WO2023155696A1 - 数据库的操作方法、系统、存储介质以及计算机终端 - Google Patents

数据库的操作方法、系统、存储介质以及计算机终端 Download PDF

Info

Publication number
WO2023155696A1
WO2023155696A1 PCT/CN2023/074411 CN2023074411W WO2023155696A1 WO 2023155696 A1 WO2023155696 A1 WO 2023155696A1 CN 2023074411 W CN2023074411 W CN 2023074411W WO 2023155696 A1 WO2023155696 A1 WO 2023155696A1
Authority
WO
WIPO (PCT)
Prior art keywords
ciphertext
original
request
database
module
Prior art date
Application number
PCT/CN2023/074411
Other languages
English (en)
French (fr)
Inventor
汪晟
李飞飞
Original Assignee
阿里巴巴（中国）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴（中国）有限公司 filed Critical 阿里巴巴（中国）有限公司
Publication of WO2023155696A1 publication Critical patent/WO2023155696A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/22—Indexing; Data structures therefor; Storage structures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G06F15/76—Architectures of general purpose stored program computers
    • G06F15/78—Architectures of general purpose stored program computers comprising a single central processing unit
    • G06F15/7807—System on chip, i.e. computer system on a single chip; System in package, i.e. computer system on one or more chips in a single package
    • G06F15/781—On-chip cache; Off-chip memory
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries

Definitions

  • the present application relates to the field of database operation, in particular, to a database operation method, system, storage medium and computer terminal.
  • the embodiment of the present application provides a database operation method, system, storage medium and computer terminal to at least solve the technical problem in the related art that the database runs in the trusted area of the processor and the security of the database operation is not high .
  • a method for operating a database including: transmitting the ciphertext operation request sent by the database engine to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent the original operation request The operation request obtained by encrypting; the original operation request is processed by the atomic operation module in the on-chip storage, and the original operation result is obtained, wherein the atomic operation module runs in the trusted area of the processor; the ciphertext operation result is obtained from the on-chip
  • the storage is returned to the database engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result, and the database engine is used to operate the data stored in the database based on the ciphertext operation result.
  • an operating system for a database including: a database engine, configured to send a ciphertext operation request, wherein the ciphertext operation request is used to represent the result obtained by encrypting the original operation request The operation request; the processor, connected with the database engine, including: on-chip storage and trusted area, the atomic operation module runs in the trusted area, the processor is used to transmit the ciphertext operation request to the on-chip storage, in the on-chip storage through the atomic
  • the operation module processes the original operation request, obtains the original operation result, and returns the ciphertext operation result from the on-chip storage to the database engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result;
  • the database engine is also used to operate on the data stored in the database based on the result of the ciphertext operation.
  • a computer-readable storage medium includes a stored program, wherein, when the program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned database. How to do it.
  • a computer terminal including: a memory and a processor, and the processor is used to run a program stored in the memory, wherein the above-mentioned database operation method is executed when the program is running.
  • the ciphertext operation request sent by the database engine can be transmitted to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent the operation request obtained by encrypting the original operation request;
  • the original operation request is processed by the atomic operation module to obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor;
  • the ciphertext operation result is returned from the on-chip storage to the database engine, where the ciphertext
  • the operation result is used to represent the operation result obtained by encrypting the original operation result.
  • the database engine is used to operate the data stored in the database based on the ciphertext operation result, which realizes the physical level of the database engine and the actual operation processing module.
  • the atomic operation module can be placed in the trusted area of the processor, and the database engine can only access ciphertext data during operation, thereby improving the security of database operations. Security, and then solve the technical problem in the related art that the database runs in the trusted area of the processor, and the security of the database operation is not high.
  • Fig. 1 is a kind of hardware structural block diagram of the computer terminal (or mobile device) that is used to realize the operation method of database according to the embodiment of the application;
  • FIG. 2 is a flow chart of a method for operating a database according to an embodiment of the present application
  • Fig. 3 is a schematic diagram of an encryption structure according to an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an overall architecture of a database operating system according to an embodiment of the present application.
  • Fig. 5 is a schematic diagram of a database operating device according to an embodiment of the present application.
  • Fig. 6 is a structural block diagram of a computer terminal according to an embodiment of the present application.
  • On-Chip Computing is a trusted computing technology that uses the on-chip storage inside the CPU as the running memory, and encrypts when the memory page is swapped out to ordinary memory. Using the on-chip computing technology can realize the full memory encryption of the software to prevent attacks on the memory, such as bus sniffing, cold start, etc.
  • Trusted Execution Environment The Trusted Execution Environment is a secure area of the processor, which ensures that the confidentiality and integrity of the code and data loaded inside it are protected. It provides an isolated execution space security zone in which trusted programs running can prevent common applications, operating systems (OS) and even virtual machine detectors (Hypervisor) from infringing.
  • OS operating systems
  • Hypervisor virtual machine detectors
  • ARM TrustZone is a secure computing environment unique to ARM processors. They allow users to define trusted regions of memory whose contents are integrity protected and cannot be accessed by any software outside the trusted region.
  • the domestic cloud market is closely related to the demand for confidential computing and domestic processors.
  • the use of domestic processors can meet independent and controllable security requirements, and on the other hand, it can also implement rights and responsibilities to domestic manufacturers.
  • TrustZone as a security extension of the ARM processor architecture, provides isolation capabilities for various physical resources at the hardware level, including memory isolation, interrupt isolation, and device isolation.
  • ARM TrustZone itself does not provide the confidentiality and integrity protection of secure memory. It needs to use the on-chip storage (OCM) configured on ARM and introduce memory encryption technology to resist physical attacks.
  • OCM on-chip storage
  • the existing encrypted database work based on trusted chip technology is mainly divided into schemes based on trusted hardware and homomorphic encryption.
  • the mainstream schemes based on trusted hardware mainly include EnclaveDB (enhanced key code database), StealthDB ( hidden database), Cipherbase (encrypted database) and DBStore (warehouse management system).
  • EnclaveDB runs a complete in-memory database in SGX (software guard extensions, instruction extensions), relying on memory encryption and integrity checks provided by SGX to protect database data.
  • SGX software guard extensions, instruction extensions
  • StealthDB and Cipherbase choose not to modify the existing commercial database, but to expand the database through custom functions (UDF), and use the ciphertext calculation module running in SGX to decrypt and calculate the ciphertext.
  • DBStore is a secure mobile database solution based on TrustZone (hardware architecture). It uses SQLite (embedded database engine) as the database engine, but it does not implement an encryption scheme for physical memory and cannot defend against physical attacks.
  • SQLite embedded database engine
  • Microsoft Azure SQL Database uses SGX as a trusted hardware mechanism.
  • the data is always encrypted, and the ciphertext is only decrypted, calculated and re-encrypted in the trusted environment enclave. And provide functions such as remote authentication to the client.
  • the academic work DBStore uses TrustZone, a trusted hardware mechanism provided by ARM, to protect the database SQLite on the mobile side. This work runs SQLite in Trustzone to isolate it from untrusted software.
  • Azure SQL Database (cloud computing database) is an encrypted database based on SGX. Enclave (key code) can be used to protect atomic operations on ciphertext. The database cannot access plaintext data and can only operate ciphertext data by calling atomic operations. Since the chip cannot be localized, it is difficult to achieve independent and controllable security goals.
  • this application provides a database operation method, which can set the database in an untrusted execution environment, and set the atomic operation module in the trusted execution environment to perform actual operations, so that the database can only access the encrypted It is difficult to access plaintext data, thereby improving data security.
  • an embodiment of the operation method of the database is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and, Although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.
  • FIG. 1 shows a block diagram of hardware structure of a computer terminal (or mobile device) for realizing the operation method of the database.
  • the computer terminal 10 may include one or more (shown by 102a, 102b, ..., 102n in the figure) processors 102 (the processors 102 may include but not limited to microprocessor A processing device such as a processor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions.
  • FIG. 1 is only a schematic diagram, which does not limit the structure of the above-mentioned electronic device.
  • computer terminal 10 may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .
  • the one or more processors 102 and/or other data processing circuits described above may generally be referred to herein as "data processing circuits".
  • the data processing circuit may be implemented in whole or in part as software, hardware, firmware or other arbitrary combinations.
  • the data processing circuit can be a single independent processing module, or be fully or partially integrated into any of the other elements in the computer terminal 10 (or mobile device).
  • the data processing circuit acts as a kind of processor control (eg selection of the variable resistor terminal path connected to the interface).
  • the memory 104 can be used to store software programs and modules of application software, such as the program instruction/data storage device corresponding to the operation method of the database in the embodiment of the present application, and the processor 102 runs the software programs and modules stored in the memory 104, thereby Execute various functional applications and data processing, that is, realize the operation method of the above-mentioned database.
  • the memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory 104 may further include a memory that is remotely located relative to the processor 102 , and these remote memories may be connected to the computer terminal 10 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the transmission device 106 is used to receive or transmit data via a network.
  • the specific example of the above-mentioned network may include a wireless network provided by the communication provider of the computer terminal 10 .
  • the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet.
  • the transmission device 106 may be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.
  • RF Radio Frequency
  • the display may be, for example, a touchscreen liquid crystal display (LCD), which may enable a user to interact with the user interface of the computer terminal 10 (or mobile device).
  • LCD liquid crystal display
  • the computer device (or mobile device) shown in FIG. 1 may include hardware components (including circuits), software components (including computer code), or a combination of both hardware and software elements. It should be noted that FIG. 1 is only one example of a particular embodiment, and is intended to illustrate the types of components that may be present in a computer device (or mobile device) as described above.
  • Fig. 2 is a flow chart of the operation method of the database according to the embodiment of the application.
  • Step S202 transmitting the ciphertext operation request sent by the database engine to the on-chip storage of the processor.
  • the ciphertext operation request is used to represent the operation request obtained by encrypting the original operation request.
  • the above-mentioned database engine may be a database query engine.
  • the above-mentioned database engine can be in an untrusted execution environment, which is convenient for users to use flexibly.
  • Plaintext data may be stored in the above-mentioned on-chip storage.
  • the above-mentioned on-chip storage can be used as the running memory of the trusted program, and AES-GCM encryption can be performed on the memory pages leaving the on-chip storage, and the swapped-in memory pages can be decrypted, so that the data stored in the on-chip storage are all in plaintext form, while the storage
  • the data to other memory is in ciphertext form, which can solve the problem of ARM TrustZone does not provide the threat of physical attack posed by memory encryption. It can achieve the same or even stronger security guarantees than using SGX.
  • the original operation request can be encrypted to obtain the ciphertext operation request, and then the database engine in an untrusted execution environment can be used to receive the ciphertext operation request , making it difficult for the database engine in an untrusted execution environment to directly access unencrypted data, thereby improving data security.
  • the database engine can only access encrypted data such as ciphertext operation requests during data processing, it does not need to be limited to a specific database engine, making the database engine highly applicable and compatible sex.
  • the original operation request after the original operation request is acquired, can be stored in the on-chip storage of the processor, and the on-chip storage can be read through the target operation operator in the atomic operation program.
  • the original operation request in order to obtain the original operation result corresponding to the target operation request, and store the original operation result in the on-chip storage.
  • the atomic operation module can decrypt the received ciphertext operation request to obtain the original operation request, and after obtaining the original operation request, it can first store the original operation request in the on-chip storage of the processor Among them, the on-chip storage can store multiple original operation requests, and the on-chip storage can process the original operation requests according to the order in which the original operation requests are stored.
  • the target operation request can be the original operation request that the on-chip storage is currently processing. After processing, the current operation result corresponding to the currently processed original operation request can be obtained, and the current operation result is stored in the on-chip storage.
  • the original operation result corresponding to the original operation request needs to be obtained, the original operation result can be obtained in the on-chip storage.
  • the client in order to improve the security of the client in the data query process, can send the original operation request through the encrypted channel, and encrypt the original operation request in the encrypted channel to obtain the ciphertext Action request.
  • an encryption type extension module can be set in the database engine, which can extend the encryption type of the database system, forward the operation of the encryption type to the trusted atomic operation module, and process the returned
  • the extended design makes the encryption database scheme have strong applicability and compatibility, and does not need to be limited to a specific database.
  • Step S204 process the original request through the atomic operation module in the on-chip storage, and obtain the original operation result.
  • the atomic operation module runs in the trusted area of the processor.
  • the above-mentioned atomic operation module may be in a trusted execution environment.
  • the atomic operation module can run in the secure world of ARM TrustZone, isolated from untrusted operating systems, etc., to prevent the leakage of confidential information at the software level.
  • the atomic operation module may be an atomic operation program.
  • the above-mentioned atomic operation module can perform arithmetic and logic operations, comparison operations, etc., and can receive input from the database engine
  • the ciphertext operands and operators perform the corresponding operations after decrypting the operands, and return the encrypted results to the database engine.
  • the original operation request can be processed through the atomic operation module in the on-chip storage to obtain the original operation result.
  • the original operation request in order to improve data security, after obtaining the ciphertext operation request, the original operation request can be processed according to the ciphertext operation request through on-chip storage with high security, and the original operation request can be obtained As a result, in order to prevent data leakage, the original operation result can be encrypted through the atomic operation module in the on-chip storage to obtain the above-mentioned ciphertext operation result.
