Encrypted data query method, device, storage medium, processor and terminal device

Abstract

Embodiments of the present invention disclose an encrypted data query method, apparatus, storage medium, processor, and terminal device, belonging to the field of encrypted data processing. The encrypted data query method includes: obtaining a ciphertext to be queried and a first preset ciphertext stored in a first target node; decrypting the ciphertext to be queried and the first preset ciphertext in a trusted execution environment to obtain a target key value to be queried and multiple first preset key values ​​arranged in order of size; in the trusted execution environment, using preset query logic to query the target key value from the multiple first preset key values ​​to obtain a first query result; and outputting the first query result. The present invention solves the technical problem of low query efficiency in related technologies when querying encrypted data stored in a multi-node data structure.

Description

Technical Field

[0001] The present invention relates to the field of encrypted data processing, and in particular to an encrypted data query method, device, storage medium, processor and terminal equipment. Background Art

[0002] B-Tree (multi-way search tree) is a common data structure, often used for database indexing and boasting high overall efficiency. B+Tree, a variant of B-Tree, uses fewer disk reads and writes, offers more stable query efficiency, and facilitates range queries, making it widely used in database indexing.

[0003] When using B-Tree, B+Tree or other similar data structures to store data, several nodes are generated. These nodes are used to store content. The arrangement relationship between the key values ​​of the data within the node and the arrangement relationship between the key values ​​of the data between nodes can facilitate data search operations. When using a multi-node data structure such as B-Tree or B+Tree to store encrypted data, when it is necessary to operate on the encrypted data, it is necessary to first perform a ciphertext query operation. In the related art, when querying encrypted data stored in such a multi-node data structure, it is necessary to switch to a trusted execution environment for data comparison operations for each data in each node, so the trusted execution environment needs to be called frequently. For example, when querying data in a node of a B-Tree or B+Tree, it is necessary to input each ciphertext in the node into the trusted execution environment in turn for decryption and comparison with the ciphertext to be queried. This brings a large trusted execution environment call overhead, resulting in low query efficiency.

[0004] Therefore, in the related art, the query efficiency when querying encrypted data stored in a multi-node data structure is low. Currently, no effective solution has been proposed to the above problem.

[0005] The above information disclosed in the Background section is only intended to enhance the understanding of the background technology of the technology described herein. Therefore, the Background section may contain some information that does not form the known prior art for those skilled in the art. Summary of the Invention

[0006] Embodiments of the present invention provide an encrypted data query method, apparatus, storage medium, processor, and terminal device to at least solve the technical problem in related technologies of low query efficiency when querying encrypted data stored in a multi-node data structure.

[0007] According to a first aspect of an embodiment of the present invention, there is provided an encrypted data query method for querying a ciphertext stored in a preset data structure, the preset data structure storing the ciphertext in the form of a key-value pair, the preset data structure including multiple nodes, multiple key values ​​belonging to the same node being arranged in order of size, and a preset size relationship being present between the key values ​​of at least two nodes, the encrypted data query method comprising: obtaining a ciphertext to be queried and a first preset ciphertext stored in a first target node, the first target node being any node of the preset data structure; decrypting the ciphertext to be queried and the first preset ciphertext in a trusted execution environment to obtain a target key value to be queried and multiple first preset key values ​​being arranged in order of size; in the trusted execution environment, using a preset query logic to query a target key value from multiple first preset key values ​​to obtain a first query result; outputting the first query result, the first query result including at least result identification information and position identification information, the result identification information representing whether the target key value is found in the multiple first preset key values, and the position identification information being used to indicate the position to which the target key value belongs.

[0008] Furthermore, in a trusted execution environment, a preset query logic is used to query a target key value from multiple first preset key values, including: determining whether the target key value exists in the multiple first preset key values ​​to obtain result identification information; in a case where the target key value exists in the multiple first preset key values, determining the position identification information based on the size relationship between the target key value and the multiple first preset key values; in a case where the target key value does not exist in the multiple first preset key values, determining the position identification information based on the first size relationship and the second size relationship, the first size relationship being the size relationship between the target key value and the multiple first preset key values, and the second size relationship being the size relationship between at least one first preset key value and at least one key value of other nodes.

[0009] Furthermore, when the result identification information indicates that the target key value is not found in the multiple first preset key values, the encrypted data query method also includes: determining the second target node based on the location identification information; obtaining the second preset ciphertext stored in the second target node; decrypting the second preset ciphertext in a trusted execution environment to obtain multiple second preset key values ​​arranged in order of size; and querying the target key value from the multiple second preset key values.

[0010] Furthermore, the ciphertext to be queried or the first preset ciphertext is decrypted in a trusted execution environment, including: determining whether the decryption result corresponding to the ciphertext to be queried or the first preset ciphertext is stored in the decryption cache; if the decryption result is stored in the decryption cache, obtaining the decryption result from the decryption cache.

[0011] Furthermore, decrypting the query ciphertext or the first preset ciphertext in a trusted execution environment also includes: when the decryption result is not stored in the decryption cache, using the preset decryption logic to decrypt the query ciphertext or the first preset ciphertext to obtain the decryption result; and storing the decryption result in the decryption cache.

[0012] Furthermore, a preset query logic is used to query the target key value from multiple first preset key values, including: obtaining an identifier of the target query function; determining a pointer corresponding to the target query function based on the identifier; and using the pointer to call the target query function to query the target key value from multiple first preset key values.

[0013] Furthermore, when the trusted execution environment can access the host memory, obtaining the first preset ciphertext stored in the first target node includes: obtaining the memory address corresponding to the first preset ciphertext; when the trusted execution environment cannot access the host memory, obtaining the first preset ciphertext stored in the first target node includes: copying the first preset ciphertext to the trusted execution environment.

[0014] According to a second aspect of an embodiment of the present invention, an encrypted data query device is also provided for querying ciphertext stored in a preset data structure, the preset data structure storing ciphertext in the form of key-value pairs, the preset data structure including multiple nodes, multiple key values ​​belonging to the same node arranged in order of size, and a preset size relationship between the key values ​​of at least two nodes. The encrypted data query device includes: a first acquisition unit, used to obtain the ciphertext to be queried and the first preset ciphertext stored in the first target node, the first target node being any node of the preset data structure; a first decryption unit, used to decrypt the ciphertext to be queried and the first preset ciphertext in a trusted execution environment to obtain a target key value to be queried and multiple first preset key values ​​arranged in order of size; the first query unit, used to query the target key value from the multiple first preset key values ​​in the trusted execution environment using preset query logic to obtain a first query result; an output unit, used to output the first query result, the first query result including at least result identification information and position identification information, the result identification information indicating whether the target key value is found in the multiple first preset key values, and the position identification information indicating the position to which the target key value belongs.

