A ciphertext data processing method, system, device and equipment
By homomorphically encrypting the query keywords and performing matching and querying in the encrypted state, the problem of leakage of encrypted data during querying is solved, and secure and efficient data processing is achieved.
Patent Information
- Application Number
- CN202310065118.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-01-17
- Publication Date
- 2026-08-25
- Estimated Expiration
- 2043-01-17
AI Technical Summary
In existing technologies, encrypted data needs to be decrypted when querying or processing, which leads to data leakage and reduced operability.
The query keywords are encrypted using a homomorphic encryption algorithm, and matching and querying are performed in the encrypted state. The properties of the homomorphic algorithm are used for verification and operation to ensure that the data is processed in an encrypted state.
It enables the querying and processing of encrypted data while maintaining data security, improving the efficiency of keyword search operations and the operability of data.
Smart Images
Figure CN116049218B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a method, system, apparatus and device for processing encrypted data. Background Technology
[0002] With the development of internet technology, society is gradually entering the era of "big data." For example, data related to daily electricity consumption needs to be stored on the power company's servers so that users can easily query and process the data using their devices. However, to protect user privacy, the relevant data on user devices needs to be encrypted to form ciphertext data.
[0003] Currently, traditional symmetric encryption algorithms are used to encrypt and store data on servers. However, in practical applications, user devices need to decrypt the encrypted data before querying or processing it, which can easily lead to data leakage and significantly reduce the operability of the data. Summary of the Invention
[0004] This application provides a method, system, apparatus, and device for processing encrypted data. While maintaining the encrypted data in an encrypted state, operations such as querying or calculating the encrypted data can be performed, thereby achieving the purpose of data processing while ensuring the security of the encrypted data.
[0005] Firstly, this application provides a method for processing encrypted data, applied in a data center, the method comprising:
[0006] The first query keyword is encrypted to obtain the first ciphertext keyword, which is obtained from the query request of the user device;
[0007] Find the first index keyword that corresponds to the first ciphertext keyword;
[0008] Based on the verification results of the first ciphertext keyword and the first index keyword, it is determined that the first ciphertext keyword and the first index keyword match.
[0009] Send the query results corresponding to the first index keyword to the user equipment, wherein the query results include the decryption key corresponding to the first index keyword.
[0010] Optionally, based on the verification results of the first encrypted keyword and the first index keyword, determining that the first encrypted keyword and the first index keyword match includes:
[0011] Send the first encrypted keyword and the first index keyword to the server;
[0012] The server receives a verification result, which is obtained by the server performing homomorphic computation on the first ciphertext keyword and the first index keyword.
[0013] Decrypt the verification result to obtain the decrypted result;
[0014] If the decryption result equals the preset value, then the first ciphertext keyword and the first index keyword are confirmed to match.
[0015] Optionally, the query results may also include the first encrypted file corresponding to the first index keyword.
[0016] Optionally, the method further includes:
[0017] A first instruction message is sent to the server, which instructs the server to send the first encrypted file corresponding to the first index keyword to the user device.
[0018] Optionally, the method further includes:
[0019] Obtain the first data to be encrypted and stored, the first data including plaintext keywords and plaintext non-keywords;
[0020] The plaintext keyword is homomorphically encrypted using the first public key to obtain the second ciphertext keyword;
[0021] The signature of the first data, the plaintext non-keyword, and the second ciphertext keyword are symmetrically encrypted to obtain the second ciphertext file;
[0022] An index table is stored, which includes the correspondence between the second ciphertext key and the first private key, the first private key corresponding to the first public key, and the second ciphertext key being the index key of the correspondence in the index table.
[0023] Optionally, the method further includes:
[0024] Send the second encrypted keyword to the server, and establish the correspondence between the second encrypted file and the encrypted key.
[0025] Optionally, the first index keyword corresponding to the first ciphertext keyword is searched, including:
[0026] The binary search method is used to find the index keyword corresponding to the first ciphertext keyword from the index table, and this keyword is denoted as the first index keyword.
[0027] Optionally, the method further includes:
[0028] Receive analysis requests sent by the data analysis center, the analysis requests including second query keywords and operation keywords;
[0029] The second query keyword is encrypted to obtain the third ciphertext keyword, and the operation keyword is encrypted to obtain the fourth ciphertext keyword.
[0030] Find the second index keyword that corresponds to the third ciphertext keyword;
[0031] Based on the verification results of the third ciphertext keyword and the second index keyword, it is determined that the third ciphertext keyword and the second index keyword match.
[0032] A second instruction message is sent to the server, which instructs the server to process at least one third ciphertext file corresponding to the second index keyword according to the fourth ciphertext keyword to obtain the analysis result, and then send the analysis result to the data analysis center.
[0033] Secondly, this application provides an encrypted data processing system, which includes: a data center and user equipment.
[0034] User equipment is used to send query requests to the data center;
[0035] Data center, used to perform the method described in the first aspect above;
[0036] User equipment is also used to receive query results sent by the data center.
[0037] Optionally, the system also includes:
[0038] The server is used to perform homomorphic computation on the first encrypted keyword and the first indexed keyword, obtain the verification result, and send the verification result to the data center;
[0039] The server is also used to send the first encrypted file corresponding to the first index keyword to the user device;
[0040] The server is also used to receive the correspondence between the second ciphertext keyword and the second ciphertext file.
[0041] Optionally, the user equipment is also used for:
[0042] Receive the first encrypted file sent by the server.
[0043] Optionally, the system also includes:
[0044] The data analytics center is used to send analytics requests to the data center.
[0045] Optionally, the server is also used for:
[0046] The analysis results are obtained by processing at least one third ciphertext file corresponding to the second index keyword according to the fourth ciphertext keyword, and then the analysis results are sent to the data analysis center.
[0047] Optionally, the data analytics center is also used for:
[0048] Receive the analysis results sent by the server.
[0049] Thirdly, this application provides an encrypted data processing apparatus, which includes:
[0050] The first obtaining unit is used to encrypt the first query keyword to obtain the first ciphertext keyword, wherein the first query keyword is obtained from the query request of the user device;
[0051] The search unit is used to search for the first index keyword that corresponds to the first encrypted keyword.
[0052] The determining unit is used to determine whether the first ciphertext keyword and the first index keyword match based on the verification results of the first ciphertext keyword and the first index keyword;
[0053] The first sending unit is used to send the query result corresponding to the first index keyword to the user equipment, the query result including the decryption key corresponding to the first index keyword.
[0054] Optionally, the unit is specifically used for:
[0055] Send the first encrypted keyword and the first index keyword to the server;
[0056] The server receives a verification result, which is obtained by the server performing homomorphic computation on the first ciphertext keyword and the first index keyword.
[0057] Decrypt the verification result to obtain the decrypted result;
[0058] If the decryption result equals the preset value, then the first ciphertext keyword and the first index keyword are confirmed to match.
[0059] Optionally, the device further includes:
[0060] The second sending unit is used to send a first instruction message to the server, the first instruction message being used to instruct the server to send the first encrypted file corresponding to the first index keyword to the user equipment.
[0061] Optionally, the device further includes:
[0062] The second obtaining unit is used to obtain the first data to be encrypted and stored, the first data including plaintext keywords and plaintext non-keywords;
[0063] The second obtaining unit is used to homomorphically encrypt the plaintext keyword using the first public key to obtain the second ciphertext keyword;
[0064] The second obtaining unit is used to symmetrically encrypt the signature, plaintext non-keyword, and second ciphertext keyword of the first data to obtain the second ciphertext file;
[0065] A storage unit is used to store an index table, which includes a correspondence between a second ciphertext keyword and a first private key, wherein the first private key corresponds to a first public key, and the second ciphertext keyword is the index keyword of the correspondence in the index table.
[0066] Fourthly, this application provides an encrypted data processing device, which includes a memory and a processor:
[0067] Memory is used to store computer programs;
[0068] The processor is used to execute the method provided in the first aspect above according to the computer program.
[0069] Fifthly, this application also provides a computer-readable storage medium for storing a computer program for performing the method provided in the first aspect above.
[0070] Therefore, this application has the following beneficial effects:
[0071] This application provides a method for processing encrypted data. The method involves encrypting a first query keyword in a user device's query request to obtain a first encrypted keyword. Then, a first index term corresponding to the first encrypted keyword is searched. Next, based on the verification results of the first encrypted keyword and the first index term, a match is confirmed. Finally, the query result corresponding to the first index term is sent to the user device. During the search process, leveraging the properties of the encryption algorithm, the search can continue while the query keyword remains encrypted, matching the corresponding encrypted index keyword. The encrypted file and its decryption key are then obtained through the index keyword, ensuring data processing while maintaining the security of the encrypted data. Furthermore, using the encrypted keyword as the index of the index table obtained using the properties of this encryption algorithm improves the efficiency of the keyword search operation. Attached Figure Description
[0072] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.
[0073] Figure 1 This is a flowchart illustrating a method for processing encrypted data in an embodiment of this application.
[0074] Figure 2 This is a schematic diagram of the structure of a encrypted data processing system 200 according to an embodiment of this application;
[0075] Figure 3 This is a flowchart illustrating one embodiment of a encrypted data processing method according to this application.
[0076] Figure 4 This is a schematic diagram of the structure of a encrypted data processing device 400 in an embodiment of this application;
[0077] Figure 5 This is a schematic diagram of the structure of a encrypted data processing device 500 in an embodiment of this application. Detailed Implementation
[0078] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0079] In the embodiments of this application, the "first" in names such as "first query keyword" and "first encrypted keyword" is only used as a name identifier and does not represent the first in order. This rule also applies to "second", "third", etc.
[0080] Currently, the encryption of ciphertext mainly uses traditional symmetric encryption algorithms to ensure data security. However, in practical applications, ciphertext data needs to be processed according to requirements, such as querying or performing calculations. The ciphertext data must first be decrypted before it can be processed accordingly. This leads to a conflict between data processing and the protection of user privacy information. Therefore, existing technical solutions can cause varying degrees of data privacy leakage when processing ciphertext data, thereby reducing the operability of ciphertext data.
[0081] In this embodiment, a first query keyword is obtained by querying based on the first query keyword in the user device's query request. Then, the query result is sent to the user device based on the first index keyword. Specifically, this method may include: encrypting the first query keyword in the user device's query request to obtain a first ciphertext keyword; searching for the first index keyword corresponding to the first ciphertext keyword; determining a match between the first ciphertext keyword and the first index keyword based on the verification results; and finally, sending the query result corresponding to the first index keyword to the user device. It is evident that the method provided in this application ensures that the data is encrypted throughout the data processing process, thus enabling data manipulation while maintaining data security.
[0082] To facilitate understanding of the specific implementation of the encrypted data processing method provided in the embodiments of this application, the following description will be provided in conjunction with the accompanying drawings.
[0083] It should be noted that the entity implementing this encrypted data processing method can be the encrypted data processing system provided in the embodiments of this application, or it can be the encrypted data processing device provided in the embodiments of this application. The encrypted data processing device can be carried in an electronic device or a functional module of an electronic device. The encrypted data processing device in the embodiments of this application can be any device capable of implementing the encrypted data processing method in the embodiments of this application, such as an Internet of Things (IoT) device.
[0084] Figure 1 This is a flowchart illustrating a method for processing encrypted data according to an embodiment of this application. This method can be applied to an encrypted data processing system, which may be, for example, a system that... Figure 2 The encrypted data processing system 200 shown; this method can also be applied to an encrypted data processing device, which may be, for example, as shown in the figure. Figure 4 The encrypted data processing device 400 shown, or the encrypted data processing device may be integrated into Figure 5 The functional modules in the encrypted data processing device 500 shown.
[0085] like Figure 1 As shown, this method is applied to a data center and includes the following steps S101 to S104:
[0086] S101: Encrypt the first query keyword to obtain the first ciphertext keyword, wherein the first query keyword is obtained from the query request of the user device.
[0087] As an example, before S101, the following may be included: the encrypted data processing device obtains the public and private keys of the algorithm, while other third-party devices obtain the public key of the corresponding algorithm.
[0088] As an example, step S101 might include: obtaining first data to be encrypted and stored, the first data including plaintext keywords and plaintext non-keywords; homomorphically encrypting the plaintext keywords using a first public key to obtain a second ciphertext keyword; symmetrically encrypting the signature of the first data, the plaintext non-keyword, and the second ciphertext keyword to obtain a second ciphertext file; saving an index table, which includes a correspondence between the second ciphertext keywords and the first private key, where the first private key corresponds to the first public key, and the second ciphertext keyword is the index keyword of the correspondence in the index table. Furthermore, the correspondence between the second ciphertext keyword and the second ciphertext file is sent to the server.
[0089] In this case, digitally signing the first data can be used by a third-party device (user device) to determine the authenticity and integrity of the first data protected by the signature.
[0090] The plaintext keyword is homomorphically encrypted using the first public key to obtain the second ciphertext keyword. This is to leverage the homomorphic property of the homomorphic algorithm to ensure that the plaintext keyword can still be queried and retrieved even in an encrypted state, thus enabling ciphertext data query processing. The signature of the first data, the plaintext non-keyword, and the second ciphertext keyword are symmetrically encrypted. That is, in order to encrypt the first data, since homomorphic encryption and decryption are less efficient than symmetric decryption, only the plaintext keyword is homomorphically encrypted, while the entire first data is still symmetrically encrypted.
[0091] For keyword data whose value range is concentrated within a fixed interval and mostly within a small range, the index table can be sorted according to the size of the numerical value based on the homomorphic property of the encrypted keywords, thus forming an ordered index table. The ordered index table can use binary search to improve retrieval efficiency.
[0092] As an example, S101 may include: receiving a query request from a user device, the query request including a first query keyword, the query request being used to instruct the user to obtain query results.
[0093] To obtain the query results, the first query keyword needs to be encrypted to obtain the first ciphertext keyword. Then, the first index keyword corresponding to the first ciphertext keyword is searched. Based on the verification results of the first ciphertext keyword and the first index keyword, it is determined that the first ciphertext keyword and the first index keyword match. Finally, the query results corresponding to the first index keyword are sent to the user equipment. Therefore, in this embodiment, obtaining the first ciphertext keyword through S101 provides a prerequisite for finding the first index keyword.
[0094] In one scenario, to protect the query keywords in a user's device, the query keywords need to be encrypted. In another scenario, since the stored keywords and files are encrypted, the query keywords also need to be encrypted in order to retrieve the matching encrypted keywords and files stored in the storage.
[0095] S102: Find the first index keyword that corresponds to the first ciphertext keyword.
[0096] As an example, S102 may include: using a binary search method to find the index keyword corresponding to the first ciphertext keyword from the index table, denoted as the first index keyword.
[0097] Using binary search to search the index table improves the efficiency of keyword search compared to previous methods.
[0098] S103: Based on the verification results of the first ciphertext keyword and the first index keyword, determine that the first ciphertext keyword and the first index keyword match.
[0099] As an example, S103 may include: S103a1, sending the first ciphertext keyword and the first index keyword to the server; S103a2, receiving the verification result sent by the server, which is obtained by the server performing homomorphic computation on the first ciphertext keyword and the first index keyword; S103a3, decrypting the verification result to obtain the decryption result; S103a4, if the decryption result is equal to a preset value (such as 0), then determining that the first ciphertext keyword and the first index keyword match.
[0100] As an example, S103 may include: S103b1, performing homomorphic computation on the first ciphertext keyword and the first index keyword to obtain a verification result; S103b2, decrypting the verification result to obtain a decryption result; S103b3, if the decryption result is equal to a preset value, then determining that the first ciphertext keyword and the first index keyword match.
[0101] Homomorphic algorithms utilize the homomorphic property to perform operations on ciphertext data without decryption, thus obtaining the verification result. However, to retrieve the content of the verification result, it is still necessary to decrypt it.
[0102] S104: Send the query result corresponding to the first index keyword to the user equipment, wherein the query result includes the decryption key corresponding to the first index keyword.
[0103] As an example, after S103, the method may further include: sending a first instruction message to the server, the first instruction message instructing the server to send the first ciphertext file corresponding to the first index keyword to the user equipment. In this way, the user equipment can obtain the first ciphertext file and the decryption key from the server and the ciphertext data processing device respectively, as the overall query result corresponding to the first query keyword.
[0104] As another example, the index table may also include a ciphertext file corresponding to each index keyword. Therefore, the query result in S104 may also include the first ciphertext file corresponding to the first index value. In this way, the user equipment can obtain the first ciphertext file and the decryption key from the ciphertext data processing device as the overall query result corresponding to the first query keyword.
[0105] This application embodiment can also obtain the analysis results of encrypted data. For example, the method may include: receiving an analysis request sent by a data analysis center, the analysis request including a second query keyword and an operation keyword; encrypting the second query keyword to obtain a third encrypted keyword, encrypting the operation keyword to obtain a fourth encrypted keyword; searching for a second index keyword corresponding to the third encrypted keyword; determining that the third encrypted keyword and the second index keyword match based on the verification results of the third encrypted keyword and the second index keyword; then, sending a second instruction message to the server, the second instruction message being used to instruct the server to process at least one third encrypted file corresponding to the second index keyword according to the fourth encrypted keyword to obtain the analysis results, and sending the analysis results to the data analysis center.
[0106] As can be seen, this embodiment of the application encrypts the query keywords in the user device's query request to obtain ciphertext keywords, then searches for the corresponding index keywords, and finally, based on the verification results of the ciphertext keywords and index keywords, determines that the ciphertext keywords and index keywords match. Finally, the query results corresponding to the index keywords are sent to the user device. During this query process, both the ciphertext keywords and their corresponding index keywords are encrypted, as is the ciphertext file in the obtained query results. Therefore, the data remains secure throughout the entire process of querying ciphertext data.
[0107] The system in the embodiments of this application can be seen, for example, as shown in [reference 1]. Figure 2 The encrypted file processing system 200 shown may include, for example, user equipment 201 and data center 202.
[0108] User equipment 201 is used to send query requests to data center 202;
[0109] Data center 202 is used to perform the methods described in the above embodiments;
[0110] User equipment 201 is also used to receive query results sent by data center 202.
[0111] Optionally, the system 200 may also include:
[0112] Server 203 is used to perform homomorphic computation on the first encrypted keyword and the first index keyword, obtain the verification result, and send the verification result to data center 202;
[0113] Server 203 is also used to send the first encrypted file corresponding to the first index keyword to user device 201;
[0114] Server 203 is also used to receive the correspondence between the second ciphertext keyword and the second ciphertext file.
[0115] Optionally, user equipment 201 is also used for:
[0116] Receive the first encrypted file sent by server 203.
[0117] Optionally, the system 200 also includes:
[0118] Data analysis center 204 is used to send analysis requests to data center 202;
[0119] Optionally, server 203 is also used for:
[0120] The analysis results are obtained by processing at least one third ciphertext file corresponding to the second index keyword according to the fourth ciphertext keyword, and then the analysis results are sent to the data analysis center 204.
[0121] Optionally, Data Analytics Center 204 is also used for:
[0122] Receive the analysis results sent by server 203.
[0123] In addition to querying and retrieving encrypted files, the embodiments of this application can also obtain corresponding analysis results by processing encrypted files. The following will illustrate this further. Figure 3 The method will be explained in detail.
[0124] S301: Data center 202 receives an analysis request sent by data analysis center, the analysis request including query keyword 2 and operation keyword.
[0125] As an example, the analysis request in S301 could be to obtain the total electricity consumption of region 1, where the query keyword in the analysis request could be, for example, the second keyword in the method described above.
[0126] S302: Data center 202 performs homomorphic encryption on query keyword 2 to obtain ciphertext keyword 3, and performs homomorphic encryption on operation keyword to obtain ciphertext keyword 4.
[0127] Since the homomorphic property of the homomorphic algorithm is used when processing the encrypted file, and the security of the query keyword and operation keyword is guaranteed, it is necessary to homomorphically encrypt the query keyword and operation keyword. For example, the ciphertext keyword 3 can be the third ciphertext keyword in the above method, and the ciphertext keyword 4 can be the fourth ciphertext keyword in the above method.
[0128] S303: Data center 202 uses a binary search method to find the index keyword 2 corresponding to the ciphertext keyword 3 from the index table.
[0129] For example, index keyword 2 can be the second index keyword in the method described above.
[0130] S304: Data center 202 sends encrypted keyword 3 and index keyword 2 to the server.
[0131] S305: The server multiplies the encrypted keyword 3 and the index keyword 2 to obtain the verification result, and sends the verification result to the data center 202.
[0132] The property of homomorphic algorithms is that they allow operations to be performed on ciphertext data without decryption, thus keeping the ciphertext data in an encrypted state.
[0133] S306: Data Center 202 decrypts the verification result to obtain the decryption result.
[0134] The obtained verification result is still encrypted and needs to be decrypted to obtain the content of the verification result, i.e., the decryption result.
[0135] S307: Data center 202 determines that if the decryption result is equal to the number 0, then the ciphertext keyword 3 and the index keyword 2 are matched.
[0136] According to the homomorphic property of homomorphic algorithms, if the decryption result is equal to the number 0, it means that the query keyword 2 and the index keyword 2 are the same.
[0137] It should be noted that after executing S307, the operation keywords can be encrypted to obtain ciphertext keyword 4.
[0138] S308: Data center 202 sends encrypted keyword 4 to the server.
[0139] S309: The server processes at least one encrypted file 3 corresponding to index keyword 2 according to encrypted keyword 4 to obtain analysis results, and sends the analysis results to the data analysis center.
[0140] As an example, the encrypted file 3 in S309 can be an electricity consumption data file in a certain region 1, where the encrypted file 3 can be, for example, the third encrypted file in the above method.
[0141] As an example, S309 may include: the server multiplies the electricity consumption data in total region 1 according to the encrypted keyword 4 to obtain the analysis result.
[0142] Due to the homomorphic nature of homomorphic algorithms, multiplying homomorphically encrypted data is equivalent to adding plaintext data. That is, by decrypting the obtained analysis results, we can obtain the electricity consumption data of region 1, and thus obtain the total electricity consumption of region 1.
[0143] This application provides a method for processing encrypted data. On the one hand, it encrypts query keywords and operation keywords using a homomorphic algorithm. By utilizing the properties of the homomorphic algorithm, the corresponding encrypted keywords can be retrieved. Furthermore, the encrypted data can be processed based on the encrypted operation keywords to obtain the molecular result. In this process, data security is ensured while meeting the operational requirements of the encrypted data. On the other hand, the data size is compared through the results of the homomorphic operation to obtain an index table. The encrypted retrieval efficiency is improved by using binary search on the index table.
[0144] See Figure 4 This application provides a encrypted data processing apparatus 400, which includes:
[0145] The first obtaining unit 401 is used to encrypt the first query keyword to obtain the first ciphertext keyword, wherein the first query keyword is obtained from the query request of the user device;
[0146] The lookup unit 402 is used to look up the first index keyword corresponding to the first encrypted keyword;
[0147] The determining unit 403 is used to determine that the first ciphertext keyword and the first index keyword match based on the verification results of the first ciphertext keyword and the first index keyword;
[0148] The first sending unit 404 is used to send the query result corresponding to the first index keyword to the user equipment, the query result including the decryption key corresponding to the first index keyword.
[0149] Optionally, the determining unit 403 is specifically used for:
[0150] Send the first encrypted keyword and the first index keyword to the server;
[0151] The server receives a verification result, which is obtained by the server performing homomorphic computation on the first ciphertext keyword and the first index keyword.
[0152] Decrypt the verification result to obtain the decrypted result;
[0153] If the decryption result equals the preset value, then the first ciphertext keyword and the first index keyword are confirmed to match.
[0154] Optionally, the device 400 further includes:
[0155] The second sending unit is used to send a first instruction message to the server, the first instruction message being used to instruct the server to send the first encrypted file corresponding to the first index keyword to the user equipment.
[0156] Optionally, the device 400 further includes:
[0157] The second obtaining unit is used to obtain the first data to be encrypted and stored, the first data including plaintext keywords and plaintext non-keywords;
[0158] The second obtaining unit is used to homomorphically encrypt the plaintext keyword using the first public key to obtain the second ciphertext keyword;
[0159] The second obtaining unit is used to symmetrically encrypt the signature, plaintext non-keyword, and second ciphertext keyword of the first data to obtain the second ciphertext file;
[0160] A storage unit is used to store an index table, which includes a correspondence between a second ciphertext keyword and a first private key, wherein the first private key corresponds to a first public key, and the second ciphertext keyword is the index keyword of the correspondence in the index table.
[0161] This application embodiment also provides a device 500 for ciphertext data processing, such as... Figure 5 As shown, the device 500 includes a memory 501 and a processor 502:
[0162] Memory 501 is used to store computer programs;
[0163] Processor 502 is used to execute the above according to the computer program. Figure 1 or Figure 3 The methods provided.
[0164] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus a general-purpose hardware platform. Based on this understanding, the technical solution of this application can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as a read-only memory (ROM) / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or some parts of the embodiments of this application.
[0165] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The device embodiments described above are merely illustrative. Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the objectives of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.
[0166] The above description is merely an exemplary implementation of this application and is not intended to limit the scope of protection of this application.
Claims
1. A method for processing encrypted data, characterized in that, Applied to data centers, the method includes: Obtain the first data to be encrypted and stored, the first data including plaintext keywords and plaintext non-keywords; The plaintext keyword is homomorphically encrypted using the first public key to obtain the second ciphertext keyword; The signature of the first data, the plaintext non-keyword, and the second ciphertext keyword are symmetrically encrypted to obtain the second ciphertext file; An index table is stored, which includes the correspondence between the second ciphertext keyword and the first private key, wherein the first private key corresponds to the first public key, and the second ciphertext keyword is the index keyword of the correspondence in the index table; The first query keyword is encrypted to obtain the first ciphertext keyword, which is obtained from the query request of the user device; Find the first index keyword that corresponds to the first ciphertext keyword; Based on the verification results of the first ciphertext keyword and the first index keyword, it is determined that the first ciphertext keyword and the first index keyword match. Send the query result corresponding to the first index keyword to the user equipment, wherein the query result includes the decryption key corresponding to the first index keyword; Receive analysis requests sent by the data analysis center, the analysis requests including second query keywords and operation keywords; The second query keyword is encrypted to obtain the third ciphertext keyword, and the operation keyword is encrypted to obtain the fourth ciphertext keyword; Find the second index keyword that corresponds to the third ciphertext keyword; Based on the verification results of the third ciphertext keyword and the second index keyword, it is determined that the third ciphertext keyword and the second index keyword match; A second instruction message is sent to the server, which instructs the server to process at least one third encrypted file corresponding to the second index keyword according to the fourth encrypted keyword to obtain the analysis result, and then send the analysis result to the data analysis center.
2. The method according to claim 1, characterized in that, The step of determining that the first ciphertext keyword and the first index keyword match based on the verification results of the first ciphertext keyword and the first index keyword includes: Send the first encrypted keyword and the first indexed keyword to the server; The server receives the verification result, which is obtained by the server performing homomorphic computation on the first ciphertext keyword and the first index keyword. The verification result is decrypted to obtain the decryption result; If the decryption result is equal to the preset value, then it is determined that the first ciphertext keyword and the first index keyword match.
3. The method according to claim 1, characterized in that, The query results also include the first encrypted file corresponding to the first index keyword.
4. The method according to claim 3, characterized in that, The method further includes: A first instruction message is sent to the server, which instructs the server to send the first encrypted file corresponding to the first index keyword to the user equipment.
5. The method according to claim 1, characterized in that, The method further includes: Send the correspondence between the second encrypted keyword and the second encrypted file to the server.
6. The method according to claim 1, characterized in that, The process of finding the first index keyword corresponding to the first ciphertext keyword includes: A binary search method is used to find the index keyword corresponding to the first ciphertext keyword from the index table, and this keyword is denoted as the first index keyword.
7. A encrypted data processing system, characterized in that, The system includes: a data center and user equipment. The user equipment is used to send a query request to the data center; The data center is used to perform the method according to any one of claims 1-6; The user equipment is also used to receive query results sent by the data center.
8. A device for processing encrypted data, characterized in that, The device includes a memory and a processor, the processor being configured to execute a program stored in the memory, performing the method as described in any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program for performing the method according to any one of claims 1-6.