A string encryption method, device, equipment and storage medium

Abstract

The application discloses a string encryption method and device, equipment and storage medium, and relates to the computer technical field, and includes: obtaining a to-be-encrypted string and a preset shortest character segmentation length, determining a to-be-segmented length set based on the shortest character segmentation length and an original length of the to-be-encrypted string; segmenting the to-be-encrypted string based on the to-be-segmented length set to obtain a set of decomposed strings; encrypting the set of decomposed strings by using a preset encryption algorithm to obtain a set of encrypted strings; and storing the set of encrypted strings and a primary key identifier corresponding to the to-be-encrypted string into an encryption auxiliary storage table. The to-be-encrypted string is segmented according to different lengths, the decomposed strings are respectively encrypted and stored, and the corresponding information is queried through the primary key identifier in the newly-added encryption auxiliary storage table, so that the business function requirement is met, and the query performance and the query efficiency of the system are improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a string encryption method, apparatus, device, and storage medium. Background Technology

[0002] Currently, the main methods for fuzzy search of encrypted fields are: 1. Supporting fuzzy search of encrypted fields with specific rules. A new table field is added to extract characters of a specific length from sensitive strings for additional encryption and storage. The length of the extracted characters is guaranteed to be consistent with the length of the input query condition value supported by the system. For example, the last 6 digits of the ID card number are extracted and encrypted and stored. When querying, the last 6 digits of the ID card number are entered, and the system performs an exact match in the database. 2. Sensitive fields are grouped by a fixed length, generally by 4 English characters (half-width) or 2 Chinese characters (full-width). Each group of strings is then encrypted separately, and the encrypted strings are concatenated and stored in a new table field. The input query condition is then fuzzy matched in the table field. However, the above two methods have the following limitations: (1) Method 1 only supports searching of encrypted fields under specific rules or lengths, which is not very applicable to business and has a high cost of modification. (2) Method 2 uses grouped encrypted storage, which requires the encrypted field to be at least 4 English characters or 2 Chinese characters long. After the encrypted string is concatenated and stored, the length of the database storage column will increase exponentially with the increase of encrypted groups, and additional columns need to be added to store the encrypted string. This involves intrusive modification to the original business table structure. If a new column of data is encrypted, the original table structure needs to be changed, and corresponding grouped encrypted storage columns need to be added, which increases the complexity of system development and maintenance and poses a security risk to the database. (3) Both Method 1 and Method 2 require modification of the original business table fields and the addition of encrypted storage columns, which affects the storage space and query performance of the original business table.

[0003] Currently, the main method for fuzzy search of encrypted fields is to group and encrypt sensitive fields by a specific length, then concatenate and store the encrypted strings. During the search, the query conditions are also grouped and encrypted in the same way before performing a fuzzy search in the database. However, existing technologies still have the following problems: the original business table needs to add a field to store the encrypted string, which involves intrusive modification of the table structure and poses security risks to database operation and maintenance; concatenating and storing the grouped encrypted strings will result in excessively large table fields, increasing storage space, and this problem becomes more pronounced as the length of the encrypted string increases, affecting the retrieval and maintenance of table data; using fixed-length string grouping has low business adaptability and the cost of modification is high. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a string encryption method, apparatus, device, and storage medium that can meet business function requirements and improve the system's query performance and efficiency. The specific solution is as follows:

[0005] In a first aspect, the present invention discloses a string encryption method, comprising:

[0006] Obtain the string to be encrypted and the preset shortest character segmentation length, and determine the set of segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted;

[0007] The string to be encrypted is segmented based on the set of lengths to be segmented to obtain a set of decomposed strings;

[0008] The decomposed string set is encrypted using a preset encryption algorithm to obtain the encrypted string set;

[0009] The encrypted string set and the primary key identifier corresponding to the string to be encrypted are stored in the encryption auxiliary storage table.

[0010] Optionally, determining the set of word segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted includes:

[0011] Add 1 to the shortest character segmentation length to obtain the current character segmentation length;

[0012] Determine whether the current character segmentation length is less than the original length of the string to be encrypted;

[0013] If the current character segmentation length is less than the original length of the string to be encrypted, then it is determined that the current character segmentation length meets the preset character segmentation rules, and the current character segmentation length is incremented by 1, and the process re-enters the step of determining whether the current character segmentation length is less than the original length of the string to be encrypted;

[0014] If the current character segmentation length is not less than the original length of the string to be encrypted, then the segmentation length determination operation ends;

[0015] The shortest character segmentation length, the original length, and the current character segmentation length that all satisfy the preset character segmentation rules are determined as the set of lengths to be segmented.

[0016] Optionally, segmenting the string to be encrypted based on the set of lengths to be segmented includes:

[0017] Determine the target segmentation length from the set of lengths to be segmented, and take the first character of the string to be encrypted as the current starting position for truncation;

[0018] Based on the current starting position, extract a decomposed string of length equal to the target word segmentation length from the string to be encrypted;

[0019] Determine whether the current start truncation position is less than the current end truncation position; wherein, the current end truncation position is the position obtained by adding 1 to the absolute value of the difference between the target word segmentation length and the original length;

[0020] If the current start truncation position is less than the current end truncation position, then the current start truncation position is incremented by 1, and the process re-enters the step of extracting a decomposed string of length equal to the target word segmentation length from the string to be encrypted based on the current start truncation position.

