CN106446196A - Self-controllable database data encryption retrieval method and system based on random salt - Google Patents

Abstract

The invention provides an autonomous controllable database data encryption and retrieval method and system based on random salt. The system comprises a database internal processing subsystem and a data encryption subsystem. The database internal processing subsystem comprises an external interface calling module for calling the database encryption subsystem to encrypt/decrypt data, a database view decryption calling module for encrypting a plaintext database, a database trigger encryption calling module for encrypting the data when the data in the database calls a trigger, and an extension index interface encryption indexing module for generating indexes for the encrypted data. The data encryption subsystem comprises a strategy management module, a data encryption module and a data decryption module.

Description

Self-controllable database data encryption retrieval method and system based on random salt

technical field

The invention belongs to the technical field of information security, in particular to a random salt-based self-controllable database data encryption retrieval method and system.

Background technique

With the widespread use of information technology, more and more important data are stored and processed electronically. Although this data storage and processing method can improve convenience, it is easy to lead to data theft and tamper. In the prior art, the most common way to steal and tamper with data is to attack the database, so how to ensure the security of the database and the working efficiency of the database at the same time is a main research direction at present. This is because: the most effective way to solve the problem of database security performance is to encrypt the data stored in the database; but once all data is encrypted, it is difficult to perform effective retrieval, resulting in a sharp decline in the work efficiency of the database.

Contents of the invention

Aiming at the problem in the prior art that it is difficult for the database to ensure data security and usability at the same time, the technical problem to be solved by the present invention is to provide a more effective and efficient self-controllable database data encryption retrieval based on random salt Methods and systems to solve data leakage problems, encrypted data retrieval problems, and database performance problems of databases.

In order to solve the above problems, the embodiment of the present invention proposes an autonomous and controllable database data encryption retrieval system based on random salt, including: database internal processing subsystem and data encryption subsystem;

Wherein the internal processing subsystem of the database includes: an external interface calling module for calling the data encryption subsystem to encrypt/decrypt data, a database view decryption calling module for encrypting plaintext database tables, A database trigger encryption call module for encrypting the data when the data in the database calls the trigger, and an extended index interface encryption index module for generating an index on the encrypted data; wherein,

The database view decryption calling module is used to copy the plaintext database table to a preset location, rename the plaintext database table and establish a view with the same name as the plaintext database table, and send the plaintext fields that need to be encrypted in the plaintext database table to the The data encryption subsystem, and replace the plaintext field with the mask field corresponding to the plaintext field determined by the data encryption subsystem, and replace the data in the plaintext field with encrypted data;

The extended index interface encryption index module is used to judge whether the field to be queried is an encrypted field. If it is not an encrypted field, use the bitmap scan extended search interface of the database to execute the view query, and then send the view to the data encryption subsystem for decryption processing; If it is an encrypted field, then determine the masked field in the plaintext database according to the corresponding relationship between the plaintext field and the masked field stored in the data encryption subsystem, and decrypt the data in the column of the plaintext field in the plaintext database;

Wherein said data encryption subsystem includes:

A policy management module, configured to provide a login interface for users to input an encryption policy, wherein the encryption policy includes at least one of the following: plaintext fields that need to be encrypted, whether to save plaintext database tables;

The data encryption module is used to replace the plaintext fields in the database that need to be encrypted with shielded fields according to the received instructions of the internal processing subsystem of the database, and store the corresponding relationship between the plaintext fields and the shielded fields; The MD5 plus random salt algorithm encrypts the data in the column of the plaintext field;

The data decryption module is used for decrypting the encrypted data in the database according to the received instruction of the internal processing subsystem of the database.

Wherein, the data encryption subsystem also includes:

The authority management module is used to authenticate the login account password and manage the encryption/decryption authority; wherein the authority management module uses the RSA asymmetric encryption algorithm or an external digital certificate interface authentication method to authenticate the login account password.

