Ciphertext single character matching fuzzy query method and device for database encryption

Abstract

The invention discloses a ciphertext single-character matching fuzzy query method and device for database encryption, and relates to the technical field of database encryption. Through the calculation process of the method, a simple and effective character fuzzification method can be realized. It is ensured that original information is not directly exposed when the data are stored or processed, and meanwhile a predictable mode is reserved for querying the data. Specifically, due to the design of the algorithm, each input character has a unique and irreversible mask character mapping, and the mapping not only prevents data leakage, but also supports a fuzzy query function.

Description

Technical Field

[0001] The invention discloses a ciphertext single-character matching fuzzy query method and device for database encryption, and relates to the technical field of database encryption. Background Art

[0002] Database encryption technology is designed to protect sensitive information stored in the database from unauthorized access. With the frequent occurrence of data breaches, encryption technology has become a key part of data security. Database encryption can be performed at different levels, including full database encryption, column-level encryption, and application-level encryption, aiming to achieve security protection of data at rest.

[0003] Performing fuzzy queries in encrypted databases introduces additional challenges because traditional query techniques cannot be directly applied to encrypted data. To perform effective queries without decrypting the data, special encryption and query techniques are required. These techniques attempt to balance query efficiency, query accuracy, and data security.

[0004] At present, encryption technologies that implement fuzzy queries from an algorithmic perspective mainly include homomorphic encryption, secure multi-party computation (SMC), and searchable encryption (SSE). Homomorphic encryption allows operations on encrypted data without decryption, but its high computational cost limits its application on large-scale data. Searchable encryption technology supports fuzzy queries by building special encrypted indexes. Building and maintaining encrypted indexes and performing encrypted search operations may result in significant performance overhead.

[0005] From the perspective of the solution, the encryption technologies for implementing fuzzy queries mainly include memory decryption, data desensitization, word segmentation combination, etc. Memory decryption is to load all data into the memory for decryption, so that fuzzy query can be used in the same way as querying plain text. Although this solution can implement fuzzy query, it is completely unusable if the amount of data is large. Data desensitization is to store the ciphertext in the fuzzy query column after desensitizing it, which will lose a lot of precision. Word segmentation combination is a widely used solution now. The ciphertext is segmented and combined, the segmentation results are encrypted, and the query is decrypted based on the combination words. The disadvantage of this solution is that the storage cost increases sharply and the fuzzy query length is limited. Summary of the invention

[0006] In view of the problems of the prior art, the present invention provides a ciphertext single-character matching fuzzy query method and device for database encryption, and the technical solution adopted is: In a first aspect, a ciphertext single-character matching fuzzy query method for database encryption is provided, the method comprising: S1, according to the SQL type executed by the database, encrypts the data and stores it in the fuzzy query column through a single character matching algorithm; S2, rewriting the SQL by conventional database encryption according to executing the fuzzy query column; S3, according to the rewritten SQL, single character matching is performed through the fuzzy query column to obtain a fuzzy query result.

[0007] In some implementations, in S1, the single character matching algorithm performs character fuzzification by masking the characters to obtain fuzzy characters for fuzzy query.

[0008] In some implementations, the S1 specifically includes: S11, converting each character of the original character into a new mask character by performing an offset operation and a bitwise AND operation on each character; S12: According to the offset operation, irreversibly process the original character by adding a constant.

[0009] In some implementations, the S11 specifically includes: S111, performing an offset operation using a predefined constant `DEFAULT_DELTA` according to each character of the original character through the offset operation; S112, performing a bitwise AND operation on the single character after the offset operation using a constant mask `DEFAULT_MASK` through the bitwise AND operation; S113, according to the specific characters of the original characters, use `Map` to provide the corresponding specific index value through the lookup table, and perform offset and mask processing on the specific index value.

[0010] In a second aspect, an embodiment of the present invention provides a ciphertext single-character matching fuzzy query device for database encryption, the device comprising: The encryption module is used to encrypt and store data into the fuzzy query column through a single character matching algorithm according to the SQL type executed by the database; A query module, used to rewrite SQL through conventional database encryption according to executing the fuzzy query column; The matching module is used to match a single character through the fuzzy query column according to the rewritten SQL to obtain a fuzzy query result.

