Data hiding query method and related device

Abstract

The invention relates to the technical field of data security query, and discloses a data hiding query method and a related device.Firstly, a data query end encrypts at least one piece of data to be queried, and constructs a first hash table based on p target hash functions and an encryption result of each piece of data to be queried, the encryption result of each piece of to-be-queried data is sent to the data providing end, a vector set sent by the data providing end is received, and finally, the data querying end determines p vectors corresponding to each piece of to-be-queried data in the vector set according to the encryption result of the to-be-queried data contained in each row of the first hash table, and obtaining a query result corresponding to each piece of to-be-queried data based on the p vectors corresponding to each piece of to-be-queried data. By encrypting each piece of to-be-queried data, the problem of data leakage in the data interaction process is avoided. Meanwhile, the query result corresponding to each piece of to-be-queried data can be quickly determined through the vector set sent by the data providing end in combination with the constructed first hash table.

Description

Background Art

[0002] With the increasingly strict supervision of data security, data security and personal privacy have received much attention. It is difficult for enterprises to share data value due to the "data island" problem. For example, due to different business scopes, financial institutions have accumulated different user information. If each institution can share information without leaking privacy, it can greatly improve the information transparency of financial institutions and help each institution improve its risk prevention capabilities. In this context, Private Information Retrieval (PIR) technology came into being.

[0003] Hidden query is a very practical technology in privacy computing, which is used to protect the query privacy of users. Its purpose is to ensure that when the data query end sends a data query request to the data provider end, the query is completed without leaking the queried data. That is, during the entire query process, the data provider end does not know what specific data the data query end is querying.

[0004] In the relevant hidden query process, all the data needs to be interacted each time. When the amount of data from each party is large, especially the amount of data to be queried is large, the network bandwidth consumption is huge, which greatly wastes the computing and network resources of each party, significantly reduces the query efficiency, and makes it difficult to meet the timeliness of real-time queries. Summary of the invention

[0005] The embodiments of the present application provide a data anonymity query method and related devices, which can avoid data leakage problems during data interaction and can also quickly determine the query results corresponding to the data to be queried.

[0006] In a first aspect, an embodiment of the present application provides a data anonymity query method, which is applied to a data query end, and the method includes:

[0007] Encrypting at least one data to be queried to obtain an encryption result of each data to be queried in the at least one data to be queried;

[0008] Based on the preset p target hash functions and the encryption result of each data to be queried, a first hash table is constructed; p is a positive integer;

[0009] Send the encryption result of each data to be queried to the data provider, and receive the vector set sent by the data provider; the vector set includes vectors obtained based on the query results corresponding to the p target hash functions and the encryption results of each data to be queried;

[0010] For the encryption results of the data to be queried contained in each row in the first hash table, p vectors corresponding to each data to be queried are determined in the vector set, and based on the p vectors corresponding to each data to be queried, a query result corresponding to each data to be queried is obtained.

[0011] Compared with the prior art, the present application avoids data leakage during data interaction by encrypting each data to be queried. At the same time, the query result corresponding to each data to be queried can be quickly determined by combining the constructed first hash table with the vector set obtained by the query result corresponding to the p target hash functions and the encryption result of each data to be queried sent by the data provider.

[0012] In a possible embodiment, a first hash table is constructed based on the preset p target hash functions and the encryption result of each data to be queried, including:

[0013] Input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried;

[0014] For each encryption result of the data to be queried, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption result of the data to be queried, the bucket position of the encryption result of the data to be queried in the first hash table is determined; the encryption result of the data to be queried is filled into the bucket position;

[0015] After it is determined that the encryption result of each data to be queried is completed, a first hash table is obtained; the encryption result of each data to be queried in the first hash table does not appear repeatedly.

[0016] The present application sets a rule for filling the encryption result of each data to be queried into the first hash table, so as to quickly determine the query result corresponding to each data to be queried according to the constructed first hash table.

[0017] In a possible embodiment, determining the bucket position of the encryption result of the data to be queried in the first hash table according to the p target hash values ​​corresponding to the encryption result of the data to be queried includes:

[0018] Match the p target hash values ​​with the bucket identifiers of the first hash table to determine the m bucket positions in the first hash table; m is less than or equal to p;

[0019] If all m bucket positions are occupied, the encryption result of the data to be queried in the first bucket position is discarded; the first bucket position is any bucket position among the m bucket positions;

[0020] The first bucket position is determined to be the bucket position of the encryption result of the data to be queried in the first hash table.

[0021] The present application sets a rule for filling the encryption result of each data to be queried into the first hash table, so as to quickly determine the query result corresponding to each data to be queried according to the constructed first hash table.

