Hierarchical retrieval methods, devices, equipment, storage media, and products for encrypted data
By constructing an encrypted index using a hierarchical retrieval method and the DCFR algorithm, the efficiency and storage problems of encrypted data querying under large data volumes are solved, achieving efficient and accurate encrypted retrieval.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA MOBILE (SUZHOU) SOFTWARE TECH CO LTD
- Filing Date
- 2026-02-10
- Publication Date
- 2026-05-26
Smart Images
Figure CN122086953A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a hierarchical retrieval method, apparatus, device, storage medium, and product for encrypted data. Background Technology
[0002] With the development of the internet, cybersecurity has become a critical issue in the internet field. Data encryption is an important technical means of cybersecurity; for example, encrypting sensitive information in databases has become a standard practice for various databases to ensure data security. While data encryption can prevent the leakage of sensitive database information, it also brings many problems to data management and maintenance, especially in data query schemes. Queries on plaintext data can proceed normally, but queries on encrypted data are prone to failure.
[0003] In existing encrypted data queries, the common approach is to decrypt first and then query, or to build an index through word segmentation. However, the decryption-first approach is only suitable for small data volumes. When the data volume is large, it leads to high decryption overhead, high memory usage, and low query efficiency. While building an index through word segmentation can improve query efficiency, it causes the index length to grow explosively with the data volume, increasing storage burden and reducing retrieval accuracy. Summary of the Invention
[0004] To address the problems existing in the prior art, embodiments of the present invention provide a hierarchical retrieval method, apparatus, device, storage medium, and product for encrypted data, which can effectively reduce storage usage during the data query process and improve the accuracy of data query.
[0005] In a first aspect, embodiments of the present invention provide a hierarchical retrieval method for encrypted data, comprising: When a query statement indicates that encrypted data should be retrieved, the nodes of the distributed cache are requested to perform a first-level cache retrieval based on the query keywords in the query statement. If the query fails to find the first-level cache, the query keywords in the query statement are parsed and constructed to obtain the encrypted index query value. A secondary encrypted retrieval is performed based on the encrypted index query value to obtain the secondary encrypted retrieval result. The secondary encrypted retrieval result is then cached in the distributed cache for retrieval filtering processing to obtain the final retrieval result.
[0006] As an improvement to the above scheme, the process of storing the encrypted data includes: The plaintext data is encrypted to obtain encrypted data, and the encrypted data is stored in the encrypted field of the target database; Each field of the plaintext data is encrypted using a variable grouping mechanism, an encrypted index of the encrypted data is constructed, and the encrypted index is stored in the encrypted index field corresponding to the encrypted field.
[0007] As an improvement to the above scheme, each field of the plaintext data is encrypted using a variable block mechanism to construct an encrypted index for the encrypted data, including: The plaintext data is grouped into multiple character groups; Perform general hash encryption on each of the character groups to obtain the first hash value of each of the character groups; Perform keyword generation processing on the first hash value to generate the corresponding keyword for the first hash value; The keywords are subjected to format-preserving encryption to obtain the group index of the corresponding character groups; The encryption index is obtained by concatenating the group indices of each character group.
[0008] As an improvement to the above scheme, a first-level cache retrieval is requested from the distributed cache nodes based on the query keywords in the query statement, including: A second hash value is obtained by performing a hash calculation on the query keywords in the query statement; Locate the data partition corresponding to the second hash value on the node to which the distributed cache belongs, and request the node to perform a local retrieval based on the query keywords.
[0009] As an improvement to the above scheme, the query keywords in the query statement are parsed and constructed to obtain an encrypted index query value, including: The query keywords are segmented and extracted to obtain several key strings; The key string is transformed into an encrypted query based on a variable grouping mechanism to generate an encrypted index query value.
[0010] As an improvement to the above scheme, the secondary encrypted retrieval results are cached in the distributed cache for retrieval filtering processing to obtain the final retrieval results, including: The secondary encrypted search results are cached in the distributed cache; In the distributed cache, the secondary encrypted retrieval result is decrypted to obtain at least one plaintext data retrieval result; Based on the query keywords, the search results of at least one plaintext data are filtered to obtain the final search results.