Wherein, the database internal processing subsystem also includes a database trigger encryption call module for encrypting data when the plaintext database table is changed, and the database trigger encryption call module is used to determine whether the database has called a trigger , if yes, call the data encryption subsystem to encrypt the data.

At the same time, the embodiment of the present invention also proposes an autonomous and controllable database data encryption retrieval method based on random salt, including:

The plaintext database table processing step is used to copy the plaintext database table to a preset location, rename the plaintext database table and establish a view with the same name as the plaintext database table, and send the plaintext fields that need to be encrypted in the plaintext database table to all The data encryption subsystem, and replace the plaintext field with the mask field corresponding to the plaintext field determined by the data encryption subsystem, and replace the data in the plaintext field with encrypted data;

The retrieval step is used to determine whether the field to be queried is an encrypted field. If it is not an encrypted field, use the bitmap scan extended retrieval interface of the database to execute the view query, and then send the view to the data encryption subsystem for decryption processing; if it is an encrypted field , then determine the masked field in the plaintext database according to the corresponding relationship between the plaintext field and the masked field stored in the data encryption subsystem, and decrypt the data in the masked field column in the plaintext database;

The trigger encryption call step, the main function of this function module is to judge whether to call the trigger, when the trigger is called, the trigger calls the encryption module of the encryption and decryption software to encrypt the data.

The policy management step is used to provide a login interface for users to input an encryption policy, wherein the encryption policy includes at least one of the following: plaintext fields that need to be encrypted, whether to save plaintext database tables;

The data encryption step is used to replace the plaintext fields in the database that need to be encrypted with shielded fields according to the received instructions of the internal processing subsystem of the database, and store the corresponding relationship between the plaintext fields and the shielded fields; The MD5 plus random salt algorithm encrypts the data in the column of the plaintext field;

The data decryption step is used to decrypt the encrypted data in the database according to the received instruction of the internal processing subsystem of the database.

Wherein said method also comprises:

The login authentication management module is used to authenticate the login account password and manage the encryption/decryption authority; wherein the authority management module uses the RSA asymmetric encryption algorithm or an external digital certificate interface authentication method to authenticate the login account password.

The beneficial effects of the above-mentioned technical solution of the present invention are as follows: the embodiment of the present invention proposes an autonomously controllable database data encryption retrieval method and system based on random salt, which can shield the preset fields of the plaintext database table, and The data in the default field column is encrypted. At the same time, the corresponding plaintext field can be quickly obtained according to the shielded field during retrieval, and the data in the plaintext string can be decrypted. The above scheme can take both security and retrieval effect into consideration.

Description of drawings

Fig. 1 is a system structure topology diagram of an embodiment of the present invention.

detailed description

In order to make the technical problems, technical solutions and advantages to be solved by the present invention clearer, the following will describe in detail with reference to the drawings and specific embodiments.

The embodiment of the present invention proposes an autonomous and controllable database data encryption retrieval system based on random salt, including: a database internal processing subsystem and a data encryption subsystem;

Wherein the internal processing subsystem of the database includes: an external interface calling module for calling the data encryption subsystem to encrypt/decrypt data, a database view decryption calling module for encrypting plaintext database tables, A database trigger encryption call module for encrypting the data when the data in the database calls the trigger, and an extended index interface encryption index module for generating an index on the encrypted data; wherein,

The database view decryption calling module is used to copy the plaintext database table to a preset location, rename the plaintext database table and establish a view with the same name as the plaintext database table, and send the plaintext fields that need to be encrypted in the plaintext database table to the The data encryption subsystem, and replace the plaintext field with the mask field corresponding to the plaintext field determined by the data encryption subsystem, and replace the data in the plaintext field with encrypted data;

The extended index interface encryption index module is used to judge whether the field to be queried is an encrypted field. If it is not an encrypted field, use the bitmap scan extended search interface of the database to execute the view query, and then send the view to the data encryption subsystem for decryption processing; If it is an encrypted field, then determine the masked field in the plaintext database according to the corresponding relationship between the plaintext field and the masked field stored in the data encryption subsystem, and decrypt the data in the column of the plaintext field in the plaintext database;

