CN116821935A - Database field encryption and decryption method and device, electronic equipment and storage medium - Google Patents

Database field encryption and decryption method and device, electronic equipment and storage medium Download PDF

Info

Publication number
CN116821935A
CN116821935A CN202310801365.3A CN202310801365A CN116821935A CN 116821935 A CN116821935 A CN 116821935A CN 202310801365 A CN202310801365 A CN 202310801365A CN 116821935 A CN116821935 A CN 116821935A
Authority
CN
China
Prior art keywords
decryption
character string
entity attribute
encryption
database field
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310801365.3A
Other languages
Chinese (zh)
Inventor
邹虎
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Unicloud Technology Co Ltd
Original Assignee
Unicloud Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Unicloud Technology Co Ltd filed Critical Unicloud Technology Co Ltd
Priority to CN202310801365.3A priority Critical patent/CN116821935A/en
Publication of CN116821935A publication Critical patent/CN116821935A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/602Providing cryptographic facilities or services
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Bioethics (AREA)
  • Databases & Information Systems (AREA)
  • Storage Device Security (AREA)

Abstract

The application provides a database field encryption and decryption method, a device, electronic equipment and a storage medium, wherein the method comprises the following steps: obtaining parameter entering information of a target object; responding to character string attributes containing custom notes in the parameter entering information, calling an encryption algorithm to encrypt the character string, executing target object operation, and returning an execution result; and traversing the set and performing annotation scanning on the entity attribute of each set element in response to the execution result being the set to determine whether the entity attribute needs to be decrypted, judging whether the entity attribute is a character string in response to the entity attribute needing to be decrypted, and calling a decryption algorithm to decrypt the entity attribute and returning a plaintext in response to the entity attribute being the character string. The encryption and decryption method of the database field separates encryption and decryption operation from business processing, greatly simplifies codes and reduces coupling between the encryption and decryption operation and business processing.

