Design method for querying encrypted data

Abstract

The invention discloses a design method for querying encrypted data, which comprises the following steps of: S1, designing a database table structure, and additionally adding an extension column on the basis of a business field; s2, presetting a word segmentation rule, and performing word segmentation processing on the original data in the database according to the word segmentation rule to generate a result set; s3, encrypting the result set by adopting an encryption algorithm, and storing the encrypted result set in an expansion column; s4, judging whether the queried keywords conform to a word segmentation rule or not, encrypting the keywords conforming to the word segmentation rule by adopting the same encryption algorithm, and matching ciphertext characters with the extension columns; and S5, performing return operation according to a matching result. According to the design method for querying the encrypted data, fuzzy query can be realized in a word segmentation encryption query mode under the condition of not decrypting the original data, so that the requirements on I / O (Input / Output) operation of a server disk and the occupation of memory resources can be remarkably reduced in a scene of processing a large amount of encrypted data.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a design method for querying encrypted data. Background Art

[0002] In Internet applications, protecting user privacy and data security is of vital importance. For some key data in user information, such as passwords, mobile phone numbers, telephone numbers, detailed addresses, bank card numbers, credit card verification codes, etc., encryption technology is usually used to store them to ensure the security of sensitive information. Different types of sensitive data have different encryption strategies due to their different uses and security requirements. For example, for sensitive information such as passwords, an irreversible hash algorithm is usually used for encryption and storage. This encryption method can effectively prevent brute force cracking. Encrypted information such as passwords does not need to be decrypted or fuzzy searched. When searching, the ciphertext is directly used for full matching. In contrast, information such as mobile phone numbers requires viewing the original content in specific cases and supports fuzzy search functions.

[0003] For fuzzy queries on encrypted data, the traditional approach is to use memory decryption. That is, first retrieve all relevant encrypted data from the database, then decrypt them one by one in the memory, store the decrypted plaintext data in the memory set, and then perform the matching operation. However, when the amount of data is large, this method will result in a large number of disk I / O operations (input / output operations) and high consumption of server memory resources, affecting the response speed and stability of the system. If the data loaded into the memory exceeds the memory capacity limit of the server, it is easy to cause memory overflow and cause the system to crash. Summary of the invention

[0004] The purpose of the present invention is to solve the above-mentioned background technical problems and to propose a design method for querying encrypted data.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] A design method for querying encrypted data, comprising:

[0007] S1. Design the database table structure and add additional extension columns based on the business fields;

[0008] S2. Preset a word segmentation rule, perform word segmentation processing on the original data in the database according to the word segmentation rule, and generate a result set;

[0009] S3, encrypting the result set using an encryption algorithm, and storing the encrypted result set in the extension column, and storing other data in the database in the business field;

[0010] S4, judging whether the queried keyword meets the word segmentation rule, encrypting the keyword meeting the word segmentation rule by using the same encryption algorithm, recording the encrypted keyword as ciphertext characters, and matching the ciphertext characters with the extended column;

[0011] S5. Perform a return operation according to the matching result.

[0012] As a further solution of the present invention: in step S2, the result set includes several substrings.

[0013] As a further solution of the present invention: in the step S3, when encrypting the result set, each substring needs to be encrypted separately, and each encrypted substring is recorded as a ciphertext character string.

[0014] As a further solution of the present invention: in the step S4, when the ciphertext characters are matched with the extended column, the ciphertext characters are used as conditions and fuzzy matching is performed using the LIKE keyword of the SQL statement.

[0015] As a further solution of the present invention: in step S5, if the match is successful, the matching result is returned after the data is assembled, and the assembled data is output.

[0016] As a further solution of the present invention: in step S5, if the matching fails, an empty set is returned.

[0017] As a further solution of the present invention: the assembled data is: the data matched to the result set and the data associated therewith in the business field.

[0018] Beneficial effects of the present invention:

[0019] (1) In the present invention, fuzzy query can be implemented without decrypting the original data through word segmentation encrypted query, so that when processing a large amount of encrypted data, the demand for server disk I / O operations and the occupation of memory resources can be significantly reduced, thereby improving the response speed and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The present invention will be further described below in conjunction with the accompanying drawings.

[0021] Figure 1 It is a flow chart of the design method for querying encrypted data of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] See also Figure 1 As shown, the present invention is a design method for querying encrypted data, comprising:

[0024] S1. Design the database table structure and add additional extension columns based on the business fields.

[0025] S2. Preset a word segmentation rule, perform word segmentation processing on the original data in the database according to the word segmentation rule, and generate a result set.

[0026] Specifically, according to the word segmentation rules, the original data is processed by word segmentation to form several substrings, and the combination of several substrings is the result set.

[0027] Example: The preset word segmentation rule is: combine 3 consecutive numbers. At this time, the original data (such as the mobile phone number "18211323395") is segmented according to the word segmentation rule to obtain a series of substring result sets, which are {182, 821, 211, 113, 132, 323, 233, 339, 395}.

[0028] S3. Encrypt the result set using an encryption algorithm, and store the encrypted result set in the extended column. Other data in the database is stored in the business field.

[0029] When encrypting the result set, each substring needs to be encrypted separately, and each encrypted substring is recorded as a ciphertext string.

[0030] Specific encryption algorithms include but are not limited to symmetric encryption algorithms, asymmetric encryption algorithms, and hash algorithms.

[0031] In the example of step S2, after step S3 is performed and each substring is encrypted separately, the resulting ciphertext string list is "encrypt182, encrypt821, encrypt211, encrypt113, encrypt132, encrypt323, encrypt233, encrypt339, encrypt395". At this time, these ciphertext strings form an encrypted result set as a whole, and the encrypted result set is {encrypt182, encrypt821, encrypt211, encrypt113, encrypt132, encrypt323, encrypt233, encrypt339, encrypt395}, and the encrypted result set is stored in the extended column (encrypted_data) of the database.

