Data query method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a data query method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: receiving a data query request, wherein the data query request indicates a query plaintext text and a target column of a to-be-queried target data table; performing word segmentation on the query plaintext text to obtain at least one plaintext text fragment, and performing encryption by adopting a pre-configured encryption algorithm to obtain a ciphertext text fragment corresponding to each plaintext text fragment; according to each ciphertext text fragment, screening out a target filter from candidate filters associated with the target column; obtaining multiple pieces of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column; and adopting a decryption algorithm corresponding to the encryption algorithm to decrypt the multiple pieces of target ciphertext data, and performing data matching with the query plaintext text to obtain a data query result. By adopting the method, the data query efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of data query technology, and in particular to a data query method, device, computer equipment, storage medium and program product. Background Art

[0002] With the rapid development of the Internet and big data technology, data has become one of the core assets of modern society. Some data are sensitive data involving multiple levels such as personal privacy, corporate secrets or national security. Therefore, in order to ensure data security, these data are usually encrypted to form ciphertext data, and the ciphertext data is stored in the database. In practical applications, there is a need to query ciphertext data. Users input the plaintext to be queried and match the ciphertext data stored in the database with the plaintext to be queried to achieve data query. In traditional technology, the full amount of ciphertext data is usually obtained, the full amount of encrypted data is decrypted to obtain the plaintext data, and the decrypted plaintext data is matched with the plaintext to be queried.

[0003] However, the method of decrypting the entire amount of ciphertext data and then matching it with the plaintext to be queried results in low data query efficiency. Summary of the invention

[0004] Based on this, it is necessary to provide a data query method, device, computer equipment, storage medium and program product that can improve data query efficiency in response to the above technical problems.

[0005] In a first aspect, the present application provides a data query method, comprising:

[0006] Receive a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried;

[0007] After segmenting the query plaintext text to obtain at least one plaintext text segment, encrypting the query plaintext text using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment;

[0008] According to each of the ciphertext text fragments, a target filter is selected from the candidate filters associated with the target column;

[0009] Acquire a plurality of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column;

[0010] The decryption algorithm corresponding to the encryption algorithm is adopted to decrypt the multiple target ciphertext data respectively, and then the data is matched with the query plaintext text to obtain the data query result.

[0011] In a second aspect, the present application also provides a data query device, comprising:

[0012] A receiving module, used for receiving a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried;

[0013] A filtering module is used to segment the query plaintext text to obtain at least one plaintext text segment, and then encrypt it using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment; and select a target filter from the candidate filters associated with the target column according to each ciphertext text segment;

[0014] The query module is used to obtain multiple target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column; use a decryption algorithm corresponding to the encryption algorithm to decrypt the multiple target ciphertext data respectively, and then perform data matching with the query plaintext text to obtain a data query result.

[0015] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0016] Receive a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried;

[0017] After segmenting the query plaintext text to obtain at least one plaintext text segment, encrypting the query plaintext text using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment;

[0018] According to each of the ciphertext text fragments, a target filter is selected from the candidate filters associated with the target column;

[0019] Acquire a plurality of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column;

[0020] The decryption algorithm corresponding to the encryption algorithm is adopted to decrypt the multiple target ciphertext data respectively, and then the data is matched with the query plaintext text to obtain the data query result.

[0021] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0022] Receive a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried;

[0023] After segmenting the query plaintext text to obtain at least one plaintext text segment, encrypting the query plaintext text using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment;

[0024] According to each of the ciphertext text fragments, a target filter is selected from the candidate filters associated with the target column;

[0025] Acquire a plurality of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column;

[0026] The decryption algorithm corresponding to the encryption algorithm is adopted to decrypt the multiple target ciphertext data respectively, and then the data is matched with the query plaintext text to obtain the data query result.

[0027] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0028] Receive a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried;

[0029] After segmenting the query plaintext text to obtain at least one plaintext text segment, encrypting the query plaintext text using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment;

[0030] According to each of the ciphertext text fragments, a target filter is selected from the candidate filters associated with the target column;

[0031] Acquire a plurality of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column;

[0032] The decryption algorithm corresponding to the encryption algorithm is adopted to decrypt the multiple target ciphertext data respectively, and then the data is matched with the query plaintext text to obtain the data query result.

[0033] The above-mentioned data query method, device, computer equipment, storage medium and program product, after receiving a data query request, obtains a ciphertext text segmentation and then encrypts the query plaintext text, and then screens out a target filter from the candidate filters associated with the target column based on each ciphertext text segmentation. This means that when storing data, it is also segmented and encrypted before being stored in the filter, which increases the difficulty of cracking the data and ensures data security. Moreover, since the target filter is screened out based on the ciphertext text segment, and the target filter is associated with multiple target ciphertext data, it means that in the preliminary data query process, it is not necessary to decrypt the full amount of ciphertext data stored in the target column, and the target ciphertext data that may match the query plaintext text can be preliminarily screened out, and then only multiple target ciphertext data need to be decrypted and then matched with the query plaintext text, which improves data query efficiency while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0035] FIG1 is a schematic diagram of a flow chart of a data query method in one embodiment;

[0036] FIG2 is a schematic diagram of a data query architecture in one embodiment;

[0037] FIG3 is a schematic diagram of a correlation relationship building process in one embodiment;

[0038] FIG4 is a schematic diagram of a data encryption storage process in one embodiment;

[0039] FIG5 is a schematic diagram of a data query request processing flow in one embodiment;

[0040] FIG6 is a schematic diagram of a fuzzy matching process in one embodiment;

[0041] FIG7 is a structural block diagram of a data query device in one embodiment;

[0042] FIG. 8 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] In one embodiment, as shown in FIG1 , a data query method is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be a personal computer, a laptop computer, a smart phone, a tablet computer, an Internet of Things device, and a portable wearable device. The Internet of Things device can be a smart speaker, a smart TV, a smart air conditioner, a smart car device, a projection device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The head-mounted device can be a virtual reality (VR) device, an augmented reality (AR) device, smart glasses, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. In this embodiment, the method includes the following steps:

[0045] Step 102 , receiving a data query request, where the data query request indicates a query plain text and a target column of a target data table to be queried.