Description

Database field encryption and decryption method and device, electronic equipment and storage medium
Technical Field
The application belongs to the technical field of data encryption and decryption, and particularly relates to a database field encryption and decryption method, a device, electronic equipment and a storage medium.
Background
The conventional project involves encryption and storage of some sensitive information fields, complicated business logic and encryption and decryption operations are mixed together, so that business codes are huge and chaotic, encryption and decryption operations are required to be extracted from the business logic, common practice is to extract common classes and call appointed fields at the places needing encryption and decryption, encryption and decryption actions are not completely separated from the business logic, coding is increased, and hard coding forms are adopted to execute the operations in the business codes when encryption and decryption are carried out on the sensitive fields, so that coupling is serious.
Disclosure of Invention
In view of the foregoing, the present application is directed to a method, an apparatus, an electronic device and a storage medium for encrypting and decrypting a database field, so as to solve at least one of the above problems.
In order to achieve the above purpose, the technical scheme of the application is realized as follows:
in a first aspect, the present application provides a method for encrypting and decrypting a database field, where the method includes:
obtaining parameter entering information of a target object, wherein the parameter entering information comprises parameter list data;
judging whether the parameter list data contains a character string containing a custom annotation or not;
responding to character string attributes containing custom notes in the parameter list data, calling an encryption algorithm to encrypt the character string, executing the target object operation, and returning an execution result;
judging whether the execution result is of a set type or not;
and traversing the set and carrying out annotation scanning on the entity attribute of each set element in response to the execution result being the set so as to determine whether the entity attribute needs decryption or not, judging whether the entity attribute is a character string in response to the entity attribute needing decryption, and calling a decryption algorithm to carry out decryption operation on the entity attribute and returning a plaintext in response to the entity attribute being the character string.
Further, the target objects include insert, update, delete, select, and return objects.
Further, an Interceptor is defined by the Interceptor interface to intercept the target object.
Further, the determining whether the parameter list data has a character string containing a custom annotation includes:
and acquiring parameter list data and types corresponding to each parameter, obtaining the character string name and types of the parameter object through a reflection mechanism, and determining the marked character string.
Based on the same inventive concept, the application also provides a database field encryption and decryption device:
the acquisition module is configured to acquire parameter entering information of a target object, wherein the parameter entering information comprises parameter list data;
the first judging module is configured to judge whether the parameter list data contains a character string containing a custom annotation or not;
an encryption module; the system comprises a parameter list data and a target object data, wherein the parameter list data is configured to respond to character string attributes containing custom notes, an encryption algorithm is called to encrypt the character string, the target object operation is executed, and an execution result is returned;
the second judging module is configured to judge whether the execution result is of a set type;
and the decryption module is configured to traverse the set and carry out annotation scanning on the entity attribute of each set element in response to the execution result being the set so as to determine whether the entity attribute needs decryption, judge whether the entity attribute is a character string in response to the entity attribute needing decryption, and call a decryption algorithm to decrypt the entity attribute and return a plaintext in response to the entity attribute being the character string.
Based on the same inventive concept, the application also provides an electronic device, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the database field encryption and decryption method when executing the program.
Based on the same inventive concept, the present application also provides a non-transitory computer readable storage medium, wherein the non-transitory computer readable storage medium stores computer instructions for causing the computer to execute the database field encryption and decryption method as described above.
Compared with the prior art, the database field encryption and decryption method, the device, the electronic equipment and the storage medium have the following beneficial effects:
according to the method, the device, the electronic equipment and the storage medium for encrypting and decrypting the database fields, the encryption and decryption actions are added before and after the database is operated, the automatic encryption and decryption operation is carried out by adding notes to the appointed fields, the data stored in the database is ensured to be ciphertext, the encryption and decryption operation is separated from the business processing when the data result is inquired, the codes are greatly simplified, and the coupling between the two is reduced.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:
FIG. 1 is a flowchart of a method for encrypting and decrypting a database field according to an embodiment of the present application;
FIG. 2 is a schematic diagram of a database field encryption and decryption apparatus according to an embodiment of the present application;
fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the application.
Detailed Description
The present application will be further described in detail below with reference to specific embodiments and with reference to the accompanying drawings, in order to make the objects, technical solutions and advantages of the present application more apparent.