[0022] In a possible embodiment, for the encryption result of the to-be-queried data contained in each row in the first hash table, p vectors corresponding to each to-be-queried data are determined in the vector set, including:

[0023] For the encryption result of the data to be queried contained in each row of the first hash table, the encryption result of the data to be queried is input into p target hash functions respectively to obtain p target hash values ​​corresponding to the encryption result of the data to be queried;

[0024] Based on the vector set, find the p vectors corresponding to the p target hash values.

[0025] The present application screens the vector set, and uses the screened p vectors in combination with the constructed first hash table to quickly determine the query result corresponding to each to-be-queried data.

[0026] In a second aspect, an embodiment of the present application provides a data anonymity query method, which is applied to a data provider, and the method includes:

[0027] Receiving an encryption result of at least one data to be queried sent by a data query terminal;

[0028] Determine a query result corresponding to the encryption result of each to-be-queried data in at least one to-be-queried data;

[0029] Constructing a second hash table based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried; p is a positive integer;

[0030] A vector set is obtained by encoding the corresponding relationship between the encryption result and the query result contained in each row in the second hash table, and the vector set is sent to the data query end.

[0031] The present application screens the data according to the encryption result of at least one data to be queried sent by the data query end, determines the query result corresponding to each encryption result of the data to be queried, and then constructs a second hash table so that the encryption result of each data to be queried and the query result corresponding to the encryption result of each data to be queried are arranged in order, and obtains a vector set according to the second hash table encoding, so that the data query end can quickly determine the query result corresponding to each data to be queried according to the vector set.

[0032] In a possible embodiment, a second hash table is constructed based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried, including:

[0033] Input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried;

[0034] Constructing a correspondence between the encryption result of each data to be queried and the query result corresponding to the encryption result of each data to be queried;

[0035] For each corresponding relationship, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption results of the data to be queried, the bucket position of the corresponding relationship in the second hash table is determined; the corresponding relationship is filled into the bucket position;

[0036] After each corresponding relationship is determined to be filled in, a second hash table is obtained; each corresponding relationship in the second hash table is repeated p times.

[0037] The present application sets the encryption result of each data to be queried and the query result corresponding to each encryption result of the data to be queried to fill in the second hash table with a rule, so that multiple corresponding relationships can be arranged in order in the second hash table, so that a vector set can be obtained according to the constructed second hash table encoding, and then the data query end can quickly determine the query result corresponding to each data to be queried according to the vector set.

[0038] In a third aspect, an embodiment of the present application provides a data anonymity query device, which is applied to a data query end, and the device includes:

[0039] An encryption module, used for encrypting at least one data to be queried, and obtaining an encryption result of each data to be queried in the at least one data to be queried;

[0040] A first construction module is used to construct a first hash table based on p preset target hash functions and the encryption result of each data to be queried; p is a positive integer;

[0041] A first receiving module is used to send the encryption result of each data to be queried to the data provider, and receive a vector set sent by the data provider; the vector set includes vectors obtained based on p target hash functions and query results corresponding to the encryption result of each data to be queried;

[0042] The query module is used to determine p vectors corresponding to each data to be queried in the vector set according to the encryption results of the data to be queried contained in each row in the first hash table, and obtain the query result corresponding to each data to be queried based on the p vectors corresponding to each data to be queried.

[0043] In a possible embodiment, the first building module is specifically used to:

[0044] Input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried;

[0045] For each encryption result of the data to be queried, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption result of the data to be queried, the bucket position of the encryption result of the data to be queried in the first hash table is determined; the encryption result of the data to be queried is filled into the bucket position;

[0046] After it is determined that the encryption result of each data to be queried is completed, a first hash table is obtained; the encryption result of each data to be queried in the first hash table does not appear repeatedly.

[0047] In a possible embodiment, the first building module is specifically used to:

[0048] Match the p target hash values ​​with the bucket identifiers of the first hash table to determine the m bucket positions in the first hash table; m is less than or equal to p;

[0049] If all m bucket positions are occupied, the encryption result of the data to be queried in the first bucket position is discarded; the first bucket position is any bucket position among the m bucket positions;

[0050] The first bucket position is determined to be the bucket position of the encryption result of the data to be queried in the first hash table.

[0051] In a possible embodiment, the query module is specifically used to:

[0052] For the encryption result of the data to be queried contained in each row of the first hash table, the encryption result of the data to be queried is input into p target hash functions respectively to obtain p target hash values ​​corresponding to the encryption result of the data to be queried;

[0053] Based on the vector set, find the p vectors corresponding to the p target hash values.

