Data management method and device, electronic device and storage medium

Abstract

The present specification provides a data management method and device, an electronic device and a storage medium, the method comprising: generating multiple data blocks according to the number of data items in the data to be stored, wherein each data block corresponds to the multiple data items in the data to be stored; adding path information, a common count and an individual count of each data item in the corresponding multiple data items, and index information of the corresponding multiple data items in the data blocks, and inputting the common count and the individual count of each data item in the corresponding multiple data items into a PRF function to obtain a random number for each data item in the corresponding multiple data items; storing each data block and each data item of the data to be stored in a preset data tree and in a path corresponding to the data block, and sending the data tree to a cloud server for storage; obtaining the data item pointed to by the query condition from the cloud server according to the query condition, the index information in each data block and the path information.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of database technology, and in particular, to a data management method and device, an electronic device, and a storage medium. Background Art

[0002] With the rise of cloud computing and the development of cloud service providers, users (such as companies and hospitals) are increasingly inclined to host their own databases in the cloud for access, thereby saving their own expenses on database management software and storage hardware. However, the security risks brought by cloud hosting services have brought huge challenges to the implementation of cloud databases. The biggest problem is how to prevent untrusted cloud service providers from directly seeing sensitive information in user databases. Cloud encrypted databases are a solution to this scenario and the corresponding security risks. It requires users to encrypt the database before uploading it to the cloud server, so that cloud service providers cannot obtain data information, especially sensitive information.

[0003] However, the cloud-based encrypted database in the related art has poor management security for encrypted data. For example, when a user queries the encrypted data in the cloud-based encrypted database, part or even all of the data information may be obtained by the cloud service provider. Summary of the invention

[0004] In view of this, one or more embodiments of the present specification provide a data management method and device, an electronic device, and a storage medium.

[0005] To achieve the above objectives, one or more embodiments of this specification provide the following technical solutions:

[0006] According to a first aspect of one or more embodiments of this specification, a data management method is proposed, which is applied to a client, and the method includes:

[0007] Generate multiple data blocks according to the number of data items in the data to be stored, wherein each data block corresponds to multiple data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all data items of the data to be stored;

[0008] For each data block, adding path information, a common count and an individual count of each data item in the corresponding multiple data items, and index information of the corresponding multiple data items in the data block, and inputting the common count and the individual count of each data item in the corresponding multiple data items into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items;

[0009] Storing each data block in a path corresponding to the path information in the data block in a preset data tree, storing each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, and sending the data tree to the cloud server for storage;

[0010] According to the query conditions, as well as the index information and path information in each data block, the corresponding data block is obtained from the cloud server, and according to the data block and the query conditions, the data item pointed to by the query condition is obtained from the cloud server.

[0011] In a possible embodiment of the present specification, generating a plurality of data blocks according to the number of data items in the data to be stored includes:

[0012] The data to be stored is divided into multiple data fragments based on a preset number of divisions, and multiple data blocks corresponding to the multiple data fragments are generated, wherein the data to be stored includes multiple data items, and each data fragment of the multiple data fragments except the last data fragment includes the number of data items divided.

[0013] In a possible embodiment of the present specification, the step of inputting the common count and the individual count of each of the corresponding multiple data items into a preset PRF function to obtain a random number for each of the corresponding multiple data items includes:

[0014] The public count, and the individual count and key of each data item in the corresponding plurality of data items are input into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items.

[0015] In a possible embodiment of the present specification, storing each data block in a path corresponding to the path information in the data block in a preset data tree, and storing each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, includes:

[0016] Encrypting each data block based on a preset algorithm, and storing each encrypted data block in a path corresponding to the path information in the data block in a preset data tree;

[0017] Each data item in the data to be stored is encrypted based on a preset algorithm, and each encrypted data item in the data to be stored is stored in a path in the data tree corresponding to the random number of the data item.

[0018] In a possible embodiment of the present specification, before storing each data item in the data to be stored in the path corresponding to the random number of the data item in the data tree, the method further includes:

[0019] For each data item in the data to be stored, a random number of the data item is added to the data item.

[0020] In a possible embodiment of this specification, the method further includes:

[0021] The other storage units in the data tree except the storage unit storing the data block or the data item are filled with random character strings.

[0022] In a possible embodiment of the present specification, acquiring the corresponding data block from the cloud server according to the query condition and the index information and path information in each data block, and acquiring the data item pointed to by the query condition from the cloud server according to the data block and the query condition, includes:

[0023] Determine the path information and index information of the target data block according to the target key in the query condition and the index information in each data block, wherein the target key is the key of the target data item, the target data item is the data item pointed to by the query condition, and the target data block is the data block corresponding to the target data item;

[0024] Acquire a path from the cloud server based on the path information of the target data block, and read the target data block from the acquired path based on the index information of the target data block;

[0025] Inputting the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain a random number for the target data item;

[0026] A path is obtained from the cloud server based on the random number of the target data item, and the target data item is read from the obtained path based on the target key.

[0027] In a possible embodiment of this specification, the method further includes:

[0028] The personal count corresponding to the target key in the target data block is updated in an incremental manner, and the public count and the updated personal count are input into the PRF function to obtain an updated result of the random number of the target data item;

[0029] The target data item is stored in a path in the data tree corresponding to an update result of the random number of the target data item.

[0030] In a possible embodiment of the present specification, the adding of a common count and an individual count of each data item in the corresponding plurality of data items in the data block includes:

[0031] Adding a first count group and a second count group in the data item, wherein the first count group and the second count group both include a common count and an individual count of each data item in the corresponding plurality of data items, and an initial value of the individual count of each data item in the first count group is non-0, and an initial value of the individual count of each data item in the second count group is 0;

[0032] The step of inputting the common count and the individual count of each data item in the corresponding plurality of data items into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items comprises:

[0033] The common count in the first count group and the individual count of each data item are input into a preset PRF function to obtain a random number for each data item in the multiple data items corresponding to the data block.

[0034] In a possible embodiment of the present specification, the inputting the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain the random number of the target data item includes:

[0035] In response to the individual count corresponding to the target key in the first count group in the target data block being non-zero, inputting the public count in the first count group, the individual count corresponding to the target key, and the order of the first count group into the PRF function to obtain a random number for the target data item;

[0036] In response to the personal count corresponding to the target key in the first count group within the target data block being 0, the public count in the second count group, the personal count corresponding to the target key, and the order of the second count group are input into the PRF function to obtain a random number for the target data item.

[0037] In a possible embodiment of the present specification, when the random number of the target data item is obtained based on the first count group, the individual count corresponding to the target key in the target data block is updated in an incremental manner, and the public count and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item, including:

[0038] In response to the individual count corresponding to the target key in the first counting group not reaching a preset maximum value, the individual count corresponding to the target key in the first counting group is updated in an incremental manner, and the public count in the first counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item;

[0039] In response to the individual count corresponding to the target key in the first counting group reaching a preset maximum value, and there being a non-zero individual count in the second counting group, the individual count corresponding to the target key in the first counting group is set to 0, the individual count corresponding to the target key in the second counting group is updated in an incremental manner, and the public count in the second counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item;

[0040] In response to the personal count corresponding to the target key in the first counting group reaching a preset maximum value and there being no non-zero personal count in the second counting group, the personal count corresponding to the target key in the first counting group is set to 0, the public count in the second counting group and the personal count corresponding to the target key are updated in an incremental manner, and the updated public count and personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0041] In a possible embodiment of this specification, the method further includes:

[0042] In response to the public count in the first counting group being greater than the public count in the second counting group, and there being a non-zero individual count in the second counting group, at least one non-zero individual count in the second counting group is set to 0, the corresponding individual count in the first counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the first counting group;

[0043] In response to the public count in the first counting group being less than the public count in the second counting group, and there being non-zero individual counts in the first counting group, at least one non-zero individual count in the first counting group is set to 0, the corresponding individual count in the second counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the second counting group.