[0046] Among them, the data query request is used to query the data matching the plain text from the target column of the target data table according to the query conditions. The data query request can specifically be a SQL (Structured Query Language) request, which can correspond to an SQL statement. The data query request can specifically include query conditions, identification information of the target data table and identification information of the target column. The identification information can be a number, name or other. The target data table is the data table to be queried in the database. The target column is the column to be queried in the target data table. The columns in the data table can also be understood as fields in the data table. The target column is used to store ciphertext data, which can also be called desensitized data.

[0047] The query condition includes the query plain text and the matching relationship. The matching relationship is the relationship between the query plain text and the data query result to be obtained. The matching relationship can be used for exact matching or fuzzy matching. For example, the matching relationship can be that the query plain text is the same as the data query result, in which case the matching relationship can be used for exact matching. The matching relationship can also be expressed by the logic of the LIKE operator, in which case the matching relationship can be used for fuzzy matching.

[0048] For example, the SQL statement corresponding to the data query request can be "SELECT * FROM user WHERE address LIKE CONCAT('%', 'Qinglong', '%')". Here, "user" can be the name of the target data table, "address" can be the name of the target column, "LIKE CONCAT('%', 'Qinglong', '%')" can be the query condition, and "Qinglong" can be the query plaintext. The meaning of this query condition is to match any string that contains the substring "Qinglong", and the matching relationship in this query condition can be the logic of matching any string that contains the substring.

[0049] Exemplarily, the server can receive a data query request sent by a terminal, parse out the target data table to be queried, the target column in the target data table, and the query condition from the data query request, where the query condition includes the query plaintext.

[0050] Step 104: After segmenting the query plaintext to obtain at least one plaintext segment, encrypt it using a pre-configured encryption algorithm to obtain the ciphertext segment corresponding to each plaintext segment.

[0051] Among them, the segmentation can be implemented through a pre-configured segmentation algorithm. The same segmentation algorithm is used in the query data process and the data storage process. The segmentation algorithm can be a segmentation algorithm based on deep learning. For example, the segmentation algorithm can be Word2Vec (a word vector model open-sourced by Google), GloVe (Global Vectors for Word Representation, a word representation tool based on global word frequency statistics), or others.

[0052] The segmentation algorithm can also be an algorithm based on custom rules. The segmentation algorithm includes the segmentation width and the segmentation logic. The segmentation width is the length of the data segment obtained after segmentation. The segmentation logic can represent the way to obtain the data segment that matches the segmentation width. For example, the segmentation logic can be that each adjacent segment of the segmentation width is used as a data segment after segmentation. For example, according to the segmentation width of two Chinese characters and this segmentation logic, after segmenting "Dongcheng District, Beijing", "Beijing", "Jingshi", "Shidong", "Dongcheng", and "Chengqu" can be obtained. It can be understood that when the width of the query plaintext is the same as the segmentation width, after segmenting the query plaintext, one plaintext segment is obtained, that is, the query plaintext itself is used as the plaintext segment.

[0053] The preconfigured encryption algorithm is a preconfigured algorithm for encrypting data. The query data process and the storage data process use the same encryption algorithm. The query data process can be understood as the process of executing steps 102 to 110. The storage data process can be understood as the process of storing the preset plaintext data to be stored. The encryption algorithm can be an AES (Advanced Encryption Standard) algorithm, a 3DES (Triple DES encryption, DES is called Data Encryption Standard, meaning Data Encryption Standard) algorithm or others.

[0054] Exemplarily, the server may use a preconfigured word segmentation algorithm to segment the query plaintext text to obtain at least one plaintext text segment, and use a preconfigured encryption algorithm to encrypt each plaintext text segment in the at least one plaintext text segment to obtain a ciphertext text segment corresponding to each plaintext text segment.

[0055] Step 106 , based on each ciphertext text segment, select a target filter from the candidate filters associated with the target column.

[0056] The candidate filter is a filter associated with the target column. The target column is used to store pre-encrypted ciphertext data. The target column can be associated with multiple candidate filters, and different candidate filters can be associated with different ciphertext data subsets in the ciphertext data stored in the target column. The ciphertext data subset includes a part of the ciphertext data stored in the target column. The candidate filter is used to filter out the ciphertext data that is not associated with the candidate filter. The ciphertext data not filtered out by the candidate filter may be associated with the candidate filter. The candidate filter can be a Bloom filter.

[0057] Exemplarily, the server may traverse the candidate filters associated with the target column, and in the process of traversing, filter each ciphertext text segment in at least one plaintext text segment through the traversed candidate filter, and when the traversed candidate filter cannot filter out each of at least one plaintext text segment, update the traversed candidate filter to the target filter; and determine the target filter existing when the traversal is completed as the target filter selected from the candidate filters associated with the target column. Among them, when the traversed candidate filter can filter out one or more of at least one plaintext text segment, it can be determined that the traversed candidate filter is not the target filter.

[0058] Step 108: Acquire multiple target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column.

[0059] The ciphertext data is data generated by encrypting the preset plaintext data.

[0060] Exemplarily, the target data table may contain multiple data records, each data record containing a ciphertext data stored in the target column; in this embodiment, the server can obtain multiple target data record identifiers associated with the target filter, and determine the ciphertext data contained in the data records corresponding to the multiple target data record identifiers in the pre-encrypted ciphertext data stored in the target column as multiple target ciphertext data associated with the target filter.

[0061] The data record is a record in the target data table. In some scenarios, a record is also referred to as a row of data in a data table. The target data record identifier is the data record identifier associated with the target filter. The data record identifier is used to uniquely identify a data record in the target data table. The data record identifier can also be referred to as the primary key ID of the data record.

[0062] Step 110, using a decryption algorithm corresponding to the encryption algorithm, decrypting multiple target ciphertext data respectively, and then matching the data with the query plaintext text to obtain a data query result.

[0063] Decryption is the process of restoring data from ciphertext to plaintext. Data matching can be either exact matching or fuzzy matching.

[0064] Exemplarily, the server may adopt a decryption algorithm corresponding to the encryption algorithm to decrypt multiple target ciphertext data respectively, thereby obtaining multiple target plaintext data corresponding to the multiple target ciphertext data one by one, and match the multiple target plaintext data with the query plaintext text according to the query conditions indicated by the data query request to obtain the data query results filtered out from the multiple target plaintext data.

