Data query method and device and computer program product

Abstract

The invention provides a data query method and device and a computer program product, and relates to the technical field of communication. The data query method is applied to a data query end and comprises the following steps: sending primary encrypted query information to a data center; receiving secondary encryption query information returned by the data center, wherein the secondary encryption query information is generated by performing secondary encryption on the primary encryption query information by the data center; decrypting the secondary encrypted query information based on a preset decryption mode to generate tertiary encrypted query information; the encryption mode of the third-time encryption query information is the same as the encryption mode of the second-time encryption; querying in pre-received encrypted total information based on the three-time encrypted query information to obtain target encrypted information, and querying in pre-received category identifiers according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; wherein the category identifier corresponds to the encrypted information; the encryption mode of the three-time encryption query information is the same as the encryption mode of the encryption information.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data query method, device and computer program product. Background Art

[0002] Users may communicate with enterprises through multiple channels, and each channel uses an identifier to mark the user. However, each channel may have different identifiers for the same user, resulting in the user information in the enterprise information data being relatively scattered. In order to make the user information in the enterprise information data more concentrated, the enterprise information data is generally sent to the data center for query, and the data center processes the user information in the enterprise information data and returns the query result after connecting the user information in the enterprise information data. However, at present, when sending enterprise information data to the data center, plain text transmission is generally used, resulting in the lack of privacy of the enterprise information data sent to the data center. Summary of the invention

[0003] In view of the problems existing in the prior art, the present invention provides a data query method, device and computer program product.

[0004] The present invention provides a data query method, which is applied to a data query end and includes: Send an encrypted query message to the data center; Receiving secondary encrypted query information returned by the data center, where the secondary encrypted query information is generated by the data center performing secondary encryption on the primary encrypted query information; Decrypting the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information; the encryption method of the tertiary encrypted query information is the same as the secondary encryption method; Based on the three encrypted query information, query the pre-received encrypted full information to obtain target encrypted information, and query the pre-received category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; The encrypted full amount information includes multiple encrypted information, the category identifier corresponds to the encrypted information in the encrypted full amount information; the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information.

[0005] According to a data query method provided by the present invention, before sending encrypted query information to a data center, the method further includes: The query information is encrypted once to generate the encrypted query information; the encryption method of the primary encryption and the encryption method of the secondary encryption are the same encryption algorithms using different private keys.

[0006] According to a data query method provided by the present invention, before encrypting the query information once to generate the encrypted query information, the method further includes: Create query templates; Preprocessing the query information to generate multiple query information blocks; Performing cryptographic hashing on each of the query information blocks to generate a hash information block; Combining the hash information block and the query template to generate intermediate query content, and performing obfuscation processing on the intermediate query content to generate obfuscated query content; Encrypting the query information once generates encrypted query information, specifically including: The obfuscated query content is encrypted once to generate encrypted query information.

[0007] According to a data query method provided by the present invention, the thrice-encrypted query information includes a plurality of thrice-encrypted query information sub-items; Based on the three encrypted query information, querying in the pre-received encrypted full information to obtain the target encrypted information specifically includes: Based on the three encrypted query information sub-items, queries are performed in the pre-received encrypted full information respectively to obtain the corresponding target encrypted information.

[0008] The present invention also provides a data query method, which is applied to a data center and comprises: Receiving encrypted query information sent by the data query terminal; Performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; Sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method, generates tertiary encrypted query information, queries the pre-sent encrypted full information based on the tertiary encrypted query information, obtains target encrypted information, and queries the pre-sent category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; Among them, the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0009] According to a data query method provided by the present invention, the data center pre-stores full information, and the full information includes multiple sub-information; Before sending the encrypted full amount of information to the data query end, the method further includes: Encrypt each sub-information to generate encrypted information; wherein the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information, and the tertiary encrypted query information is generated by the data query end decrypting the secondary encrypted query information; The encrypted full amount information is obtained based on the encrypted information.

[0010] According to a data query method provided by the present invention, before encrypting each sub-information to generate encrypted information, the method further includes: Create information templates; Preprocessing the sub-information to generate a plurality of information blocks respectively; Performing cryptographic hashing on each of the information blocks to generate a hashed information block; Combining the hash information block and the information template to generate intermediate information content, and performing obfuscation processing on the intermediate information content to generate obfuscated information content; Each sub-information is encrypted to generate encrypted information, including: The obfuscated information content is encrypted to generate encrypted information.