[0021] If the current start position for truncation is not less than the current end position for truncation, then the current string segmentation operation ends.

[0022] Optionally, after ending the current string segmentation operation if the current start position is not less than the current end position, the method further includes:

[0023] Determine whether there is any unused length information in the set of word lengths to be segmented;

[0024] If there is unused length information in the set of lengths to be segmented, then any one of the unused length information is determined as the target segmentation length, and the process re-enters the step of taking the first character of the string to be encrypted as the current starting position for truncation;

[0025] Accordingly, the obtained set of decomposed strings includes:

[0026] If there is no unused length information in the set of word segmentation lengths, then all the decomposed strings corresponding to the target word segmentation length and the string to be encrypted are integrated to obtain the set of decomposed strings.

[0027] Optionally, encrypting the decomposed string set using a preset encryption algorithm to obtain the encrypted string set includes:

[0028] Each of the decomposed strings in the set of decomposed strings is encrypted using a preset encryption algorithm to obtain the corresponding encrypted decomposed string;

[0029] The string to be encrypted is encrypted using the preset encryption algorithm to obtain the corresponding encrypted string;

[0030] By integrating all the encrypted decomposed strings and the encrypted strings, the set of encrypted strings is obtained.

[0031] Optionally, after encrypting the string to be encrypted using the preset encryption algorithm to obtain the corresponding encrypted string, the method further includes:

[0032] The encrypted information table is obtained by replacing the string to be encrypted in the original information table with the encrypted string.

[0033] Optionally, after storing the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table, the method further includes:

[0034] Receive information query requests sent by user terminals and obtain query index information from the information query requests;

[0035] The query index information is encrypted using the preset encryption algorithm to obtain encrypted index information;

[0036] Query the table information corresponding to the encrypted index information in the encrypted auxiliary storage table;

[0037] If a unique corresponding table information is found in the encrypted auxiliary storage table, then the primary key identifier corresponding to the table information is obtained;

[0038] Based on the primary key identifier, the corresponding target information is obtained from the original information table, and the target information is sent to the user terminal.

[0039] Secondly, the present invention discloses a string encryption device, comprising:

[0040] The module for obtaining the shortest character segmentation length is used to obtain the string to be encrypted and the preset shortest character segmentation length;

[0041] The module for determining the set of word segmentation lengths is used to determine the set of word segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted;

[0042] The string segmentation module is used to segment the string to be encrypted based on the set of lengths to be segmented, so as to obtain a set of decomposed strings;

[0043] The decomposed string encryption module is used to encrypt the decomposed string set using a preset encryption algorithm to obtain the encrypted string set.

[0044] The encrypted string storage module is used to store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table.

[0045] Thirdly, the present invention discloses an electronic device, comprising:

[0046] Memory, used to store computer programs;

[0047] A processor for executing the computer program to implement the steps of the string encryption method disclosed above.

[0048] Fourthly, the present invention discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the string encryption method disclosed above.

[0049] As can be seen, this invention provides a string encryption method, comprising: obtaining the string to be encrypted and a preset minimum character segmentation length, and determining a segmentation length set based on the minimum character segmentation length and the original length of the string to be encrypted; segmenting the string to be encrypted based on the segmentation length set to obtain a set of decomposed strings; encrypting the set of decomposed strings using a preset encryption algorithm to obtain an encrypted string set; and storing the encrypted string set and the primary key identifier corresponding to the string to be encrypted in an encryption auxiliary storage table. Thus, this invention, by segmenting the string to be encrypted according to different lengths and encrypting and storing the decomposed strings separately, allows users to query corresponding information in the encryption auxiliary storage table regardless of the length of the input string. Users can then query the corresponding unencrypted information using the primary key identifier in the newly added encryption auxiliary storage table. The use of an encryption auxiliary table supports fuzzy query schemes, reduces intrusion into the original table's business model, and has no significant impact on the storage space of the original table after encryption, meeting business function requirements and improving the system's query performance and efficiency. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0051] Figure 1 This is a flowchart of a string encryption method disclosed in this invention;

[0052] Figure 2 This is a flowchart of a specific string encryption method disclosed in this invention;

[0053] Figure 3 This is a flowchart of a specific string encryption method disclosed in this invention;

[0054] Figure 4 A schematic diagram of the string encryption device provided by the present invention;

[0055] Figure 5 This invention provides a structural diagram of an electronic device. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] Current methods for querying encrypted fields have the following drawbacks: they only support searching encrypted fields under specific rules or lengths, resulting in low business applicability and high costs for modification; grouped encryption storage requires encrypted fields to be at least 4 English characters or 2 Chinese characters long, and the length of the database storage column increases exponentially with the addition of encrypted groups, necessitating additional columns to store the encrypted strings, which intrudes on the original business table structure. Adding encrypted data to a new column requires changing the original table structure and adding corresponding grouped encryption storage columns, increasing the complexity of system development and maintenance, and posing database security risks; modifying original business table fields to add encrypted storage columns impacts storage space and query performance. Therefore, this invention provides a string encryption method that meets business functional requirements and improves system query performance and efficiency.

