Encryption method and device for unstructured data, storage medium and program product

Abstract

The invention provides an encryption method for unstructured data, electronic equipment, a readable storage medium and a computer program product, and the method comprises the steps: flexibly selecting an encryption strategy according to information such as data sensitivity, access frequency and use scene for preprocessed unstructured block data, and carrying out corresponding encryption; wherein a key and an algorithm in the encryption strategy can be synchronously updated; meanwhile, dynamically adjusting an encryption strategy based on a query record of the encrypted data; in addition, for high-sensitivity data or abnormal access conditions, a virtual query technology is adopted to confuse real queries. According to the method, the encryption strategy can be dynamically adjusted according to attribute information such as the sensitivity, the access frequency and the use scene of the data, so that the performance bottleneck problem in a high-frequency access scene can be solved while the data encryption security is guaranteed.

Description

Technical Field

[0001] The present application relates to the technical field of data encryption, and in particular to an encryption method for unstructured data, an electronic device, a readable storage medium, and a computer program product. Background Art

[0002] In order to provide appropriate security for sensitive data, a variety of encryption methods such as static encryption methods have been proposed. However, in practice, it is found that current encryption methods usually use a unified encryption method for all data, which leads to encryption and decryption operations becoming performance bottlenecks when data is accessed frequently, affecting the overall response speed of the system, and thus making current encryption methods unable to adapt to the increasingly complex and changing data security needs. Summary of the invention

[0003] The purpose of this application is to provide an encryption method, electronic device, readable storage medium and computer program product for unstructured data, which can determine a suitable encryption strategy based on attribute information such as data sensitivity, access frequency, usage scenarios, etc., so as to ensure the security of data encryption while solving the performance bottleneck problem in high-frequency access scenarios.

[0004] The first aspect of the present application provides an encryption method for unstructured data, comprising:

[0005] Acquire preprocessed data of unstructured data; wherein the preprocessed data is block data;

[0006] Identifying attribute information of the preprocessed data;

[0007] Based on the attribute information, determining an initial encryption strategy for the preprocessed data;

[0008] The pre-processed data is encrypted based on the initial encryption strategy to obtain encrypted data.

[0009] In the above implementation process, the method can preprocess unstructured data into block data, so that it can reduce the complexity of a single encryption operation, improve encryption efficiency, and facilitate the implementation of different encryption strategies according to the importance or sensitivity of different data blocks. At the same time, by accurately identifying attribute information, it can ensure that the encryption strategy matches the actual needs and security level of the data, thereby improving the pertinence and effectiveness of encryption. Then, according to different query frequencies, data sensitivity and other factors, the strength and method of encryption can be adaptively determined, so that the method can optimize query performance and system response speed while ensuring data security. Finally, the application of the final encryption strategy can avoid the performance bottlenecks and security vulnerabilities that may be caused by a single encryption method, thereby improving the security and flexibility of the overall system.

[0010] Furthermore, the method further comprises:

[0011] Based on the query record of the encrypted data, adjusting the initial encryption strategy to a dynamic encryption strategy;

[0012] The encrypted data is dynamically encrypted based on the dynamic encryption strategy to obtain dynamic encrypted data.

[0013] In the above implementation process, the method can dynamically adjust the encryption strategy based on the query records, thereby achieving flexible and adaptive protection of encrypted data, thereby effectively improving the security and encryption efficiency of the data, and ensuring the dynamic security and compliance of the data during storage and access.

[0014] Furthermore, the attribute information includes sensitivity information, access frequency information, and usage scenario information;

[0015] The sensitivity information includes high sensitivity, medium sensitivity and low sensitivity;

[0016] The access frequency information includes high access frequency, medium access frequency and low access frequency;

[0017] The usage scenario information includes real-time processing scenarios, batch processing scenarios, and archiving scenarios.

[0018] In the above implementation process, the method can achieve refined and adaptive encryption of unstructured data by comprehensively considering the data's sensitivity information (high, medium, low), access frequency information (high, medium, low) and usage scenario information (real-time processing, batch processing, archiving), thereby significantly improving data security and system performance.

[0019] Further, determining the initial encryption strategy of the pre-processed data based on the attribute information includes:

[0020] When the sensitivity information in the attribute information is high sensitivity, determining an initial encryption strategy for the preprocessed data based on a strong encryption algorithm; or

[0021] When the sensitivity information in the attribute information is medium sensitivity, determining an initial encryption strategy for the preprocessed data based on a standard encryption algorithm; or

[0022] When the sensitivity information in the attribute information is low sensitivity, determining an initial encryption strategy for the preprocessed data based on a weak encryption algorithm; or

[0023] When it is determined based on the attribute information that the pre-processed data is data that does not need to be encrypted, the initial encryption policy of the pre-processed data is determined to be empty.

