Non-relational database ciphertext data retrieval method and medium

Abstract

The application discloses a kind of non-relational database cipher data retrieval methods, comprising: step one, obtaining the plaintext retrieval request that data user submits to database system, extract the plaintext keyword in the plaintext retrieval request;Step two, according to the plaintext keyword according to the proposed cipher data retrieval algorithm based on key characteristic value, generates cipher retrieval characteristic value by feedback reinforcement training learning, and executes cipher data retrieval in database to obtain cipher data;Its step three, the obtained cipher data is decrypted operation to restore plaintext data document.The application has the advantages that the encrypted data in non-relational database can be retrieved, it is convenient for user to find encrypted data in database, and can support non-relational database field-level encrypted data retrieval.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and medium for retrieving encrypted data from a non-relational database. Background Technology

[0002] The widespread adoption of cloud computing technology has led to a rapid increase in data volume, resulting in the rapid deployment of unstructured database systems. However, since NoSQL databases primarily store data in plaintext, they pose numerous security risks. Even MongoDB, a widely used database, only introduced field-level encryption with the release of MongoDB 4.2 Enterprise Edition, but this did not adequately address the issue of retrieving encrypted data at this level. In other words, after encrypting the entire database in a NoSQL database, it becomes difficult to securely select and query encrypted data. Apart from the data source user, other essential applications cannot support expression queries. While MongoDB 4.2 Enterprise Edition offers more flexible encryption strategies after introducing field-level encryption, it still does not support users performing expression queries on completely randomly encrypted data. Therefore, there is an urgent need to research encrypted data retrieval methods for NoSQL databases to address the problem of encrypted data storage and enable retrieval of field-level encrypted data. Summary of the Invention

[0003] This invention provides a method and medium for retrieving encrypted data from a non-relational database. Its advantages include the ability to retrieve encrypted data from a non-relational database, making it convenient for users to find encrypted data in the database, and supporting data retrieval at the field level of encryption in non-relational databases.

[0004] On one hand, the present invention provides a method for retrieving encrypted data from a non-relational database, comprising:

[0005] Step 1: Obtain the plaintext retrieval request submitted by the data user to the database system, and extract the plaintext keywords from the plaintext retrieval request;

[0006] Step 2: Generate a ciphertext retrieval feature value t′ based on the plaintext keyword, and perform a ciphertext data retrieval in the database to obtain the ciphertext data;

[0007] Step 3: Decrypt the obtained ciphertext data to recover the plaintext data document.

[0008] Furthermore, step two is completed using the SEARCH algorithm, which is based on keyword feature values ​​for ciphertext data retrieval.

[0009] The encrypted data retrieval algorithm SEARCH based on keyword feature values ​​includes:

[0010] Initialization algorithm: k = SEARCH.setup(λ), which generates the encryption / decryption key k by giving the security parameter λ;

[0011] Encryption algorithm: c = SEARCH.enc(k,m), input plaintext m and key k generated by the system initialization algorithm. This encryption algorithm transforms plaintext m into ciphertext c and uploads it to a non-relational database.

[0012] Algorithm for generating keyword feature values: t = H(H) m H C In plaintext document m, select keywords, use the hash function Hash to generate feature value t, and store {t,c} in the feature value database.

[0013] Keyword feature value matching algorithm based on feedback reinforcement training: When a data user performs a plaintext search, for any plaintext keyword w to be searched, a ciphertext search feature value t′ is generated, and then the feature value t′ is subjected to feedback reinforcement training until t′ matches t.

[0014] Algorithm for determining feature value matching results: If the ciphertext retrieval feature value t′ matches the feature value t, perform keyword retrieval based on the corresponding field of the ciphertext in the database based on the retrieval keyword w, and output the corresponding ciphertext c;

[0015] Decryption algorithm: m = SEARCH.dec(k,c), which recovers the plaintext m from the ciphertext c based on the ciphertext c and the key k.