[0011] Secondly, embodiments of the present invention provide a hierarchical retrieval device for encrypted data, comprising: The first-level cache retrieval module is used to request the nodes of the distributed cache to perform a first-level cache retrieval based on the query keywords in the query statement when the query statement indicates that encrypted data should be retrieved. The parsing and construction module is used to parse and construct the query keywords in the query statement to obtain the encrypted index query value when the query is not found in the first-level cache. The secondary encrypted retrieval module is used to perform a secondary encrypted retrieval based on the encrypted index query value, obtain the secondary encrypted retrieval result, and cache the secondary encrypted retrieval result in the distributed cache for retrieval filtering processing to obtain the final retrieval result.
[0012] Thirdly, embodiments of the present invention provide a hierarchical retrieval device for encrypted data, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the hierarchical retrieval method for encrypted data as described in any one of the first aspects.
[0013] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the hierarchical retrieval method for encrypted data as described in any one of the first aspects.
[0014] Fifthly, embodiments of the present invention provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the hierarchical retrieval method for encrypted data as described in any one of the first aspects.
[0015] Compared to existing technologies, the present invention provides a hierarchical retrieval method, apparatus, device, storage medium, and product for encrypted data. When a query statement indicates a retrieval of encrypted data, it requests a distributed cache node to perform a first-level cache retrieval based on the query keywords in the query statement. If the first-level cache retrieval fails, it parses and constructs an encrypted index query value from the query keywords in the query statement. A second-level encrypted retrieval is then performed based on the encrypted index query value to obtain a second-level encrypted retrieval result. This second-level encrypted retrieval result is then cached in the distributed cache for retrieval filtering to obtain the final retrieval result. The present invention, by introducing a two-level retrieval mechanism, effectively improves the accuracy of data retrieval through first-level cache retrieval and second-level encrypted retrieval. Furthermore, the introduction of an encrypted index query value in the second-level encrypted retrieval effectively improves data retrieval efficiency and reduces storage usage during the data retrieval process. Attached Figure Description
[0016] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 This is a flowchart of a hierarchical retrieval method for encrypted data provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the hierarchical retrieval of encrypted database provided in an embodiment of the present invention; Figure 3 This is a structural block diagram of a hierarchical retrieval device for encrypted data provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a hierarchical retrieval device for encrypted data provided in an embodiment of the present invention. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0019] It is understood that the various numerical designations used in the embodiments of this invention are merely for descriptive convenience and are not intended to limit the scope of this application. The order of the process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.
[0020] In embodiments of the invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element. The term "a plurality or several" refers to two or more.
[0021] See Figure 1 , Figure 1This is a flowchart of a hierarchical retrieval method for encrypted data provided in an embodiment of the present invention. The hierarchical retrieval method for encrypted data specifically includes: S11: When the query statement indicates that encrypted data should be retrieved, the nodes of the distributed cache are requested to perform a first-level cache retrieval based on the query keywords in the query statement; S12: If the query fails to find the first-level cache, the query keywords in the query statement are parsed and constructed to obtain the encrypted index query value; S13: Perform a secondary encrypted search based on the encrypted index query value to obtain the secondary encrypted search result, and cache the secondary encrypted search result in the distributed cache for search filtering processing to obtain the final search result.
[0022] In this embodiment of the invention, the database (DB) can store plaintext data, and / or encrypted data of the plaintext data (also called ciphertext data) and a unique encrypted index of the encrypted data. This encrypted index is used to directly query the encrypted data stored in the database. For a user-input query, the system first determines whether the query is for retrieving encrypted data. For example, it checks whether the query conditions (such as query keywords) indicate encrypted data or encrypted fields of encrypted data in the database. If not, the query is for retrieving plaintext data, and the query can be performed directly based on the query conditions. If not, the query is for retrieving encrypted data, and the system proceeds to the ciphertext retrieval process, as follows: First-level cache retrieval is performed based on a distributed cache (ignite). For example, a local retrieval is requested from a node in the distributed cache based on the query keywords in the query statement. If the corresponding encrypted data is found, that is, the first-level cache retrieval query is hit, the encrypted data is returned directly, and the ciphertext retrieval is completed. If the corresponding encrypted data is not found, that is, the first-level cache retrieval query is not hit, the second-level ciphertext retrieval is performed.