[0024] In the above implementation process, the method can intelligently select the encryption algorithm strength according to the sensitivity information of the data, thereby realizing the refinement and differentiation of the encryption strategy, which not only ensures the high security of highly sensitive data, but also avoids excessive encryption of low-sensitivity data, thereby improving the overall encryption efficiency and data processing flexibility.

[0025] Further, determining the initial encryption strategy of the pre-processed data based on the attribute information includes:

[0026] When the data type of the pre-processed data in the attribute information is a string type or an integer type, determining an initial encryption strategy for the pre-processed data based on an order-preserving encryption algorithm; or

[0027] When it is determined based on the attribute information that the pre-processed data is data that needs to support a sorting query or data that needs to support a range query, determining an initial encryption strategy for the pre-processed data based on an order-preserving encryption algorithm; or

[0028] When it is determined based on the attribute information that the pre-processed data is data that needs to support permission access, an initial encryption strategy for the pre-processed data is determined based on an attribute-based encryption algorithm.

[0029] In the above implementation process, the method can intelligently select encryption algorithms according to data types and query requirements, such as using order-preserving encryption algorithms to support sorting and range queries, and attribute-based encryption algorithms to ensure permission access control, thereby achieving targeted optimization of encryption strategies and improving the flexibility and efficiency of data processing.

[0030] Furthermore, adjusting the initial encryption strategy to a dynamic encryption strategy based on the query record of the encrypted data includes:

[0031] Performing calculation based on the query record of the encrypted data to obtain the query frequency of the encrypted data;

[0032] When the query frequency is greater than a preset frequency threshold and the sensitivity information in the attribute information is not high sensitivity, the initial encryption strategy is subjected to encryption strength downgrade processing to obtain a dynamic encryption strategy;

[0033] The encryption strength downgrading process at least includes reducing the strength of the encryption algorithm in the initial encryption strategy.

[0034] In the above implementation process, this method can appropriately reduce the encryption strength when the query is frequent and the data sensitivity is not high, thereby improving the efficiency of data processing and query while ensuring data security.

[0035] Further, adjusting the initial encryption strategy to a dynamic encryption strategy based on the query record of the encrypted data includes:

[0036] Performing time pattern analysis, user pattern analysis, and content pattern analysis based on the query records of the encrypted data to obtain query pattern analysis results;

[0037] Performing calculation based on the query pattern analysis result to obtain an anomaly score of the encrypted data;

[0038] When the abnormality score is greater than a preset score threshold and the sensitivity information in the attribute information is not high sensitivity, performing encryption strength upgrade processing on the initial encryption strategy to obtain a dynamic encryption strategy;

[0039] The encryption strength upgrade process at least includes improving the strength of the encryption algorithm in the initial encryption strategy.

[0040] In the above implementation process, the method can deeply analyze the query patterns of encrypted data, intelligently identify abnormal behaviors, and automatically upgrade the encryption strength when necessary, thereby achieving dynamic response and enhanced protection for data security.

[0041] Furthermore, the method further comprises:

[0042] When the query frequency is greater than the preset frequency threshold and the sensitivity information in the attribute information is high sensitivity, or when the anomaly score is greater than the preset score threshold and the sensitivity information in the attribute information is high sensitivity, or when the encrypted data is repeatedly accessed by users of a preset user group, the number of virtual queries is calculated based on a preset virtual query ratio parameter;

[0043] Based on the encrypted data, determining a virtual query type and virtual query content;

[0044] Generate a virtual query request based on the virtual query quantity, the virtual query type and the virtual query content;

[0045] Based on a preset insertion time requirement and a preset insertion priority requirement, the virtual query request is inserted into a real query request sequence.

[0046] In the above implementation process, this method can generate virtual query requests and intelligently insert them into the real query sequence when highly sensitive data encrypted data is frequently accessed or abnormally accessed, thereby effectively confusing the real query mode, thereby enhancing the confidentiality and security of data access, and providing a higher level of protection for sensitive data.

[0047] Furthermore, the method further comprises:

[0048] When the initial encryption strategy is updated, a new key or a new encryption algorithm is generated by a key management module;

[0049] The old key or the old encryption algorithm in the initial encryption policy is updated to the new key or the new encryption algorithm, and the old key or the old encryption algorithm is discarded.

[0050] In the above implementation process, the method can achieve smooth transition and abandonment of keys or encryption algorithms through the key management module when the encryption policy is updated, thereby ensuring the continued security and flexibility of the encryption system, and effectively responding to potential security threats.

