Data query method, requester, and service provider of a fully homomorphic database

Abstract

The present application discloses a data query method, a requester, and a service provider of a fully homomorphic database. The requester obtains a fully homomorphic public-private key pair, which includes a fully homomorphic public key and a fully homomorphic private key; sends a homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; receives the query result ciphertext returned by the service provider; the fully homomorphic database is obtained by encoding through integer coding and / or bit coding; the query result ciphertext is decrypted based on the homomorphic private key to obtain the query result corresponding to the query request. The service provider receives the fully homomorphic public key and query request sent by the requester; performs a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext; and sends the query result ciphertext to the requester.

Description

Technical Field

[0001] The present invention relates to the field of data query technology, and in particular to a data query method, a requester, and a service provider for a fully homomorphic database. Background Art

[0002] At present, the common range data query solutions for fully homomorphic databases in ciphertext computing scenarios mainly include interactive solutions and non-interactive solutions. Among them, the interactive solution has the problem of excessive communication data volume and poor security. As for the non-interactive solution, the encryption algorithms of Order-Preserving Encryption (OPE) and Order-Revealing Encryption (ORE) have the problem of exposing the size order information of private data, and the solution of the Fully Homomorphic Encryption (FHE) algorithm currently generally has the problems of complex technology and poor performance.

[0003] In other words, common range data query solutions cannot take into account both the security and efficiency of range queries. Summary of the invention

[0004] The embodiments of the present application provide a data query method, a requester, and a service provider for a fully homomorphic database, which can effectively improve the efficiency of range data query while ensuring the security of range query.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a data query method for a fully homomorphic database, which is applied to a requesting party and includes:

[0007] Obtain a fully homomorphic public-private key pair, the fully homomorphic public-private key pair comprising a fully homomorphic public key and a fully homomorphic private key;

[0008] Sending the homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding;

[0009] Receive the query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on the fully homomorphic database, the homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0010] The query result ciphertext is decrypted based on the homomorphic private key to obtain the query result corresponding to the query request.

[0011] In a second aspect, an embodiment of the present application provides a data query method for a fully homomorphic database, which is applied to a service provider, including:

[0012] Receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext;

[0013] Perform a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0014] The query result ciphertext is sent to the requesting party.

[0015] In a third aspect, an embodiment of the present application provides a requesting party, the requesting party comprising:

[0016] An acquisition unit, used to acquire a fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key;

[0017] A first sending unit is configured to send the homomorphic public key and a range query request to a service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; and the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding;

[0018] A first receiving unit is used to receive the query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on the fully homomorphic database, the homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0019] The decryption unit is used to decrypt the query result ciphertext based on the homomorphic private key to obtain the query result corresponding to the query request.

[0020] In a fourth aspect, an embodiment of the present application provides a service provider, the service provider comprising:

[0021] A second receiving unit is used to receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext;

[0022] A query unit, configured to perform a query based on a fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext, to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0023] The second sending unit is used to send the query result ciphertext to the requesting party.

[0024] In a fifth aspect, an embodiment of the present application provides a data query system for a fully homomorphic database, the data query system for a fully homomorphic database includes a requester and a servicer, wherein:

[0025] The requesting party is used to execute the data query method of the fully homomorphic database as in the first aspect;

[0026] The service provider is used to execute the data query method of the fully homomorphic database as in the second aspect.

[0027] In the sixth aspect, an embodiment of the present application provides a requester, which includes: a processor and a storage medium storing executable instructions, the storage medium relies on the processor to perform operations through a communication bus, and when the executable instructions are executed by the processor, the data query method of the fully homomorphic database described in the first aspect is executed.

[0028] In the seventh aspect, an embodiment of the present application provides a service party, which includes: a processor and a storage medium storing executable instructions, the storage medium relies on the processor to perform operations through a communication bus, and when the executable instructions are executed by the processor, the data query method of the fully homomorphic database described in the second aspect is executed.

[0029] In an eighth aspect, an embodiment of the present application provides a computer storage medium storing executable instructions. When the executable instructions are executed by a processor, the processor executes the data query method of a fully homomorphic database as described in the first aspect or the second aspect.

[0030] The embodiments of the present application provide a data query method, a requester, and a service provider for a fully homomorphic database. The requester obtains a fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key; sends the homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding; receives the query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on the fully homomorphic database, the homomorphic public key, the range query type, and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; the query result ciphertext is decrypted based on the homomorphic private key to obtain the query result corresponding to the query request. The service provider receives the fully homomorphic public key and query request sent by the requester; wherein the query request carries the range query type and the range query parameter ciphertext; performs a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; and sends the query result ciphertext to the requester. It can be seen that in an embodiment of the present application, on the basis of the fully homomorphic database, a range data query can be performed for a determined range query type and an encrypted range query parameter ciphertext, wherein the fully homomorphic database is obtained by encoding using different encoding methods, and the range data query can include a screening process and a statistical process for different range query types. In other words, the embodiment of the present application implements a range data query of a ciphertext by utilizing encodings with different computing advantages, as well as a unified plaintext space and encryption algorithm, thereby effectively improving the efficiency of the range data query on the basis of ensuring the security of the range query. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 1 ;

[0032] Figure 2 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 2 ;

[0033] Figure 3 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 3 ;

[0034] Figure 4 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 4 ;

[0035] Figure 5Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 5 ;

[0036] Figure 6 A schematic diagram of a method for constructing a fully homomorphic plaintext database proposed in an embodiment of the present application;

[0037] Figure 7 A schematic diagram of a range data query method based on a fully homomorphic plaintext database proposed in an embodiment of the present application;

[0038] Figure 8 A schematic diagram of a method for constructing a fully homomorphic ciphertext database proposed in an embodiment of the present application;

[0039] Fig. 9 A schematic diagram of a range data query method based on a fully homomorphic ciphertext database proposed in an embodiment of the present application;

[0040] Fig.10 A schematic diagram of the structure of the requesting party proposed in the embodiment of the present application;

[0041] Fig.11 A schematic diagram of the hardware structure of the requesting party proposed in the embodiment of the present application;

[0042] Fig.12 A schematic diagram of the composition structure of the service provider proposed in the embodiment of the present application;

[0043] Fig.13 A schematic diagram of the hardware structure of the service provider proposed in the embodiment of the present application;

[0044] Fig.14 A schematic diagram of the structure of the data query system proposed in the embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. It is understood that the specific embodiments described herein are only used to explain the difference application, rather than to limit the application. It should also be noted that, for the convenience of description, only the parts that are different from the related applications are shown in the drawings.

[0046] Currently, for ciphertext databases that support range queries, the technical means for calculating equality or comparison functions on private data can be divided into two main categories: one is an interactive solution, and the other is a non-interactive solution.

[0047] Non-interactive solutions can also be divided into two types: one is to use encryption algorithms such as order-preserving encryption OPE and sequence-revealing encryption ORE that preserve the order of plaintext data size; the other is to use a fully homomorphic encryption algorithm.

[0048] Among them, in the solution using FHE, the main technical routes are:

[0049] 1. Use plaintext space as The FHE ciphertext equality and comparison function is bits of data, usually requires a multiplication depth of at least ,Subsequent statistical calculations are performed in a binary manner.

[0050] 2. Use plaintext space as or ( is a prime number greater than 2), using Fermat's little theorem and Frobenius mapping, the ciphertext data equality function needs to consume at least The multiplication depth.

[0051] 3. Combined use of plaintext space and FHE algorithm. The plaintext space is The FHE algorithm is used to calculate the correlation or comparison function of the ciphertext data, and the plaintext space is The FHE algorithm is used for statistical computing. At this time, it requires the conversion technology between LWE (Learning With Errors) ciphertext and RLWE (Ring-Learning With Errors) ciphertext, the technology of converting LWE ciphertext to RGSW ciphertext, and complex technologies such as BlindRotate.

[0052] 4. Combined use of plaintext space The FHE algorithm and other technologies, private data equality and comparison functions are implemented through technologies such as Bio Hashing method, Multi-Layer Perceptron (MLP) Hashing method, and Index-of-Maximum (IoM) Hashing method.

[0053] 5. Use plaintext space as or smaller Homomorphic encryption algorithm, which decomposes and encodes a single data into multiple or smaller In the above, the equality and comparison calculations of the ciphertext data, as well as the statistical calculations that may occur later, are decomposed and performed on a smaller number field, and then the results are combined using the inverse function of the decomposition method.

[0054] Interactive solutions have the problem of too much communication data, and inappropriate access modes and communication data may also bring security risks. Non-interactive solutions using OPE / ORE encryption algorithms retain the size and order information of plaintext data while also exposing the size and order information of private data. Solutions using FHE algorithms currently have the problems of complex technology and poor performance.

[0055] In order to solve the above problems, an embodiment of the present application provides a data query method, a requester, and a service provider for a fully homomorphic database, wherein the requester obtains a fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key; sends a homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameters after bit encoding; receives a query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on the fully homomorphic database, the homomorphic public key, the range query type, and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; the query result ciphertext is decrypted based on the homomorphic private key to obtain a query result corresponding to the query request. The service provider receives the fully homomorphic public key and query request sent by the requester; wherein the query request carries the range query type and the range query parameter ciphertext; performs a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; and sends the query result ciphertext to the requester. It can be seen that in an embodiment of the present application, on the basis of the fully homomorphic database, a range data query can be performed for a determined range query type and an encrypted range query parameter ciphertext, wherein the fully homomorphic database is obtained by encoding using different encoding methods, and the range data query can include a screening process and a statistical process for different range query types. In other words, the embodiment of the present application implements a range data query of a ciphertext by utilizing encodings with different computing advantages, as well as a unified plaintext space and encryption algorithm, thereby effectively improving the efficiency of the range data query on the basis of ensuring the security of the range query.

[0056] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0057] An embodiment of the present application provides a data query method for a fully homomorphic database. The data query method for a fully homomorphic database can be applied to a requester, and can also be applied to any terminal or device configured with a requester, and the present application does not make any specific limitations.

[0058] Below, taking the requesting party as an example, a data query method for a fully homomorphic database proposed in an embodiment of the present application is exemplified.

[0059] Furthermore, in the embodiments of the present application, Figure 1 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 1 ,like Figure 1 As shown, a data query method for a fully homomorphic database may include the following steps:

[0060] Step 101, obtain a fully homomorphic public-private key pair; wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key.

[0061] In an embodiment of the present application, the requesting party can obtain a fully homomorphic public-private key pair.

[0062] In an embodiment of the present application, a fully homomorphic public-private key pair may include a fully homomorphic public key and a fully homomorphic private key. The fully homomorphic public key may be used to encrypt data, i.e., the fully homomorphic public key is the key part used to encrypt data; the fully homomorphic private key may be used to decrypt data, i.e., the fully homomorphic private key is the key part used to decrypt data.

[0063] Furthermore, in the embodiments of the present application, the generation of a fully homomorphic public key generally involves a series of mathematical operations and random number generation to ensure that the generated key pair is secure and reliable. In practical applications, the length and format of the public key will vary depending on the specific homomorphic encryption algorithm. For example, in some algorithms, the public key may be a matrix whose elements come from a specific set of integers and satisfy certain mathematical properties.

[0064] Furthermore, in the embodiments of the present application, the generation process of the fully homomorphic private key is closely related to the public key, and is usually completed through a series of mathematical operations and random number generation. The confidentiality of the private key is crucial to the security of homomorphic encryption.

[0065] In an embodiment of the present application, a fully homomorphic database used for range data query may include a fully homomorphic ciphertext database and a fully homomorphic plaintext database, wherein the methods for obtaining the fully homomorphic public-private key pairs are different for the fully homomorphic ciphertext database and the fully homomorphic plaintext database.

[0066] Further, in an embodiment of the present application, assuming that the fully homomorphic database is a fully homomorphic ciphertext database, the requesting party can directly obtain a pre-stored fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair is pre-generated by the requesting party and stored in a local key storage device.

[0067] Exemplarily, in some embodiments, for the scenario where the fully homomorphic database is a fully homomorphic ciphertext database, the requester can generate a fully homomorphic public-private key pair including a fully homomorphic public key and a fully homomorphic private key in advance by calling a fully homomorphic key generation operator, and then the fully homomorphic public-private key pair can be stored in a local key storage device for subsequent use.

[0068] Accordingly, in an embodiment of the present application, for a scenario where the fully homomorphic database is a fully homomorphic ciphertext database, the requester can generate a fully homomorphic ciphertext database in advance. Wherein, for each data column of all data tables in the original data storage device, determine the encoding method of each data column; wherein the encoding method includes integer encoding and / or bit encoding; for data columns that meet the query conditions, encode according to the encoding method of bit encoding to obtain a bit-encoded data column; wherein the bit encoding includes bit-by-bit integer encoding of the input data; for data columns that meet statistical calculations, encode according to the encoding method of integer encoding to obtain an integer-encoded data column; wherein the integer encoding includes encoding based on a fully homomorphic encoding operator; then, based on the fully homomorphic public key, call the fully homomorphic encryption operator to encrypt the bit-encoded data column and the integer-encoded data column to obtain a fully homomorphic ciphertext database; finally, the fully homomorphic ciphertext database can be sent to the service provider.

[0069] Accordingly, in some embodiments, a fully homomorphic database is obtained after encoding the data columns according to different encoding methods, for example, bit encoding and integer encoding; therefore, the fully homomorphic database may include a bit encoding database and an integer encoding database, wherein, for a fully homomorphic ciphertext database, it correspondingly includes a bit encoding ciphertext database and an integer encoding ciphertext database.

[0070] It can be understood that in the embodiments of the present application, after generating a fully homomorphic public-private key pair, the encoded data columns corresponding to all data tables in the original data storage device can also be encrypted using the fully homomorphic public key in the fully homomorphic public-private key pair to obtain the corresponding fully homomorphic ciphertext database.

[0071] It should be noted that in the embodiments of the present application, all data tables in the original data storage device may be encoded using different encoding methods, including but not limited to integer encoding and / or bit encoding. For each data column, there may be one or more encoding methods.

[0072] Exemplarily, in some embodiments, during the database encoding stage, data columns that can be used as query conditions can be encoded using a bit encoding method; data columns that can be used for statistical calculations can be encoded using an integer method.

[0073] Exemplarily, in some embodiments, in the database encoding stage, assuming that a data column can be used as a query condition and can also be used for statistical calculations, the data column can also be encoded according to different encoding methods to obtain a bit-encoded data column and an integer-encoded data column, that is, each data column corresponds to one or more encoding methods.