Wherein said data encryption subsystem includes:

A policy management module, configured to provide a login interface for users to input an encryption policy, wherein the encryption policy includes at least one of the following: plaintext fields that need to be encrypted, whether to save plaintext database tables;

The data encryption module is used to replace the plaintext fields in the database that need to be encrypted with shielded fields according to the received instructions of the internal processing subsystem of the database, and store the corresponding relationship between the plaintext fields and the shielded fields; The MD5 plus random salt algorithm encrypts the data in the column of the plaintext field;

The data decryption module is used for decrypting the encrypted data in the database according to the received instruction of the internal processing subsystem of the database.

Wherein, the data encryption subsystem also includes:

The authority management module is used to authenticate the login account password and manage the encryption/decryption authority; wherein the authority management module uses the RSA asymmetric encryption algorithm or an external digital certificate interface authentication method to authenticate the login account password.

Wherein, the database internal processing subsystem also includes a database trigger encryption call module for encrypting data when the plaintext database table is changed, and the database trigger encryption call module is used to determine whether the database has called a trigger , if yes, call the data encryption subsystem to encrypt the data.

At the same time, the embodiment of the present invention also proposes an autonomous and controllable database data encryption retrieval method based on random salt, including:

The plaintext database table processing step is used to copy the plaintext database table to a preset location, rename the plaintext database table and establish a view with the same name as the plaintext database table, and send the plaintext fields that need to be encrypted in the plaintext database table to all The data encryption subsystem, and replace the plaintext field with the mask field corresponding to the plaintext field determined by the data encryption subsystem, and replace the data in the plaintext field with encrypted data;

The retrieval step is used to determine whether the field to be queried is an encrypted field. If it is not an encrypted field, use the bitmap scan extended retrieval interface of the database to execute the view query, and then send the view to the data encryption subsystem for decryption processing; if it is an encrypted field , then determine the masked field in the plaintext database according to the corresponding relationship between the plaintext field and the masked field stored in the data encryption subsystem, and decrypt the data in the masked field column in the plaintext database;

The trigger encryption call step, the main function of this function module is to judge whether to call the trigger, when the trigger is called, the trigger calls the encryption module of the encryption and decryption software to encrypt the data.

The policy management step is used to provide a login interface for users to input an encryption policy, wherein the encryption policy includes at least one of the following: plaintext fields that need to be encrypted, whether to save plaintext database tables;

The data encryption step is used to replace the plaintext fields in the database that need to be encrypted with shielded fields according to the received instructions of the internal processing subsystem of the database, and store the corresponding relationship between the plaintext fields and the shielded fields; The MD5 plus random salt algorithm encrypts the data in the column of the plaintext field;

The data decryption step is used to decrypt the encrypted data in the database according to the received instruction of the internal processing subsystem of the database.

Wherein said method also comprises:

The login authentication management module is used to authenticate the login account password and manage the encryption/decryption authority; wherein the authority management module uses the RSA asymmetric encryption algorithm or an external digital certificate interface authentication method to authenticate the login account password.

As shown in Figure 1, a specific example will be used to illustrate the following. In this example, the existing analytical database management software for enterprise-level applications is used. The software uses the advanced open source database PostgreSQL as the core for secondary development. It integrates easy-to-learn, easy-to-use, and easy-to-use management interfaces and auxiliary tools to meet the stability, security, and simplicity required by the power industry for database software products. While ensuring the security, high availability and scalability of the management software, the development team tries to reduce the overall cost of the software and enhance the ease of use of the software. According to the processing flow and function division, the database management software divides the management system into five parts: connection management system, compilation and execution system, storage management system, transaction management system, and system table. Of course, this is just an example, and those skilled in the art can understand that the method of the embodiment of the present invention can be used in any database management software.