[0011] In some implementations, in the encryption module, the single character matching algorithm performs character fuzzification by masking the characters to obtain fuzzy characters for fuzzy query.

[0012] In some implementations, the encryption module specifically includes: A mask processing unit, for converting each character of the original character into a new mask character by performing an offset operation and a bitwise AND operation on each character; An offset processing unit is used to perform irreversible processing on the original character by adding a constant according to the offset operation.

[0013] In some implementations, the mask processing unit specifically includes: A first operation subunit, configured to perform an offset operation using a predefined constant `DEFAULT_DELTA` according to each character of the original character through the offset operation; A second operation subunit is used for performing a bitwise AND operation using a constant mask `DEFAULT_MASK` through the bitwise AND operation according to the single character after the offset operation; The third operation subunit is used to provide a corresponding specific index value through a lookup table using `Map` according to a specific character of the original character, and to perform offset and mask processing on the specific index value.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein when the one or more computer instructions are executed by the processor, the method described in the first aspect above is implemented.

[0015] In a fourth aspect, an embodiment of the present invention provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it is used to implement the method described in the first aspect.

[0016] One or more embodiments of the present invention can bring at least the following beneficial effects: The core of the algorithm is the combination of offset (`DEFAULT_DELTA`) and mask (`DEFAULT_MASK`). These two are used together to ensure that even if the input characters are close, their mask characters may be significantly different. This feature enhances the fuzzification effect while preserving some patterns of the input characters.

[0017] Since masking discards some information, and there may be multiple different input characters mapped to the same mask character, this makes it impossible to reverse the original character. For example, if `DEFAULT_MASK` is a low-byte mask, the high-byte part of any input character will be lost.

[0018] Each time the same input character is masked, the same mask character is generated. This feature makes the algorithm suitable for fuzzy queries because the system can match the query conditions through the mask character without saving the original data.

[0019] Through the calculation process of the method of the present invention, a simple and effective character obfuscation method can be achieved. It ensures that the original information is not directly exposed when the data is stored or processed, while retaining a predictable way to query the data. Specifically, the algorithm is designed so that each input character has a unique and irreversible mask character mapping, which prevents data leakage and supports fuzzy query functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0021] Figure 1 The present invention provides a flowchart of a fuzzy query method for ciphertext single-character matching for database encryption. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present invention.

[0023] Embodiment 1: Figure 1 A flowchart of a ciphertext single-character matching fuzzy query method for database encryption is shown. Figure 1 As shown, the ciphertext single-character matching fuzzy query method for database encryption provided in this embodiment includes: S1, according to the SQL type executed by the database, encrypts the data and stores it in the fuzzy query column through a single character matching algorithm; S2, rewriting the SQL by conventional database encryption according to executing the fuzzy query column; S3, according to the rewritten SQL, single character matching is performed through the fuzzy query column to obtain a fuzzy query result.

[0024] According to the method of the present invention, by masking the characters, the characters are fuzzified for fuzzy query. Specifically, the algorithm converts each original character into a new mask character, and this conversion process involves character offset and bitwise AND operation. The offset operation changes the position of the character by adding a constant, and the bitwise AND operation ensures that the resulting character falls within a specific range. These operations make the original characters irreversible, that is, even if the mask character is known, the original character cannot be uniquely determined, thereby effectively protecting data privacy. At the same time, the algorithm's processing is consistent, that is, each mask operation on the same original character will generate the same mask character. This consistency allows the system to perform fast fuzzy queries through mask characters without exposing the original data.

[0025] In some implementations, in S1, the single character matching algorithm performs character fuzzification by masking the characters to obtain fuzzy characters for fuzzy query.

[0026] 3. The method according to claim 2, characterized in that the S1 specifically comprises: S11, converting each character of the original character into a new mask character by performing an offset operation and a bitwise AND operation on each character; The algorithm first checks whether the input characters are the special characters `%` and `_` in SQL fuzzy query. If so, these characters will be returned directly without any changes to preserve their original meaning (that is, `%` represents any character sequence, and `_` represents a single arbitrary character); S12: According to the offset operation, irreversibly process the original character by adding a constant.

[0027] If the input character is not in the special character range, the algorithm will choose different processing methods based on the range of the character. Usually there is a predefined maximum character limit (such as `MAX_NUMERIC_LETTER_CHAR`) to distinguish between basic characters (such as characters in the ASCII range) and other more complex characters (such as non-Latin characters).