[0015] Furthermore, the first query unit includes: a first query module for determining whether a target key value exists in a plurality of first preset key values ​​to obtain result identification information; a second query module for determining position identification information based on a size relationship between the target key value and a plurality of first preset key values ​​when the target key value exists in a plurality of first preset key values; the second query module is also used to determine position identification information based on a first size relationship and a second size relationship when the target key value does not exist in a plurality of first preset key values, the first size relationship being a size relationship between the target key value and a plurality of first preset key values, and the second size relationship being a size relationship between at least one first preset key value and at least one key value of other nodes; the encrypted data query device also includes: a determination unit for determining a second target node based on the position identification information when the result identification information indicates that the target key value is not found in a plurality of first preset key values; a second acquisition unit for acquiring a second preset ciphertext stored in the second target node; a second decryption unit for decrypting the second preset ciphertext in a trusted execution environment to obtain a plurality of second preset key values ​​arranged in order of size; the second query unit for A target key value is searched from multiple second preset key values; the first decryption unit includes: a first determination module, used to determine whether the decryption cache stores the decryption result corresponding to the ciphertext to be queried or the first preset ciphertext; a first acquisition module, used to obtain the decryption result from the decryption cache if the decryption result is stored in the decryption cache; the first decryption unit also includes: a decryption module, used to use the preset decryption logic to decrypt the ciphertext to be queried or the first preset ciphertext to obtain the decryption result if the decryption result is not stored in the decryption cache; a storage module, used to store the decryption result in the decryption cache; the first query unit includes: a second acquisition module, used to obtain an identifier of the target query function; a second determination module, used to determine the pointer corresponding to the target query function based on the identifier; a third query module, used to use the pointer to call the target query function to query the target key value from multiple first preset key values; the first acquisition unit includes: a third acquisition module, used to obtain the memory address corresponding to the first preset ciphertext when the trusted execution environment can access the host memory; and a copy module, used to copy the first preset ciphertext to the trusted execution environment when the trusted execution environment cannot access the host memory.

[0016] According to a third aspect of an embodiment of the present invention, a non-volatile storage medium is further provided, wherein the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above-mentioned encrypted data query method.

[0017] According to a fourth aspect of an embodiment of the present invention, a processor is further provided, wherein the processor is used to run a program, wherein the above-mentioned encrypted data query method is executed when the program is running.

[0018] According to a fifth aspect of an embodiment of the present invention, a terminal device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the above-mentioned encrypted data query method.

[0019] The encrypted data query method of the embodiment of the present invention, after obtaining the ciphertext to be queried and the first preset ciphertext stored in the first target node, will decrypt both in a trusted execution environment. Since the first preset ciphertext stored in the first target node is stored in the form of a key-value pair according to a preset data structure, after decrypting the ciphertext to be queried and the first preset ciphertext in the trusted execution environment, the target key value to be queried and multiple first preset key values ​​can be correspondingly obtained. The target key value is the key value of the plaintext corresponding to the ciphertext to be queried, and the plaintext data corresponding to the ciphertext to be queried is the value value corresponding to the key value. The multiple first preset key values ​​are the key values ​​of the plaintexts corresponding to the multiple first preset ciphertexts stored in the first target node. Correspondingly, the plaintext data corresponding to the multiple first preset ciphertexts are multiple value values, and the multiple first preset key values ​​are arranged in order of size (for example, from small to large). In this way, by comparing the target key value with multiple first preset key values ​​according to the preset query logic, it is possible to determine whether the first target node stores content identical to the ciphertext to be queried, thereby obtaining result identification information. Furthermore, based on the size relationship between the target key value and the multiple first preset key values, as well as the preset size relationship between the node key values, the location of the ciphertext to be queried in the first target node or the location of other nodes where it resides can be determined, thereby obtaining location identification information, facilitating subsequent operations such as insertion, deletion, and update related to the ciphertext to be queried. The location identification information can be information indicating the location of the ciphertext to be queried in the first target node or information indicating other nodes where the ciphertext to be queried resides. Using this encrypted data query method, during the query process for the first target node, the ciphertext to be queried and the first preset ciphertext are decrypted in the trusted execution environment to obtain the target key value and multiple first preset key values, and then the target key value is retrieved from the multiple first preset key values ​​within the trusted execution environment. Therefore, the entire query process only requires a single call to the trusted execution environment to query the data within the first target node and return the query result. Compared with the method in related technologies of calling the trusted execution environment once for decryption query when querying and comparing each data in a node, this method effectively reduces the number of calls to the trusted execution environment, which is beneficial to saving the overhead brought by the trusted execution environment switching process, and can effectively improve the query efficiency of encrypted data stored in multi-node data structures such as B-Tree or B+Tree, solving the technical problem of low query efficiency when querying encrypted data stored in multi-node data structures in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0021] Figure 1 A schematic diagram of a flow chart of an encrypted data query method provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of an encrypted data query device provided by an embodiment of the present invention;

[0023] Figure 3 A partial schematic diagram of an encrypted data query method provided by an embodiment of the present invention during implementation. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present invention are used to distinguish different objects rather than to limit a specific order.

[0026] Figure 1 is an encrypted data query method according to an embodiment of the present invention, such as Figure 1 As shown, the method is used to query ciphertext stored in a preset data structure. The preset data structure stores ciphertext in the form of key-value pairs. The preset data structure includes multiple nodes. Multiple key values ​​belonging to the same node are arranged in order of size. There is a preset size relationship between the key values ​​of at least two nodes. The encrypted data query method of the embodiment of the present invention includes the following steps:

[0027] Step S102: obtaining a ciphertext to be queried and a first preset ciphertext stored in a first target node, where the first target node is any node in a preset data structure;

[0028] Step S104: decrypting the ciphertext to be queried and the first preset ciphertext in the trusted execution environment to obtain a target key value to be queried and a plurality of first preset key values ​​arranged in order of size.