[0058] This invention discloses a string encryption method, see [link to relevant documentation]. Figure 1 As shown, the method includes:

[0059] Step S11: Obtain the string to be encrypted and the preset shortest character segmentation length, and determine the set of segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted.

[0060] In this embodiment, the string to be encrypted and the preset shortest character segmentation length are obtained, and a set of segmentation lengths to be determined is made based on the shortest character segmentation length and the original length of the string to be encrypted. Specifically, the shortest character segmentation length is incremented by 1 to obtain the current character segmentation length; it is determined whether the current character segmentation length is less than the original length of the string to be encrypted; if the current character segmentation length is less than the original length of the string to be encrypted, it is determined that the current character segmentation length satisfies the preset character segmentation rule, and the current character segmentation length is incremented by 1, and the step of determining whether the current character segmentation length is less than the original length of the string to be encrypted is re-entered; if the current character segmentation length is not less than the original length of the string to be encrypted, the segmentation length determination operation ends; the shortest character segmentation length, the original length, and the current character segmentation lengths that all satisfy the preset character segmentation rule are determined as the set of segmentation lengths to be determined.

[0061] It is understood that this invention uses a word segmentation algorithm to segment the string to be encrypted. The length of the segmented string must be greater than or equal to the minimum value configured by the system. Then, the segmented strings are encrypted and stored separately. That is, after obtaining the shortest character segment length, it is necessary to increment the shortest character segment length by 1 and determine whether the length after incrementing the shortest character segment length by 1 is still less than or equal to the original length of the string to be encrypted. If the length after incrementing the shortest character segment length by 1 is still the original length of the string to be encrypted, then it will be incremented by 1 again. That is, starting from the shortest character segment length, it is cyclically determined whether the character segment length based on the shortest character segment length and incremented by 1 is less than the original length of the string to be encrypted. If it is less than the original length of the string to be encrypted, the loop continues; if it is equal to the original length of the string to be encrypted, the loop operation ends. At this time, the current character segment length, the shortest character segment length, and the original length obtained during the loop that satisfy the preset character segmentation rules are determined as the set of character segmentation lengths corresponding to the string to be encrypted. It should be noted that satisfying the preset character segmentation rules means that the current character segmentation length is greater than the shortest character segmentation length, and at the same time, the current character segmentation length is less than the original length.

[0062] Step S12: Segment the string to be encrypted based on the set of lengths to be segmented to obtain a set of decomposed strings.

[0063] In this embodiment, after determining the set of word segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted, the string to be encrypted is segmented based on the set of word segmentation lengths to obtain a set of decomposed strings. Specifically, a target word segmentation length is determined from the set of word segmentation lengths, and the first character of the string to be encrypted is taken as the current starting position for truncation; based on the current starting position for truncation, a decomposed string of length equal to the target word segmentation length is extracted from the string to be encrypted; it is determined whether the current starting position for truncation is less than the current ending position for truncation; wherein, the current ending position for truncation is the position obtained by adding 1 to the absolute value of the difference between the target word segmentation length and the original length; if the current starting position for truncation is less than the current ending position for truncation, the current starting position for truncation is incremented by 1, and the step of extracting a decomposed string of length equal to the target word segmentation length from the string to be encrypted based on the current starting position for truncation is re-entered; if the current starting position for truncation is not less than the current ending position for truncation, the current string segmentation operation is terminated.

[0064] Furthermore, if the current start truncation position is not less than the current end truncation position, after ending the current string segmentation operation, it is determined whether there is any unused length information in the set of word lengths to be segmented; if there is unused length information in the set of word lengths to be segmented, any one of the unused length information is determined as the target word length, and the process re-enters the step of taking the first character of the string to be encrypted as the current start truncation position; if there is no unused length information in the set of word lengths to be segmented, all the decomposed strings corresponding to the target word length and the string to be encrypted are integrated to obtain the set of decomposed strings.

[0065] For example, such as Figure 2 As shown, the length of the original string before encryption is denoted as L, and the shortest length of the substrings processed by word segmentation is N. The main processing logic of word segmentation encryption is as follows:

[0066] (1) If the length of the original string L <= N, then the original string is not segmented and is encrypted as a whole.

[0067] (2) If the length of the original string L>N, then loop through all strings with lengths of N, N+1, N+2, ..., L (the string with length L is the original string itself).

[0068] To explain the word segmentation process, we need to find all decomposed strings of length n (n can be N, N+1, N+2, ..., L).

[0069] (1) Starting from the first character of the string, extract a substring of length n;

[0070] (2) Starting from the second character of the string, extract a substring of length n; (3)...

[0072] (4) Extract a string of length n starting from the (L-n+1)th character of the string.

[0073] After extracting a substring of length n starting from the (L-n+1)th character of the original string, increment n by 1, and start extracting a substring of length n+1 again from the first character of the original string. This process is repeated until n = L. n is the current length of the substring to be calculated; Pos is the starting position of the substring of length n calculated from the original string.