It should be noted that unless otherwise defined, technical or scientific terms used in the embodiments of the present application should be given the ordinary meaning as understood by one of ordinary skill in the art to which the present application belongs. The terms "first," "second," and the like, as used in embodiments of the present application, do not denote any order, quantity, or importance, but rather are used to distinguish one element from another. The word "comprising" or "comprises", and the like, means that elements or items preceding the word are included in the element or item listed after the word and equivalents thereof, but does not exclude other elements or items. The terms "connected" or "connected," and the like, are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "upper", "lower", "left", "right", etc. are used merely to indicate relative positional relationships, which may also be changed when the absolute position of the object to be described is changed.
Embodiments of the present application are described in detail below with reference to the accompanying drawings.
Referring to fig. 1, a method for encrypting and decrypting a database field according to an embodiment of the present application includes the following steps:
step S101, obtaining parameter entering information of a target object, wherein the parameter entering information comprises parameter list data.
In some embodiments, the target objects include insert, update, delete, select, and return objects.
In some embodiments, an Interceptor is defined by an Interceptor interface to intercept the target object.
By using the plug-in mechanism provided by MyBatis, the user can conveniently insert own logic in the SQL executing process.
The plug in method of the plug in needs to be focused on, the method returns the proxy object to be proxied, and meanwhile, the current intersator instance is set in an intersectional set of the Configuration object, so that the interception is needed to be carried out on target objects such as insert/update/delete in MyBatis, and the acquired target object parameter entering information is needed.
Step S102, judging whether the parameter list data contains a character string with a custom annotation.
In some embodiments, the parameter list data and the type corresponding to each parameter are obtained, the character string name and the type of the parameter object are obtained through a reflection mechanism, and the marked character string is determined.
Specifically, the present embodiment may use a Java reflection mechanism to obtain a corresponding Field object according to a class and a Field name, and determine whether the character string (or Field) is annotated by @ encryptefield.
And step 103, responding to the character string attribute containing the custom annotation in the parameter list data, calling an encryption algorithm to encrypt the character string, executing the target object operation, and returning an execution result.
Step S104, judging whether the execution result is of a collection type.
Step 105, in response to the execution result being a set, traversing the set, performing annotation scanning on the entity attribute of each set element to determine whether the entity attribute needs decryption, in response to the entity attribute needing decryption, judging whether the entity attribute is a character string, in response to the entity attribute being a character string, invoking a decryption algorithm to decrypt the entity attribute, and returning to the plaintext.
Specifically, since the query result may include multiple lines of data, the returned result may be a set, so that to implement unified processing of different service scenarios, we need to perform different processing on different types of returned values, and if the query result is an object list, we need to process each object in the list one by one.
The encryption and decryption algorithm adopted in this embodiment is a conventional encryption and decryption algorithm in the field, such as DES, 3DES, AES, etc., and will not be described in detail here.
Before implementing the encryption and decryption method, the embodiment needs to create a Spring Boot starter item named as springboot-mybatis-crypt-starter, the item should contain code implementation of an encryption and decryption module, and provide corresponding infrastructures such as annotation and interface, so that a service system can access quickly, and in order to enable the service system to implement their encryption and decryption method by itself, we need to define a custom annotation, such as @ encryptefield, which means that a certain field needs encryption processing. Meanwhile, an Encryptor interface, such as Encryptor, needs to be defined, and specific encryption logic can be realized in a service system according to specific scenes, so that the expandability and flexibility of an encryption algorithm are ensured.
The application aims to increase encryption and decryption actions in the front and back of an operation database by using a Mybat interceptor, and automatically encrypts and decrypts the data stored in the database in a form of annotating a designated field, so that the data stored in the database is ensured to be ciphertext, and the data result is inquired to be plaintext.
It should be noted that the foregoing describes some embodiments of the present application. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments described above and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
Based on the same inventive concept, the embodiment of the application also provides a database field encryption and decryption device corresponding to the method of any embodiment.
As shown in fig. 2, the database field encrypting and decrypting apparatus includes:
an acquisition module 11 configured to acquire entry information of a target object, wherein the entry information includes parameter list data;
a first judging module 12 configured to judge whether the parameter list data contains a character string containing a custom annotation;
the encryption module 13 is configured to respond to the character string attribute containing the custom annotation in the parameter list data, call an encryption algorithm to encrypt the character string, execute the target object operation and return an execution result;
a second judging module 14 configured to judge whether the execution result is of a collection type;
and the decryption module 15 is configured to respond to the execution result as a set, traverse the set, carry out annotation scanning on the entity attribute of each set element to determine whether the entity attribute needs decryption, respond to the entity attribute needs decryption, judge whether the entity attribute is a character string, respond to the entity attribute as the character string, and call a decryption algorithm to decrypt the entity attribute and return a plaintext.