In this example, by modifying the kernel of the database management system (DBMS) to call the encryption and decryption software external to the database management software to realize functions such as encryption, decryption and retrieval of the database. The invention has a strong encryption function, does not affect the normal use of the database management system (DBMS), and realizes the perfect and seamless combination of the encryption and decryption technology and the database management system.

Database management software part: it modifies the kernel of the database to support the call of the database encryption and decryption software on the basis of the existing database management system.

Database view decryption call module:

The view of the database management system (DBMS) is a virtual table. For the operation of the database, the system needs to define the base table associated with the operation and the view according to the view definition. Make full use of the principle of the database view to realize the filtering, projection, aggregation, association and function operation of the encrypted data in the table.

The main function of this module is to copy the plaintext data table to the specified path when it is judged that the encrypted data of the user needs to be backed up in plaintext, rename the table, create a view with the same name as the table, and call the encrypted call module of the trigger to perform data backup. Encryption processing. When it is judged that the plaintext data of the user does not need plaintext backup, directly rename the table, create a view with the same name as the table, and call the decryption module of the external encryption and decryption software in the view to decrypt the data. Encryption of a field in a database table can be achieved.

Database trigger encryption call module:

The main function of this functional module is to judge whether to call the trigger. When the trigger is called, the trigger calls the encryption module of the encryption and decryption software to encrypt the data. A database trigger is a function that is called automatically when a database operation occurs. For row-level triggers such as "BEFORE" and "INSTEAD OF", when the returned result is NULL, it means that the operation on the current row is ignored. If the row returns non-NULL, for INSERT and UPDATE operations, The trigger invokes the encryption module of the encryption and decryption software to encrypt the data.

Extended Index Interface Encrypted Index Module

The database management system (DBMS) extended index interface encryption index module performs indexing on encrypted data. There are five types of indexes in the database management system (DBMS). The most commonly used index is B-tree. Index Scan traverses all the rows of the entire data table from beginning to end, so the efficiency is not very high when the amount of data is large. ;bitmap scan takes out all the index items that meet the conditions at one time, sorts them in memory, and then accesses the table data according to the index items taken out. This patent uses a bitmap scan machine for encrypted retrieval. Write the corresponding processing code for the execution of the index in the Create Index, Insert, Delete, Update statements, and bitmap scan execution. Through this mechanism, you can use a custom extended encryption index. When the index retrieves encrypted data, because the bitmap scan takes out all the index items that meet the conditions at one time and sorts them in memory, it solves the problem of data retrieval after encryption. problem, greatly improving the efficiency of ciphertext retrieval.

The external interface calling module mainly provides interfaces for connecting encryption and decryption algorithms and encryption and decryption software, and realizes calls to encryption and decryption software, authority control independent of the database, and interfaces for other software of encryption algorithms. The technical key to realize this purpose is external program calling and external communication support. To support external program calls in the database, the communication interface must first be defined. Through the interface, the database encryption function and decryption function are made into external calls, and an independent database encryption and decryption software is written to run on an independent server; the authority verification process limits the authority of the super user, so as to improve the performance of the database management software Effect.

Database encryption and decryption part:

Account authority management module

The main functions of the account and authority management module are used for user login account password management and encryption and decryption authority management. Identity authentication adopts RSA asymmetric encryption algorithm or external digital certificate interface authentication method.

Policy setting module

This function module is user-defined interface setting, user-defined setting encrypted database object: setting user-defined encrypted column. Whether the user saves plaintext and other policy configurations.

Database encryption module

This function module uses MD5 plus random salt to encrypt the data in the database. When users INSERT and UPDATE data, the corresponding column names are renamed and calculated, for example, the ID card with the same name is calculated and processed as a big pagoda tree, etc. The data in the corresponding column is encrypted by calculating the function of the column and adding random salt, and then encrypting the data by means of MD5 calculation. For example: MD5(f(X)+random salt)

Due to the massive amount of data in the database, using other encryption algorithms requires too much calculation. Therefore, MD5 plus random salt is used to improve security performance.