[0051] A second aspect of the present application provides an encryption device for unstructured data, the encryption device for unstructured data comprising:

[0052] An acquisition unit, used for acquiring pre-processed data of unstructured data; wherein the pre-processed data is block data;

[0053] an identification unit, used for identifying attribute information of the preprocessed data;

[0054] A first determining unit, configured to determine an initial encryption strategy for the preprocessed data based on the attribute information;

[0055] The encryption unit is used to encrypt the pre-processed data based on the initial encryption strategy to obtain encrypted data.

[0056] Furthermore, the unstructured data encryption device further comprises:

[0057] An adjustment unit, configured to adjust the initial encryption strategy to a dynamic encryption strategy based on a query record of the encrypted data;

[0058] The encryption unit is further used to dynamically encrypt the encrypted data based on the dynamic encryption strategy to obtain dynamic encrypted data.

[0059] Furthermore, the attribute information includes sensitivity information, access frequency information, and usage scenario information;

[0060] The sensitivity information includes high sensitivity, medium sensitivity and low sensitivity;

[0061] The access frequency information includes high access frequency, medium access frequency and low access frequency;

[0062] The usage scenario information includes real-time processing scenarios, batch processing scenarios, and archiving scenarios.

[0063] Further, the first determining unit is specifically configured to determine an initial encryption strategy for the preprocessed data based on a strong encryption algorithm when the sensitivity information in the attribute information is high sensitivity; or

[0064] When the sensitivity information in the attribute information is medium sensitivity, determining an initial encryption strategy for the preprocessed data based on a standard encryption algorithm; or

[0065] When the sensitivity information in the attribute information is low sensitivity, determining an initial encryption strategy for the preprocessed data based on a weak encryption algorithm; or

[0066] When it is determined based on the attribute information that the pre-processed data is data that does not need to be encrypted, the initial encryption policy of the pre-processed data is determined to be empty.

[0067] Furthermore, the first determining unit is further configured to determine an initial encryption strategy for the preprocessed data based on an order-preserving encryption algorithm when the data type of the preprocessed data in the attribute information is a string type or an integer type; or

[0068] When it is determined based on the attribute information that the pre-processed data is data that needs to support a sorting query or data that needs to support a range query, determining an initial encryption strategy for the pre-processed data based on an order-preserving encryption algorithm; or

[0069] When it is determined based on the attribute information that the pre-processed data is data that needs to support permission access, an initial encryption strategy for the pre-processed data is determined based on an attribute-based encryption algorithm.

[0070] Furthermore, the adjustment unit includes:

[0071] A calculation subunit, configured to calculate based on the query record of the encrypted data to obtain the query frequency of the encrypted data;

[0072] an adjusting subunit, configured to, when the query frequency is greater than a preset frequency threshold and the sensitivity information in the attribute information is not high sensitivity, perform encryption strength downgrading processing on the initial encryption strategy to obtain a dynamic encryption strategy;

[0073] The encryption strength downgrading process at least includes reducing the strength of the encryption algorithm in the initial encryption strategy.

[0074] Furthermore, the adjustment unit includes:

[0075] An analysis subunit, configured to perform time pattern analysis, user pattern analysis, and content pattern analysis based on the query records of the encrypted data to obtain a query pattern analysis result;

[0076] The computing subunit is further configured to perform a calculation based on the query pattern analysis result to obtain an abnormality score of the encrypted data;

[0077] The adjustment subunit is further configured to perform encryption strength upgrade processing on the initial encryption strategy to obtain a dynamic encryption strategy when the anomaly score is greater than a preset score threshold and the sensitivity information in the attribute information is not high sensitivity;

[0078] The encryption strength upgrade process at least includes improving the strength of the encryption algorithm in the initial encryption strategy.

[0079] Furthermore, the unstructured data encryption device further comprises:

[0080] a calculation unit, configured to calculate the number of virtual queries based on a preset virtual query ratio parameter when the query frequency is greater than the preset frequency threshold and the sensitivity information in the attribute information is high sensitivity, or when the anomaly score is greater than the preset score threshold and the sensitivity information in the attribute information is high sensitivity, or when the encrypted data is repeatedly accessed by users of a preset user group;

[0081] A second determining unit, configured to determine a virtual query type and virtual query content based on the encrypted data;

[0082] A generating unit, configured to generate a virtual query request based on the virtual query quantity, the virtual query type and the virtual query content;

[0083] The inserting unit is used to insert the virtual query request into the real query request sequence based on a preset insertion time requirement and a preset insertion priority requirement.