[0074] In the word segmentation algorithm, a string truncation operation is performed only once at each starting position, and each string of length needs to be processed L-n+1 times (that is, the number of segmented strings of each length is L-n+1). Then, all the segmented strings are encrypted and stored independently.

[0075] Therefore, when L>N, a total of (L-N+1)*(L-N+1) strings can be obtained after word segmentation. That is, for each string, there are (L-N+1)*(L-N+1) encrypted strings. Based on this, the required storage space can be estimated.

[0076] In one specific embodiment, assuming the original string to be encrypted is "abcdefgia" with a length of 9, and the minimum word segmentation length for encryption is 4, then it is necessary to segment the string to obtain all word segments of lengths 4, 5, 6, 7, 8, and 9. The segmentation results are as follows:

[0077] Step 1: Tokenize to obtain all strings of length 4: abcd, bcde, cdef, defg, efgi, fgia;

[0078] Step 2: Tokenize to obtain all strings of length 5: abcde, bcdef, cdefg, defgi, efgia; ...

[0080] Step 5: Tokenize to obtain all strings of length 8: abcdefgi, bcdefgia;

[0081] Step 6: Tokenize to obtain all strings of length 9: abcdefgia.

[0082] Step S13: Encrypt the decomposed string set using a preset encryption algorithm to obtain the encrypted string set.

[0083] In this embodiment, the string to be encrypted is segmented based on the set of lengths to be segmented to obtain a set of decomposed strings. Then, the set of decomposed strings is encrypted using a preset encryption algorithm to obtain a set of encrypted strings. Specifically, each decomposed string in the set of decomposed strings is encrypted using the preset encryption algorithm to obtain a corresponding encrypted decomposed string; the string to be encrypted is encrypted using the preset encryption algorithm to obtain a corresponding encrypted string; and all the encrypted decomposed strings and the encrypted string are integrated to obtain the set of encrypted strings.

[0084] Step S14: Store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table.

[0085] In this embodiment, the decomposed string set is encrypted using a preset encryption algorithm. After obtaining the encrypted string set, the encrypted string set and the primary key identifier corresponding to the string to be encrypted are stored in an encrypted auxiliary storage table. It is understood that regulatory and consumer protection agencies are increasingly emphasizing the security of sensitive personal data, requiring the encrypted storage of important customer data to prevent data leakage, such as ID card numbers, names, mobile phone numbers, bank card numbers, and other sensitive personal identification information. After information is encrypted and stored, the fuzzy query function for encrypted fields in various business systems is restricted, affecting business operations. To avoid affecting the original business table structure, this invention adds an encrypted auxiliary storage table to support fuzzy queries after the sensitive fields are encrypted. The encrypted auxiliary storage table stores the primary key ID of the original business table. During fuzzy queries, the auxiliary table is used for matching to obtain the primary key ID of the original table. Then, the primary key ID is used to query the original table to obtain the relevant records, ensuring the normal use of business functions and meeting business function requirements.

[0086] It is understood that this invention creates a new encrypted auxiliary storage table for business tables that require encrypted storage to support fuzzy queries. The main table fields of the encrypted auxiliary storage table are shown in Table 1 below:

[0087] Table 1

[0088]

[0089]

[0090] The string segmentation algorithm in this invention is simple, the number of encrypted strings is predictable, and the algorithm's time complexity is O(L*L), where L is the length of the original string. It is highly efficient, simple to implement, and easy to maintain. The segmented strings are encrypted as a whole, rather than encrypted and concatenated character by character, making the encryption algorithm simpler and more efficient. The group length of the encrypted fields is not fixed and can be configured according to specific scenarios, providing greater adaptability and flexibility. Adding new encrypted fields does not require modifying the original table structure; only a new encrypted field type needs to be added to the encryption auxiliary table (i.e., adding a column name from the original business table to the encrypt_column field), demonstrating good scalability. Using an encryption auxiliary table for storage reduces intrusion into the original table's business model. Encryption has no significant impact on the original table's storage space, and different storage components can be used in the auxiliary table to improve system query performance based on specific scenarios. All encrypted information is stored in the encryption auxiliary storage table (including the full-text encrypted string of the encrypted fields). Business queries for encrypted fields only need to access the encryption auxiliary storage table. The encrypted strings contain all valid query condition values, so an index can be created on the encryption strings in the auxiliary table for precise matching, improving query efficiency (e.g., querying ID card numbers).

[0091] This invention first iterates through the original string to be encrypted, finds all decomposed strings that meet the conditions, encrypts them, and then stores the encrypted strings independently. To avoid intrusion into the original table structure, a new encryption auxiliary storage table is added. The encryption auxiliary storage table stores the primary key ID of the original business table and is associated with the original business table through the primary key ID. During fuzzy search, the encryption auxiliary storage table is queried first, and then the data in the original business table is queried through the associated ID. The encryption auxiliary storage table can use the same database as the original business table, or it can use an intermediate storage component such as ES (Elasticsearch, an open-source, highly scalable distributed full-text search engine) to improve the flexibility of business processing.

