practice, such as in certain jurisdictions in which such content is subject to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

It should be noted that the foregoing describes specific embodiments of the present invention. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Further, those skilled in the art will appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily all required for the embodiments described in the specification.

In the foregoing embodiments, the descriptions of the embodiments are emphasized, and for parts of one embodiment that are not described in detail, reference may be made to the related descriptions of other embodiments.

It should be noted that, in the embodiments of the present application, the use of user data may be involved, and in practical applications, user specific personal data may be used in the schemes described herein within the scope allowed by applicable legal regulations in the country where the applicable legal regulations are met (for example, the user explicitly agrees to the user to actually notify the user, etc.).

The preferred embodiments of the present specification disclosed above are merely used to help clarify the present specification. Alternative embodiments are not intended to be exhaustive or to limit the invention to the precise form disclosed. Obviously, many modifications and variations are possible in light of the teaching of the embodiments. The embodiments were chosen and described in order to best explain the principles of the embodiments and the practical application, to thereby enable others skilled in the art to best understand and utilize the invention. This specification is to be limited only by the claims and the full scope and equivalents thereof.

Claims

1. A data processing method, applied to a target device, comprising:

receiving first encryption information which is sent by a client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by the target equipment;

2. The method of claim 1, wherein after decrypting the first encrypted information based on the shared key to obtain first plaintext information corresponding to the first encrypted information, the method further comprises:

3. The method of claim 2, the parsing the first plaintext information to obtain a parsing result corresponding to the first plaintext information, comprising:

4. The method according to claim 3, wherein the determining, according to the parsing result, a preset encryption method corresponding to the first plaintext information includes:

5. The method of claim 4, wherein the determining the initial encryption method corresponding to each first plaintext sub-information according to the attribute information corresponding to each first plaintext sub-information comprises:

6. The method of claim 4, the attribute information comprising priority information;

the determining a preset encryption method corresponding to the first plaintext information according to the initial encryption method corresponding to each first plaintext sub-information comprises the following steps:

7. The method according to claim 4, wherein encrypting the first plaintext information according to a predetermined encryption method to obtain second encrypted information comprises:

Determining a target initial encryption method corresponding to target first plaintext sub-information, wherein the target first plaintext sub-information is any one of the at least one plaintext sub-information;

encrypting the target first plaintext sub-information according to the target initial encryption method to obtain target sub-encryption information corresponding to the target first plaintext sub-information;

8. The method of claim 1, wherein after encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information and sending the second encrypted information to a server, further comprising:

under the condition that feedback information is returned by the server based on the second encryption information, decrypting the feedback information according to the preset encryption method to obtain second plaintext information corresponding to the feedback information;

and encrypting the second plaintext information based on the shared secret key to obtain third encrypted information, and sending the third encrypted information to the client.

9. The method of claim 1, the method further comprising:

receiving a verification request sent by a client, wherein the verification request is used for verifying whether a trusted execution environment is configured in the target equipment;

Generating a shared key for the client in a trusted execution environment if the target device is configured with the trusted execution environment;

and sending the shared key to the client.

10. A data processing method is applied to a server and comprises the following steps:

receiving second encryption information sent by target equipment;

11. The method of claim 10, the processing the second encryption information to obtain an encryption execution result, comprising:

12. A data processing method, applied to a target device, comprising:

receiving a first encryption structured query statement sent by a client and based on shared key encryption, wherein the shared key is sent to the client in advance by the target equipment;

encrypting the first plaintext structured query sentence according to a preset encryption method to obtain a second encrypted structured query sentence, and sending the second encrypted structured query sentence to a server.

13. A data processing system comprising a client, a target device and a server;

the target device is configured to receive first encryption information based on shared key encryption sent by the client, wherein the shared key is sent to the client in advance by the target device; decrypting the first encryption information based on the shared key to obtain first plaintext information corresponding to the first encryption information; encrypting the first plaintext information according to a preset encryption method to obtain second encrypted information, and sending the second encrypted information to a server;

14. A data processing apparatus configured to a target device, comprising:

a first receiving module configured to receive first encryption information based on shared key encryption sent by a client, wherein the shared key is sent to the client in advance by the target device;

the first encryption module is configured to encrypt the first plaintext information according to a preset encryption method to obtain second encrypted information, and send the second encrypted information to a server.

15. The apparatus of claim 14, the apparatus further comprising:

the analysis module is configured to analyze the first plaintext information to obtain an analysis result corresponding to the first plaintext information;

and the determining module is configured to determine a preset encryption method corresponding to the first plaintext information according to the analysis result.

16. The apparatus of claim 15, the parsing module further configured to:

17. The apparatus of claim 16, the determination module further configured to:

18. The apparatus of claim 17, the determination module further configured to:

19. The apparatus of claim 17, the attribute information comprising priority information;

The determination module is further configured to:

20. The apparatus of claim 17, the first encryption module further configured to:

21. The apparatus of claim 14, further comprising:

the second decryption module is configured to decrypt the feedback information according to the preset encryption method under the condition that the feedback information is returned by the server based on the second encryption information, so as to obtain second plaintext information corresponding to the feedback information;

and the second encryption module is configured to encrypt the second plaintext information based on the shared secret key, obtain third encrypted information, and send the third encrypted information to the client.

22. A data processing apparatus, configured in a server, comprising:

the judging module is configured to judge whether the encryption execution result is returned to the target equipment according to the type of the second encryption information;

23. A data processing apparatus configured to a target device, comprising:

the third receiving module is configured to receive a first encryption structured query statement which is sent by a client and is encrypted based on a shared key, wherein the shared key is sent to the client in advance by the target equipment;

the third encryption module is configured to encrypt the first plaintext structured query sentence according to a preset encryption method to obtain a second encrypted structured query sentence, and send the second encrypted structured query sentence to a server.

24. A computing device, comprising:

a memory and a processor;

the memory is configured to store computer executable instructions, the processor being configured to execute the computer executable instructions, which when executed by the processor, implement the steps of the method of any one of claims 1-12.

25. A computer readable storage medium storing computer executable instructions which when executed by a processor perform the steps of the method of any one of claims 1 to 12.