[0016] Furthermore, the keyword feature value matching algorithm based on feedback reinforcement training learning includes the following steps:

[0017] Generate encrypted keyword retrieval feature value t′, t′=SEARCH.trapdoof(k sEARCH Input plaintext search keyword w and key k. SEARCH Generate encrypted keyword retrieval feature value t′; use t′ as label data;

[0018] The algorithm matches the ciphertext keyword search feature values ​​t′ and t. {true,false} = SEARCH.query(t′,t), where t′ and t are input, and the algorithm returns the matching comparison result between the search feature value t′ and t; true indicates a match, and false indicates a no match.

[0019] If the matching result is false, t′ and t are assigned as initial values ​​to the pre-trained language model (LM); the text output generated by LM is sorted and labeled to generate a scalar number SN;

[0020] The scalar number SN is fed back to LM for optimization and fine-tuning, and feedback reinforcement learning (RL) is performed sequentially until any plaintext m = {m1, m2, ..., m} is obtained. n The encrypted ciphertext c is true for any search keyword w if w∈m.

[0021] Furthermore, the algorithm trapdoof() used to generate the encrypted keyword for retrieving the feature value t′ is either MD5 or SHA-512.

[0022] Furthermore, the query() algorithm, which matches the ciphertext keyword retrieval feature values ​​t′ and t, uses the string matching algorithm KMP.

[0023] Furthermore, the encryption algorithm used is a searchable symmetric encryption algorithm (SSE).

[0024] Furthermore, when retrieving encrypted data from the database, the encrypted data stored in the database is divided into several sub-data. If any sub-data in a piece of encrypted data contains the search keyword w, the entire encrypted data is output.

[0025] Furthermore, it also includes: setting up a key database to store encryption and decryption keys k, and in step three, calling the encryption and decryption keys k stored in the key database to perform decryption operations on the ciphertext data.

[0026] Furthermore, the identity of the data user is verified before step three, and step three is executed after the data user's identity is verified.

[0027] On the other hand, the present invention provides a medium for storing a computer program, which, when invoked and executed, performs the non-relational database encrypted data retrieval method described in any of the above schemes.

[0028] In summary, the beneficial effects of this invention are: it enables the retrieval of encrypted data in non-relational databases, making it easier for users to find encrypted data in the database, and it supports data retrieval at the field level of encryption in non-relational databases. Attached Figure Description

[0029] Figure 1 This is a schematic diagram illustrating the principle of the non-relational database encrypted data retrieval method of the present invention;

[0030] Figure 2 This is a flowchart illustrating the algorithm for establishing keyword feature values ​​in this invention;

[0031] Figure 3 This is a flowchart illustrating the keyword feature value matching algorithm based on feedback reinforcement training learning of the present invention.

[0032] Figure 4 This is a schematic diagram of the proxy component and its encrypted data retrieval process in an embodiment of the present invention. Detailed Implementation

[0033] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0034] Example: This embodiment of the invention provides a method for retrieving encrypted data from a non-relational database, including:

[0035] Step 1: Obtain the plaintext retrieval request submitted by the data user to the database system, and extract the plaintext keywords from the plaintext retrieval request;

[0036] Step 2: Generate a ciphertext retrieval feature value t′ based on the plaintext keyword, and perform a ciphertext data retrieval in the database to obtain the ciphertext data;

[0037] Step 3: Decrypt the obtained ciphertext data to recover the plaintext data document.

[0038] It should be understood that the above three steps are only for distinguishing each step and indicating the order of the steps, and are not the entirety of the steps in this plan.

[0039] Step two is accomplished using the SEARCH algorithm, which retrieves encrypted data based on keyword feature values.

[0040] The encrypted data retrieval algorithm SEARCH based on keyword feature values ​​includes:

[0041] (1) Initialization algorithm: k = SEARCH.setup(λ), which generates encryption and decryption keys k by giving security parameters λ.

[0042] (2) Encryption algorithm: c = SEARCH.enc(k,m), input plaintext m and key k generated by the system initialization algorithm. This encryption algorithm transforms plaintext m into ciphertext c and uploads it to a non-relational database.