[0092] As can be seen, this invention provides a string encryption method, comprising: obtaining the string to be encrypted and a preset minimum character segmentation length, and determining a segmentation length set based on the minimum character segmentation length and the original length of the string to be encrypted; segmenting the string to be encrypted based on the segmentation length set to obtain a set of decomposed strings; encrypting the set of decomposed strings using a preset encryption algorithm to obtain an encrypted string set; and storing the encrypted string set and the primary key identifier corresponding to the string to be encrypted in an encryption auxiliary storage table. Thus, this invention, by segmenting the string to be encrypted according to different lengths and encrypting and storing the decomposed strings separately, allows users to query corresponding information in the encryption auxiliary storage table regardless of the length of the input string. Users can then query the corresponding unencrypted information using the primary key identifier in the newly added encryption auxiliary storage table. The use of an encryption auxiliary table supports fuzzy query schemes, reduces intrusion into the original table's business model, and has no significant impact on the storage space of the original table after encryption, meeting business function requirements and improving the system's query performance and efficiency.

[0093] See Figure 3 As shown, this embodiment of the invention discloses a string encryption method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution.

[0094] Step S21: Obtain the string to be encrypted and the preset shortest character segmentation length, and determine the set of segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted.

[0095] Step S22: Segment the string to be encrypted based on the set of lengths to be segmented to obtain a set of decomposed strings.

[0096] Step S23: Encrypt the decomposed string set using a preset encryption algorithm to obtain the encrypted string set.

[0097] In this embodiment, the decomposed string set is encrypted using a preset encryption algorithm. Specifically, each string in the decomposed string set is encrypted and stored separately, and the encrypted strings are then stored in the corresponding encrypted auxiliary storage table of the original business table as required. For example, suppose the nickname and ID number in the user table are segmented and encrypted, with a minimum character length (minimum segmentation length) of 2. The information in the user table before encryption is shown in Table 2 below:

[0098] Table 2

[0099] Primary key id Cert_id (ID card number) Name 10000 4305XXXXXXX0001 Ouyang Zhangsan 10001 4305XXXXXXX0002 Ouyang Lisi

[0100] Step S24: Replace the string to be encrypted in the original information table with the encrypted string to obtain the encrypted information table.

[0101] In this embodiment, the data of the user table after adopting the encrypted storage scheme is shown in Table 3 below:

[0102] Table 3

[0103] Primary key id Cert_id (ID card number) Name 10000 aaa1 bbb1 10001 aaa2 bbb2

[0104] It should be noted that aaa and bbb in Table 3 above represent the encrypted information obtained after full-text encryption of the corresponding information. That is, aaa1 corresponds to the encrypted information after full-text encryption of 4305XXXXXXX0001 in Table 2. In other words, although multiple word lengths were obtained when segmenting the string to be encrypted, and multiple decomposed strings were determined based on the multiple word lengths, the encrypted information corresponding to all the decomposed strings will not be stored in the original table. Instead, the encrypted information corresponding to all the decomposed strings will be stored in the encryption auxiliary storage table. Only the unique encrypted string corresponding to the original text (full text) of the string to be encrypted will be stored in the original table. The encrypted string is used to replace the string to be encrypted in the original information table to obtain the encrypted information table.

[0105] Step S25: Store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table.

[0106] Step S26: Receive the information query request sent by the user terminal and perform the information query operation.

[0107] In this embodiment, after storing the encrypted string set and the primary key identifier corresponding to the string to be encrypted in an encrypted auxiliary storage table, an information query operation is performed when an information query request is received from the user terminal. Specifically, the query index information in the information query request is obtained; the query index information is encrypted using the preset encryption algorithm to obtain encrypted index information; the table information corresponding to the encrypted index information is queried in the encrypted auxiliary storage table; if a unique corresponding table information is found in the encrypted auxiliary storage table, the primary key identifier corresponding to the table information is obtained; the corresponding target information is obtained from the original information table based on the primary key identifier, and the target information is sent to the user terminal.

[0108] For example, the user encryption auxiliary table stores information as shown in Table 4 below:

[0109] Table 4

[0110]

[0111]

[0112] The information shown in Table 4 above is only a partial example and not all the information. For ease of querying, the auxiliary table stores the encrypted information of the original string before tokenization (i.e., the full text of the string). It can be understood that the encryption auxiliary table will store the encrypted information corresponding to each decomposed string, the encrypted information corresponding to the original full text of the string to be encrypted, the encrypted field column name corresponding to each of the above encrypted information, and the associated ID (i.e., the primary key identifier in the original information table) corresponding to each of the above encrypted information.