[0065] In the above data query method, after receiving the data query request, the query plaintext text is segmented and then encrypted to obtain the ciphertext text fragment corresponding to each plaintext text fragment obtained by the segmentation, and then the target filter is screened out from the candidate filters associated with the target column according to each ciphertext text fragment, which means that when storing the data, it is also segmented and encrypted before being stored in the filter, which increases the difficulty of cracking the data and ensures data security. Moreover, since the target filter is screened out based on the ciphertext text fragment, and the target filter is associated with multiple target ciphertext data, it means that in the preliminary data query process, it is not necessary to decrypt the full amount of ciphertext data stored in the target column, and the target ciphertext data that may match the query plaintext text can be preliminarily screened out, and then only multiple target ciphertext data need to be decrypted and then matched with the query plaintext text, which improves data query efficiency while ensuring data security.

[0066] In an exemplary embodiment, before step 106, the above-mentioned data query method also includes the following steps: obtaining a pre-stored association table, the association table includes multiple association records, each association record represents the association relationship between a preset data table, a preset column of the preset data table, and a preset filter; determining a candidate association record from the multiple association records, the preset data table and the preset column in the association relationship represented by the candidate association record are respectively the same as the target data table and the target column; determining the preset filter in the association relationship represented by the candidate association record as the candidate filter associated with the target column.

[0067] Among them, the association table is a data table used to map the association relationship. The association record is a record in the association table. Each association record in the association table may contain the identification information of the preset data table, the identification information of the preset column of the preset data table, and the serialized array of the preset filter, so that each association record can represent the association relationship between the preset data table, the preset column of the preset data table, and the preset filter. The serialized array is an array obtained by serializing the preset filter. The preset filter can be obtained by deserializing the serialized array. After the preset filter is serialized, the serialized array can be persistently stored, which can simplify data exchange. The preset data table is a data table preset in the database. The preset column is a column preset in the preset data table. The preset column stores the ciphertext data stored historically.

[0068] The number of candidate association records may be one or more. The identification information of the preset data table included in the candidate association record may be the same as the identification information of the target data table, and the identification information of the preset column included in the candidate association record may be the same as the identification information of the target column, so that the preset data table and preset column in the association relationship represented by the candidate association record are respectively the same as the target data table and the target column.

[0069] Exemplarily, the server may obtain a pre-stored association table, and filter out candidate association records from multiple association records contained in the association table according to the identification information of the target data table and the identification information of the target column, so that the identification information of the preset data table contained in the candidate association record is the same as the identification information of the target data table, and the identification information of the preset column contained is the same as the identification information of the target column.

[0070] In one embodiment, the serialized array of preset filters contained in the candidate association record is deserialized to obtain the preset filters in the association relationship represented by the candidate association record, and the preset filters in the association relationship represented by the candidate association record are determined as candidate filters associated with the target column.

[0071] In this embodiment, the association relationship between the preset data table, the preset columns of the preset data table and the preset filters is recorded through an association table. In this way, the candidate filter associated with the target column can be determined through the association table and the target data table and target column indicated by the data query request, creating conditions for subsequent efficient and secure data query.

[0072] In an exemplary embodiment, each association record represents an association relationship between a preset data table, a preset column of the preset data table, a subset of ciphertext data stored in the preset column, and a preset filter. Step 108 includes: determining a target association record from candidate association records, and the preset filter in the association relationship represented by the target association record is filtered as a target filter; and determining the ciphertext data contained in the subset of ciphertext data in the association relationship represented by the target association record in the pre-encrypted ciphertext data stored in the target column as multiple target ciphertext data associated with the target filter.

[0073] The target data table may include multiple data records, each data record includes a ciphertext data stored in the target column, and each data record corresponds to a data record identifier. Each associated record in the associated table may include identification information of a preset data table, identification information of a preset column of the preset data table, a first data record identifier, a second data record identifier, and a serialized array of preset filters, wherein the first data record identifier and the second data record identifier may indicate a subset of ciphertext data stored in the preset column, so that each associated record may represent the association relationship between the preset data table, the preset column of the preset data table, the subset of ciphertext data stored in the preset column, and the preset filter.

[0074] The preset filter in the association relationship represented by the candidate association record is the candidate filter associated with the target column. After the candidate filters are screened to obtain the target filter, the target association record in the candidate association record can be determined.

[0075] Exemplarily, the ciphertext data subset stored in the preset column in the association relationship represented by each association record can be determined in the following manner: in the target data table, multiple target data record identifiers are determined with the first data record identifier and the second data record identifier contained in the association record as the two ends, and the ciphertext data of the preset column in the association relationship represented by the association record contained in the target data record corresponding to each target data record identifier in the multiple target data record identifiers is determined as the ciphertext data in the ciphertext data subset stored in the preset column in the association relationship represented by the association record.

[0076] The first data record identifier and the second data record identifier are different. For example, the first data record identifier may be 101 and the second data record identifier may be 150. Then, the plurality of target data records are data records whose data record identifiers are between 101 and 150 (including 101 and 150).

[0077] In this embodiment, each association record represents the association relationship between a preset data table, a preset column of the preset data table, a subset of ciphertext data stored in the preset column, and a preset filter. In this way, by determining the target association record where the target filter is located, multiple target ciphertext data associated with the target filter can be determined, creating conditions for subsequent data matching.

[0078] In an exemplary embodiment, each associated record includes identification information of a preset data table, identification information of a preset column, a first data record identifier, a second data record identifier following the first data record identifier, and a serialized array of preset filters. Before step 102, the data query method further includes the step of storing data: receiving a data storage request, the data storage request indicating preset plaintext data, a preset data table to be updated, and a preset column to be updated in the preset data table to be updated; encrypting the preset plaintext data and a plurality of plaintext data fragments obtained after word segmentation of the preset plaintext data using an encryption algorithm to obtain a preset plaintext data. Assume ciphertext data corresponding to plaintext data and multiple ciphertext data fragments corresponding to the multiple plaintext data fragments one by one; store the ciphertext data corresponding to the preset plaintext data in the preset column to be updated to generate an updated data record in the preset data table to be updated; determine the associated record to be updated among the multiple records in the associated table based on the preset data table to be updated, the preset column to be updated, and the data record identifier of the updated data record; update the second data identifier contained in the associated record to be updated according to the data record identifier of the updated data record, and update the serialized array of the preset filter contained in the associated record to be updated according to the multiple ciphertext data fragments.