[0043] (3) Algorithm for generating keyword feature values: t = H(H m H C The algorithm selects keywords from plaintext document m, generates feature values ​​t using a hash function, and stores {t, c} in a feature value database. The specific process for generating keyword feature values ​​is as follows: Figure 2 As shown

[0044] (4) Keyword Feature Value Matching Algorithm Based on Feedback Reinforcement Training: When a data user performs a plaintext search, for any plaintext keyword w to be searched, a ciphertext search feature value t′ is generated. Then, the feature value t′ is subjected to feedback reinforcement training until t′ matches t; for example... Figure 3 As shown, it includes the following steps:

[0045] ① Generate encrypted keyword retrieval feature value t′, t′=SEARCH.trapdoof(k SEARcH Input plaintext search keyword w and key k. SEARCH Generate encrypted keyword retrieval feature value t′; use t′ as tag data; the algorithm trapdoof() used to generate encrypted keyword retrieval feature value t′ should be either MD5 or SHA-512.

[0046] ② Match the ciphertext keyword search feature values ​​t′ and t, {true,false}=SEARCH.query(t′,t), input t′ and t, the algorithm returns the matching comparison result of the search feature value t′ and t; true means match, false means no match; the algorithm query() that matches the ciphertext keyword search feature values ​​t′ and t is the string matching algorithm KMP;

[0047] ③ If the matching result is false, then t′ and t are assigned as initial values ​​to the pre-trained language model (LM); the text output generated by LM is sorted and labeled to generate a scalar number (SN);

[0048] ④ Feedback the scalar number SN to LM for optimization and fine-tuning, and perform feedback reinforcement learning (RL) in sequence until the plaintext m = {m1, m2, ..., m} is satisfied. n The encrypted ciphertext c is true for any search keyword w if w∈m.

[0049] (5) Algorithm for determining feature value matching results: If the ciphertext retrieval feature value t′ matches the feature value t, a keyword retrieval is performed based on the corresponding field of the ciphertext in the database according to the retrieval keyword w, and the corresponding ciphertext c is output. In one embodiment of the present invention, when retrieving ciphertext data in the database, the ciphertext data stored in the database is divided into several sub-data. If any sub-data in a ciphertext contains the retrieval keyword w, the entire ciphertext data is output. Specifically, for a ciphertext data C′ stored in the database, it is divided into (c i (i = 1, 2, 3, ..., n).

[0050] (6) Decryption Algorithm: m = SEARCH.dec(k,c), based on the ciphertext c and the key k, this algorithm recovers the plaintext m from the ciphertext c. In one embodiment of the present invention, the method further includes the step of: setting up a key database to store encryption and decryption keys k; in step three, calling the encryption and decryption keys k stored in the key database to perform decryption operations on the ciphertext data. Before step three, the identity of the data user is verified; after the data user's identity is verified, step three is executed.

[0051] For string data, a searchable symmetric encryption algorithm (SSE) can be used as the encryption algorithm.

[0052] The above solution is implemented in a proxy component, which can be implemented using a B / S architecture design that allows web application servers and database servers to interact. Each functional entity module follows the application programming interface specification and can be implemented using any computer programming language such as Java, Node.js, or Python.

[0053] This invention uses a text-based MongoDB database as a specific example for illustration. When applied to a NoSQL database, the solution involves five entities, such as... Figure 1 The diagram illustrates the components: a database firewall, a proxy component, a NoSQL database cluster, data users, and data owners. Data owners upload data information, encrypt the data, and upload it to the database system. Data users can decrypt documents with access permissions, but before accessing the database system, they are unsure what documents exist in the database or whether they contain the required data. After a data user submits a plaintext search request to the database system, the proxy component first uses the database firewall to control access and intercept all plaintext data operation requests from the client data user, analyzing and determining the submitted search method and keywords. Then, it calls the encrypted data retrieval algorithm (SEARCH) based on keyword feature values ​​to perform encrypted data retrieval in the database. Finally, the data user calls the decryption module to decrypt the encrypted data and recover the plaintext data document.