[0074] It can be understood that in an embodiment of the present application, after the requesting party stores the pre-generated fully homomorphic public-private key pair in the local key storage device, it can directly read it from the local key storage device when the fully homomorphic public-private key pair is needed later.

[0075] Exemplarily, in some embodiments, for a scenario where the fully homomorphic database is a fully homomorphic ciphertext database, when obtaining a fully homomorphic public-private key pair, the requesting party may obtain the fully homomorphic public-private key pair from a local key storage device.

[0076] Furthermore, in an embodiment of the present application, assuming that the fully homomorphic database is a fully homomorphic plaintext database, when obtaining a fully homomorphic public-private key pair, the requesting party can call a fully homomorphic key generation operator to generate a fully homomorphic public-private key pair. Among them, the fully homomorphic key generation operator generally refers to the operation or step in the key generation algorithm (KeyGen), which is used to generate the public and private key pairs required for fully homomorphic encryption. These key pairs play a vital role in the subsequent steps of fully homomorphic encryption, including encryption, decryption, and homomorphic operations.

[0077] Exemplarily, in some embodiments, the fully homomorphic key generation algorithm may include the following steps:

[0078] 1. Input parameters: The key generation algorithm usually takes a fixed ring R and an ideal basis B_I of the ring R as input. The selection of these parameters has an important impact on the security and efficiency of the generated key.

[0079] 2. Generate private key: Use the subroutine IdealGen(R, B_I) to generate the private key B_sk. The private key B_sk is a basis of the ideal lattice J, which consists of a set of approximately orthogonal vectors with small Euclidean norm.

[0080] 3. Generate public key: The public key B_pk is generated from the private key B_sk, usually through some mathematical transformation (such as Hermite canonical form HNF). The public key B_pk is used to encrypt the plaintext during the encryption process, and also plays a key role in homomorphic operations.

[0081] 4. Generate homomorphic computing public key: In some fully homomorphic encryption schemes, a special public key may be generated, namely the homomorphic computing public key Evk. This public key is used when executing the homomorphic operation algorithm (Eval) to control the growth of ciphertext and the accumulation of noise.

[0082] That is to say, in an embodiment of the present application, for a scenario where the fully homomorphic database is a fully homomorphic plaintext database, the requester can generate a fully homomorphic public-private key pair by calling a fully homomorphic key generation operator.

[0083] It can be seen that in the embodiments of the present application, for the scenario where the fully homomorphic database is a fully homomorphic ciphertext database, the requester obtains the fully homomorphic public-private key pair from a local key storage device; for the scenario where the fully homomorphic database is a fully homomorphic plaintext database, the requester calls the fully homomorphic key generation operator to generate a fully homomorphic public-private key pair.

[0084] Furthermore, in an embodiment of the present application, if the fully homomorphic database used for range data query is a fully homomorphic ciphertext database, the fully homomorphic ciphertext database can be constructed by the requester and sent to the service provider; if the fully homomorphic database used for range data query is a fully homomorphic plaintext database, the fully homomorphic plaintext database can be constructed by the service provider.

[0085] It should be noted that in the embodiments of the present application, the construction methods of the fully homomorphic ciphertext database and the fully homomorphic plaintext database may be different. During the construction of the fully homomorphic ciphertext database, the encoded data columns need to be encrypted, while during the construction of the fully homomorphic plaintext database, the encoded data columns do not need to be encrypted.

[0086] It is understandable that the data query method proposed in the embodiment of the present application can be a range data query method, that is, a range query method. Among them, range query (Range Query) is an operation to find records that meet specific range conditions in a database or data structure. It is usually used to retrieve data that falls within a specified interval on one or some fields. Range queries are widely used in various database management systems (DBMS) and data storage systems, such as relational databases (such as MySQL, PostgreSQL), NoSQL databases (such as MongoDB), and memory data structures (such as red-black trees, B-trees, etc.). Range query is one of the basic and important functions in database operations, which allows users to retrieve data according to a specified range. By understanding and using range queries, you can extract the required information from the database more efficiently, while using indexes to optimize query performance.

[0087] Step 102: Send a fully homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding.

[0088] In an embodiment of the present application, after obtaining a fully homomorphic public-private key pair, the requester may send the fully homomorphic public key included in the fully homomorphic public-private key pair to the service provider. At the same time, the requester may send a range query request to the service provider, wherein the range query request sent by the requester to the service provider may carry a range query type and a range query parameter ciphertext.

[0089] In an embodiment of the present application, the requester may first determine a range query type and range query parameters.

[0090] Further, in an embodiment of the present application, when determining the range query type, the requester may first determine a screening function and a statistical function, and then may further determine the range query type based on the screening function and the statistical function.

[0091] Furthermore, in an embodiment of the present application, the filter function may include one or more filter predicates, wherein the filter predicate may be used to determine relevant information of the filter process corresponding to the range query process.

[0092] In the embodiments of the present application, the number of the screening predicates may be one or more, which is not specifically limited in the present application.

[0093] Further, in an embodiment of the present application, the screening predicate includes screening-related columns, comparison operators and predicate parameters. The screening-related columns may be one or more data columns in a fully homomorphic database that meet the screening condition.

[0094] In an embodiment of the present application, the comparison operator may include one of the following operators: an equal operator, a not equal operator, a less than operator, a greater than operator, a less than or equal to operator, and a greater than or equal to operator.

[0095] Further, in an embodiment of the present application, in the case of multiple filter predicates, the multiple filter predicates may be connected by one or more connectors; wherein the connector may include the following logical operators: AND, OR, NOT.

[0096] Furthermore, in the embodiment of the present application, the predicate parameter is input data of the requester, and different screening predicates may correspond to different predicate parameters.

[0097] Exemplarily, in some embodiments, it is assumed that the determination filtering function includes a filtering predicate "salary income is greater than 2,000 yuan", wherein the column involved in the filtering in the filtering predicate is "salary table" or "salary data", the comparison operator in the filtering predicate is "greater than operator", and the predicate parameter in the filtering predicate is "2000".

[0098] Exemplarily, in some embodiments, it is assumed that the determination filtering function includes a filtering predicate "the time of joining the company is earlier than 2021", wherein the column involved in the filtering in the filtering predicate is "joining timetable", the comparison operator in the filtering predicate is "less than operator", and the predicate parameter in the filtering predicate is "2021".

[0099] For example, in some embodiments, it is assumed that the determination filter function includes two filter predicates, namely "salary income is greater than 2,000 yuan" and "the time of joining the company is earlier than 2021", wherein the two filter predicates can be connected by a connector "and". That is, the corresponding filter function can be understood as: salary income is greater than 2,000 yuan and the time of joining the company is earlier than 2021.

[0100] For example, in some embodiments, it is assumed that the determination filter function includes two filter predicates, namely "salary income is greater than 2,000 yuan" and "the time of joining the company is earlier than 2021", wherein the two filter predicates can be connected by a connector "or". That is, the corresponding filter function can be understood as: salary income is greater than 2,000 yuan or the time of joining the company is earlier than 2021.

[0101] Further, in an embodiment of the present application, the statistical function may include columns involved in the statistics and statistical types. The statistical function may be used to determine relevant information of the statistical process corresponding to the range query process.

[0102] Furthermore, in an embodiment of the present application, the columns involved in the statistics may be one or more data columns in a fully homomorphic database that meet the statistical conditions.

[0103] Further, in an embodiment of the present application, the statistical type includes one or more of the following arithmetic operators: addition, subtraction, and multiplication.

[0104] For example, in some embodiments, assuming that statistics on gender are required, the column involved in the statistics is "gender data".

[0105] For example, in some embodiments, assuming that it is necessary to count the total salary, the column involved in the statistics is "salary data", and the corresponding statistical type may include an arithmetic operator of addition.

[0106] Furthermore, in an embodiment of the present application, each range query corresponds to at least one screening function and at least one statistical function.

[0107] That is to say, in the embodiments of the present application, data screening can be performed for different screening functions through a range query, and data statistics can be performed for different statistical functions through a range query.

[0108] Further, in an embodiment of the present application, the range query parameter may include a predicate parameter in a filter predicate included in a filter function in a range query type, wherein the predicate parameter may be input data of the requester.

[0109] That is to say, in an embodiment of the present application, after receiving the data output by the requester, the requester can generate corresponding range query parameters based on the output data, and can also determine the predicate parameters in the filter predicate included in the filter function in the range query type based on the input data.

[0110] In an embodiment of the present application, after determining the range query type and the range query parameters, the requester may further encode and encrypt the range query parameters to obtain a ciphertext of the range query parameters.

[0111] Further, in an embodiment of the present application, when encoding and encrypting the range query parameter to obtain the range query parameter ciphertext, the range query parameter can be bit-encoded to obtain the bit-encoded range query parameter. Then, the fully homomorphic encryption operator is further called to encrypt the bit-encoded range query parameter to generate the range query parameter ciphertext.

[0112] It can be understood that in the embodiments of the present application, since the range query parameters include the predicate parameters in the filtering predicate included in the filtering function in the range query type, that is, the range query parameters can be used in the filtering process, therefore, the range query parameters related to the filtering can be encoded using bit encoding to obtain the corresponding bit-encoded range query parameters.

[0113] It is understandable that in the embodiments of the present application, for the range query parameter after bit encoding, the requester can call a fully homomorphic encryption operator to encrypt it and obtain the corresponding range query parameter ciphertext. Among them, the fully homomorphic encryption operator supports any number of multiplication and / or addition operations on the ciphertext, which means that if a series of mathematical operations are performed on the plaintext and then encrypted, the result obtained by directly performing the same operation on the ciphertext is equivalent after decryption.

[0114] That is to say, in the embodiments of the present application, by generating range query parameter ciphertext through a fully homomorphic encryption operator, data integrity can be maintained while improving data security.

[0115] Step 103, receiving the query result ciphertext sent by the service provider; wherein, the query result ciphertext is obtained by the service provider based on the fully homomorphic database, the fully homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer coding and / or bit coding.

[0116] In an embodiment of the present application, after sending a range query request to the service provider, the requester may receive a query result ciphertext sent by the service provider in response to the range query request.

[0117] It can be understood that in the embodiments of the present application, the query result ciphertext can be obtained by the service provider based on the fully homomorphic database, the fully homomorphic public key, the range query type and the range query parameter ciphertext.

[0118] It should be noted that in the embodiments of the present application, both the fully homomorphic plaintext database generated by the service provider and the fully homomorphic ciphertext database generated by the requesting party are encoded using different encoding methods, for example, they are encoded using integer encoding and / or bit encoding.

[0119] Step 104: Use the fully homomorphic private key to decrypt the query result ciphertext to obtain the query result corresponding to the query request.

[0120] In an embodiment of the present application, after receiving the query result ciphertext sent by the service party in response to the range query request, the requester can use the fully homomorphic private key to decrypt the query result ciphertext to obtain the query result corresponding to the query request.

[0121] It can be understood that in an embodiment of the present application, after receiving the query result ciphertext sent by the service provider, the requester also needs to decrypt the query result ciphertext, wherein the requester can use the fully homomorphic private key in the fully homomorphic public-private key pair that has been obtained to decrypt the query result ciphertext, and finally obtain the query result corresponding to the query request.

[0122] In summary, the data query method of the fully homomorphic database proposed in the embodiment of the present application adopts the plaintext space as The FHE algorithm is used, but the data is bit-encoded and FHE itself is plaintext-encoded at the same time. The ciphertext corresponding to the bit encoding is used when calculating the equality and comparison of the ciphertext data, and the ciphertext corresponding to the plaintext encoding of the FHE algorithm is used when statistics are taken. The embodiment of the present application greatly optimizes the performance of range query by utilizing encodings with different computational advantages, as well as a unified plaintext space and encryption algorithm.

[0123] The range data query method proposed in the embodiment of the present application, the ciphertext database supports range query, multi-column range query with combined conditions and statistical calculation. The present application makes good use of the computing advantages of full homomorphism in range query and statistical calculation by combining encodings with different computing advantages and a unified encryption scheme.

[0124] The embodiment of the present application provides a data query method for a fully homomorphic database, which can perform range data query for a determined range query type and an encrypted range query parameter ciphertext on the basis of a fully homomorphic database, wherein the fully homomorphic database is encoded using different encoding methods, and the range data query may include a screening process and a statistical process for different range query types. In other words, the embodiment of the present application implements range data query of ciphertext by utilizing encodings with different computing advantages, as well as a unified plaintext space and encryption algorithm, thereby effectively improving the efficiency of range data query while ensuring the security of range query.

[0125] Another embodiment of the present application provides a data query method for a fully homomorphic database. The data query method for a fully homomorphic database can be applied to a service provider, and can also be applied to any terminal or device configured with a service provider, and the present application does not make any specific limitations.

[0126] Below, taking the service side as an example, a data query method for a fully homomorphic database proposed in an embodiment of the present application is exemplified.

[0127] Furthermore, in the embodiments of the present application, Figure 2 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 2 ,like Figure 2 As shown, a data query method for a fully homomorphic database may include the following steps:

[0128] Step 201: Receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext.

[0129] In an embodiment of the present application, the service provider may receive a fully homomorphic public key sent by the requester, and at the same time, may receive a query request sent by the requester; wherein the query request carries a range query type and a range query parameter ciphertext.

[0130] It can be understood that in an embodiment of the present application, the requesting party can obtain a fully homomorphic public-private key pair including a fully homomorphic public key and a fully homomorphic private key, and then send the fully homomorphic public key to the service provider.

[0131] In an embodiment of the present application, a fully homomorphic database used for range data query may include a fully homomorphic ciphertext database and a fully homomorphic plaintext database, wherein, assuming that the fully homomorphic database is a fully homomorphic ciphertext database, the requesting party can directly obtain a pre-stored fully homomorphic public-private key pair, and assuming that the fully homomorphic database is a fully homomorphic plaintext database, when obtaining the fully homomorphic public-private key pair, the requesting party can call a fully homomorphic key generation operator to generate a fully homomorphic public-private key pair.

[0132] In an embodiment of the present application, the service provider may receive a query request sent by the requester, wherein the range query request may carry a range query type and a range query parameter ciphertext.

[0133] In an embodiment of the present application, the range query type may be determined by the requester based on a screening function and a statistical function. The requester may first determine the screening function and the statistical function respectively. The screening function may include one or more screening predicates. The screening predicate may be used to determine the relevant information of the screening process corresponding to the range query process. The statistical function may include the columns involved in the statistics and the statistical type. The statistical function may be used to determine the relevant information of the statistical process corresponding to the range query process.