[0023] In the second-level encrypted retrieval, the query keywords in the query statement are parsed and constructed to obtain the encrypted index query value; the encrypted index in the database is matched and retrieved using the encrypted index query value to find the encrypted data corresponding to the encrypted index that matches the encrypted index query value, thus obtaining the second-level encrypted retrieval result and completing the second-level encrypted retrieval. Finally, the above-mentioned secondary encrypted search results are cached in a distributed cache to build a primary cache of the secondary encrypted search results. The secondary encrypted search results (including at least one encrypted data) cached in the distributed cache can be retrieved locally through the nodes in the distributed cache. At the same time, the distributed cache can also perform further retrieval and filtering processing on the secondary encrypted search results, such as retrieving the encrypted data in the secondary encrypted search results based on the query keywords in the query statement to obtain the final search results.
[0024] This invention introduces a two-level retrieval mechanism, which effectively improves the accuracy of data retrieval through first-level cache retrieval and second-level encrypted retrieval. At the same time, the introduction of encrypted index query values in the second-level encrypted retrieval enables encrypted retrieval, which can effectively improve data retrieval efficiency and reduce storage usage during the data retrieval process.
[0025] Furthermore, the process of storing the encrypted data includes: The plaintext data is encrypted to obtain encrypted data, and the encrypted data is stored in the encrypted field of the target database; Each field of the plaintext data is encrypted using a variable grouping mechanism, an encrypted index of the encrypted data is constructed, and the encrypted index is stored in the encrypted index field corresponding to the encrypted field.
[0026] In this embodiment of the invention, when storing encrypted fields in the database, corresponding encrypted retrieval fields are simultaneously appended. When storing encrypted data (i.e., the values of encrypted fields), a variable grouping method is used for encryption, generating the values of the corresponding encrypted index fields (i.e., encrypted indexes). During the query phase, a first-level cache retrieval is performed first; if no match is found, a second-level encrypted retrieval is executed. Simultaneously, a first-level cache of the second-level encrypted retrieval results is constructed, and the final retrieval result is returned, such as... Figure 2 As shown.
[0027] This invention employs a dual-field storage method that uses encrypted fields and variable grouping encryption to generate encrypted index fields. During a query, the data is first retrieved from the first-level cache, and if no match is found, a second-level encrypted retrieval is performed. Simultaneously, the second-level results are cached in the first-level cache. This achieves end-to-end encrypted security protection for data storage and retrieval, enhancing the security of encrypted storage. Furthermore, the hierarchical retrieval significantly improves overall query performance, reduces invalid database overhead, and enhances the performance of encrypted retrieval.
[0028] Specifically, each field of the plaintext data is encrypted using a variable grouping mechanism to construct an encrypted index for the encrypted data, including: The plaintext data is grouped into multiple character groups; Perform general hash encryption on each of the character groups to obtain the first hash value of each of the character groups; Perform keyword generation processing on the first hash value to generate the corresponding keyword for the first hash value; The keywords are subjected to format-preserving encryption to obtain the group index of the corresponding character groups; The encryption index is obtained by concatenating the group indices of each character group.
[0029] In this embodiment of the invention, the Fuzzy retrieval method based on database ciphertext (DCFR) is used to generate an encrypted index (also called a retrieval index) corresponding to the encrypted data, and it is stored in the corresponding ciphertext index field. The specific process is as follows: Let the encrypted field be 'field', and the plaintext data be D = {d1d2...d...} n The corresponding encrypted index field is fd_index. The first key used to generate the ciphertext data and the encrypted index is k1, the second key is k2, the value of the encrypted index is InD, and the encrypted data is... The computational representation of generating encrypted data and its encrypted index based on the DCFR method is as follows: (lnD, )=KGen(D,k1,k2)(1); Here, KGen (Ciphertext and Index Generation Algorithm) represents the ciphertext and index generation algorithm; Encrypted data The encrypted computation is represented as follows: =Enc(D, k1)(2) Wherein, Enc represents encrypted computation. It is the encrypted data of plaintext data D, which is obtained by encrypting plaintext data D using the first key K1.