[0028] In some implementations, the S11 specifically includes: S111, performing an offset operation using a predefined constant `DEFAULT_DELTA` according to each character of the original character through the offset operation; For the input characters, the algorithm uses a predefined constant `DEFAULT_DELTA` for offset. The purpose of this step is to change the numerical representation of the character and move it to a different position. This offset may be to avoid overlapping with other characters or symbols, and can also be regarded as a simple encryption method.

[0029] S112, performing a bitwise AND operation on the single character after the offset operation using a constant mask `DEFAULT_MASK` through the bitwise AND operation; The binary representation of the character is further restricted to a certain range by bitwise ANDing it with a constant mask `DEFAULT_MASK`. This step may discard some bits of information of the character, thus further obfuscating the character. The bitwise AND operation ensures that all masked characters are in a predefined range.

[0030] S113, according to the specific characters of the original characters, use `Map` to provide the corresponding specific index value through the lookup table, and perform offset and mask processing on the specific index value.

[0031] For some specific characters, the algorithm uses a `Map` (such as `charIndexes`) to provide a specific index value for these characters by looking up the table. The algorithm then offsets and masks the index value. The reason for doing this may be to ensure that certain characters (such as commonly used non-Latin characters) have specific mask character mappings.

[0032] If the input character is not matched by the above conditions, the algorithm will enter a default mask calculation process. This process is similar to the previous logic, generating a new mask character through offset and mask operations.

[0033] The method of the present invention has good supportability: Wide range of query operation support: This algorithm supports all operations for fuzzy queries in standard databases, including but not limited to LIKE queries, wildcard matching, etc. This means that developers and end users can seamlessly integrate it into existing database systems without large-scale modification or reconstruction.

[0034] Compatible with existing database systems: The algorithm is designed with compatibility with mainstream database management systems (such as MySQL, PostgreSQL, etc.) in mind, making it easy to integrate into existing database architectures.

[0035] The method of the present invention has high safety: Mathematically based security assurance: The encryption technology used in the algorithm is based on solid mathematical theory, ensuring that fuzzy queries can be performed even in the ciphertext state without leaking key information or allowing malicious users to infer the original text by analyzing the query results.

[0036] Preventing information leakage: Through carefully designed encryption and query algorithms, any information leakage that may occur during the query process, such as search patterns (i.e., how often searches are performed) or access patterns (i.e., how often which data is accessed), can be minimized.

[0037] The method of the present invention has low cost and high speed: Efficient query processing: The algorithm optimizes the query processing process and can maintain a fast speed even for fuzzy queries on large data sets, making this solution very suitable for application scenarios that need to process large amounts of sensitive data.

[0038] Low resource consumption: Compared with other encrypted query technologies, this solution has low computational and storage overhead when performing ciphertext queries. This not only reduces the requirements for hardware resources, but also means that it can run in resource-constrained environments, such as mobile devices and edge computing devices.

[0039] Optimized index structure: To further improve query efficiency, the solution uses a specially optimized index structure (creating indexes on ciphertext columns). These structures ensure query speed without sacrificing data security.

[0040] The database encrypted ciphertext single-character matching fuzzy query algorithm provides a practical and efficient solution through its excellent support, superior security and low overhead, meeting the dual needs of data security and query efficiency in modern applications.

[0041] Embodiment 2: In a second aspect, an embodiment of the present invention provides a ciphertext single-character matching fuzzy query device for database encryption, the device comprising: The encryption module is used to encrypt and store data into the fuzzy query column through a single character matching algorithm according to the SQL type executed by the database; A query module, used to rewrite SQL through conventional database encryption according to executing the fuzzy query column; The matching module is used to match a single character through the fuzzy query column according to the rewritten SQL to obtain a fuzzy query result.

[0042] In some implementations, in the encryption module, the single character matching algorithm performs character fuzzification by masking the characters to obtain fuzzy characters for fuzzy query.

[0043] In some implementations, the encryption module specifically includes: A mask processing unit, for converting each character of the original character into a new mask character by performing an offset operation and a bitwise AND operation on each character; An offset processing unit is used to perform irreversible processing on the original character by adding a constant according to the offset operation.