[0134] In an embodiment of the present application, the range query parameter ciphertext may be obtained by encoding and encrypting the range query parameter by the requester. The range query parameter may include a predicate parameter in a filter predicate included in a filter function in a range query type. The predicate parameter may be input data of the requester.

[0135] It is understandable that the data query method proposed in the embodiment of the present application can be a range data query method, that is, a range query method. Among them, range query (Range Query) is an operation to find records that meet specific range conditions in a database or data structure. It is usually used to retrieve data that falls within a specified interval on one or some fields. Range queries are widely used in various database management systems (DBMS) and data storage systems, such as relational databases (such as MySQL, PostgreSQL), NoSQL databases (such as MongoDB), and memory data structures (such as red-black trees, B-trees, etc.). Range query is one of the basic and important functions in database operations, which allows users to retrieve data according to a specified range. By understanding and using range queries, you can extract the required information from the database more efficiently, while using indexes to optimize query performance.

[0136] Step 202: perform a query based on a fully homomorphic database, a fully homomorphic public key, a range query type, and a range query parameter ciphertext to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding.

[0137] In an embodiment of the present application, after receiving the query public key sent by the requester and the query request carrying the range query type and range query parameter ciphertext, the service party can further perform a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext.

[0138] Furthermore, in an embodiment of the present application, when performing a query based on a fully homomorphic database, a fully homomorphic public key, a range query type, and a range query parameter ciphertext to obtain a query result ciphertext, the service provider may first determine a filtering request and a statistical request based on the range query type and the range query parameter ciphertext.

[0139] It can be understood that in the embodiment of the present application, the filtering request determined by the service party based on the range query type and the range query parameter ciphertext may correspond to the filtering function determined by the requesting party when generating the range query type. The statistical request determined by the service party based on the range query type and the range query parameter ciphertext may correspond to the statistical function determined by the requesting party when generating the range query type.

[0140] Accordingly, in an embodiment of the present application, the screening request may include one or more screening predicates, wherein the screening predicates may be used to determine relevant information of the screening process corresponding to the range query process.

[0141] In the embodiments of the present application, the number of the screening predicates may be one or more, which is not specifically limited in the present application.

[0142] Further, in an embodiment of the present application, the screening predicate includes screening the columns involved, comparing the operator with the predicate parameter ciphertext, wherein the screening columns involved may be one or more data columns in the fully homomorphic database that meet the screening condition.

[0143] In an embodiment of the present application, the comparison operator may include one of the following operators: an equal operator, a not equal operator, a less than operator, a greater than operator, a less than or equal to operator, and a greater than or equal to operator.

[0144] Further, in an embodiment of the present application, in the case of multiple filter predicates, the multiple filter predicates may be connected by one or more connectors; wherein the connector may include the following logical operators: AND, OR, NOT.

[0145] Furthermore, in the embodiment of the present application, the predicate parameter ciphertext is obtained by encrypting the predicate parameter, the predicate parameter is the input data of the requesting party, and different screening predicates may correspond to different predicate parameters.

[0146] Exemplarily, in some embodiments, it is assumed that the determination filtering request includes a filtering predicate "salary income is greater than A yuan", wherein the column involved in the filtering in the filtering predicate is "salary table" or "salary data", the comparison operator in the filtering predicate is "greater than operator", and the predicate parameter ciphertext in the filtering predicate is "A".

[0147] Exemplarily, in some embodiments, it is assumed that the determination filtering request includes a filtering predicate "the time of joining the company is earlier than B years", wherein the column involved in the filtering in the filtering predicate is "joining timetable", the comparison operator in the filtering predicate is "less than operator", and the predicate parameter ciphertext in the filtering predicate is "B".

[0148] For example, in some embodiments, it is assumed that the determination filter function includes two filter predicates, namely "salary income is greater than A yuan" and "entry time is earlier than B years", wherein the two filter predicates can be connected by a connector "and". That is, the corresponding filter function can be understood as: salary income is greater than A yuan and the entry time is earlier than B years.

[0149] For example, in some embodiments, it is assumed that the determination filter function includes two filter predicates, namely "salary income is greater than A yuan" and "entry time is earlier than B years", wherein the two filter predicates can be connected by a connector "or". That is, the corresponding filter function can be understood as: salary income is greater than A yuan or entry time is earlier than B years.

[0150] Further, in an embodiment of the present application, the statistical request may include the columns involved in the statistics and the statistical type. The statistical request may be used to determine the relevant information of the statistical process corresponding to the range query process.

[0151] Furthermore, in an embodiment of the present application, the columns involved in the statistics may be one or more data columns in a fully homomorphic database that meet the statistical conditions.

[0152] Further, in an embodiment of the present application, the statistical type includes one or more of the following arithmetic operators: addition, subtraction, and multiplication.

[0153] For example, in some embodiments, assuming that statistics on gender are required, the column involved in the statistics is "gender data".

[0154] For example, in some embodiments, assuming that it is necessary to count the total salary, the column involved in the statistics is "salary data", and the corresponding statistical type may include an arithmetic operator of addition.

[0155] Furthermore, in an embodiment of the present application, each range query corresponds to at least one screening request and at least one statistics request.

[0156] That is to say, in the embodiments of the present application, data screening can be performed for different screening requests through a range query, and data statistics can be performed for different statistics requests through a range query.

[0157] Further, in an embodiment of the present application, the range query parameter ciphertext may include the predicate parameter ciphertext in the screening predicate included in the screening request in the range query type, wherein the predicate parameter ciphertext is obtained by encrypting the predicate parameter, and the predicate parameter may be input data of the requester.

[0158] Furthermore, in an embodiment of the present application, after determining the filtering request and the statistical request based on the range query type and the range query parameter ciphertext, the first filtering request result ciphertext can be determined based on the fully homomorphic public key, the fully homomorphic database and the filtering request.

[0159] It should be noted that in the embodiments of the present application, when determining the first screening request result ciphertext based on the fully homomorphic public key, the fully homomorphic database and the screening request, the fully homomorphic comparison operator corresponding to the comparison operator in the screening predicate can be called for each screening predicate based on the fully homomorphic public key and the fully homomorphic database to screen the data on the columns involved in the screening to obtain the first screening predicate result ciphertext. For the screening request, the service party can call the fully homomorphic logic operator corresponding to the connector to calculate the logical calculation results of all the first screening predicate result ciphertexts to obtain the first screening request result ciphertext.

[0160] It should be noted that, in the embodiment of the present application, the first screening predicate result ciphertext includes the result of whether all the data on the columns involved in the screening pass the screening. In other words, the first screening predicate result ciphertext can be used to determine whether the data on the columns involved in the screening satisfies the screening predicate composed of the comparison operator and the predicate parameter ciphertext.

[0161] It should be noted that, in the embodiments of the present application, corresponding to the comparison operator, the fully homomorphic comparison operator may include one of the following fully homomorphic operators: a fully homomorphic equal operator, a fully homomorphic not equal operator, a fully homomorphic less than operator, a fully homomorphic greater than operator, a fully homomorphic less than or equal to operator, and a fully homomorphic greater than or equal to operator.

[0162] It is understandable that in an embodiment of the present application, after obtaining the first screening predicate result ciphertext, the service provider may choose to convert the representation of the first screening predicate result ciphertext in a specific manner; wherein the converted first screening predicate result ciphertext includes the first value or the second value.

[0163] It should be noted that in the embodiment of the present application, the first value and the second value are different, and the embodiment of the present application does not specifically limit the numerical values ​​of the first value and the second value. For example, the first value may be 1, and the second value may be 0.

[0164] Accordingly, in some embodiments, after the service provider converts the representation of the first screening predicate result ciphertext in a specific manner, if the converted first screening predicate result ciphertext is a first value, then the first screening predicate result ciphertext can be considered to represent a result that passes the screening; if the converted first screening predicate result ciphertext is a second value, then the first screening predicate result ciphertext can be considered to represent a result that fails the screening.

[0165] It can be understood that, in the embodiment of the present application, since the first screening predicate result ciphertext includes the result of whether all the data on the columns involved in the screening pass the screening, the first screening request result ciphertext obtained by calculating the logical calculation result of the first screening predicate result ciphertext may include the result ciphertext of whether all the data on the columns involved in the screening meet the screening request. In other words, the first screening request result ciphertext may be used to determine whether the data on the columns involved in the screening meet the screening request composed of one or more screening predicates.

[0166] Further, in an embodiment of the present application, corresponding to one or more connectors in a filter request that connect multiple filter predicates, the fully homomorphic logic operators may include: a fully homomorphic AND operator, a fully homomorphic OR operator, and a fully homomorphic NOT operator.

[0167] Furthermore, in an embodiment of the present application, for a statistical request, the service provider may call a fully homomorphic multiplication operator to obtain a first screening data ciphertext based on the first screening request result ciphertext and all data on the columns involved in the statistics; and then, based on the statistical type, a fully homomorphic arithmetic operator may be called to calculate the first screening data ciphertext to further determine the query result ciphertext.

[0168] It should be noted that, in the embodiments of the present application, the fully homomorphic arithmetic operators may include a fully homomorphic addition operator, a fully homomorphic subtraction operator and a fully homomorphic multiplication operator.

[0169] That is to say, in an embodiment of the present application, after receiving the query request sent by the requester, the service provider can further determine the filtering request and the statistical request based on the range query type and the range query parameter ciphertext carried in the query request, and then process the filtering request and the statistical request respectively based on the fully homomorphic public key and the fully homomorphic database, and finally obtain the query result ciphertext corresponding to the query request.

[0170] It can be understood that in an embodiment of the present application, the fully homomorphic database used for range data query may include a fully homomorphic ciphertext database and a fully homomorphic plaintext database, wherein, for the fully homomorphic ciphertext database and the fully homomorphic plaintext database, the range data query method performed by the service party based on the fully homomorphic database is different.

[0171] Furthermore, in an embodiment of the present application, if the fully homomorphic database used for range data query is a fully homomorphic ciphertext database, the fully homomorphic ciphertext database can be constructed by the requester and sent to the service provider; if the fully homomorphic database used for range data query is a fully homomorphic plaintext database, the fully homomorphic plaintext database can be constructed by the service provider.

[0172] It should be noted that in the embodiments of the present application, the construction methods of the fully homomorphic ciphertext database and the fully homomorphic plaintext database may be different. During the construction of the fully homomorphic ciphertext database, the encoded data columns need to be encrypted, while during the construction of the fully homomorphic plaintext database, the encoded data columns do not need to be encrypted.

[0173] Furthermore, in an embodiment of the present application, when the service provider constructs a fully homomorphic plaintext database, that is, for the scenario where the fully homomorphic database is a fully homomorphic plaintext database, for each data column of all data tables in the original data storage device, a coding method for each data column is determined; for data columns that meet the query conditions, encoding is performed according to a bit coding method to obtain a bit-coded data column; wherein, the bit coding includes bit-by-bit integer coding of the input data; for data columns that meet statistical calculations, encoding is performed according to an integer coding method to obtain an integer-coded data column; wherein, the integer coding includes coding based on a fully homomorphic coding operator; based on the bit-coded data column and the integer-coded data column, a fully homomorphic plaintext database is constructed.

[0174] It is understandable that, in the embodiments of the present application, the encoding method may include integer encoding and / or bit encoding. Among them, each data column may correspond to one or more encoding methods. That is, for all data tables in the original data storage device, different encoding methods may be used for encoding, including but not limited to integer encoding and / or bit encoding.

[0175] Exemplarily, in some embodiments, during the database encoding stage, data columns that can be used as query conditions can be encoded using a bit encoding method; data columns that can be used for statistical calculations can be encoded using an integer method.

[0176] For example, in some embodiments, during the database encoding stage, assuming that a data column can be used as a query condition and also for statistical calculations, the data column can be encoded in different encoding methods, that is, each data column corresponds to one or more encoding methods.

[0177] Accordingly, in some embodiments, the fully homomorphic database is obtained after encoding the data columns according to different encoding methods, for example, bit encoding and integer encoding; therefore, the fully homomorphic database may include a bit encoding database and an integer encoding database, wherein, for the fully homomorphic plaintext database, a bit encoding plaintext database and an integer encoding plaintext database are correspondingly included. It can be understood that in the embodiments of the present application, the bit encoded data columns and the integer encoded data columns in the fully homomorphic plaintext database are encoded using different encoding methods.

[0178] Furthermore, in an embodiment of the present application, a fully homomorphic database for range data query may include a fully homomorphic ciphertext database and a fully homomorphic plaintext database. Accordingly, for the fully homomorphic ciphertext database, all data in the fully homomorphic database is in ciphertext form; for the fully homomorphic plaintext database, all data in the fully homomorphic database is in plaintext form.

[0179] Furthermore, in an embodiment of the present application, for the scenario of a fully homomorphic plaintext database, that is, all data in the fully homomorphic database is in plaintext form, when the service party calls the fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit plaintext to obtain the first screening predicate result ciphertext, it can first determine the predicate parameter bit ciphertext corresponding to each bit of the bit-encoded predicate parameter ciphertext; at the same time, determine the data bit plaintext corresponding to each bit of the data in the column involved in the bit-encoded screening in the fully homomorphic database; and then the fully homomorphic comparison operator can be called to compare the predicate parameter bit ciphertext and the data bit plaintext to obtain the first screening predicate result ciphertext.

[0180] It is understandable that, in the embodiments of the present application, for each screening predicate, comparison operators such as an equal operator, a not equal operator, a less than operator, a greater than operator, a less than or equal operator, and a greater than or equal operator may be included. Accordingly, when the service party executes a range data query on a fully homomorphic database, it may choose to call a fully homomorphic comparison operator corresponding to the comparison operator to filter the data on the columns involved in the screening, thereby obtaining the first screening predicate result ciphertext. Among them, the fully homomorphic comparison operator may include one of the following fully homomorphic operators: a fully homomorphic equal operator, a fully homomorphic not equal operator, a fully homomorphic less than operator, a fully homomorphic greater than operator, a fully homomorphic less than or equal operator, and a fully homomorphic greater than or equal operator.

[0181] It can be understood that, in the embodiments of the present application, different comparison operators can be implemented by different comparison functions.

[0182] Exemplarily, in some embodiments, for two positive integers a and b, for the equality operator, a comparison function may be defined as:

[0183] (1)

[0184] Exemplarily, in some embodiments, for two positive integers a and b, for the less than operator, a comparison function may be defined as:

[0185] (2)

[0186] Exemplarily, in some embodiments, for two positive integers a and b, for the greater than operator, a comparison function may be defined as:

[0187] (3)

[0188] Exemplarily, in some embodiments, for two positive integers a and b, for the less than or equal to operator, a comparison function may be defined as:

[0189] (4)

[0190] Exemplarily, in some embodiments, for two positive integers a and b, for the greater than or equal to operator, a comparison function may be defined as:

[0191] (5)

[0192] Consider using a fully homomorphic algorithm that supports addition, subtraction, and multiplication. In order to implement the above comparison function, the comparison calculation needs to be implemented using addition, subtraction, and multiplication. Assume that the binary representation of a and b does not exceed k bits. The binary bits of a are recorded as , ; The binary bits of b are recorded as , The comparison function of a and b can be calculated using a single-bit comparison function and addition, subtraction and multiplication.