[0054] The proxy component includes a decryption module that uses decryption algorithms to encrypt and decrypt documents. For the key database, a corresponding key manager is set up to manage it and verify the identity of the data user.

[0055] In a NoSQL database system, the proxy component and its encrypted data retrieval process are as follows: Figure 4 As shown, the main steps are as follows:

[0056] (1) The data user registered by the client sends a plaintext retrieval request to the proxy component.

[0057] (2) The proxy component intercepts all plaintext data operation requests from data users, analyzes and determines the retrieval method of the data operation requests, and identifies the characteristics of the search keywords. Data query operations performed by data users may include retrieval methods such as equality query, range query, prefix query, suffix query, and substring query. Note that the non-relational database (MongoDB) stores encrypted data, and the data retrieval performed in the database is encrypted. For example, the specific steps for keyword retrieval of encrypted data using a combination of random encryption and retrieval algorithm (RND+SEARCH) are as follows:

[0058] ① The proxy component first identifies the search method and keywords, then calls the encryption / decryption module to send a request to the key manager to use the decryption key k, obtaining the key management decryption service specified by the data owner. For example, when searching for documents containing the keyword "artificial intelligence," the decryption algorithm module is called to send a decryption key request to the key manager, obtaining the decryption key k associated with or bound to the data user.

[0059] ② Perform keyword retrieval on the encrypted data (e.g., using a combination of RND and SEARCH retrieval algorithms). If the plaintext search keyword is w (e.g., artificial intelligence), then use the algorithm SEARCH.trapdoof(k) SEARCH Generate the encrypted retrieval feature value t′ for the keyword w (artificial intelligence). For example, for simplicity, the encrypted retrieval feature value t′ = f068f0dad74789bee210163c40a4b50d can be directly generated using the MD5 algorithm.

[0060] ③ The proxy component rewrites the retrieval operation request, converting the plaintext retrieval request into a ciphertext retrieval request with the ciphertext retrieval feature value t′, and submits it to the non-relational database cluster. For example, using the find() method in MongoDB, to query documents in the collection liucoll whose content field contains the sub-document keyword and whose feature value t′ begins with "f068", the retrieval request command is as follows:

[0061] >db.liucoll.find({"content.keyword": / ^f068 / }).pretty()

[0062] ④ Use the algorithm SEARCH.query(t′,t) to determine the feature values ​​t′, t and their relationship with the ciphertext data C′(c′). i The matching relationship is defined as follows: (i = 1, 2, 3, ..., n). If true, it indicates that the ciphertext contains the keyword w to be retrieved, and the entire ciphertext C′ is returned to the decryption module in the proxy component. For example, the database cluster returns the ciphertext data document c′ containing the keyword. i as follows:

[0063]

[0064]

[0065] ⑤ After the decryption module obtains the ciphertext C′, the data user uses the decryption key k from the key manager's key store. RND Call the corresponding decryption algorithm in the decryption module, such as RND.dec(k RND c) Perform decryption to recover the plaintext data m. Note: Only users with access to the correct decryption key can read and decrypt the encrypted data.

[0066] ⑥ Present the plaintext data M-document to the client data user.

[0067] All parts not covered in this invention are the same as or implemented using existing programming techniques.

[0068] This invention also provides a medium for storing a computer program, which, when invoked and run, executes the above-described method for retrieving encrypted data from a non-relational database.

[0069] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several modifications and improvements without departing from the inventive concept of the present invention, and these all fall within the protection scope of the present invention.