[0011] The present invention also provides a data query device, applied to a data query end, comprising: A query module, used to send an encrypted query message to the data center; A receiving module, used for receiving the secondary encrypted query information returned by the data center, where the secondary encrypted query information is generated by the data center performing secondary encryption on the primary encrypted query information; A decryption module, used to decrypt the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information; the encryption method of the tertiary encrypted query information is the same as the secondary encryption method; A target category identification acquisition module, used to query in the pre-received encrypted full information based on the three encrypted query information to obtain target encrypted information, and query in the pre-received category identification according to the target encrypted information to obtain the target category identification corresponding to the target encrypted information; The encrypted full amount information includes multiple encrypted information, the category identifier corresponds to the encrypted information in the encrypted full amount information; the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information.

[0012] The present invention also provides a data query device, which is applied to a data center and includes: A receiving module, used for receiving the encrypted query information sent by the data query terminal; A secondary encryption module, used for performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; A sending module, used for sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method, generates tertiary encrypted query information, queries the pre-sent encrypted full information based on the tertiary encrypted query information, obtains target encrypted information, and queries the pre-sent category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; Among them, the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0013] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the data query method as described in any one of the above items is implemented.

[0014] The data query method, device and computer program product provided by the present invention send a primary encrypted query message to a data center, receive a secondary encrypted query message returned by the data center, decrypt the secondary encrypted query message to obtain a tertiary encrypted query message, use the tertiary encrypted query message to query in pre-received encrypted full information to obtain target encrypted information, query in pre-received category identifiers based on the target encrypted information, and obtain a target category identifier corresponding to the target encrypted information, thereby preventing the data center from obtaining the content of the query information and protecting the privacy of the query information. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 This is one of the flow charts of the data query method provided by the present invention.

[0017] Figure 2 This is the second flow chart of the data query method provided by the present invention.

[0018] Figure 3 It is a schematic diagram of the architecture of the data query method provided by the present invention.

[0019] Figure 4This is one of the structural schematic diagrams of the data query device provided by the present invention.

[0020] Figure 5 This is the second structural schematic diagram of the data query device provided by the present invention.

[0021] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Combine the following Figure 1-Figure 5 The data query method, device and computer program product of the present invention are described.

[0024] ID-Mapping (OneID) is the core infrastructure of user operations. Through ID-Mapping, user information fragments scattered in enterprise information data can be connected to complete user portrait extraction. Information fragments include user information in different business sectors or different terminals of the enterprise. Different terminals can include mobile terminals, PC terminals, and Web terminals.

[0025] ID-Mapping is generally set up in a data center (also known as a data center platform). Enterprises need to transmit their own corporate information data to the data center for query (also known as matching query) to connect information fragments in the corporate information data, and during the transmission process, their own corporate information data is often directly transmitted in plain text, resulting in a lack of privacy in the corporate information data sent to the data center.

[0026] In order to solve the above technical problems, the present invention provides a data query method, device and computer program product. Figure 1-Figure 5 Give a description.

[0027] Figure 1 It is one of the flow charts of the data query method provided by the present invention, which is applied to the data query end, such as Figure 1 As shown, the method includes: Step 101: Send an encrypted query message to the data center.

[0028] The data center is an external platform or service that is independent of the data query end. The data center can pre-collect, store and process data from different enterprises or organizations, and organize the information in the data of different enterprises or organizations through complex algorithms and technologies, and connect the information of the same users. For example, the data center can group the information in the data of different enterprises or organizations, and classify the information of the same users into the same group.

[0029] The data center can be built by the enterprise itself or by a third-party data center. The third-party data center is generally a trusted data center.

[0030] Step 102: Receive secondary encrypted query information returned by the data center, where the secondary encrypted query information is generated by the data center performing secondary encryption on the primary encrypted query information.

[0031] Secondary encryption can use symmetric encryption algorithms or asymmetric encryption algorithms, such as Advanced Encryption Standard (AES), elliptic encryption algorithm, and RSA encryption algorithm.

[0032] After receiving the encrypted query information sent by the data query end, the data center does not perform a decryption operation, but directly re-encrypts the encrypted query information to generate the secondary encrypted query information, and sends the secondary encrypted query information back to the data query end so that the data query end can obtain the query result (see below for the specific acquisition method). In this way, the privacy of the query end in the data center can be enhanced by avoiding informing the data center of the plain text content of the query information.

[0033] In one embodiment, before sending the encrypted query information once to the data center, the method further includes: encrypting the query information once to generate the encrypted query information once; the encryption method of the primary encryption and the encryption method of the secondary encryption are the same encryption algorithm using different private keys.