[0193] Exemplarily, in some embodiments, for the equality operator, a single-bit comparison function may be defined as:

[0194] (6)

[0195] Exemplarily, in some embodiments, for the equality operator, a single-bit comparison function may be defined as:

[0196] (7)

[0197] Exemplarily, in some embodiments, for the greater than operator, a single-bit comparison function may be defined as:

[0198] (8)

[0199] For the equality operator, the single-bit comparison function can use the following formula:

[0200] (9)

[0201] For the less than operator, the single-bit comparison function can use the following formula:

[0202] (10)

[0203] For the greater than operator, the single-bit comparison function can use the following formula:

[0204] (11)

[0205] After the above multi-bit comparison function is introduced, each bit of a and b is input, and each multi-bit comparison function can be implemented by addition, subtraction and multiplication calculation.

[0206] For example, in some embodiments, for one or a group of integer data ,use Represents its corresponding fully homomorphic ciphertext.

[0207] Accordingly, in some embodiments, assuming that the predicate parameter ciphertext is , then for the i-th bit of the predicate parameter ciphertext, the corresponding predicate parameter bit ciphertext is .

[0208] Accordingly, in some embodiments, for a fully homomorphic plaintext database, the data in the column involved in the bit-encoded screening in the fully homomorphic database is b, and the data bit plaintext corresponding to each bit of the data is .

[0209] Accordingly, in some embodiments, for a fully homomorphic ciphertext database, the data in the columns involved in the bit-encoded screening in the fully homomorphic database is , the data bit ciphertext corresponding to each bit of the data is .

[0210] That is to say, in the embodiment of the present application, for a fully homomorphic ciphertext database, all data in the fully homomorphic database is in ciphertext form. ; For a fully homomorphic plaintext database, all data in the fully homomorphic database is in plaintext form b.

[0211] Further, in an embodiment of the present application, when calling a fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit plaintext to obtain a first screening predicate result ciphertext, corresponding to the comparison operator included in the screening predicate, for each bit, the predicate parameter bit ciphertext and the data bit plaintext are used as input, and the fully homomorphic bit comparison operator corresponding to the comparison operator is called to obtain a first equal result ciphertext; the fully homomorphic comparison operator is called to combine the first equal result ciphertexts corresponding to all bits to obtain a first screening predicate result ciphertext.

[0212] Exemplarily, in some embodiments, corresponding to the equality operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit equality operator is called to obtain a first equality result ciphertext; the fully homomorphic equality operator is called to combine the first equality result ciphertexts corresponding to all bits to obtain a first filtering predicate result ciphertext.

[0213] That is to say, in the embodiment of the present application, corresponding to the equality operator included in the filtering predicate, the service party can call the corresponding fully homomorphic equality operator to execute the filtering process for the filtering predicate.

[0214] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit plaintext is , then the process of calling the fully homomorphic bit equal operator to obtain the first equal result ciphertext is as follows:

[0215] (12)

[0216] Exemplarily, in some embodiments, the process in which the service party calls the fully homomorphic equality operator to combine the first equality result ciphertexts corresponding to all bits is as follows:

[0217] (13)

[0218] Exemplarily, in some embodiments, corresponding to the less than operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit less than operator is called to obtain a first less than result ciphertext; the fully homomorphic less than operator is called to combine the first equal to result ciphertext and the first less than result ciphertext corresponding to all bits to obtain a first filtering predicate result ciphertext.

[0219] That is to say, in the embodiment of the present application, corresponding to the less-than operator included in the filtering predicate, the service party can call the corresponding fully homomorphic less-than operator to execute the filtering process for the filtering predicate.

[0220] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit plaintext is , then the process of calling the fully homomorphic bit less than operator to obtain the first less than result ciphertext is as follows:

[0221] (14)

[0222] Exemplarily, in some embodiments, the process in which the service party calls the fully homomorphic less-than operator to combine the first less-than result ciphertexts corresponding to all bits is as follows:

[0223] (15)

[0224] Exemplarily, in some embodiments, corresponding to the greater than operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit greater than operator is called to obtain a first greater than result ciphertext; the fully homomorphic greater than operator is called to combine the first equal to result ciphertext and the first greater than result ciphertext corresponding to all bits to obtain a first filtering predicate result ciphertext.

[0225] That is to say, in the embodiment of the present application, corresponding to the greater-than operator included in the filtering predicate, the service party can call the corresponding fully homomorphic greater-than operator to execute the filtering process for the filtering predicate.

[0226] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit plaintext is , then the process of calling the fully homomorphic bit greater than operator to obtain the first greater than result ciphertext is as follows:

[0227] (16)

[0228] Exemplarily, in some embodiments, the process in which the service party calls the fully homomorphic greater-than operator to combine the first greater-than result ciphertexts corresponding to all bits is as follows:

[0229] (17)

[0230] Exemplarily, in some embodiments, corresponding to the inequality operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit equality operator is called to obtain a first equality result ciphertext; the fully homomorphic equality operator is called to combine the first equality result ciphertexts corresponding to all bits to obtain a second equality result ciphertext; the fully homomorphic negation operator is called to perform a negation operation based on the second equality result ciphertext to obtain a first filtering predicate result ciphertext.

[0231] That is to say, in the embodiment of the present application, corresponding to the not equal operator included in the screening predicate, the service party can obtain it by calculating the negation of the equal operator.

[0232] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit plaintext is , then the process of calling the fully homomorphic bit-equal operator to obtain the first equal result ciphertext is as shown in formula (12).

[0233] Exemplarily, in some embodiments, the service party calls the fully homomorphic equality operator to combine the first equality result ciphertexts corresponding to all bits to obtain the second equality result ciphertext as shown in formula (13).

[0234] Finally, the process of performing a negation operation based on the second equal result ciphertext is as follows:

[0235] (18)

[0236] Exemplarily, in some embodiments, corresponding to the greater than or equal to operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit less than operator is called to obtain a first less than result ciphertext; the fully homomorphic less than operator is called to combine the first equal to result ciphertext and the first less than result ciphertext corresponding to all bits to obtain a second less than result ciphertext; the fully homomorphic negation operator is called to perform a negation operation based on the second less than result ciphertext to obtain a first filtering predicate result ciphertext.

[0237] That is to say, in the embodiment of the present application, corresponding to the greater than or equal to operator included in the screening predicate, the service provider can obtain it by performing calculation through the negation of the less than operator.

[0238] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit plaintext is , then the process of calling the fully homomorphic bit less than operator to obtain the first less than result ciphertext is as shown in formula (14).

[0239] Exemplarily, in some embodiments, the service party calls the fully homomorphic less-than operator to combine the first less-than result ciphertext corresponding to all bits to obtain the second less-than result ciphertext as shown in formula (15).

[0240] Finally, the process of performing a negation operation based on the second less than result ciphertext is as follows:

[0241] (19)

[0242] Exemplarily, in some embodiments, corresponding to the less than or equal to operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit plaintext are taken as input, and the fully homomorphic bit greater than operator is called to obtain a first greater than result ciphertext; the fully homomorphic greater than operator is called to combine the first equal to result ciphertext and the first greater than result ciphertext corresponding to all bits to obtain a second greater than result ciphertext; the fully homomorphic negation operator is called to perform a negation operation based on the second greater than result ciphertext to obtain a first filtering predicate result ciphertext.

[0243] That is to say, in the embodiment of the present application, corresponding to the less than or equal to operator included in the screening predicate, the service party can obtain it by calculating the negation of the greater than operator.

[0244] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit plaintext is , then the process of calling the fully homomorphic bit greater than operator to obtain the first greater than result ciphertext is as shown in formula (16).

[0245] Exemplarily, in some embodiments, the service party calls the fully homomorphic less-than operator to combine the first greater-than result ciphertext corresponding to all bits to obtain the second greater-than result ciphertext as shown in formula (17).

[0246] Finally, the process of performing a negation operation based on the second greater than result ciphertext is as follows:

[0247] (20)

[0248] Furthermore, in an embodiment of the present application, for the scenario of a fully homomorphic ciphertext database, the service provider may first receive the fully homomorphic ciphertext database sent by the requesting party.

[0249] Furthermore, in an embodiment of the present application, for the scenario of a fully homomorphic ciphertext database, that is, all data in the fully homomorphic database is in ciphertext form, when the service party calls the fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit plaintext to obtain the first screening predicate result ciphertext, it can first determine the predicate parameter bit ciphertext corresponding to each bit of the bit-encoded predicate parameter ciphertext; at the same time, determine the data bit ciphertext corresponding to each bit of the data in the column involved in the bit-encoded screening in the fully homomorphic database; and then call the fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit ciphertext to obtain the first screening predicate result ciphertext.

[0250] Furthermore, in the embodiment of the present application, for a fully homomorphic ciphertext database, all data in the fully homomorphic database is in ciphertext form. .

[0251] Further, in an embodiment of the present application, when calling a fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit ciphertext to obtain a first screening predicate result ciphertext, corresponding to the comparison operator included in the screening predicate, for each bit, the predicate parameter bit ciphertext and the data bit ciphertext are used as input, and the fully homomorphic bit comparison operator corresponding to the comparison operator is called to obtain a first equal result ciphertext; the fully homomorphic comparison operator is called to combine the first equal result ciphertexts corresponding to all bits to obtain a first screening predicate result ciphertext.

[0252] Exemplarily, in some embodiments, corresponding to the equality operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit equality operator is called to obtain a first equality result ciphertext; the fully homomorphic equality operator is called to combine the first equality result ciphertexts corresponding to all bits to obtain a first filtering predicate result ciphertext.

[0253] That is to say, in the embodiment of the present application, corresponding to the equality operator included in the filtering predicate, the service party can call the corresponding fully homomorphic equality operator to execute the filtering process for the filtering predicate.

[0254] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit ciphertext is , then the process of calling the fully homomorphic bit equal operator to obtain the first equal result ciphertext is as follows:

[0255] (twenty one)

[0256] Exemplarily, in some embodiments, the process in which the service party calls the fully homomorphic equality operator to combine the first equality result ciphertexts corresponding to all bits is as shown in formula (13).

[0257] Exemplarily, in some embodiments, corresponding to the less than operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit less than operator is called to obtain a first less than result ciphertext; the fully homomorphic less than operator is called to combine the first equal to result ciphertext and the first less than result ciphertext corresponding to all bits to obtain a first filtering predicate result ciphertext.

[0258] That is to say, in the embodiment of the present application, corresponding to the less-than operator included in the filtering predicate, the service party can call the corresponding fully homomorphic less-than operator to execute the filtering process for the filtering predicate.

[0259] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit ciphertext is , then the process of calling the fully homomorphic bit less than operator to obtain the first equal result ciphertext is as follows:

[0260] (twenty two)

[0261] Exemplarily, in some embodiments, the process in which the service party calls the fully homomorphic less-than operator to combine the first less-than result ciphertexts corresponding to all bits is as shown in formula (15).

[0262] Exemplarily, in some embodiments, corresponding to the greater than operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the data bit ciphertext and the predicate parameter bit ciphertext are taken as input, and the fully homomorphic bit less than operator is called to obtain a first less than result ciphertext; the fully homomorphic less than operator is called to combine the first equal to result ciphertext and the first less than result ciphertext corresponding to all bits to obtain a first filtering predicate result ciphertext.

[0263] That is to say, in the embodiment of the present application, corresponding to the greater-than operator included in the filtering predicate, the service party can call the corresponding fully homomorphic greater-than operator to execute the filtering process for the filtering predicate.

[0264] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit ciphertext is , then the process of calling the fully homomorphic bit greater than operator to obtain the first greater than result ciphertext is as follows:

[0265] (twenty three)

[0266] Exemplarily, in some embodiments, the process in which the service party calls the fully homomorphic greater-than operator to combine the first greater-than result ciphertexts corresponding to all bits is as shown in formula (17).

[0267] Exemplarily, in some embodiments, corresponding to the inequality operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit equality operator is called to obtain a first equality result ciphertext; the fully homomorphic equality operator is called to combine the first equality result ciphertexts corresponding to all bits to obtain a second equality result ciphertext; the fully homomorphic negation operator is called to perform a negation operation based on the second equality result ciphertext to obtain a first filtering predicate result ciphertext.

[0268] That is to say, in the embodiment of the present application, corresponding to the not equal operator included in the screening predicate, the service party can obtain it by calculating the negation of the equal operator.

[0269] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit ciphertext is , then the process of calling the fully homomorphic bit equal operator to obtain the first equal result ciphertext is as shown in formula (21).

[0270] Exemplarily, in some embodiments, the service party calls the fully homomorphic equality operator to combine the first equality result ciphertexts corresponding to all bits to obtain the second equality result ciphertext as shown in formula (13).

[0271] Finally, the process of performing a negation operation based on the second equal result ciphertext is as shown in formula (18).

[0272] Exemplarily, in some embodiments, corresponding to the greater than or equal to operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit less than operator is called to obtain a first less than result ciphertext; the fully homomorphic less than operator is called to combine the first equal to result ciphertext and the first less than result ciphertext corresponding to all bits to obtain a second less than result ciphertext; the fully homomorphic negation operator is called to perform a negation operation based on the second less than result ciphertext to obtain a first filtering predicate result ciphertext.

[0273] That is to say, in the embodiment of the present application, corresponding to the greater than or equal to operator included in the screening predicate, the service provider can obtain it by performing calculation through the negation of the less than operator.

[0274] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit ciphertext is , then the process of calling the fully homomorphic bit less than operator to obtain the first equal result ciphertext is as shown in formula (22).

[0275] Exemplarily, in some embodiments, the service party calls the fully homomorphic less-than operator to combine the first less-than result ciphertext corresponding to all bits to obtain the second less-than result ciphertext as shown in formula (15).

[0276] Finally, the process of performing a negation operation based on the second less than result ciphertext is as shown in formula (19).