For convenience of description, the above devices are described as being functionally divided into various modules, respectively. Of course, the functions of each module may be implemented in the same piece or pieces of software and/or hardware when implementing an embodiment of the present application.
The device of the above embodiment is used for implementing the corresponding database field encryption and decryption method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiment, which is not described herein.
Based on the same inventive concept, the embodiment of the application also provides an electronic device corresponding to the method of any embodiment, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor realizes the database field encryption and decryption method according to any embodiment when executing the program.
Fig. 3 shows a more specific hardware architecture of an electronic device according to this embodiment, where the device may include: a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050. Wherein processor 1010, memory 1020, input/output interface 1030, and communication interface 1040 implement communication connections therebetween within the device via a bus 1050.
The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit ), microprocessor, application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, etc. for executing relevant programs to implement the technical solutions provided in the embodiments of the present disclosure.
The Memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory ), static storage device, dynamic storage device, or the like. Memory 1020 may store an operating system and other application programs, and when the embodiments of the present specification are implemented in software or firmware, the associated program code is stored in memory 1020 and executed by processor 1010.
The input/output interface 1030 is used to connect with an input/output module for inputting and outputting information. The input/output module may be configured as a component in a device (not shown) or may be external to the device to provide corresponding functionality. Wherein the input devices may include a keyboard, mouse, touch screen, microphone, various types of sensors, etc., and the output devices may include a display, speaker, vibrator, indicator lights, etc.
Communication interface 1040 is used to connect communication modules (not shown) to enable communication interactions of the present device with other devices. The communication module may implement communication through a wired manner (such as USB, network cable, etc.), or may implement communication through a wireless manner (such as mobile network, WIFI, bluetooth, etc.).
Bus 1050 includes a path for transferring information between components of the device (e.g., processor 1010, memory 1020, input/output interface 1030, and communication interface 1040).
It should be noted that although the above-described device only shows processor 1010, memory 1020, input/output interface 1030, communication interface 1040, and bus 1050, in an implementation, the device may include other components necessary to achieve proper operation. Furthermore, it will be understood by those skilled in the art that the above-described apparatus may include only the components necessary to implement the embodiments of the present description, and not all the components shown in the drawings.
The electronic device of the foregoing embodiment is configured to implement the corresponding method for encrypting and decrypting the database field in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiment, which is not described herein.
Based on the same inventive concept, the present application also provides a non-transitory computer readable storage medium corresponding to the method of any embodiment, where the non-transitory computer readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute the database field encryption and decryption method according to any embodiment.
The computer readable media of the present embodiments, including both permanent and non-permanent, removable and non-removable media, may be used to implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device.
The computer instructions stored in the storage medium of the foregoing embodiments are used to make the computer execute the database field encryption and decryption method described in any one of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which are not described herein.
Those of ordinary skill in the art will appreciate that: the discussion of any of the embodiments above is merely exemplary and is not intended to suggest that the scope of the application (including the claims) is limited to these examples; the technical features of the above embodiments or in the different embodiments may also be combined within the idea of the application, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the application as described above, which are not provided in detail for the sake of brevity.
Additionally, well-known power/ground connections to Integrated Circuit (IC) chips and other components may or may not be shown within the provided figures, in order to simplify the illustration and discussion, and so as not to obscure the embodiments of the present application. Furthermore, the devices may be shown in block diagram form in order to avoid obscuring the embodiments of the present application, and also in view of the fact that specifics with respect to implementation of such block diagram devices are highly dependent upon the platform within which the embodiments of the present application are to be implemented (i.e., such specifics should be well within purview of one skilled in the art). Where specific details (e.g., circuits) are set forth in order to describe example embodiments of the application, it should be apparent to one skilled in the art that embodiments of the application can be practiced without, or with variation of, these specific details. Accordingly, the description is to be regarded as illustrative in nature and not as restrictive.
While the application has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of those embodiments will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.
The present embodiments are intended to embrace all such alternatives, modifications and variances which fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, and the like, which are within the spirit and principles of the embodiments of the application, are intended to be included within the scope of the application.

