CN102722576B - Encipherment protection system and encipherment protection method for database in cloud computing environment - Google Patents

Abstract

The invention provides an encipherment protection system and an encipherment protection method for a database in a cloud computing environment. The encipherment protection system provided by the invention comprises an application interface, a task management subsystem, a resource management subsystem and an encipherment engine pool. The encipherment protection system provided by the invention has the following advantages that 1. the encipherment protection system adopts the encipherment engine pool so as to avoid that the database performance is reduced by the influence of the overload operation of encipherment and decryption modules; 2. an application system is entirely transparent to final users of the database, so that the conversion between clear test and cipher text can be carried out according to the requirements; 3. the encipherment engine pool is fully independent from the database and the application system, so that the encipherment function of data can be realized without changing the database and the application system; 4. the encipherment engine pool constructed by using virtualization technologies has favorable manageability and elasticity, and can be constructed according to the requirements, the bottleneck problems of the fine granularity and the large concurrency access in the application of a relational database are solved, resources can be reasonably used, and the capability and the efficiency of a database server are enhanced.

Description

Database encryption protection system and encryption protection method in cloud computing environment

technical field

The present invention relates to the field of information security in a cloud computing environment, and in particular to a database encryption protection system and encryption protection method in a cloud computing environment. A data encryption and decryption engine pool is constructed through virtualization technology, and encryption and decryption are dynamically created and scheduled according to the encryption and decryption load conditions. Engine, suitable for data encryption protection of large concurrent fine-grained access.

Background technique

Cloud computing is an Internet-based computing model for public participation, and its computing resources are dynamic, scalable, virtualized, and provided as a service. Users have changed from buying software in the past to renting corresponding application software through the Internet under cloud computing; from purchasing servers and building computer rooms before, to renting remote virtual computing capabilities through the Internet under cloud computing. The information technology represented by cloud computing is promoting the information industry from providing independent software and hardware products to providing socialized, intensive and professional information services. Database storage security is the basis for ensuring cloud computing security.

In the cloud computing environment, deploying traditional security measures such as access control, firewall and intrusion detection to protect the database, there are two situations that may easily cause confidential information leakage: 1) The database administrator has too much authority and has the right to access all/part of the confidential data ; 2) Loss of backup media, maintenance of database system security requires regular backup of data in the database, a large number of data backup files are stored in unprotected magnetic and optical media, the hidden danger of loss is quite large, which may cause leakage of confidential information .

Contents of the invention

In view of the above-mentioned problems existing in the traditional database security protection measures in the cloud computing environment, the present invention provides a database encryption protection system and encryption protection method in the cloud computing environment.

The invention mainly solves the problem of realizing efficient encryption/decryption of data after the encrypted data stored in the cloud computing database server has formed a scale. On the basis of traditional security measures, data encryption technology is used to encrypt the confidential data in the database, so that even if the intruder bypasses or breaks through various system security mechanisms, only the encrypted ciphertext data is obtained, and the backup data is lost. It will not cause the disclosure of confidential information.

The first aspect of the present invention provides a database encryption protection system in a cloud computing environment, including an application interface (1), a task management subsystem (2), a resource management subsystem (3), a virtual host encryption and decryption engine pool (4 ), the system includes:

1) The application interface (1) is the interface for the task management subsystem (2) to interact with the application server. On the one hand, the SQL request of the application server is submitted to the task management subsystem (2), and on the other hand, the task management subsystem ( 2) The collected running results are provided to the application server;

2) Task management subsystem (2), which parses various database access requests, decomposes the SQL requests allowed to be accessed into multiple execution subtasks through access control security review, and releases, maintains, monitors and updates these subtasks and other control and management work;

3) The resource management subsystem (3), on the one hand, collects the information of all virtual machines and physical machines; on the other hand, deploys virtual machines according to the sub-task execution requirements released by the task management subsystem, and provides encryption and decryption engine creation and recycling services , realize the on-demand distribution function of the virtual encryption and decryption engine;

4) The encryption and decryption engine pool (4), the core part of the system, is composed of multiple dynamic encryption and decryption engines based on virtualization technology. These encryption and decryption engines are created in the virtual machine by the resource management subsystem (3). The task execution unit in the management subsystem (2), responsible for providing encryption and decryption services and data security access services for users' data services.