[0277] Exemplarily, in some embodiments, corresponding to the less than or equal to operator included in the filtering predicate, for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit equal to operator is called to obtain a first equal to result ciphertext; for each bit position, the predicate parameter bit ciphertext and the data bit ciphertext are taken as input, and the fully homomorphic bit greater than operator is called to obtain a first greater than result ciphertext; the fully homomorphic greater than operator is called to combine the first equal to result ciphertext and the first greater than result ciphertext corresponding to all bits to obtain a second greater than result ciphertext; the fully homomorphic negation operator is called to perform a negation operation based on the second greater than result ciphertext to obtain a first filtering predicate result ciphertext.

[0278] That is to say, in the embodiment of the present application, corresponding to the less than or equal to operator included in the screening predicate, the service party can obtain it by calculating the negation of the greater than operator.

[0279] Exemplarily, in some embodiments, it is assumed that the predicate parameter bit ciphertext is , the data bit ciphertext is , then the process of calling the fully homomorphic bit greater than operator to obtain the first greater than result ciphertext is as shown in formula (23).

[0280] Exemplarily, in some embodiments, the service party calls the fully homomorphic less-than operator to combine the first greater-than result ciphertext corresponding to all bits to obtain the second greater-than result ciphertext as shown in formula (17).

[0281] Finally, the process of performing a negation operation based on the second greater than result ciphertext is as shown in formula (20).

[0282] Further, in an embodiment of the present application, for a screening request, the service party calls the fully homomorphic logic operator corresponding to the connector, calculates the logical calculation results of all first screening predicate result ciphertexts, and when obtaining the first screening request result ciphertext, for the fully homomorphic and operator corresponding to the connector, calls the fully homomorphic multiplication operator, combines all the first screening predicate result ciphertexts, and obtains the first logical calculation result ciphertext; for the fully homomorphic or operator corresponding to the connector, calls the fully homomorphic subtraction operator and the fully homomorphic multiplication operator, combines all the first screening predicate result ciphertexts, and obtains the second logical calculation result ciphertext; for the fully homomorphic non-operator corresponding to the connector, calls the fully homomorphic subtraction operator, combines all the first screening predicate result ciphertexts, and obtains the third logical calculation result ciphertext; finally, the first screening request result ciphertext can be determined based on one or more of the first logical calculation result ciphertext, the second logical calculation result ciphertext, and the third logical calculation result ciphertext.

[0283] Furthermore, in an embodiment of the present application, each range query corresponds to at least one filtering request and at least one statistical request; for each statistical request, if the statistical type involves summation, a fully homomorphic addition operator and a fully homomorphic rotation operator are called to perform rotation and summation operations on the first filtered data ciphertext to obtain a query result ciphertext.

[0284] For example, in some embodiments, it is assumed that the table in the database that needs to be ciphertext queried has c columns and r rows, and the contents are all positive integers. Line The contents of the column are , remember The data width of the column is . This application embodiment supports calculations that satisfy In each row of data for each filter condition The accumulation of the products of column data, where and Both can be set to 0. Correspondingly, no filtering is done and statistics are made on the entire data column. The corresponding count is the number of rows that meet the filter conditions. The query format is as follows:

[0285] (twenty four)

[0286] in, It is The filter function of the filter condition can be one of EQ, LT, GT, LE, GE, It is The parameter value to be compared in each filter condition. It is The position of the filter column, It is The location of the statistics column.

[0287] It can be seen that in the embodiment of the present application, for the first If this column needs to be used as data in the filter condition, the data in it is encoded in bits, and each value occupies If this column needs to be used as statistical data, that is, for product calculation of values, the data in it is encoded as integers, and each value occupies 1 plaintext slot. Note that if a column of data can be used for both filtering conditions and statistical calculations, the data can be encoded in two ways and stored in the encoded database respectively. ,To protect the confidentiality of its data, the requester encodes it with bits and encrypts it.

[0288] It is understandable that in the embodiments of the present application, such as the fully homomorphic encryption algorithm of the BFV algorithm or the BGV algorithm, the message data corresponding to the plaintext or ciphertext can accommodate N integers. In the embodiments of the present application, each value of a set of message data in the database corresponds to a different row in the table. , the bit encoding of a column with a data width of k bits uses message data, a column of integer encoding using Message data. Parameters for filtering conditions Each bit of uses 1 message data, all N values ​​in it are the values ​​of the current bit, and a parameter t uses a total of k message data.

[0289] Exemplarily, in some embodiments, after encoding in the above manner, the following formula may be referred to for calculation on the ciphertext:

[0290] (25)

[0291] The calculation of each plaintext / ciphertext in N slots is independent. The calculation result is m ciphertexts, corresponding to r products. Finally, the r products need to be accumulated. This step can be achieved using the standard ciphertext rotation accumulation method:

[0292] (26)

[0293] It is understandable that in the embodiment of the present application, if the database content is encrypted, the above query calculation can use a multiplication depth of no more than If the database content is plain text, the above query calculation can use a multiplication depth of no more than The ciphertext calculation process is implemented.

[0294] Step 203: Send the encrypted query result to the requesting party.

[0295] In an embodiment of the present application, after performing a query based on a fully homomorphic database, a fully homomorphic public key, a range query type, and a range query parameter ciphertext and obtaining the query result ciphertext, the service party may send the query result ciphertext to the requesting party.

[0296] It is understandable that in the embodiment of the present application, what the service sends to the requester is not the final query result, but the query result ciphertext in response to the query request. Therefore, for the requester, after receiving the query result ciphertext, it is also necessary to decrypt the query result ciphertext.

[0297] In summary, the range data query method proposed in the embodiment of the present application, the ciphertext database supports range query, multi-column range query with combined conditions and statistical calculation. The present application makes good use of the computing advantages of full homomorphism in range query and statistical calculation by combining encodings with different computing advantages and a unified encryption scheme. Among them, the query performance of the database based on full homomorphism is mainly based on two aspects: one is the range query of ciphertext, and the other is statistical calculation.

[0298] The embodiment of the present application provides a data query method for a fully homomorphic database, which can perform range data query for a determined range query type and an encrypted range query parameter ciphertext on the basis of a fully homomorphic database, wherein the fully homomorphic database is encoded using different encoding methods, and the range data query may include a screening process and a statistical process for different range query types. In other words, the embodiment of the present application implements range data query of ciphertext by utilizing encodings with different computing advantages, as well as a unified plaintext space and encryption algorithm, thereby effectively improving the efficiency of range data query while ensuring the security of range query.

[0299] Based on the above embodiments, another embodiment of the present application proposes a data query method for a fully homomorphic database. The data query method for a fully homomorphic database can be applied to a data query system. The data query system may include a requester and a service provider, which is not specifically limited in the present application.

[0300] Below, taking a data query system including a requester and a service party as an example, a data query method for a fully homomorphic database proposed in an embodiment of the present application is exemplified.

[0301] Furthermore, in the embodiments of the present application, Figure 3 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 3 ,like Figure 3 As shown, a data query method for a fully homomorphic database may include the following steps:

[0302] Step 301: The requesting party obtains a fully homomorphic public-private key pair; wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key.

[0303] In an embodiment of the present application, the requesting party may obtain a fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair may include a fully homomorphic public key and a fully homomorphic private key.

[0304] In an embodiment of the present application, for the scenario where the fully homomorphic database is a fully homomorphic ciphertext database, the requester obtains a fully homomorphic public-private key pair from a local key storage device; for the scenario where the fully homomorphic database is a fully homomorphic plaintext database, the requester calls a fully homomorphic key generation operator to generate a fully homomorphic public-private key pair.

[0305] Step 302: The requester determines a range query type and range query parameters.

[0306] In an embodiment of the present application, the requester may determine a range query type and range query parameters.

[0307] In an embodiment of the present application, when determining the range query type, the requester may first determine a screening function and a statistical function, and then may further determine the range query type based on the screening function and the statistical function.

[0308] In an embodiment of the present application, the screening function may include one or more screening predicates. The screening predicate includes the columns involved in the screening, the comparison operator and the predicate parameter. The predicate parameter is the input data of the requester.

[0309] In an embodiment of the present application, the comparison operator may include one of the following operators: an equal operator, a not equal operator, a less than operator, a greater than operator, a less than or equal to operator, and a greater than or equal to operator.

[0310] In the embodiment of the present application, in the case of multiple filter predicates, the multiple filter predicates may be connected by one or more connectors; wherein the connector may include the following logical operators: AND, OR, NOT.

[0311] In an embodiment of the present application, the statistical function may include columns involved in the statistics and statistical types, wherein the statistical type includes one or more of the following arithmetic operators: addition, subtraction, and multiplication.

[0312] In an embodiment of the present application, each range query corresponds to at least one screening function and at least one statistical function.

[0313] In an embodiment of the present application, the range query parameter may include a predicate parameter in a filter predicate included in a filter function in a range query type.

[0314] Step 303: The requesting party encodes and encrypts the range query parameter to obtain a ciphertext of the range query parameter.

[0315] In an embodiment of the present application, when encoding and encrypting the range query parameter to obtain the range query parameter ciphertext, the range query parameter can be bit-encoded to obtain the bit-encoded range query parameter. Then, the fully homomorphic encryption operator is further called to encrypt the bit-encoded range query parameter to generate the range query parameter ciphertext.

[0316] Step 304: The requester sends the fully homomorphic public key to the service provider.

[0317] After obtaining the fully homomorphic public-private key pair, the requester may send the fully homomorphic public key included in the fully homomorphic public-private key pair to the service provider.

[0318] Step 305: The requester sends a range query request to the service provider; wherein the range query request carries a range query type and a range query parameter ciphertext.

[0319] In an embodiment of the present application, the range query request sent by the requester to the service provider may carry a range query type and a range query parameter ciphertext.

[0320] Step 306: The service provider performs a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext.

[0321] In an embodiment of the present application, when performing a query based on a fully homomorphic database, a fully homomorphic public key, a range query type, and a range query parameter ciphertext to obtain a query result ciphertext, the service provider can first determine a filtering request and a statistical request based on the range query type and the range query parameter ciphertext.

[0322] The filtering request determined by the service provider based on the range query type and the range query parameter ciphertext may correspond to the filtering function determined by the requester when generating the range query type. The statistical request determined by the service provider based on the range query type and the range query parameter ciphertext may correspond to the statistical function determined by the requester when generating the range query type.

[0323] Among them, the filtering request includes one or more filtering predicates, the filtering predicate includes the columns involved in the filtering, the comparison operator and the predicate parameter ciphertext; the comparison operator includes one of the following operators: equal operator, not equal operator, less than operator, greater than operator, less than or equal to operator, greater than or equal to operator; multiple filtering predicates are connected by one or more connectors; the connectors include the following logical operators: and, or, not; the predicate parameter ciphertext is obtained by encrypting the predicate parameter, and the predicate parameter is the input data of the requester; the statistical request includes the columns involved in the statistics and the statistical type; the statistical type includes one or more of the following arithmetic operators: addition, subtraction, and multiplication.

[0324] In an embodiment of the present application, the service provider can further call the fully homomorphic comparison operator corresponding to the comparison operator in the filter predicate for each filter predicate based on the fully homomorphic public key and the fully homomorphic database, filter the data on the columns involved in the filter, and obtain the first filter predicate result ciphertext; wherein the first filter predicate result ciphertext contains the result of whether all data on the columns involved in the filter pass the filter; the fully homomorphic comparison operator includes one of the following fully homomorphic operators: a fully homomorphic equality operator, a fully homomorphic inequality operator, a fully homomorphic less than operator, a fully homomorphic greater than operator, a fully homomorphic less than or equal to operator, and a fully homomorphic greater than or equal to operator.

[0325] In an embodiment of the present application, the service provider may convert the representation form of the first screening predicate result ciphertext in a specific manner; wherein the converted first screening predicate result ciphertext includes the first value or the second value.

[0326] In an embodiment of the present application, for a filtering request, the service provider may call the fully homomorphic logic operator corresponding to the connector, calculate the logical calculation results of all first filtering predicate result ciphertexts, and obtain the first filtering request result ciphertext; wherein the first filtering request result ciphertext includes the result ciphertext of whether all data on the columns involved in the filtering satisfy the filtering request; the fully homomorphic logic operators include: a fully homomorphic and operator, a fully homomorphic or operator, and a fully homomorphic not operator.

[0327] In an embodiment of the present application, for a statistical request, the service provider may call a fully homomorphic multiplication operator to obtain a first screening data ciphertext based on the first screening request result ciphertext and all data on the columns involved in the statistics.

[0328] In an embodiment of the present application, the service provider may call a fully homomorphic arithmetic operator according to the statistical type, calculate the first screening data ciphertext, and determine the query result ciphertext; wherein the fully homomorphic arithmetic operator includes a fully homomorphic addition operator, a fully homomorphic subtraction operator, and a fully homomorphic multiplication operator.

[0329] Step 307: The service provider sends the encrypted query result to the requester.

[0330] After performing a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext and obtaining the query result ciphertext, the service provider may send the query result ciphertext to the requester.

[0331] Step 308: The requesting party uses the fully homomorphic private key to decrypt the query result ciphertext to obtain the query result corresponding to the query request.

[0332] In an embodiment of the present application, after receiving the query result ciphertext sent by the service provider, the requester also needs to decrypt the query result ciphertext, wherein the requester can use the fully homomorphic private key in the fully homomorphic public-private key pair that has been obtained to decrypt the query result ciphertext, and finally obtain the query result corresponding to the query request.

[0333] Furthermore, in the embodiments of the present application, Figure 4 Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 4 ,like Figure 4 As shown, a data query method for a fully homomorphic database may include the following steps:

[0334] Step 309: The requesting party generates a fully homomorphic public-private key pair; wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key.

[0335] In an embodiment of the present application, assuming that the fully homomorphic database is a fully homomorphic plaintext database, when obtaining a fully homomorphic public-private key pair, the requesting party can call a fully homomorphic key generation operator to generate a fully homomorphic public-private key pair.

[0336] That is to say, in an embodiment of the present application, for a scenario where the fully homomorphic database is a fully homomorphic plaintext database, the requester can generate a fully homomorphic public-private key pair by calling a fully homomorphic key generation operator.

[0337] Step 302: The requester determines a range query type and range query parameters.

[0338] Step 303: The requesting party encodes and encrypts the range query parameter to obtain a ciphertext of the range query parameter.

[0339] Step 304: The requester sends the fully homomorphic public key to the service provider.

[0340] Step 305: The requester sends a range query request to the service provider; wherein the range query request carries a range query type and a range query parameter ciphertext.

[0341] Step 310: The service provider builds a fully homomorphic plaintext database.

[0342] In an embodiment of the present application, if the fully homomorphic database used for range data query is a fully homomorphic plaintext database, the fully homomorphic plaintext database may be constructed by a service provider.