  • the atomic operation module runs in the trusted area of the processor, and the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result.
  • Step S206 return the ciphertext operation result from the on-chip storage to the database engine.
  • the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result, and the database engine is used to operate the data stored in the database based on the ciphertext operation result.
  • the ciphertext operation result can be returned to the database engine, and the database engine can operate on the data stored in the database according to the ciphertext operation result. Specifically, the database engine can Send the ciphertext data stored in the database to the client.
  • the ciphertext operation request sent by the database engine can be transmitted to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent the operation request obtained by encrypting the original operation request;
  • the atomic operation module processes the original operation request to obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor; returns the ciphertext operation result from the on-chip storage to the database engine, wherein the ciphertext operation result is used
  • the database engine is used to operate the data stored in the database based on the ciphertext operation result, and realize the physical and software level of the database engine and the actual operation processing module.
  • the above isolation can improve the security of data processing.
  • the atomic operation module can be placed in the trusted area of the processor, and the database engine can only access the ciphertext data during the operation, thereby improving the security of database operations. Furthermore, it solves the technical problem in the related art that the database runs in the trusted area of the processor, and the security of operating the database is not high.
  • processing the original operation request through the atomic operation module to obtain the original operation result includes: decrypting the ciphertext operation request through the decryption operator included in the atomic operation module to obtain the original operation request;
  • the target operation operator contained in the module processes the original operation request to obtain the original operation result;
  • the encryption operator contained in the atomic operation module encrypts the original operation result to obtain the ciphertext operation result.
  • the aforementioned target operation operator may be an operator corresponding to an arithmetic logic operation, an operator corresponding to a comparison operation, or the like.
  • the atomic operation module can decrypt the ciphertext operation request through its included decryption operator in a trusted environment to obtain the original operation request, where the original operation request can be an arithmetic Requests such as logical operations and comparison operations can obtain the target operation operator corresponding to the original operation request. For example, if the original operation request is to perform arithmetic and logic operations on the target character, the operator corresponding to the arithmetic and logic operation can be used to perform arithmetic and logic operations on the target character. Perform the operation to obtain the original operation result. If the original operation request is to perform a comparison operation on any two characters in the target character, the operation operator corresponding to the comparison operation can be used to perform the operation on the target character to obtain the original operation result.
  • the original operation request is to perform a comparison operation on any two characters in the target character
  • the operation operator corresponding to the comparison operation can be used to perform the operation on the target character to obtain the original operation result.
  • the original operation result can be encrypted to obtain the ciphertext operation result, and the database engine can operate on the data in the database according to the ciphertext operation result and send it to in the client.
  • the original operation request includes: a target operand and at least one target operator, wherein the original operation request is processed through the target operation operator included in the atomic operation module to obtain the original operation result, including: Obtain the operation operator corresponding to each target operator from the multiple operation operators contained in the atomic operation module; combine the operation operators corresponding to at least one target operator to obtain the target operation operator; The operands are processed to obtain the original operation result.
  • the above-mentioned target operand may be characters to be calculated, such as numbers and letters.
  • the above-mentioned target operators may be operators such as addition, subtraction, multiplication, initial, greater than, and less than.
  • the multiple operators mentioned above can be fine-grained atomic operators, and different operators can be combined arbitrarily to form more complex target operators. Because operators are small in size and stateless, multiple copies of operators can be run to provide services for the database, which has better scalability and isolation.
  • the operator corresponding to each target operator can be obtained from multiple operators contained in the atomic operation module, and multiple operators can be combined to obtain a more complex target An operation operator, so that the target operand can be processed by the target operation operator to obtain the original operation result.
  • obtaining the operator corresponding to each target operator from the multiple operators contained in the atomic operation module includes: Save as multiple copies; get the operator corresponding to each target operator from each copy.
  • multiple operation operators can be saved as multiple copies, and each target operator can be provided with corresponding operation operators through multiple copies, which can have better scalability and Isolation improves security and flexibility during data operations.
  • the method further includes: detecting whether the client sending the ciphertext operation request is successfully authenticated; When it is detected that the client authentication is successful, the ciphertext operation request is decrypted by the decryption operator to obtain the original Start the operation request.
  • the cloud service when the cloud service receives the ciphertext operation request sent by the client, it can first authenticate the client to check whether the client has the operation authority. Specifically, the client can log in to Authentication, the login authentication of the client can be detected through key management, and whether the client has operation authority is detected. When the client authentication is detected successfully, the ciphertext operation request can be processed through the decryption operator in the atomic operation module. Decrypt to get the original operation request. By authenticating the client, the database engine can be prevented from being used by the client without authentication, thereby improving the security of the database engine.
  • the method further includes: when it is detected that the remaining storage space of the on-chip storage is less than a preset value, encrypting the original data stored in the on-chip storage to obtain ciphertext data; stored in memory.
  • the above-mentioned preset value can be set according to the remaining storage controls reserved by the user.
  • the storage space of the on-chip storage is limited, when the remaining storage space of the on-chip storage is less than a preset value, that is, when the on-chip storage space is about to be exhausted, the The original data stored in the on-chip storage can be moved to other spaces.
  • the original data to be moved can be encrypted before moving to other spaces to obtain ciphertext data, and the To move ciphertext data, specifically, ciphertext data can be stored in the memory to release on-chip storage space, and it is necessary to ensure that only ciphertext data appears in the memory, so that the database query engine and high-privilege users can access the memory However, it is difficult to access the plaintext data in the on-chip storage.
  • DBA database administrator
  • the data in the memory needs to be encrypted, so that Only ciphertext data appears in the memory, thereby improving data security.
  • the DBA since the DBA has physical access to the memory device, it may implement physical attacks such as bus sniffing. Therefore, only ciphertext data can be stored in the memory, and there is no need to store plaintext data in the memory, which can improve the security of the memory.
  • FIG. 3 it is a schematic diagram of the encryption structure, which includes three areas, namely the trusted area, the untrusted area, and the encrypted area, wherein the trusted area contains atomic operation programs and on-chip storage, and the untrusted area contains There is a database query engine, and the encrypted area contains memory.
  • the atomic operation program (the above-mentioned atomic operation module) can read the encrypted data from the memory, decrypt it and perform calculations in the trusted on-chip storage. After the calculation is completed, you can Re-encrypt the result and write it back to the memory.
  • the paging operation can be performed when it is exhausted, that is, the data in the on-chip storage is stored in other memory, and the page can be updated when swapping out
  • the data is encrypted to ensure that only ciphertext data exists in the memory to improve data security.
  • the method further includes: reading the ciphertext data from the internal memory; decrypting the ciphertext data to obtain original data; and storing the original data in on-chip storage.
  • the ciphertext data when the ciphertext data needs to be processed, the ciphertext data can be read from the memory, and the ciphertext data can be decrypted to obtain the original data, and the original data can be stored on the chip storage operations to improve data security.
  • the method before transmitting the ciphertext operation request sent by the database engine to the on-chip storage of the processor, the method further includes: obtaining the ciphertext operation request from the database engine through the request forwarding module, wherein the request forwarding module Installed in the database engine; forward the ciphertext operation request to the atomic operation module through the request forwarding module.
  • the above request forwarding module can be installed in the database engine.
  • the database engine after the database engine receives the ciphertext operation request, it can obtain the ciphertext operation request from the database engine through the request forwarding module, and forward the ciphertext operation request to the trusted atomic operation
  • the processing status of multiple atomic operation modules can also be recorded in the request forwarding module, and an appropriate atomic operation module can be selected for forwarding according to the processing status of multiple atomic operation modules. Specifically, a relatively idle one can be selected The atomic operation module forwards to improve the processing efficiency of the atomic operation module.
  • returning the ciphertext operation result from the on-chip storage to the database engine includes: receiving the ciphertext operation result sent by the atomic operation module through the request forwarding module; forwarding the ciphertext operation result to the database engine through the request forwarding module .
  • the atomic operation module after the atomic operation module obtains the ciphertext operation result, it can send the ciphertext operation result from the on-chip storage to the request forwarding module, and the request forwarding module can forward the obtained ciphertext operation result In the database engine, the data processing efficiency can be avoided by requesting the forwarding module to forward the data between the database engine and the atomic operation module.
  • FIG. 4 it is a schematic diagram of the overall architecture of the database operating system, which includes two areas, namely the trusted area and the untrusted area.
  • the trusted area includes the client, login authentication, key management, atomic
  • the operating program, the untrusted area includes the encryption type extension and the database query engine.
  • the specific operation process is that the client can first perform login authentication in the cloud server, and then verify whether the authentication is passed through key management. After the authentication is passed, the client can send the original operation request through the encrypted channel.
  • the original operation request is encrypted to generate a ciphertext operation request, and the database query engine can forward the ciphertext operation request to the atomic operation program for operation.
  • the trusted atomic operation program can be determined through the encryption type extension, and the The ciphertext operation request is forwarded to the atomic operation program.
  • the atomic operation program can decrypt the ciphertext operation request to obtain the original operation request, perform corresponding operations according to the original operation request, and obtain the original Operation results, the original operation results can be encrypted to obtain the ciphertext operation results, and the ciphertext operation results can be fed back to the database query engine, and the database query engine can return the ciphertext operation results to the client through the encrypted channel.
  • the ciphertext operation result can be decrypted to obtain the original operation result, so that the client can obtain the original operation result.
  • the method according to the above embodiments can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware, but in many cases the former is better implementation.
  • the technical solution of the present application can be embodied in the form of a software product in essence or the part that contributes to the prior art, and the computer software product is stored in a storage medium (such as ROM/RAM, disk, CD) contains several instructions to make a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) execute the method of each embodiment of the present application.
  • a storage medium such as ROM/RAM, disk, CD
  • a database operation device for implementing the above-mentioned database operation method is also provided.
  • the device includes: a receiving module 502 , a processing module 504 , and a feedback module 506 .
  • the receiving module is configured to transmit the ciphertext operation request sent by the database engine to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent an operation request obtained by encrypting the original operation request;
  • the processing module is used to process the original operation request through the atomic operation module in the on-chip storage to obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor;
  • the feedback module is used to return the ciphertext operation result from the on-chip storage to the database engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result, and the database engine is used to update the database based on the ciphertext operation result operate on the data stored in it.
  • the above-mentioned receiving module 502, processing module 504, and feedback module 506 correspond to Step S202 to Step S206 in Embodiment 1, and the examples and application scenarios realized by the three modules are the same as those of the corresponding steps, but not It is limited to the content disclosed in Embodiment 1 above. It should be noted that, as a part of the device, the above modules can run in the computer terminal 10 provided in Embodiment 1.
  • the processing module includes: a decryption unit, a processing unit, and an encryption unit.
  • the decryption unit is used to decrypt the ciphertext operation request through the decryption operator included in the atomic operation module to obtain the original operation request;
  • the processing unit is used to process the original operation request through the target operation operator included in the atomic operation module , to obtain the original operation result;
  • the encryption unit is used to encrypt the original operation result through the encryption operator contained in the atomic operation module to obtain the ciphertext operation result.
  • the original operation request includes: the target operand and at least one target operator, and the processing unit is also used to obtain the corresponding operator of each target operator from the multiple operators included in the atomic operation module ; Combine the operation operators corresponding to at least one target operator to obtain the target operation operator; process the target operand through the target operation operator to obtain the original operation result.