[0054] In a fourth aspect, an embodiment of the present application provides a data anonymity query device, which is applied to a data provider, and the device includes:

[0055] A second receiving module, used for receiving an encryption result of at least one data to be queried sent by the data query end;

[0056] A determination module, used to determine a query result corresponding to the encryption result of each to-be-queried data in at least one to-be-queried data;

[0057] A second construction module is used to construct a second hash table based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried; p is a positive integer;

[0058] The sending module is used to encode the corresponding relationship between the encryption result and the query result contained in each row of the second hash table to obtain a vector set, and send the vector set to the data query end.

[0059] In a possible embodiment, the second building module is specifically used to:

[0060] Input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried;

[0061] Constructing a correspondence between the encryption result of each data to be queried and the query result corresponding to the encryption result of each data to be queried;

[0062] For each corresponding relationship, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption results of the data to be queried, the bucket position of the corresponding relationship in the second hash table is determined; the corresponding relationship is filled into the bucket position;

[0063] After each corresponding relationship is determined to be filled in, a second hash table is obtained; each corresponding relationship in the second hash table is repeated p times.

[0064] In a fifth aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0065] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data anonymity query method as described in any one of the first aspects; or execute the data anonymity query method as described in any one of the second aspects.

[0066] In the sixth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute a data anonymity query method as described in any one of the first aspect; or to execute a data anonymity query method as described in any one of the second aspect.

[0067] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements a data anonymity query method as described in any one of the first aspects; or executes a data interaction method as described in any one of the second aspects.

[0068] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0070] Figure 1 A schematic diagram of an application scenario of a data anonymity query method provided in an embodiment of the present application;

[0071] Figure 2 A flowchart of a data anonymity query method provided in one embodiment of the present application;

[0072] Figure 3 A schematic diagram of the interaction between a data provider and a data query terminal provided in an embodiment of the present application;

[0073] Figure 4 A flowchart of a data anonymity query method provided in one embodiment of the present application;

[0074] Figure 5 A flowchart of a data anonymity query method provided in one embodiment of the present application;

[0075] Figure 6 A schematic diagram of the structure of a data anonymity query device provided in one embodiment of the present application;

[0076] Figure 7 A schematic diagram of the structure of a data anonymity query device provided in one embodiment of the present application;

[0077] Figure 8 A schematic diagram of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0079] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0080] With the increasingly strict supervision of data security, data security and personal privacy have received much attention. It is difficult for enterprises to share data value due to the "data island" problem. For example, due to different business scopes, financial institutions have accumulated different user information. If the institutions can share information without leaking privacy, it can greatly improve the information transparency of financial institutions and help each institution improve its risk prevention capabilities. In this context, PIR technology came into being.

[0081] Hidden query is a very practical technology in privacy computing, which is used to protect the query privacy of users. Its purpose is to ensure that when the data query end sends a data query request to the data provider end, the query is completed without leaking the queried data. That is, during the entire query process, the data provider end does not know what specific data the data query end is querying.

[0082] In the relevant hidden query process, all the data needs to be interacted each time. When the amount of data from each party is large, especially the amount of data to be queried is large, the network bandwidth consumption is huge, which greatly wastes the computing and network resources of each party, significantly reduces the query efficiency, and makes it difficult to meet the timeliness of real-time queries.

[0083] To this end, the present application provides a data anonymity query method and related devices, which encrypt each data to be queried to avoid data leakage during data interaction. At the same time, the query result corresponding to each data to be queried can be quickly determined by combining the first hash table constructed by using the p target hash functions and the encryption results of each data to be queried, which is sent by the data provider and obtained by the vector set of query results corresponding to the p target hash functions and the encryption results of each data to be queried.

[0084] After introducing the design ideas of the embodiments of the present application, the following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0085] refer to Figure 1 , which is a schematic diagram of an application scenario of the data anonymity query method provided in an embodiment of the present application. The application scenario includes: a data query terminal 101 and a data provider terminal 102. First, the data query terminal 101 determines at least one to-be-queried data that needs to be sent to the data provider terminal 102. In order to avoid data leakage during data interaction, each to-be-queried data can be encrypted first, and then the encrypted result of each to-be-queried data is sent to the data provider terminal 102.