[0044] In some implementations, the mask processing unit specifically includes: A first operation subunit, configured to perform an offset operation using a predefined constant `DEFAULT_DELTA` according to each character of the original character through the offset operation; A second operation subunit is used for performing a bitwise AND operation using a constant mask `DEFAULT_MASK` through the bitwise AND operation according to the single character after the offset operation; The third operation subunit is used to provide a corresponding specific index value through a lookup table using `Map` according to a specific character of the original character, and to perform offset and mask processing on the specific index value.

[0045] Embodiment three: This embodiment further provides an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions implement the method of embodiment 1 when executed by the processor; In practical applications, the processor can be an application specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller unit (MCU), a microprocessor or other electronic components to execute the methods in the above embodiments.

[0046] The method implemented in this embodiment is as described in Embodiment 1.

[0047] Embodiment 4: This embodiment further provides a computer storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by one or more processors, the method of the first embodiment is implemented; Among them, the computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0048] The method implemented by this embodiment is as described in Example 1.

[0049] In the several embodiments provided in the embodiments of the present invention, it should be understood that the disclosed system and method can also be implemented in other ways. The system and method embodiments described above are merely illustrative.

[0050] It should be noted that, in this article, the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. The terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0051] Although the embodiments disclosed in the present invention are as above, the above contents are only embodiments adopted for facilitating the understanding of the present invention and are not intended to limit the present invention. Any technician in the technical field to which the present invention belongs can make any modifications and changes in the form and details of the implementation without departing from the spirit and scope disclosed in the present invention, but the patent protection scope of the present invention shall still be subject to the scope defined in the attached claims.

Claims

1. A fuzzy query method for ciphertext single character matching for database encryption, characterized in that: The method comprises: S1, according to the SQL type executed by the database, encrypts the data and stores it in the fuzzy query column through a single character matching algorithm; S2, rewriting the SQL by conventional database encryption according to executing the fuzzy query column; S3, according to the rewritten SQL, single character matching is performed through the fuzzy query column to obtain a fuzzy query result.

2. The method according to claim 1, characterized in that: In S1, the single character matching algorithm performs masking on characters to fuzzify the characters, and obtains fuzzy characters for fuzzy query.

3. The method according to claim 2, characterized in that The S1 specifically includes: S11, converting each character of the original character into a new mask character by performing an offset operation and a bitwise AND operation on each character; S12: According to the offset operation, irreversibly process the original character by adding a constant.

4. The method according to claim 3, characterized in that The S11 specifically includes: S111, performing an offset operation using a predefined constant `DEFAULT_DELTA` according to each character of the original character through the offset operation; S112, performing a bitwise AND operation on the single character after the offset operation using a constant mask `DEFAULT_MASK` through the bitwise AND operation; S113, according to the specific characters of the original characters, use `Map` to provide the corresponding specific index value through the lookup table, and perform offset and mask processing on the specific index value.

5. A fuzzy query device for ciphertext single character matching for database encryption, characterized in that: The device comprises: The encryption module is used to encrypt and store data into the fuzzy query column through a single character matching algorithm according to the SQL type executed by the database; A query module, used to rewrite SQL through conventional database encryption according to executing the fuzzy query column; The matching module is used to match a single character through the fuzzy query column according to the rewritten SQL to obtain a fuzzy query result.

6. The device according to claim 5, characterized in that In the encryption module, the single character matching algorithm performs masking on characters to fuzzify the characters, and obtains the fuzzified characters for fuzzy query.

7. The device according to claim 6, characterized in that The encryption module specifically includes: A mask processing unit, for converting each character of the original character into a new mask character by performing an offset operation and a bitwise AND operation on each character; An offset processing unit is used to perform irreversible processing on the original character by adding a constant according to the offset operation.

8. The device according to claim 7, characterized in that The mask processing unit specifically includes: A first operation subunit, configured to perform an offset operation using a predefined constant `DEFAULT_DELTA` according to each character of the original character through the offset operation; A second operation subunit is used for performing a bitwise AND operation using a constant mask `DEFAULT_MASK` through the bitwise AND operation according to the single character after the offset operation; The third operation subunit is used to provide a corresponding specific index value through a lookup table using `Map` according to a specific character of the original character, and to perform offset and mask processing on the specific index value.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it is used to implement the method as described in any one of claims 1 to 4 above.

Images