Database decryption module

When the view makes a decryption request, it calls the database encryption and decryption software to decrypt. Perform MD5 decryption function to decrypt data; take modulo and desalt; anti-encryption column function calculation.

The method of the present invention may comprise:

1. Identity authentication login

The database encryption and decryption software has passed RSA identity authentication or UKRY authentication, otherwise the login is refused;

To determine the encrypted object, the user selects the corresponding encrypted database, table, column, and whether to save the policy option of plain text. Set encryption policy for new users;

2. Encryption judgment

Determine whether the user needs to encrypt data: When the user does not need to encrypt data, send a corresponding request to the database management system (DBMS), perform database operations, and exit the process. When the user needs to encrypt data, send a request to the plaintext backup judgment for processing;

3. Plaintext backup judgment

After the encryption request is judged, the database encryption and decryption software judges for the first time whether the plaintext needs to be backed up; if the user needs the plaintext, send a request to the trigger, copy the plaintext view with the same name to the specified path, and redo the view of the table that needs to be encrypted. Naming, mask the field names that need to be encrypted: for example: the field ID card becomes the field apple tree.

When the user requests insert and update, judge the plaintext backup request; if the user has a plaintext backup request, call the database trigger to send the insert and update command data into the plaintext table, and send the encryption request to the encryption module for encryption processing; if not Plain text backup strategy, send encryption request to encryption module for encryption processing encryption module;

4. Encryption processing

After the encryption judgment and the plaintext backup judgment, the encryption module performs the following processing: the encrypted field is matched, the encrypted field is stored in the plaintext in the database encryption and decryption software, and after the encrypted field is matched, the field name that needs to be encrypted is masked; Generate random salt and encrypted field ID random salt association database in encryption and decryption software. Perform function processing on the plain text of the value of the relevant field and then add random salt to generate new data; then the combined data is processed by MD5, and the encrypted data value is executed by the trigger of the database to the encrypted view, which is carried out by the mechanism of the database Related Storage Operations

5. Encrypted data trigger processing

The encrypted data with masked field names and encrypted data is sent by the database encryption and decryption software to the database encryption and decryption interface, and the encryption and decryption interface sends the request to the database trigger, and the trigger performs related operations according to the data mechanism. The entire encryption process is completed;

6. Decrypted data view processing

When the user makes a query select request in the database encryption and decryption software, including filtering, projection, aggregation, association and function operation, etc., the process is as follows:

When the user makes a query request in the encryption and decryption software, first determine whether the query field is an encrypted field. If it is not an encrypted field, directly send the request to the database bitmap scan extended search interface. After the bitmap scan extended search executes the view query according to the database mechanism, the database The view sends a decryption request to the database encryption and decryption interface to call the decryption program of the database encryption and decryption software; the decryption program first encodes MD5 to decrypt, then takes the modulus and removes the salt, and performs reverse encryption column function calculation to return data. If the field is encrypted, after processing the field with a masking function, query the random salt and encrypted field ID random salt associated database in the encryption and decryption software, add the random salt to the value processed by the masking function, and then send it to the database after MD5 encryption Bitmap scan extended retrieval interface, bitmap scan extended retrieval performs view query according to the database mechanism, and the view sends a decryption request to the database encryption and decryption interface to call the decryption program of the database encryption and decryption software; the decryption program first Encode MD5 decryption, then take the model and remove the salt, Perform reverse encryption column function calculation to return data.

