水利业务系统数据加密方案实践

Practice of data encryption scheme for water management business system

随着水利信息化的部署推进和等保2.0及数据安全法的实行,数据加密成为水利行业新系统设计或老系统改造时面临的一个重要问题。从架构设计角度出发,对业务系统中应用层、中间件层、数据库层、文件和存储层等各个层面的数据加密方案进行分析,从加密粒度、加密性能、数据处理能力、实施成本等方面进行对比,给出不同层面数据加密方案适用的场景,同时重点针对数据库层加密,结合水利业务分析透明加密、硬加密2种方案的加密算法和性能,为水利业务系统架构设计提供参考。分析结果表明:不同的业务需求适合不同的数据加密方案,其中,数据库层透明加密适用于大部分水利业务场景。

With the development of water informatization and the implementation of Classified Protection of Cybersecurity 2.0 and data security law,data encryption has become an important issue in the design of new systems or the transformation of old systems in water management. From the perspective of architecture design,this paper analyzes the data encryption schemes of application layer,middleware layer,database layer,file and storage layer in the business system. The encryption granularity,encryption performance,data processing capacity,and implementation cost etc.are compared,to give the applicable scenarios of data encryption schemes at different levels. Meanwhile,focusing on database layer encryption,the encryption algorithm and performance of transparent encryption and hard encryption are analyzed in combination with water business to provide reference for water business system architecture design.The results show that different data encryption schemes are designed to match different business requirements,and the transparent encryption of database layer is suitable for most business systems of water management.