[0034] The query information may be enterprise information data including multiple information. The encrypted query information is the ciphertext content of the query information.

[0035] Exemplarily, the multiple information may be dispersed user information. Specifically, the same user may use two mobile phone numbers to interact with the enterprise. The enterprise generates a user code for each mobile phone number. Each mobile phone number is a piece of information, and the two mobile phone numbers are dispersed user information. By sending an encrypted query message including the two mobile phone numbers to the data center, it can be made clear in the data center that the two mobile phone numbers point to the same user, and the dispersed user information can be connected to facilitate the establishment of user portraits and better services for users.

[0036] In this embodiment, by encrypting the query information once using the same encryption algorithm with different private keys, and encrypting the once encrypted query information twice, the secondary encryption can be coordinated based on the primary encryption, so as to improve the encryption efficiency.

[0037] Enterprise information data is an asset, and enterprise information data may include user privacy information. In this embodiment, by encrypting the query information to obtain encrypted query information, and sending the encrypted query information to the data center for query, the number of times the plain text content of the enterprise information data is transmitted can be reduced, thereby better protecting enterprise data assets and enhancing the protection of user privacy.

[0038] Step 103: decrypt the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information; the encryption method of the tertiary encrypted query information is the same as the secondary encryption method.

[0039] The preset decryption method is a decryption method corresponding to the encryption method of the first encrypted query information. Taking the encryption method of the first encrypted query as an example, the first encrypted query information is the query information encrypted using the public key. After receiving the second encrypted query information, the data receiving end uses the private key to decrypt the second encrypted query information, wherein the public key and the private key are a key pair obtained through the encryption algorithm.

[0040] The twice encrypted query information can be partially decrypted based on the preset decryption method; the twice encrypted query information is generated by twice encrypting the once encrypted query information, and partial decryption refers to decrypting the encryption corresponding to the once encrypted query information. It can be understood that in asymmetric encryption, the public key is used to encrypt the plaintext content to obtain the ciphertext information, and the private key is used to decrypt the ciphertext information to obtain the plaintext content; in this way, the thrice encrypted query information is equivalent to the ciphertext query information obtained by encrypting the plaintext query information using the twice encrypted encryption method.

[0041] Step 104: query the pre-received encrypted full information based on the three encrypted query information to obtain target encrypted information, and query the pre-received category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; The encrypted full information is the information sent by the data center to the data query end, and the encrypted full information includes the data corresponding to the encrypted query information. For example, if the query information is two mobile phone numbers, the full information sent by the data center to the data query end is a group of mobile phone numbers, which includes these two mobile phone numbers. In this way, after the data query end receives the full information, it can be easily determined whether the two mobile phone numbers are the mobile phone numbers of the same user, and which user's two mobile phone numbers are.

[0042] The encrypted full information includes multiple encrypted information, and the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information.

[0043] The full information includes multiple sub-information, and the encrypted information is the ciphertext information obtained by encrypting the sub-information. The encrypted full information can be obtained based on the multiple encrypted information. For example, the sub-information can correspond to a piece of user information, and the encrypted full information can be composed of multiple encrypted information, or it can be composed of encrypted information and other identification information, etc. Other identification information may include encryption time, encryption device number, etc.

[0044] As mentioned above, the three encrypted query information is equivalent to the ciphertext query information obtained by encrypting the plaintext query information. In this embodiment, the encrypted information is the ciphertext information obtained by encrypting the plaintext sub-information. On the basis that the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information, if the plaintext query information and the sub-information are the same, then the three encrypted query information and the encrypted information are also the same. In this way, the data query end can determine the encrypted information corresponding to the query information without knowing the plaintext content corresponding to the encrypted information, that is, obtain the target encrypted information from the encrypted full information.

[0045] The category identifier corresponds to the encrypted information in the encrypted full information.

[0046] A corresponding relationship can be established between the sub-information and the category identifier, and a corresponding relationship can be established between the encrypted information and the sub-information, thereby making the category identifier correspond to the encrypted information.

[0047] The category identifier is used to indicate the category of the encrypted information. The category identifiers corresponding to different encrypted information may be the same or different. If the category identifiers corresponding to different encrypted information are the same, it means that the different encrypted information belong to the same category. Exemplarily, each encrypted information may have only one category identifier, which may be a user name or a user code, etc. In this way, if the category identifiers corresponding to different encrypted information are the same, it means that the different encrypted information is the information of the same user, thereby connecting the scattered user information in the query information together to facilitate the construction of a user profile of the user.