The above description is a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (5)

1. An autonomous and controllable database data encryption retrieval system based on random salt, characterized in that, comprising: a database internal processing subsystem and a data encryption subsystem; Wherein the internal processing subsystem of the database includes: an external interface calling module for calling the data encryption subsystem to encrypt/decrypt data, a database view decryption calling module for encrypting plaintext database tables, A database trigger encryption call module for encrypting the data when the data in the database calls the trigger, and an extended index interface encryption index module for generating an index on the encrypted data; wherein, The database view decryption calling module is used to copy the plaintext database table to a preset location, rename the plaintext database table and establish a view with the same name as the plaintext database table, and send the plaintext fields that need to be encrypted in the plaintext database table to the The data encryption subsystem, and replace the plaintext field with the mask field corresponding to the plaintext field determined by the data encryption subsystem, and replace the data in the plaintext field with encrypted data; The extended index interface encryption index module is used to judge whether the field to be queried is an encrypted field. If it is not an encrypted field, use the bitmap scan extended search interface of the database to execute the view query, and then send the view to the data encryption subsystem for decryption processing; If it is an encrypted field, then determine the masked field in the plaintext database according to the corresponding relationship between the plaintext field and the masked field stored in the data encryption subsystem, and decrypt the name in the column of the plaintext field in the plaintext database; Wherein said data encryption subsystem includes: The policy management module is used to provide a login interface to enable users to formulate encryption policies, wherein the encryption policies include at least one of the following: setting fields that need to be encrypted, setting whether to save plaintext data; The data encryption module is used to replace the plaintext fields in the database that need to be encrypted with shielded fields according to the received instructions of the internal processing subsystem of the database, and store the corresponding relationship between the plaintext fields and the shielded fields; The MD5 plus random salt algorithm encrypts the data in the column of the plaintext field; The data decryption module is used for decrypting the encrypted data in the database according to the received instruction of the internal processing subsystem of the database. 2. The autonomous controllable database data encryption retrieval system based on random salt according to claim 1, wherein the data encryption subsystem also includes: The authority management module is used to authenticate the login account password and manage the encryption/decryption authority; wherein the authority management module uses the RSA asymmetric encryption algorithm or an external digital certificate interface authentication method to authenticate the login account password. 3. The self-controllable database data encryption retrieval system based on random salt according to claim 1, characterized in that, the internal processing subsystem of the database also includes a device for encrypting data when the plaintext database table is changed. The database trigger encryption calling module is used to judge whether the database has called the trigger, and if so, call the data encryption subsystem to encrypt the data. 4. An autonomous and controllable database data encryption retrieval method based on random salt, characterized in that it comprises: The plaintext database table processing step is used to copy the plaintext database table to a preset location, rename the plaintext database table and establish a view with the same name as the plaintext database table, and send the plaintext fields that need to be encrypted in the plaintext database table to all The data encryption subsystem, and replace the plaintext field with the mask field corresponding to the plaintext field determined by the data encryption subsystem, and replace the data in the plaintext field with encrypted data; The retrieval step is used to determine whether the field to be queried is an encrypted field. If it is not an encrypted field, use the bitmap scan extended retrieval interface of the database to execute the view query, and then send the view to the data encryption subsystem for decryption processing; if it is an encrypted field , then determine the masked field in the plaintext database according to the corresponding relationship between the plaintext field and the masked field stored in the data encryption subsystem, and decrypt the data in the masked field column in the plaintext database; The search and judgment step is used for searching and judging the ciphertext database table; specifically includes: judging whether the database has invoked a trigger, and if so, encrypting the data. The policy management step is used to provide a login interface for users to input an encryption policy, wherein the encryption policy includes at least one of the following: plaintext fields that need to be encrypted, whether to save plaintext database tables; The data encryption step is used to replace the plaintext fields in the database that need to be encrypted with shielded fields according to the received instructions of the internal processing subsystem of the database, and store the corresponding relationship between the plaintext fields and the shielded fields; The MD5 plus random salt algorithm encrypts the data in the column of the plaintext field; The data decryption step is used to decrypt the encrypted data in the database according to the received instruction of the internal processing subsystem of the database. 5. the random salt-based autonomous controllable database data encryption retrieval method according to claim 4, is characterized in that, also comprises: The login authentication management module is used to authenticate the login account password and manage the encryption/decryption authority; wherein the authority management module uses the RSA asymmetric encryption algorithm or an external digital certificate interface authentication method to authenticate the login account password.