  • the processing unit when there are multiple target operators, is further configured to save the multiple operators as multiple copies; obtain the corresponding operator of each target operator from each copy son.
  • the device includes: a detection module.
  • the detection module is used to detect whether the client sending the ciphertext operation request is successfully authenticated; the decryption module is used to decrypt the ciphertext operation request through the decryption operator to obtain the original operation ask.
  • the device includes: an encryption module and a storage module.
  • the encryption module is used to encrypt the original data stored in the on-chip storage to obtain ciphertext data when it is detected that the remaining storage space of the on-chip storage is less than a preset value; the storage module is used to store the ciphertext data in the memory middle.
  • the device includes: a reading module and a decryption module.
  • the reading module is used to read the ciphertext data from the memory;
  • the decryption module is used to decrypt the ciphertext data to obtain the original data;
  • the storage module is also used to store the original data to on-chip storage.
  • the device further includes: an acquisition module and a forwarding module.
  • the acquisition module is used to obtain the ciphertext operation request from the database engine through the request forwarding module, wherein the request forwarding module is installed in the database engine; the forwarding module is used to forward the ciphertext operation request to the atomic operation module through the request forwarding module.
  • the feedback module includes: a receiving unit and a forwarding unit.
  • the receiving unit is used to receive the ciphertext operation result sent by the atomic operation module through the request forwarding module; the second forwarding unit is used to forward the ciphertext operation result to the database engine through the request forwarding module.
  • Embodiments of the present application may provide a database operating system, including:
  • the database engine is configured to send a ciphertext operation request, wherein the ciphertext operation request is used to represent an operation request obtained by encrypting the original operation request;
  • Processor connected to the database engine, including: on-chip storage and trusted area, the atomic operation module runs in the trusted area, the processor is used to transmit the ciphertext operation request to the on-chip storage, and the atomic operation module executes the original The operation request is processed, the original operation result is obtained, and the ciphertext operation result is returned from the on-chip storage to the database An engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result;
  • the database engine is also used to operate on the data stored in the database based on the result of the cipher text operation.
  • the atomic operation module includes: a decryption operator for decrypting the ciphertext operation request to obtain the original operation request; a target operation operator for processing the original operation request to obtain the original operation result; The encryption operator is used to encrypt the original operation result to obtain the ciphertext operation result.
  • the system further includes: a client, used to send a ciphertext operation request; a verification server, connected in communication with the client, used to authenticate the client; an atomic operation module, connected in communication with the verification server, It is used to decrypt the ciphertext operation request through the decryption operator to obtain the original operation request when the authentication server successfully authenticates the client.
  • Embodiments of the present application may provide a computer terminal, and the computer terminal may be any computer terminal device in a group of computer terminals.
  • the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.
  • the foregoing computer terminal may be located in at least one network device among multiple network devices of the computer network.
  • the above-mentioned computer terminal can execute the program code of the following steps in the database operation method: transmit the ciphertext operation request sent by the database engine to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent the original The operation request obtained by encrypting the operation request; the original operation request is processed by the atomic operation module in the on-chip storage to obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor; the ciphertext operation result The on-chip storage is returned to the database engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result, and the database engine is used to operate the data stored in the database based on the ciphertext operation result.
  • FIG. 6 is a structural block diagram of a computer terminal according to an embodiment of the present application.
  • the computer terminal may include: one or more (only one is shown in the figure) processors and memory.
  • the memory can be used to store software programs and modules, such as the program instructions/modules corresponding to the operation method and device of the database in the embodiment of the present application, and the processor executes various functions by running the software programs and modules stored in the memory Application and data processing, that is, to realize the operation method of the above-mentioned database.
  • the memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.
  • the memory may further include a memory remotely located relative to the processor, and these remote memories may be connected to the terminal A through a network. Examples of such networks include, but are not limited to, the Internet, Enterprise intranet, local area network, mobile communication network and their combination.
  • the processor can call the information stored in the memory and the application program through the transmission device to perform the following steps: transmit the ciphertext operation request sent by the database engine to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent the original operation The operation request obtained by requesting encryption; the original operation request is processed by the atomic operation module in the on-chip storage to obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor; the ciphertext operation result is obtained from The on-chip storage is returned to the database engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result, and the database engine is used to operate the data stored in the database based on the ciphertext operation result.
  • the above-mentioned processor can also execute the program code in the following steps: decrypt the ciphertext operation request through the decryption operator included in the atomic operation module to obtain the original operation request; use the target operation operator included in the atomic operation module to decrypt the original
  • the operation request is processed to obtain the original operation result; the original operation result is encrypted by the encryption operator contained in the atomic operation module to obtain the ciphertext operation result.
  • the above-mentioned processor can also execute the program code of the following steps: obtaining the operation operator corresponding to each target operator from the multiple operation operators contained in the atomic operation module; calculating the operation operator corresponding to at least one target operator The target operation operator is obtained by combining the sub-operators; the target operand is processed by the target operation operator to obtain the original operation result.
  • the above-mentioned processor may also execute the program code of the following steps: saving multiple operation operators as multiple copies; obtaining the operation operator corresponding to each target operator from each copy.
  • the above-mentioned processor may also execute the program code of the following steps: detecting whether the client sending the ciphertext operation request is authenticated successfully; Decrypt to get the original operation request.
  • the above-mentioned processor can also execute the program code of the following steps: when it is detected that the remaining storage space of the on-chip storage is less than a preset value, encrypt the original data stored in the on-chip storage to obtain ciphertext data;
  • the ciphertext data is stored in memory.
  • the above-mentioned processor can also execute the program code of the following steps: read the ciphertext data from the memory; decrypt the ciphertext data to obtain the original data; store the original data to the on-chip storage.
  • the above-mentioned processor can also execute the program code of the following steps: obtain the ciphertext operation request from the database engine through the request forwarding module, wherein the request forwarding module is installed in the database engine; forward the ciphertext operation request through the request forwarding module to the atomic operations module.
  • the above-mentioned processor can also execute the program code of the following steps: receiving the ciphertext operation result sent by the atomic operation module through the request forwarding module; forwarding the ciphertext operation result to the database engine through the request forwarding module.
  • the database engine can send the The ciphertext operation request is transmitted to the on-chip storage of the processor, where the ciphertext operation request is used to represent the operation request obtained by encrypting the original operation request; the original operation request is processed by the atomic operation module in the on-chip storage to obtain the original The operation result, wherein the atomic operation module runs in the trusted area of the processor; the ciphertext operation result is returned from the on-chip storage to the database engine, wherein the ciphertext operation result is used to represent the operation obtained by encrypting the original operation result
  • the database engine is used to operate the data stored in the database based on the ciphertext operation results, which realizes the physical and software isolation of the database engine and the actual operation and processing modules, improves the security of data processing, and can
  • the atomic operation module is placed in the trusted area of the processor, and the database engine can only access the ciphertext data during the operation, thereby improving the security of
  • the structure shown in Figure 6 is only schematic, and the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, and a mobile Internet device (Mobile Internet Devices, MID ), PAD and other terminal equipment.
  • FIG. 6 does not limit the structure of the above-mentioned electronic device.
  • the computer terminal may also include more or less components than those shown in FIG. 6 (eg, network interface, display device, etc.), or have a different configuration from that shown in FIG. 6 .
  • the embodiment of the present application also provides a storage medium.
  • the above-mentioned storage medium may be used to store the program code executed by the database operation method provided in the above-mentioned embodiment.
  • the above-mentioned storage medium may be located in any computer terminal in the group of computer terminals in the computer network, or in any mobile terminal in the group of mobile terminals.
  • the storage medium is configured to store program codes for performing the following steps: transmitting the ciphertext operation request sent by the database engine to the on-chip storage of the processor, wherein the ciphertext operation request is used for Characterize the operation request obtained by encrypting the original operation request; process the original operation request through the atomic operation module in the on-chip storage, and obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor; the encrypted The text operation result is returned from the on-chip storage to the database engine, wherein the ciphertext operation result is used to represent the operation result obtained by encrypting the original operation result, and the database engine is used to operate the data stored in the database based on the ciphertext operation result.
  • the above-mentioned storage medium is also configured to store program codes for performing the following steps: decrypt the ciphertext operation request through the decryption operator contained in the atomic operation module to obtain the original operation request;
  • the operation operator processes the original operation request and obtains the original operation result;
  • the atomic operation module contains The encryption operator encrypts the original operation result to obtain the ciphertext operation result.
  • the above-mentioned storage medium is also configured to store program codes for performing the following steps: obtain the operation operator corresponding to each target operator from the multiple operation operators contained in the atomic operation module; convert at least one target operation The operator corresponding to the symbol is combined to obtain the target operator; the target operand is processed by the target operator to obtain the original operation result.
  • the above-mentioned storage medium is further configured to store program codes for performing the following steps: saving multiple operation operators as multiple copies; obtaining the operation operator corresponding to each target operator from each copy.
  • the above-mentioned storage medium is also configured to store program codes for performing the following steps: detecting whether the client sending the ciphertext operation request is authenticated successfully; The ciphertext operation request is decrypted to obtain the original operation request.
  • the above-mentioned storage medium is also configured to store program codes for performing the following steps: when it is detected that the remaining storage space of the on-chip storage is less than a preset value, the original data stored in the on-chip storage is encrypted to obtain Ciphertext data; store the ciphertext data in memory.
  • the above-mentioned storage medium is further configured to store program codes for executing the following steps: reading ciphertext data from memory; decrypting ciphertext data to obtain original data; storing the original data to on-chip storage.
  • the above-mentioned storage medium is also configured to store program codes for performing the following steps: obtain the ciphertext operation request from the database engine through the request forwarding module, wherein the request forwarding module is installed in the database engine; The ciphertext operation request is forwarded to the atomic operation module.
  • the above-mentioned storage medium is also configured to store program code for performing the following steps: receiving the ciphertext operation result sent by the atomic operation module through the request forwarding module; forwarding the ciphertext operation result to the database engine through the request forwarding module.
  • the ciphertext operation request sent by the database engine can be transmitted to the on-chip storage of the processor, wherein the ciphertext operation request is used to represent the operation request obtained by encrypting the original operation request;
  • the original operation request is processed to obtain the original operation result, wherein the atomic operation module runs in the trusted area of the processor;
  • the ciphertext operation result is returned from the on-chip storage to the database engine, wherein the ciphertext operation result is used to represent the original
  • the database engine is used to operate the data stored in the database based on the ciphertext operation result, which realizes the physical and software isolation of the database engine and the actual operation processing module.
  • the atomic operation module can be placed in the trusted area of the processor, and the database engine can only access ciphertext data during operation, thereby improving the security of database operations and solving related problems.
  • the database runs in the trusted area of the processor, and the security of operating the database is not high.
  • the disclosed technical content can be realized in other ways.
  • the device embodiments described above are only illustrative, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or can be Integrate into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of units or modules may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or part of the contribution to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for enabling a computer device (which may be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disc, etc., which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Computing Systems (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种数据库的操作方法、系统、存储介质以及计算机终端。其中，该方法包括：将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。本申请解决了相关技术中数据库运行在处理器的可信区域中，对数据库进行操作的安全性不高的技术问题。