[0048] Moreover, in the case that the data center is a third-party data center, in this embodiment, the encrypted query information is queried three times in the encrypted full information to obtain the target encrypted information. When the data query end cannot obtain the plaintext full information, the category identifier of the corresponding user information in the query information can be obtained through the category identifier of the target encrypted information, thereby protecting the data assets of the third-party data center.

[0049] In one embodiment, the full information refers to the full information of a certain category of the corresponding query information, or the full information of several categories. For example, when the query information only includes the mobile phone number, the data center returns the full information of the mobile phone number category to the data query end; when the query information includes the mobile phone number and the address, the data center returns the full information of the mobile phone number category and the full information of the address category to the data query end.

[0050] It can be understood that in the full information of the mobile phone number category, the sub-information can be a single mobile phone number, and in the full information of the address category, the sub-information can be a single address.

[0051] In one embodiment, before sending encrypted query information to the data center, a full information acquisition request may be sent to the data center to pre-receive the encrypted full information and category identifier returned by the data center.

[0052] The data query method provided by the embodiment of the present invention sends a first encrypted query message to a data center, receives a second encrypted query message returned by the data center, decrypts the second encrypted query message to obtain a third encrypted query message, uses the third encrypted query message to query in the pre-received encrypted full information to obtain the target encrypted information, queries in the pre-received category identifier based on the target encrypted information, obtains the target category identifier corresponding to the target encrypted information, thereby making it impossible for the data center to obtain the plaintext content of the query information, thereby protecting the privacy of the query information.

[0053] At the same time, the data query end is unable to obtain the plaintext content of the full amount of information, thereby reducing the number of plaintext transmissions of data on both ends and better protecting the privacy of data on both ends.

[0054] Based on the above embodiment, before encrypting the query information once to generate encrypted query information, the method further includes: Create query templates; Preprocessing the query information to generate multiple query information blocks; Performing cryptographic hashing on each of the query information blocks to generate a hash information block; Combining the hash information block and the query template to generate intermediate query content, and performing obfuscation processing on the intermediate query content to generate obfuscated query content; Encrypting the query information once generates encrypted query information, specifically including: The obfuscated query content is encrypted once to generate encrypted query information.

[0055] The query template is a template used to generate obfuscated query content. Preprocessing can be to first fill the query information so that the length of the query information meets the set requirements, and then divide the filled query information into a set number of query information blocks. Performing operations such as modular addition, XOR and shift on a query information block can generate a hash information block.

[0056] Exemplarily, the query template may be a set of strings consisting of preset characters and having a fixed length, and the characters in the string may be updated based on the hash information block to generate intermediate query content, and the intermediate query content may be diffused to obtain a set of strings having a fixed length, i.e., obfuscated query content. The length of the obfuscated query content is the same as the length of the query template.

[0057] As mentioned above, the query information is actually enterprise information data. In this embodiment, the query information is deformed to generate obfuscated query content, and the obfuscated query content is encrypted once to generate encrypted query information. This can increase the difficulty of cracking the encrypted query information to obtain the query information, further increase the security of the enterprise information data sent to the data center, and enhance the protection of user privacy.

[0058] Based on any of the above embodiments, the tertiary encrypted query information includes multiple tertiary encrypted query information sub-items.

[0059] The three-times encrypted query information sub-item is the ciphertext content of a user information in the corresponding query information. Exemplarily, the three-times encrypted query information may be composed of three-times encrypted query information sub-items, or may be composed of three-times encrypted query information sub-items and other identification information, and other identification information may include encryption time, encryption device number, etc.

[0060] Based on the three encrypted query information, query is performed in the pre-received encrypted full information to obtain target encrypted information, specifically including: based on the three encrypted query information sub-items, query is performed in the pre-received encrypted full information respectively to obtain corresponding target encrypted information.

[0061] As mentioned above, the encrypted information corresponds to the ciphertext content of a sub-information in the full information, and the sub-information may correspond to a user information. The three encrypted query information sub-items may be matched and queried in the pre-received encrypted full information, and the matched encrypted information may be obtained as the corresponding target encrypted information, so as to obtain the category identifier corresponding to the three encrypted query information sub-items.