[0044] In a possible embodiment of this specification, the method further includes:

[0045] In response to the public count in the first counting group being greater than the public count in the second counting group, and there being no non-zero individual count in the second counting group, randomly accessing a path in the data tree;

[0046] In response to the public count in the first counting group being less than the public count in the second counting group, and there being no non-zero individual count in the first counting group, a path of the data tree is randomly accessed.

[0047] In a possible embodiment of this specification, the method further includes:

[0048] The path information of the target data block is updated, and the target data block is stored in the path in the data tree corresponding to the update result of the path information in the target data block.

[0049] According to a second aspect of one or more embodiments of this specification, a data management device is provided, which is applied to a client, and the device includes:

[0050] A generating module, configured to generate a plurality of data blocks according to the number of data items in the data to be stored, wherein each data block corresponds to a plurality of data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all the data items of the data to be stored;

[0051] An adding module, for adding, for each data block, path information, a common count and an individual count of each data item in a corresponding plurality of data items, and index information of the corresponding plurality of data items in the data block, and inputting the common count and the individual count of each data item in the corresponding plurality of data items into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items;

[0052] A storage module, used to store each data block in a path corresponding to the path information in the data block in a preset data tree, store each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, and send the data tree to the cloud server for storage;

[0053] The query module is used to obtain the corresponding data block from the cloud server according to the query condition and the index information and path information in each data block, and obtain the data item pointed to by the query condition from the cloud server according to the data block and the query condition.

[0054] According to a third aspect of one or more embodiments of this specification, a computer program product is provided, comprising a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0055] According to a fourth aspect of one or more embodiments of this specification, an electronic device is provided, including:

[0056] processor;

[0057] a memory for storing processor-executable instructions;

[0058] The processor implements the method as described in the first aspect by running the executable instructions.

[0059] According to a fifth aspect of one or more embodiments of the present specification, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0060] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0061] The data management method provided in the embodiment of the present specification first generates multiple data blocks according to the number of data items in the data to be stored, so that each data block corresponds to multiple data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all data items of the data to be stored; then for each data block, path information, a common count and an individual count of each data item in the corresponding multiple data items, and index information of the corresponding multiple data items are added to the data block, and the common count and the individual count of each data item in the corresponding multiple data items are input into a preset A PRF function is performed to obtain a random number for each of the corresponding multiple data items; then each data block is stored in a path corresponding to the path information in the data block in a preset data tree, each data item in the data to be stored is stored in a path corresponding to the random number of the data item in the data tree, and the data tree is sent to the cloud server for storage; finally, the corresponding data block is obtained from the cloud server according to the query condition, as well as the index information and path information in each data block, and the data item pointed to by the query condition is obtained from the cloud server according to the data block and the query condition.

[0062] This method stores data items in a specific path rather than a specific storage unit block, which can prevent the cloud service provider from knowing the specific storage block of the queried data item when the user queries the data item, thereby preventing the cloud service provider from locking the block storing the data item by knowing which blocks.

[0063] This method records the path where the data item is located through the public count and personal count stored in the data block of the cloud server, and the PRF function is stored locally to prevent the path where the data item is located from being leaked, further improving data security and avoiding information leakage during data query. In particular, each data block can record the path where multiple data items are located through multiple personal counts, with a high compression ratio, thereby improving the efficiency of users in finding the path where the data item is located and improving data query efficiency; that is, the user only needs to store the PRF function locally, as well as the index information and path information of a small number of data blocks, to achieve data location confidentiality and query efficiency improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1It is a schematic diagram of the architecture of a client and a cloud server provided by an exemplary embodiment.

[0065] Figure 2 The figure is a flow chart of a data management method applied to a client provided by an exemplary embodiment.

[0066] Figure 3 The present invention is a flowchart of a data query method applied to a client provided by an exemplary embodiment.

[0067] Figure 4 It is a structural schematic diagram of a device provided by an exemplary embodiment.

[0068] Figure 5 It is a block diagram of a data management device applied to a client provided by an exemplary embodiment. DETAILED DESCRIPTION

[0069] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0070] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

[0071] Next, some concepts involved in this specification are explained.

[0072] Cloud encrypted database: refers to the user encrypting his own database and hosting it on the server provided by the cloud service provider in order to reduce the expenditure on hardware and software. In order to facilitate the user's daily query and access to the database, the user adopts a special encryption scheme, so that the encrypted database can efficiently complete the user's query and access requests without leaking the user's privacy to the cloud service provider.

[0073] Key-Value (KV) data: Each record consists of a key and its corresponding data value. The KV data is represented as .

[0074] Oblivious RAM (ORAM): refers to a tool for encrypted databases that allows users to retrieve one piece of data from multiple KV data without letting the cloud service provider know which data the user has accessed. In particular, ORAM generally only supports access to KV data whose keys are continuous according to a certain pattern, that is, for , ORAM requires ,in is a fixed constant.

[0075] AES: refers to the Advanced Encryption Standard (AES), a symmetric encryption scheme widely used in commercial activities. This scheme uses the AES scheme as the basic encryption scheme to encrypt data.

[0076] PRF: refers to the Pseudorandom function family, a common tool in cryptography. The user specifies a PRF function by setting a key so that, given any input, the function outputs an approximately random integer corresponding to the input.

[0077] Users often worry that cloud service providers can detect their sensitive information through their access to data. Therefore, users hope that cloud service providers cannot know the sensitive information that users are accessing from accessing the cloud encrypted database, such as which data the user is accessing for each query. Oblivious RAM (ORAM) is a technology proposed for this scenario and demand. It can help users access the data they need from KV data while preventing service providers from knowing which data the user is accessing. However, to date, various ORAM solutions in related technologies still find it difficult to achieve stable and efficient performance. For example, Path ORAM is the most basic and simplest ORAM solution that helps users access KV data, but its existence requires users to store all keys locally or interact with cloud servers each time. round to access data, where is the total number of data items, which makes the Path ORAM solution unable to bring stable and efficient performance.

[0078] Based on the above technical problems, at least one embodiment of the present specification provides a data management method, which allows users to store data in an encrypted form in a cloud server, and will not leak information such as the storage location when querying the stored data, thereby preventing the cloud service provider from knowing which data locations are accessed or frequently accessed, etc., to improve the data security of the cloud encryption server.