[0029] Step S106: In the trusted execution environment, using a preset query logic, querying a target key value from a plurality of first preset key values ​​to obtain a first query result;

[0030] Step S108: output a first query result, which includes at least result identification information and location identification information. The result identification information indicates whether the target key value is found in the multiple first preset key values, and the location identification information is used to indicate the location of the target key value.

[0031] The encrypted data query method of an embodiment of the present invention, after obtaining the ciphertext to be queried and the first preset ciphertext stored in the first target node (i.e., the ciphertext data stored in the first target node), will decrypt both in a trusted execution environment (i.e., Trusted Execution Environment, TEE for short). Since the first preset ciphertext stored in the first target node is stored in the form of a key-value pair according to a preset data structure, after decrypting the ciphertext to be queried and the first preset ciphertext in the trusted execution environment, the target key value to be queried and multiple first preset key values ​​can be obtained accordingly. The target key value is the key value corresponding to the data in the ciphertext to be queried, that is, the key value of the plaintext corresponding to the ciphertext to be queried, and the plaintext data corresponding to the ciphertext to be queried is the value value corresponding to the key value; the multiple first preset key values ​​are multiple key values ​​corresponding to the multiple data stored in the first target node, that is, the key values ​​of several plaintexts corresponding to the multiple ciphertext data stored in the first target node. Accordingly, the plaintext data corresponding to the multiple ciphertext data is multiple value values, and the multiple first preset key values ​​are arranged in order of size (for example, from small to large). In this way, by comparing the target key value with multiple first preset key values ​​according to the preset query logic, it is possible to determine whether the first target node stores content identical to the ciphertext to be queried, thereby obtaining result identification information. Furthermore, based on the size relationship between the target key value and the multiple first preset key values, as well as the preset size relationship between key values ​​between nodes, the location of the ciphertext to be queried in the first target node or the location of other nodes where it resides can be determined, thereby obtaining location identification information, facilitating subsequent operations such as insertion, deletion, and update related to the ciphertext to be queried. The location identification information can be information indicating the location of the ciphertext to be queried in the first target node or information indicating other nodes where the ciphertext to be queried resides. Using this encrypted data query method, during the query process for the first target node, the ciphertext to be queried and the first preset ciphertext are decrypted in the trusted execution environment to obtain the target key value and multiple first preset key values, and then the target key value is retrieved from the multiple first preset key values ​​within the trusted execution environment. Therefore, the entire query process only requires a single call to the trusted execution environment to query the data within the first target node and return the query results. Compared with the method in related technologies of calling the trusted execution environment once for decryption query when querying and comparing each data in a node, this method effectively reduces the number of calls to the trusted execution environment, which is beneficial to saving the overhead brought by the trusted execution environment switching process, and can effectively improve the query efficiency of encrypted data stored in multi-node data structures such as B-Tree or B+Tree, solving the technical problem of low query efficiency when querying encrypted data stored in multi-node data structures in related technologies.

[0032] The aforementioned trusted execution environment is an independent processing environment with computing and storage capabilities that provides security and integrity protection. Its basic concept is to allocate a separate, isolated memory block for sensitive data in the hardware. All sensitive data computations are performed within this memory block, and no other hardware components, except authorized interfaces, can access the information in this isolated memory block. This enables private computing of sensitive data and ensures data security. A preset size relationship exists between the key values ​​of at least two of the aforementioned nodes, meaning that a certain size relationship exists between the key values ​​of multiple nodes in a preset data structure. The preset data structure may include, but is not limited to, data structures such as B-Tree or B+Tree. The definition of the preset data structure given above is: a preset data structure stores ciphertext in the form of key-value pairs, includes multiple nodes, and multiple key values ​​belonging to the same node are arranged in order of size. A preset size relationship exists between the key values ​​of at least two nodes. Any data structure that meets these conditions can be considered a preset data structure.

[0033] Furthermore, the encrypted data query method employing the aforementioned approach avoids the inefficiency of queries caused by frequent calls to the trusted execution environment. Instead of placing all data query logic within the trusted execution environment, it only places query operations within a single node within the trusted execution environment. This eliminates the need for system calls to lock and read and write disks within the trusted execution environment. Furthermore, the method also maintains a sufficiently small trusted computing base (TCB, a collection of all security protection mechanisms for computer system security, which can be implemented in the form of hardware, firmware, and software). The TCB represents a secure execution environment, and its size directly impacts the security of the TEE. A smaller TCB requires less trust and verification, which helps minimize the impact on TEE security. The aforementioned node is an object that stores data, such as an area on a disk. It can store encrypted data or simply address information corresponding to the encrypted data.

[0034] In this embodiment, in a trusted execution environment, a preset query logic is used to query a target key value from multiple first preset key values, including: determining whether the target key value exists in the multiple first preset key values ​​to obtain result identification information; in a case where the target key value exists in the multiple first preset key values, determining the position identification information based on the size relationship between the target key value and the multiple first preset key values; in a case where the target key value does not exist in the multiple first preset key values, determining the position identification information based on the first size relationship and the second size relationship, the first size relationship being the size relationship between the target key value and the multiple first preset key values, and the second size relationship being the size relationship between at least one first preset key value and at least one key value of other nodes.

[0035] For example, in one specific embodiment, the ciphertext to be queried is stored using a B-Tree or B+Tree data structure. This data structure generates a large number of nodes when storing data, including root nodes, intermediate nodes, and leaf nodes from top to bottom. In related art, when querying ciphertext stored using this data structure, when querying each node, the ciphertext to be queried and the ciphertext corresponding to each data in the node need to be sequentially input into the trusted execution environment for decryption and comparison. Therefore, the query for each node requires multiple calls to the trusted execution environment. This method of frequently inputting the ciphertext to be queried and each ciphertext in the node into the trusted execution environment for decryption and comparison brings about a large trusted execution environment call overhead, resulting in low query efficiency. In the embodiment of the present invention, when querying each node (taking the first target node as an example), the ciphertext to be queried and the first preset ciphertext stored in the first target node are input into a trusted execution environment, wherein the target key value and multiple first preset key values ​​correspond to a number of ciphertext data stored in the first target node, and the multiple first preset key values ​​are arranged in order of size. By comparing the target key value with the multiple first preset key values ​​in the trusted execution environment, a first query result can be obtained and output. The first query result includes result identification information and position identification information. The result identification information is used to indicate whether the target key value is found in the multiple first preset key values, and the position identification information is used to indicate the location of the target key value, thereby realizing the query operation on the ciphertext to be queried. When performing ciphertext query in this way, only one call to the trusted execution environment is required for each node, which effectively reduces the trust execution environment call overhead and improves query efficiency.

