CN114564735A - Database encryption and complete matching retrieval system - Google Patents

Abstract

The invention discloses a database encryption and complete matching retrieval system, and relates to the technical field of data encryption and matching retrieval. The invention comprises a data encryption and storage module and an encrypted data query module; the data encryption and storage module comprises an encryption algorithm initialization unit, a data encryption execution unit, a ciphertext data visualization unit and an encrypted data storage unit; the encrypted data query module comprises a query receiving unit, a query analyzing unit, a data encryption and decryption unit, an encrypted data visualization unit and a query result returning unit. The method can ensure high security of data storage and rapid matching of the ciphertext data by continuously using the database index when completely matching and querying, improves the retrieval efficiency of the ciphertext data under the business scene mainly comprising completely matching and querying, and particularly can greatly improve the user experience under the condition of mass data.

Description

A database encryption and exact matching retrieval system

technical field

The invention belongs to the technical field of data encryption and matching retrieval, in particular to a database encryption and complete matching retrieval system and method.

Background technique

There are three most commonly used methods for personal information protection: encrypting and storing personal information in the database; implementing data leakage prevention through database firewalls; and concealing personal information through data desensitization. The first method can ensure that the data before encryption cannot be parsed even if the database data is stolen, and is widely used.

All major data security vendors on the market have launched database encryption products. These products not only ensure data storage security, but also change some attributes of data in the database (comparability, orderliness, similarity). It is difficult for the database to meet the complex and diverse business needs of the application system.

In order to solve this problem, everyone has focused on how to make the ciphertext data maintain the same or similar properties as the plaintext data, so that the encrypted ciphertext can also perform complex database operations or perform the same as the plaintext. Fuzzy match. However, the development of technology at home and abroad is slow, and database encryption products using these technologies often cannot meet the needs of business systems due to performance or result matching problems in actual use.

As the country continues to strengthen data protection, business systems must use these protected data more cautiously, and must avoid information leakage due to business needs. In recent years, with the rapid development of cloud services, there are more and more cloud-based convenience services. Behind these services are database encryption and fast retrieval technologies. How to provide fully matched retrieval capabilities after database encryption is an urgent issue for encrypted products. technical issues to be resolved.

The easiest way to solve this problem is to decrypt the encrypted field data first, and then retrieve the decrypted data. This method requires decrypting all encrypted fields of the table, which is expensive and cannot be practically applied in products.

A kind of data encryption and retrieval method for database has been disclosed in the existing patent, which comprises the following steps: a) firstly utilize a one-way encryption algorithm to encrypt the original data, and under the condition that the order of the original data is kept unchanged, generate an Decrypted indexable header; b) then continue to encrypt the original data to generate decryptable ciphertext data; c) combine the indexable header and the decryptable ciphertext data to generate encrypted combined data and store it in the database; The one-way encryption algorithm in the step a) is MD5, SHA or HMAC; the encryption algorithm in the step b) is a symmetric key encryption algorithm.

The existing technologies listed above all have the following shortcomings in practical product applications:

Although the method of first decrypting and then searching is simple, it is only suitable for scenarios with very small amount of data, and cannot be applied in the business environment of massive data; in the above-mentioned published patent, a single encryption algorithm is used to encrypt the original text to generate an index, and this part of the index is used as the index of the encrypted data. The initial part is stored in the database. This approach has the following risks: the one-way encryption algorithm MD5 and SHA have a greater risk of cracking. Once the data content is leaked, it is easy to be cracked, and the security of the data cannot be guaranteed; the one-way encryption algorithm Both MD5 and SHA have the possibility of conflict, which may reduce the retrieval performance.

SUMMARY OF THE INVENTION

The present invention completes the encryption of the database data and the complete matching retrieval method of the encrypted data by combining the existing symmetric encryption algorithm and the own visualization algorithm, and mainly solves the problem of fast and complete matching of the encrypted data after the database data is encrypted. It is mostly used in scenarios where accurate query business is the mainstay.