[0343] In an embodiment of the present application, when the service provider constructs a fully homomorphic ciphertext database, that is, for a scenario in which the fully homomorphic database is a fully homomorphic plaintext database, for each data column of all data tables in the original data storage device, the service provider determines the encoding method of each data column; then each data column can be encoded according to the encoding method of each data column to obtain the corresponding encoded data column, that is, to obtain a fully homomorphic plaintext database.

[0344] In an embodiment of the present application, the encoding method may include integer encoding and / or bit encoding. Each data column may correspond to one or more encoding methods. Integer encoding includes encoding based on a fully homomorphic encoding operator; bit encoding includes integer encoding of input data bit by bit.

[0345] In an embodiment of the present application, the bit-encoded data columns and the integer-encoded data columns in the fully homomorphic plaintext database are encoded using different encoding methods.

[0346] Step 311: The service provider performs a query based on the fully homomorphic plaintext database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext.

[0347] In an embodiment of the present application, for a fully homomorphic plaintext database, all data in the fully homomorphic database is in plaintext form.

[0348] In an embodiment of the present application, for the scenario of a fully homomorphic plaintext database, the service provider, based on a fully homomorphic public key and a fully homomorphic database, calls the fully homomorphic comparison operator corresponding to the comparison operator in the filter predicate for each filter predicate, filters the data on the columns involved in the filter, and obtains the first filter predicate result ciphertext. The service provider can first determine the predicate parameter bit ciphertext corresponding to each bit of the bit-encoded predicate parameter ciphertext; at the same time, determine the data bit plaintext corresponding to each bit of the data in the bit-encoded columns involved in the filter in the fully homomorphic database; and then call the fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit plaintext to obtain the first filter predicate result ciphertext.

[0349] Step 307: The service provider sends the encrypted query result to the requester.

[0350] Step 308: The requesting party uses the fully homomorphic private key to decrypt the query result ciphertext to obtain the query result corresponding to the query request.

[0351] Furthermore, in the embodiments of the present application, Figure 5Schematic diagram of the implementation process of a data query method for a fully homomorphic database proposed in an embodiment of the present application Figure 5 ,like Figure 5 As shown, a data query method for a fully homomorphic database may include the following steps:

[0352] Step 3012: The requesting party generates a fully homomorphic public-private key pair; wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key.

[0353] In the embodiment of the present application, for the scenario where the fully homomorphic database is a fully homomorphic ciphertext database, the requester can generate a fully homomorphic public-private key pair in advance by calling a fully homomorphic key generation operator.

[0354] Step 3013: The requesting party stores the fully homomorphic public-private key pair.

[0355] In an embodiment of the present application, the requester may store a fully homomorphic public-private key pair in a local key storage device.

[0356] Step 3014: The requesting party builds a fully homomorphic ciphertext database based on the fully homomorphic public key.

[0357] Step 3015: The requesting party sends a fully homomorphic ciphertext database to the service party.

[0358] In an embodiment of the present application, if the fully homomorphic database used for range data query is a fully homomorphic ciphertext database, the fully homomorphic ciphertext database may be constructed by the requesting party and sent to the service party.

[0359] In an embodiment of the present application, for a scenario where the fully homomorphic database is a fully homomorphic ciphertext database, the requesting party can generate a fully homomorphic ciphertext database. Wherein, for each data column of all data tables in the original data storage device, determine the encoding method of each data column; wherein the encoding method includes integer encoding and / or bit encoding; each data column corresponds to one or more encoding methods; then each data column can be encoded according to the encoding method of each data column to obtain the corresponding encoded data column; wherein the bit-encoded data column and the integer-encoded data column are encoded using different encoding methods; then, based on the fully homomorphic public key, call the fully homomorphic encryption operator to encrypt the bit-encoded data column and the integer-encoded data column to obtain a fully homomorphic ciphertext database. Wherein, for the fully homomorphic ciphertext database, a bit-encoded ciphertext database and an integer-encoded ciphertext database are included accordingly.

[0360] Step 3016: The requesting party obtains a pre-stored fully homomorphic public-private key pair.

[0361] In an embodiment of the present application, after the pre-generated fully homomorphic public-private key pair is stored in a local key storage device, it can be directly read from the local key storage device when the fully homomorphic public-private key pair is needed later. For example, in the scenario where the fully homomorphic database is a fully homomorphic ciphertext database, when obtaining the fully homomorphic public-private key pair, the requesting party can obtain the fully homomorphic public-private key pair from the local key storage device.

[0362] Step 302: The requester determines a range query type and range query parameters.

[0363] Step 303: The requesting party encodes and encrypts the range query parameter to obtain a ciphertext of the range query parameter.

[0364] Step 304: The requester sends the fully homomorphic public key to the service provider.

[0365] Step 305: The requester sends a range query request to the service provider; wherein the range query request carries a range query type and a range query parameter ciphertext.

[0366] Step 317: The service provider performs a query based on the fully homomorphic ciphertext database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain the query result ciphertext.

[0367] In an embodiment of the present application, for a fully homomorphic ciphertext database, all data in the fully homomorphic database is in ciphertext form.

[0368] In an embodiment of the present application, for the scenario of a fully homomorphic ciphertext database, the service provider can first determine the predicate parameter bit ciphertext corresponding to each bit of the bit-encoded predicate parameter ciphertext; at the same time, determine the data bit ciphertext corresponding to each bit of the data in the column involved in the bit-encoded filtering in the fully homomorphic database; and then call the fully homomorphic comparison operator to compare the predicate parameter bit ciphertext and the data bit ciphertext to obtain the first filtering predicate result ciphertext.

[0369] Step 307: The service provider sends the encrypted query result to the requester.

[0370] Step 308: The requesting party uses the fully homomorphic private key to decrypt the query result ciphertext to obtain the query result corresponding to the query request.

[0371] To summarize, the range data query method proposed in the embodiment of the present application uses a fully homomorphic cryptographic algorithm that supports integer addition, subtraction, and multiplication to implement a ciphertext database solution that supports multi-column range queries and statistical calculations, and can use a smaller multiplication depth to efficiently implement ciphertext calculations for queries.

[0372] The range data query method proposed in the embodiment of the present application, the ciphertext database supports range query, multi-column range query with combined conditions and statistical calculation. The present application makes good use of the computing advantages of full homomorphism in range query and statistical calculation by combining encodings with different computing advantages and a unified encryption scheme.

[0373] In summary, the data query method of the fully homomorphic database proposed in the embodiment of the present application adopts the plaintext space as The FHE algorithm is used, but the data is bit-encoded and FHE itself is plaintext-encoded at the same time. The ciphertext corresponding to the bit encoding is used when calculating the equality and comparison of the ciphertext data, and the ciphertext corresponding to the plaintext encoding of the FHE algorithm is used when statistics are taken. The embodiment of the present application greatly optimizes the performance of range query by utilizing encodings with different computational advantages, as well as a unified plaintext space and encryption algorithm.

[0374] The embodiment of the present application provides a data query method for a fully homomorphic database, which can perform range data query for a determined range query type and an encrypted range query parameter ciphertext on the basis of a fully homomorphic database, wherein the fully homomorphic database is encoded using different encoding methods, and the range data query may include a screening process and a statistical process for different range query types. In other words, the embodiment of the present application implements range data query of ciphertext by utilizing encodings with different computing advantages, as well as a unified plaintext space and encryption algorithm, thereby effectively improving the efficiency of range data query while ensuring the security of range query.

[0375] Based on the above embodiments, the embodiments of the present application propose a data query method for a fully homomorphic database, which supports range queries, multi-column range queries with combined conditions, and statistical calculations.

[0376] The current FHE solution is to use a single FHE algorithm: the plaintext space is FHE is not friendly to statistical computing; the plaintext space is The FHE algorithm is not friendly to range queries and currently only supports EQ. Both solutions lead to poor overall query performance. Alternatively, both technologies that are friendly to range queries and FHE algorithms that are friendly to statistical calculations are used at the same time, which involves complex mutual conversion technology between the two data encryption formats, resulting in poor overall performance.

[0377] To solve this problem, by combining encodings with different computing advantages and a unified encryption scheme, the computing advantages of fully homomorphic are well utilized in range queries and statistical calculations.

[0378] The range data query method can be applied to different range data query modes, including but not limited to a two-party joint computing mode and a data outsourcing computing mode.

[0379] In an embodiment of the present application, for a two-party joint computing mode, the fully homomorphic database used for range data query may be a fully homomorphic plaintext database.

[0380] In an embodiment of the present application, in a two-party joint computing mode, the participants are a database service provider (e.g., a service provider) and a database query provider (e.g., a requester). The service provider owns the database content information and needs to protect the database information other than the query results from being leaked to the query provider and other potential attackers while providing query services. The query provider needs to protect the query request information and query results from being leaked to the service provider and other potential attackers while completing the query request. If the database query process is performed in plain text, the relevant information will be leaked to the participant who performs the calculation. Only by using privacy computing-related technologies to solve the information protection of the data calculation process can the security needs of both parties be met and the open sharing of this type of data be promoted.

[0381] Furthermore, in an embodiment of the present application, a range data query method in a two-party joint computing mode may include two parts: construction of a fully homomorphic plaintext database and data query of the fully homomorphic database.

[0382] For example, in some embodiments, Figure 6 A schematic diagram of a method for constructing a fully homomorphic plaintext database proposed in an embodiment of the present application is shown in FIG. Figure 6 As shown, after the service provider 60 obtains the original database 601 from the original data storage device, for each data column of all data tables in the original database, it can first determine the encoding method of each data column (step 602), including but not limited to the bit encoding method and the integer encoding method. After the service provider 60 encodes each data column according to the encoding method (step 603), it can obtain the bit-encoded data column 604 and the integer-encoded data column 605, and then obtain the bit-encoded plaintext database 606 and the integer-encoded plaintext database 607 respectively. The bit-encoded plaintext database and the integer-encoded plaintext database constitute a fully homomorphic plaintext database 608.

[0383] For example, in some embodiments, Figure 7 Schematic diagram of a range data query method based on a fully homomorphic plaintext database proposed in an embodiment of the present application, as shown in FIG. Figure 7As shown, the query party 70 can determine and send the range query type (step 701); at the same time, it can also determine the range query parameters (step 702), and then encode and encrypt the range query parameters to obtain the range query parameter ciphertext (step 703) and send it; the query party 70 can also generate a fully homomorphic public-private key pair by calling a fully homomorphic key generation operator (step 704), and send the fully homomorphic public key in the fully homomorphic public-private key pair (step 705). After receiving the range query type, range query parameter ciphertext, and fully homomorphic public key sent by the query party 70, the service party 60 can perform range screening (step 706) and data statistics (step 707) on the basis of the fully homomorphic plaintext database 608, and finally generate the query result ciphertext, and the service party 60 sends the query result ciphertext to the query party 70 (step 708). After receiving the query result ciphertext, the query party 70 can further use the private key to decrypt the query result ciphertext and finally obtain the range query result (step 709).

[0384] It can be seen that in the embodiment of the application, in the two-party joint computing mode, the service party encodes the database into data in the form of fully homomorphic plaintext using a specified encoding method, that is, a fully homomorphic plaintext database. The requesting party generates a fully homomorphic public-private key pair, and then sends the public key (fully homomorphic public key) to the service party. The requesting party encodes and encrypts the request data into a request data ciphertext (range query parameter ciphertext), and then sends the request data ciphertext to the service party. The service party uses the database plaintext (fully homomorphic plaintext database), the fully homomorphic public key, and the request data ciphertext to perform a query calculation on the database on the ciphertext, obtain the query result ciphertext, and send it to the requesting party. The requesting party decrypts to obtain the range query result.

[0385] In an embodiment of the present application, for the data outsourcing computing mode, the fully homomorphic database used for range data query can be a fully homomorphic ciphertext database.

[0386] In an embodiment of the present application, in the data outsourcing computing mode, the owner and query party of the database are the same participant (e.g., the service party). The user needs to deploy the database on an external server, such as a public cloud, to obtain better computing / storage resources and server management services. Generally, the user needs to protect the content information, query requests, and query results of the database from being leaked to the outsourcing party (e.g., the service party) of the external server and other potential attackers. In order to address the security requirements of this scenario, the outsourced data storage, data transmission, and data calculation of the database need to be implemented in a ciphertext state.

[0387] Furthermore, in an embodiment of the present application, a range data query method in a data outsourcing computing mode may include two parts: construction of a fully homomorphic ciphertext database and data query of the fully homomorphic database.

[0388] For example, in some embodiments, Figure 8 A schematic diagram of a method for constructing a fully homomorphic ciphertext database proposed in an embodiment of the present application is shown in FIG. Figure 8 As shown, the querying party 80 can pre-call the fully homomorphic key generation operator to generate a fully homomorphic public-private key pair (step 801), and store the generated fully homomorphic public-private key pair (step 802). After the querying party 80 obtains the original database 803 from the original data storage device, for each data column of all data tables in the original database, the encoding method of each data column can be first determined (step 804), including but not limited to the bit encoding method and the integer encoding method. After the querying party 80 encodes each data column according to the encoding method (step 805), the bit-encoded data column 806 and the integer-encoded data column 807 can be obtained, and then the fully homomorphic public key in the pre-generated fully homomorphic public-private key pair can be used to encrypt the encoded data columns respectively (step 808), and the bit-encoded ciphertext database 809 and the integer-encoded ciphertext database 810 are obtained. The bit-encoded ciphertext database and the integer-encoded ciphertext database constitute the fully homomorphic ciphertext database 811. Finally, the querying party 80 can send the fully homomorphic ciphertext database to the outsourcing party.

[0389] For example, in some embodiments, Fig. 9 Schematic diagram of a range data query method based on a fully homomorphic ciphertext database proposed in an embodiment of the present application, as shown in FIG. Fig. 9 As shown, the querying party 80 can determine and send the range query type (step 901); at the same time, it can also determine the range query parameters (step 902), and then the range query parameters can be encoded and encrypted to obtain the range query parameter ciphertext and send it (step 903); the querying party 80 can also read the pre-generated and stored fully homomorphic public-private key pair (step 904), and send the fully homomorphic public key in the fully homomorphic public-private key pair (step 905). After receiving the range query type, range query parameter ciphertext, and fully homomorphic public key sent by the querying party 80, the outsourcing party 90 can perform range screening (step 906) and data statistics (step 907) on the basis of the fully homomorphic ciphertext database 811, and finally generate the query result ciphertext, and the outsourcing party 90 sends the query result ciphertext to the querying party 80 (step 908). After receiving the query result ciphertext, the querying party 80 can further use the private key to decrypt the query result ciphertext and finally obtain the range query result (step 909).