Description

数据库的操作方法、系统、存储介质以及计算机终端
本申请要求于2022年02月17日提交中国专利局、申请号为202210148186.X、申请名称为“数据库的操作方法、系统、存储介质以及计算机终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据库的操作领域，具体而言，涉及一种数据库的操作方法、系统、存储介质以及计算机终端。
背景技术
目前，云计算客户对于公有云数据的安全性、可靠性等需求愈加迫切，通过安全处理器提供的隔离或加密等硬件特性可以保证数据安全，目前所采用的处理器本身并不提供对安全内存的保密性和完整性的保护，因此，对于运行在处理器中的数据库进行操作的安全性不高。
针对上述的问题，目前尚未提出有效的解决方案。
发明内容
本申请实施例提供了一种数据库的操作方法、系统、存储介质以及计算机终端，以至少解决相关技术中数据库运行在处理器的可信区域中，对数据库进行操作的安全性不高的技术问题。
根据本申请实施例的一个方面，提供了一种数据库的操作方法，包括：将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。
根据本申请实施例的另一方面，还提供了一种数据库的操作系统，包括：数据库引擎，用于发送密文操作请求，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；处理器，与数据库引擎连接，包括：片上存储和可信区域，可信区域中运行有原子操作模块，处理器用于将密文操作请求传输至片上存储，在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，并将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果； 数据库引擎还用于基于密文操作结果对数据库中存储的数据进行操作。
根据本申请实施例的另一方面，还提供了一种计算机可读存储介质，计算机可读存储介质包括存储的程序，其中，在程序运行时控制计算机可读存储介质所在设备执行上述的数据库的操作方法。
根据本申请实施例的另一方面，还提供了一种计算机终端，包括：存储器和处理器，处理器用于运行存储器中存储的程序，其中，程序运行时执行上述的数据库的操作方法。
在本申请实施例中，首先，可以将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作，实现了将数据库引擎与实际进行操作处理的模块进行物理层面和软件层面上的隔离，提高数据处理的安全性，可以将原子操作模块放入到处理器的可信区域中，并且数据库引擎操作的过程中只能接触到密文数据，从而提高数据库操作的安全性，进而解决了相关技术中数据库运行在处理器的可信区域中，对数据库进行操作的安全性不高的技术问题。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是根据本申请实施例的一种用于实现数据库的操作方法的计算机终端(或移动设备)的硬件结构框图；
图2是根据本申请实施例的一种数据库的操作方法的流程图；
图3是根据本申请实施例的一种加密结构的示意图；
图4是根据本申请实施例的一种数据库操作系统的整体架构示意图；
图5是根据本申请实施例的一种数据库的操作装置的示意图；
图6是根据本申请实施例的一种计算机终端的结构框图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
首先，在对本申请实施例进行描述的过程中出现的部分名词或术语适用于如下解释：
片上计算(On-Chip Computing)：片上计算是一种可信计算技术，利用CPU内部的片上存储作为运行内存，当内存页被换出到普通内存时进行加密。利用片上计算技术可以实现软件的全内存加密，防止针对内存的攻击，如总线嗅探、冷启动等。
可信执行环境TEE(Trusted Execution Environment)：可信执行环境是处理器的一个安全区域，保证其内部加载的代码和数据的机密性和完整性能得到保护。它提供了一个隔离的执行空间安全区，在其中运行的受信任程序可以防止普通应用程序，操作系统(OS)甚至是虚拟机检测器(Hypervisor)的侵害。
ARM可信区域(ARM TrustZone)：ARM TrustZone是ARM处理器所特有的安全计算环境。它们允许用户定义内存的可信区域，其内容受完整性保护并且无法被可信区域以外的任何软件所访问。
目前，国内云市场对保密计算和国产处理器的需求紧密相关。一方面，使用国产处理器可满足自主可控的安全需求，另一方面，也能将权责问题落实到国内厂商。在云计算环境面临的复杂安全问题背景下，需要利用国产ARM处理器的TrustZone特性实现云环境场景下的，加密数据库方案。
其中，TrustZone作为ARM处理器体系架构的安全扩展，在硬件层面提供了多种物理资源的隔离能力，包括内存隔离、中断隔离、设备隔离等。但是ARM TrustZone本身并不提供安全内存的保密性和完整性保护，需要利用ARM上配置的片上存储(OCM)，引入内存加密技术来抵御物理攻击。
现有的基于可信芯片技术的加密数据库工作主要分为基于可信硬件以及基于同态加密的方案，其中主流的是基于可信硬件的方案工作主要有EnclaveDB(加强关键代码数据库)、StealthDB(隐藏数据库)、Cipherbase(加密数据库)和DBStore(仓库管理系统)。EnclaveDB在SGX(software guard extensions，指令扩展)中运行完整的内存数据库，依赖SGX提供的内存加密和完整性检查来保护数据库数据。StealthDB与Cipherbase选择不修改现有商用数据库，而是通过自定义函数(UDF)对数据库进行扩展，利用运行在SGX中的密文计算模块对密文进行解密计算，整个过程中数据库始终无法接触到数据明文。 DBStore是基于TrustZone(硬件架构)的移动端安全数据库方案，以SQLite(嵌入式数据库引擎)作为数据库引擎，但没有实现物理内存的加密方案，无法防御物理攻击。
Microsoft Azure SQL Database(微软基于云计算的数据库)使用SGX作为可信硬件机制，在数据库服务器中上，数据始终处于加密状态，仅在可信环境enclave中对密文进行解密、运算和重加密。并对客户端提供远程认证等功能。
DBStore：学界工作DBStore使用ARM提供的可信硬件机制TrustZone，在移动端保护数据库SQLite，该工作将SQLite运行在Trustzone中，与不可信软件进行隔离。
Azure SQL Database(云计算的数据库)是基于SGX的加密数据库，可以使用enclave(关键代码)保护对密文的原子操作，数据库无法接触到明文数据，只能通过调用原子操作来操作密文数据。由于芯片无法国产化，难以达到自主可控的安全目标。
此外由于SGX和ARM TrustZone技术上存在区别，其提供的可信执行环境机制和安全保证不同，基于SGX的加密数据库方案无法直接移植到TrustZone上，无法直接达到同样的安全级别。DBStore方案将SQLite直接运行在Trustzone中，对数据库有改动和适配。此外，其依赖隔离内存，但由于没有进行内存加密，不防御物理攻击。
为了解决上述问题，本申请提供了一种数据库操作方法，可以将数据库设置于不可信的执行环境中，在可信的执行环境中设置原子操作模块进行实际的操作，使得数据库只能接触到密文数据，难以接触到明文数据，从而提高数据的安全性。
实施例1
根据本申请实施例，还提供了一种数据库的操作方法实施例，需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
本申请实施例所提供的方法实施例可以在移动终端、计算机终端或者类似的运算装置中执行。图1示出了一种用于实现数据库的操作方法的计算机终端(或移动设备)的硬件结构框图。如图1所示，计算机终端10(或移动设备10)可以包括一个或多个(图中采用102a、102b，……，102n来示出)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输装置106。除此以外，还可以包括：显示器、输入/输出接口(I/O接口)、通用串行总线(USB)端口(可以作为BUS总线的端口中的一个端口被包括)、网络接口、电源和/或相机。本领域普通技术人员可以理解，图1所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图1中所示更多或者更少的组件，或者具有与图1所示不同的配置。
应当注意到的是上述一个或多个处理器102和/或其他数据处理电路在本文中通常可以被称为“数据处理电路”。该数据处理电路可以全部或部分的体现为软件、硬件、固件或其他任意组合。此外，数据处理电路可为单个独立的处理模块，或全部或部分的结合到计算机终端10(或移动设备)中的其他元件中的任意一个内。该数据处理电路作为一种处理器控制(例如与接口连接的可变电阻终端路径的选择)。
存储器104可用于存储应用软件的软件程序以及模块，如本申请实施例中的数据库的操作方法对应的程序指令/数据存储装置，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的数据库的操作方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
显示器可以例如触摸屏式的液晶显示器(LCD)，该液晶显示器可使得用户能够与计算机终端10(或移动设备)的用户界面进行交互。
此处需要说明的是，在一些可选实施例中，上述图1所示的计算机设备(或移动设备)可以包括硬件元件(包括电路)、软件元件(包括存储在计算机可读介质上的计算机代码)、或硬件元件和软件元件两者的结合。应当指出的是，图1仅为特定具体实例的一个实例，并且旨在示出可存在于上述计算机设备(或移动设备)中的部件的类型。
在上述运行环境下，本申请提供了如图2所示的数据库的操作方法。图2是根据本申请实施例的数据库的操作方法的流程图。
步骤S202，将数据库引擎发送的密文操作请求传输至处理器的片上存储。
其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求。
上述的数据库引擎可以是数据库查询引擎。上述的数据库引擎可以处于不可信的执行环境中，便于用户灵活的使用。
上述的片上存储中可以存储有明文数据。上述的片上存储可以作为可信程序的运行内存，可以对离开片上存储的内存页进行AES-GCM加密，对换入的内存页进行解密，使得片上存储中存储的数据都是明文形式，而存储至其他内存的数据都是密文形式，可以解决ARM  TrustZone不提供内存加密所带来的物理攻击威胁。能够达到与使用SGX相同，甚至更强的安全保障。
在一种可选的实施例中，为了提高数据操作的安全性，可以对原始操作请求进行加密，得到密文操作请求，然后使用处于不可信的执行环境中的数据库引擎接收该密文操作请求，使得处于不可信的执行环境中的数据库引擎难以直接接触到未加密的数据，从而提高数据的安全性。其中，由于数据库引擎只能接触到数据处理过程中的密文操作请求等进行加密处理之后的数据，因此，其不需要局限于使用特定的数据库引擎，使得数据库引擎具有很强的适用性和兼容性。
在另一种可选的实施例中，在获取到原始操作请求之后，可以将原始操作请求存储在处理器的片上存储中，可以通过原子操作程序中的目标操作算子读取片上存储中存储的原始操作请求，以便得到目标操作请求对应的原始操作结果，并将原始操作结果存储至片上存储中。
在另一种可选的实施例中，原子操作模块可以对接收到密文操作请求进行解密，得到原始操作请求，在得到原始操作请求之后，可以先将原始操作请求存储在处理器的片上存储中，片上存储可以存储有多个原始操作请求，片上存储可以按照原始操作请求存储的顺序对原始操作请求进行处理，目标操作请求可以是片上存储当前正在处理的原始操作请求，通过对目标操作请求进行处理，可以得到当前处理的原始操作请求对应的当前操作结果，并将当前操作结果存储至片上存储中。在需要获取到原始操作请求对应的原始操作结果时，可以在片上存储中获取到该原始操作结果。