[0079] This method is completed by the client and the cloud server. Figure 1 After initializing the key and other information in the client, the data in the local database is encrypted into encrypted data and then sent to the ORAM encryption storage module of the cloud server for storage, and the key and overflow data (i.e. the mapping relationship between the index information and path information of the data block mentioned below) obtained during the initialization and encryption process are sent to the Stash module for storage; the user request module obtains the overflow data from the Stash module based on the query conditions, and enables the query processing module to obtain the data from the ORAM encryption storage module of the cloud server based on the overflow data. After obtaining the data, the query processing module encrypts it for use, and re-stores the updated overflow data in the ORAM encryption storage module of the cloud server, and updates the overflow data in the Stash module at the same time.

[0080] Next, the details of this method are introduced from both the client and cloud server sides.

[0081] Please refer to the attached Figure 2 , which exemplarily shows a flow chart of a data management method applied to a client, including steps S201 to S204.

[0082] In step S201, multiple data blocks are generated according to the number of data items in the data to be stored, wherein each data block corresponds to multiple data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all data items of the data to be stored.

[0083] The data to be stored includes multiple data items, for example, a data row is regarded as a data item. Preferably, this step can divide the data to be stored into multiple data segments based on a preset number of divisions, and generate multiple data blocks corresponding to the multiple data segments one by one, wherein the data to be stored includes multiple data items, and each data segment except the last data segment includes the data items of the division number. For example, for the data to be stored ,generate data blocks, A constant set by the user. To round up.

[0084] In step S202, for each data block, path information, a common count and an individual count of each data item in the corresponding multiple data items, and index information of the corresponding multiple data items are added in the data block, and the common count and the individual count of each data item in the corresponding multiple data items are input into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items.

[0085] Before executing this step, the key of the PRF function can be pre-generated, which can be recorded as .

[0086] Among them, the random number of the data item is used to indicate its storage path in the data tree, that is, to characterize the storage location of the data item; in other words, this step records the storage locations of multiple data items with a public count and multiple individual counts, thereby improving the efficiency of recording the storage locations; and the public count and multiple individual counts need to be input into a preset PRF function to obtain the random number characterizing the storage location. Users can store data blocks that occupy more space on a cloud server to avoid local storage space being occupied, and store PRF functions and their keys that occupy less space locally to increase the security of the storage location of the data item.

[0087] For example, after adding the path information, the common count and the individual count of each of the corresponding multiple data items, and the index information of the corresponding multiple data items, the generated The structure of the jth data block in the data blocks is: ,in, is index information, such as indicating that the multiple data items corresponding to the data block are the (j-1)X-1th data item to the jXth data item, is the public count of the data block, are the individual counts of the 1st, 2nd, ..., Xth data items in the multiple data items corresponding to the data block, The path information of the data block is used to represent the path where the data block is stored on the data tree. .

[0088] The client can store locally , and the key of the PRF function .

[0089] Preferably, in this step, the public count, and the individual count and key of each data item in the corresponding multiple data items can be input into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items. That is, for each data item, its individual count and key and the public count are input into the PRF function to obtain a random number for the data item.

[0090] For example, the i-th data item is obtained according to the following formula Random number :

[0091]

[0092] In the above formula, It is used to represent the order of the data block where the data item is located. It is used to represent the order of the data item in the multiple data items corresponding to its corresponding data block. To find the remainder function, The range is 1 to , The key for this data item.

[0093] In step S203, each data block is stored in a path in a preset data tree corresponding to the path information in the data block, each data item in the data to be stored is stored in a path in the data tree corresponding to the random number of the data item, and the data tree is sent to the cloud server for storage.

[0094] Before executing this step, a data tree, such as a binary tree, can be generated in advance. The total number of leaf nodes in the data tree can be , each node is called a bucket, and each node can store A storage unit block, each block can be used to store a piece of data.

[0095] The path information path corresponds to the path from the root node to the path-th leaf node. The path corresponding to the random number p refers to the path from the root node to the p-th leaf node.

[0096] Before executing this step, you can also pre-select a preset algorithm and generate a key for the preset algorithm. For example, select the AES algorithm and generate its key .

[0097] This step can encrypt each data block based on a preset algorithm, and store each encrypted data block in a path corresponding to the path information in the data block in a preset data tree. Preferably, the encrypted data block is stored in a block close to a leaf node in the path corresponding to the path information in the data block.

[0098] This step can encrypt each data item in the data to be stored based on a preset algorithm, and store each encrypted data item in the data to be stored in the path corresponding to the random number of the data item in the data tree. Preferably, the encrypted data item is stored in a block close to a leaf node in the path corresponding to the random number of the data item. More preferably, the random number of the data item is added to the data item before the data item is stored in the path corresponding to the random number.

[0099] For example, for the database , generate a new database ; Then use the AES algorithm and its key pair Each data item is encrypted and stored in the data tree The corresponding path.

[0100] In addition, the method can also fill random strings in other storage units in the data tree except for the storage unit storing the data block or the data item, so that all blocks appear to contain data of the same length, thereby avoiding leakage of blocks storing data blocks or data items to cloud service providers.

[0101] In step S204, the corresponding data block is obtained from the cloud server according to the query condition, and the index information and path information in each data block, and the data item pointed to by the query condition is obtained from the cloud server according to the data block and the query condition.

[0102] For example, according to the attached Figure 3 This step is performed in the manner shown, including sub-steps S2041 to S2044.

[0103] In sub-step S2041, the path information and index information of the target data block are determined based on the target key in the query condition and the index information in each data block, wherein the target key is the key of the target data item, the target data item is the data item pointed to by the query condition, and the target data block is the data block corresponding to the target data item.

[0104] This step is used to lock a data block recording the individual count of the target data item among multiple data blocks, so as to subsequently determine and obtain the individual count of the target data item and further determine the random number of the target data item.

[0105] For example, the query condition is the target key , the client can first calculate , then access the local storage ,turn up , that is, the index information of the target data block and path information .

[0106] In sub-step S2042, a path is obtained from the cloud server based on the path information of the target data block, and the target data block is read from the obtained path based on the index information of the target data block.

[0107] In this step, the path information of the target data block can be sent to the cloud server so that the cloud server returns the path; based on a preset algorithm (such as the AES algorithm and its key mentioned in the above embodiment), the data in each block in the path is decrypted to obtain the target data block.

[0108] For example, user access The corresponding binary tree path, and find the corresponding block from this path The target data block .

[0109] In step S2043, the public count in the target data block and the personal count corresponding to the target key are input into the PRF function to obtain a random number for the target data item.

[0110] Among them, the individual count corresponding to the target key is the individual count of the target data item.

[0111] For example, in step S202, the public count and the individual count of each data item in the corresponding multiple data items are input into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items, that is, , then this step can input the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain the random number of the target data item, that is, , wherein the is the random number of the target data item, is the common count within the target data block, the counts the number of individuals in the target data block that correspond to the target key, .

[0112] For example, in step S202, the public count, and the individual count and key of each data item in the corresponding multiple data items are input into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items, that is, , then in this step, the public count in the target data block, the personal count corresponding to the target key and the target key can be input into the PRF function to obtain the random number of the target data item, that is, , wherein the is the random number of the target data item, is the common count within the target data block, the counts the number of individuals in the target data block that correspond to the target key, .

[0113] In step S2044, a path is obtained from the cloud server based on the random number of the target data item, and the target data item is read from the obtained path based on the target key.