[0086] Then the data provider 102 determines the corresponding query result according to the encryption result of each data to be queried, and constructs a second hash table based on the p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried, and encodes a vector set according to the corresponding relationship between the encryption result and the query result contained in each row of the second hash table, and sends the vector set to the data query terminal 101. The data query terminal 101 receives the vector set, and can also construct the first hash table based on the preset p target hash functions and the encryption result of each data to be queried, and finally determines the p vectors corresponding to each data to be queried in the vector set for the encryption result of each data to be queried contained in each row of the first hash table, and obtains the query result corresponding to each data to be queried based on the p vectors corresponding to each data to be queried.

[0087] Of course, the method provided in the embodiment of the present application is not limited to Figure 1 The application scenario shown can also be used in other possible application scenarios.

[0088] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application.

[0089] Combine the following Figure 1 The application scenario shown illustrates the technical solution provided by the embodiment of the present application.

[0090] like Figure 2 As shown, an embodiment of the present application discloses a flow chart of a data anonymity query method, the method comprising the following steps:

[0091] S201, the data query end determines at least one data to be queried, encrypts the at least one data to be queried, and obtains an encryption result of each data to be queried in the at least one data to be queried.

[0092] For example, the data query end can be an e-commerce company, bank, insurance company, etc., and the data provider end can be an operator, etc. The data query end queries the data provider end for the credit rating, web browsing history, purchasing power, etc. associated with the target data, so as to further analyze the target data associated information.

[0093] like Figure 3 As shown, the data query end and the data provider negotiate an encryption function F k , the data provider saves the encryption function F k The key k is assumed to be at least one piece of data to be queried determined by the data query end to be y 1 ,y 2 , …, y M , according to the encryption function F k After encryption, the encryption result of each data to be queried is y' 1 (You can also use F k (y 1 ) indicates), y' 2 (You can also use F k (y 2 ) indicates),…,y' M (You can also use F k (y M ) represents). Among them, the encryption function F k It can be an Oblivious Pseudorandom Function (OPRF).

[0094] S202, the data query end sends the encryption result of each data to be queried to the data provider end.

[0095] S203: The data provider determines the query result corresponding to the encryption result of each data to be queried.

[0096] For example, Figure 3 As shown, the data provider decrypts the encryption result of each data to be queried according to the key k, and obtains each data to be queried as y 1 ,y 2 , …, y M , and then determine each data y to be queried through data screening 1 ,y 2 , …, y M The corresponding query result is l 1 , l 2 ,…,l M , and then the encryption result y' of each data to be queried 1 ,y' 2 ,…,y' MThe corresponding query result can also be l 1 , l 2 ,…,l M .

[0097] S204: The data provider constructs a second hash table based on the p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried.

[0098] The p target hash functions may be determined by negotiation between the data query end and the data provider end. For example, the p target hash functions are: H = {h 1 、h 2 ,…,h p}, h i :{0, 1} * →[L], where L represents the number of buckets in the second hash table and the first hash table. i and p are both positive integers.

[0099] Optionally, the following are specific steps for constructing the second hash table: input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried. For example, the encryption result y' 1 Input into p target hash functions, and get p target hash values, which are h 1 (y' 1 ),h 2 (y' 1 ),…,h p (y' 1 ).

[0100] Then, a corresponding relationship between the encryption result of each data to be queried and the query result corresponding to the encryption result of each data to be queried is constructed. For example, the encryption result y' of the data to be queried 1 And the encryption result y' of each data to be queried 1 The corresponding query result l 1 The corresponding relationship can be (y' 1 , l 1 ).

[0101] For each corresponding relationship, perform the following operations respectively: determine the bucket position of the corresponding relationship in the second hash table according to the p target hash values ​​corresponding to the encryption result of the data to be queried, and fill the corresponding relationship into the bucket position. After determining that each corresponding relationship has been filled, a second hash table is obtained, in which each corresponding relationship in the second hash table is repeated p times. For example Figure 3 The second hash table shown contains L rows, and since each corresponding relationship needs to be repeated p times during the construction of the second hash table, the present application does not limit the number of columns of the second hash table.

[0102] Or, for each corresponding relationship, each corresponding relationship (y' i , l i ) are filled into the second hash table respectively, which can be: initialize a hash table T with L rows and 1 column, calculate y' in the corresponding relationship i The corresponding p target hash values ​​h j (y' i )(1≤j≤p, 1≤i≤M), if the hth j (y' i ) bucket marker position is empty, then (y' i , l i ) is filled in the position. Otherwise, add a new column to the hash table T and replace (y' i , l i ) Fill in the hth column of the newly added column j (y' i ) Bucket identification position. And so on until all the corresponding relationships are filled into the hash table T to obtain the second hash table.

[0103] After the data provider constructs the second hash table, the data provider proceeds to step S205, where the data provider encodes a vector set according to the correspondence between the encryption result and the query result contained in each row in the second hash table, and sends the vector set to the data query end.

[0104] For example, Figure 3 As shown, the first row (y' 3 , l 3 )、(y' 7 , l 7 ),…,(y' 6 , l 6 ) encoding can get vector D 1 :d 11 d 12 ,…,d 1t , the second row of the second hash table (y' 2 , l 2 )、(y' 1 , l 1 ),…,(y' 4 , l 4 ) encoding can get vector D 2 :d 21 d 22 ,…,d 2t , the Lth row of the second hash table (y' 1 , l 1 )、(y' 4 , l 4 ),…,(y' 5 , l5 ) encoding can get vector D L :d L1 d L2 ,…,d Lt . So the vector set can be {D 1 , D 2 ,…,D L}.

[0105] Exemplarily, assume that the second hash table stores t elements per row, and the hash function is v(·): {0, 1} * →{0, 1} S , and v(y' 1 ),…,v(y' t ) are linearly independent. i Through the hash function v(·), it is transformed into a binary string of length S, thus forming a t*S matrix. Assuming that each query result is a binary string of length Q, then all y' i The query results of i It also becomes a t*Q matrix, and then we can calculate an S*Q binary matrix D i .

[0106] Optionally, after determining the vectors encoded in each row of the second hash table, each vector may be encoded using an oblivious key value storage (OKVS) encoding algorithm, and after the data provider sends the vector set to the data query end, the data query end decodes each vector according to the OKVS decoding algorithm. In addition, before the data provider sends the vector set to the data query end, a pair of public and private keys may be generated, the public key may be sent to the data query end, and the vector set may be encrypted using the private key. After receiving the vector set, the data query end decrypts the vector set using the public key.

[0107] After receiving the vector set sent by the data provider, the data query end may proceed to step S206, where the data query end constructs a first hash table based on the p target hash functions and the encryption result of each data to be queried.

[0108] Optionally, the following is a specific step of constructing the first hash table: input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried. 1 Input into p target hash functions, and get p target hash values, which are h 1 (y' 1 ),h 2 (y' 1),…,h p (y' 1 ).

[0109] Then, for each encryption result of the data to be queried, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption result of the data to be queried, the bucket position of the encryption result of the data to be queried in the first hash table is determined, and the encryption result of the data to be queried is filled into the bucket position. After determining that the encryption result of each data to be queried is completed, the first hash table is obtained, wherein the encryption result of each data to be queried in the first hash table does not appear repeatedly. Here, the first hash table can be L rows and 1 column, and L is the number of buckets in the p target hash functions.

[0110] In a possible embodiment, the p target hash values ​​corresponding to the encryption result of each data to be queried can be sorted, and the bucket position of each encryption result of the data to be queried in the first hash table can be determined according to the sorting result. Optionally, the encryption result of the data to be queried can be filled into the bucket position in the first hash table corresponding to the minimum target hash value among the p target hash values ​​corresponding to the encryption result of each data to be queried. If the bucket position in the first hash table corresponding to the minimum target hash value corresponding to the encryption result of the data to be queried has stored data, then the encryption result of the data to be queried can be filled into the bucket position in the first hash table corresponding to the previous target hash value of the minimum target hash value in the sorting. Similarly, each target hash value corresponding to the encryption result of the data to be queried can be traversed to fill the encryption result of the data to be queried in the first hash table.

[0111] For example, the three target hash values ​​corresponding to the encryption result A of the data to be queried are 3, 2, and 5, the three target hash values ​​corresponding to the encryption result B of the data to be queried are 2, 4, and 6, and the three target hash values ​​corresponding to the encryption result C of the data to be queried are 3, 5, and 7. The number of buckets in the hash table is 7, so the hash table filled with the encryption results A, B, and C of the data to be queried is shown in Table 1 below:

[0112] Table 1

[0113]

[0114] In a possible embodiment, determining the bucket position of the encryption result of the data to be queried in the first hash table according to the p target hash values ​​corresponding to the encryption result of the data to be queried includes:

[0115] Match the p target hash values ​​with the bucket identifiers of the first hash table to determine the m bucket positions in the first hash table. If the m bucket positions are all occupied, remove the encryption result of the data to be queried in the first bucket position, and determine that the first bucket position is the bucket position of the encryption result of the data to be queried in the first hash table. The first bucket position is any bucket position among the m bucket positions, and m is less than or equal to p.