[0030] The calculation representation of the encrypted index InD is as follows: InD=E k1 (KGA(H) k2 (d) i )))(3; Among them, E k1 This indicates FPE (Format-Preserving Encryption) encryption computation, KGA indicates Keyword Generation Algorithm, and H... k2This indicates UHF (Universal hashfunctions) processing, d i Let represent the i-th character in the plaintext data, where 1 ≤ i ≤ n.
[0031] In UHF processing, depending on the type of plaintext data to be encrypted, a variable block method is used to divide the plaintext data into blocks {w1w2...w...}. m}, m n. First, group the resulting characters into w groups. j (1≤j≤m) Perform UHF encryption: =h k2 (w) j ,k2)(4); in, Indicates the j-th group w j The result of UHF encryption (i.e., the first hash value, which is a string), h K2 This indicates a general hash calculation based on encryption using the second key K2.
[0032] It is understood that the type of plaintext data refers to the business field type, which is the actual category based on the business attributes, format specifications, and character characteristics of the encrypted fields in the database. Examples include fixed-length identifier fields (such as mobile phone numbers, ID card numbers, bank card numbers, etc.), variable-length natural character fields (such as names, usernames, addresses, etc.), numeric sensitive fields (such as dates of birth, account balances, etc.), and mixed-format composite fields (such as email addresses, login accounts, license plate numbers, etc.). In this embodiment of the invention, the relationships between fields contained in the plaintext data can be identified, and different field types can be divided into different character groups.
[0033] In KGA processing, the first hash value mentioned above... This string is processed using 1-gram (i.e., slicing the string into consecutive single-character segments and extracting each single character as an independent feature) and 2-gram (i.e., slicing the string into consecutive double-character segments and extracting every two adjacent consecutive characters as a combined feature). This process can identify the keyword features and relative positions of different characters, resulting in a feature list of nGram={g1, g2, ..., g...}. m The feature list is then deduplicated to obtain the first hash value. Keywords The specific calculation is as follows: = KGA ( (5); Understandably, KGA will generate different unique keys for two different pieces of information generated by UHF processing. For example... =KGA(A), =KGA(B), A B.
[0034] In FPE encryption processing, the generated keywords are... FPE format preservation encryption is performed to obtain character blocks w j Grouped index The specific calculation is as follows: =E FPE ( ,k1)(6); Among them, EF PE It's the FPE encryption algorithm, a special type of symmetric encryption algorithm that guarantees the encrypted ciphertext format is exactly the same as the plaintext format. For example, encrypting a 16-digit bank card number using the FPE algorithm will still result in a 16-digit number. Format-preserving encryption is often used in data anonymization projects because it maintains the encrypted data format, offering advantages such as not requiring changes to the database normalization and being transparent to upper-layer applications.
[0035] Encryption Index Construction: After calculating the encryption result for each group, the encryption index is constructed by sequentially concatenating the encryption results (i.e., the keywords of each group) using the character order preservation method of the original plaintext data. For example, for the Chinese {C1C2...Cn}, the groups are divided into {w1w2...wm}, and the encryption index InD is { ... }, and store it in the corresponding encrypted index field fd_index of the record.
[0036] The embodiments of this invention generate encrypted indexes for encrypted data through multi-layered encryption, which has the advantages of irreversibility and extremely low probability of encryption collisions, thereby improving data security. At the same time, encrypted retrieval can be achieved by using encrypted indexes constructed with the DCFR encryption method, improving data retrieval efficiency. The encrypted indexes generated by the DCFR encryption method are relatively short in length, occupy less storage space, reduce the difficulty of data maintenance, and can also accommodate partial spelling errors in query conditions, making them suitable for scenarios with large amounts of data.