[0113] When performing a fuzzy search, the user inputs query conditions (i.e., query index information). These conditions are either partial or complete information stored in the original information table. The input query condition value is encrypted using the same encryption algorithm used to store the information. Then, the encrypted string is used to perform a joint query on the original business table and the encrypted auxiliary table, and the query results are deduplicated. For example, if the user's username is "Li Si", the encrypted string "abs$%!" is obtained. This encrypted string is then used for database matching. The SQL (Structured Query Language) statement executed is as follows:

[0114] SELECT DISTINCT a.id,a.name FROM user a,user_encrypt b WHERE a.id=b.refId AND b.encrypt_column='Name' AND b.encrypt_data='abs$%! '

[0115] If both ID number and name are entered as search criteria, and these criteria are encrypted separately, the SQL executed by the database will be as follows (assuming the name search criterion is encrypted as abs$%! and the ID number search criterion is encrypted as $$!%%#):

[0116] SELECT DISTINCT a.id,a.name FROM user a,user_encrypt b WHERE a.id=b.refId AND(b.encrypt_column='Name'AND b.encrypt_data='abs$%!')AND(b.encrypt_column='Cert_id'AND b.encrypt_data='$$!%%#')

[0117] To improve query efficiency, the query can be performed in two steps. First, retrieve the primary key `id` from the encrypted auxiliary table that meets the given conditions. Second, use `id` to query the corresponding record in the business table. The executed SQL statement is as follows:

[0118] Step 1:

[0119] SELECT DISTINCT b.refId FROM user_encrypt b WHERE b.encrypt_column='Cert_id'AND b.encrypt_data='$$! %%#';

[0120] Step 2:

[0121] For example, if the value of b.refId is 10000 or 10001, the SQL statement would be as follows:

[0122] SELECT a.id,a.name FROM user a WHERE a.id IN('10000','10001');

[0123] It should be noted that the minimum character length (minimum character segmentation length) for encryption of sensitive fields is uniformly configured by the user. Users can use different minimum field length configurations for different fields according to their actual needs, and the function implementation only needs to be uniformly adapted. The encrypted auxiliary storage table can be in the same database as the original database, or it can use components such as Elasticsearch to improve storage and query efficiency. The naming of the encrypted auxiliary storage table is determined by each business system. If the encrypted auxiliary storage table is stored in other ways (i.e., it is not in the same database as the original business table), the only way is to first query the primary key ID of the original table from the auxiliary table, and then query the record in the original table using the primary key ID.

[0124] This invention encrypts the query conditions input by the user, uses the encrypted string to retrieve the primary key id of the original business table from the auxiliary table, and then uses the id to query the business table to obtain the required data. Because the encrypted string includes all strings that meet the specified length, precise queries can be performed directly in the encrypted auxiliary table. The encrypted fields can be indexed, improving query efficiency.

[0125] For details regarding steps S21, S22, and S25, please refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0126] As can be seen, this application embodiment obtains the string to be encrypted and a preset minimum character segmentation length, and determines a segmentation length set based on the minimum character segmentation length and the original length of the string to be encrypted; segments the string to be encrypted based on the segmentation length set to obtain a set of decomposed strings; encrypts the set of decomposed strings using a preset encryption algorithm to obtain an encrypted string set; replaces the string to be encrypted in the original information table with the encrypted string to obtain an encrypted information table; stores the primary key identifiers corresponding to the encrypted string set and the string to be encrypted in an encrypted auxiliary storage table; receives information query requests sent by the user terminal and performs information query operations, thus meeting business function requirements and improving the system's query performance and efficiency.

[0127] See Figure 4 As shown, this embodiment of the invention also discloses a string encryption device, comprising:

[0128] The shortest character segmentation length acquisition module 11 is used to acquire the string to be encrypted and the preset shortest character segmentation length;

[0129] The module 12 for determining the set of word segmentation lengths is used to determine the set of word segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted.

[0130] The string segmentation module 13 is used to segment the string to be encrypted based on the set of lengths to be segmented, so as to obtain a set of decomposed strings;

[0131] The decomposed string encryption module 14 is used to encrypt the decomposed string set using a preset encryption algorithm to obtain the encrypted string set.

[0132] The encrypted string storage module 15 is used to store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table.

[0133] As can be seen, the present invention includes: obtaining the string to be encrypted and a preset minimum character segmentation length, and determining a segmentation length set based on the minimum character segmentation length and the original length of the string to be encrypted; segmenting the string to be encrypted based on the segmentation length set to obtain a set of decomposed strings; encrypting the set of decomposed strings using a preset encryption algorithm to obtain an encrypted string set; and storing the encrypted string set and the primary key identifier corresponding to the string to be encrypted in an encryption auxiliary storage table. Therefore, the present invention, by segmenting the string to be encrypted according to different lengths and encrypting and storing the decomposed strings separately, allows users to query the corresponding information in the encryption auxiliary storage table regardless of the length of the input string. Users can then query the corresponding unencrypted information using the primary key identifier in the newly added encryption auxiliary storage table. The use of an encryption auxiliary table supports fuzzy query schemes, reduces intrusion into the original table's business model, and has no significant impact on the storage space of the original table after encryption, meeting business function requirements and improving the system's query performance and efficiency.

[0134] In some specific embodiments, the shortest character segmentation length acquisition module 11 specifically includes:

[0135] The unit for obtaining the string to be encrypted is used to obtain the string to be encrypted.

[0136] The shortest character segmentation length acquisition unit is used to obtain the preset shortest character segmentation length.