在另一种可选的实施例中，为了提高客户端进行数据查询过程中的安全性，客户端可以通过加密信道发送原始操作请求，并在加密信道中对原始操作请求进行加密，得到密文操作请求。
在又一种可选的实施例中，可以在数据库引擎中设置加密类型扩展模块，可以对数据库系统的加密类型进行扩展，将加密类型的操作转发到可信的原子操作模块中，并处理返回的结果，采用扩展的设计使得该加密数据库的方案可以具有很强的适用性和兼容性，并不需要局限于特定的数据库。
步骤S204，在片上存储中通过原子操作模块对原始请求进行处理，得到原始操作结果。
其中，原子操作模块运行在处理器的可信区域中。
上述的原子操作模块可以处于可信的执行环境中。例如，原子操作模块可以运行在ARM TrustZone的安全世界中，与不可信的操作系统等进行隔离，防止在软件层面发生机密信息泄露。其中，原子操作模块可以为原子操作程序。
上述的原子操作模块可以进行算数逻辑运算、比较操作等，可以接收数据库引擎输入 的密文操作数和操作符，在对操作数解密后执行对应的操作，并将结果加密返回给数据库引擎。
上述的片上存储的安全性较高，因此，可以在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果。
在一种可选的实施例中，为了提高数据的安全性，可以在获取到密文操作请求之后，根据密文操作请求通过安全性较高的片上存储对原始操作请求进行处理，得到原始操作结果，为了防止发生数据的泄露，可以在片上存储中通过原子操作模块对原始操作结果进行加密，得到上述的密文操作结果。
其中，原子操作模块运行在处理器的可信区域中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果。
步骤S206，将密文操作结果从片上存储返回至数据库引擎。
其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。
在一种可选的实施例中，可以将密文操作结果返回至数据库引擎中，数据库引擎可以根据密文操作结果对数据库中存储的数据进行操作，具体的，数据库引擎可以根据密文操作结果将数据库中存储的密文数据发送至客户端。
需要说明的是，本方案并未对数据库引擎进行侵入式修改，可以兼容现有的成熟数据库系统，不局限于特定的数据库，具有更强的灵活性。
通过上述步骤，首先，可以将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作，实现了将数据库引擎与实际进行操作处理的模块进行物理层面和软件层面上的隔离，提高数据处理的安全性，可以将原子操作模块放入到处理器的可信区域中，并且数据库引擎操作的过程中只能接触到密文数据，从而提高数据库操作的安全性，进而解决了相关技术中数据库运行在处理器的可信区域中，对数据库进行操作的安全性不高的技术问题。
在本申请上述实施例中，通过原子操作模块对原始操作请求进行处理，得到原始操作结果包括：通过原子操作模块包含的解密算子对密文操作请求进行解密，得到原始操作请求；通过原子操作模块包含的目标操作算子对原始操作请求进行处理，得到原始操作结果；通过原子操作模块包含的加密算子对原始操作结果进行加密，得到密文操作结果。
上述的目标操作算子可以是算术逻辑运算对应的算子、比较操作对应的算子等。
在一种可选的实施例中，原子操作模块可以在可信的环境下，通过其包含的解密算子对密文操作请求进行解密，得到原始操作请求，其中，原始操作请求可以是进行算术逻辑运算、比较操作等请求，可以获取到原始操作请求对应的目标操作算子，例如，若原始操作请求为对目标字符进行算术逻辑运算，则可以采用算术逻辑运算对应的操作算子对目标字符进行运算，得到原始操作结果，若原始操作请求为对目标字符中任意两个字符进行比较操作，则可以采用比较操作对应的操作算子对目标字符进行运算，得到原始操作结果。
进一步地，为了使得原始操作结果可以在不可信区域中进行传递，可以将原始操作结果进行加密，得到密文操作结果，数据库引擎可以根据密文操作结果对数据库中的数据进行操作，并发送至客户端中。
在本申请上述实施例中，原始操作请求包括：目标操作数和至少一个目标操作符，其中，通过原子操作模块包括的目标操作算子对原始操作请求进行处理，得到原始操作结果，包括：从原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子；将至少一个目标操作符对应的操作算子进行组合，得到目标操作算子；通过目标操作算子对目标操作数进行处理，得到原始操作结果。
上述的目标操作数可以为待进行计算的字符，例如数字、字母。上述的目标操作符可以为加、减、乘、初、大于、小于等操作符。
上述的多个操作算子可以为细粒度的原子操作算子，不同操作算子之间可以进行任意组合，组成更复杂的目标操作算子。由于算子的粒度较小且无状态，因此，可以运行多个算子的副本为数据库提供服务，有较好的可扩展性和隔离性。
在一种可选的实施例中，可以从原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子，可以将多个操作算子进行组合，得到更加复杂的目标操作算子，以便通过该目标操作算子对目标操作数进行处理，得到原始操作结果。
在本申请上述实施例中，在目标操作符为多个的情况下，从原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子包括：将多个操作算子保存为多个副本；从每个副本中获取每个目标操作符对应的操作算子。
在一种可选的实施例中，可以将多个操作算子保存为多个副本，通过多个副本为为每个目标操作符提供对应的操作算子，可以有更好的可扩展性和隔离性，提高数据操作过程中的安全性和灵活性。
在本申请上述实施例中，在通过原子操作模块包含的解密算子对密文操作请求进行解密，得到原始操作请求之前，该方法还包括：检测发送密文操作请求的客户端是否认证成功；在检测到客户端认证成功的情况下，通过解密算子对密文操作请求进行解密，得到原 始操作请求。
在一种可选的实施例中，云服务在接收到客户端发送的密文操作请求时，可以先对客户端进行认证，检测客户端是否具有操作权限，具体的，客户端可以通过登录进行认证，可以通过密钥管理对客户端的登录认证进行检测，检测客户端是否具有操作权限，在检测到客户端认证成功的情况下，可以通过原子操作模块中的解密算子对密文操作请求进行解密，得到原始操作请求。通过对客户端进行认证，可以避免没有进行认证的客户端使用数据库引擎，从而提高数据库引擎的安全性。
在本申请上述实施例中，该方法还包括：在检测到片上存储的剩余存储空间小于预设值的情况下，对片上存储中存储的原始数据进行加密，得到密文数据；将密文数据存储至内存中。
上述的预设值可以根据用户需要预留的剩余存储控件进行设定。
在一种可选的实施例中，由于片上存储的存储空间有限，因此，在片上存储的剩余存储空间小于预设值的情况下，也即，片上存储空间快要用尽的情况下，可以将片上存储中存储的原始数据进行移动，可以移动到其他的空间中，为了保证数据的安全性，可以在移动至其他空间之前，先对需要移动的原始数据进行加密，得到密文数据，并将密文数据进行移动，具体的，可以将密文数据存储至内存中，以释放片上存储的存储空间，并且需要保证内存中只出现密文数据，使得数据库查询引擎以及高权限用户可以接触到内存中的密文数据，但是难以访问到片上存储中的明文数据。
在另一种可选的实施例中，由于存在不可信的数据库管理员(DBA)，其具有数据库的管理权限，可以对内存进行无限制访问，因此，需要对内存中的数据进行加密，使得内存中只出现密文数据，从而提高数据的安全性。由于DBA对内存设备具有物理访问能力，其可能实施诸如总线嗅探等物理攻击，因此，在内存中可以只存储密文数据，不需要在内存中存储明文数据，这样可以提高内存的安全性。另外，在数据处理过程中还可能存在不可信的云服务器的操作系统、虚拟机检测器或者其他租户的虚拟机，其可能会被恶意程序利用，遭受攻击后进而窃取内存中的机密数据，因此，需要在内存保存密文数据，避免被恶意窃取。
如图3所示为加密结构的示意图，其包含有三个区域，分别为可信区域、不可信区域和加密区域，其中，可信区域中包含有原子操作程序、片上存储，不可信区域中包含有数据库查询引擎，加密区域中包含有内存，原子操作程序(上述的原子操作模块)可以从内存中读取加密后的数据，可以解密并在可信的片上存储中进行计算，计算完成之后可以将结果重新加密写回到内存中，由于片上存储空间有限，当用尽使可以进行换页操作，也即，将片上存储中的数据存储至其他的内存中，在换出时可以对页内的数据进行加密，以保证内存中只存在密文数据，以提高数据的安全性。
在本申请上述实施例中，该方法还包括：从内存中读取密文数据；对密文数据进行解密，得到原始数据；将原始数据存储至片上存储。
在一种可选的实施例中，在需要对密文数据进行处理的情况下，可以从内存中读取密文数据，并对密文数据进行解密后得到原始数据，将原始数据存储至片上存储进行操作，以提高数据的安全性。
在本申请上述实施例中，在将数据库引擎发送的密文操作请求传输至处理器的片上存储之前，该方法还包括：通过请求转发模块从数据库引擎获取密文操作请求，其中，请求转发模块安装在数据库引擎中；通过请求转发模块将密文操作请求转发至原子操作模块。
上述的请求转发模块可以安装到数据库引擎中。
在一种可选的实施例中，在数据库引擎接收到密文操作请求之后，可以通过请求转发模块从数据库引擎中获取到密文操作请求，并将密文操作请求转发到可信的原子操作模块中，具体的，在请求转发模块中还可以记载多个原子操作模块的处理状态，可以根据多个原子操作模块的处理状态选择合适的原子操作模块进行转发，具体的，可以选择较为空闲的原子操作模块进行转发，以提高原子操作模块的处理效率。
在本申请上述实施例中，将密文操作结果从片上存储返回至数据库引擎包括：通过请求转发模块接收原子操作模块发送的密文操作结果；通过请求转发模块将密文操作结果转发至数据库引擎。
在一种可选的实施例中，原子操作模块在得到密文操作结果之后，可以将密文操作结果从片上存储发送至请求转发模块中，请求转发模块可以将获取到的密文操作结果转发至数据库引擎中，通过请求转发模块对数据库引擎和原子操作模块之间的数据进行转发，可以避免提高数据的处理效率。
如图4所示为数据库操作系统的整体架构示意图，其包含有两个区域，分别为可信区域、不可信区域，其中，可信区域中包含有客户端、登陆认证、密钥管理、原子操作程序，不可信区域中包含有加密类型扩展、数据库查询引擎。具体的操作过程为，客户端可以先在云服务器中进行登录认证，通过密钥管理可以检验是否认证通过，在认证通过之后，客户端可以通过加密信道发送原始操作请求，在加密信道中可以对该原始操作请求进行加密，生成密文操作请求，数据库查询引擎可以将密文操作请求转发到原子操作程序中进行操作，具体的，可以通过加密类型扩展确定出可信的原子操作程序，并将密文操作请求转发到原子操作程序中，原子操作程序在接收到密文操作请求之后，可以对密文操作请求进行解密，得到原始操作请求，可以根据原始操作请求执行对应的操作，并得到原始操作结果，可以对原始操作结果进行加密，得到密文操作结果，可以将密文操作结果反馈至数据库查询引擎中，数据库查询引擎可以将密文操作结果通过加密信道返回至客户端，在加密信道中，可以对密文操作结果进行解密，得到原始操作结果，使得客户端可以获取到原始操作结果。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例的方法。
实施例2
根据本申请实施例，还提供了一种用于实施上述的数据库的操作方法的数据库的操作装置，如图5所示，该装置包括：接收模块502、处理模块504、反馈模块506。
接收模块，用于将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；
处理模块，用于在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；
反馈模块，用于将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。