[0079] The data storage request is used to instruct to encrypt the preset plaintext data to be stored and store it in a preset column in the preset data table. The data storage request may be an SQL request. When performing word segmentation on the preset plaintext data, a preconfigured word segmentation algorithm may be used, which is the same as the word segmentation algorithm used for word segmentation in step 104. The updated data record includes ciphertext data corresponding to the preset plaintext data.

[0080] When a data record is generated in a preset data table, the data record identifier is self-incrementing, that is, each time a data record is generated in the preset data table, the data record identifier of the generated data record is self-incrementing compared to the data record identifier of the last data record existing in the preset data table, and the increase range may be 1. For example, if the data record identifier of the last data record in the preset data record table is 100, a new data record is generated at this time, and the data record identifier of the new data record may be 101. The second data record identifier is after the first data record identifier, which may also indicate that the second data record identifier is greater than the first data record identifier.

[0081] The identification information of the preset data table contained in the associated record to be updated may be the same as the identification information of the preset data table to be updated, and the identification information of the preset column contained in the associated record to be updated may be the same as the identification information of the preset column to be updated, and the second data record identifier contained in the associated record to be updated may be the previous data record identifier of the updated data record.

[0082] Exemplarily, the server may use a preconfigured word segmentation algorithm to segment preset plaintext data to obtain multiple plaintext data fragments, and use an encryption algorithm to encrypt the preset plaintext data and the multiple plaintext data fragments, respectively, to obtain ciphertext data corresponding to the preset plaintext data, and multiple ciphertext data fragments corresponding one to one to the multiple plaintext data fragments.

[0083] In one embodiment, the server may deserialize the serialized array of the preset filter contained in the associated record to be updated to obtain the bit array and multiple hash functions of the preset filter; for each ciphertext data fragment in the multiple ciphertext data fragments, respectively calculate through the multiple hash functions of the preset filter to obtain multiple function values ​​corresponding to each ciphertext data fragment, and set the value of the bit indicated by the multiple function values ​​corresponding to each ciphertext data fragment in the bit array of the preset filter to 1 to update the preset filter; re-serialize the updated preset filter to obtain an updated serialized array, and replace the serialized array of the preset filter contained in the associated record to be updated with the updated serialized array, so as to update the serialized array of the preset filter contained in the associated record to be updated according to the multiple ciphertext data fragments.

[0084] The preset filter may be a Bloom filter. The preset filter does not store the data itself, for example, it does not store the ciphertext data fragment or the ciphertext data itself, but stores the function value obtained by calculating the ciphertext data fragment using the hash function. The amount of data stored by the preset filter is much smaller than the amount of the ciphertext data fragment or the ciphertext data. Therefore, the time complexity of filtering through the preset filter is approximately O(1) (indicating that the execution time of an algorithm does not change with the size of the input data, and the input data can be understood as ciphertext data).

[0085] The bit array of the preset filter may include multiple bits and the value of each bit. The value of the bit in the bit array is 0 by default, and the value of the corresponding bit is set to 1 when an element is added. In the bit array of the filter, the bit indicated by the function value refers to the bit in the bit array of the filter whose bit identifier is the same as the function value. For example, the bit array includes 4 bits with bit identifiers 1, 2, 3, and 4, respectively. When the function value is 3, the bit indicated by the function value in the bit array of the filter is the bit with bit identifier 3. In some scenarios, the bit identifier can also be called a subscript.

[0086] In one embodiment, the server may replace the second data identifier included in the associated record to be updated with the data record identifier of the updated data record, so as to update the second data identifier included in the associated record to be updated according to the data record identifier of the updated data record.

[0087] In this embodiment, after receiving a data storage request, the preset plaintext data and multiple plaintext data fragments obtained after word segmentation of the preset plaintext data are encrypted to obtain ciphertext data corresponding to the preset plaintext data and multiple ciphertext data fragments corresponding to the multiple plaintext data fragments. The ciphertext data is stored in the preset column to be updated, and the multiple ciphertext data fragments are used to update the serialized array of the preset filter, and the preset filter is used to perform preliminary data query in an encrypted state during subsequent data query, thereby improving data security and data query efficiency, and updating the associated records to be updated to ensure the immediate update of the associated relationship, creating conditions for subsequent efficient data query.

[0088] In an exemplary embodiment, each preset filter includes a bit array and multiple hash functions, the bit array includes multiple bits and the value of each bit, the value of each bit is 1 or 0, and before step 102, the above-mentioned data query method also includes the following steps: when the ratio of the number of bits with a value of 1 in the bit array of the preset filter meets the preset adjustment trigger condition, the array length of the bit array of the preset filter is adjusted; based on the number of hash functions in the preset filter and the adjusted bit array of the preset filter, the error rate of the preset filter is determined; when the error rate does not meet the preset error rate condition, the number of hash functions of the preset filter is adjusted so that the error rate of the preset filter meets the preset error rate condition.

[0089] Among them, in order to reduce the false positive rate, the number of multiple hash functions is generally not less than 3. The preset adjustment trigger condition is a preset trigger condition satisfied by adjusting the length of the bit array. The preset adjustment trigger condition may include that the ratio of the number of bits with a value of 1 in the bit array of the preset filter is greater than a first preset ratio, and may also include that the ratio of the number of bits with a value of 1 in the bit array of the preset filter is less than a second preset ratio. The first preset ratio is greater than the second preset ratio. The first preset ratio may be 0.75, and the second preset ratio may be 0.25.

[0090] The length of the bit array of the preset filter is adjusted, including doubling the length of the bit array of the preset filter, or reducing the length of the bit array of the preset filter by half. When the ratio of the number of bits with a value of 1 in the bit array of the preset filter is greater than a first preset ratio, the length of the bit array of the preset filter is doubled. When the ratio of the number of bits with a value of 1 in the bit array of the preset filter is less than a second preset ratio, the length of the bit array of the preset filter is reduced by half.