[0037] Combining a two-level retrieval mechanism, the first-level cache retrieval is based on a distributed memory cache, which has good retrieval efficiency and good scalability, and can be applied to fuzzy retrieval scenarios with large data volumes; the second-level encrypted retrieval uses encrypted index fields to complete fuzzy matching without decryption first, avoiding the risk of sensitive data leakage in the decryption process, and can be adapted to fuzzy retrieval scenarios with large data volumes.
[0038] In one optional embodiment, requesting a node in the distributed cache to perform a first-level cache retrieval based on the query keywords in the query statement includes: A second hash value is obtained by performing a hash calculation on the query keywords in the query statement; Locate the data partition corresponding to the second hash value on the node to which the distributed cache belongs, and request the node to perform a local retrieval based on the query keywords.
[0039] In this embodiment of the invention, the keywords in the query statement can be hashed first to obtain a second hash value. Then, the data partition corresponding to the second hash value is matched, and the node of the distributed cache ighite where the data is allocated is found. After that, the node is directly connected to for local retrieval.
[0040] The following is an example of key code for executing first-level cache retrieval: "@Service / / Declare this class as a Spring service layer bean (component), managed by the Spring container; public class MyCacheService { @Autowired / / Defines a public class named MyCacheService, which is automatically injected (dependency injected) by Spring with an Ignite instance; private Ignite ignite; / / Declare a private variable of type Ignite for operating the Ignite cluster; public void addCache(String key, Object value) { / / Public method: Adds data to the cache, including the key (a unique identifier for the cached data, such as the second hash value mentioned above) and the value (such as the data in the cache, such as the target data to be retrieved); IgniteCache<String, Object> cache = ignite.getOrCreateCache("myCache"); cache.put(key, value); / / Get or create a cache named "myCache", returning a cache instance with a String key and an Object value; } public Object queryCache(String key) { / / Common method: Query cached data; IgniteCache<String, Object> cache = ignite.getOrCreateCache("myCache"); / / Get or create a cache named "myCache" (if it already exists, get it directly); return cache.get(key); / / Retrieves the value from the cache based on the key and returns it; } }".
[0041] First-level cache retrieval also supports partition awareness, routing queries to data cache nodes to improve query performance. Specifically, another key code example for first-level cache retrieval is as follows: "ClientConfiguration cfg = new ClientConfiguration() / / Set the address and port of the Ignite cluster node to connect to; .setAddresses("node1_address:10800","node2_address:10800","node3_address:10800") / / The address and port of the Ignite cluster node, such as 10800; .setPartitionAwarenessEnabled(true); / / Enable partition awareness by setting it to true (enabled); try (IgniteClient client = Ignition.startClient(cfg)) { / / Get or create a cache named "myCache", specifying that the key type is Integer and the value type is String; ClientCache<Integer, String> cache = client.cache("myCache"); / / You can perform caching operations here, such as putting, retrieving, or deleting data; / / Put, get, or remove data from the cache... / / Capture all Ignite client-specific exceptions; } catch (ClientException e) { / / If an exception occurs during connection or operation, catch the ClientException error message; System.err.println(e.getMessage()); / / Print the error message; }".
[0042] If the first-level cache search finds a match, the search result is returned directly; otherwise, the second-level encrypted search is executed. Using a distributed memory cache for first-level cache retrieval can improve search efficiency.
[0043] In one optional embodiment, the query keywords in the query statement are parsed and constructed to obtain an encrypted index query value, including: The query keywords are segmented and extracted to obtain several key strings; The key string is transformed into an encrypted query based on a variable grouping mechanism to generate an encrypted index query value.
[0044] In the secondary encrypted retrieval process, the query conditions (i.e., query keywords) in the query statement are first parsed and constructed to obtain the encrypted index query value. The specific process is as follows: Suppose the query keyword is reg=s1||s2||...||s n The process involves segmenting and extracting key patterns (i.e., key strings), as follows: keyw1=s1||...||s h ; keyw2=s i ||...||s j ; keyw3=s k ||...||s t ; Among them, 1 <h<i<j<k<t≤n。
[0045] After extracting and transforming the keyword pattern, the corresponding encrypted keyword query pattern (i.e., encrypted index query value) is generated as follows: key =kx1||...||kx h ; key =kx i ||...||kx j ; key =kx k ||...||kx t ; Among them, Kx i Indicates the character 's' in the keyword pattern iThe value obtained after query transformation should be noted that the query transformation process of characters in the keyword pattern is the same as the encryption calculation in the above plaintext data encryption storage process, that is, the kGen algorithm is used for encryption, and the resulting encrypted index is the encrypted index query value after query transformation.