[0116] Exemplarily, continue to use the above example to illustrate, after the encryption results A, B, and C of the data to be queried are filled into the hash table in sequence, when the encryption result D of the data to be queried is continued to be filled into the hash table, if the three target hash values ​​corresponding to the encryption result D of the data to be queried are 2, 3, and 4, then the encryption result of any one of the data to be queried in the buckets marked as 2, 3, and 4 in the hash table is randomly removed, and the encryption result of the removed data to be queried is refilled into the hash table. For example, the encryption result A of the data to be queried stored in the bucket marked as 2 in the hash table is removed, and the encryption result A of the removed data to be queried is refilled into the hash table. The updated hash table is shown in Table 2:

[0117] Table 2

[0118]

[0119] It should be known that the first hash table can be constructed according to a Cuckoo Hash Function (CHF), and the second hash table can be constructed according to a common hash function. This application does not limit the specific forms of the first hash table and the second hash table.

[0120] After the data query end constructs the first hash table and receives the vector set, step S207 can be continued. The data query end determines the p vectors corresponding to each data to be queried in the vector set based on the encryption result of the data to be queried contained in each row in the first hash table, and obtains the query result corresponding to each data to be queried based on the p vectors corresponding to each data to be queried.

[0121] Optionally, for the encryption results of the data to be queried contained in each row in the first hash table, the encryption results of the data to be queried are respectively input into p target hash functions to obtain p target hash values ​​corresponding to the encryption results of the data to be queried, and then based on the vector set, p vectors corresponding to the p target hash values ​​are searched.

[0122] The present application can ensure that the data anonymity query process has low computational complexity and low communication complexity, and thus can be applicable to data query application scenarios with billions of data volumes.

[0123] like Figure 4As shown, an embodiment of the present application discloses a flow chart of a data anonymity query method, which is applied to a data query end, and the method includes the following steps:

[0124] S401, encrypting at least one data to be queried to obtain an encryption result of each data to be queried in the at least one data to be queried;

[0125] S402, constructing a first hash table based on the preset p target hash functions and the encryption result of each data to be queried; p is a positive integer;

[0126] S403, sending the encryption result of each data to be queried to the data provider, and receiving a vector set sent by the data provider; the vector set includes vectors obtained based on p target hash functions and query results corresponding to the encryption result of each data to be queried;

[0127] S404, for the encryption results of the data to be queried contained in each row in the first hash table, determine p vectors corresponding to each data to be queried in the vector set, and obtain the query result corresponding to each data to be queried based on the p vectors corresponding to each data to be queried.

[0128] like Figure 5 As shown, an embodiment of the present application discloses a flow chart of a data anonymity query method, which is applied to a data provider, and the method includes the following steps:

[0129] S501, receiving an encryption result of at least one data to be queried sent by a data query terminal;

[0130] S502, determining a query result corresponding to the encryption result of each to-be-queried data in at least one to-be-queried data;

[0131] S503, constructing a second hash table based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried; p is a positive integer;

[0132] S504: Encode a vector set according to the correspondence between the encryption result and the query result contained in each row in the second hash table, and send the vector set to the data query end.

[0133] like Figure 6 As shown, an embodiment of the present application provides a data anonymity query device, which is applied to a data query end, and the device includes:

[0134] The encryption module 601 is used to encrypt at least one data to be queried, and obtain an encryption result of each data to be queried in the at least one data to be queried;

[0135] The first construction module 602 is used to construct a first hash table based on the preset p target hash functions and the encryption result of each data to be queried; p is a positive integer;

[0136] The first receiving module 603 is used to send the encryption result of each data to be queried to the data provider, and receive the vector set sent by the data provider; the vector set includes vectors obtained based on the query results corresponding to the p target hash functions and the encryption result of each data to be queried;

[0137] The query module 604 is used to determine p vectors corresponding to each data to be queried in the vector set according to the encryption results of the data to be queried contained in each row in the first hash table, and obtain the query result corresponding to each data to be queried based on the p vectors corresponding to each data to be queried.

[0138] In a possible embodiment, the first building module 602 is specifically configured to:

[0139] Input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried;

[0140] For each encryption result of the data to be queried, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption result of the data to be queried, the bucket position of the encryption result of the data to be queried in the first hash table is determined; the encryption result of the data to be queried is filled into the bucket position;

[0141] After it is determined that the encryption result of each data to be queried is completed, a first hash table is obtained; the encryption result of each data to be queried in the first hash table does not appear repeatedly.

[0142] In a possible embodiment, the first building module 602 is specifically configured to:

[0143] Match the p target hash values ​​with the bucket identifiers of the first hash table to determine the m bucket positions in the first hash table; m is less than or equal to p;

[0144] If all m bucket positions are occupied, the encryption result of the data to be queried in the first bucket position is discarded; the first bucket position is any bucket position among the m bucket positions;

[0145] The first bucket position is determined to be the bucket position of the encryption result of the data to be queried in the first hash table.