Claims (7)

1. A method for encrypting and decrypting a database field, the method comprising:
obtaining parameter entering information of a target object, wherein the parameter entering information comprises parameter list data;
judging whether the parameter list data contains a character string containing a custom annotation or not;
responding to character string attributes containing custom notes in the parameter list data, calling an encryption algorithm to encrypt the character string, executing the target object operation, and returning an execution result;
judging whether the execution result is of a set type or not;
and traversing the set and carrying out annotation scanning on the entity attribute of each set element in response to the execution result being the set so as to determine whether the entity attribute needs decryption or not, judging whether the entity attribute is a character string in response to the entity attribute needing decryption, and calling a decryption algorithm to carry out decryption operation on the entity attribute and returning a plaintext in response to the entity attribute being the character string.
2. The method for encrypting and decrypting the database field according to claim 1, wherein:
the target objects include insert, update, delete, select, and return objects.
3. The method for encrypting and decrypting the database field according to claim 2, wherein:
an Interceptor is defined by the Interceptor interface to intercept the target object.
4. The method for encrypting and decrypting a database field according to claim 1, wherein the determining whether the parameter list data has a string containing a custom annotation comprises:
and acquiring parameter list data and types corresponding to each parameter, obtaining the character string name and types of the parameter object through a reflection mechanism, and determining the marked character string.
5. A database field encryption and decryption device, characterized in that:
the acquisition module is configured to acquire parameter entering information of a target object, wherein the parameter entering information comprises parameter list data;
the first judging module is configured to judge whether the parameter list data contains a character string containing a custom annotation or not;
an encryption module; the system comprises a parameter list data and a target object data, wherein the parameter list data is configured to respond to character string attributes containing custom notes, an encryption algorithm is called to encrypt the character string, the target object operation is executed, and an execution result is returned;
the second judging module is configured to judge whether the execution result is of a set type;
and the decryption module is configured to traverse the set and carry out annotation scanning on the entity attribute of each set element in response to the execution result being the set so as to determine whether the entity attribute needs decryption, judge whether the entity attribute is a character string in response to the entity attribute needing decryption, and call a decryption algorithm to decrypt the entity attribute and return a plaintext in response to the entity attribute being the character string.
6. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the database field encryption and decryption method of any one of claims 1-4 when the program is executed by the processor.
7. A non-transitory computer readable storage medium, wherein the non-transitory computer readable storage medium stores computer instructions for causing the computer to perform the database field encryption and decryption method of any one of claims 1-4.
CN202310801365.3A 2023-06-30 2023-06-30 Database field encryption and decryption method and device, electronic equipment and storage medium Pending CN116821935A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310801365.3A CN116821935A (en) 2023-06-30 2023-06-30 Database field encryption and decryption method and device, electronic equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310801365.3A CN116821935A (en) 2023-06-30 2023-06-30 Database field encryption and decryption method and device, electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
CN116821935A true CN116821935A (en) 2023-09-29

Family

ID=88140959

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310801365.3A Pending CN116821935A (en) 2023-06-30 2023-06-30 Database field encryption and decryption method and device, electronic equipment and storage medium

Country Status (1)

Country Link
CN (1) CN116821935A (en)

Similar Documents

Publication Publication Date Title
JP6871393B2 (en) Login information processing method and device
CN110011954B (en) Homomorphic encryption-based biological identification method, device, terminal and business server
EP3405868A1 (en) Methods and apparatus to selectively provide cached and presently compiled applications
CN109145240B (en) Page access method, device and system based on code scanning operation
CN111310221B (en) Encryption and decryption method, device, equipment and storage medium for persistent layer data
CN110633309A (en) Block chain transaction processing method and device
CN110569281A (en) Block chain transaction query method and system
CN112256275B (en) Code confusion method, device, electronic equipment and medium
CN110597877A (en) Block chain transaction processing method and device
CN107103211A (en) SDK is sent, using issue, using operation method and device
CN108536569B (en) Business behavior tracking method, device and equipment
CN111611606B (en) File encryption and decryption method and device
CN112579955A (en) Page access method, equipment, medium and electronic equipment
CN108985109B (en) Data storage method and device
CN107463808B (en) Method for calling functional module integrated in operating system
CN116821935A (en) Database field encryption and decryption method and device, electronic equipment and storage medium
CN110968885A (en) Model training data storage method and device, electronic equipment and storage medium
CN111767550A (en) Data storage method and device
CN116010992A (en) Data processing method and device, readable storage medium and electronic equipment
CN113434535B (en) Data processing method, communication system, device, product and storage medium
CN112822201A (en) Privacy-protecting difference data determination method, device, equipment and system
CN112445576B (en) Equipment calling method for shielding service difference and related equipment
US20240104224A1 (en) Privacy-preserving search using homomorphic encryption
CN113312637B (en) Proxy server and method for matching encrypted subscription with event
WO2024087313A1 (en) Database access method and apparatus

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination