A data query method and device, computer equipment and a storage medium

Abstract

The present application relates to the technical field of data query, and especially relates to a data query method and device, computer equipment and a storage medium, the above-mentioned method is applied to the medical field, in the present application, the data query method is applied to the database collection and the client-to-client query index is asymmetrically encrypted, and the values in the to-be-queried database node in the database collection are homomorphically encrypted, the query data corresponding to the query index is encrypted through the private key of asymmetric encryption, the privacy of the query party is protected, so that the database node cannot know the to-be-queried data obtained by the data query party, the to-be-queried data is homomorphically encrypted, so that direct operation can be carried out between the encrypted data, and the query efficiency of the query result is improved.

Description

Technical Field

[0001] This invention relates to the field of data query technology, and in particular to a data query method, apparatus, computer equipment, and storage medium. Background Technology

[0002] With the gradual integration of the medical system and the internet, the medical system has benefited greatly from internet-based development. However, in the existing medical data system, different hospitals have different systems. When users obtain medical data from different hospitals, they need to access the data from the databases of different hospital systems. As data privacy becomes increasingly important, both individual and corporate users have raised the need to protect the query intent and target of the query, while also protecting the data security and privacy of the queried database. To improve data query security, the server typically encrypts the query results using encryption algorithms before sending them to the client. The client then decrypts the results using decryption algorithms to obtain the final query result. However, this requires encrypting each value in the database individually, which is very time-consuming and incurs significant communication overhead, reducing query efficiency. Therefore, improving data query efficiency during the encryption process is a pressing issue that needs to be addressed. Summary of the Invention

[0003] Therefore, it is necessary to provide a data query method, apparatus, computer equipment, and storage medium to address the aforementioned technical problems, thereby resolving the issue of low query efficiency during the encryption of query data.

[0004] A first aspect of this application provides a data query method applied to a database set, the database set including N databases, where N is an integer greater than 1, the data query method comprising:

[0005] For each database node to be queried in the database set, a first key pair is generated, the public key in the first key pair is sent to the querying party, and any database node to be queried in the database set is selected as a cooperating node. Homomorphic operation is used to generate a second key pair, and the second key pair is sent to the querying party and the other database nodes to be queried.

[0006] Obtain the blinded index data fed back by the querying party based on the first key pair, encrypt the blinded index data using the private key in the first key pair to obtain encrypted index data, and send the encrypted index data to the querying party;

[0007] acquire a first bucket identifier corresponding to the encrypted index data fed back by the querying party, and send preset encrypted index data in a second bucket identifier equal to the first bucket identifier to the querying party according to the first bucket identifier.

[0008] A second aspect of the embodiment of the application provides a data query method, which is applied to a client and includes the following steps.

[0009] According to the public key in the acquired first public key pair, blind processing is performed on the query index to obtain blind index data, and the blind index data is sent to a to-be-queried database node in the database set.

[0010] According to the encrypted index data fed back by the to-be-queried database node, through deblinding processing and bucket calculation processing, deblinded encrypted index data and a first bucket identifier corresponding to the encrypted index data are obtained, and the first bucket identifier is sent to the to-be-queried database node.

[0011] The deblinded encrypted index data is compared with preset encrypted index data fed back by the to-be-queried database node, and target position information of the query index in a corresponding bucket is determined.

[0012] According to the homomorphic ciphertext fed back by the to-be-queried database node based on a second key pair and the target position information, target homomorphic ciphertext corresponding to the target position information is determined, the target homomorphic ciphertext is decrypted by using a private key in the second key pair, and target query results are obtained.

[0013] A third aspect of the embodiment of the application provides a data query device, which is applied to a database set and includes the following steps.

[0014] A key pair generation module is configured to generate a first key pair at a to-be-queried database node in the database set, send a public key in the first key pair to a querying party, select an arbitrary to-be-queried database node as a collaborative node in the database set, generate a second key pair by using homomorphic operation, and send a public key in the second key pair to the querying party and the remaining to-be-queried database nodes.

[0015] An encryption module is configured to acquire blind index data fed back by the querying party based on the first key pair, perform encryption processing on the blind index data by using a private key in the first key pair to obtain encrypted index data, and send the encrypted index data to the querying party.

[0016] The bucket identifier determination module is configured to acquire the first bucket identifier corresponding to the encrypted index data fed back by the query party, and send preset encrypted index data in the second bucket identifier equal to the first bucket identifier to the query party according to the first bucket identifier.

[0017] The fourth aspect of the embodiment of the application provides a data query device, which is applied to a client, and the data query device comprises:

[0018] The blinding module is configured to perform blinding processing on the query index according to the public key in the acquired first public key pair, to obtain blind index data, and send the blind index data to the to-be-queried database node in the database set;

[0019] The bucket processing module is configured to obtain the deblinded encrypted index data and the first bucket identifier corresponding to the encrypted index data through deblinding processing and bucket calculation processing according to the encrypted index data fed back by the to-be-queried database node, and send the first bucket identifier to the to-be-queried database node;

[0020] The comparison module is configured to compare the deblinded encrypted index data with the preset encrypted index data fed back by the to-be-queried database node, and determine target position information of the query index in a corresponding bucket;

[0021] The decryption module is configured to determine target homomorphic ciphertext corresponding to the target position information according to the homomorphic ciphertext fed back by the to-be-queried database node based on the second key pair and the target position information, and decrypt the target homomorphic ciphertext by using a private key in the second key pair to obtain a target query result.

[0022] In the fifth aspect, the embodiment of the application provides a computer device, which comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, and the processor implements the data query method according to the first aspect when executing the computer program.

[0023] In the sixth aspect, the embodiment of the application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the data query method according to the first aspect.

[0024] Compared with the prior art, the embodiment of the application has the following beneficial effects:

[0025] The data query method in the application is applied to a database set and a client. In the database set, the database set comprises N databases, N is an integer greater than 1, each to-be-queried database node in the database set generates a first key pair, sends a public key in the first key pair to a querying party, selects an arbitrary to-be-queried database node in the database set as a collaborative node, generates a second key pair using homomorphic operation, sends the second key pair to the querying party and the remaining to-be-queried database nodes, obtains blind index data fed back by the querying party based on the first key pair, encrypts the blind index data using a private key in the first key pair to obtain encrypted index data, and sends the encrypted index data to the querying party, obtains the first bucket identifier corresponding to the encrypted index data fed back by the querying party, and sends preset encrypted index data in the second bucket identifier equal to the first bucket identifier to the querying party,

[0026] In the client, the querying index is blinded based on the obtained public key in the first public key pair to obtain blind index data, the blind index data is sent to the to-be-queried database node in the database set, the encrypted index data fed back by the to-be-queried database node is deblinded and bucketed to obtain deblinded encrypted index data and the first bucket identifier corresponding to the encrypted index data, the first bucket identifier is sent to the to-be-queried database node, the deblinded encrypted index data is compared with the preset encrypted index data fed back by the to-be-queried database node to determine the target position information of the querying index in the corresponding bucket, the target homomorphic ciphertext corresponding to the target position information is determined based on the homomorphic ciphertext fed back by the to-be-queried database node based on the second key pair and the target position information, the target homomorphic ciphertext is decrypted based on the target homomorphic ciphertext and the private key in the second key pair to obtain the target query result.

[0027] In the application, the querying index is asymmetrically encrypted and the to-be-queried data is fully homomorphically encrypted, the querying data corresponding to the querying index is encrypted by the private key of asymmetric encryption, the privacy of the querying party is protected, the to-be-queried data is fully homomorphically encrypted, direct operation can be performed between the encrypted data, and the query efficiency of the query result is improved. In a medical system, when the querying index is received, the querying index is asymmetrically encrypted, the to-be-queried data is fully homomorphically encrypted, the querying data corresponding to the querying index is encrypted by the private key of asymmetric encryption, the privacy of the querying party is protected, the to-be-queried data is fully homomorphically encrypted, direct operation can be performed between the encrypted data, and the efficiency of medical data query can be improved to a certain extent when the databases in different medical systems are queried. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0029] Figure 1 is a schematic diagram of an application environment of a data query method provided by an embodiment of the present application;

[0030] Figure 2 is a schematic diagram of a flow of a data query method provided by an embodiment of the present application;

[0031] Figure 3 is a schematic diagram of a flow of a data query method provided by an embodiment of the present application;

[0032] Figure 4 is a schematic diagram of a structure of a data query device provided by an embodiment of the present application;

[0033] Figure 5 is a schematic diagram of a structure of a data query device provided by an embodiment of the present application;

[0034] Figure 6 is a schematic diagram of a structure of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0035] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort under the premise of not making the present application fall into the public domain.

[0036] It should be understood that when used in the specification and the appended claims of the present application, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0037] It should also be understood that the term "and / or" used in the specification and the appended claims of the present application means any combination of the associated listed items and all possible combinations, and includes these combinations.

[0038] As used in the description of the application and the appended claims, the term "if' can be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be interpreted to mean "upon determining" or "in response to determining" or "upon detecting [the described condition or event]" or "in response to detecting [the described condition or event]," depending on the context.

[0039] In addition, the terms "first", "second", "third", etc. as used in the description of the application and the appended claims are merely used to differentiate descriptions and cannot be understood as indicating or implying relative importance.

[0040] Reference in the specification to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in one embodiment" or "in some embodiments" in various places in the specification are not necessarily all referring to the same embodiment, although it can. The terms "including," "containing," "having," and variations thereof are meant to encompass the terms "including but not limited to."

[0041] It should be understood that the size of the serial number of each step in the following embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the application.

[0042] In order to illustrate the technical solutions of the application, the following specific embodiments are described.

[0043] An embodiment of the application provides a data query method, which can be applied in an application environment such as Figure 1 , wherein a client and a server communicate. The client includes but is not limited to a palmtop computer, a desktop computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), and the like computer device. The server can be implemented by an independent server or a server cluster generated by multiple servers.

[0044] Referring to Figure 2 , it is a flowchart of a data query method provided by an embodiment of the application, and the data query method can be applied in an application environment such asFigure 1 a server in the database collection, the server being connected to the corresponding client, as shown in Figure 2 The data query method can include the following steps.

[0045] S201: In each to-be-queried database node in a database collection, a first key pair is generated, a public key in the first key pair is sent to a querying party, and an arbitrary to-be-queried database node is selected as a collaborative node in the database collection, a second key pair is generated using homomorphic operation, and the second key pair is sent to the querying party and the remaining to-be-queried database nodes.

[0046] In step S201, each to-be-queried database node generates a first key pair, wherein the first key pair is an asymmetric key pair, a public key in the first key pair is sent to a querying party, and an arbitrary to-be-queried database node is selected as a collaborative node, each row of a second key pair is reviewed at the collaborative node, the second key pair is a homomorphic key pair, and the second key pair is sent to the querying party and the remaining to-be-queried database nodes.

[0047] In this embodiment, during a medical treatment process, a doctor needs to query medical treatment records of a patient in different hospitals after understanding the situation of the patient, each to-be-queried database node in a database collection is a database in a medical treatment system in different hospitals, and the medical treatment records of the patient are stored in the database in the medical treatment system. The database nodes in the medical treatment system in different hospitals are encrypted to generate an asymmetric key pair, and the to-be-queried database nodes in the medical treatment system are encrypted to generate a homomorphic key pair.

[0048] The asymmetric key pair can be obtained by an elliptic encryption algorithm, and the public key in the elliptic encryption algorithm is a coordinate point on an elliptic curve obtained by multiplying a private key and a base point. In the number multiplication algorithm used when calculating the coordinate point of the curve, the point multiplication and point addition operations have high computational complexity, so the point multiplication value of the base point coordinate is preprocessed to obtain a first point multiplication value set, the first point multiplication value set includes point multiplication values of the base point from 1 to 255. When performing the point multiplication operation, the corresponding point multiplication value is directly selected from the first point multiplication value set, and the time for obtaining the coordinate point of the curve is saved.

[0049] It should be noted that in the preprocessing of the base point coordinates, for any value from 1 to 255, the arbitrary value is converted to a binary value, the binary expansion method is used to calculate the point multiplication coordinates on the elliptic curve, and the binary length of the arbitrary value after binary expansion is at most 256 bits. In the preprocessing process, if the number of 0 and 1 in a 256-bit binary is equal, the doubling operation will run 256 times, and the point addition operation will run 128 times. Therefore, when the binary expansion number of the arbitrary value is 256 bits, multiple doubling operations and multiple point addition operations need to be performed. Therefore, all possible doubling value sets are obtained in advance as the first point multiplication value set, and when the doubling point is calculated, the corresponding result is selected from the first point multiplication value set.

[0050] For example, the random number generator generates an arbitrary value less than the order of the base point, the arbitrary value is expanded to a binary value, and the binary expansion method is used to calculate the curve point coordinates. In the process of the loop, when the result of the doubling point is needed, the corresponding result is directly selected from the first point multiplication value set, and the loop continues until all the binary is completed.

[0051] The homomorphic key generated by the collaboration node generates a second key pair through homomorphic operation. In this embodiment, the homomorphic operation is a KeyGen algorithm, which takes the security parameter \lambda and other public parameters describing other requirements as input, and outputs an encryption key public key and a decryption key private key. The public key in the first key pair is sent to the query party, the second key pair is generated, and the second key pair is sent to the query party and the remaining database nodes to be queried.

[0052] S202: Obtain the blinded index data fed back by the query party based on the first key pair, encrypt the blinded index data using the private key in the first key pair to obtain encrypted index data, and send the encrypted index data to the query party.

[0053] In step S202, the private key in the first key pair is stored in the database node to be queried, and the blinded index data is encrypted using the private key in the first key pair, wherein the blinded index data is obtained by blinding the query index, to obtain encrypted index data, and send the encrypted index data to the query party.

[0054] In this embodiment, the blinded index data is encrypted using the private key in the asymmetric key pair. First, the blinded index data is encoded, the blinded index data to be encrypted is encoded to a point on the ellipse, and a random number is generated. The blinded index data is encrypted according to the random number and the corresponding point coordinates to obtain the encrypted index data, and the encrypted index data is sent to the query party.

[0055] S203: Obtain the first sub-bucket identifier corresponding to the encrypted index data fed back by the query party, and send the preset encrypted index data in the second sub-bucket identifier equal to the first sub-bucket identifier to the query party according to the first sub-bucket identifier.

[0056] In step S203, the first sub-bucket identifier is the location sub-bucket of the encrypted index data. According to the first sub-bucket identifier, the second sub-bucket identifier equal to the first sub-bucket identifier is determined, and the preset encrypted index data in the second sub-bucket identifier is sent to the query party. The second sub-bucket identifier is the sub-bucket identifier corresponding to the query index obtained by the database using the first key for encryption in advance;

[0057] In this embodiment, in each to-be-queried database node, the query index in the to-be-queried database is encrypted according to the private key in the first key pair generated in the to-be-queried database, and the encrypted query index is subjected to sub-bucket processing to obtain the sub-bucket identifier corresponding to each query index in each to-be-queried database. According to the sub-bucket identifier corresponding to the query index of the query party, the first sub-bucket identifier equal to the query index in the query party is determined, and the corresponding preset encrypted index data in the sub-bucket is sent to the query party.

[0058] Optionally, obtaining the first sub-bucket identifier corresponding to the encrypted index data fed back by the query party, and sending the preset encrypted index data in the second sub-bucket identifier equal to the first sub-bucket identifier to the query party according to the first sub-bucket identifier, comprises:

[0059] According to the number of each column query index in the query field in the to-be-queried database, the number of preset sub-buckets is determined;

[0060] The private key in the first key pair is used to encrypt each column query index in the query field to obtain the preset encrypted index data;

[0061] According to the preset encrypted index data and the number of preset sub-buckets, the second sub-bucket identifier corresponding to each preset encrypted index data is determined;

[0062] The preset encrypted index data in the second sub-bucket identifier equal to the first sub-bucket identifier is sent to the query party.

[0063] In this embodiment, the preset number of buckets is determined based on the number of query indexes in the database to be queried and the preset number of data that each bucket can store. For example, if a database to be queried contains 20,000 data items, and each bucket stores 8,192 encrypted data items, then three buckets are needed. After determining the preset number of buckets, the query indexes in the database to be queried are encrypted using the private key in the first key pair to obtain preset encrypted index data. Based on the preset encrypted index data and the preset number of buckets, the bucket identifier corresponding to the preset encrypted index data is determined. The query indexes in the database to be queried then correspond to buckets with different identifiers. The preset encrypted index data in the second bucket identifier, which is equal to the first bucket identifier, is determined based on the first bucket identifier. The preset encrypted index data in the second bucket identifier, which is equal to the first bucket identifier, is sent to the querying party.

[0064] See Figure 3 This is a flowchart illustrating a data query method provided in an embodiment of the present invention. The above data query method can be applied to... Figure 1 The client in the above-mentioned client connects to the corresponding server, such as Figure 3 As shown, the data query method may include the following steps.

[0065] S301: Based on the public key in the first public key pair obtained, blind the query index to obtain blinded index data, and send the blinded index data to the database node to be queried in the database set.

[0066] In step S301, the public key in the first key pair sent by the database to be queried is obtained according to the query. Based on the public key in the first key pair, the query index of the querying party is blinded to obtain blinded index data. The blinding process is to hide the querying party's query intent. The blinded index data is sent to the database node to be queried in the database set.

[0067] In this embodiment, the querying party blinds the query index based on the public key in the first key pair obtained. The query index can be a name, ID number, mobile phone number, etc. Based on the blinded query index, blinded index data is obtained.

[0068] Optionally, based on the public key in the obtained first public key pair, the query index is blinded to obtain blinded index data, including:

[0069] Based on the generated random data and the public key in the first key pair, the blinded index data corresponding to the query index is obtained through calculation.

[0070] In this embodiment, the querying party generates random data and blinds the queried index based on the public key in the first key pair and the random data to obtain blinded index data. The calculation formula for the blinded index data is as follows:

[0071]

[0072] Among them, blind id To blind the index data, id is the query index, r is the random data generated by the query party, and pk1 is the public key in the first key pair.

[0073] It should be noted that, in order to ensure that the query intent of the data query is not disclosed to the database to be queried, a random number, i.e., random data, can be generated. Then, the public key in the first key pair and the random data are used to blind the query index. In other words, the public key in the first key pair and the generated random data are used to disguise the data to be queried, so as to obtain blinded index data, thus ensuring the privacy of data query.

[0074] S302: Based on the encrypted index data returned by the database node to be queried, the encrypted index data after blinding and the first bucket identifier corresponding to the encrypted index data are obtained through deblinding and bucketing calculation. The first bucket identifier is then sent to the database node to be queried.

[0075] In step S302, the deblinding process removes random data from the encrypted index data, resulting in the deblinded encrypted index data. The bucketing calculation process divides the deblinded encrypted index data into buckets and determines the bucket identifier corresponding to the encrypted index data.

[0076] In this embodiment, blinding the query index is done to hide the query from the database to be queried. When the querying party needs to process the query data, it deblinds the encrypted index data so that only the encrypted part is processed. The deblinded encrypted index data removes the blinded part and only contains the encrypted part of the query index, so it can be compared with the preset encrypted index obtained in the database to be queried. After obtaining the deblinded encrypted index data, it is bucketed to determine the bucket identifier of the encrypted index data, thereby determining the bucket identifier of the querying party's query index.

[0077] Optionally, based on the encrypted index data returned by the database node to be queried, through deblinding and bucketing calculation, the deblinded encrypted index data and the first bucket identifier corresponding to the encrypted index data are obtained, including:

[0078] The generated random data is used to deblind the encrypted index data based on the feedback from the database node to be queried, resulting in deblinded encrypted index data.

[0079] Based on the deblinded encrypted index data and the preset number of buckets, determine the first bucket identifier corresponding to the encrypted index data.

[0080] In this embodiment, the encrypted index data undergoes deblinding processing, and the deblinding formula is as follows:

[0081]

[0082] Among them, enc id ' represents the deblinded encrypted index data. To encrypt the index data, r is random data generated by the query party.

[0083] After obtaining the deblinded encrypted index data, the bucket identifier corresponding to the encrypted index data is obtained through bucketing calculation based on the preset number of buckets. The bucketing calculation formula is as follows:

[0084] D = enc id ′%b

[0085] Where D is the bucket identifier corresponding to the calculated encrypted index data, enc id ′ represents the deblinded encrypted index data, and b represents the preset number of buckets. The preset number of buckets is the same as the number of buckets obtained in the database to be queried. For example, when the calculated number of buckets in the database to be queried is 3, then b is 3; when the number of buckets in the database to be queried is 4, then b is 4. The bucket identifier of the deblinded encrypted index data in different databases to be queried is calculated and determined according to the number of buckets in the corresponding database to be queried.

[0086] S303: Compare the deblinded encrypted index data with the preset encrypted index data returned by the database node to be queried to determine the target location information of the query index in the corresponding bucket.

[0087] In step S303, the preset encrypted index data is the encrypted index data in the same bucket identifier. The deblinded encrypted index data is compared one by one with the encrypted index data in the second bucket identifier that is equal to the first bucket identifier to determine the position information of the deblinded encrypted index data in the bucket.

[0088] In this embodiment, when the querying party determines the first bucket identifier of the query index, it sends the first bucket identifier to the database to be queried. The database to be queried obtains the second bucket identifier, which is equal to the first bucket identifier, from the database node. The database sends the preset encrypted index data corresponding to each query index in the second bucket identifier to the corresponding querying party. The querying party searches for the encrypted index data that is equal to the encrypted index after deblinding from the preset encrypted index data. Since the preset encrypted index data is obtained by encrypting each query index with the private key in the first key pair, and the encrypted index after deblinding is also obtained by encrypting the query index with the private key in the first key pair, a comparison can be made to determine the corresponding comparison result. Based on the comparison result, the location information of the encrypted index data that is equal to the encrypted index data after deblinding in the bucket can be obtained from the preset encrypted index.

[0089] S304: Based on the homomorphic ciphertext fed back by the database node to be queried based on the second key pair, and the target location information, determine the target homomorphic ciphertext corresponding to the target location information, and use the private key in the second key pair to decrypt the target homomorphic ciphertext to obtain the target query result.

[0090] In step S304, the database node to be queried performs homomorphic encryption on the data to be queried, and sends the homomorphic ciphertext to the querying party. The querying party decrypts the homomorphic ciphertext according to the private key in the second key pair to obtain the target query result.

[0091] In this embodiment, the querying party determines the homomorphic ciphertext at the corresponding position in the corresponding bucket of each database to be queried based on the position information of the query index in the bucket. The homomorphic ciphertext is the ciphertext obtained by encrypting the data to be queried corresponding to the query index using the public key in the second key pair.

[0092] It should be noted that each bucket includes groups, and each group contains encrypted feature information from the database to be queried. Each group is of equal size. For example, a bucket may contain three groups: one group stores encrypted names, another group stores encrypted ID card numbers, and yet another group stores encrypted phone numbers. Each group contains 8912 data entries, and the data stored in corresponding positions within each group has a mapping relationship. For instance, the encrypted ID card number stored in the third position of the encrypted ID card number group and the encrypted phone number stored in the third position of the encrypted phone number group belong to the same object.

[0093] In this embodiment, based on the target location information of the query index in the corresponding bucket, the location information of the homomorphic ciphertext of the data to be queried in the corresponding feature group is determined, the homomorphic ciphertext in the corresponding location information is extracted, the homomorphic ciphertext is decrypted, and the corresponding query result is obtained.

[0094] Optionally, the target homomorphic ciphertext is decrypted using the private key in the second key pair to obtain the target query result, including:

[0095] Based on the preset operation function, the target homomorphic ciphertext is processed to obtain the operation result;

[0096] Salt the calculation results to obtain the salted calculation results;

[0097] The salted operation result is decrypted using the private key in the second key pair to obtain the decrypted result.

[0098] The desalted result is then desalted to obtain the target query result.

[0099] In this embodiment, the data to be queried is homomorphically encrypted. A preset operation function is used to process the target homomorphic ciphertext to obtain the result. The preset operation function is an operation function based on the desired query result from the data to be queried. For example, if the sum of the data to be queried in database A and database B is needed, the preset operation function is a sum operation; if the difference between the data to be queried in database A and database B is needed, the preset operation function is a difference operation; if the mean of the data to be queried in database A and database B is needed, the preset operation function is a mean operation, and so on. The operation result is then salted to obtain a salted result. Salting involves adding a random number after the ciphertext operation to increase the security of the ciphertext. After salting, the salted result is decrypted using the private key from the second key pair to obtain the decrypted result. The decrypted result is then desalted to obtain the target query result.

[0100] In this invention, the data query method is applied to a database set and a client. The database set comprises N databases, where N is an integer greater than 1. For each database node to be queried in the database set, a first key pair is generated. The public key of the first key pair is sent to the querying party. Any database node to be queried is selected as a collaborating node, and a second key pair is generated using homomorphic operations. This second key pair is sent to the querying party and the other database nodes to be queried. The blinded index data fed back by the querying party based on the first key pair is obtained. The blinded index data is encrypted using the private key of the first key pair to obtain encrypted index data, which is then sent to the querying party. The first bucket identifier corresponding to the encrypted index data fed back by the querying party is obtained. Based on the first bucket identifier, the preset encrypted index data in the second bucket identifier, which is equal to the first bucket identifier, is sent to the querying party.

[0101] In the client, the query index is blinded based on the public key in the first public key pair, resulting in blinded index data. This blinded index data is then sent to the database node to be queried in the database set. Based on the encrypted index data returned by the database node to be queried, deblinding and bucketing processes are performed to obtain the deblinded encrypted index data and the corresponding first bucket identifier. The first bucket identifier is then sent to the database node to be queried. The deblinded encrypted index data is compared with the preset encrypted index data returned by the database node to be queried to determine the target location information of the query index in the corresponding bucket. Based on the homomorphic ciphertext returned by the database node to be queried based on the second key pair and the target location information, the target homomorphic ciphertext corresponding to the target location information is determined. The target homomorphic ciphertext is then decrypted based on the target homomorphic ciphertext and the private key in the second key pair to obtain the target query result.

[0102] In this invention, the query index is asymmetric encrypted and the logarithmic value is fully homomorphically encrypted. The query data corresponding to the query index is encrypted using the private key of the asymmetric encryption, thus protecting the privacy of the querying party. By performing fully homomorphic encryption on the data to be queried, direct computation can be performed between the encrypted data, thereby improving the query efficiency of the query results.

[0103] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of a basic data query device provided in an embodiment of the present invention. In this embodiment, the server includes units used for execution... Figure 2 The steps in the corresponding embodiments. Please refer to the details. Figure 2 The relevant descriptions in the corresponding embodiments are shown below. For ease of explanation, only the parts relevant to this embodiment are shown. See also... Figure 4The data query device 40 includes: a key pair generation module 41, an encryption module 42, and a bucket identifier determination module 43.

[0104] The key pair generation module 41 is used to generate a first key pair in the database node to be queried in the database set, send the public key in the first key pair to the querying party, select any database node to be queried in the database set as a cooperating node, use homomorphic operation to generate a second key pair, and send the public key in the second key pair to the querying party and the other database nodes to be queried.

[0105] The encryption module 42 is used to obtain the blinded index data fed back by the querying party based on the first key pair, encrypt the blinded index data using the private key in the first key pair to obtain encrypted index data, and send the encrypted index data to the querying party.

[0106] The bucket identifier determination module 43 is used to obtain the first bucket identifier corresponding to the encrypted index data returned by the querying party, and send the preset encrypted index data in the second bucket identifier, which is equal to the first bucket identifier, to the querying party based on the first bucket identifier.

[0107] Optionally, the above-mentioned bin identification number determination module 43 includes:

[0108] The preset number of buckets determination unit is used to determine the preset number of buckets based on the number of indexes in each column of the query field in the database to be queried.

[0109] The preset encrypted index data determination unit is used to encrypt the query index of each column in the query field using the private key in the first key pair to obtain the preset encrypted index data.

[0110] The second bucket identifier determination unit is used to determine the second bucket identifier corresponding to each preset encrypted index data according to the preset encrypted index data and the preset number of buckets.

[0111] The preset encrypted index data sending unit is used to send the preset encrypted index data in the second bucket identifier number, which is equal to the first bucket identifier number, to the querying party.

[0112] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a basic data query device provided in an embodiment of the present invention. In this embodiment, the single client units included in the terminal are used to execute... Figure 3 The steps in the corresponding embodiments. Please refer to the details. Figure 3 The relevant descriptions in the corresponding embodiments are shown below. For ease of explanation, only the parts relevant to this embodiment are shown. See also... Figure 5The data query device 50 includes: a blinding module 51, a bucketing processing module 52, a comparison module 53, and a decryption module 54.

[0113] The blinding module 51 is used to blind the query index according to the public key in the first public key pair obtained, to obtain blinded index data, and to send the blinded index data to the database node to be queried in the database set.

[0114] The bucketing module 52 is used to obtain the deblinded encrypted index data and the first bucket identifier corresponding to the encrypted index data through deblinding and bucketing calculation based on the encrypted index data fed back by the database node to be queried, and then send the first bucket identifier to the database node to be queried.

[0115] The comparison module 53 is used to compare the deblinded encrypted index data with the preset encrypted index data fed back by the database node to be queried, and to determine the target location information of the query index in the corresponding bucket.

[0116] The decryption module 54 is used to determine the target homomorphic ciphertext corresponding to the target location information based on the homomorphic ciphertext fed back by the database node to be queried based on the second key pair and the target location information, and to decrypt the target homomorphic ciphertext using the private key in the second key pair to obtain the target query result.

[0117] Optionally, the aforementioned blinding module 51 includes:

[0118] The blinded index data determination unit is used to calculate the blinded index data corresponding to the query index based on the generated random data and the public key in the first key pair.

[0119] Optionally, the above-mentioned bucket processing module 52 includes:

[0120] The deblinding unit is used to deblind the encrypted index data based on the feedback from the database node to be queried using generated random data, so as to obtain the deblinded encrypted index data.

[0121] The first bucket identifier determination unit is used to determine the first bucket identifier corresponding to the encrypted index data based on the deblinded encrypted index data and the preset number of buckets.

[0122] Optionally, the above-mentioned decryption module 54 includes:

[0123] The arithmetic processing unit is used to perform arithmetic processing on the target homomorphic ciphertext according to a preset arithmetic function to obtain the arithmetic result;

[0124] The salting unit is used to salt the calculation results to obtain the salted calculation results.

[0125] The decryption unit is used to decrypt the salted operation result using the private key in the second key pair to obtain the decrypted result.

[0126] The desalting unit is used to desalt the decryption result to obtain the target query result.

[0127] It should be noted that the information interaction and execution process between the above-mentioned units are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0128] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 6 As shown, the computer device of this embodiment includes: at least one processor ( Figure 6 Only one is shown in the diagram), a memory, and a computer program stored in the memory and executable on at least one processor, wherein the processor executes the computer program to implement the steps in any of the above-described data query method embodiments.

[0129] This computer device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that... Figure 6 The examples of computer devices are merely examples and do not constitute a limitation on computer devices. Computer devices may include more or fewer components than shown in the illustration, or combinations of certain components, or different components, such as network interfaces, displays, and input devices.

[0130] The processor referred to can be a CPU, but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0131] Memory includes readable storage media, internal memory, etc., wherein internal memory can be the RAM of a computer device, providing an environment for the operation of the operating system and computer-readable instructions stored in the readable storage media. The readable storage media can be the hard drive of a computer device, or in other embodiments, it can be an external storage device of the computer device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, memory can include both internal storage units and external storage devices of the computer device. Memory is used to store the operating system, applications, bootloader, data, and other programs, such as program code for computer programs. Memory can also be used to temporarily store data that has been output or will be output.

[0132] Those skilled in the art will understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the functions described above can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this invention. The specific working process of the units and modules in the above device can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the processes in the methods of the above embodiments by instructing related hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the above method embodiments. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. A computer-readable medium can include at least: any entity or device capable of carrying computer program code, a recording medium, a computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0133] The present invention can implement all or part of the processes in the methods of the above embodiments, or it can be accomplished by a computer program product. When the computer program product is run on a computer device, the computer device executes the steps in the above method embodiments.

[0134] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0135] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0136] In the embodiments provided by this invention, it should be understood that the disclosed apparatus / computer devices and methods can be implemented in other ways. For example, the apparatus / computer device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0137] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0138] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A data query method, characterized by, The data query method is applied to a database set, the database set comprises N databases, N is an integer greater than 1, and the data query method comprises the following steps: In each to-be-queried database node in the database set, a first key pair is generated, a public key in the first key pair is sent to a querying party, and any to-be-queried database node in the database set is selected as a collaborative node, a second key pair is generated using homomorphic operation, and the second key pair is sent to the querying party and the remaining to-be-queried database nodes; Blind index data fed back by the querying party based on the first key pair is acquired, the blind index data is encrypted by using a private key in the first key pair to obtain encrypted index data, and the encrypted index data is sent to the querying party; A first bucket identifier corresponding to the encrypted index data fed back by the querying party is acquired, and preset encrypted index data in a second bucket identifier equal to the first bucket identifier is sent to the querying party according to the first bucket identifier, the second bucket identifier being a bucket identifier corresponding to each query index in the to-be-queried database; The acquisition of the first bucket identifier corresponding to the encrypted index data fed back by the querying party and the sending of the preset encrypted index data in the second bucket identifier equal to the first bucket identifier to the querying party according to the first bucket identifier comprise the following steps: The number of preset buckets is determined according to the number of each column query index in a query field in the to-be-queried database; Each column query index in the query field is encrypted by using the private key in the first key pair to obtain preset encrypted index data; A second bucket identifier corresponding to each preset encrypted index data is determined according to the preset encrypted index data and the number of preset buckets; The preset encrypted index data in the second bucket identifier equal to the first bucket identifier is sent to the querying party.

2. A data query method, characterized by, The data query method is applied to a client, and the data query method comprises the following steps: Blind index data corresponding to a query index is obtained by calculation according to generated random data and a public key in a first key pair, and the blind index data is sent to to-be-queried database nodes in a database set; Encrypted index data fed back by the to-be-queried database nodes is deblinded by using the generated random data to obtain deblinded encrypted index data; A first bucket identifier corresponding to the encrypted index data is determined according to the deblinded encrypted index data and a number of preset buckets, and the first bucket identifier is sent to the to-be-queried database nodes; Target position information of the query index in a corresponding bucket is determined by comparing the deblinded encrypted index data with preset encrypted index data fed back by the to-be-queried database nodes; Target homomorphic ciphertext corresponding to the target position information is determined according to homomorphic ciphertext fed back by the to-be-queried database nodes based on a second key pair and the target position information, and an operation result is obtained by performing operation processing on the target homomorphic ciphertext according to a preset operation function. The operation result is salted to obtain a salted operation result; The salted operation result is decrypted using a private key in the second key pair to obtain a decryption result; The decryption result is desalted to obtain a target query result.

3. A data query apparatus, characterized by comprising: The data query device is applied to a database set, the database set includes N databases, N is an integer greater than 1, and the data query device includes: A key pair generation module is configured to generate a first key pair in a to-be-queried database node in the database set, send a public key in the first key pair to a querying party, select any to-be-queried database node as a collaborative node in the database set, and generate a second key pair using homomorphic operation, and send a public key in the second key pair to the querying party and the remaining to-be-queried database nodes; An encryption module is configured to obtain blind index data fed back by the querying party based on the first key pair, encrypt the blind index data using a private key in the first key pair to obtain encrypted index data, and send the encrypted index data to the querying party; A bucket identification number determination module is configured to obtain a first bucket identification number corresponding to the encrypted index data fed back by the querying party, and send preset encrypted index data in a second bucket identification number equal to the first bucket identification number to the querying party according to the first bucket identification number. The first bucket identification number corresponding to the encrypted index data fed back by the querying party is obtained, and preset encrypted index data in a second bucket identification number equal to the first bucket identification number is sent to the querying party according to the first bucket identification number, including: A preset number of buckets is determined according to the number of query indexes in each column of the query field in the to-be-queried database; Each column of query indexes in the query field is encrypted using a private key in the first key pair to obtain preset encrypted index data; A second bucket identification number corresponding to each preset encrypted index data is determined according to the preset encrypted index data and the preset number of buckets; The preset encrypted index data in the second bucket identification number equal to the first bucket identification number is sent to the querying party.

4. A data query apparatus, characterized by comprising: The data query device is applied to a client, and the data query device includes: A blinding module is configured to obtain blind index data corresponding to query indexes by calculation according to generated random data and a public key in a first key pair, and send the blind index data to to-be-queried database nodes in a database set; A bucket processing module is configured to perform deblinding processing on encrypted index data fed back based on the to-be-queried database nodes using generated random data to obtain deblinded encrypted index data; A first bucket identification number corresponding to the encrypted index data is determined according to the deblinded encrypted index data and a preset number of buckets, and the first bucket identification number is sent to the to-be-queried database nodes. The comparison module is configured to compare the de-blinded encrypted index data with the preset encrypted index data fed back by the database node to be queried, and determine target location information of the query index in a corresponding bucket; The decryption module is configured to determine target homomorphic ciphertext corresponding to the target location information according to the homomorphic ciphertext fed back by the database node to be queried based on a second key and the target location information, perform operation processing on the target homomorphic ciphertext according to a preset operation function, and obtain an operation result; The operation result is subjected to salt processing to obtain a salted operation result; The salted operation result is subjected to decryption processing by using a private key in the second key to obtain a decryption result; The decryption result is subjected to desalt processing to obtain a target query result.

5. A computer device, comprising: The computer device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, and the processor implements the data query method of any one of claims 1-2 when executing the computer program.

6. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 5. The computer program is executed by the processor to implement the data query method of any one of claims 1-2.

Images