[0036] In the process of querying the target key value from multiple first preset key values ​​using the preset query logic, it can be determined whether the target key value exists in the multiple first preset key values, thereby determining the result identification information. Since the multiple first preset key values ​​are arranged in order of size, the position identification information can be determined by comparing the size relationship between the target key value and the multiple first preset key values. For example, the first query result returned may include an offset (position identification information) and an identification of whether the data is found (result identification information). This offset represents the data position in the node closest to the ciphertext to be queried (if the data is found, this offset is the position of the ciphertext, otherwise it can be the data position that is smaller than the ciphertext to be queried and is expected to be closest). For example, the first target node contains data 2, 4, 6, and 8, and the data positions correspond to 0, 1, 2, and 3 respectively. If the data to be queried is 5, the binary search will return the position of data 4 (that is, 1) and the data no hit identification; if the data to be queried is 6, then the position of data 6 (that is, 2) and the data hit identification will be directly returned.

[0037] Since searching the first target node may not necessarily result in the searched ciphertext being found, in this embodiment, when the result identification information indicates that the target key value is not found in the multiple first preset key values, the encrypted data query method further includes: determining a second target node based on the location identification information; obtaining a second preset ciphertext stored in the second target node; decrypting the second preset ciphertext in a trusted execution environment to obtain multiple second preset key values ​​arranged in order of size; and searching for the target key value from the multiple second preset key values.

[0038] That is to say, in this embodiment, the result identification information can be used to indicate the location of the node to which the target key value belongs. After querying the first target node using the above method, if it is found that there is no target key value among multiple first preset key values, that is, the first target node does not store the ciphertext to be queried. The child node (second target node) to which the ciphertext to be queried belongs can be determined based on the size relationship between the target key value and each first preset key value. After locating the second target node, the trusted execution environment is called again to query the second target node to further implement fine-grained query operations. Of course, this process can be refined layer by layer and repeated until the ciphertext to be queried is found in a certain node, or if the ciphertext to be queried is still not found after querying the leaf node, the query logic can be terminated, thereby conveniently implementing the query of encrypted data.

[0039] The following describes the encrypted data query method described above with reference to a specific embodiment:

[0040] For example, when using a preset data structure to store encrypted data, at least five nodes A, B, C, D, and E are generated. The key values ​​of the data stored in node A are 15 and 35, the key values ​​of the data stored in node B are 6 and 10, the key values ​​of the data stored in node C are 24 and 30, the key values ​​of the data stored in node D are 42 and 53, and the key values ​​of the data stored in node E are 26 and 28. It can be seen that the key values ​​corresponding to the data in different nodes have a certain size relationship. For example, the key values ​​of the data stored in node B are all smaller than the minimum value 15 of the key values ​​in node A, the key values ​​of the data stored in node C are all between the maximum value 35 and the minimum value 15 of the key values ​​stored in node A, and the key values ​​of the data stored in node D are all larger than the maximum value 35 of the key values ​​in node A. This belongs to the above-mentioned "there is a preset size relationship between the key values ​​of at least two nodes". Of course, the size relationship mentioned here is not limited to the above-mentioned examples. It is clear that the size relationship of the key values ​​between nodes is used to locate the query target to another node according to the query results, that is, according to the size relationship between the target key value and multiple first preset key values, the key value range of the target key value can be determined, and then the node where it is located can be determined. As long as this condition is met, it can be regarded as "there is a preset size relationship between the key values ​​of at least two nodes". In this embodiment, if you want to query data with a key value of 28, start the query from node A. At this time, 28 is the target key value, node A is the first target node, and the key values ​​15 and 35 of the data in node A are the first preset key values. By querying the target key value 28 from the first preset key values ​​15 and 35, you can get the first query result. Since there is no key value 28 in node A, the result identification information of the first query result indicates that the target key value was not found in the multiple first preset key values. And since the key values ​​of node A, node B, node C, node D, and node E have the above-mentioned preset size relationship, the target key value 28 can be located at the node with a key value range between 15 and 35. Therefore, the position identification information obtained by the query indicates that the target key value 28 belongs to node C. In this way, in the process of further searching, the query target can be located at node C, narrowing the search range. During further searches, node C is determined to be the second target node based on the location identifier information. The key values ​​24 and 30 corresponding to the data stored in node C are the second preset key values. By querying and comparing 24 and 30 with 28, the query result for node C can be obtained. Since there is no key value 28 in node C, and 28 is between 24 and 30, the query result for node C can locate the next target node to a node with a key value in the range of 24 to 30, that is, node E. Then, by querying node E, the target key value 28 can be hit in node E.

[0041] In this embodiment, the ciphertext to be queried or the first preset ciphertext is decrypted in a trusted execution environment, including: determining whether the decryption result corresponding to the ciphertext to be queried or the first preset ciphertext is stored in the decryption cache; if the decryption result is stored in the decryption cache, obtaining the decryption result from the decryption cache.

[0042] During the decryption process of the ciphertext to be queried or the first preset ciphertext, the decryption cache will be queried first to see if there is a corresponding decryption result. If there is a decryption result, it will be directly obtained from the decryption cache without the need for decryption. This method of directly obtaining plaintext by matching the decryption result in the decryption cache does not require re-decryption operations for some ciphertexts that have already been cached for decryption results, thereby reducing the frequency of decryption operations and thus helping to improve the overall efficiency of encrypted data queries. In this embodiment, the method of determining whether the decryption result corresponding to the ciphertext to be queried or the first preset ciphertext is stored in the decryption cache can be flexibly selected according to actual conditions, for example, it may include the following steps: determining a key value by hash function calculation based on the ciphertext to be queried or a certain first preset ciphertext; querying the hash table corresponding to the data stored in the decryption cache based on the key value; if a hit is found, it means that the corresponding decryption result has been cached; if there is no hit, it means that the corresponding decryption result has not been cached.

[0043] When the decryption result is not stored in the decryption cache, the ciphertext to be queried or the first preset ciphertext is decrypted using a preset decryption logic to obtain a decryption result; and the decryption result is stored in the decryption cache.