[0137] In some specific embodiments, the module 12 for determining the set of word lengths to be segmented specifically includes:

[0138] The current character segmentation length acquisition unit is used to add 1 to the shortest character segmentation length to obtain the current character segmentation length;

[0139] The current character segmentation length determination unit is used to determine whether the current character segmentation length is less than the original length of the string to be encrypted;

[0140] The current character segmentation length determination unit is used to determine that the current character segmentation length satisfies the preset character segmentation rules if the current character segmentation length is less than the original length of the string to be encrypted.

[0141] The current character segmentation length increment unit is used to increment the current character segmentation length by 1 and re-enter the step of determining whether the current character segmentation length is less than the original length of the string to be encrypted;

[0142] The word segmentation length determination operation termination unit is used to terminate the word segmentation length determination operation if the current character word segmentation length is not less than the original length of the string to be encrypted.

[0143] The unit for determining the set of word segmentation lengths is used to determine the set of word segmentation lengths as the set of shortest character segmentation lengths, the original lengths, and the current character segmentation lengths that all satisfy the preset character segmentation rules.

[0144] In some specific embodiments, the string segmentation module 13 specifically includes:

[0145] The target word segmentation length determination unit is used to determine the target word segmentation length from the set of word segmentation lengths to be segmented;

[0146] The current start truncation position determination unit is used to determine the first character of the string to be encrypted as the current start truncation position;

[0147] The decomposed string truncation unit is used to truncate a decomposed string of length equal to the target word segmentation length from the string to be encrypted based on the current starting truncation position;

[0148] The current start truncation position determination unit is used to determine whether the current start truncation position is less than the current end truncation position; wherein, the current end truncation position is the position obtained by adding 1 to the absolute value of the difference between the target word segmentation length and the original length;

[0149] The current start truncation position increment unit is used to increment the current start truncation position by 1 if the current start truncation position is less than the current end truncation position, and then re-enter the step of extracting a decomposed string of length equal to the target word segmentation length from the string to be encrypted based on the current start truncation position;

[0150] The string segmentation operation termination unit is used to terminate the current string segmentation operation if the current start position is not less than the current end position.

[0151] The unit for judging the length set of words to be segmented is used to judge whether there is any unused length information in the set of lengths to be segmented.

[0152] The length information determination unit is used to determine any unused length information in the set of lengths to be segmented as the target segmentation length if there is unused length information in the set of lengths to be segmented, and to re-enter the step of taking the first character of the string to be encrypted as the current starting position for truncation;

[0153] The decomposed string set acquisition unit is used to integrate all the decomposed strings corresponding to the target word length and the string to be encrypted to obtain the decomposed string set if there is no unused length information in the set of word lengths to be segmented.

[0154] In some specific embodiments, the decomposed string encryption module 14 specifically includes:

[0155] The decomposed string encryption unit is used to encrypt each of the decomposed strings in the set of decomposed strings using a preset encryption algorithm to obtain the corresponding encrypted decomposed string;

[0156] An encrypted string acquisition unit is used to encrypt the string to be encrypted using the preset encryption algorithm to obtain the corresponding encrypted string;

[0157] The encrypted string set acquisition unit is used to integrate all the encrypted decomposed strings and the encrypted string to obtain the encrypted string set.

[0158] The encrypted information table acquisition unit is used to replace the string to be encrypted in the original information table with the encrypted string to obtain the encrypted information table.

[0159] In some specific embodiments, the encrypted string storage module 15 specifically includes:

[0160] The encrypted string storage unit is used to store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table.

[0161] In some specific embodiments, after the encrypted string storage module 15, the system further includes:

[0162] The information query request receiving unit is used to receive information query requests sent by the user terminal.

[0163] The query index information acquisition unit is used to acquire the query index information in the information query request;

[0164] An encrypted index information acquisition unit is used to encrypt the query index information using the preset encryption algorithm to obtain encrypted index information;

[0165] The table information query unit is used to query the table information corresponding to the encrypted index information in the encrypted auxiliary storage table.

[0166] The primary key identifier acquisition unit is used to acquire the primary key identifier corresponding to the table information if a unique corresponding table information is found in the encrypted auxiliary storage table.

[0167] A target information determination unit is used to obtain corresponding target information from the original information table based on the primary key identifier;

[0168] The target information sending unit is used to send the target information to the user terminal.

[0169] Furthermore, embodiments of the present invention also provide an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of the invention.

[0170] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present invention. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the string encryption method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0171] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this invention, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0172] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0173] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the string encryption method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0174] Furthermore, embodiments of the present invention also disclose a computer-readable storage medium storing a computer program, which, when loaded and executed by a processor, implements the string encryption method steps disclosed in any of the foregoing embodiments.

[0175] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0176] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0177] The present invention provides a detailed description of a string encryption method, apparatus, device, and storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, those skilled in the art will recognize that there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A string encryption method, characterized in that, include: Obtain the string to be encrypted and the preset shortest character segmentation length, and determine the segmentation length set based on the shortest character segmentation length and the original length of the string to be encrypted; the segmentation length set includes the shortest character segmentation length, the original length, and all lengths between the shortest character segmentation length and the original length; The string to be encrypted is segmented based on the set of lengths to be segmented to obtain a set of decomposed strings; The decomposed string set is encrypted using a preset encryption algorithm to obtain the encrypted string set; Store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table; The step of storing the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table further includes: Receive information query requests sent by user terminals and obtain query index information from the information query requests; The query index information is encrypted using the preset encryption algorithm to obtain encrypted index information; Query the table information corresponding to the encrypted index information in the encrypted auxiliary storage table; If a unique corresponding table information is found in the encrypted auxiliary storage table, then the primary key identifier corresponding to the table information is obtained; Based on the primary key identifier, the corresponding target information is obtained from the original information table, and the target information is sent to the user terminal.