[0390] It can be seen that in the embodiment of the application, in the data outsourcing computing mode, the querying party obtains the pre-generated and stored fully homomorphic public-private key pair, and sends the public key to the outsourcing party. The querying party encodes and encrypts the database into a fully homomorphic ciphertext database using the specified encoding method, and then sends the database ciphertext (fully homomorphic ciphertext database) to the outsourcing party. The querying party encodes and encrypts the request data into a request data ciphertext (range query parameter ciphertext), and then sends the request data ciphertext to the outsourcing party. The outsourcing party uses the database ciphertext (fully homomorphic ciphertext database), the fully homomorphic public key, and the request data ciphertext to perform a query calculation on the database on the ciphertext, obtain the query result ciphertext, and send it to the querying party. The querying party decrypts to obtain the query result.

[0391] Furthermore, in an embodiment of the present application, a fully homomorphic cryptographic algorithm is an encryption and decryption algorithm that supports arbitrary calculations on ciphertext data. The embodiment of the present application uses a fully homomorphic cryptographic algorithm BFV or BGV, does not use ciphertext bootstrapping, and implements database query tasks through a finite number of ciphertext multiplication depths. In the BFV or BGV algorithm, the homomorphic parameters include the polynomial order N, the ciphertext modulus Q, the plaintext modulus T, and the noise distribution variance sigma; a message data includes N integers with values ​​in [0, T); a message data is encoded to obtain a plaintext, which includes a polynomial under a plaintext modulus or a ciphertext modulus; a plaintext is encrypted using an encrypted public key to obtain a ciphertext, which includes two polynomials under the ciphertext modulus. The fully homomorphic cryptographic operators related to the embodiments of the present application include:

[0392] Key generation KeyGen(lambda)->(sk, pk, rlk, glk): Input security parameter lambda, output private key sk, encrypted public key pk, relinearized public key rlk, rotated public key glk.

[0393] Encode(msg)->pt: Input a message data msg and output a plaintext pt.

[0394] Decode(pt)->msg: Input a plaintext pt and output a message data msg.

[0395] Encrypt(pk, pt)->ct: Input the encrypted public key pk, a plaintext pt, and output a ciphertext ct.

[0396] Decryption Decrypt(sk, ct)->pt: Input private key sk, a ciphertext ct, and output a plaintext pt.

[0397] Ciphertext + plaintext AddPlain(ct0, pt)->ct1: Input a ciphertext ct0 and a plaintext pt, and output a ciphertext ct1. Satisfy (Decode(Decrypt(sk, ct0)) + Decode(pt)) mod T = Decode(Decrypt(sk, ct1)), where sk is the private key.

[0398] Ciphertext + Ciphertext Add(ct0, ct1)->ct2: Input two ciphertexts ct0 and ct1, and output a ciphertext ct2. Satisfy (Decode(Decrypt(sk, ct0)) + Decode(Decrypt(sk, ct1))) mod T = Decode(Decrypt(sk, ct2)), where sk is the private key.

[0399] Plaintext - Ciphertext SubPlain(pt, ct0)->ct1: Input a plaintext pt and a ciphertext ct0, and output a ciphertext ct1. Satisfy (Decode(pt) - Decode(Decrypt(sk, ct0))) mod T = Decode(Decrypt(sk, ct1)), where sk is the private key.

[0400] Ciphertext-Ciphertext Add(ct0, ct1)->ct2: Input two ciphertexts ct0 and ct1, and output a ciphertext ct2. Satisfy (Decode(Decrypt(sk, ct0)) - Decode(Decrypt(sk, ct1))) mod T = Decode(Decrypt(sk, ct2)), where sk is the private key.

[0401] Ciphertext * plaintext MultPlain(ct0, pt)->ct1: Input the relinearized public key rlk, a ciphertext ct0 and a plaintext pt, and output a ciphertext ct1. Satisfy (Decode(Decrypt(sk, ct0)) * Decode(pt)) mod T = Decode(Decrypt(sk, ct1)), where sk is the private key.

[0402] Ciphertext * Ciphertext Mult(rlk, ct0, ct1)->ct2: Input two ciphertexts ct0 and ct1, and output a ciphertext ct2. Satisfy (Decode(Decrypt(sk, ct0)) * Decode(Decrypt(sk, ct1))) mod T = Decode(Decrypt(sk, ct2)), where sk is the private key and rlk is the relinearized public key.

[0403] Rotate(glk, ct0, n_step)->ct1: Input the rotated public key glk, a ciphertext ct0 and the rotation step number n_step, and output a ciphertext ct1 that satisfies Decode(Decrypt(sk, ct0)) = RotateMessage(Decode(Decrypt(sk, ct1)), n_step), where sk is the private key, glk is the rotated public key, and RotateMessage(,) is some kind of circular shift of the message data array.

[0404] Exemplarily, in some embodiments, for two positive integers a and b, a comparison function is defined as shown in formula (1) to formula (5).

[0405] Consider using a fully homomorphic algorithm that supports addition, subtraction, and multiplication. In order to implement the above comparison function, the comparison calculation needs to be implemented using addition, subtraction, and multiplication. Assume that the binary representation of a and b does not exceed k bits. The binary bits of a are recorded as , ; The binary bits of b are recorded as , The comparison function of a and b can be calculated using a single-bit comparison function and addition, subtraction and multiplication, see formula (6) to formula (8).

[0406] The single-bit comparison function may use the formulas of formula (9) to formula (11).

[0407] After the above multi-bit comparison function is introduced, each bit of a and b is input, and each multi-bit comparison function can be implemented by addition, subtraction and multiplication calculation.

[0408] For the data outsourcing computing mode, the input data a and b of the comparison function are both in ciphertext form; for the two-party joint computing mode, the input data a of the comparison function is in ciphertext form and b is in plaintext form. The following describes the computing process using the data outsourcing computing mode as an example. In the two-party joint computing mode, b needs to be converted into plaintext form, and the other computing processes are the same.

[0409] For one or a set of integer data ,use The above comparison function can be written as a formula for ciphertext calculation, see formula (21) to formula (23), as well as formula (13), (15), and (17).

[0410] In the application process, a and b are represented in binary form, and the value of each bit is encoded and encrypted into a ciphertext. The minimum number of bits required to calculate the k-bit comparison function on the ciphertext is For a fully homomorphic cryptographic algorithm that supports ciphertext packing, such as BFV and BGV, the message data corresponding to a ciphertext contains N integers. The comparison function calculation on the above ciphertext can calculate the comparison of N pairs of data in parallel.

[0411] Assume that the table in the database that needs to be ciphertext queried has c columns and r rows, and the contents are all positive integers. Line The contents of the column are , remember The data width of the column is . This application embodiment supports calculations that satisfy In each row of data for each filter condition The accumulation of the products of column data, where and Both can be set to 0. Correspondingly, no filtering is done and statistics are made on the entire data column. The corresponding count is the number of rows that meet the filter conditions. The query form is shown in formula (24). It is The filter function of the filter condition can be one of EQ, LT, GT, LE, GE, It is The parameter value to be compared in each filter condition. It is The position of the filter column, It is The location of the statistics column.

[0412] For the first If this column needs to be used as data in the filter condition, the data in it is encoded in bits, and each value occupies If this column needs to be used as statistical data, that is, for product calculation of values, the data in it is encoded as integers, and each value occupies 1 plaintext slot. Note that if a column of data can be used for both filtering conditions and statistical calculations, the data can be encoded in two ways and stored in the encoded database respectively. ,To protect the confidentiality of its data, the requester encodes it with bits and encrypts it.

[0413] The message data corresponding to the plaintext or ciphertext of a BFV / BGV algorithm can contain N integers. In the embodiment of the present application, each value of a set of message data in the database corresponds to a different row in the table. , the bit encoding of a column with a data width of k bits uses message data, a column of integer encoding using Message data. Parameters for filtering conditions Each bit of uses 1 message data, all N values ​​in it are the values ​​of the current bit, and a parameter t uses a total of k message data.

[0414] After encoding in the above manner, it can be calculated on the ciphertext, see formula (25).

[0415] The calculation of each plaintext / ciphertext in the N slots is independent. The calculation result is m ciphertexts, corresponding to r products. Finally, the r products need to be accumulated. This step can be implemented using the standard ciphertext rotation accumulation method, see formula (26).

[0416] If the database content is encrypted, the above query calculation can use a multiplication depth of no more than If the database content is plain text, the above query calculation can use a multiplication depth of no more than The ciphertext calculation process is implemented.

[0417] It can be seen that the range data query method proposed in the embodiment of the present application and the ciphertext database support range query, multi-column range query with combined conditions and statistical calculation.

[0418] Assume database Contains 10k data with single key values ​​( ) , is a 32-bit number. Take a query involving a single data comparison as an example. The query satisfies Data ,in is a constant. This corresponds to the following Structured Query Language (SQL) query: select sum( from where .

[0419] In comparison, in the current FHE-based solutions, under the premise of using 128-bit secure homomorphic parameters, the best end-to-end performance is at the level of hundreds of seconds, while the range data query method proposed in this application is at the level of seconds, which is two orders of magnitude better.

[0420] To summarize, the range data query method proposed in the embodiment of the present application uses a fully homomorphic cryptographic algorithm that supports integer addition, subtraction, and multiplication to implement a ciphertext database solution that supports multi-column range queries and statistical calculations, and can use a smaller multiplication depth to efficiently implement ciphertext calculations for queries.

[0421] It can be understood that the range data query method proposed in the embodiment of the present application uses bit encoding for columns that can be used as query conditions during the database encoding stage; and uses integer encoding for columns that can be used for statistical calculations.

[0422] It is understandable that the range data query method proposed in the embodiment of the present application can bit-encode and encrypt the request parameter data during the request data encryption stage.

[0423] It is understandable that the range data query method proposed in the embodiment of the present application can expand various comparison functions into a combination of addition, subtraction, and multiplication of binary data during the query condition calculation stage, and use a fully homomorphic ciphertext calculation operator to implement the calculation. The comparison functions of the range query condition include equal to, less than, greater than, less than or equal to, and greater than or equal to.

[0424] It can be understood that the range data query method proposed in the embodiment of the present application uses a multiplication operator of fully homomorphic ciphertext calculation to achieve the combination of multiple query condition results.

[0425] It can be understood that the range data query method proposed in the embodiment of the present application, in the statistical calculation stage, uses the addition and multiplication operators of fully homomorphic ciphertext calculation for the ciphertext results of the range query and the statistical calculation data to implement statistical calculations of screening, multiplication, and summation.

[0426] It can be understood that the range data query method proposed in the embodiment of the present application, the entire solution supports the use of the SIMD characteristics of the homomorphic algorithm to improve computing efficiency.

[0427] It can be seen that the range data query method proposed in the embodiment of the present application, the ciphertext database supports range query, multi-column range query with combined conditions and statistical calculation. The present application makes good use of the computing advantages of full homomorphism in range query and statistical calculation by combining encodings with different computing advantages and a unified encryption scheme.

[0428] Furthermore, in the embodiment of the present application, query statistics with a calculation result range greater than T are supported. This needs to be implemented using multiple plaintext modulus components, and the calculation, transmission, and storage overheads all increase linearly.

[0429] Furthermore, in the embodiments of the present application, if the multiplication depth needs to be reduced, similar coding can be used instead of bit coding to obtain a smaller multiplication depth with more data and calculation.

[0430] Further, in an embodiment of the present application, the type of comparison function in the protection query request, i.e. . can be achieved with a small amount of additional computation.

[0431] In summary, the data query method of the fully homomorphic database proposed in the embodiment of the present application adopts the plaintext space as The FHE algorithm is used, but the data is bit-encoded and FHE itself is plaintext-encoded at the same time. The ciphertext corresponding to the bit encoding is used when calculating the equality and comparison of the ciphertext data, and the ciphertext corresponding to the plaintext encoding of the FHE algorithm is used when statistics are taken. The embodiment of the present application greatly optimizes the performance of range query by utilizing encodings with different computational advantages, as well as a unified plaintext space and encryption algorithm.

[0432] The embodiment of the present application provides a data query method for a fully homomorphic database, which can perform range data query for a determined range query type and an encrypted range query parameter ciphertext on the basis of a fully homomorphic database, wherein the fully homomorphic database is encoded using different encoding methods, and the range data query may include a screening process and a statistical process for different range query types. In other words, the embodiment of the present application implements range data query of ciphertext by utilizing encodings with different computing advantages, as well as a unified plaintext space and encryption algorithm, thereby effectively improving the efficiency of range data query while ensuring the security of range query.

[0433] Based on the above embodiment, in another embodiment of the present application, Fig.10 A schematic diagram of the structure of the requesting party proposed in the embodiment of the present application is shown in FIG. Fig.10 As shown, the requesting party 100 proposed in the embodiment of the present application may include:

[0434] An acquisition unit 1001 is used to acquire a fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key;

[0435] The first sending unit 1002 is used to send the homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding;

[0436] The first receiving unit 1003 is used to receive the query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on the fully homomorphic database, the homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0437] The decryption unit 1004 is used to decrypt the query result ciphertext based on the homomorphic private key to obtain the query result corresponding to the query request.

[0438] Furthermore, in the embodiments of the present application, Fig.11 The hardware structure diagram of the requester proposed in the embodiment of the present application is as follows: Fig.11 As shown, the requester 100 proposed in the embodiment of the present application may include a processor 1101 , a memory 1102 , a communication interface 1103 , and a bus 1104 for connecting the processor 1101 , the memory 1102 and the communication interface 1103 .

[0439] In an embodiment of the present application, the processor 1101 may be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a Central Processing Unit (CPU), a controller, a microcontroller, and a microprocessor. It can be understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiment of the present application is not specifically limited. The communication device 110 may also include a memory 1102, which can be connected to the processor 1101, wherein the memory 1102 is used to store executable program code, the program code includes computer operation instructions, and the memory 1102 may include a high-speed RAM memory, and may also include a non-volatile memory, for example, at least two disk memories.

[0440] In the embodiment of the present application, the bus 1104 is used to connect the communication interface 1103, the processor 1101 and the memory 1102, as well as the mutual communication between these devices.

[0441] In practical applications, the memory 1102 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the processor 1101.

[0442] Further, in an embodiment of the present application, the processor 1101 is used to obtain a fully homomorphic public-private key pair, wherein the fully homomorphic public-private key pair includes a fully homomorphic public key and a fully homomorphic private key; send the homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding; receive the query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on a fully homomorphic database, the homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; the query result ciphertext is decrypted based on the homomorphic private key to obtain the query result corresponding to the query request.