[0114] In this step, the random number of the target data item can be sent to the cloud server so that the cloud server returns the path; based on a preset algorithm (such as the AES algorithm and its key mentioned in the above embodiment), the data in each block in the path is decrypted to obtain the target data item.

[0115] For example, the target data item read is .

[0116] The method may also include the following path updating step: updating the personal count corresponding to the target key in the target data block in an incremental manner, and inputting the public count and the updated personal count into the PRF function to obtain an updated result of the random number of the target data item; and storing the target data item in the path corresponding to the updated result of the random number of the target data item in the data tree.

[0117] The method may further include: updating the path information of the target data block, and storing the target data block in a path in the data tree corresponding to the update result of the path information in the target data block.

[0118] That is to say, each time a data block is read, its path on the data tree will be updated by updating its personal count. Therefore, when a data item is read multiple times, the cloud service provider cannot know that the data item has been read multiple times, because the path is different each time the data item is read. For example, if a bank encrypts all its users' account information and stores it on a cloud server, when Alice goes to the bank to deposit or withdraw money on the first day, the bank can download back Alice's data without letting the cloud service provider know that the data belongs to Alice. Moreover, if Alice also goes to the bank to deposit or withdraw money on the second day, the bank can ensure that when downloading back Alice's data, the cloud service provider will not know that the same person has come to the bank to deposit or withdraw money for two consecutive days. That is, the cloud service provider does not know whether the data accessed on two days is the same.

[0119] It should be understood that the personal count has a maximum value. If a personal count reaches the maximum value during the process of updating the personal count, it can no longer be updated by incrementing. At this time, the personal count can be set to 0, and the public count can be incremented. At the same time, the random numbers and paths of the data items corresponding to other personal counts are updated along with the public count.

[0120] Preferably, the initial values ​​of the public count and the personal count are 0, thereby increasing the number of updates; of course, if this is the case, the key needs to be input into the PRF function together with the public count and the personal count when generating the random number of the data item.

[0121] This method stores data items in a specific path rather than a specific storage unit block, which can prevent the cloud service provider from knowing the specific storage block of the queried data item when the user queries the data item, thereby preventing the cloud service provider from knowing which blocks are accessed.

[0122] This method records the path where the data item is located through the public count and personal count stored in the data block of the cloud server, and the PRF function is stored locally to prevent the path where the data item is located from being leaked, further improving data security and avoiding information leakage during data query. In particular, each data block can record the paths where multiple data items are located through multiple personal counts, with a high compression rate, thereby improving the efficiency of users in finding the paths where data items are located and improving data query efficiency; that is, users only need to store the PRF function locally, as well as the index information and path information of a small number of data blocks, to achieve data location confidentiality and query efficiency improvement, solving the problem in the Path ORAM solution that requires users to store all keys locally or interact with the cloud server each time. Technical issues in accessing data.

[0123] This method can help users secretly access their own data in the cloud encrypted database and protect their data security and privacy from the cloud service provider. That is, users can download back a piece of their own data without letting the cloud service provider know which data they are downloading. Moreover, while supporting efficient access, this method achieves a very high compression ratio so that the client's storage can be very small, and there is no need to pay the price of probabilistic efficiency loss, which can ensure that the worst-case and best-case performances are consistent.

[0124] In some embodiments of the present disclosure, step S202 in the above embodiment can add a common count and an individual count of each data item in the corresponding multiple data items in the data block in the following manner: add a first count group and a second count group in the data item, wherein the first count group and the second count group both include a common count and an individual count of each data item in the corresponding multiple data items, and the initial value of the individual count of each data item in the first count group is not 0, and the initial value of the individual count of each data item in the second count group is 0.

[0125] Preferably, initial values ​​of the common counts in the first counting group and the second counting group are both 0.

[0126] For example, the example above generates The structure of the jth data block in the data blocks is: ,in, is index information, such as indicating that the multiple data items corresponding to the data block are the (j-1)X-1th data item to the jXth data item, is the common count in the first count group, are, in order, the individual counts of the 1st, 2nd, ..., Xth data items in the multiple data items corresponding to the data block in the first counting group, is the common count in the first count group, are, in order, the individual counts of the 1st, 2nd, ..., Xth data items in the multiple data items corresponding to the data block in the second counting group, The path information of the data block is used to represent the path where the data block is stored on the data tree. .

[0127] In an example (hereinafter referred to as a storage example), based on the dual counting group design of the first counting group and the second counting group, step S202 in the above embodiment can input the common count and the individual count of each data item in the corresponding multiple data items into a preset PRF function in the following manner to obtain a random number for each data item in the corresponding multiple data items: input the common count in the first counting group and the individual count of each data item into a preset PRF function to obtain a random number for each data item in the multiple data items corresponding to the data block.

[0128] For example, the common count in the first counting group and the individual count of each data item, as well as the key of the individual count of each data item in the first counting group and the order of the first counting group are input into a preset PRF function to obtain a random number for each of the multiple data items corresponding to the data block, that is, the i-th data item is obtained according to the following formula: Random number :

[0129]

[0130] In the above formula, It is used to represent the order of the data block where the data item is located. It is used to represent the order of the data item in the multiple data items corresponding to its corresponding data block. To find the remainder function, The range is 1 to , is the key for this data item, 0 indicates the order of the first counting group.

[0131] In an example (hereinafter referred to as a query example), based on the dual count group design of the first count group and the second count group, sub-step S2043 in the above embodiment can input the public count in the target data block and the personal count corresponding to the target key into the PRF function in the following manner to obtain the random number of the target data item:

[0132] In response to the personal count corresponding to the target key in the first count group within the target data block being non-0, the public count in the first count group, the personal count corresponding to the target key, and the order of the first count group are input into the PRF function to obtain a random number for the target data item.

[0133] For example, the public count in the first count group, the personal count corresponding to the target key, and the order of the target key and the first count group are input into the PRF function to obtain a random number for the target data item. , wherein the is the random number of the target data item, is the common count in the first count group in the target data block, counts the individuals corresponding to the target key in the first count group within the target data block, , 0 is the order of the first counting group, is the target key.

[0134] In response to the personal count corresponding to the target key in the first count group within the target data block being 0, the public count in the second count group, the personal count corresponding to the target key, and the order of the second count group are input into the PRF function to obtain a random number for the target data item.

[0135] For example, the public count in the second count group, the personal count corresponding to the target key, and the order of the target key and the second count group are input into the PRF function to obtain a random number for the target data item. , wherein the is the random number of the target data item, is the common count in the second count group in the target data block, counts the number of individuals in the second count group within the target data block that correspond to the target key, , 1 is the order of the second counting group, is the target key.

[0136] In an example (hereinafter referred to as update example 1), based on the dual counting group design of the first counting group and the second counting group, if the random number of the target data item in substep S2043 of the above embodiment is obtained based on the first counting group, then the path update step in the above embodiment can update the individual count corresponding to the target key in the target data block in an incremental manner in the following manner, and input the public count and the updated individual count into the PRF function to obtain the update result of the random number of the target data item:

[0137] In response to the fact that the personal count corresponding to the target key in the first counting group has not reached a preset maximum value, the personal count corresponding to the target key in the first counting group is updated in an incremental manner, and the public count and the updated personal count in the first counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0138] For example, the public count and the updated personal count in the first count group, as well as the target key and the order of the first count group are input into the PRF function to obtain the update result of the random number of the target data item. That is, the update result of the random number of the target data item is calculated according to the following formula:

[0139] ,

[0140] In the above formula, is the update result of the individual count corresponding to the target key in the first count group, The update result of the random number of the target data item.