[0062] It can be understood that the corresponding query information includes query information sub-items. Encrypting the query information once may be, encrypting the query information sub-items once to obtain the once encrypted query information sub-items, and obtaining the once encrypted query information based on the once encrypted query information sub-items; and encrypting the once encrypted query information twice may be, encrypting the once encrypted query information sub-items twice to obtain the twice encrypted query information sub-items, and obtaining the twice encrypted query information based on the twice encrypted query information sub-items.

[0063] A corresponding relationship can be established between the query information sub-item and the first-encrypted query information sub-item, a corresponding relationship can be established between the first-encrypted query information sub-item and the second-encrypted query information sub-item, and a corresponding relationship can be established between the second-encrypted query information sub-item and the third-encrypted query information sub-item, thereby obtaining the category identification of the query information sub-item through the third-encrypted query information sub-item.

[0064] Compared to extracting thrice encrypted query information sub-items from thrice encrypted query information through preset rules or extraction models, in this embodiment, the thrice encrypted query information includes thrice encrypted query information sub-items, and the thrice encrypted query information sub-items can be directly obtained from the thrice encrypted query information, avoiding the possibility of errors in extracting the thrice encrypted query information sub-items and increasing the accuracy of querying and obtaining the corresponding target encrypted information.

[0065] Figure 2 This is the second flow chart of the data query method provided by the present invention, which is applied to a data center, such as Figure 2 As shown, the method includes: Step S201, receiving encrypted query information sent by the data query terminal; Step S202: re-encrypt the once encrypted query information to generate re-encrypted query information; Step S203: sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method, generates tertiary encrypted query information, queries the pre-sent encrypted full information based on the tertiary encrypted query information, obtains target encrypted information, and queries the pre-sent category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; Among them, the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0066] Based on any of the above embodiments, the data center pre-stores full information, and the full information includes multiple sub-information; Before sending the encrypted full amount of information to the data query end, the method further includes: Encrypt each sub-information to generate encrypted information; wherein the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information, and the tertiary encrypted query information is generated by the data query end decrypting the secondary encrypted query information; The encrypted full amount information is obtained based on the encrypted information.

[0067] Based on any of the above embodiments, before encrypting each sub-information to generate encrypted information, the method further includes: Create information templates; Preprocessing the sub-information to generate a plurality of information blocks respectively; Performing cryptographic hashing on each of the information blocks to generate a hashed information block; Combining the hash information block and the information template to generate intermediate information content, and performing obfuscation processing on the intermediate information content to generate obfuscated information content; Each sub-information is encrypted to generate encrypted information, including: The obfuscated information content is encrypted to generate encrypted information.

[0068] In order to specifically illustrate the function of the data query method provided by this implementation, Figure 3 is a schematic diagram of the architecture of the data query method provided by the present invention, such as Figure 3 As shown, a specific example is provided below.

[0069] The data query end may obtain the encrypted full information and category identification from the data center in advance, for example: The data center pre-stores full information, which includes multiple sub-information. The category identifier corresponds to the sub-information, and the category identifier can reflect the grouping of the sub-information. The data query end sends a request to the data center to obtain the encrypted full information and category identification; When the data center receives the request sent by the data query end, it can perform a hash operation on each sub-information to obtain the obfuscated information content of the full information. For example, for the full information (y1, y2, ..., y n ) performs hash operation on each sub-information to obtain h j :=H(y j ), j∈[1,n]; where y1,y2,...,y n Indicates sub-information; hash can be SHA256 (SHA256 is an international hash function, also known as hash function, hash function), or SM3 (SM3 is a domestic hash function standard); The obfuscated information content of each sub-information can be encrypted using an elliptic encryption algorithm to generate encrypted full information. For example, a random number s is selected as a temporary private key, and a temporary public key S is obtained using the random number s. , where G is the base point of the elliptic curve, and then perform scalar_multiply (point multiplication) operation to obtain the encrypted full information; Return the encrypted full information and category identification response to the data query end. For example, the response can be ,in, It is encrypted information. Is the category identifier.

[0070] The data query end may first send a query request to the data center, for example: A hash operation can be performed on each query information sub-item in the query information at the data query end to obtain the obfuscated information content of the query information. For example, for the query information (x1, x2, ..., x m ) performs hash operation on each query information sub-item to obtain g i :=H(x i ),i∈[1,m]; where x1,x2,...,x m Indicates the query information sub-item, hash can choose SHA256; Each query information sub-item can be encrypted once using the elliptic encryption algorithm to generate encrypted query information. Figure 3 The envelope icon in the upper left corner is a one-time encryption icon; for example, a random number r is selected as a temporary private key, and a temporary public key R is obtained using the random number r. , where G is the base point of the elliptic curve, and then perform a scalar_multiply operation to obtain an encrypted query information ; Send an encrypted query message to the data center.