[0044] That is, if the decryption result is not stored in the decryption cache, the query ciphertext or the first preset ciphertext must be decrypted using the preset decryption logic. Subsequent operations such as target key value queries can then be performed. After the query ciphertext or the first preset ciphertext is decrypted, the decryption result is also stored in the decryption cache. This allows the query ciphertext or the first preset ciphertext to be directly read from the decryption cache the next time it is needed to decrypt the query ciphertext or the first preset ciphertext, eliminating the need to perform a decryption operation. This saves decryption time and improves the overall efficiency of encrypted data queries. If the decryption cache does not match the corresponding decryption result, various decryption methods can be used in actual implementation to decrypt the corresponding ciphertext. For example, in one embodiment, decrypting the query ciphertext or the first preset ciphertext using the preset decryption logic includes decrypting the query ciphertext or the first preset ciphertext using a preset decryption function.

[0045] In the specific implementation, the preset query logic is used to query the target key value from multiple first preset key values, including: obtaining the identifier of the target query function; determining the pointer corresponding to the target query function based on the identifier; using the pointer, calling the target query function to query the target key value from multiple first preset key values.

[0046] The preset query logic can be a variety of query logic, such as binary query, range query, etc., and the appropriate query method can be selected according to the query needs. By entering the identifier of the corresponding target query function, the pointer corresponding to the function can be determined and then the function can be called.

[0047] When the trusted execution environment can access the host memory, obtaining the first preset ciphertext stored in the first target node includes: obtaining the memory address corresponding to the first preset ciphertext; when the trusted execution environment cannot access the host memory, obtaining the first preset ciphertext stored in the first target node includes: copying the first preset ciphertext to the trusted execution environment.

[0048] For example, when the TEE is an environment such as Intel SGX that allows direct access to host memory within the TEE, the first preset ciphertext stored in the first target node can be successfully retrieved by simply entering the node's memory address, thereby reducing data copying operations and improving the efficiency of encrypted data query. For other TEE environments that cannot directly access host memory, this can be achieved by copying the node's first preset ciphertext into the TEE.

[0049] The following describes the encrypted data query method of the present invention by taking the encrypted data query process stored in a B-Tree or B+Tree data structure as an example and combining a specific embodiment:

[0050] Constructing B-Tree and its variant, B+Tree indexes, is a common approach that can significantly reduce the number of comparison operations during the query process, thereby improving data query performance. Ciphertext data can also be processed using B-Trees to reduce the number of ciphertext comparison operations, thereby accelerating queries. On this basis, ciphertext data processing based on a trusted execution environment (TEE) can ensure user privacy protection needs. However, the efficiency of TEE-based ciphertext data processing is affected by the overhead of TEE calls and ciphertext data encryption and decryption. Specifically, B-Tree queries and updates involve a large number of comparison operations (such as querying the location of data in a node). These ciphertext data comparison operations require decryption and comparison within the TEE, resulting in a large amount of TEE call overhead and data decryption overhead, making B-Tree operations on ciphertext data very inefficient.

[0051] This embodiment puts the query-related operations in the node into the TEE, so that each access to a node only requires one TEE call. A decryption cache module is maintained in the TEE to cache the decryption results of frequently accessed ciphertext data, thereby reducing the data decryption overhead during the query and update process. Figure 3 As shown in the figure, the B-Tree shows two layers of nodes, and the root node includes 100 and 200. After receiving the ciphertext (ciphertext to be queried), the TEE will first obtain the first preset ciphertext and the ciphertext to be queried in the top-level root node, decrypt both to obtain the target key value (for example, 220) and the two first preset key values ​​100 and 200. The decryption result will be stored in the decryption cache module. Then, the node operation module (the module contains a series of functions that query and process the data in the node, and each function has a corresponding function identifier. The identifier can be used to correspond to the query function to be called, that is, the target query function) will perform a series of comparison operations based on the query function. For example, the binary search function obtains the first query result through the comparison operation and outputs it. Since there is no 220 in the root node, the result identification information in the first query result is whether, since 220 is larger than 200, the position identification information will indicate that the ciphertext to be queried is located in the rightmost child node of the lower layer according to the key value size. Subsequently, TEE will obtain the second preset ciphertext in the child node (the second target node) and decrypt it. The ciphertext to be queried does not need to be decrypted again, and the decryption result of the ciphertext to be queried can be directly obtained through the decryption cache module. The node operation module again searches 220 in the multiple key values ​​corresponding to the second preset ciphertext according to the preset query logic, and finally hits the target in the node.

[0052] When querying or updating data in a B-Tree or B+Tree index, the child nodes are queried layer by layer from the root node according to the order relationship between the data to be processed and the data in the B-Tree, until a leaf node containing the data to be processed is found, thereby completing the relevant query or update operation. When a node (such as the first target node) is processed, the identifier of the corresponding node processing function (target query function) is passed into the TEE, and the node (the multiple first preset ciphertexts stored in the first target node) is loaded into the TEE: When the TEE is an environment such as Intel SGX that can directly access the host memory within the TEE, only the memory address of the first target node needs to be passed in; for TEE environments that cannot directly access the host memory, the multiple first preset ciphertexts of the first target node need to be copied into the TEE.

[0053] In the TEE, the corresponding function pointer is found according to the identifier of the node processing function, and then the corresponding logic is executed. During the function execution process, the data needs to be decrypted and then the relevant comparison operations are performed on the plaintext.

[0054] When processing a ciphertext data (a first preset ciphertext), it will first try to obtain the result by querying the decryption cache: when the cache hits, it directly obtains the corresponding decrypted plaintext result (decryption result); when the cache does not hit, it will call the corresponding ciphertext decryption function to obtain the plaintext and update it to the cache.

[0055] After the node processing function is executed, the corresponding result (first query result) will be passed out from the TEE. The first query result will include result identification information indicating whether the multiple first preset ciphertexts include the ciphertext to be queried and location identification information indicating the location of the target key value corresponding to the ciphertext to be queried, so as to be used for subsequent processing of the B-Tree.