For reaching the above-mentioned purpose, the present invention is achieved through the following technical solutions:

A database encryption and exact matching retrieval system, the system includes:

Data encryption and storage module, encrypted data query module;

The specific processing flow of the data encryption and storage module is as follows:

S101: Initialize the encryption algorithm, and load a commonly used symmetric key encryption algorithm;

S102, determine whether there is a field that needs to be encrypted in the database, if so, execute S103, otherwise, execute S107;

S103, performing an encryption operation on the field that needs to be encrypted;

S104, performing position transformation on the binary ciphertext data;

S105, write an obfuscated value in the transformed binary ciphertext;

S106. Perform Base64 encoding on the new binary value;

S107, storing the processed data into the database;

Wherein, steps S104, S105, and S106 are the processing flow of its own visualization algorithm;

In step S101, commonly used symmetric key encryption algorithms include AES advanced encryption standard and SM4 national secret algorithm;

In step S103, this step uses the ciphertext data visualization unit's own algorithm to visualize the ciphertext data;

The specific processing flow of the encrypted data query module is as follows:

S201, initialize the encryption algorithm;

S202, initialize the query request receiving engine, and wait for receiving the query request;

S203, whether a query request is received, if so, go to step 204, otherwise go to step 203;

S204, determine whether there is an encrypted field in the condition of the query request, if so, go to step 205, otherwise go to step 209;

S205, encrypting the query condition field;

S206, performing position transformation on the binary ciphertext data;

S207, write an obfuscated value in the transformed binary ciphertext;

S208. Perform Base64 encoding on the new binary value to obtain the query condition value;

S209, query data from the database according to the query condition;

S210, determine whether there is an encrypted field in the query result, if so, go to step 211, otherwise go to step 215;

S211. Perform a Base64 decoding operation on the field value that needs to be decrypted in the query result;

S212, remove the obfuscated value from the decoded value;

S213, restore the binary position of the ciphertext to obtain the ciphertext result;

S214. Decrypt the ciphertext result to obtain a plaintext result;

S215, return the result data of the query request and return to step 203;

Among them, S206, S207, and S208 are the own visualization algorithm processing flow, and S211, S212, and S213 are the corresponding reverse processing flow.

Optionally, the data encryption and storage module includes an encryption algorithm initialization unit, a data encryption execution unit, a ciphertext data visualization unit, and an encrypted data storage unit;

The encrypted data query module includes a query receiving unit, a query parsing unit, a data encryption and decryption unit, an encrypted data visualization unit, and a query result return unit;

The data encryption and storage module is used to encrypt the fields that need to be protected in the database;

The encrypted data query module is used to quickly and completely match the data that satisfies the query condition.

Optionally, the ciphertext data visualization unit is used for visualizing the ciphertext data using its own algorithm before storage, and the processed fields can continue to use the database index to improve the retrieval efficiency, which improves the efficiency of the retrieval process when the exact match query is used. The retrieval efficiency of ciphertext data in the main business scenario, especially in the case of massive data, can greatly improve the user experience of the application.

Optionally, the data encryption execution unit is configured to execute a symmetric key encryption algorithm.

Optionally, the encrypted data storage unit is configured to store data encrypted by a symmetric key encryption algorithm.

Optionally, the data encryption and decryption unit is used to encrypt or decrypt the received data through an encryption algorithm, and the encryption algorithm of the data encryption and decryption unit is any of the AES advanced encryption standard and the SM4 national encryption algorithm. A sort of.

Embodiments of the present invention have the following beneficial effects:

In one embodiment of the present invention, by combining the existing symmetric encryption algorithm with its own visualization algorithm, it can not only ensure the high security of data storage, but also ensure that the ciphertext data can continue to use the database index for fast data storage when the query is completely matched. Matching improves the retrieval efficiency of ciphertext data in business scenarios based on complete matching queries, especially in the case of massive data, which can greatly improve the user experience of the application.

Of course, it is not necessary for any product embodying the present invention to achieve all of the advantages described above simultaneously.