[0141] In response to the personal count corresponding to the target key in the first counting group reaching a preset maximum value and there being a non-zero personal count in the second counting group, the personal count corresponding to the target key in the first counting group is set to 0, the personal count corresponding to the target key in the second counting group is updated in an incremental manner, and the public count and the updated personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0142] For example, the public count and the updated personal count in the second count group, as well as the target key and the order of the second count group are input into the PRF function to obtain the update result of the random number of the target data item. That is, the update result of the random number of the target data item is calculated according to the following formula:

[0143]

[0144] In the above formula, is the update result of the individual count corresponding to the target key in the first count group, is the update result of the individual count corresponding to the target key in the second count group, Count the individuals corresponding to the target key in the second count group, is the update result of the random number of the target data item, and 1 is the order of the second counting group.

[0145] In response to the personal count corresponding to the target key in the first counting group reaching a preset maximum value and there being no non-zero personal count in the second counting group, the personal count corresponding to the target key in the first counting group is set to 0, the public count in the second counting group and the personal count corresponding to the target key are updated in an incremental manner, and the updated public count and personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0146] For example, the updated public count and personal count in the second count group, as well as the target key and the order of the second count group are input into the PRF function to obtain the update result of the random number of the target data item. That is, the update result of the random number of the target data item is calculated according to the following formula:

[0147]

[0148] In the above formula, is the update result of the individual count corresponding to the target key in the first count group, is the update result of the individual count corresponding to the target key in the second count group, Count the individuals corresponding to the target key in the second count group, is the update result of the common count in the second count group, is the common count in the second count group, is the update result of the random number of the target data item, and 1 is the order of the second counting group.

[0149] In an example (hereinafter referred to as update example 2), based on the dual counting group design of the first counting group and the second counting group, if the random number of the target data item in substep S2043 of the above embodiment is obtained based on the second counting group, then the path update step in the above embodiment can update the individual count corresponding to the target key in the target data block in an incremental manner in the following manner, and input the public count and the updated individual count into the PRF function to obtain the update result of the random number of the target data item:

[0150] In response to the fact that the personal count corresponding to the target key in the second counting group has not reached a preset maximum value, the personal count corresponding to the target key in the second counting group is updated incrementally, and the public count and the updated personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0151] For example, the public count and the updated personal count in the second count group, as well as the target key and the order of the second count group are input into the PRF function to obtain the update result of the random number of the target data item. That is, the update result of the random number of the target data item is calculated according to the following formula:

[0152] ,

[0153] In the above formula, is the update result of the individual count corresponding to the target key in the second count group, is the update result of the random number of the target data item, and 1 is the order of the second counting group.

[0154] In response to the personal count corresponding to the target key in the second counting group reaching a preset maximum value and there being a non-zero personal count in the first counting group, the personal count corresponding to the target key in the second counting group is set to 0, the personal count corresponding to the target key in the first counting group is updated in an incremental manner, and the public count and the updated personal count in the first counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0155] For example, the public count and the updated personal count in the first count group, as well as the target key and the order of the first count group are input into the PRF function to obtain the update result of the random number of the target data item. That is, the update result of the random number of the target data item is calculated according to the following formula:

[0156]

[0157] In the above formula, is the update result of the individual count corresponding to the target key in the second count group, is the update result of the individual count corresponding to the target key in the first count group, The individual count corresponding to the target key in the first count group, It is the update result of the random number of the target data item, and 0 is the order of the first counting group.

[0158] In response to the personal count corresponding to the target key in the second counting group reaching a preset maximum value and there being no non-zero personal count in the first counting group, the personal count corresponding to the target key in the second counting group is set to 0, the public count in the first counting group and the personal count corresponding to the target key are updated in an incremental manner respectively, and the updated public count and personal count in the first counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0159] For example, the updated public count and personal count in the first count group, as well as the target key and the order of the first count group are input into the PRF function to obtain the update result of the random number of the target data item. That is, the update result of the random number of the target data item is calculated according to the following formula:

[0160]

[0161] In the above formula, is the update result of the individual count corresponding to the target key in the second count group, is the update result of the individual count corresponding to the target key in the first count group, The individual count corresponding to the target key in the first count group, is the update result of the common count in the first count group, is the common count in the first count group, It is the update result of the random number of the target data item, and 0 is the order of the first counting group.

[0162] It can be seen from the above storage example, query example, update example 1 and update example 2 that this embodiment sets two count groups, the first count group and the second count group, in the data block, so that the data item is more flexible in the query and path update process, and can switch to another count group for use when the personal count in a currently used count group reaches the maximum value, thereby solving the technical problem of requiring path update for all other data blocks corresponding to the data block when the personal count in one count group reaches the maximum value. This is because the public count group needs to be updated when the personal count in one count group reaches the maximum value, and the update of the public count group will involve all data blocks corresponding to the data block.

[0163] Specifically, in the initial stage, the present embodiment uses the first counting group to record the path (i.e., random number) of the data item corresponding to the data block. In the subsequent query process, each time the data item is queried, its personal count is updated in an incremental manner; until the personal count of a certain data item reaches the maximum value for the first time, then the public count of the second counting group and the personal count of the data item are updated in an incremental manner, and the new path of the data item is determined based on the public count and personal count updated by the second counting group; subsequently, if the personal counts of other data items in the first counting group also reach the maximum value, only the personal counts in the second counting group can be updated in an incremental manner, and the new path of the data item is determined based on the public count of the second counting group and the updated personal count, until the path records of all data items are migrated to the second counting group. In the subsequent query process, the path records of the data items will be alternately migrated between the first counting group and the second counting group, thereby avoiding the technical problem that the paths of all data items need to be redundantly updated when the personal count of a certain data item reaches the maximum value.

[0164] It should be understood that the access frequencies of different data items vary, and the differences may even be very large. In the above update examples 1 and 2, the paths of data items are updated as they are queried (i.e., accessed), and the path records are alternately migrated between the first count group and the second count group. In order to make the path records of all data items in the same count group as much as possible, the method can also perform a backup query each time a data item is queried, such as each time the above query example is executed, in the following manner:

[0165] The first case: in response to the public count in the first counting group being greater than the public count in the second counting group, and there being non-zero personal counts in the second counting group, at least one non-zero personal count in the second counting group is set to 0, the corresponding personal count in the first counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated personal count in the first counting group.

[0166] In this case, it can be seen from the fact that the public count in the first counting group is greater than the public count in the second counting group, and there is a non-zero personal count in the second counting group that the path record of the data item corresponding to the current data block is being migrated from the second counting group to the first counting group, and the above migration has not yet been completed; therefore, at this time, while querying a certain data item, you can back up and query another data item whose path record is still in the second counting group and migrate its path record to the first counting group.

[0167] The second situation: in response to the public count in the first counting group being less than the public count in the second counting group, and there being non-zero personal counts in the first counting group, at least one non-zero personal count in the first counting group is set to 0, the corresponding personal count in the second counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated personal count in the second counting group.