[0084] Furthermore, the dynamic encryption device for unstructured data further comprises:

[0085] A key management unit, configured to generate a new key or a new encryption algorithm through a key management module when the initial encryption policy is updated;

[0086] A key updating unit is used to update the old key or the old encryption algorithm in the initial encryption policy to the new key or the new encryption algorithm, and to discard the old key or the old encryption algorithm.

[0087] A third aspect of the present application provides an electronic device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the encryption method for unstructured data described in any one of the first aspect of the present application.

[0088] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions. When the computer program instructions are read and executed by a processor, the encryption method for unstructured data described in any one of the first aspect of the present application is executed.

[0089] A fifth aspect of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the encryption method for unstructured data described in any one of the first aspects of the present application is executed. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0091] Figure 1 A schematic diagram of a flow chart of an unstructured data encryption method provided in an embodiment of the present application;

[0092] Figure 2 A system architecture diagram of a secure encryption system for unstructured data provided in an embodiment of the present application;

[0093] Figure 3 A schematic diagram of a flow chart of another unstructured data encryption method provided in an embodiment of the present application;

[0094] Figure 4 A schematic diagram of the structure of an unstructured data encryption device provided in an embodiment of the present application;

[0095] Figure 5 A schematic diagram of the structure of another unstructured data encryption device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0096] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0097] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0098] Example 1

[0099] Please see Figure 1 , Figure 1 A flowchart of an encryption method for unstructured data provided in this embodiment. The encryption method for unstructured data includes:

[0100] S101. Obtain preprocessed data of unstructured data; wherein the preprocessed data is block data.

[0101] In this embodiment, the preprocessed data may be preprocessed unstructured data, wherein the preprocessing process includes layering, blocking and deduplication processing.

[0102] S102: Identify attribute information of preprocessed data.

[0103] In this embodiment, the attribute information includes sensitivity information, access frequency information, and usage scenario information;

[0104] The sensitivity information includes high sensitivity, medium sensitivity and low sensitivity;

[0105] The access frequency information includes high access frequency, medium access frequency, and low access frequency;

[0106] The usage scenario information includes real-time processing scenario, batch processing scenario and archiving scenario.

[0107] S103: Determine an initial encryption strategy for preprocessed data based on the attribute information.

[0108] In this embodiment, the method can perform hierarchical management according to the sensitivity, access frequency and usage scenarios in the attribute information, and set different encryption strategies for each pre-processed data according to these levels.

[0109] The implementation of this method can ensure data security by formulating appropriate encryption strategies, while optimizing system performance, thus achieving a balance between security and efficiency.

[0110] S104: Encrypt the preprocessed data based on the initial encryption strategy to obtain encrypted data.

[0111] As an optional implementation, the method further includes:

[0112] When the initial encryption policy is updated, a new key or a new encryption algorithm is generated through the key management module;

[0113] The old key or the old encryption algorithm in the initial encryption policy is updated to the new key or the new encryption algorithm, and the old key or the old encryption algorithm is discarded.

[0114] In this embodiment, in order to prevent key leakage or attack, the method proposes a dynamic key management mechanism to ensure the security of the key throughout its entire life cycle. Specifically, it includes:

[0115] (1) Use a hardware security module (HSM) or a trusted execution environment (TEE) to generate and store cryptographic keys.

[0116] (2) Rotate keys regularly or as needed to gradually re-encrypt stored data to ensure long-term data security.

[0117] (3) After each key rotation, this method can automatically update the encrypted keywords in the index table to ensure the accuracy and security of subsequent queries.

[0118] S105. Based on the query record of the encrypted data, the initial encryption strategy is adjusted to a dynamic encryption strategy.

[0119] S106. Dynamically encrypt the encrypted data based on the dynamic encryption strategy to obtain dynamic encrypted data.

[0120] Please see Figure 2 , Figure 2 The system architecture diagram of a secure encryption system for unstructured data is shown. The secure encryption system for unstructured data includes six components, namely, a data preprocessing system, a data dynamic encryption system, a data dynamic compression system, a data storage system, a data query system, and a key management system. It can be seen that the above-mentioned data dynamic encryption system corresponds to the "data dynamic encryption" in the figure, that is, the data dynamic encryption system is used to execute the encryption method for unstructured data proposed in this application, specifically for performing data dynamic encryption processing on unstructured data.

[0121] At the same time, this application also involves Figure 2 The key management system shown is used to manage and update keys, so that the managed and updated keys and algorithms are applied to the dynamic data encryption process.

[0122] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0123] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0124] It can be seen that the encryption method for unstructured data described in this embodiment can dynamically adjust the encryption strategy according to attribute information such as data sensitivity, access frequency, and usage scenarios, thereby ensuring the security of data encryption while solving performance bottleneck problems in high-frequency access scenarios.