The second aspect of the present invention provides a database encryption protection method in a cloud computing environment, which avoids problems such as database performance degradation caused by overloading of encryption and decryption modules. The deployment structure of the encryption and decryption engine is optimized, and the on-demand service of encryption and decryption resources is realized according to the idea of software-based, distributed, and virtualized bearer mode of encryption and decryption functions. The database encryption protection method includes the following steps:

Step 1: The SQL request of the application server is sent to the task management subsystem (2) through the application interface (1), and the task management subsystem (2) verifies the validity of the statement of the request to determine whether the statement is legal; Parallel task processing;

Step 2: The task management subsystem (2) analyzes and sorts all tasks, and sends the tasks that can be executed immediately to the resource management subsystem (3), puts the tasks with resource competition conflicts into the task waiting queue, and simultaneously Detection, the task that waits for timeout will be decided to continue waiting or discard according to the task execution strategy;

Step 3: The resource management subsystem (3) collects the information of the physical machines in the system, predicts the system's demand for virtual hosts, and deploys the required virtual hosts in the physical machines according to the virtual machine deployment strategy;

Step 4: The resource management subsystem (3) sorts the tasks received from the task management subsystem (2) according to the priority, chooses to assign resource tasks to it, and selects the matching virtual resource in the virtual resource list according to the resource allocation strategy , that is, the virtual machine, if the virtual resources are insufficient to meet the resource requirements of the task, go to step 3;

Step 5: Detect the encryption and decryption engine program in the virtual machine assigned by the task and start the program. If the program is successfully started, the task management subsystem (2) is informed that the task is being executed, and then go to step 6; otherwise, the task execution is abnormal, and the task management subsystem The system (2) cancels the task and executes step 7;

Step 6: The task starts to execute, completes the database access and data encryption services through the created encryption and decryption engine program, and returns the result to the task management subsystem (2);

Step 7: The resource management subsystem (3) recycles the virtual machine that has completed the task execution, and destroys the decryption engine program.

The invention solves the problem of database encryption protection under the cloud computing environment, and mainly has the following advantages:

1. Use the encryption and decryption engine pool to avoid the decline in database performance caused by the overload of the encryption and decryption module;

2. The application system is completely transparent to the end users of the database, and can convert plaintext and ciphertext according to needs;

3. The encryption and decryption engine is completely independent of the database and application system, and the data encryption function can be realized without changing the database and application system;

4. The encryption and decryption engine pool built based on virtualization technology has good manageability and flexibility, and can be created on demand, which solves the bottleneck problem of fine-grained and large-scale concurrent access in relational database applications. Rationalized use improves the capacity and efficiency of the database server.

Description of drawings

Fig. 1 is a schematic structural diagram of the database encryption protection system of the present invention;

Fig. 2 is the flowchart of database encryption protection method of the present invention;

Fig. 3 is the application system structural diagram of the data protection of cloud computing environment according to the embodiment of the present invention;

Fig. 4 is a workflow diagram of the application system for database encryption protection according to an embodiment of the present invention.

Detailed ways

The method and system for implementing database encryption protection in the cloud computing environment of the present invention will be described in detail below in conjunction with the accompanying drawings. In the description, numerous specific details are given to ensure a thorough understanding of examples of the invention.

As shown in FIG. 1 , according to the database encryption protection system of the embodiment of the present invention, the database encryption protection system under the cloud computing environment includes: an application interface 1 , a task management subsystem 2 , a resource management subsystem 3 , and an encryption and decryption engine pool 4 .

The application interface 1 provides an interface for the task management subsystem 2 to interact with the application server. On the one hand, it submits the SQL request of the application server to the task management subsystem 2, and on the other hand, it provides the running results collected by the task management subsystem 2 to the application server;

Task management subsystem 2, which analyzes various database access requests, decomposes the SQL requests allowed to be accessed into multiple execution sub-tasks through access control security review, and performs control and management work on these sub-tasks such as release, maintenance, monitoring, and update ;

Resource management subsystem 3, on the one hand, is responsible for collecting the information of all virtual machines and physical machines, and uses this information as the basis for task distribution, deployment and operation of task management subsystem 2; Deploy virtual machines according to task requirements, provide encryption and decryption engine creation and recycling services, and realize the on-demand distribution function of virtual encryption and decryption engines;

Encryption and decryption engine pool 4, the core part of the system, is composed of multiple dynamic encryption and decryption engines based on virtualization technology. These encryption and decryption engines are created in virtual machines by resource management subsystem 3 and are tasks in task management subsystem 2. The execution unit is responsible for providing encryption and decryption services and data security access services for users' data services.

As shown in Figure 2, according to the database encryption protection system of the embodiment of the present invention, the database encryption protection method under the cloud computing environment comprises the following steps:

Step 1: The SQL request of the application server is sent to the task management subsystem 2 through the application interface 1, and the task management subsystem verifies the validity of the statement of the request, judges whether the statement is legal, and performs parallel task processing on it;

Step 2: Task management subsystem 2 analyzes and sorts all tasks, and sends tasks that can be executed immediately to resource management subsystem 3. Tasks with resource competition conflicts are put into the task waiting queue, and at the same time, the task queue is detected, and the waiting The timed-out task decides to continue waiting or discard according to the task execution strategy;