[0091] The false positive rate refers to the probability that an element is mistakenly identified as existing in the filter. The false positive rate is related to the length of the filter's bit array, the number of elements added, and the number of hash functions. The elements added to the filter are the elements that are set to 1 after the hash function of the filter calculates the value of the indicated bit in the bit array. The preset false positive rate condition can be that the false positive rate is less than the preset false positive rate, or that the false positive rate is within the preset false positive rate range. The preset false positive rate is, for example, 0.01. The preset false positive rate range is, for example, 0.001 to 0.01.

[0092] The steps of this embodiment can be performed in the process of inserting or deleting data in the data table. After the preset filter is adjusted, the ciphertext data subset associated with the preset filter is added to the bit array of the preset filter after the function value is recalculated by the hash function of the adjusted preset filter.

[0093] In this embodiment, when the ratio of the number of bits with a value of 1 in the bit array of the preset filter meets the preset adjustment trigger condition, the array length of the bit array of the preset filter is adjusted, and when the error rate does not meet the preset error rate condition, the number of hash functions of the preset filter is adjusted, so that the length of the bit array is within a reasonable range, which neither wastes storage space nor controls the error rate within a reasonable range, thereby improving storage resource utilization and query efficiency.

[0094] In an exemplary embodiment, the candidate filter includes a bit array and multiple hash functions, the bit array includes multiple bits and the value of each bit, the value of each bit is 1 or 0, and step 106 may include: traversing the candidate filters associated with the target column; for each ciphertext text fragment, calculating through the multiple hash functions of the traversed candidate filters to obtain multiple function values ​​corresponding to the ciphertext text fragment; when in the bit array of the traversed candidate filters, the values ​​of the bits indicated by the multiple function values ​​corresponding to each ciphertext text fragment are all 1, the traversed candidate filter is updated to the target filter; the target filter existing when the traversal is completed is determined as the target filter screened out from the candidate filters associated with the target column.

[0095] Among them, in the bit array of the traversed candidate filter, the bit indicated by the function value is the bit in the bit array of the traversed candidate filter whose bit identifier is the same as the function value. When the values ​​of the bits indicated by the multiple function values ​​corresponding to a ciphertext text segment in the bit array of the traversed candidate filter are all 1, it means that the ciphertext text segment may have been added to the traversed candidate filter. Further, when the values ​​of the bits indicated by the multiple function values ​​corresponding to each ciphertext text segment are all 1, it can be determined that the traversed candidate filter cannot filter out each of at least one plaintext text segment, indicating that the ciphertext data associated with the traversed candidate filter may match the query plaintext text segment. At this time, the traversed candidate filter is determined as the target filter, and then data matching is performed through steps 108 to 110, so that accurate matching can be achieved.

[0096] When in the bit array of the traversed candidate filter, in the ciphertext text fragments corresponding to at least one plaintext text fragment, there is a bit indicated by the function value corresponding to any ciphertext text fragment with a value of 0, it means that the ciphertext data associated with the traversed candidate filter cannot match the query plaintext text fragment, that is, the traversed candidate filter can filter out one or more of the at least one plaintext text fragment, then it can be determined that the traversed candidate filter is not the target filter.

[0097] Exemplarily, the server may traverse the candidate filters associated with the target column, and during the traversal process, for each ciphertext text fragment in at least one plaintext text fragment, calculate through multiple hash functions of the traversed candidate filter to obtain multiple function values ​​corresponding to the ciphertext text fragment; when in the bit array of the traversed candidate filter, the values ​​of the bits indicated by the multiple function values ​​corresponding to each ciphertext text fragment are all 1, the traversed candidate filter is updated to the target filter; when in the bit array of the traversed candidate filter, the value of the bit indicated by any function value in the multiple function values ​​corresponding to any ciphertext text fragment is 0, it is determined that the traversed candidate filter is not the target filter; when the traversal is completed, the target filter that exists when the traversal is completed is determined as the target filter screened out from the candidate filters associated with the target column.

[0098] In this embodiment, the candidate filters associated with the target column are traversed, and for each ciphertext text fragment, multiple hash functions of the traversed candidate filters are calculated to obtain multiple function values, and the values ​​of the bits indicated by the multiple function values ​​in the bit array of the traversed candidate filters are judged. The value of each bit in the bit array is 1 or 0, and the data volume is small. There is no need to decrypt the ciphertext text fragment before matching, so that the matching efficiency between the candidate filters and the ciphertext text fragment is high. While ensuring data security, the target filter can be quickly screened out to improve data query efficiency.

[0099] In a specific application scenario, the server can run the server side, referring to the data query architecture diagram as shown in Figure 2. The server side may include an association relationship building module, a data encryption module, a filter control module, a query request processing module and a data matching module. Based on the data query architecture diagram as shown in Figure 2, the above data query method may specifically include the following steps.

[0100] Referring to the association relationship construction process diagram shown in FIG3 , the association relationship construction module of the server can create an association table (which can be recorded as sensitive_column_bf) and set at least the fields id, table_name, column_name, start_id, end_id, and bf_array in the association table; by creating a Bloom filter object (which can be recorded as a Bloom-Filter object), a preset filter (belonging to the Bloom filter) is created, and the object parameters of the preset filter (the length of the bit array and the hash function (which can be recorded as hash_list)) are configured, the word segmentation width and word segmentation logic of the word segmentation algorithm are configured, and the association relationship algorithm between the preset filter and the ciphertext data indicated by start_id and end_id is configured.

[0101] The association table can be created each time a data storage request is received, or before the data storage request is received. The association table is used to store association records. In each association record, id is used to store the association record identifier (used to distinguish different association records in the association table), table_name is used to store the identification information of the preset data table, column_name is used to store the identification information of the preset column, start_id is used to store the first data record identifier, end_id is used to store the second data record identifier, and bf_array is used to store the serialized array of the preset filter. The length of the bit array of the preset filter can be estimated based on the amount of data planned to be encrypted and stored.