[0032] S4. Determine whether the queried keyword meets the word segmentation rules, encrypt the keywords that meet the word segmentation rules using the same encryption algorithm, record the encrypted keywords as ciphertext characters, and match the ciphertext characters with the extended column.

[0033] In the example of step S3, when the keyword "132" is queried through step S4, the query keyword ("132") is first encrypted to obtain the ciphertext characters "encrypt132", and then the ciphertext characters are used as conditions to perform a fuzzy matching operation using the LI KE keyword of the SQL statement, such as SELECT * FROM table WHERE encrypted_data L IKE'%encrypt132%'.

[0034] It is understandable that if the query keyword is "1323", because the preset word segmentation rule is: combine 3 consecutive numbers, then the keyword ("1323") does not meet the word segmentation rule, and the user prompt message is returned: "The mobile phone number supports fuzzy search based on 3 numbers, please re-enter."

[0035] S5. Perform a return operation according to the matching result.

[0036] If the match is successful, the matching result is returned after the data is assembled, and the assembled data is output. The assembled data is: the data matched in the result set and the data associated with it in the business field.

[0037] If the match fails, an empty set is returned.

[0038] Specifically, after the operation in the exemplary step S4, it is determined in step S5 that if the match is successful, it means that the relevant data record is found in the result set, and the query result is returned after the data is assembled, and the assembled data is output.

[0039] The inventors found that the method commonly used in the prior art is based on a query encryption system, the key components of which include a data source, an encryption module, a database, a backend service, and a frontend page. The data source refers to analyzing and preprocessing the data entered by the user to obtain the original data of the key information, and performing word segmentation processing on the original data according to certain rules to generate a series of keywords or phrases. The encryption module refers to encrypting the original data and the generated keywords to ensure the security of the data. The database refers to storing the encrypted results of the original data and the word segmentation in the database, and constructing a fast retrieval index for subsequent query use. The backend service refers to providing an interface or API to allow the frontend page to submit a query request, encrypt the query conditions, and then match them with the stored encrypted word segmentation. The frontend interface refers to the user entering the query conditions through this interface and viewing the query results.

[0040] Based on the method of querying the encryption system, it is necessary to first retrieve all the encrypted data related to the query conditions from the database, and then decrypt these data one by one in the memory. After the decryption is completed, the obtained plaintext data is temporarily stored in a memory set. Finally, the plaintext data set is fuzzy matched. If the match is successful, it means that the relevant data is found, and the result is returned after the data is encapsulated. This method is simple and fast, and is suitable for situations where the amount of data is small. However, in the case of a large amount of data, the retrieval process from the database takes a long time, and it is also easy to cause a large number of disk I / O operations and high consumption of server memory resources, increasing the disk burden, and thus affecting the response speed and stability of the system; in addition, decrypting a large amount of encrypted data one by one will consume more CPU and memory resources, and the decryption process is also easy to increase the CPU utilization and increase the burden on the server; in terms of the use of memory sets, the decrypted plaintext data is stored in the memory set. As the amount of data increases, the memory consumption will rise rapidly, especially when the amount of data exceeds the server memory capacity, it will also cause a memory overflow error, causing the application to crash or become unresponsive. In the case of high memory consumption, the garbage collection mechanism may be triggered frequently, which also increases the burden on the CPU and may cause the application to pause and delay.

[0041] It is understandable that as the amount of data increases, the response time will be significantly extended, the user experience will be affected, and the speed at which the system processes requests will decrease, which will also cause users to wait too long.

[0042] In the method of the present application, fuzzy query can be implemented without decrypting the original data through word segmentation encrypted query, fuzzy matching can be performed at the database level, query function can be optimized, memory usage and I / O operations can be reduced, and the demand for server disk I / O operations and memory resource usage can be significantly reduced in scenarios where large amounts of encrypted data are processed, thereby improving the response speed and stability of the system and enhancing the user experience.

[0043] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made according to the scope of application of the present invention should still fall within the scope of the claims of the present invention.

Claims

1. A design method for querying encrypted data, characterized in that: include: S1. Design the database table structure and add additional extension columns based on the business fields; S2. Preset a word segmentation rule, perform word segmentation processing on the original data in the database according to the word segmentation rule, and generate a result set; S3, encrypting the result set using an encryption algorithm, and storing the encrypted result set in the extension column, and storing other data in the database in the business field; S4, judging whether the queried keyword meets the word segmentation rule, encrypting the keyword meeting the word segmentation rule by using the same encryption algorithm, recording the encrypted keyword as ciphertext characters, and matching the ciphertext characters with the extended column; S5. Perform a return operation according to the matching result.

2. A design method for querying encrypted data according to claim 1, characterized in that: In step S2, the result set includes several substrings.

3. A design method for querying encrypted data according to claim 2, characterized in that: In step S3, when encrypting the result set, each substring needs to be encrypted separately, and each encrypted substring is recorded as a ciphertext string.

4. A design method for querying encrypted data according to claim 1, characterized in that: In the step S4, when the ciphertext characters match the extended column, the ciphertext characters are used as conditions and fuzzy matching is performed using the LIKE keyword of the SQL statement.

5. A design method for querying encrypted data according to claim 1, characterized in that: In step S5, if the match is successful, the matching result is returned after the data is assembled, and the assembled data is output.

6. A design method for querying encrypted data according to claim 1, characterized in that: In step S5, if the matching fails, an empty set is returned.

7. A design method for querying encrypted data according to claim 5, characterized in that: The assembled data includes: the data matched in the result set and the data associated therewith in the business field.

Images