[0168] It can be seen from the fact that the common count in the first counting group is smaller than the common count in the second counting group that the path record of the data item corresponding to the current data block is being migrated from the first counting group to the second counting group, and it can be seen from the fact that there are non-zero personal counts in the first counting group that the above migration has not yet been completed; therefore, at this time, while querying a certain data item, you can back up and query another data item whose path record is still in the first counting group and migrate its path record to the second counting group.

[0169] The third case: in response to the public count in the first counting group being greater than the public count in the second counting group, and there being no non-zero individual count in the second counting group, a path of the data tree is randomly accessed.

[0170] Since the public count in the first counting group is greater than the public count in the second counting group, and there is no non-zero personal count in the second counting group, it can be known that the path records of all data items corresponding to the current data block are in the first counting group, so there is no need to perform the above backup query. However, the operation can be kept consistent with the backup query by randomly accessing a path in the data tree, so that the cloud service provider cannot know when the backup query is being performed, further improving data security and privacy confidentiality.

[0171] Fourth situation: in response to the public count in the first counting group being smaller than the public count in the second counting group, and there being no non-zero individual count in the first counting group, a path of the data tree is randomly accessed.

[0172] Since the public count in the second counting group is greater than the public count in the first counting group, and there is no non-zero personal count in the first counting group, it can be known that the path records of all data items corresponding to the current data block are in the second counting group, so there is no need to perform the above backup query. However, the operation can be kept consistent with the backup query by randomly accessing a path in the data tree, so that the cloud service provider cannot know when the backup query is being performed, further improving data security and privacy confidentiality.

[0173] In this example, backup queries can enable the data items with lower access frequencies to complete the migration of path records along with the data items with higher access frequencies, that is, they can be migrated alternately between the first count group and the second count group, thereby ensuring that the path records of the data items corresponding to the data block are in the same count group; and the path records of all other data items will not be updated when the individual count of any data item reaches the maximum value in the case of one count group. In other words, backup queries are evenly distributed to each normal query, which will not cause the delay of the normal query to be too high, while in the case of one count group, when the individual count of any data item reaches the maximum value, the query will be delayed very high.

[0174] The data management method applied to the cloud server may include the following steps:

[0175] Receive the data tree sent by the client for storage;

[0176] A path acquisition request sent by a client is received, and a corresponding path in the data tree is sent to the client based on the path acquisition request, wherein the path acquisition request includes index information or a random number.

[0177] The details involved in the above steps have been introduced in detail in the method introduction on the client side, and will not be repeated here.

[0178] Figure 4 is a schematic structural diagram of a device provided by an exemplary embodiment. Figure 4 At the hardware level, the device includes a processor 402, an internal bus 404, a network interface 406, a memory 408, and a non-volatile memory 410, and may also include hardware required for other tasks. One or more embodiments of this specification may be implemented based on software, such as the processor 402 reading the corresponding computer program from the non-volatile memory 410 into the memory 408 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0179] Please refer to Figure 5 , the data management device can be used for Figure 4 The client installed on the device shown in the figure implements the technical solution of this specification. The data management device may include:

[0180] A generating module 501 is used to generate a plurality of data blocks according to the number of data items in the data to be stored, wherein each data block corresponds to a plurality of data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all the data items of the data to be stored;

[0181] An adding module 502 is used to add path information, a common count and an individual count of each data item in the corresponding multiple data items, and index information of the corresponding multiple data items in each data block, and input the common count and the individual count of each data item in the corresponding multiple data items into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items;

[0182] The storage module 503 is used to store each data block in a path corresponding to the path information in the data block in a preset data tree, store each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, and send the data tree to the cloud server for storage;

[0183] The query module 504 is used to obtain the corresponding data block from the cloud server according to the query condition, and the index information and path information in each data block, and obtain the data item pointed to by the query condition from the cloud server according to the data block and the query condition.

[0184] In some embodiments of this specification, the generating module is used to:

[0185] The data to be stored is divided into multiple data fragments based on a preset number of divisions, and multiple data blocks corresponding to the multiple data fragments are generated, wherein the data to be stored includes multiple data items, and each data fragment of the multiple data fragments except the last data fragment includes the number of data items divided.

[0186] In some embodiments of the present specification, the adding module is used to input the common count and the individual count of each data item in the corresponding multiple data items into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items, and is used to:

[0187] The public count, and the individual count and key of each data item in the corresponding plurality of data items are input into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items.

[0188] In some embodiments of the present specification, the adding module is used to store each data block in a path corresponding to the path information in the data block in a preset data tree, and to store each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, and is used to:

[0189] Encrypting each data block based on a preset algorithm, and storing each encrypted data block in a path corresponding to the path information in the data block in a preset data tree;

[0190] Each data item in the data to be stored is encrypted based on a preset algorithm, and each encrypted data item in the data to be stored is stored in a path in the data tree corresponding to the random number of the data item.

[0191] In some embodiments of this specification, the device further includes an expansion module, which is used to:

[0192] Before storing each data item in the data to be stored in the path corresponding to the random number of the data item in the data tree, for each data item in the data to be stored, the random number of the data item is added to the data item.

[0193] In some embodiments of this specification, the device further includes a filling module, which is used to:

[0194] The other storage units in the data tree except the storage unit storing the data block or the data item are filled with random character strings.

[0195] In some embodiments of this specification, the query module is used to:

[0196] Determine the path information and index information of the target data block according to the target key in the query condition and the index information in each data block, wherein the target key is the key of the target data item, the target data item is the data item pointed to by the query condition, and the target data block is the data block corresponding to the target data item;

[0197] Acquire a path from the cloud server based on the path information of the target data block, and read the target data block from the acquired path based on the index information of the target data block;

[0198] Inputting the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain a random number for the target data item;

[0199] A path is obtained from the cloud server based on the random number of the target data item, and the target data item is read from the obtained path based on the target key.

[0200] In some embodiments of this specification, the device further includes an updating module, which is used to:

[0201] The personal count corresponding to the target key in the target data block is updated in an incremental manner, and the public count and the updated personal count are input into the PRF function to obtain an updated result of the random number of the target data item;

[0202] The target data item is stored in a path in the data tree corresponding to an update result of the random number of the target data item.

[0203] In some embodiments of the present specification, when the adding module is used to add the common count and the individual count of each data item in the corresponding plurality of data items in the data block, it is used to:

[0204] Adding a first count group and a second count group in the data item, wherein the first count group and the second count group both include a common count and an individual count of each data item in the corresponding plurality of data items, and an initial value of the individual count of each data item in the first count group is non-0, and an initial value of the individual count of each data item in the second count group is 0;

[0205] The step of inputting the common count and the individual count of each data item in the corresponding plurality of data items into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items comprises:

[0206] The common count in the first count group and the individual count of each data item are input into a preset PRF function to obtain a random number for each data item in the multiple data items corresponding to the data block.

[0207] In some embodiments of the present specification, the query module is used to input the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain the random number of the target data item, and is used to:

[0208] In response to the individual count corresponding to the target key in the first count group in the target data block being non-zero, inputting the public count in the first count group, the individual count corresponding to the target key, and the order of the first count group into the PRF function to obtain a random number for the target data item;

[0209] In response to the personal count corresponding to the target key in the first count group within the target data block being 0, the public count in the second count group, the personal count corresponding to the target key, and the order of the second count group are input into the PRF function to obtain a random number for the target data item.