[0102] For example, there is a need to encrypt and store the communication address (address) field (preset column) in the user table (user) in the database. First, create a sensitive_column_bf table, including the fields id, table_name, column_name, start_id, end_id, and bf_array. Set the hash_list of Bloom-Filter to [MurmurHash, JenkinsHash, FNV-1], where MurmurHash is a non-encrypted hash function proposed by Austin Appleby, JenkinsHash is a hash function proposed by Bob Jenkins, and FNV-1 is a hash function proposed by Glenn Fowler, LandonCurt Noll, and Phong Vo. Configure the maximum length of the address field to 30 Chinese characters, the word segmentation width to 2 Chinese characters, and the maximum number of word segments for this field to 29. The mapping range of each Bloom-Filter object is 100 address records, and the expected error rate is 0.01. The length of the bit array can be calculated to be 2.7×10^4bit, so the storage space it occupies is about 3.3KB. If all the word segments of this field are encrypted and stored using AES-128, the storage space occupied is about 45KB. It is not difficult to see that this application greatly reduces storage overhead.

[0103] Referring to the data encryption storage process diagram shown in FIG4 , the data encryption module of the server can receive a data storage request (a request to insert sensitive data), the data storage request indicates preset plaintext data (which can be recorded as plaintext_data), a preset data table to be updated, and a preset column to be updated in the preset data table to be updated; the preset plaintext data and multiple plaintext data fragments (which can be recorded as plaintext_array) obtained after word segmentation of the preset plaintext data are encrypted using an encryption algorithm to obtain ciphertext data (which can be recorded as ciphertext_data) corresponding to the preset plaintext data, and multiple plaintext A plurality of ciphertext data fragments (which can be recorded as ciphertext_array) corresponding to the data fragments one by one; storing the ciphertext data corresponding to the preset plaintext data in the preset column to be updated to generate an updated data record in the preset data table to be updated; determining the associated record to be updated among the plurality of records in the associated table based on the preset data table to be updated, the preset column to be updated, and the data record identifier of the updated data record; updating the serialized array of the preset filter contained in the associated record to be updated according to the plurality of ciphertext data fragments, and updating the second data identifier contained in the associated record to be updated according to the data record identifier of the updated data record.

[0104] For example, the server receives a request from a user to insert address data, and the corresponding SQL statement is as follows: INSERT INTO user (id, name, address, …) VALUES (null, ‘Zhang San’, ‘No. 1, Qinglong Hutong, Dongcheng District, Beijing’, …). It can be parsed to obtain the preset plaintext data as plaintext_data = ‘No. 1, Qinglong Hutong, Dongcheng District, Beijing’. After word segmentation, we get plaintext_array = [‘Beijing’, ‘Jingshi’, ‘Shidong’, ‘Dongcheng’, ‘Chengqu’, ‘Quqing’, ‘Qinglong’, ‘Longhu’, ‘Hutong’, ‘Tongjia’, ‘Jia1’, ‘1hao’]. Encrypting plaintext_data gives ciphertext_data = ‘A7EF1n+3Lwgqkau+mZGpzfU2E250GoWw7SHeCaJ3+wNyxUvIJ’, and encrypting plaintext_array gives ciphertext_array = [‘k7GSfaGz6OEp1BwS3WTUWg==’, ‘xTQDjbSZ66m / y2k42bWj7A==’, ‘h7sDHKZp2M9S9ntsi2rxQw==’, ‘0esZ5C7QKawBpsLFFHqVxw==’, ‘ESueMQJLWhzoP / D2U7j+Zw==’, ‘rQu9dcAm2hCZhwi0LaEGYQ==’, +59n0SV9ujET+goH2qS04w==’, ‘hlj8gvZgR63G1znBYNqucQ==’, ‘ebfVve7ERwheUzm6Vgx3Ew==’, ‘lwLSRqE7u5nKE1XBIUWXmw==’, ‘FEBZsPnjcLV9ipqfRz3kmg==’, ‘A / w8iyeaN7V2rmxN1Ek25Q==’].

[0105] Then, insert ciphertext_data into the address column of the user table to generate an updated data record, obtain the primary key id=123 returned by the updated data record, query the associated record to be updated with primary key id=2 from the sensitive_column_bf table, deserialize the serialized array contained in the associated record to obtain the Bloom-Filter object, which includes a bit array and hash_list. Traverse the ciphertext_array array, and for each element in it, use each hash function in the hash_list set to calculate the subscript corresponding to the element on the bit array of the Bloom-Filter object, obtain the subscript set index_list, and then set the bits corresponding to all subscripts in the index_list set on the bit array to 1. Reserialize the Bloom-Filter object into a serialized array, write it back to the associated record with primary key id=2 in the sensitive_column_bf table, and update the end_id of the associated record with primary key id=2 to 123.

[0106] The filter control module of the server can monitor the ratio of the number of bits with a value of 1 in the bit array of the preset filter in real time during the insertion and update operations (which can be understood as updating the preset filter); when the ratio of the number of bits with a value of 1 in the bit array of the preset filter is greater than the first preset ratio, the length of the bit array of the preset filter is doubled; when the ratio of the number of bits with a value of 1 in the bit array of the preset filter is less than the second preset ratio, the length of the bit array of the preset filter is halved; based on the number of hash functions in the preset filter and the adjusted bit array of the preset filter, the error rate of the preset filter is determined; when the error rate does not meet the preset error rate condition, the number of hash functions of the preset filter is adjusted so that the error rate of the preset filter meets the preset error rate condition; after the preset filter is adjusted, the ciphertext data subset associated with the preset filter is added to the bit array of the preset filter after the function value is recalculated through the hash function of the adjusted preset filter.

[0107] The query request processing module of the server receives a data query request, which indicates a query plaintext text and a target column of a target data table to be queried; after segmenting the query plaintext text to obtain at least one plaintext text segment, a preconfigured encryption algorithm is used to encrypt the text to obtain a ciphertext text segment corresponding to each plaintext text segment.

[0108] The query request processing module of the server obtains the pre-stored association table; determines candidate association records from multiple association records in the association table, where the preset data table and preset column in the association relationship represented by the candidate association records are the same as the target data table and target column respectively; determines the preset filter in the association relationship represented by the candidate association records as the candidate filter associated with the target column.

[0109] The query request processing module of the server traverses the candidate filters associated with the target column. For each ciphertext text segment, multiple function values corresponding to the ciphertext text segment are calculated through multiple hash functions of the traversed candidate filters. When, in the bit array of the traversed candidate filters, the values of the bits indicated by the multiple function values corresponding to each ciphertext text segment are all 1, the traversed candidate filter is updated to the target filter; the target filter existing when the traversal is completed is determined as the target filter selected from the candidate filters associated with the target column.