[0125] Example 2

[0126] Please see Figure 3 , Figure 3 A flowchart of an encryption method for unstructured data provided in this embodiment. The encryption method for unstructured data includes:

[0127] S201. Obtain preprocessed data of unstructured data; wherein the preprocessed data is block data.

[0128] In this embodiment, the preprocessed data may be preprocessed unstructured data, wherein the preprocessing process includes layering, blocking and deduplication processing.

[0129] S202: Identify attribute information of preprocessed data.

[0130] In this embodiment, the method can adopt flexible encryption strategies for different types of unstructured data based on attribute information.

[0131] S203: Determine an initial encryption strategy for preprocessed data based on the attribute information.

[0132] As an optional implementation, determining an initial encryption strategy for preprocessed data based on attribute information includes:

[0133] When the sensitivity information in the attribute information is high sensitivity, determining an initial encryption strategy for the preprocessed data based on a strong encryption algorithm; or

[0134] When the sensitivity information in the attribute information is medium sensitivity, determining an initial encryption strategy for the preprocessed data based on a standard encryption algorithm; or

[0135] When the sensitivity information in the attribute information is low sensitivity, determining an initial encryption strategy for the preprocessed data based on a weak encryption algorithm; or

[0136] When it is determined based on the attribute information that the pre-processed data is data that does not need to be encrypted, the initial encryption policy of the pre-processed data is determined to be empty.

[0137] In this embodiment, as data changes during its life cycle, its attribute information can intuitively show the specific content of the change. Therefore, the method dynamically adjusts the encryption strategy based on the attribute change information of the data to achieve a self-updating effect of the encryption strategy.

[0138] In this embodiment, when data is generated, a suitable initial encryption strength can be selected according to its expected access frequency and sensitivity. When the data changes over time or the access frequency changes, the method automatically adjusts the encryption strategy based on the change in access frequency and sensitivity.

[0139] For example, this method can reduce the encryption strength or merge data blocks for data that has not been accessed for a long time, so as to reduce storage and management overhead and improve system resource utilization.

[0140] In this embodiment, the method can also automatically and dynamically adjust the strength of the encryption algorithm according to the access frequency and sensitivity of frequently accessed non-sensitive data (using a lighter encryption algorithm), thereby achieving dynamic adjustment of the encryption strategy, thereby reducing the burden of decryption calculations and optimizing system performance.

[0141] As an optional implementation, determining an initial encryption strategy for preprocessed data based on attribute information includes:

[0142] When the data type of the pre-processed data in the attribute information is a string type or an integer type, determining an initial encryption strategy for the pre-processed data based on an order-preserving encryption algorithm; or

[0143] When it is determined based on the attribute information that the pre-processed data is data that needs to support a sorting query or data that needs to support a range query, an initial encryption strategy for the pre-processed data is determined based on an order-preserving encryption algorithm; or

[0144] When it is determined based on the attribute information that the pre-processed data is data that needs to support permission access, an initial encryption strategy for the pre-processed data is determined based on an attribute-based encryption algorithm.

[0145] In this embodiment, the method can use an Order-Preserving Encryption (OPE) strategy for continuous data that requires range query (such as video frame interval data, data within a time period, etc.).

[0146] In this embodiment, the method can encrypt the original data while maintaining the order of the data through an order-preserving encryption algorithm, so that the user can perform range queries on the encrypted data without decryption, thereby significantly improving query efficiency.

[0147] In this embodiment, the method ensures that sensitive data can only be accessed by users with specific attributes or permissions by using an Attribute-Based Encryption (ABE) strategy.

[0148] In this embodiment, the method can encrypt data based on attribute-based encryption algorithm, data sensitivity and user attributes. Therefore, only users who meet specific attribute conditions can decrypt the corresponding data, thereby ensuring the security of sensitive information. On this basis, the method can also set different access permission levels to achieve strict control of access permissions for data of different sensitivities (for example, highly sensitive data can only be accessed by users with advanced permissions).

[0149] S204. Encrypt the preprocessed data based on the initial encryption strategy to obtain encrypted data, and execute step S205 or S207.

[0150] For example, the encryption method proposed in this application is called method A (the steps of this method are subsequently called A1, A2, etc.). The input of this dynamic encryption method is:

[0151] (1) Data set D = {d1, d2, ..., d n}: contains multiple unstructured data items (such as text, images, videos, etc.);

[0152] (2) Sensitivity classification S = {s1, s2, ..., s n}: Classify each data entry by sensitivity (such as high; medium; low sensitivity);

[0153] (3) Access frequency classification F = {f1, f2, ..., f n}: Classify each data entry by access frequency (high; low, etc.);

[0154] (4) Usage scenario classification U = {u1,u2,…,u n}: Classify each data entry by usage scenario (such as real-time processing; batch processing; archiving, etc.);

[0155] (5) Access key K = {k1, k2, ..., k n}: A collection of symmetric keys used for encryption.