[0056] In this embodiment, by placing the query function logic on the node within the TEE, the number of TEE calls is equal to the number of nodes accessed. Specifically, assuming each node contains B data and the tree height is h, the TEE call overhead of this solution is O(h). However, if this method of decrypting the query ciphertext and the first preset ciphertext in a trusted execution environment and performing a query and comparison on the target key value and multiple first preset key values ​​is not adopted, each comparison operation requires a TEE call, resulting in an overhead of O(h*logB), where logB is the number of binary searches performed within the node. Therefore, the solution of this embodiment can effectively reduce the overhead caused by TEE context switching in the query logic. Moreover, by placing only the query logic within the node within the TEE, there is no need to perform locking and disk read and write system calls within the TEE, resulting in a sufficiently small TCB. In addition, since the query logic within the node is within the TEE, it can effectively prevent the leakage of data access characteristics. In addition, by maintaining a decryption cache within the TEE, this embodiment can effectively reduce the ciphertext decryption overhead.

[0057] This embodiment transplants the query-related operations within the B-Tree node into the TEE. It only needs to call the TEE in sequence to complete the data query of a node, and maintains a decryption cache module within the TEE to cache the decryption results of frequently accessed ciphertext data. This embodiment can achieve the following technical effects: each time a node is accessed, only one TEE context switch is required, effectively reducing the TEE call overhead. The query-related operations within the B-Tree node are simple, have a small TCB and are functionally independent, and have little impact on TEE security. It has little dependence on a specific data management system and is easily adapted to the B-Tree index structure of different data management systems. By utilizing data access locality, the data decryption overhead during the query process can be effectively reduced.

[0058] Secondly, if Figure 2As shown, an embodiment of the present invention further provides an encrypted data query device for querying a ciphertext stored in a preset data structure, the preset data structure stores the ciphertext in the form of a key-value pair, the preset data structure includes multiple nodes, multiple key values ​​belonging to the same node are arranged in order of size, and there is a preset size relationship between the key values ​​of at least two nodes. The encrypted data query device includes: a first acquisition unit, used to obtain the ciphertext to be queried and the first preset ciphertext stored in the first target node, the first target node is any node of the preset data structure; a first decryption unit, used to decrypt the ciphertext to be queried and the first preset ciphertext in a trusted execution environment to obtain a target key value to be queried and multiple first preset key values ​​arranged in order of size; the first query unit, used to query the target key value from the multiple first preset key values ​​in the trusted execution environment using a preset query logic to obtain a first query result; an output unit, used to output the first query result, the first query result including at least result identification information and position identification information, the result identification information indicates whether the target key value is queried among the multiple first preset key values, and the position identification information is used to indicate the position to which the target key value belongs.

[0059] In the encrypted data query device of an embodiment of the present invention, after the first acquisition unit obtains the ciphertext to be queried and the first preset ciphertext stored in the first target node, the first decryption unit will decrypt both in a trusted execution environment, thereby obtaining the target key value to be queried and multiple first preset key values. The target key value is the key value of the plaintext corresponding to the ciphertext to be queried, and the multiple first preset key values ​​are the key values ​​of the plaintexts corresponding to the first preset ciphertext stored in the first target node. The multiple first preset key values ​​are arranged in order of size (for example, from small to large). In this way, the first query unit compares the target key value with the multiple first preset key values ​​according to the preset query logic to determine whether the first target node stores the same content as the ciphertext to be queried, that is, the result identification information; and based on the size relationship between the target key value and the multiple first preset key values, and the preset size relationship between the key values ​​of the nodes, the position of the ciphertext to be queried in the first target node or the position of other nodes where it is located can be determined, that is, the position identification information is obtained, which facilitates the subsequent insertion, deletion, update and other operations related to the ciphertext to be queried on the first target node. That is, the location identification information can be information indicating the location of the ciphertext to be queried within the first target node, or information indicating the subnode where the ciphertext to be queried is located. When querying the first target node, an encrypted data query device employing this configuration decrypts the ciphertext to be queried and the first preset ciphertext within the trusted execution environment, obtaining a target key value and multiple first preset key values, and then searches for the target key value from the multiple first preset key values ​​within the trusted execution environment. Therefore, the entire query process only requires a single call to the trusted execution environment to query the data within the first target node and return the query results. Compared to the related art method of calling the trusted execution environment once for decryption querying each piece of data within a node for query and comparison, the encrypted data query device of this embodiment effectively reduces the number of calls to the trusted execution environment, which helps save the overhead associated with the trusted execution environment switching process. It can also effectively improve the query efficiency of encrypted data stored in multi-node data structures such as B-Trees or B+Trees, resolving the technical problem of low query efficiency when querying encrypted data stored in multi-node data structures in the related art.

[0060] Moreover, the encrypted data query device using the above-mentioned configuration avoids the low query efficiency caused by frequent calls to the trusted execution environment. It only places the query operation within a single node into the trusted execution environment, rather than placing all data query logic into it. There is no need to perform locking and disk read and write system calls within the trusted execution environment. At the same time, it also has a sufficiently small trusted computing base (i.e., Trusted Computing Base, referred to as TCB, refers to the collection of all security protection mechanisms for implementing computer system security protection. The mechanism can appear in the form of hardware, firmware, and software). The TCB represents a secure execution environment, and its size directly affects the security of the TEE. The smaller the TCB, the less part that needs to be trusted and verified, which helps to reduce the security impact on the TEE. The above-mentioned node is an object that stores data, such as an area on a disk. It can store encrypted data or only store the address information corresponding to the encrypted data.

[0061] In this embodiment, the first query unit includes: a first query module for determining whether a target key value exists in a plurality of first preset key values ​​to obtain result identification information; a second query module for determining position identification information based on a size relationship between the target key value and the plurality of first preset key values ​​when the target key value exists in the plurality of first preset key values; the second query module is also used to determine position identification information based on a first size relationship and a second size relationship when the target key value does not exist in the plurality of first preset key values, wherein the first size relationship is the size relationship between the target key value and the plurality of first preset key values, and the second size relationship is the size relationship between at least one first preset key value and at least one key value of another node. In the process of querying the target key value from the plurality of first preset key values ​​using the preset query logic, it can be determined whether the target key value exists in the plurality of first preset key values, thereby determining the result identification information. Since multiple first preset key values ​​are arranged in order of size, when the target key value does not exist in the multiple first preset key values, the position identification information can be determined by comparing the size relationship between the target key value and the multiple first preset key values; when the target key value does not exist in the multiple first preset key values, since the multiple first preset key values ​​in the first target node are arranged in order of size, and there is a preset size relationship between the key values ​​of different nodes, the position identification information is determined based on the first size relationship and the second size relationship, the first size relationship is the size relationship between the target key value and the multiple first preset key values, and the second size relationship is the size relationship between at least one first preset key value and at least one key value of other nodes. For example, the first query result returned may include an offset (position identification information) and an identification of whether the data is found (result identification information). This offset indicates the data position in the node that is closest to the ciphertext to be queried (if the data is found, this offset is the position of the ciphertext; otherwise, it can be the data position that is smaller than the ciphertext to be queried and is expected to be closest). For example, the first target node contains data 2, 4, 6, and 8, and the data positions correspond to 0, 1, 2, and 3 respectively. The data to be queried is 5. According to the binary search, the position of data 4 (that is, 1) and the data no-hit flag will be returned; if the data to be queried is 6, the position of data 6 (that is, 2) and the data hit flag will be directly returned.