[0110] For example, referring to the data query request processing flow diagram shown in Figure 5, a fuzzy query request initiated by the user is received, and the corresponding SQL statement is as follows: SELECT * FROM user WHERE address LIKE CONCAT(‘%’,‘Qinglong’,‘%’). Among them, user can be the target data table, address can be the target column, the query plaintext text plaintext_query = ‘Qinglong’, and since the word segmentation width is 2 Chinese characters, this query plaintext text can be used as the plaintext text segment obtained by word segmentation, and it can be encrypted to obtain ciphertext_query = ‘+59n0SV9ujET+goH2qS04w==’.

[0111] Furthermore, all candidate filters associated with the target column are queried from the sensitive_column_bf table to generate a Bloom-Filter object set (bf_list). At this time, bf_list.size = 2, that is to say, two Bloom-Filter objects (candidate filters) are queried. The primary keys of the association records corresponding to these two Bloom-Filter objects are 1 and 2 respectively, and the data record ranges of the sensitive data associated with them in the user table are [1,100] and [101,123] respectively.

[0112] Traverse the bf_list collection, and successively use each hash function in the hash_list collection of the traversed Bloom-Filter object to calculate the corresponding subscript of ciphertext_query on the bit array of the Bloom-Filter object, obtaining the index_list collection. Then, check all the corresponding subscripts in the index_list collection on the bit array. If there is a subscript value of 0, it means that the subset of ciphertext data associated with this Bloom-Filter object must not contain ciphertext data that can match plaintext_query. Therefore, directly remove this Bloom-Filter object from the bf_list collection. Specifically, the Bloom-Filter object corresponding to the associated record with the primary key id of 1 can be removed. After the traversal, the bf_list still has the Bloom-Filter object corresponding to the associated record with the primary key id of 2. Use this Bloom-Filter object as the target filter.

[0113] The data matching module of the server obtains multiple target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column store; uses the decryption algorithm corresponding to the encryption algorithm to decrypt the multiple target ciphertext data respectively, and then performs data matching with the query plaintext text to obtain the data query result.

[0114] For example, referring to the schematic diagram of the fuzzy matching process shown in Figure 6, the target filter includes the filter in the bf_list collection obtained by screening by the query request processing module of the server. At this time, there is 1 filter in the bf_list collection, and this filter corresponds to the target associated record. Use the interval formed by start_id and end_id in this target associated record as the set id_range_list of intervals where the sensitive data of plaintext_query may exist. That is, id_range_list = [101, 123].

[0115] Furthermore, traverse the id_range_list collection to query the data records with primary keys from 101 to 123 from the user table, obtain the ciphertext data in these data records, and then use the decryption algorithm corresponding to the encryption algorithm to perform batch decryption operations in memory to obtain the plaintext sensitive data corresponding to the ciphertext data in these data records. Then, perform fuzzy matching between plaintext_query and these plaintext sensitive data, and add the successfully matched sensitive data to the result set (result_list) to obtain: result_list = ['123', 'Zhang San', 'No. 1, A, Qinglong Hutong, Dongcheng District, Beijing',...]. Finally, return the result_list collection to the user to complete this desensitized data fuzzy query.

[0116] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0117] Based on the same inventive concept, the embodiment of the present application also provides a data query device for implementing the data query method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data query device embodiments provided below can refer to the limitations on the data query method above, and will not be repeated here.

[0118] In an exemplary embodiment, as shown in FIG. 7 , a data query device 700 is provided, comprising: a receiving module 710, a filtering module 720 and a query module 730, wherein:

[0119] The receiving module 710 is used to receive a data query request, where the data query request indicates a query plain text and a target column of a target data table to be queried.

[0120] The filtering module 720 is used to segment the query plaintext text to obtain at least one plaintext text segment, and then encrypt it using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment; based on each ciphertext text segment, filter out the target filter from the candidate filters associated with the target column.

[0121] The query module 730 is used to obtain multiple target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column; use a decryption algorithm corresponding to the encryption algorithm to decrypt the multiple target ciphertext data respectively, and then perform data matching with the query plaintext text to obtain the data query result.

[0122] In an exemplary embodiment, the filtering module 720 is also used to obtain a pre-stored association table, the association table contains multiple association records, each association record represents the association relationship between a preset data table, a preset column of the preset data table, and a preset filter; determine a candidate association record from the multiple association records, the preset data table and the preset column in the association relationship represented by the candidate association record are respectively the same as the target data table and the target column; determine the preset filter in the association relationship represented by the candidate association record as the candidate filter associated with the target column.

[0123] In an exemplary embodiment, each association record represents an association relationship between a preset data table, a preset column of the preset data table, a subset of ciphertext data stored in the preset column, and a preset filter. The filtering module 720 is also used to determine a target association record from candidate association records, and the preset filter in the association relationship represented by the target association record is filtered as the target filter; the ciphertext data contained in the subset of ciphertext data in the association relationship represented by the target association record in the pre-encrypted ciphertext data stored in the target column is determined as multiple target ciphertext data associated with the target filter.

[0124] In an exemplary embodiment, each associated record includes identification information of a preset data table, identification information of a preset column, a first data record identifier, a second data record identifier after the first data record identifier, and a serialized array of preset filters. The data query device 700 also includes a data storage module, which is used to receive a data storage request, and the data storage request indicates preset plaintext data, a preset data table to be updated, and a preset column to be updated in the preset data table to be updated; encrypt the preset plaintext data and multiple plaintext data fragments obtained after word segmentation of the preset plaintext data using an encryption algorithm to obtain a preset plaintext data. Ciphertext data corresponding to the plaintext data, and multiple ciphertext data fragments corresponding to the multiple plaintext data fragments; storing the ciphertext data corresponding to the preset plaintext data in the preset column to be updated to generate an updated data record in the preset data table to be updated; determining the associated record to be updated among the multiple records in the associated table based on the preset data table to be updated, the preset column to be updated, and the data record identifier of the updated data record; updating the serialized array of the preset filter contained in the associated record to be updated according to the multiple ciphertext data fragments, and updating the second data identifier contained in the associated record to be updated according to the data record identifier of the updated data record.