此处需要说明的是，上述接收模块502、处理模块504、反馈模块506对应于实施例1中的步骤S202至步骤S206，三个模块与对应的步骤所实现的实例和应用场景相同，但不限于上述实施例1所公开的内容。需要说明的是，上述模块作为装置的一部分可以运行在实施例1提供的计算机终端10中。
本申请上述实施例中，处理模块包括：解密单元、处理单元、加密单元。
其中，解密单元，用于通过原子操作模块包含的解密算子对密文操作请求进行解密，得到原始操作请求；处理单元，用于通过原子操作模块包含的目标操作算子对原始操作请求进行处理，得到原始操作结果；加密单元，用于通过原子操作模块包含的加密算子对原始操作结果进行加密，得到密文操作结果。
本申请上述实施例中，原始操作请求包括：目标操作数和至少一个目标操作符，处理单元还用于从原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子； 将至少一个目标操作符对应的操作算子进行组合，得到目标操作算子；通过目标操作算子对目标操作数进行处理，得到原始操作结果。
本申请上述实施例中，在目标操作符为多个的情况下，处理单元还用于将多个操作算子保存为多个副本；从每个副本中获取每个目标操作符对应的操作算子。
本申请上述实施例中，该装置包括：检测模块。
其中，检测模块用于检测发送密文操作请求的客户端是否认证成功；解密模块，用于在检测到客户端认证成功的情况下，通过解密算子对密文操作请求进行解密，得到原始操作请求。
本申请上述实施例中，该装置包括：加密模块、存储模块。
其中，加密模块用于在检测到片上存储的剩余存储空间小于预设值的情况下，对片上存储中存储的原始数据进行加密，得到密文数据；存储模块用于将密文数据存储至内存中。
本申请上述实施例中，该装置包括：读取模块、解密模块。
其中，读取模块用于从内存中读取密文数据；解密模块用于对密文数据进行解密，得到原始数据；存储模块还用于将原始数据存储至片上存储。
本申请上述实施例中，该装置还模块包括：获取模块、转发模块。
其中，获取模块用于通过请求转发模块从数据库引擎获取密文操作请求，其中，请求转发模块安装在数据库引擎中；转发模块用于通过请求转发模块将密文操作请求转发至原子操作模块。
本申请上述实施例中，反馈模块包括：接收单元、转发单元。
其中，接收单元用于通过请求转发模块接收原子操作模块发送的密文操作结果；第二转发单元用于通过请求转发模块将密文操作结果转发至数据库引擎。
需要说明的是，本申请上述实施例中涉及到的优选实施方案与实施例1提供的方案以及应用场景、实施过程相同，但不仅限于实施例1所提供的方案。
实施例3
本申请的实施例可以提供一种数据库的操作系统，包括：
数据库引擎，用于发送密文操作请求，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；
处理器，与数据库引擎连接，包括：片上存储和可信区域，可信区域中运行有原子操作模块，处理器用于将密文操作请求传输至片上存储，在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，并将密文操作结果从片上存储返回至数据库 引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果；
数据库引擎还用于基于密文操作结果对数据库中存储的数据进行操作。本申请上述实施例中，原子操作模块包括：解密算子，用于对密文操作请求进行解密，得到原始操作请求；目标操作算子，用于对原始操作请求进行处理，得到原始操作结果；加密算子，用于对原始操作结果进行加密，得到密文操作结果。
本申请上述实施例中，该系统还包括：客户端，用于发送密文操作请求；验证服务器，与客户端通信连接，用于对客户端进行认证；原子操作模块，与验证服务器通信连接，用于爱验证服务器对客户端认证成功的情况下，通过解密算子对密文操作请求进行解密，得到原始操作请求。
需要说明的是，本申请上述实施例中涉及到的优选实施方案与实施例1提供的方案以及应用场景、实施过程相同，但不仅限于实施例1所提供的方案。
实施例4
本申请的实施例可以提供一种计算机终端，该计算机终端可以是计算机终端群中的任意一个计算机终端设备。可选地，在本实施例中，上述计算机终端也可以替换为移动终端等终端设备。
可选地，在本实施例中，上述计算机终端可以位于计算机网络的多个网络设备中的至少一个网络设备。
在本实施例中，上述计算机终端可以执行数据库的操作方法中以下步骤的程序代码：将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。
可选地，图6是根据本申请实施例的一种计算机终端的结构框图。如图6所示，该计算机终端可以包括：一个或多个(图中仅示出一个)处理器、存储器。
其中，存储器可用于存储软件程序以及模块，如本申请实施例中的数据库的操作方法和装置对应的程序指令/模块，处理器通过运行存储在存储器内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的数据库的操作方法。存储器可包括高速随机存储器，还可以包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至终端A。上述网络的实例包括但不限于互联网、 企业内部网、局域网、移动通信网及其组合。
处理器可以通过传输装置调用存储器存储的信息及应用程序，以执行下述步骤：将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。
可选的，上述处理器还可以执行如下步骤的程序代码：通过原子操作模块包含的解密算子对密文操作请求进行解密，得到原始操作请求；通过原子操作模块包含的目标操作算子对原始操作请求进行处理，得到原始操作结果；通过原子操作模块包含的加密算子对原始操作结果进行加密，得到密文操作结果。
可选的，上述处理器还可以执行如下步骤的程序代码：从原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子；将至少一个目标操作符对应的操作算子进行组合，得到目标操作算子；通过目标操作算子对目标操作数进行处理，得到原始操作结果。
可选的，上述处理器还可以执行如下步骤的程序代码：将多个操作算子保存为多个副本；从每个副本中获取每个目标操作符对应的操作算子。
可选的，上述处理器还可以执行如下步骤的程序代码：检测发送密文操作请求的客户端是否认证成功；在检测到客户端认证成功的情况下，通过解密算子对密文操作请求进行解密，得到原始操作请求。
可选的，上述处理器还可以执行如下步骤的程序代码：在检测到片上存储的剩余存储空间小于预设值的情况下，对片上存储中存储的原始数据进行加密，得到密文数据；将密文数据存储至内存中。
可选的，上述处理器还可以执行如下步骤的程序代码：从内存中读取密文数据；对密文数据进行解密，得到原始数据；将原始数据存储至片上存储。
可选的，上述处理器还可以执行如下步骤的程序代码：通过请求转发模块从数据库引擎获取密文操作请求，其中，请求转发模块安装在数据库引擎中；通过请求转发模块将密文操作请求转发至原子操作模块。
可选的，上述处理器还可以执行如下步骤的程序代码：通过请求转发模块接收原子操作模块发送的密文操作结果；通过请求转发模块将密文操作结果转发至数据库引擎。
采用本申请实施例，提供了一种数据库的操作方案。首先，可以将数据库引擎发送的 密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作，实现了将数据库引擎与实际进行操作处理的模块进行物理层面和软件层面上的隔离，提高数据处理的安全性，可以将原子操作模块放入到处理器的可信区域中，并且数据库引擎操作的过程中只能接触到密文数据，从而提高数据库操作的安全性，进而解决了相关技术中数据库运行在处理器的可信区域中，对数据库进行操作的安全性不高的技术问题。
本领域普通技术人员可以理解，图6所示的结构仅为示意，计算机终端也可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌上电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。图6其并不对上述电子装置的结构造成限定。例如，计算机终端还可包括比图6中所示更多或者更少的组件(如网络接口、显示装置等)，或者具有与图6所示不同的配置。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
实施例5
本申请的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述实施例所提供的数据库的操作方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：通过原子操作模块包含的解密算子对密文操作请求进行解密，得到原始操作请求；通过原子操作模块包含的目标操作算子对原始操作请求进行处理，得到原始操作结果；通过原子操作模块包含 的加密算子对原始操作结果进行加密，得到密文操作结果。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：从原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子；将至少一个目标操作符对应的操作算子进行组合，得到目标操作算子；通过目标操作算子对目标操作数进行处理，得到原始操作结果。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：将多个操作算子保存为多个副本；从每个副本中获取每个目标操作符对应的操作算子。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：检测发送密文操作请求的客户端是否认证成功；在检测到客户端认证成功的情况下，通过解密算子对密文操作请求进行解密，得到原始操作请求。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：在检测到片上存储的剩余存储空间小于预设值的情况下，对片上存储中存储的原始数据进行加密，得到密文数据；将密文数据存储至内存中。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：从内存中读取密文数据；对密文数据进行解密，得到原始数据；将原始数据存储至片上存储。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：通过请求转发模块从数据库引擎获取密文操作请求，其中，请求转发模块安装在数据库引擎中；通过请求转发模块将密文操作请求转发至原子操作模块。
可选的，上述存储介质还被设置为存储用于执行以下步骤的程序代码：通过请求转发模块接收原子操作模块发送的密文操作结果；通过请求转发模块将密文操作结果转发至数据库引擎。
采用本申请实施例，提供了一种数据库的操作方案。首先，可以将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；在片上存储中通过原子操作模块对原始操作请求进行处理，得到原始操作结果，其中，原子操作模块运行在处理器的可信区域中；将密文操作结果从片上存储返回至数据库引擎，其中，密文操作结果用于表征对原始操作结果进行加密所得到的操作结果，数据库引擎用于基于密文操作结果对数据库中存储的数据进行操作，实现了将数据库引擎与实际进行操作处理的模块进行物理层面和软件层面上的隔离，提高数据处理的安全性，可以将原子操作模块放入到处理器的可信区域中，并且数据库引擎操作的过程中只能接触到密文数据，从而提高数据库操作的安全性，进而解决了相关技术中数据库运行在处理器的可信区域中，对数据库进行操作的安全性不高的技术问题。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
在本申请的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本申请的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本申请的保护范围。