[0156] The output of the dynamic encryption method is: encrypted data set EncryptedData.

[0157] Based on this, the dynamic encryption method A may include the following steps:

[0158] A1. Initialize the encrypted data set. Used to store the results of hierarchical data encryption.

[0159] A2. For each data d j ∈D, according to data d j Attribute information of j ,f j ,u j}, select a suitable preprocessing strategy, and perform preprocessing operations on the data according to the selected preprocessing strategy to obtain preprocessed data.

[0160] A3. Select encryption algorithm based on attributes:

[0161] (1) Order-preserving encryption (OPE): When data needs to support sorting and range queries, use order-preserving encryption.

[0162] (2) Attribute-based encryption (ABE): Attribute-based encryption is used when data needs to control access rights based on user attributes.

[0163] For example, the method can first be based on d i The data type determines whether the enhanced encryption algorithm OPE or ABE needs to be added: If d i For data of type such as string or integer, it is necessary to support sorting query or range query, etc., and use the OPE encryption algorithm; if the data needs to control access rights based on user attributes, the ABE encryption algorithm needs to be added;

[0164] (3) If the information is highly sensitive, choose a strong encryption algorithm (such as AES-256). At the same time, due to the high requirements for privacy protection, it can be combined with ABE or OPE encryption;

[0165] (4) If the sensitivity is medium, select a standard encryption algorithm (such as AES-192);

[0166] (5) If the sensitivity is low, select a lightweight encryption algorithm (such as AES-128), or choose not to encrypt as required.

[0167] A4. Dynamic encryption:

[0168] (1) Using the selected encryption algorithm, j The corresponding key encrypts each block data (preprocessed data):

[0169] encryptedBlock=Encrypt(c jk ,k j );

[0170] (2) Generate hash value h j =Hash(c jk ) is used for deduplication;

[0171] (3) Check the hash table: If the hash h j If it already exists in the hash table, do not store duplicate encrypted data blocks and record the reference relationship; otherwise, store the encrypted data block encryptedBlock and hash it to j Add to the hash table.

[0172] (4) Returns the encrypted data set EncryptedData for subsequent query and processing.

[0173] S205 . Perform calculation based on the query record of the encrypted data to obtain the query frequency of the encrypted data, and execute step S206 or S210 .

[0174] S206. When the query frequency is greater than the preset frequency threshold and the sensitivity information in the attribute information is not high sensitivity, the initial encryption strategy is downgraded to obtain a dynamic encryption strategy, and step S214 is executed.

[0175] In this embodiment, the encryption strength downgrading process at least includes reducing the strength of the encryption algorithm in the initial encryption strategy.

[0176] In this embodiment, when it is detected that the query frequency is higher than expected, the method can dynamically adjust the initial encryption strategy, such as increasing the encryption strength or refining the block granularity to enhance security.

[0177] In this embodiment, when it is detected that the query frequency is lower than expected, the method can dynamically adjust the initial encryption strategy, such as reducing the encryption strength or increasing the block granularity, to improve the query efficiency.

[0178] S207: Perform time pattern analysis, user pattern analysis, and content pattern analysis based on the query records of the encrypted data to obtain query pattern analysis results.

[0179] S208. Perform calculation based on the query pattern analysis result to obtain an anomaly score of the encrypted data, and execute step S209 or S210.

[0180] S209. When the abnormality score is greater than the preset score threshold and the sensitivity information in the attribute information is not high sensitivity, the initial encryption strategy is upgraded to obtain a dynamic encryption strategy, and step S214 is executed.

[0181] In this embodiment, the encryption strength upgrade process at least includes improving the strength of the encryption algorithm in the initial encryption strategy.

[0182] For example, the encryption policy adjustment process proposed in this application is called method B (the steps of this method are subsequently called B1, B2, etc.). The input of the encryption policy adjustment process is:

[0183] (1) Query History = {q1,q2,...,q m}: User's historical query behavior, used to analyze access patterns;

[0184] (2) EncryptedData: the encrypted data set (or the original data corresponding to the encrypted data set);

[0185] (3) Query frequency threshold FreqThreshold;

[0186] (4) Query the pattern anomaly threshold PatternThreshold.

[0187] The output of the dynamic encryption adjustment process is: the adjusted encrypted data EncryptedData′={c′1, c′2, ..., c′ n}.