[0071] After receiving the query request, the data center may return the query result to the data query end, for example: After receiving the primary encrypted query information sent by the data query terminal, the data center may perform secondary encryption on the primary encrypted query information to generate secondary encrypted query information; Figure 3 The envelope icon in the lower left corner is the secondary encryption icon; for example, the random number s is used to perform a scalar_multiply operation on the received data to generate secondary encryption query information. ; Return the secondary encrypted query information to the data query end.

[0072] The data query end can obtain the corresponding target category identifier based on the secondary encrypted query information, exemplarily: The data query end receives the secondary encrypted query information returned by the data center, uses the random number r to perform an inverse operation on each secondary encrypted query information sub-item of the secondary encrypted query information, and generates a tertiary encrypted query information sub-item. ; In msg1, encrypt the m three-times query information sub-items respectively Matching is performed to obtain the target encrypted information, and the target category identifier corresponding to the target encrypted information is searched in the pre-received category identifier according to the target encrypted information, and the target category identifier corresponding to the target encrypted information is obtained. For example, the target category identifier of the three-times encrypted query information sub-item of 111 is A, the target category identifier of the three-times encrypted query information sub-item of 222 is B, and the target category identifier of the three-times encrypted query information sub-item of 333 is B.

[0073] The data query end can also be called the query party (Guest), and the data center can also be called the queried party (Host).

[0074] Compared with fully homomorphic encryption through private information retrieval (PIR), in this embodiment, it is only necessary to perform elliptic curve encryption on the query data at the data query end, perform elliptic curve encryption on the full data in the data center, and perform two rounds of protocol transmission to complete a secure query. The required mathematical calculation amount is relatively small, which can improve query efficiency.

[0075] Exemplarily, in this embodiment, the query can be completed within T+1 time.

[0076] The data query device provided by the present invention is described below. The data query device described below and the data query method described above can be referenced to each other.

[0077] Figure 4 is one of the structural diagrams of the data query device provided by the present invention, which is applied to the data query end, such as Figure 4 As shown, the device comprises: Query module 401, used to send encrypted query information to the data center; A receiving module 402 is used to receive the secondary encrypted query information returned by the data center, where the secondary encrypted query information is generated by the data center by secondary encrypting the primary encrypted query information; A decryption module 403 is used to decrypt the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information; the encryption method of the tertiary encrypted query information is the same as the secondary encryption method; The target category identification acquisition module 404 is used to query the pre-received encrypted full information based on the three encrypted query information to obtain the target encrypted information, and query the pre-received category identification according to the target encrypted information to obtain the target category identification corresponding to the target encrypted information; The encrypted full amount information includes multiple encrypted information, the category identifier corresponds to the encrypted information in the encrypted full amount information; the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information.

[0078] Based on any of the above embodiments, the data query device further includes an encryption module; Before sending an encrypted query message to the data center, the encryption module is used to: The query information is encrypted once to generate the encrypted query information; the encryption method of the primary encryption and the encryption method of the secondary encryption are the same encryption algorithms using different private keys.

[0079] Based on any of the above embodiments, the data query device further includes an obfuscation module; Before encrypting the query information once to generate encrypted query information, the obfuscation module is used to: Create query templates; Preprocessing the query information to generate multiple query information blocks; Performing cryptographic hashing on each of the query information blocks to generate a hash information block; Combining the hash information block and the query template to generate intermediate query plaintext content, and performing obfuscation processing on the intermediate query plaintext content to generate obfuscated query plaintext content; The encryption module is specifically used for: The obfuscated query plaintext content is encrypted once to generate encrypted query information.

[0080] Based on any of the above embodiments, the three-times encrypted query information includes a plurality of three-times encrypted query information sub-items; The target category identification acquisition module 404 is specifically used to: Based on the three encrypted query information sub-items, queries are performed in the pre-received encrypted full information respectively to obtain the corresponding target encrypted information.