[0146] In a possible embodiment, the query module 604 is specifically configured to:

[0147] For the encryption result of the data to be queried contained in each row of the first hash table, the encryption result of the data to be queried is input into p target hash functions respectively to obtain p target hash values ​​corresponding to the encryption result of the data to be queried;

[0148] Based on the vector set, find the p vectors corresponding to the p target hash values.

[0149] like Figure 7 As shown, an embodiment of the present application provides a data anonymity query device, which is applied to a data provider, and the device includes:

[0150] The second receiving module 701 is used to receive the encryption result of at least one to-be-queried data sent by the data query end;

[0151] A determination module 702, configured to determine a query result corresponding to an encryption result of each to-be-queried data in at least one to-be-queried data;

[0152] The second construction module 703 is used to construct a second hash table based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried; p is a positive integer;

[0153] The sending module 704 is used to encode the corresponding relationship between the encryption result and the query result contained in each row of the second hash table to obtain a vector set, and send the vector set to the data query end.

[0154] In a possible embodiment, the second building module 703 is specifically configured to:

[0155] Input the encryption result of each data to be queried into p target hash functions respectively, and obtain p target hash values ​​corresponding to the encryption result of each data to be queried;

[0156] Constructing a correspondence between the encryption result of each data to be queried and the query result corresponding to the encryption result of each data to be queried;

[0157] For each corresponding relationship, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption results of the data to be queried, the bucket position of the corresponding relationship in the second hash table is determined; the corresponding relationship is filled into the bucket position;

[0158] After each corresponding relationship is determined to be filled in, a second hash table is obtained; each corresponding relationship in the second hash table is repeated p times.

[0159] After introducing the data anonymity query method and related devices according to an exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0160] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0161] In some possible implementations, the electronic device according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the data anonymity query method according to various exemplary implementations of the present application described above in this specification. For example, the processor may execute the steps in the data anonymity query method.

[0162] Refer to the following Figure 8 The electronic device 80 according to this embodiment of the present application is described. Figure 8 The electronic device 80 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0163] like Figure 8 As shown, the electronic device 80 is in the form of a general electronic device. The components of the electronic device 80 may include but are not limited to: at least one processor 81, at least one memory 82, and a bus 83 connecting different system components (including the memory 82 and the processor 81).

[0164] Bus 83 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0165] The memory 82 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 821 and / or a cache memory 822 , and may further include a read-only memory (ROM) 823 .

[0166] The memory 82 may also include a program / utility 825 having a set (at least one) of program modules 824, such program modules 824 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0167] The electronic device 80 may also communicate with one or more external devices 84 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 80, and / or may communicate with any device that enables the electronic device 80 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 85. Furthermore, the electronic device 80 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 86. As shown, the network adapter 86 communicates with other modules for the electronic device 80 via a bus 83. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 80, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0168] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 82 including instructions, and the instructions can be executed by the processor 81 to perform the above method. Alternatively, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0169] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, which, when executed by the processor 81, implements any of the data anonymity query methods provided in the present application.

[0170] In an exemplary embodiment, various aspects of a data anonymity query method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a data anonymity query method according to various exemplary embodiments of the present application described above in this specification.

[0171] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0172] The program product for unlocking an electronic device of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0173] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0174] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0175] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or entirely on the remote electronic device or server. In the case of a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0176] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0177] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0178] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0179] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable electronic device to generate a machine, so that the instructions executed by the processor of the computer or other programmable electronic device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0180] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable electronic device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0181] These computer program instructions may also be loaded onto a computer or other programmable electronic device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0182] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0183] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data anonymity query method, characterized in that: Applied to the data query end, the method includes: Encrypting at least one data to be queried to obtain an encryption result of each data to be queried in the at least one data to be queried; Constructing a first hash table based on the preset p target hash functions and the encryption result of each data to be queried; wherein p is a positive integer; Sending the encryption result of each of the data to be queried to the data provider, and receiving a vector set sent by the data provider; the vector set includes vectors obtained based on the query results corresponding to the p target hash functions and the encryption result of each of the data to be queried; For the encryption results of the data to be queried contained in each row in the first hash table, p vectors corresponding to each data to be queried are determined in the vector set, and based on the p vectors corresponding to each data to be queried, a query result corresponding to each data to be queried is obtained.