[0443] In addition, each functional module in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or software functional modules.

[0444] If the integrated unit is implemented in the form of a software function module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method of this embodiment. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0445] Furthermore, in the embodiments of the present application, Fig.12 This is a schematic diagram of the composition structure of the service provider proposed in the embodiment of the present application, such as Fig.12 As shown, the service provider 120 proposed in the embodiment of the present application may include:

[0446] The second receiving unit 1201 is used to receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext;

[0447] A query unit 1202 is used to query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0448] The second sending unit 1203 is used to send the query result ciphertext to the requesting party.

[0449] Furthermore, in the embodiments of the present application, Fig.13 This is a schematic diagram of the hardware structure of the service provider proposed in the embodiment of the present application, such as Fig.13 As shown, the service provider 120 proposed in the embodiment of the present application may include a processor 1301 , a memory 1302 , a communication interface 1303 , and a bus 1304 for connecting the processor 1301 , the memory 1302 , and the communication interface 1303 .

[0450] In an embodiment of the present application, the processor 1301 may be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a Central Processing Unit (CPU), a controller, a microcontroller, and a microprocessor. It can be understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiment of the present application is not specifically limited. The communication device 130 may also include a memory 1302, which may be connected to the processor 1301, wherein the memory 1302 is used to store executable program code, the program code includes computer operation instructions, and the memory 1302 may include a high-speed RAM memory, and may also include a non-volatile memory, for example, at least two disk memories.

[0451] In the embodiment of the present application, the bus 1304 is used to connect the communication interface 1303, the processor 1301 and the memory 1302, as well as the mutual communication between these devices.

[0452] In practical applications, the memory 1302 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or a combination of the above types of memories, and provide instructions and data to the processor 1301.

[0453] Further, in an embodiment of the present application, the processor 1301 is used to receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext; based on a fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext, a query is performed to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; and the query result ciphertext is sent to the requester.

[0454] In addition, each functional module in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or software functional modules.

[0455] If the integrated unit is implemented in the form of a software function module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the method of this embodiment. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0456] Furthermore, in the embodiments of the present application, Fig.14 This is a schematic diagram of the structure of the data query system proposed in the embodiment of the present application, such as Fig.14 As shown, the data query system 140 proposed in the embodiment of the present application may include a requester 100 and a server 120, wherein the requester 100 and the server 120 can be used to execute the data query method of the fully homomorphic database described in any of the above embodiments, which will not be repeated here for the sake of brevity.

[0457] Furthermore, an embodiment of the present application provides a computer-readable storage medium having a program stored thereon, and when the program is executed by a processor, the range data query method as described above is implemented.

[0458] Specifically, the program instructions corresponding to the data query method of a fully homomorphic database in this embodiment can be stored on a storage medium such as a CD, a hard disk, a USB flash drive, etc. When the program instructions corresponding to the data query method of a fully homomorphic database in the storage medium are read or executed by an electronic device, the following steps are included:

[0459] Obtain a fully homomorphic public-private key pair, the fully homomorphic public-private key pair comprising a fully homomorphic public key and a fully homomorphic private key;

[0460] Sending the homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding;

[0461] Receive the query result ciphertext returned by the service provider; wherein the query result ciphertext is obtained by the service provider device based on the fully homomorphic database, the homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0462] The query result ciphertext is decrypted based on the homomorphic private key to obtain the query result corresponding to the query request.

[0463] Specifically, the program instructions corresponding to the data query method of a fully homomorphic database in this embodiment can be stored on a storage medium such as a CD, a hard disk, a USB flash drive, etc. When the program instructions corresponding to the data query method of a fully homomorphic database in the storage medium are read or executed by an electronic device, the following steps are included:

[0464] Receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext;

[0465] Perform a query based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding;

[0466] The query result ciphertext is sent to the requesting party.

[0467] The embodiment of the present application also provides a computer program product.

[0468] In some embodiments, the computer program product may include a computer program or instructions.

[0469] In some embodiments, the computer program product can be applied to the computer device in the embodiments of the present application, and the computer program instructions enable the computer to execute the corresponding processes implemented by the computer device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0470] It should be noted here that the description of the above communication device, chip, communication system, storage medium, computer program product and computer program embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the communication device, chip, communication system, storage medium, computer program product and computer program embodiment of this application, please refer to the description of the method embodiment of this application for understanding.

[0471] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0472] The present application is described with reference to the implementation flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0473] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which is implemented in the implementation flow diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0474] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing the steps in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0475] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A data query method for a fully homomorphic database, characterized in that: The method is applied to the requesting party, comprising: Obtain a fully homomorphic public-private key pair, the fully homomorphic public-private key pair comprising a fully homomorphic public key and a fully homomorphic private key; Sending the fully homomorphic public key and a range query request to the service provider; wherein the range query request includes a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding; Receive the query result ciphertext returned by the service provider; wherein, the query result ciphertext is obtained by the service provider based on the fully homomorphic database, the fully homomorphic public key, the range query type and the range query parameter ciphertext; the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; wherein, the encoding of the fully homomorphic database includes encoding the data column used as the query condition using bit encoding, and encoding the data column used as the statistical calculation using integer encoding; the fully homomorphic database includes the fully homomorphic ciphertext database generated by the requester and the fully homomorphic plaintext database generated by the service provider; Decrypting the query result ciphertext based on the fully homomorphic private key to obtain the query result corresponding to the query request; Wherein, obtaining a fully homomorphic public-private key pair includes: When the fully homomorphic database is the fully homomorphic ciphertext database, the requesting party obtains the fully homomorphic public-private key pair from a local key storage device; When the fully homomorphic database is the fully homomorphic plaintext database, the requesting party calls a fully homomorphic key generation operator to generate the fully homomorphic public-private key pair.

2. The method according to claim 1, characterized in that When the fully homomorphic database is the fully homomorphic ciphertext database, the method further includes: Pre-calling a fully homomorphic key generation operator to generate the fully homomorphic public-private key pair; storing the fully homomorphic public-private key pair in a local key storage device; The obtaining of a fully homomorphic public-private key pair includes: Obtain the fully homomorphic public-private key pair from the local key storage device.

3. The method according to claim 2, characterized in that The method further comprises: For each data column of all data tables in the original data storage device, determine a coding method for each data column; wherein the coding method includes integer coding and / or bit coding; For the data column that meets the query condition, encode it according to the bit encoding encoding method to obtain the bit-encoded data column; wherein the bit encoding includes integer encoding of the input data bit by bit; For a data column that satisfies statistical calculation, encoding is performed according to an integer encoding method to obtain an integer encoded data column; wherein the integer encoding includes encoding based on a fully homomorphic encoding operator; Based on the fully homomorphic public key, calling a fully homomorphic encryption operator to encrypt the bit-encoded data column and the integer-encoded data column to obtain the fully homomorphic ciphertext database; Send the fully homomorphic ciphertext database to the service provider.

4. The method according to claim 1, characterized in that The obtaining of a fully homomorphic public-private key pair includes: When the fully homomorphic database is the fully homomorphic plaintext database, the fully homomorphic key generation operator is called to generate the fully homomorphic public-private key pair.

5. The method according to claim 1, characterized in that The method further comprises: Determine a screening function and a statistical function; wherein the screening function includes one or more screening predicates, the screening predicate includes the columns involved in the screening, the comparison operator and the predicate parameter; the statistical function includes the columns involved in the statistics and the statistical type; Determining the range query type based on the screening function and the statistical function; Each range query corresponds to at least one of the screening functions and at least one of the statistical functions.

6. A data query method for a fully homomorphic database, characterized in that: The method is applied to the service side, and includes: Receive a fully homomorphic public key and a query request sent by a requester; wherein the query request carries a range query type and a range query parameter ciphertext; the range query parameter ciphertext is obtained by encrypting the range query parameter after bit encoding; Based on the fully homomorphic database, the fully homomorphic public key, the range query type, and the range query parameter ciphertext, a query is performed to obtain a query result ciphertext; wherein the fully homomorphic database is obtained by encoding through integer encoding and / or bit encoding; wherein the encoding of the fully homomorphic database includes encoding the data column used as the query condition using a bit encoding method, and encoding the data column used as the statistical calculation using an integer method; the fully homomorphic database includes a fully homomorphic ciphertext database generated by the requester and a fully homomorphic plaintext database generated by the service provider; Sending the query result ciphertext to the requesting party; in, When the fully homomorphic database is the fully homomorphic ciphertext database, the fully homomorphic public-private key pair including the fully homomorphic public key is obtained by the requesting party from a local key storage device; When the fully homomorphic database is the fully homomorphic plaintext database, the fully homomorphic public-private key pair is generated by the requesting party calling a fully homomorphic key generation operator.

7. The method according to claim 6, characterized in that The querying based on the fully homomorphic database, the fully homomorphic public key, the range query type and the range query parameter ciphertext to obtain the query result ciphertext includes: Determine a filtering request and a statistical request based on the range query type and the range query parameter ciphertext; wherein the filtering request includes one or more filtering predicates, the filtering predicate includes the columns involved in the filtering, the comparison operator and the predicate parameter ciphertext; the statistical request includes the columns involved in the statistics, and the statistical type; Determine a first screening request result ciphertext based on the fully homomorphic public key, the fully homomorphic database, and the screening request; For the statistical request, calling a fully homomorphic multiplication operator, and obtaining a first screening data ciphertext based on the first screening request result ciphertext and all data on the columns involved in the statistics; According to the statistical type, a fully homomorphic arithmetic operator is called to calculate the first screening data ciphertext to determine the query result ciphertext.

8. The method according to claim 7, wherein: A plurality of said filter predicates are connected by one or more connectors; The determining, based on the fully homomorphic public key, the fully homomorphic database, and the screening request, a first screening request result ciphertext comprises: Based on the fully homomorphic public key and the fully homomorphic database, for each screening predicate, calling the fully homomorphic comparison operator corresponding to the comparison operator in the screening predicate, screening the data on the column involved in the screening, and obtaining the first screening predicate result ciphertext; For the screening request, the fully homomorphic logic operator corresponding to the connector is called to calculate the logical calculation results of all the first screening predicate result ciphertexts to obtain the first screening request result ciphertext.

9. The method according to claim 8, characterized in that When the fully homomorphic database is the fully homomorphic plaintext database, the method further includes: For each data column of all data tables in the original data storage device, determine a coding method for each data column; wherein the coding method includes integer coding and / or bit coding; For the data column that meets the query condition, encode it according to the bit encoding encoding method to obtain the bit-encoded data column; wherein the bit encoding includes integer encoding of the input data bit by bit; For a data column that satisfies statistical calculation, encoding is performed according to an integer encoding method to obtain an integer encoded data column; wherein the integer encoding includes encoding based on a fully homomorphic encoding operator; The fully homomorphic plaintext database is constructed based on the bit-encoded data column and the integer-encoded data column.

10. The method according to claim 9, characterized in that In the case where the fully homomorphic database is the fully homomorphic plaintext database, all data in the fully homomorphic database is in plaintext form; The method of calling the fully homomorphic comparison operator corresponding to the comparison operator in the screening predicate for each screening predicate based on the fully homomorphic public key and the fully homomorphic database, screening the data on the column involved in the screening, and obtaining the first screening predicate result ciphertext includes: Determining the predicate parameter bit ciphertext corresponding to each bit position of the bit-encoded predicate parameter ciphertext; Determine a data bit plaintext corresponding to each bit of data in the column involved in the bit-encoded screening in the fully homomorphic database; Corresponding to the comparison operator included in the screening predicate, for each bit, taking the predicate parameter bit ciphertext and the data bit plaintext as input, calling the fully homomorphic bit comparison operator corresponding to the comparison operator, and obtaining a first equal result ciphertext; The fully homomorphic comparison operator is called to combine the first equal result ciphertexts corresponding to all bits to obtain the first screening predicate result ciphertext.

11. The method according to claim 8, wherein for the screening request, calling the fully homomorphic logic operator corresponding to the connector, calculating the logical calculation results of all first screening predicate result ciphertexts, and obtaining the first screening request result ciphertext comprises: For the fully homomorphic AND operator corresponding to the connector, calling the fully homomorphic multiplication operator, combining all first screening predicate result ciphertexts, and obtaining the first logic calculation result ciphertext; For the fully homomorphic or operator corresponding to the connector, calling the fully homomorphic subtraction operator and the fully homomorphic multiplication operator, combining all the first screening predicate result ciphertexts, and obtaining the second logic calculation result ciphertext; For the fully homomorphic negation operator corresponding to the connector, calling the fully homomorphic subtraction operator, combining all the first screening predicate result ciphertexts, and obtaining the third logic calculation result ciphertext; The first screening request result ciphertext is determined based on one or more of the first logic calculation result ciphertext, the second logic calculation result ciphertext, and the third logic calculation result ciphertext.

12. The method according to claim 8, characterized in that When the fully homomorphic database is the fully homomorphic ciphertext database, the method further includes: Receiving the fully homomorphic ciphertext database sent by the requesting party; Correspondingly, in the case where the fully homomorphic database is the fully homomorphic ciphertext database, all data in the fully homomorphic database is in ciphertext form; the method of invoking the fully homomorphic comparison operator corresponding to the comparison operator in the filter predicate for each filter predicate based on the fully homomorphic public key and the fully homomorphic database, filtering the data on the column involved in the filter, and obtaining the first filter predicate result ciphertext includes: Determining the predicate parameter bit ciphertext corresponding to each bit position of the bit-encoded predicate parameter ciphertext; Determine a data bit ciphertext corresponding to each bit of data in the column involved in the bit-encoded screening in the fully homomorphic database; Corresponding to the comparison operator included in the screening predicate, for each bit, taking the predicate parameter bit ciphertext and the data bit ciphertext as input, calling the fully homomorphic bit comparison operator corresponding to the comparison operator, and obtaining a first equal result ciphertext; The fully homomorphic comparison operator is called to combine the first equal result ciphertexts corresponding to all bits to obtain the first screening predicate result ciphertext.

13. A requesting device, characterized in that: The requesting device includes: a processor and a storage medium storing executable instructions, wherein the storage medium relies on the processor to perform operations through a communication bus, and when the executable instructions are executed by the processor, the data query method of the fully homomorphic database as described in any one of claims 1-5 is executed.

14. A service device, characterized in that: The service-side device includes: a processor and a storage medium storing executable instructions, wherein the storage medium relies on the processor to perform operations through a communication bus, and when the executable instructions are executed by the processor, the data query method of the fully homomorphic database as described in any one of claims 6-12 is executed.

Images