[0081] Figure 5 is a schematic diagram of the structure of the data query device provided by the present invention, which is applied to a data center, such as Figure 5 As shown, the device comprises: The receiving module 501 is used to receive the encrypted query information sent by the data query terminal; A secondary encryption module 502, configured to perform secondary encryption on the primary encrypted query information to generate secondary encrypted query information; The sending module 503 is used to send the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method, generates tertiary encrypted query information, queries the pre-sent encrypted full information based on the tertiary encrypted query information, obtains the target encrypted information, and queries the pre-sent category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; Among them, the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0082] Based on any of the above embodiments, the data center pre-stores full information, and the full information includes multiple sub-information; The data query device also includes an encrypted full information acquisition module; Before sending the encrypted full amount information to the data query end, the encrypted full amount information acquisition module is used to: Encrypt each sub-information to generate encrypted information; wherein the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information, and the tertiary encrypted query information is generated by the data query end decrypting the secondary encrypted query information; The encrypted full amount information is obtained based on the encrypted information.

[0083] Based on any of the above embodiments, the data query device further includes an obfuscation module; Before encrypting each sub-information to generate encrypted information, the obfuscation module is used to: Create information templates; Preprocessing the sub-information to generate a plurality of information blocks respectively; Performing cryptographic hashing on each of the information blocks to generate a hashed information block; Combining the hash information block and the information template to generate intermediate information plaintext content, and performing obfuscation processing on the intermediate information plaintext content to generate obfuscated information plaintext content; The encrypted full information acquisition module is specifically used for: The plain text content of the obfuscated information is encrypted to generate encrypted information.

[0084] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, the electronic device may include: a processor (processor) 610 , a communication interface (Communications Interface) 620 , a memory (memory) 630 and a communication bus 640 , wherein the processor 610 , the communication interface 620 , and the memory 630 communicate with each other through the communication bus 640 . The processor 610 can call the logic instructions in the memory 630 to execute the data query method applied to the data query end, the method comprising: sending a primary encrypted query message to the data center; receiving a secondary encrypted query message returned by the data center, the secondary encrypted query message being generated by the data center performing secondary encryption on the primary encrypted query message; decrypting the secondary encrypted query message based on a preset decryption method to generate a tertiary encrypted query message; the encryption method of the tertiary encrypted query message is the same as the encryption method of the secondary encryption; querying in the pre-received encrypted full information based on the tertiary encrypted query message to obtain the target encrypted information, and querying in the pre-received category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; wherein the encrypted full information comprises a plurality of encrypted messages, the category identifier corresponding to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query message; or Executing a data query method applied to a data center, the method includes: receiving a primary encrypted query information sent by the data query end; performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information, querying in pre-sent encrypted full information based on the tertiary encrypted query information to obtain target encrypted information, and querying in a pre-sent category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; wherein the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0085] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0086] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute a data query method applied to a data query end, the method including: sending a primary encrypted query message to a data center; receiving a secondary encrypted query message returned by the data center, the secondary encrypted query message being generated by the data center performing secondary encryption on the primary encrypted query message; decrypting the secondary encrypted query message based on a preset decryption method to generate a tertiary encrypted query message; the encryption method of the tertiary encrypted query message is the same as the encryption method of the secondary encryption; querying in the pre-received encrypted full information based on the tertiary encrypted query information to obtain target encrypted information, and querying in the pre-received category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; wherein the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information; or Executing a data query method applied to a data center, the method includes: receiving a primary encrypted query information sent by the data query end; performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information, querying in pre-sent encrypted full information based on the tertiary encrypted query information to obtain target encrypted information, and querying in a pre-sent category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; wherein the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0087] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute a data query method applied to a data query end, the method comprising: sending a primary encrypted query message to a data center; receiving a secondary encrypted query message returned by the data center, the secondary encrypted query message being generated by the data center performing secondary encryption on the primary encrypted query message; decrypting the secondary encrypted query message based on a preset decryption method to generate a tertiary encrypted query message; the encryption method of the tertiary encrypted query message is the same as the encryption method of the secondary encryption; querying in pre-received encrypted full information based on the tertiary encrypted query information to obtain target encrypted information, and querying in a pre-received category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; wherein the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information; or Executing a data query method applied to a data center, the method includes: receiving a primary encrypted query information sent by the data query end; performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information, querying in pre-sent encrypted full information based on the tertiary encrypted query information to obtain target encrypted information, and querying in a pre-sent category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; wherein the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

[0088] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0089] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data query method, characterized in that: Applied to the data query end, including: Send an encrypted query message to the data center; Receiving secondary encrypted query information returned by the data center, where the secondary encrypted query information is generated by the data center performing secondary encryption on the primary encrypted query information; Decrypting the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information; the encryption method of the tertiary encrypted query information is the same as the secondary encryption method; Based on the three encrypted query information, query the pre-received encrypted full information to obtain the target encrypted information, and query the pre-received category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; The encrypted full amount information includes multiple encrypted information, the category identifier corresponds to the encrypted information in the encrypted full amount information; the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information.