[0046] For example, the query statement is: SELECT The query `FROM t_user tu WHERE name LIKE '%key1key2key3%'` represents the query keyword in plaintext: `query='%key1Andkey2Andkey3%'`. The query is then transformed using the following process: `kGen(r, k1, k2) = {kx1, kx2, ..., kx}`. n}
[0047] Parse and construct the encrypted index query value as SELECT FROM t_user tu WHERE name LIKE '%key % ' OR LIKE '%key % ' OR LIKE '%key The %' parameter indicates that this parsing query is compatible with partial misspelling matching and fuzzy search. Executing this encrypted index query (in SQL) will return stored records (i.e., encrypted data) that partially or completely match the query keywords.
[0048] This invention utilizes a two-level encrypted retrieval system to perform fuzzy matching through encrypted index fields, eliminating the need for prior decryption and avoiding the risk of sensitive data leakage during the decryption process. This system is suitable for fuzzy search scenarios involving large datasets.
[0049] In one optional embodiment, the secondary encrypted retrieval results are cached in the distributed cache for retrieval filtering processing to obtain the final retrieval results, including: The secondary encrypted search results are cached in the distributed cache; In the distributed cache, the secondary encrypted retrieval result is decrypted to obtain at least one plaintext data retrieval result; Based on the query keywords, the search results of at least one plaintext data are filtered to obtain the final search results.
[0050] The secondary encrypted search results are cached in the primary search, and the encrypted search results are returned.
[0051] In this embodiment of the invention, a first-level cache is constructed for the search results returned by the second-level encrypted search (i.e., the second-level encrypted search results, including at least one encrypted data); the specific process is as follows: The secondary encrypted search results are decrypted, and the corresponding plaintext data is then combined with the query keywords of the query statement to perform precise search filtering, obtain the final search results, and return them. By segmenting the query keywords and constructing a cache key (using the same generation method as the second hash value mentioned above), and simultaneously caching the search results (including plaintext data) obtained through precise search filtering into the value corresponding to the cache key, a first-level cache is achieved. An example of the execution code is as follows: public Object queryCache(String key) { / / Define a public method that takes a string key as input and returns an object; IgniteCache<String, Object> cache = ignite.getOrCreateCache("myCache"); / / Get or create a cache named "myCache" from the Ignite instance, where the keys are string types and the values are object types; return cache.get(key); / / Retrieves the value from the cache using the given key and returns it; }".
[0052] Subsequently, the corresponding search results can be obtained directly by performing a first-level cache search in the first-level cache, without the need for a second-level encrypted search, thus improving search efficiency.
[0053] Since the encrypted data has already been preliminarily retrieved in the secondary ciphertext search and precise retrieval and filtering have also been performed in the primary cache, the data in the primary cache is only a small part of the total database data, which can reduce memory usage. At the same time, it is not necessary to decrypt all encrypted data before retrieval; only a small amount of encrypted data returned by the secondary ciphertext search in the primary cache needs to be decrypted, which can reduce decryption overhead.
[0054] Furthermore, the cache expiration time can be set in the first-level cache to ensure that the cached data is not too large. Moreover, the first-level cache is a distributed cache called Ignite, which supports scalability to cope with massive amounts of data.
[0055] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows: The introduction of a two-level hierarchical retrieval mechanism enables partition awareness and good scalability through first-level cache retrieval, achieving efficient and accurate retrieval capabilities. Second-level encrypted retrieval, based on encrypted index fields, allows for fuzzy matching without prior decryption, resulting in efficient and accurate retrieval effects with a wide range of applications.