Description of drawings

The accompanying drawings forming a part of the present application are used to provide further understanding of the present invention, and the exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the attached image:

1 is a schematic diagram of a system flow of a data encryption and storage module according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of a system flow of an encrypted data query module according to an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.

In order to keep the following description of the embodiments of the present invention clear and concise, the present invention omits detailed descriptions of well-known functions and well-known components.

Referring to Figures 1-2, in this embodiment, a database encryption and complete matching retrieval system is provided, including: a data encryption and storage module, and an encrypted data query module;

The specific processing flow of the data encryption and storage module is as follows:

S101: Initialize the encryption algorithm, and load a commonly used symmetric key encryption algorithm;

S102, determine whether there is a field that needs to be encrypted in the database, if so, execute S103, otherwise, execute S105;

S103, performing an encryption operation on the field that needs to be encrypted;

S104, performing visual processing on the ciphertext data;

S105, storing the processed data into a database;

In step S101, commonly used symmetric key encryption algorithms include AES advanced encryption standard and SM4 national secret algorithm;

In step S103, this step uses the ciphertext data visualization unit's own algorithm to visualize the ciphertext data;

The specific processing flow of the encrypted data query module is as follows:

S201, initialize the encryption algorithm;

S202, initialize the query request receiving engine, and wait for receiving the query request;

S203, whether a query request is received, if so, execute S204, otherwise, execute S203;

S204, determine whether there is an encrypted field in the condition of the query request, if so, execute S205, otherwise, execute S207;

S205, encrypting the query condition field;

S206, using its own algorithm to visualize the ciphertext data;

S207, query data from the database according to the query condition;

S208, determine whether there is an encrypted field in the query result, if so, execute S209; otherwise, execute S210;

S209, decrypt the ciphertext field in the query result to obtain plaintext data;

S210. Return the result data of the query request and return to S203.

As shown in Figure 1, the data encryption and storage module includes an encryption algorithm initialization unit, a data encryption execution unit, a ciphertext data visualization unit, and an encrypted data storage unit;

The encrypted data query module includes a query receiving unit, a query parsing unit, a data encryption and decryption unit, an encrypted data visualization unit, and a query result return unit;

The data encryption and storage module is used to encrypt the fields that need to be protected in the database;

The encrypted data query module is used to quickly and completely match the data that satisfies the query condition.

All major data security vendors on the market have launched database encryption products. These products not only ensure data storage security, but also change some attributes of data in the database (comparability, orderliness, similarity). It is difficult for the database to meet the complex and diverse business needs of the application system.

In order to solve this problem, everyone has focused on how to make the ciphertext data maintain the same or similar properties as the plaintext data, so that the encrypted ciphertext can also perform complex database operations or perform the same as the plaintext. Fuzzy match. However, the technology development at home and abroad is slow at present, and database encryption products using these technologies are often unable to meet the needs of business systems due to performance or result matching problems in actual use;

By combining the existing symmetric encryption algorithm with its own visualization algorithm, this scheme can not only ensure high security of data storage, but also ensure that the ciphertext data can continue to use the database index for fast matching when the query is completely matched. It improves the retrieval efficiency of ciphertext data in the business scenario based on complete matching query, especially in the case of massive data, which can greatly improve the user experience of the application.

As shown in FIG. 1 , the ciphertext data visualization unit is used to visualize the ciphertext data using its own algorithm before storage, and the processed fields can continue to use the database index to improve retrieval efficiency.

As shown in FIG. 2 , the data encryption execution unit is configured to execute a symmetric key encryption algorithm, and the encrypted data storage unit is configured to store data encrypted by the symmetric key encryption algorithm.