Claims (14)

  1. 一种数据库的操作方法，其特征在于，包括：
    将数据库引擎发送的密文操作请求传输至处理器的片上存储，其中，所述密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；
    在所述片上存储中通过原子操作模块对所述原始操作请求进行处理，得到原始操作结果，其中，所述原子操作模块运行在处理器的可信区域中；
    将密文操作结果从所述片上存储返回至所述数据库引擎，其中，所述密文操作结果用于表征对所述原始操作结果进行加密所得到的操作结果，所述数据库引擎用于基于所述密文操作结果对数据库中存储的数据进行操作。
  2. 根据权利要求1所述的方法，其特征在于，通过原子操作模块对所述原始操作请求进行处理，得到原始操作结果包括：
    通过所述原子操作模块包含的解密算子对所述密文操作请求进行解密，得到所述原始操作请求；
    通过所述原子操作模块包含的目标操作算子对所述原始操作请求进行处理，得到所述原始操作结果；
    通过所述原子操作模块包含的加密算子对所述原始操作结果进行加密，得到所述密文操作结果。
  3. 根据权利要求2所述的方法，其特征在于，所述原始操作请求包括：目标操作数和至少一个目标操作符，其中，通过所述原子操作模块包含的目标操作算子对所述原始操作请求进行处理，得到所述原始操作结果包括：
    从所述原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子；
    将所述至少一个目标操作符对应的操作算子进行组合，得到所述目标操作算子；
    通过所述目标操作算子对所述目标操作数进行处理，得到所述原始操作结果。
  4. 根据权利要求3所述的方法，其特征在于，在所述目标操作符为多个的情况下，从所述原子操作模块包含的多个操作算子中获取每个目标操作符对应的操作算子包括：
    将所述多个操作算子保存为多个副本；
    从每个副本中获取所述每个目标操作符对应的所述操作算子。
  5. 根据权利要求2所述的方法，其特征在于，在通过所述原子操作模块包含的解密算子对所述密文操作请求进行解密，得到所述原始操作请求之前，所述方法还包括：
    检测发送所述密文操作请求的客户端是否认证成功；
    在检测到所述客户端认证成功的情况下，通过所述解密算子对所述密文操作请求进行解密，得到所述原始操作请求。
  6. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    在检测到所述片上存储的剩余存储空间小于预设值的情况下，对所述片上存储中存储的原始数据进行加密，得到密文数据；
    将所述密文数据存储至内存中。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    从所述内存中读取所述密文数据；
    对所述密文数据进行解密，得到所述原始数据；
    将所述原始数据存储至所述片上存储。
  8. 根据权利要求1至7中任意一项所述的方法，其特征在于，在将数据库引擎发送的密文操作请求传输至处理器的片上存储之前，所述方法还包括：
    通过请求转发模块从所述数据库引擎获取所述密文操作请求，其中，所述请求转发模块安装在所述数据库引擎中；
    通过所述请求转发模块将所述密文操作请求转发至所述原子操作模块。
  9. 根据权利要求8所述的方法，其特征在于，将所述密文操作结果从所述片上存储返回至所述数据库引擎包括：
    通过所述请求转发模块接收所述原子操作模块发送的所述密文操作结果；
    通过所述请求转发模块将所述密文操作结果转发至所述数据库引擎。
  10. 一种数据库的操作系统，其特征在于，包括：
    数据库引擎，用于发送密文操作请求，其中，所述密文操作请求用于表征对原始操作请求进行加密所得到的操作请求；
    处理器，与所述数据库引擎连接，包括：片上存储和可信区域，所述可信区域中运行有原子操作模块，所述处理器用于将所述密文操作请求传输至所述片上存储，在所述片上存储中通过所述原子操作模块对所述原始操作请求进行处理，得到原始操作结果，并将密文操作结果从所述片上存储返回至所述数据库引擎，其中，所述密文操作结果用于表征对所述原始操作结果进行加密所得到的操作结果；
    所述数据库引擎还用于基于所述密文操作结果对数据库中存储的数据进行操作。
  11. 根据权利要求10所述的系统，其特征在于，所述原子操作模块包括：
    解密算子，用于对所述密文操作请求进行解密，得到所述原始操作请求；
    目标操作算子，用于对所述原始操作请求进行处理，得到所述原始操作结果；
    加密算子，用于对所述原始操作结果进行加密，得到所述密文操作结果。
  12. 根据权利要求11所述的系统，其特征在于，所述系统还包括：
    客户端，用于发送密文操作请求；
    验证服务器，与所述客户端通信连接，用于对所述客户端进行认证；
    所述原子操作模块，与所述验证服务器通信连接，用于爱所述验证服务器对所述客户端认证成功的情况下，通过所述解密算子对所述密文操作请求进行解密，得到所述原始操作请求。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括存储的程序，其中，在所述程序运行时控制所述计算机可读存储介质所在设备执行权利要求1至9中任意一项所述的数据库的操作方法。
  14. 一种计算机终端，其特征在于，包括：存储器和处理器，所述处理器用于运行所述存储器中存储的程序，其中，所述程序运行时执行权利要求1至9中任意一项所述的数据库的操作方法。
PCT/CN2023/074411 2022-02-17 2023-02-03 数据库的操作方法、系统、存储介质以及计算机终端 WO2023155696A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210148186.XA CN114637743A (zh) 2022-02-17 2022-02-17 数据库的操作方法、系统、存储介质以及计算机终端
CN202210148186.X 2022-02-17

Publications (1)

Publication Number Publication Date
WO2023155696A1 true WO2023155696A1 (zh) 2023-08-24

Family

ID=81946158

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/074411 WO2023155696A1 (zh) 2022-02-17 2023-02-03 数据库的操作方法、系统、存储介质以及计算机终端

Country Status (2)

Country Link
CN (1) CN114637743A (zh)
WO (1) WO2023155696A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117574437A (zh) * 2024-01-15 2024-02-20 杭州阿里云飞天信息技术有限公司 全密态数据库系统、数据处理方法、安全控制装置及设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114637743A (zh) * 2022-02-17 2022-06-17 阿里巴巴（中国）有限公司 数据库的操作方法、系统、存储介质以及计算机终端
CN115374483B (zh) * 2022-10-24 2023-01-20 北京智芯微电子科技有限公司 数据安全存储方法及装置、电子设备、介质、芯片

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105046163A (zh) * 2014-05-02 2015-11-11 美国博通公司 保护嵌入式管理程序系统中的重要数据结构
US20170177862A1 (en) * 2015-12-21 2017-06-22 Alpa Narendra Trivedi Techniques to enable scalable cryptographically protected memory using on-chip memory
CN112699399A (zh) * 2021-03-22 2021-04-23 阿里云计算有限公司 加密数据库系统、实现加密数据库系统的方法以及装置
CN112948810A (zh) * 2021-05-12 2021-06-11 支付宝(杭州)信息技术有限公司 一种可信计算程序调用方法、装置、电子设备及存储介质
CN114637743A (zh) * 2022-02-17 2022-06-17 阿里巴巴（中国）有限公司 数据库的操作方法、系统、存储介质以及计算机终端

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105046163A (zh) * 2014-05-02 2015-11-11 美国博通公司 保护嵌入式管理程序系统中的重要数据结构
US20170177862A1 (en) * 2015-12-21 2017-06-22 Alpa Narendra Trivedi Techniques to enable scalable cryptographically protected memory using on-chip memory
CN112699399A (zh) * 2021-03-22 2021-04-23 阿里云计算有限公司 加密数据库系统、实现加密数据库系统的方法以及装置
CN112948810A (zh) * 2021-05-12 2021-06-11 支付宝(杭州)信息技术有限公司 一种可信计算程序调用方法、装置、电子设备及存储介质
CN114637743A (zh) * 2022-02-17 2022-06-17 阿里巴巴（中国）有限公司 数据库的操作方法、系统、存储介质以及计算机终端

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117574437A (zh) * 2024-01-15 2024-02-20 杭州阿里云飞天信息技术有限公司 全密态数据库系统、数据处理方法、安全控制装置及设备

Also Published As

Publication number Publication date
CN114637743A (zh) 2022-06-17

Similar Documents

Publication Publication Date Title
US10462114B2 (en) System and associated software for providing advanced data protections in a defense-in-depth system by integrating multi-factor authentication with cryptographic offloading
WO2023155696A1 (zh) 数据库的操作方法、系统、存储介质以及计算机终端
CN100487715C (zh) 一种数据安全存储系统和装置及方法
CN107506659B (zh) 一种基于sgx的通用数据库的数据保护系统及方法
RU2584570C2 (ru) Реализация защищенного обмена информацией в исполняющей системе
US9054865B2 (en) Cryptographic system and methodology for securing software cryptography
WO2020042822A1 (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
CN101102180B (zh) 基于硬件安全单元的系统间绑定及平台完整性验证方法
US20200026882A1 (en) Methods and systems for activating measurement based on a trusted card
EP3780484A1 (en) Cryptographic operation and working key creation method and cryptographic service platform and device
WO2017166362A1 (zh) 一种esim号码的写入方法、安全系统、esim号码服务器及终端
WO2021129003A1 (zh) 一种密码管理方法及相关装置
WO2015117523A1 (zh) 访问控制方法及装置
US11735319B2 (en) Method and system for processing medical data
CN114221762A (zh) 一种私钥存储方法、读取方法、管理装置、设备及介质
CN112242899B (zh) 使用量子密钥对存储文件进行加解密的nas存储系统及方法
US20240184909A1 (en) Data security processing method and apparatus
US11997192B2 (en) Technologies for establishing device locality
US20240028759A1 (en) Database access method and apparatus
US20230362018A1 (en) System and Method for Secure Internet Communications
Fan et al. One secure access scheme based on trusted execution environment
CN110740036A (zh) 基于云计算的防攻击数据保密方法
CN110858246B (zh) 安全代码空间的认证方法和系统、及其注册方法
WO2022199796A1 (en) Method and computer-based system for key management
Katre et al. Trusted third party for data security in cloud environment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23755699

Country of ref document: EP

Kind code of ref document: A1