[0062] Since the ciphertext to be queried may not be found after searching the first target node, the ciphertext to be queried may be in other nodes (for example, a child node in the lower layer of the first target node). In this embodiment, the encrypted data query device also includes: a determination unit, which is used to determine the second target node according to the position identification information when the result identification information indicates that the target key value is not found in the multiple first preset key values, and the second target node is a child node of the first target node; a second acquisition unit, which is used to obtain the second preset ciphertext stored in the second target node; a second decryption unit, which is used to decrypt the second preset ciphertext in a trusted execution environment to obtain multiple second preset key values ​​arranged in order of size; and a second query unit, which is used to query the target key value from the multiple second preset key values. That is, in this embodiment, the result identification information can be used to indicate the location of the node to which the target key value belongs. After querying the first target node using the above device, if it is found that the target key value is not found in the multiple first preset key values, that is, the ciphertext to be queried is not stored in the first target node. The node to which the ciphertext to be queried belongs (the second target node) can be determined based on the size relationship between the target key value and each first preset key value, as well as the size relationship between the key values ​​of each node. After locating the node, the trusted execution environment is called again to query the second target node to further implement fine-grained query operations. Of course, this process can be repeated layer by layer until the ciphertext to be queried is found in a certain node, or if the ciphertext to be queried is still not found after querying the leaf node (the bottom node), the query logic can be terminated, thereby conveniently implementing the query of encrypted data.

[0063] The first decryption unit includes: a first determination module for determining whether a decryption result corresponding to the queried ciphertext or a first preset ciphertext is stored in the decryption cache; and a first retrieval module for retrieving the decryption result from the decryption cache if the decryption result is stored in the decryption cache. In this embodiment, during the decryption of the queried ciphertext or the first preset ciphertext, the decryption cache is first queried for a corresponding decryption result. If a decryption result is present, the decryption result is directly retrieved from the decryption cache without decryption. This method of directly retrieving plaintext by matching the decryption result in the decryption cache eliminates the need to perform a further decryption operation for ciphertexts for which decryption results are already cached, thereby reducing the frequency of decryption operations and improving overall encrypted data query efficiency. In this embodiment, determining whether a decryption result corresponding to the queried ciphertext or the first preset ciphertext is stored in the decryption cache includes: determining a key value based on the queried ciphertext or the first preset ciphertext; and querying a hash table corresponding to the data stored in the decryption cache based on the key value.

[0064] The first decryption unit also includes: a decryption module for decrypting the query ciphertext or the first preset ciphertext using a preset decryption logic to obtain a decryption result when the decryption result is not stored in the decryption cache; and a storage module for storing the decryption result in the decryption cache. In other words, when the decryption result is not stored in the decryption cache, the query ciphertext or the first preset ciphertext needs to be decrypted using the preset decryption logic. Subsequent operations such as target key value queries can then be performed. After decrypting the query ciphertext or the first preset ciphertext, the decryption result is also stored in the decryption cache. This allows the query ciphertext or the first preset ciphertext to be directly read from the decryption cache the next time it is needed to decrypt the query ciphertext or the first preset ciphertext, without having to perform the decryption operation again. This helps save decryption time and thus improves the overall efficiency of encrypted data queries.

[0065] In a specific implementation, if no corresponding decryption result is matched in the decryption cache, various decryption methods may be used to decrypt the corresponding ciphertext. For example, in one embodiment, decrypting the query ciphertext or the first preset ciphertext using a preset decryption logic includes: decrypting the query ciphertext or the first preset ciphertext using a preset decryption function.

[0066] In a specific implementation, the first query unit includes: a second acquisition module for obtaining an identifier of a target query function; a second determination module for determining a pointer corresponding to the target query function based on the identifier; and a third query module for using the pointer to call the target query function to query a target key value from a plurality of first preset key values. The preset query logic can be a variety of query logic forms, such as binary query, range query, etc., and the appropriate query method can be selected according to the query needs. By inputting the identifier of the corresponding target query function, the pointer corresponding to the function can be determined, and then the function can be called.

[0067] The first acquisition unit includes: a third acquisition module, which is used to obtain the memory address corresponding to the first preset ciphertext when the trusted execution environment can access the host memory; a copy module, which is used to copy the first preset ciphertext to the trusted execution environment when the trusted execution environment cannot access the host memory. For example, when the TEE is an environment such as Intel SGX that can directly access the host memory within the TEE, it is only necessary to pass in the memory address of the node to successfully obtain the first preset ciphertext stored in the first target node, which is conducive to reducing data copy operations and improving the efficiency of encrypted data queries. For other TEE environments that cannot directly access the host memory, this can be achieved by copying the first preset ciphertext of the node into the TEE.

[0068] In addition, an embodiment of the present invention further provides a non-volatile storage medium, wherein the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the above-mentioned encrypted data query method.

[0069] Again, an embodiment of the present invention further provides a processor, wherein the processor is used to run a program, wherein the above-mentioned encrypted data query method is executed when the program is running.

[0070] Finally, an embodiment of the present invention further provides a terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the above-described encrypted data query method. It is understood that the terminal device can be a local device or a cloud device, and thus can be used by a user to query local encrypted data or to query data stored in the cloud.

[0071] The serial numbers of the embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. Moreover, the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system, such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be performed in a different order than shown here.