As shown in Figure 1-2, the data encryption and decryption unit is used to encrypt or decrypt the received data through an encryption algorithm, and the encryption algorithm of the data encryption and decryption unit is AES Advanced Encryption Standard, SM4 National Code any of the algorithms.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention in any form. Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Without departing from the scope of the technical solution of the present invention, when the technical content indicated above can be used to make some changes or modifications to equivalent examples of equivalent changes, the implementations in the above-mentioned examples can also be further combined or replaced, but any Without departing from the content of the technical solution of the present invention, any simple modifications, equivalent changes and modifications made to the above embodiments according to the technical essence of the present invention still fall within the scope of the solution of the present invention.

Claims (7)

1. A database encryption and perfect match retrieval system, the system comprising:

the system comprises a data encryption and storage module, an encrypted data query module and a database module;

the data encryption and storage module comprises an encryption algorithm initialization unit, a data encryption execution unit, a ciphertext data visualization unit and an encrypted data storage unit;

the encrypted data query module comprises a query receiving unit, a query analyzing unit, a data encryption and decryption unit, an encrypted data visualization unit and a query result returning unit;

the data encryption and storage module is used for encrypting fields needing to be protected in the database module;

the encrypted data query module is used for quickly and completely matching data meeting query conditions;

the database module is used for receiving and storing data.

2. The database encryption and perfect-match retrieval system of claim 1, wherein the ciphertext data visualization unit is configured to perform visualization processing on the ciphertext data before being put in storage by using an own algorithm.

3. The system for database encryption and perfect match retrieval as claimed in claim 1, wherein the specific process flow of the data encryption and storage module is as follows:

s101, initializing an encryption algorithm, and loading a common symmetric key encryption algorithm;

s102, judging whether a field needing to be encrypted exists in the database, if so, executing S103, otherwise, executing S107;

s103, carrying out encryption operation on fields needing to be encrypted;

s104, performing position transformation on the binary ciphertext data;

s105, writing an obfuscated value in the transformed binary ciphertext;

s106, carrying out Base64 coding on the new binary value;

s107, storing the processed data into a database;

wherein, the steps S104, S105 and S106 are the own visualization algorithm processing flow.

4. The database encryption and perfect-match retrieval system according to claim 3, wherein in step S101, the commonly used symmetric key encryption algorithm includes AES advanced encryption standard, SM4 national encryption algorithm, the data encryption execution unit is configured to execute the symmetric key encryption algorithm, and the encrypted data storage unit is configured to store the data encrypted by the symmetric key encryption algorithm.

5. The database encryption and perfect-match retrieval system of claim 1, wherein the specific processing flow of the encrypted data query module is as follows:

s201, initializing an encryption algorithm;

s202, initializing a query request receiving engine, and waiting for receiving a query request;

s203, whether a query request is received or not is judged, if yes, step 204 is executed, and if not, step 203 is executed;

s204, judging whether the condition of the query request has an encrypted field, if so, executing a step 205, otherwise, executing a step 209;

s205, encrypting the query condition field;

s206, carrying out position transformation on the binary ciphertext data;

s207, writing an obfuscated value in the transformed binary ciphertext;

s208, carrying out Base64 encoding on the new binary value to obtain a query condition value;

s209, inquiring data from the database according to the inquiry condition;

s210, judging whether an encrypted field exists in the query result, if so, executing a step 211, otherwise, executing a step 215;

s211, performing Base64 decoding operation on the field value needing to be decrypted in the query result;

s212, removing an aliasing value from the decoded value;

s213, restoring the binary position of the ciphertext to obtain a ciphertext result;

s214, carrying out decryption operation on the ciphertext result to obtain a plaintext result;

s215, returning result data of the query request and returning to the step 203;

wherein, S206, S207, S208 are own visualization algorithm processing flows, and S211, S212, S213 are corresponding inverse processing flows.

6. The database encryption and perfect match retrieval system of claim 1, wherein the data encryption and decryption unit is configured to encrypt the received data by an encryption algorithm or decrypt the received data by a decryption algorithm.

7. The database encryption and perfect match retrieval system of claim 6, wherein the encryption algorithm of the data encryption and decryption unit is any one of AES advanced encryption Standard, SM4 national encryption Algorithm.

Images