[0210] In some embodiments of the present specification, when the random number of the target data item is obtained based on the first count group, the update module is used to update the individual count corresponding to the target key in the target data block in an incremental manner, and input the public count and the updated individual count into the PRF function to obtain an update result of the random number of the target data item, and is used to:

[0211] In response to the individual count corresponding to the target key in the first counting group not reaching a preset maximum value, the individual count corresponding to the target key in the first counting group is updated in an incremental manner, and the public count in the first counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item;

[0212] In response to the individual count corresponding to the target key in the first counting group reaching a preset maximum value, and there being a non-zero individual count in the second counting group, the individual count corresponding to the target key in the first counting group is set to 0, the individual count corresponding to the target key in the second counting group is updated in an incremental manner, and the public count in the second counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item;

[0213] In response to the personal count corresponding to the target key in the first counting group reaching a preset maximum value and there being no non-zero personal count in the second counting group, the personal count corresponding to the target key in the first counting group is set to 0, the public count in the second counting group and the personal count corresponding to the target key are updated in an incremental manner, and the updated public count and personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

[0214] In some embodiments of this specification, the device further includes a migration module, which is used to:

[0215] In response to the public count in the first counting group being greater than the public count in the second counting group, and there being a non-zero individual count in the second counting group, at least one non-zero individual count in the second counting group is set to 0, the corresponding individual count in the first counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the first counting group;

[0216] In response to the public count in the first counting group being less than the public count in the second counting group, and there being non-zero individual counts in the first counting group, at least one non-zero individual count in the first counting group is set to 0, the corresponding individual count in the second counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the second counting group.

[0217] In some embodiments of this specification, the migration module is further used to:

[0218] In response to the public count in the first counting group being greater than the public count in the second counting group, and there being no non-zero individual count in the second counting group, randomly accessing a path in the data tree;

[0219] In response to the public count in the first counting group being less than the public count in the second counting group, and there being no non-zero individual count in the first counting group, a path of the data tree is randomly accessed.

[0220] In some embodiments of this specification, the device further includes an updating module, which is used to:

[0221] The path information of the target data block is updated, and the target data block is stored in the path in the data tree corresponding to the update result of the path information in the target data block.

[0222] The data management device can be used for Figure 4 The cloud server formed on the device shown in the figure can realize the technical solution of this specification. The data management device may include:

[0223] The storage module is used to receive and store the data tree sent by the client.

[0224] The receiving module is used to receive a path acquisition request sent by a client, and send the corresponding path in the data tree to the client based on the path acquisition request, wherein the path acquisition request includes index information or a random number.

[0225] One or more embodiments of the present specification also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the method provided in any of the above embodiments.

[0226] One or more embodiments of the present specification further provide a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method provided in any of the above embodiments.

[0227] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0228] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0229] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0230] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0231] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0232] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0233] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0234] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0235] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0236] The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims

1. A data management method, applied to a client, comprising: Generate multiple data blocks according to the number of data items in the data to be stored, wherein each data block corresponds to multiple data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all the data items of the data to be stored; For each data block, path information, a common count and an individual count of each data item in the corresponding multiple data items, and index information of the corresponding multiple data items are added in the data block, and the common count and the individual count of each data item in the corresponding multiple data items are input into a preset PRF function to obtain a random number for each data item in the corresponding multiple data items, wherein the individual count is marked with the order of the data item in the multiple data items corresponding to the data block; Store each data block in a path corresponding to the path information in the data block in a preset data tree, store each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, and send the data tree to a cloud server for storage; According to the query conditions, as well as the index information and path information in each data block, the corresponding data block is obtained from the cloud server, and according to the data block and the query conditions, the data item pointed to by the query conditions is obtained from the cloud server, wherein the query conditions include a target key, which is the key of the target data item, and the target data item is the data item pointed to by the query conditions.

2. The data management method according to claim 1, wherein generating a plurality of data blocks according to the number of data items in the data to be stored comprises: The data to be stored is divided into multiple data fragments based on a preset number of divisions, and multiple data blocks corresponding to the multiple data fragments are generated, wherein the data to be stored includes multiple data items, and each data fragment of the multiple data fragments except the last data fragment includes the number of data items divided.

3. The data management method according to claim 1, wherein the step of inputting the common count and the individual count of each of the corresponding plurality of data items into a preset PRF function to obtain a random number for each of the corresponding plurality of data items comprises: The public count, the individual count of each data item in the corresponding plurality of data items, and the key of each data item are input into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items.

4. The data management method according to claim 1, wherein storing each data block in a path corresponding to the path information in the data block in a preset data tree, and storing each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, comprises: Encrypting each data block based on a preset algorithm, and storing each encrypted data block in a path corresponding to the path information in the data block in a preset data tree; Each data item in the data to be stored is encrypted based on a preset algorithm, and each encrypted data item in the data to be stored is stored in a path in the data tree corresponding to the random number of the data item.

5. The data management method according to claim 1, before storing each data item in the data to be stored in the path corresponding to the random number of the data item in the data tree, the method further comprises: For each data item in the data to be stored, a random number of the data item is added to the data item.

6. The data management method according to claim 1, further comprising: The other storage units in the data tree except the storage unit storing the data block or the data item are filled with random character strings.

7. The data management method according to claim 1, wherein the step of obtaining the corresponding data block from the cloud server according to the query condition and the index information and path information in each data block, and obtaining the data item pointed to by the query condition from the cloud server according to the data block and the query condition comprises: Determine the path information and index information of the target data block according to the target key in the query condition and the index information in each data block, wherein the target data block is the data block corresponding to the target data item; Acquire a path from the cloud server based on the path information of the target data block, and read the target data block from the acquired path based on the index information of the target data block; Inputting the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain a random number for the target data item; A path is obtained from the cloud server based on the random number of the target data item, and the target data item is read from the obtained path based on the target key.

8. The data management method according to claim 7, further comprising: The personal count corresponding to the target key in the target data block is updated in an incremental manner, and the public count and the updated personal count are input into the PRF function to obtain an updated result of the random number of the target data item; The target data item is stored in a path in the data tree corresponding to an update result of the random number of the target data item.

9. The data management method according to claim 8, wherein adding a common count and an individual count of each of the corresponding plurality of data items in the data block comprises: Adding a first count group and a second count group in the data item, wherein the first count group and the second count group both include a common count and an individual count of each data item in the corresponding plurality of data items, and an initial value of the individual count of each data item in the first count group is non-0, and an initial value of the individual count of each data item in the second count group is 0; The step of inputting the common count and the individual count of each data item in the corresponding plurality of data items into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items comprises: The common count in the first count group and the individual count of each data item are input into a preset PRF function to obtain a random number for each data item in the multiple data items corresponding to the data block.

10. The data management method according to claim 9, wherein the step of inputting the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain the random number of the target data item comprises: In response to the individual count corresponding to the target key in the first count group in the target data block being non-zero, inputting the public count in the first count group, the individual count corresponding to the target key, and the order of the first count group into the PRF function to obtain a random number for the target data item; In response to the personal count corresponding to the target key in the first count group within the target data block being 0, the public count in the second count group, the personal count corresponding to the target key, and the order of the second count group are input into the PRF function to obtain a random number for the target data item.