Step 3: The resource management subsystem 3 is responsible for collecting the information of the physical machines in the system, predicting the demand of the system for virtual hosts, and deploying the required virtual hosts in the physical machines according to the virtual machine deployment strategy;

Step 4: The resource management subsystem 3 sorts the tasks received from the task management subsystem 2 according to priority, selects to assign resource tasks to them, and selects the matching virtual resource in the virtual resource list according to the resource allocation strategy, that is, the virtual machine , if the virtual resources are insufficient to meet the resource requirements of the task, go to step 3;

Step 5: Detect the encryption and decryption engine program in the virtual machine assigned to the task and start the program. If the program is successfully started, the task management subsystem 2 is informed that the task is being executed, and step 6 is executed; otherwise, the task execution is abnormal and the task management subsystem 2 cancels it. task, perform step seven;

Step 6: The task starts to execute, completes the database access and data encryption services through the created encryption and decryption engine program, and returns the result to the task management subsystem 2;

Step 7: The resource management subsystem 3 recycles the virtual machine that has completed the task execution, and destroys the decryption engine program.

As shown in Figure 3, according to the database encryption protection system of the embodiment of the present invention, the application system of database encryption protection under the cloud computing environment includes: user terminal equipment 5, application portal 6, application server 7, database encryption protection system 9, key And authentication management center 8, data audit system 10, database 11.

The user terminal device 5, the user applies for service access on the user terminal device through the user name, password, or UKEY login method, and the user terminal device 5 accesses the application portal 6 through a secure channel, that is, using HTTPS/traditional VPN or private VPN ( The user client installs the VPN client, dials to the VPN gateway of the platform, and establishes a secure connection channel)/SSL/SSH/FTPS and other secure communication methods after successful authentication.

The application portal 6 authenticates the user's access application by invoking the unified identity authentication service of the key and authentication management center 8; judges whether to allow access to the application server 7 and the data server through the authentication information.

The application server 7 is connected to the client and to the database 11, and is used to receive the authentication request from the client, to perform authentication by the key and the authentication management center 8, to obtain the database access information when the authentication is passed, and to encrypt the database to protect the system 9 The data obtained from the database 11 is sent to the client; the database encryption protection system 9, as an intermediate layer between the front-end application server 7 and the back-end database 11, is responsible for receiving the data request from the client and performing relevant processing, and then passing it to the database 11, the data is processed, and finally the result is returned to the client by the database middleware. The processing here includes access control of the database 11, encryption/decryption of data, integrity protection of data, transmission control and balanced management of virtual resources.

The key and authentication management center 8 provides key request and acquisition services for the database encryption protection system 9; the key and authentication management center 8 is an important part of the database encryption protection system 9, responsible for providing key generation (export) , save, backup, update, restore, query, destroy and other keys and the security management of its own system, formulate key management processes and standards, and provide large-scale application key management in cloud computing application environments.

The database audit system 10 can support various database system audits for data encryption and decryption engines and databases, realize real-time monitoring and auditing functions for encryption and decryption activities and database 11 access operations, and provide comprehensive database 11 security protection functions, that is, it can be used in Without affecting the operation of the database 11, the monitoring, auditing and security functions of the database 11 and the function of dynamic modeling are provided. Detailed access records to the database 11 including the users of the application system provide real-time blocking of illegal database access.

The database 11 mainly stores ciphertext data encrypted by the encryption and decryption engine.

As shown in Figure 4, according to the database encryption protection system of the embodiment of the present invention, when the user in the database encryption protection system on the cloud computing platform accesses the application server through the client, the database encryption protection system realizes the process of user data protection as follows:

Step 1: The user inserts the personal digital certificate USBKEY into the client host, and accesses the application portal 6 through the client through a VPN or security protocol (for example: SSL, SSH, IPSec); after the application portal 6 performs integrity verification on the user input information, it will The information input by the user and the application system identification that the user wants to visit are sent to the key and authentication management center 8; the user authentication and access authority judgment of the application server 7 are completed by the key and authentication management center 8; pass, fail, authority list, certificate information), judged by the application portal 6; if the user is illegal or does not have authority, return an exception prompt to the user, and end the visit; if it belongs to a legal user and has the authority to access the application system, Then provide the session token and go to step 2.

Step 2: Create a session between the application system and the user, and return the authorization token of the application system to the user. Afterwards, the user can continue to access the application system through the authorization token until the system exits or the session times out.

Step 3: The user sends a service request to the application server 7, and the application server can access the background database 11 through the database encryption protection system 9; there are four types of SQL operation requests: (1) Write records, delete, and modify operations on the database 11, such as Uploading data; (2) querying the database 11, which requires background encryption/decryption; (3) data acquisition, which does not require background encryption/decryption, but requires user-side encryption/decryption; (4) data exchange (requires multiple database participation). The task management subsystem 2 in the database encryption protection system 9 decomposes the SQL request into multiple execution subtasks, and the resource management subsystem 3 creates several virtual machine-based encryption and decryption engines to execute the subtasks.

