Field-level database encryption device

Abstract

The invention is suitable for the field of information security and provides a field-level database encryption device, which comprises a user information storage unit, a database field encryption setting unit and a database access preprocessor, wherein the user information storage unit is used for storing database encryption symmetric keys which are encrypted through user public keys; the database field encryption setting unit is used for setting whether fields in a database are encrypted or not; and the database access preprocessor is used for conducting encryption conversion or decryption conversion to database access statements according to the decrypted database encryption symmetric keys and field encryption setting information in the database field encryption setting unit. By using the field-level database encryption device, a user can select different symmetric encryption algorithms supported by a database system according to demands for different encryption intensities, an application program does not need to conduct encryption or decryption operation to the database, all data encryption and decryption operations are completed by the database system, a full-text retrieval function of data items can be supported, and the original database access statements are not needed to be changed and can be directly and transparently used.

Description

technical field [0001] The invention belongs to the field of information security, in particular to a field-level database encryption device. Background technique [0002] Database is an important method of data storage in modern software systems. The data stored in the database is often user-sensitive data, and encryption has become an important means to protect data information from being leaked. [0003] At present, for the data stored in the database, two different encryption methods are often used according to the nature of the data. [0004] One type of encryption is irreversible encryption. In this way, the data hash operation is performed on the plaintext data to obtain the characteristic value of the data, and the characteristic value is stored in the database, and the plaintext data is not stored. Since the stored data only saves the characteristic value of the data, the data is irreversible and has relatively large limitations. It can only be used for some speci...

AI Technical Summary

Problems solved by technology

[0008] 1. Performance issues: In general applications, client-side data decryption is often used, and the encrypted data is taken out of the database for processing, which seriously affects the performance of database access. In the case of relatively large data records, it is basically unusable;

[0009] 2. Cannot perform full-text search: because the database stores ciphertext, it is generally used to take out the ciphertext and decrypt it before performing full-text search. The efficiency is slower than the direct search of the database system, and the overhead on the system is also very large;

[0010] 3. Different users cannot share: Since the data is encrypted with a user-specific key, when the data needs to be shared, the data cannot be encrypted;

[0011] 4. Field encryption cannot be set: the encryption of database fields cannot be flexibly selected, resulting in serious data encryption performance problems;

[0012] 5. The application system's access to the database is not transparent: the application system needs to encrypt and decrypt the data, which is opaque

Images