Claims

1. A method for retrieving encrypted data from a non-relational database, characterized in that, include: Step 1: Obtain the plaintext retrieval request submitted by the data user to the database system, and extract the plaintext keywords from the plaintext retrieval request; Step 2: Generate a ciphertext retrieval feature value t′ based on the plaintext keyword, and perform a ciphertext data retrieval in the database to obtain the ciphertext data; Step two is completed using the SEARCH algorithm, which retrieves encrypted data based on keyword feature values. The encrypted data retrieval algorithm SEARCH based on keyword feature values ​​includes: Initialization algorithm: k = SEARCH.setup(λ), which generates the encryption / decryption key k by giving the security parameter λ; Encryption algorithm: c = SEARCH.enc(k,m), input plaintext m and key k generated by the system initialization algorithm. This encryption algorithm transforms plaintext m into ciphertext c and uploads and stores it in a non-relational database; Algorithm for generating keyword feature values: t = H(H) m H C In plaintext document m, select keywords, use the hash function Hash to generate feature value t, and store {t,c} in the feature value database. Keyword feature value matching algorithm based on feedback reinforcement training: When a data user performs a plaintext search, for any plaintext keyword w to be searched, a ciphertext search feature value t′ is generated, and then the feature value t′ is subjected to feedback reinforcement training until t′ matches t. Algorithm for determining feature value matching results: If the ciphertext retrieval feature value t′ matches the feature value t, perform keyword retrieval based on the corresponding field of the ciphertext in the database based on the retrieval keyword w, and output the corresponding ciphertext c; Decryption algorithm: m = SEARCH.dec(k,c), which recovers the plaintext m from the ciphertext c based on the ciphertext c and the key k. The keyword feature value matching algorithm based on feedback reinforcement training learning includes the following steps: Generate encrypted keyword retrieval feature value t′, t′=SEARCH.trapdoof(k SEARCH Input plaintext search keyword w and key k. SEARCH Generate encrypted keyword retrieval feature value t′; use t′ as label data; The algorithm matches the ciphertext keyword search feature values ​​t′ and t. {true,false} = SEARCH.query(t′,t), where t′ and t are input, and the algorithm returns the matching comparison result between the search feature value t′ and t; true indicates a match, and false indicates a no match. If the matching result is false, t′ and t are assigned as initial values ​​to the pre-trained language model (LM); the text output generated by LM is sorted and labeled to generate a scalar number SN; The scalar number SN is fed back to LM for optimization and fine-tuning, and feedback reinforcement learning (RL) is performed sequentially until any plaintext m = {m1, m2, ..., m} is obtained. n The encrypted ciphertext c, for any search keyword w, if w∈m, then SEARCH.query(t′,t) is true; Step 3: Decrypt the obtained ciphertext data to recover the plaintext data document.

2. The method for retrieving encrypted data from a non-relational database according to claim 1, characterized in that, The algorithm trapdoof() used to generate ciphertext keywords and retrieve feature values ​​t′ employs either MD5 or SHA-512 algorithms.

3. The method for retrieving encrypted data from a non-relational database according to claim 1, characterized in that, The query() algorithm, which matches the feature values ​​t′ and t of the encrypted keyword retrieval, uses the KMP string matching algorithm.

4. The method for retrieving encrypted data from a non-relational database according to claim 1, characterized in that, The encryption algorithm used is a searchable symmetric encryption algorithm (SSE).

5. The method for retrieving encrypted data from a non-relational database according to claim 1, characterized in that, When retrieving encrypted data from a database, the encrypted data stored in the database is divided into several sub-data. If any sub-data in a encrypted data contains the search keyword w, the entire encrypted data is output.

6. The method for retrieving encrypted data from a non-relational database according to claim 1, characterized in that, Also includes: Set up a key database to store encryption and decryption keys k. In step three, call the encryption and decryption keys k stored in the key database to perform decryption operations on the ciphertext data.

7. The method for retrieving encrypted data from a non-relational database according to claim 6, characterized in that, Before step three, the identity of the data user is verified. Step three is executed after the identity of the data user is verified.

8. A medium for storing a computer program, characterized in that, When the computer program is invoked and executed, it performs the non-relational database encrypted data retrieval method according to any one of claims 1-7.

Images