[0056] In the secondary encrypted retrieval stage, a variable grouping method and the DCFR algorithm are used to construct encrypted index query values, enabling fast and efficient secondary encrypted retrieval. In the primary caching stage, the secondary encrypted retrieval results are precisely filtered, returned, and a primary cache is built to achieve efficient and accurate retrieval, providing effective support for system service retrieval queries and daily data maintenance. Simultaneously, the DCFR algorithm preserves some logical relationships and the overall logical order between keywords, and can accommodate queries with partial spelling errors. This allows the secondary encrypted retrieval to have both partial spelling error tolerance and efficient and accurate retrieval capabilities, improving query performance.
[0057] See Figure 3 , Figure 3 This is a structural block diagram of a hierarchical retrieval device for encrypted data provided in an embodiment of the present invention. The hierarchical retrieval device for encrypted data includes: The first-level cache retrieval module 11 is used to request the nodes of the distributed cache to perform a first-level cache retrieval based on the query keywords in the query statement when the query statement indicates that encrypted data should be retrieved. The parsing and construction module 12 is used to parse and construct the query keywords in the query statement to obtain the encrypted index query value when the first-level cache retrieval query fails. The secondary encrypted retrieval module 13 is used to perform a secondary encrypted retrieval based on the encrypted index query value, obtain the secondary encrypted retrieval result, and cache the secondary encrypted retrieval result in the distributed cache for retrieval filtering processing to obtain the final retrieval result.
[0058] In an optional embodiment, the device further includes: The first encryption module is used to encrypt plaintext data to obtain encrypted data, and store the encrypted data in the encrypted field of the target database; The second encryption module encrypts each field of the plaintext data using a variable grouping mechanism, constructs an encryption index for the encrypted data, and stores the encryption index in the encryption index field corresponding to the encrypted field.
[0059] In one optional embodiment, the second encryption module includes: A character grouping unit is used to group the characters of the plaintext data to obtain multiple character groups; A general hash encryption unit is used to perform general hash encryption processing on each of the character groups to obtain a first hash value for each of the character groups; A keyword generation unit is used to perform keyword generation processing on the first hash value to generate keywords corresponding to the first hash value; The format-preserving encryption unit is used to perform format-preserving encryption processing on the keyword to obtain the group index of the corresponding character group; An encrypted index construction unit is used to concatenate the grouping indices of each character group to obtain the encrypted index.
[0060] In one optional embodiment, the first-level cache retrieval module 11 includes: A hash calculation unit is used to perform hash calculation on the query keywords in the query statement to obtain a second hash value; The node retrieval request unit is used to find the data partition corresponding to the second hash value on the node to which the distributed cache belongs, and to request the node to perform a local retrieval based on the query keywords.
[0061] In an optional embodiment, the parsing construction module 12 includes: The keyword segmentation extraction unit is used to segment and extract keywords from the query keywords to obtain several key strings; The encrypted query conversion unit is used to perform encrypted query conversion on the key string based on a variable grouping mechanism to generate an encrypted index query value.
[0062] In one optional embodiment, the secondary encrypted retrieval module 13 includes: A secondary encrypted search result caching unit is used to cache the secondary encrypted search results in the distributed cache; The retrieval result decryption unit is used to decrypt the secondary ciphertext retrieval result in the distributed cache to obtain at least one plaintext data retrieval result; The search result filtering unit is used to perform search filtering processing on the search results of the at least one plaintext data based on the query keywords, so as to obtain the final search results.
[0063] It should be noted that the working process of each module in the hierarchical retrieval device for encrypted data described in the embodiments of the present invention can refer to the working process of the hierarchical retrieval method for encrypted data described in the above embodiments, and the technical effect achieved is the same as that of the hierarchical retrieval method for encrypted data described in the above embodiments, which will not be repeated here.
[0064] See Figure 4 , Figure 4This is a structural block diagram of a hierarchical retrieval device for encrypted data provided in an embodiment of the present invention. The hierarchical retrieval device for encrypted data includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the various embodiments of the hierarchical retrieval method for encrypted data described above, such as steps S11 to S13.
[0065] For example, the computer program may be divided into one or more modules or units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules or units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the hierarchical retrieval device for encrypted data.
[0066] The hierarchical retrieval device for encrypted data may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of a hierarchical retrieval device for encrypted data and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the hierarchical retrieval device for encrypted data may also include input / output devices, network access devices, buses, etc.