[0188] Based on this, the dynamic encryption adjustment process B may include the following steps:

[0189] B1. Initialization: Set the adjusted encrypted data as the initial encrypted data set EncryptedData′=EncryptedData.

[0190] B2. Count the number of accesses, time information, and user access records for each data block in historical queries:

[0191] (1) For each query record q i ∈QueryHistory extracts the set of data blocks c involved in the query k ∈Blocks(q i ), and calculate each data block c k The number of visits Count(c k )=Count(c k-1 )+1;

[0192] (2) Record the access time series of data blocks TimeSeries (c k );

[0193] (3) Record user access records UserAccess(c k ,User(q i )).

[0194] B3. Calculate the query frequency and query pattern anomaly score of each database in the historical query, and dynamically encrypt and adjust the data block according to the access frequency and anomaly score results:

[0195] (1) Traverse each data block c in the historical query k ∈Blocks(QueryHistory), and calculate q i The query frequency of each block in Freq(c k )=Count(c k ) / TotalTime, where TotalTime is the total time of the statistical period;

[0196] (2) Analyze the query pattern and calculate the access anomaly score AnomalyScore (c k ):

[0197] ① Time pattern analysis: Calculate the distribution of query time interval Δt and detect abnormal access frequency changes.

[0198] ② User pattern analysis: Analyze the distribution of users accessing the data block and detect whether there are abnormal users or abnormal access behaviors.

[0199] ③ Content pattern analysis: Analyze the content or scope of the query to detect whether there are specific data blocks being queried repeatedly.

[0200] ④ Anomaly score calculation: Combined with the above analysis, use statistical methods or machine learning algorithms (such as isolation forest, support vector machine) to calculate the anomaly score AnomalyScore (c k ).

[0201] B4. For each database c k ∈Blocks(QueryHistory) dynamically adjusts high-frequency data:

[0202] If Freq(c k )>FreqThreshold and the sensitivity of the data block is s k If the sensitivity is not high, this method can choose to reduce the encryption strength or optimize the encryption method to improve the query efficiency. The details are as follows:

[0203] (1) Select an efficient encryption algorithm: Change from the original encryption algorithm to an algorithm with faster decryption speed (such as changing from AES-256 to AES-128).

[0204] (2) Merge adjacent data blocks to increase the block granularity and reduce the number of decryption operations.

[0205] (3) If you need to query a range, use the OPE encrypted database.

[0206] (4) Re-encrypt the database according to the adjustment strategy to generate a new data block c′ k =AdjustBlock(c k ).

[0207] (5) Set c in EncryptedData′ k c′ k .

[0208] B5. For each database c k ∈Blocks(QueryHistory) performs abnormal access detection and processing. If AnomalyScore(c k )>PatternThreshold, indicating c k May be attacked, need to c kMake the following encryption adjustments:

[0209] (1) If the sensitivity of the data block is s k If the information is not highly sensitive, you can choose a stronger encryption algorithm, for example, upgrading from AES-128 to AES-256.

[0210] (2) The database can be split into smaller granularities to increase security.

[0211] (3) Add ABE encryption and increase access rights restrictions.

[0212] (4) If AnomalyScore(c k )>PatternThreshold and its sensitivity is s k It is already highly sensitive, so a virtual query mechanism GenVirtualQuery can be introduced to generate a virtual query q virtual , randomly access other data blocks to confuse the real query mode. At the same time, the key or access policy can be updated to generate a new key k′ k Or update the public parameters of ABE and re-encrypt the database c″ k =Encrypt(c k ,k′ k ), use c″ k Replace c' of EncryptedData' k .

[0213] B6. Return the adjusted encrypted data set EncryptedData′.

[0214] S210. When the query frequency is greater than a preset frequency threshold and the sensitivity information in the attribute information is high sensitivity, or when the anomaly score is greater than a preset score threshold and the sensitivity information in the attribute information is high sensitivity, or when the encrypted data is repeatedly accessed by users of a preset user group, the number of virtual queries is calculated based on a preset virtual query ratio parameter.

[0215] In this embodiment, when the method adopts the order-preserving encryption strategy, it can be anticipated that the order-preserving encryption strategy may cause data sequence information leakage. Therefore, the method introduces frequency interference and virtual query mechanisms.

[0216] On the other hand, when the access frequency of a data block is found to be abnormally high, the method can re-encrypt the data block or generate a virtual query accordingly, thereby preventing attackers from obtaining valid information through frequency analysis and further ensuring data security.

[0217] In this embodiment, the method can dynamically adjust the parameters of the encryption algorithm when an abnormal query pattern (such as frequent queries of a specific range) is detected, so that the attacker cannot infer the original data through the known sequence information. At the same time, the method can also generate and insert invalid or random query requests, thereby obfuscating the real query requests and preventing frequency analysis attacks.