[0072] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0073] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0074] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0075] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0076] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0077] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for querying encrypted data, for querying ciphertext stored in a preset data structure, wherein the preset data structure stores the ciphertext in the form of key-value pairs, the preset data structure comprising multiple nodes, multiple key values ​​belonging to the same node being arranged in order of magnitude, and a preset magnitude relationship existing between the key values ​​of at least two of the nodes, the method comprising: Obtaining a ciphertext to be queried and a first preset ciphertext stored in a first target node, where the first target node is any node in the preset data structure; Decrypting the ciphertext to be queried and the first preset ciphertext in a trusted execution environment to obtain a target key value to be queried and a plurality of first preset key values ​​arranged in order of size; Determine whether the target key value exists in the plurality of first preset key values, and obtain result identification information; If the target key value exists in the plurality of first preset key values, determining the position identification information according to a magnitude relationship between the target key value and the plurality of first preset key values; If the target key value does not exist in the multiple first preset key values, the position identification information is determined based on a first size relationship and a second size relationship, wherein the first size relationship is a size relationship between the target key value and the multiple first preset key values, and the second size relationship is a size relationship between at least one of the first preset key values ​​and at least one of the key values ​​of the other nodes; Output a first query result, the first query result at least including the result identification information and the location identification information, the result identification information represents whether the target key value is found in the multiple first preset key values, and the location identification information is used to indicate the location to which the target key value belongs.

2. The encrypted data query method according to claim 1, wherein: When the result identification information indicates that the target key value is not found in the plurality of first preset key values, the encrypted data query method further includes: Determining a second target node according to the location identification information; Obtaining a second preset ciphertext stored in the second target node; Decrypting the second preset ciphertext in the trusted execution environment to obtain a plurality of second preset key values ​​arranged in order of size; The target key value is searched from a plurality of second preset key values.

3. The encrypted data query method according to claim 1, wherein: The decrypting the ciphertext to be queried or the first preset ciphertext in the trusted execution environment includes: Determining whether a decryption result corresponding to the ciphertext to be queried or the first preset ciphertext is stored in the decryption cache; In a case where the decryption result is stored in the decryption cache, the decryption result is obtained from the decryption cache.

4. The encrypted data query method according to claim 3, wherein: The decrypting of the ciphertext to be queried or the first preset ciphertext in the trusted execution environment further includes: If the decryption result is not stored in the decryption cache, decrypt the ciphertext to be queried or the first preset ciphertext using a preset decryption logic to obtain a decryption result; The decryption result is stored in the decryption cache.

5. The encrypted data query method according to any one of claims 1 to 4, wherein: The method further comprises: Get the identifier of the target query function; Determine, according to the identifier, a pointer corresponding to the target query function; The target query function is called using the pointer to query the target key value from the multiple first preset key values.

6. The encrypted data query method according to any one of claims 1 to 4, wherein: In a case where the trusted execution environment can access the host memory, obtaining the first preset ciphertext stored in the first target node includes: obtaining a memory address corresponding to the first preset ciphertext; In a case where the trusted execution environment cannot access the host memory, obtaining the first preset ciphertext stored in the first target node includes: copying the first preset ciphertext to the trusted execution environment.

7. An encrypted data query device for querying ciphertext stored in a preset data structure, wherein the preset data structure stores the ciphertext in the form of key-value pairs, the preset data structure comprising multiple nodes, multiple key values ​​belonging to the same node being arranged in order of magnitude, and a preset magnitude relationship existing between the key values ​​of at least two of the nodes, the encrypted data query device comprising: A first acquiring unit is configured to acquire a ciphertext to be queried and a first preset ciphertext stored in a first target node, where the first target node is any node in the preset data structure; a first decryption unit, configured to decrypt the ciphertext to be queried and the first preset ciphertext in a trusted execution environment to obtain a target key value to be queried and a plurality of first preset key values ​​arranged in order of size; A first query unit, configured to determine whether the target key value exists in the plurality of first preset key values, and obtain result identification information; If the target key value exists in the multiple first preset key values, the position identification information is determined based on a size relationship between the target key value and the multiple first preset key values; if the target key value does not exist in the multiple first preset key values, the position identification information is determined based on a first size relationship and a second size relationship, where the first size relationship is a size relationship between the target key value and the multiple first preset key values, and the second size relationship is a size relationship between at least one of the first preset key values ​​and at least one of the key values ​​of the other nodes; An output unit is used to output a first query result, wherein the first query result at least includes the result identification information and the location identification information, the result identification information represents whether the target key value is queried among the multiple first preset key values, and the location identification information is used to indicate the location to which the target key value belongs.

8. The encrypted data query device according to claim 7, wherein: The encrypted data query device further includes: a determination unit configured to determine a second target node based on the location identification information when the result identification information indicates that the target key value is not found in the multiple first preset key values; a second acquisition unit configured to acquire a second preset ciphertext stored in the second target node; a second decryption unit configured to decrypt the second preset ciphertext in the trusted execution environment to obtain multiple second preset key values ​​arranged in order of size; and a second query unit configured to query the target key value from the multiple second preset key values. The first decryption unit includes: a first determining module, configured to determine whether a decryption result corresponding to the ciphertext to be queried or the first preset ciphertext is stored in a decryption cache; a first acquiring module, configured to acquire the decryption result from the decryption cache if the decryption result is stored in the decryption cache; The first decryption unit further includes: a decryption module for decrypting the ciphertext to be queried or the first preset ciphertext using a preset decryption logic to obtain a decryption result when the decryption result is not stored in the decryption cache; and a storage module for storing the decryption result in the decryption cache; The first query unit includes: a second acquisition module for acquiring an identifier of a target query function; a second determination module for determining a pointer corresponding to the target query function based on the identifier; and a third query module for calling the target query function using the pointer to query the target key value from the plurality of first preset key values; The first acquisition unit includes: a third acquisition module, used to obtain the memory address corresponding to the first preset ciphertext when the trusted execution environment can access the host memory; and a copy module, used to copy the first preset ciphertext to the trusted execution environment when the trusted execution environment cannot access the host memory.

9. A non-volatile storage medium, wherein: The non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the encrypted data query method according to any one of claims 1 to 6.

10. A processor, wherein: The processor is used to run a program, wherein the encrypted data query method according to any one of claims 1 to 6 is executed when the program is run.

11. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the encrypted data query method according to any one of claims 1 to 6 is implemented.

Images