2. The method according to claim 1, characterized in that The step of constructing a first hash table based on the preset p target hash functions and the encryption result of each data to be queried comprises: Inputting the encryption results of each of the data to be queried into the p target hash functions respectively, to obtain p target hash values ​​corresponding to the encryption results of each of the data to be queried; For each encryption result of the data to be queried, the following operations are performed respectively: according to the p target hash values ​​corresponding to the encryption result of the data to be queried, the bucket position of the encryption result of the data to be queried in the first hash table is determined; and the encryption result of the data to be queried is filled into the bucket position; After it is determined that the encryption result of each data to be queried is completed, the first hash table is obtained; the encryption result of each data to be queried in the first hash table does not appear repeatedly.

3. The method according to claim 2, characterized in that The determining, according to the p target hash values ​​corresponding to the encryption result of the data to be queried, the bucket position of the encryption result of the data to be queried in the first hash table includes: Match the p target hash values ​​with the bucket identifiers of the first hash table to determine m bucket positions in the first hash table; m is less than or equal to p; If the m bucket positions are all occupied, the encryption result of the to-be-queried data in the first bucket position is discarded; wherein the first bucket position is any bucket position among the m bucket positions; Determine the first bucket position as the bucket position of the encryption result of the data to be queried in the first hash table.

4. The method according to claim 1, characterized in that: The step of determining, for each row of the first hash table containing the encryption result of the data to be queried, p vectors corresponding to each data to be queried in the vector set includes: For the encryption result of the data to be queried contained in each row of the first hash table, input the encryption result of the data to be queried into the p target hash functions respectively to obtain p target hash values ​​corresponding to the encryption result of the data to be queried; Based on the vector set, p vectors corresponding to the p target hash values ​​are searched.

5. A data anonymity query method, characterized in that: Applied to a data provider, the method comprises: Receiving an encryption result of at least one data to be queried sent by a data query terminal; Determine a query result corresponding to the encryption result of each to-be-queried data in the at least one to-be-queried data; Constructing a second hash table based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried; wherein p is a positive integer; A vector set is obtained by encoding the corresponding relationship between the encryption result and the query result contained in each row of the second hash table, and the vector set is sent to the data query end.

6. The method according to claim 5, characterized in that The constructing a second hash table based on the preset p target hash functions, the encryption result of each to-be-queried data, and the query result corresponding to the encryption result of each to-be-queried data includes: Inputting the encryption results of each of the data to be queried into the p target hash functions respectively, to obtain p target hash values ​​corresponding to the encryption results of each of the data to be queried; Constructing a correspondence between the encryption result of each data to be queried and the query result corresponding to the encryption result of each data to be queried; For each of the corresponding relationships, the following operations are performed respectively: determining the bucket position of the corresponding relationship in the second hash table according to the p target hash values ​​corresponding to the encryption result of the data to be queried; and filling the corresponding relationship into the bucket position; After it is determined that each of the corresponding relationships is filled in, the second hash table is obtained; each of the corresponding relationships in the second hash table is repeated p times.

7. A data anonymity query device, characterized in that: Applied to a data query end, the device comprises: An encryption module, used for encrypting at least one data to be queried, and obtaining an encryption result of each data to be queried in the at least one data to be queried; A first construction module is used to construct a first hash table based on p preset target hash functions and the encryption result of each data to be queried; p is a positive integer; A first receiving module is used to send the encryption result of each data to be queried to the data provider, and receive a vector set sent by the data provider; the vector set includes vectors obtained based on the p target hash functions and the query result corresponding to the encryption result of each data to be queried; The query module is used to determine the p vectors corresponding to each data to be queried in the vector set according to the encryption result of the data to be queried contained in each row in the first hash table, and obtain the query result corresponding to each data to be queried based on the p vectors corresponding to each data to be queried.

8. A data anonymity query device, characterized in that: Applied to a data provider, the device comprises: A second receiving module, used for receiving an encryption result of at least one data to be queried sent by the data query end; A determination module, used to determine a query result corresponding to the encryption result of each to-be-queried data in the at least one to-be-queried data; A second construction module is used to construct a second hash table based on the preset p target hash functions, the encryption result of each data to be queried, and the query result corresponding to the encryption result of each data to be queried; wherein p is a positive integer; The sending module is used to encode a vector set according to the corresponding relationship between the encryption result and the query result contained in each row of the second hash table, and send the vector set to the data query end.

9. An electronic device, characterized in that: The device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data anonymity query method as described in any one of claims 1-4; or, execute the data anonymity query method as described in any one of claims 5-6.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the data anonymity query method as described in any one of claims 1 to 4; or to execute the data anonymity query method as described in any one of claims 5 to 6.

Images