[0067] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the hierarchical retrieval device for encrypted data, connecting various parts of the device via various interfaces and lines.
[0068] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the encrypted data hierarchical retrieval device by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.
[0069] If the modules or units integrated into the hierarchical retrieval device for encrypted data are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.
[0070] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.
[0071] The above description represents the preferred embodiments of the present invention. It should be noted that, for those skilled in the art, various improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.
Claims
1. A hierarchical retrieval method for encrypted data, characterized in that, include: When a query statement indicates that encrypted data should be retrieved, the nodes of the distributed cache are requested to perform a first-level cache retrieval based on the query keywords in the query statement. If the query fails to find the first-level cache, the query keywords in the query statement are parsed and constructed to obtain the encrypted index query value. A secondary encrypted retrieval is performed based on the encrypted index query value to obtain the secondary encrypted retrieval result. The secondary encrypted retrieval result is then cached in the distributed cache for retrieval filtering processing to obtain the final retrieval result.
2. The hierarchical retrieval method for encrypted data as described in claim 1, characterized in that, The process of storing the encrypted data includes: The plaintext data is encrypted to obtain encrypted data, and the encrypted data is stored in the encrypted field of the target database; Each field of the plaintext data is encrypted using a variable grouping mechanism, an encrypted index of the encrypted data is constructed, and the encrypted index is stored in the encrypted index field corresponding to the encrypted field.
3. The hierarchical retrieval method for encrypted data as described in claim 2, characterized in that, Each field of the plaintext data is encrypted using a variable block mechanism, and an encrypted index of the encrypted data is constructed, including: The plaintext data is grouped into multiple character groups; Perform general hash encryption on each of the character groups to obtain the first hash value of each of the character groups; Perform keyword generation processing on the first hash value to generate the corresponding keyword for the first hash value; The keywords are subjected to format-preserving encryption to obtain the group index of the corresponding character groups; The encryption index is obtained by concatenating the group indices of each character group.
4. The hierarchical retrieval method for encrypted data as described in claim 1, characterized in that, Based on the query keywords in the query statement, request the distributed cache nodes to perform a first-level cache retrieval, including: A second hash value is obtained by performing a hash calculation on the query keywords in the query statement; Locate the data partition corresponding to the second hash value on the node to which the distributed cache belongs, and request the node to perform a local retrieval based on the query keywords.
5. The hierarchical retrieval method for encrypted data as described in claim 1, characterized in that, The query keywords in the query statement are parsed and constructed to obtain the encrypted index query value, including: The query keywords are segmented and extracted to obtain several key strings; The key string is transformed into an encrypted query based on a variable grouping mechanism to generate an encrypted index query value.
6. The hierarchical retrieval method for encrypted data as described in claim 4, characterized in that, The secondary encrypted search results are cached in the distributed cache for retrieval filtering to obtain the final search results, including: The secondary encrypted search results are cached in the distributed cache; In the distributed cache, the secondary encrypted retrieval result is decrypted to obtain at least one plaintext data retrieval result; Based on the query keywords, the search results of at least one plaintext data are filtered to obtain the final search results.
7. A hierarchical retrieval device for encrypted data, characterized in that, include: The first-level cache retrieval module is used to request the nodes of the distributed cache to perform a first-level cache retrieval based on the query keywords in the query statement when the query statement indicates that encrypted data should be retrieved. The parsing and construction module is used to parse and construct the query keywords in the query statement to obtain the encrypted index query value when the query is not found in the first-level cache. The secondary encrypted retrieval module is used to perform a secondary encrypted retrieval based on the encrypted index query value, obtain the secondary encrypted retrieval result, and cache the secondary encrypted retrieval result in the distributed cache for retrieval filtering processing to obtain the final retrieval result.
8. A hierarchical retrieval device for encrypted data, characterized in that, include: A processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the hierarchical retrieval method for encrypted data as described in any one of claims 1 to 6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the hierarchical retrieval method for encrypted data as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the hierarchical retrieval method for encrypted data as described in any one of claims 1 to 6.