2. The data query method according to claim 1, characterized in that: Before sending the encrypted query information to the data center, the method further includes: The query information is encrypted once to generate the encrypted query information; the encryption method of the primary encryption and the encryption method of the secondary encryption are the same encryption algorithms using different private keys.

3. The data query method according to claim 2, characterized in that: Before encrypting the query information once to generate encrypted query information, the method further includes: Create query templates; Preprocessing the query information to generate multiple query information blocks; Performing cryptographic hashing on each of the query information blocks to generate a hash information block; Combining the hash information block and the query template to generate intermediate query content, and performing obfuscation processing on the intermediate query content to generate obfuscated query content; Encrypting the query information once generates encrypted query information, specifically including: The obfuscated query content is encrypted once to generate encrypted query information.

4. The data query method according to claim 1, characterized in that: The three-times encrypted query information includes a plurality of three-times encrypted query information sub-items; Based on the three encrypted query information, querying in the pre-received encrypted full information to obtain the target encrypted information specifically includes: Based on the three encrypted query information sub-items, queries are performed in the pre-received encrypted full information respectively to obtain the corresponding target encrypted information.

5. A data query method, characterized in that: Applications in data centers include: Receiving encrypted query information sent by the data query terminal; Performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; Sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method, generates tertiary encrypted query information, queries the pre-sent encrypted full information based on the tertiary encrypted query information, obtains target encrypted information, and queries the pre-sent category identifier according to the target encrypted information to obtain the target category identifier corresponding to the target encrypted information; Among them, the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

6. The data query method according to claim 5, characterized in that: The data center has pre-stored full information, where the full information includes a plurality of sub-information; Before sending the encrypted full amount of information to the data query end, the method further includes: Encrypt each sub-information to generate encrypted information; wherein the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information, and the tertiary encrypted query information is generated by the data query end decrypting the secondary encrypted query information; The encrypted full amount information is obtained based on the encrypted information.

7. The data query method according to claim 6, characterized in that: Before encrypting each sub-information to generate encrypted information, the method further includes: Create information templates; Preprocessing the sub-information to generate a plurality of information blocks respectively; Performing cryptographic hashing on each of the information blocks to generate a hashed information block; Combining the hash information block and the information template to generate intermediate information content, and performing obfuscation processing on the intermediate information content to generate obfuscated information content; Each sub-information is encrypted to generate encrypted information, including: The obfuscated information content is encrypted to generate encrypted information.

8. A data query device, characterized in that: Applied to the data query end, including: A query module, used to send an encrypted query message to the data center; A receiving module, used for receiving the secondary encrypted query information returned by the data center, where the secondary encrypted query information is generated by the data center performing secondary encryption on the primary encrypted query information; A decryption module, used to decrypt the secondary encrypted query information based on a preset decryption method to generate tertiary encrypted query information; the encryption method of the tertiary encrypted query information is the same as the secondary encryption method; A target category identification acquisition module, used to query in the pre-received encrypted full information based on the three encrypted query information to obtain target encrypted information, and query in the pre-received category identification according to the target encrypted information to obtain the target category identification corresponding to the target encrypted information; The encrypted full amount information includes multiple encrypted information, the category identifier corresponds to the encrypted information in the encrypted full amount information; the encryption method of the encrypted information is the same as the encryption method of the three encrypted query information.

9. A data query device, characterized in that: Applications in data centers include: A receiving module, used for receiving the encrypted query information sent by the data query terminal; A secondary encryption module, used for performing secondary encryption on the primary encrypted query information to generate secondary encrypted query information; A sending module, used for sending the secondary encrypted query information to the data query end, so that the data query end decrypts the secondary encrypted query information based on a preset decryption method, generates tertiary encrypted query information, queries the pre-sent encrypted full information based on the tertiary encrypted query information, obtains target encrypted information, and queries the pre-sent category identifier according to the target encrypted information to obtain a target category identifier corresponding to the target encrypted information; Among them, the encryption method of the tertiary encrypted query information is the same as the encryption method of the secondary encryption; the encrypted full information includes multiple encrypted information, and the category identifier corresponds to the encrypted information in the encrypted full information; the encryption method of the encrypted information is the same as the encryption method of the tertiary encrypted query information.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data query method according to any one of claims 1 to 7 is implemented.

Images