11. The data management method according to claim 10, wherein when the random number of the target data item is obtained based on the first count group, the individual count corresponding to the target key in the target data block is updated in an incremental manner, and the public count and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item, comprising: In response to the individual count corresponding to the target key in the first counting group not reaching a preset maximum value, the individual count corresponding to the target key in the first counting group is updated in an incremental manner, and the public count in the first counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item; In response to the individual count corresponding to the target key in the first counting group reaching a preset maximum value, and there being a non-zero individual count in the second counting group, the individual count corresponding to the target key in the first counting group is set to 0, the individual count corresponding to the target key in the second counting group is updated in an incremental manner, and the public count in the second counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item; In response to the personal count corresponding to the target key in the first counting group reaching a preset maximum value and there being no non-zero personal count in the second counting group, the personal count corresponding to the target key in the first counting group is set to 0, the public count in the second counting group and the personal count corresponding to the target key are updated in an incremental manner, and the updated public count and personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

12. The data management method according to claim 11, further comprising: In response to the public count in the first counting group being greater than the public count in the second counting group, and there being a non-zero individual count in the second counting group, at least one non-zero individual count in the second counting group is set to 0, the corresponding individual count in the first counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the first counting group; In response to the public count in the first counting group being less than the public count in the second counting group, and there being non-zero individual counts in the first counting group, at least one non-zero individual count in the first counting group is set to 0, the corresponding individual count in the second counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the second counting group.

13. The data management method according to claim 12, further comprising: In response to the public count in the first counting group being greater than the public count in the second counting group, and there being no non-zero individual count in the second counting group, randomly accessing a path in the data tree; In response to the public count in the first counting group being less than the public count in the second counting group, and there being no non-zero individual count in the first counting group, a path of the data tree is randomly accessed.

14. The data management method according to claim 7, further comprising: The path information of the target data block is updated, and the target data block is stored in the path in the data tree corresponding to the update result of the path information in the target data block.

15. A data management device, applied to a client, comprising: A generating module, configured to generate a plurality of data blocks according to the number of data items in the data to be stored, wherein each data block corresponds to a plurality of data items in the data to be stored, different data blocks correspond to different data items, and the data items corresponding to all data blocks are all the data items of the data to be stored; An adding module, for adding, for each data block, path information, a common count and an individual count of each data item in a corresponding plurality of data items, and index information of the corresponding plurality of data items in the data block, and inputting the common count and the individual count of each data item in the corresponding plurality of data items into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items, wherein the individual count is marked with an order of the data item in the plurality of data items corresponding to the data block; A storage module, used to store each data block in a path corresponding to the path information in the data block in a preset data tree, store each data item in the data to be stored in a path corresponding to the random number of the data item in the data tree, and send the data tree to a cloud server for storage; A query module is used to obtain the corresponding data block from the cloud server according to the query conditions, as well as the index information and path information in each data block, and to obtain the data item pointed to by the query condition from the cloud server according to the data block and the query conditions, wherein the query conditions include a target key, which is the key of the target data item, and the target data item is the data item pointed to by the query condition.

16. The data management device according to claim 15, wherein the query module is used for: According to the target key in the query condition and the index information in each data block, the path information and index information of the target data block are determined, where: The target key is the key of the target data item, the target data item is the data item pointed to by the query condition, and the target data block is the data block corresponding to the target data item; Acquire a path from the cloud server based on the path information of the target data block, and read the target data block from the acquired path based on the index information of the target data block; Inputting the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain a random number for the target data item; A path is obtained from the cloud server based on the random number of the target data item, and the target data item is read from the obtained path based on the target key.

17. The data management device according to claim 16, further comprising an updating module, configured to: The personal count corresponding to the target key in the target data block is updated in an incremental manner, and the public count and the updated personal count are input into the PRF function to obtain an updated result of the random number of the target data item; The target data item is stored in a path in the data tree corresponding to an update result of the random number of the target data item.

18. The data management device according to claim 17, wherein the adding module is used to add the common count and the individual count of each data item in the corresponding plurality of data items in the data block, to: Adding a first count group and a second count group within the data item, wherein: The first counting group and the second counting group both include a common count and an individual count of each data item in the corresponding plurality of data items, and an initial value of the individual count of each data item in the first counting group is non-0, and an initial value of the individual count of each data item in the second counting group is 0; The step of inputting the common count and the individual count of each data item in the corresponding plurality of data items into a preset PRF function to obtain a random number for each data item in the corresponding plurality of data items comprises: The common count in the first count group and the individual count of each data item are input into a preset PRF function to obtain a random number for each data item in the multiple data items corresponding to the data block.

19. The data management device according to claim 18, wherein the query module is used to input the public count in the target data block and the personal count corresponding to the target key into the PRF function to obtain the random number of the target data item, and is used to: In response to the individual count corresponding to the target key in the first count group in the target data block being non-zero, inputting the public count in the first count group, the individual count corresponding to the target key, and the order of the first count group into the PRF function to obtain a random number for the target data item; In response to the personal count corresponding to the target key in the first count group within the target data block being 0, the public count in the second count group, the personal count corresponding to the target key, and the order of the second count group are input into the PRF function to obtain a random number for the target data item.

20. The data management device according to claim 19, wherein when the random number of the target data item is obtained based on the first count group, the update module is used to update the individual count corresponding to the target key in the target data block in an incremental manner, and input the public count and the updated individual count into the PRF function to obtain the update result of the random number of the target data item, and is used to: In response to the individual count corresponding to the target key in the first counting group not reaching a preset maximum value, the individual count corresponding to the target key in the first counting group is updated in an incremental manner, and the public count in the first counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item; In response to the individual count corresponding to the target key in the first counting group reaching a preset maximum value, and there being a non-zero individual count in the second counting group, the individual count corresponding to the target key in the first counting group is set to 0, the individual count corresponding to the target key in the second counting group is updated in an incremental manner, and the public count in the second counting group and the updated individual count are input into the PRF function to obtain an updated result of the random number of the target data item; In response to the personal count corresponding to the target key in the first counting group reaching a preset maximum value and there being no non-zero personal count in the second counting group, the personal count corresponding to the target key in the first counting group is set to 0, the public count in the second counting group and the personal count corresponding to the target key are updated in an incremental manner, and the updated public count and personal count in the second counting group are input into the PRF function to obtain an updated result of the random number of the target data item.

21. The data management device according to claim 20, further comprising a migration module, configured to: In response to the public count in the first counting group being greater than the public count in the second counting group, and there being a non-zero individual count in the second counting group, at least one non-zero individual count in the second counting group is set to 0, the corresponding individual count in the first counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the first counting group; In response to the public count in the first counting group being less than the public count in the second counting group, and there being non-zero individual counts in the first counting group, at least one non-zero individual count in the first counting group is set to 0, the corresponding individual count in the second counting group is updated in an incremental manner, and the path of the corresponding data item is updated based on the updated individual count in the second counting group.

22. A computer program product comprising a computer program / instructions, which when executed by a processor implement the steps of the method according to any one of claims 1 to 14.

23. An electronic device, comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 14 by running the executable instructions.

24. A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 14.

Images