[0125] In an exemplary embodiment, each preset filter includes a bit array and multiple hash functions, the bit array includes multiple bits and the value of each bit, the value of each bit is 1 or 0, the data query device 700 also includes an adjustment module, the adjustment module is used to adjust the array length of the bit array of the preset filter when the ratio of the number of bits with a value of 1 in the bit array of the preset filter meets the preset adjustment trigger condition; determine the error rate of the preset filter based on the number of hash functions in the preset filter and the adjusted bit array of the preset filter; when the error rate does not meet the preset error rate condition, adjust the number of hash functions of the preset filter so that the error rate of the preset filter meets the preset error rate condition.

[0126] In an exemplary embodiment, the candidate filter includes a bit array and multiple hash functions, the bit array includes multiple bits and the value of each bit, the value of each bit is 1 or 0, and the filtering module 720 is also used to traverse the candidate filters associated with the target column; for each ciphertext text fragment, calculations are performed through the multiple hash functions of the traversed candidate filters to obtain multiple function values ​​corresponding to the ciphertext text fragment; when in the bit array of the traversed candidate filter, the values ​​of the bits indicated by the multiple function values ​​corresponding to each ciphertext text fragment are all 1, the traversed candidate filter is updated to the target filter; the target filter that exists when the traversal is completed is determined as the target filter screened out from the candidate filters associated with the target column.

[0127] Each module in the above data query device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0128] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG8. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data to be stored when executing the above-mentioned data query method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data query method is implemented.

[0129] Those skilled in the art will understand that the structure shown in FIG. 8 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0131] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0132] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0134] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0135] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0136] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data query method, characterized in that: The method comprises: Receive a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried; After segmenting the query plaintext text to obtain at least one plaintext text segment, encrypting the query plaintext text using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment; According to each of the ciphertext text fragments, a target filter is selected from the candidate filters associated with the target column; Acquire a plurality of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column; The decryption algorithm corresponding to the encryption algorithm is adopted to decrypt the multiple target ciphertext data respectively, and then the data is matched with the query plaintext text to obtain the data query result.

2. The method according to claim 1, characterized in that: The method further comprises: Obtaining a pre-stored association table, the association table comprising a plurality of association records, each of the association records representing an association relationship between a preset data table, a preset column of the preset data table, and a preset filter; Determine a candidate association record from the plurality of association records, wherein a preset data table and a preset column in the association relationship represented by the candidate association record are respectively the same as the target data table and the target column; The preset filter in the association relationship represented by the candidate association record is determined as the candidate filter associated with the target column.

3. The method according to claim 2, characterized in that Each of the association records represents an association relationship between a preset data table, a preset column of the preset data table, a ciphertext data subset stored in the preset column, and a preset filter, and obtaining a plurality of target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column includes: Determine a target association record from the candidate association records, wherein a preset filter in the association relationship represented by the target association record is filtered as the target filter; The ciphertext data contained in the ciphertext data subset in the association relationship represented by the target association record in the pre-encrypted ciphertext data stored in the target column is determined as a plurality of target ciphertext data associated with the target filter.

4. The method according to claim 2, characterized in that: Each of the associated records includes identification information of a preset data table, identification information of a preset column, a first data record identifier, a second data record identifier following the first data record identifier, and a serialized array of preset filters, and the method further includes: receiving a data storage request, the data storage request indicating preset plaintext data, a preset data table to be updated, and a preset column to be updated in the preset data table to be updated; Encrypting the preset plaintext data and the multiple plaintext data segments obtained after word segmentation of the preset plaintext data using the encryption algorithm to obtain ciphertext data corresponding to the preset plaintext data and multiple ciphertext data segments corresponding to the multiple plaintext data segments one by one; Storing the ciphertext data corresponding to the preset plaintext data in the preset column to be updated to generate an updated data record in the preset data table to be updated; Determine the associated record to be updated among the multiple records in the associated table based on the preset data table to be updated, the preset column to be updated, and the data record identifier of the updated data record; According to the multiple ciphertext data fragments, the serialized array of the preset filter included in the associated record to be updated is updated, and according to the data record identifier of the updated data record, the second data identifier included in the associated record to be updated is updated.

5. The method according to claim 2, characterized in that: Each preset filter includes a bit array and multiple hash functions, the bit array includes multiple bits and the value of each bit, the value of each bit is 1 or 0, and the method further includes: When the ratio of the number of bits with a value of 1 in the bit array of the preset filter meets a preset adjustment trigger condition, adjusting the array length of the bit array of the preset filter; Determining the false positive rate of the preset filter based on the number of hash functions in the preset filter and the adjusted bit array of the preset filter; When the false positive rate does not satisfy a preset false positive rate condition, the number of hash functions of the preset filter is adjusted so that the false positive rate of the preset filter satisfies the preset false positive rate condition.

6. The method according to any one of claims 1 to 5, characterized in that: The candidate filter includes a bit array and multiple hash functions, the bit array includes multiple bits and the value of each bit, the value of each bit is 1 or 0, and the target filter is screened out from the candidate filters associated with the target column according to each of the ciphertext text fragments, including: Traversing candidate filters associated with the target column; For each of the ciphertext text fragments, multiple hash functions of the traversed candidate filters are used to calculate to obtain multiple function values ​​corresponding to the ciphertext text fragment; When, in the bit array of the traversed candidate filter, the values ​​of the bits indicated by the multiple function values ​​corresponding to each of the ciphertext text fragments are all 1, the traversed candidate filter is updated to the target filter; The target filter existing when the traversal is completed is determined as the target filter screened from the candidate filters associated with the target column.

7. A data query device, characterized in that: The device comprises: A receiving module, used for receiving a data query request, wherein the data query request indicates a query plain text and a target column of a target data table to be queried; A filtering module is used to segment the query plaintext text to obtain at least one plaintext text segment, and then encrypt it using a preconfigured encryption algorithm to obtain a ciphertext text segment corresponding to each plaintext text segment; and select a target filter from the candidate filters associated with the target column according to each ciphertext text segment; The query module is used to obtain multiple target ciphertext data associated with the target filter from the pre-encrypted ciphertext data stored in the target column; use a decryption algorithm corresponding to the encryption algorithm to decrypt the multiple target ciphertext data respectively, and then perform data matching with the query plaintext text to obtain a data query result.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images