Step 4: The encryption and decryption engine converts the SQL request into an easy-to-handle tree form, and extracts the parameters required for database encryption and decryption processing (table name, field name, inserted data, etc.) from the tree. In addition, the syntax tree is converted into SQL statements that can operate on the ciphertext database.

Step 5: The encryption and decryption engine applies to the key and authentication management center 8 for the corresponding encrypted table key according to the database relational table to be operated; the key and authentication management center 8 will use the user's public key to encrypt the table key Return it to the user terminal through the application portal 6; the user terminal uses the private key it holds to decrypt the table key encrypted by the public key to obtain the table key, and then the application portal 6 sends it to the database encryption protection system 9 (i.e. decryption engine); the encryption and decryption engine sends the obtained table key to the key and the authentication management center 8 for key confirmation; if the key is invalid, an exception prompt is returned to the user, and step 11 is executed; otherwise, step 6 is executed.

Step 6: The encryption and decryption engine accesses the database 11 to obtain ciphertext data from the database. Due to different types of SQL access, there are differences in the operation details: (1) Write records and delete operations to the relational table, and perform step 7 ;(2) Modify the records in the relational table, perform query operation, perform step 7; (3) perform data acquisition, perform step 9.

Step 7: Generate a work key based on the table key, and use the work key to encrypt and decrypt data; complete the corresponding business operation; if the SQL access type is query operation, perform step 9, otherwise perform step 8.

Step 8: Delete the records in the database 11 or encrypt the data that needs to be written back into the database 11 and store it in the database 11 again.

Step 9: Send the execution result of the SQL subtask to the task management subsystem 2 , and send the operation record to the database audit system 10 .

Step ten: The task management subsystem 2 collects the execution results of all SQL subtasks requested by the user, and transmits them to the application server 7 through the VPN channel.

Step 11: After the task is executed, close the encryption and decryption engine, and recover virtual resources.

Claims (2)

1. A database encryption protection system under a cloud computing environment, characterized in that, comprising: 1) The application interface (1) is the interface for the task management subsystem (2) to interact with the application server. On the one hand, the SQL request of the application server is submitted to the task management subsystem (2), and on the other hand, the task management subsystem ( 2) The collected running results are provided to the application server; 2) Task management subsystem (2), which parses various database access requests, decomposes the SQL requests allowed to be accessed into multiple execution subtasks through access control security review, and releases, maintains, monitors and updates these subtasks control management work; 3) The resource management subsystem (3), on the one hand, is responsible for collecting the information of all virtual machines and physical machines; on the other hand, it deploys virtual machines according to the sub-task execution requirements released by the task management subsystem (2), and provides encryption and decryption engine Create and recycle services to realize the on-demand distribution function of the virtual encryption and decryption engine; 4) The encryption and decryption engine pool (4), the core part of the system, is composed of multiple dynamic encryption and decryption engines based on virtualization technology. These encryption and decryption engines are created in the virtual machine by the resource management subsystem (3). The task execution unit in the management subsystem (2), responsible for providing encryption and decryption services and data security access services for users' data services. 2. A database encryption protection method under a cloud computing environment, characterized in that: comprising the following steps: Step 1: The SQL request of the application server is sent to the task management subsystem (2) through the application interface (1), and the task management subsystem (2) verifies the validity of the statement of the request, judges whether the statement is legal, and executes Parallel task processing; Step 2: The task management subsystem (2) analyzes and sorts all tasks, and sends the tasks that can be executed immediately to the resource management subsystem (3), puts the tasks with resource competition conflicts into the task waiting queue, and simultaneously Detection, the task that waits for timeout will be decided to continue waiting or discard according to the task execution strategy; Step 3: The resource management subsystem (3) collects the information of the physical machines in the system, predicts the system's demand for virtual machines, and deploys the required virtual machines in the physical machines according to the virtual machine deployment strategy; Step 4: The resource management subsystem (3) sorts the tasks received from the task management subsystem (2) according to their priority, selects a task with a higher priority, allocates resources for the task, and assigns resources to the virtual resource according to the resource allocation strategy. Select the matching virtual machine from the list. If the virtual machine is insufficient to meet the resource requirements of the task, go to step 3; Step 5: Detect the encryption and decryption engine program in the virtual machine assigned by the task and start the program. If the program is successfully started, the task management subsystem (2) is informed that the task is being executed, and step 6 is executed; otherwise, the task is notified that the task is executing abnormally, and the task management subsystem (2) To cancel the task, go to step 7; Step 6: The task starts to execute, completes the database access and data encryption services through the created encryption and decryption engine program, and returns the result to the task management subsystem (2); Step 7: The resource management subsystem (3) recycles the virtual machine that has completed the task execution, and destroys the decryption engine program.