2. The string encryption method according to claim 1, characterized in that, The process of determining the set of word segmentation lengths based on the shortest character segmentation length and the original length of the string to be encrypted includes: Add 1 to the shortest character segmentation length to obtain the current character segmentation length; Determine whether the current character segmentation length is less than the original length of the string to be encrypted; If the current character segmentation length is less than the original length of the string to be encrypted, then it is determined that the current character segmentation length meets the preset character segmentation rules, and the current character segmentation length is incremented by 1, and the process re-enters the step of determining whether the current character segmentation length is less than the original length of the string to be encrypted; If the current character segmentation length is not less than the original length of the string to be encrypted, then the segmentation length determination operation ends; The shortest character segmentation length, the original length, and the current character segmentation length that all satisfy the preset character segmentation rules are determined as the set of lengths to be segmented.

3. The string encryption method according to claim 1, characterized in that, The segmentation of the string to be encrypted based on the set of lengths to be segmented includes: Determine the target segmentation length from the set of lengths to be segmented, and take the first character of the string to be encrypted as the current starting position for truncation; Based on the current starting position, extract a decomposed string of length equal to the target word segmentation length from the string to be encrypted; Determine whether the current start truncation position is less than the current end truncation position; wherein, the current end truncation position is the position obtained by adding 1 to the absolute value of the difference between the target word segmentation length and the original length; If the current start truncation position is less than the current end truncation position, then the current start truncation position is incremented by 1, and the process re-enters the step of extracting a decomposed string of length equal to the target word segmentation length from the string to be encrypted based on the current start truncation position. If the current start position for truncation is not less than the current end position for truncation, then the current string segmentation operation ends.

4. The string encryption method according to claim 3, characterized in that, If the current start position for truncation is not less than the current end position for truncation, then after ending the current string segmentation operation, the method further includes: Determine whether there is any unused length information in the set of word lengths to be segmented; If there is unused length information in the set of lengths to be segmented, then any one of the unused length information is determined as the target segmentation length, and the process re-enters the step of taking the first character of the string to be encrypted as the current starting position for truncation; Accordingly, the obtained set of decomposed strings includes: If there is no unused length information in the set of word segmentation lengths, then all the decomposed strings corresponding to the target word segmentation length and the string to be encrypted are integrated to obtain the set of decomposed strings.

5. The string encryption method according to any one of claims 1 to 4, characterized in that, The step of encrypting the decomposed string set using a preset encryption algorithm to obtain the encrypted string set includes: Each of the decomposed strings in the set of decomposed strings is encrypted using a preset encryption algorithm to obtain the corresponding encrypted decomposed string; The string to be encrypted is encrypted using the preset encryption algorithm to obtain the corresponding encrypted string; By integrating all the encrypted decomposed strings and the encrypted strings, the set of encrypted strings is obtained.

6. The string encryption method according to claim 5, characterized in that, After encrypting the string to be encrypted using the preset encryption algorithm to obtain the corresponding encrypted string, the method further includes: The encrypted information table is obtained by replacing the string to be encrypted in the original information table with the encrypted string.

7. A string encryption device, characterized in that, include: The module for obtaining the shortest character segmentation length is used to obtain the string to be encrypted and the preset shortest character segmentation length; The module for determining the length set to be segmented is used to determine the length set to be segmented based on the shortest character segmentation length and the original length of the string to be encrypted; the length set to be segmented includes the shortest character segmentation length, the original length, and all lengths between the shortest character segmentation length and the original length; The string segmentation module is used to segment the string to be encrypted based on the set of lengths to be segmented, so as to obtain a set of decomposed strings; The decomposed string encryption module is used to encrypt the decomposed string set using a preset encryption algorithm to obtain the encrypted string set. The encrypted string storage module is used to store the encrypted string set and the primary key identifier corresponding to the string to be encrypted in the encryption auxiliary storage table; The string encryption device further includes: The information query request receiving unit is used to receive information query requests sent by the user terminal. The query index information acquisition unit is used to acquire the query index information in the information query request; An encrypted index information acquisition unit is used to encrypt the query index information using the preset encryption algorithm to obtain encrypted index information; The table information query unit is used to query the table information corresponding to the encrypted index information in the encrypted auxiliary storage table. The primary key identifier acquisition unit is used to acquire the primary key identifier corresponding to the table information if a unique corresponding table information is found in the encrypted auxiliary storage table. The target information determination unit is used to obtain the corresponding target information from the original information table based on the primary key identifier; The target information sending unit is used to send the target information to the user terminal.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the string encryption method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the string encryption method as described in any one of claims 1 to 6.

Images