[0218] S211. Determine the virtual query type and virtual query content based on the encrypted data.

[0219] S212: Generate a virtual query request based on the virtual query quantity, virtual query type and virtual query content.

[0220] S213. Based on the preset insertion time requirement and the preset insertion priority requirement, insert the virtual query request into the real query request sequence, and execute step S214.

[0221] For example, the virtual query method proposed in this application is called method C (the steps of this method are subsequently called C1, C2, etc.). The input of the virtual query method is:

[0222] (1) Query History: contains all query records in the past period of time, including query content, time, user and other information;

[0223] (2) Data set D = {d1, d2, ..., d n}: All data blocks stored in the system;

[0224] (3) Abnormal data block set C anomaly ;

[0225] (4) Virtual query ratio parameter p: used to control the probability of generating virtual queries;

[0226] (5) Upper limit of virtual query quantity N max : Used to limit the number of virtual queries generated each time;

[0227] (6) User attribute set U: contains the user's attributes and permission information, which is used to generate virtual queries that meet the permissions (applicable to ABE encrypted data).

[0228] The output of the virtual query method is: virtual query set Q virtual .

[0229] Based on this, the virtual query method C may include the following steps:

[0230] C1. Initialize virtual query set Used to store generated virtual queries;

[0231] C2. Determine the data blocks that need to generate virtual queries. anomaly and system strategy to determine the data block set C that needs to generate virtual queries target The selection principles are as follows:

[0232] (1) Abnormal data blocks containing highly sensitive data.

[0233] (2) Data blocks with abnormally high query frequency.

[0234] (3) Data blocks that are repeatedly accessed by specific users.

[0235] C3, target data block C target Generates a dummy query. target Each target block c in k Do the following:

[0236] (1) Determine the number of virtual queries: Determine the number of virtual queries N that need to be generated based on system parameters and the degree of abnormality of the data block. k , the calculation formula is N k =min(round(p×AnomalyScore(c k )),N max ). Among them, AnomalyScore (ck) is the anomaly score of the data block, ranging from 0 to 1.

[0237] (2) According to N k , generate virtual queries one by one, the detailed sub-steps are as follows:

[0238] ① Determine the type of virtual query: If c k If it is an OPE encrypted block, a range query similar to the real query is generated, and the range can be slightly offset or expanded; if it is an OPE encrypted block, a virtual query that meets the permissions is generated based on the user attribute set U;

[0239] ② Generate virtual query content: Randomly select the query content that matches c from the dataset D. k Data blocks of the same type and similar sensitivity d virtual ; Construct OPE encrypted query or ABE encrypted query respectively; when constructing OPE query, the range contains d virtual When constructing an ABE query, construct a query that satisfies a specific attribute strategy;

[0240] ③Generate virtual query object: construct virtual query q virtual , whose format and structure are consistent with the real query; set the metadata of the query (such as timestamp, user ID, etc.), where the timestamp can be randomly generated near the current time; the user ID can select a virtual user or an anonymous user with corresponding permissions;

[0241] ④q virtual Add to virtual query set Q virtual middle;

[0242] ⑤Inject virtual queries into the system: inject virtual query set Q virtual Inject into query processing and execute together with real queries; when executing virtual queries, virtual queries can be inserted at certain time intervals to simulate real query behavior; the execution priority of virtual queries needs to be controlled to avoid affecting the performance of real queries;

[0243] ⑥Update query history: Add the record of the virtual query to the query history QueryHistory for subsequent analysis.

[0244] C4. Executing virtual queries will have a certain impact on system performance, so it is necessary to monitor the impact of virtual queries on system performance to ensure that they do not cause excessive load. Dynamically adjust the virtual query ratio parameter p and the upper limit N according to the system's operating status and security requirements. max .

[0245] S214. Dynamically encrypt the encrypted data based on the dynamic encryption strategy to obtain dynamic encrypted data.

[0246] In this embodiment, the encrypted data can still support efficient query functions after encryption is completed, and can defend against common encryption attacks.

[0247] In this embodiment, the execution subject of the method may be a computing device such as a computer or a server, and no limitation is made in this embodiment.

[0248] In this embodiment, the execution subject of the method may also be a smart device such as a smart phone, a tablet computer, etc., which is not limited in this embodiment.

[0249] It can be seen that the encryption method for unstructured data described in this embodiment can dynamically adjust the encryption strategy according to attribute information such as data sensitivity, access frequency, usage scenarios, etc., so as to meet the query requirements of data in an encrypted state and defend against inference attacks, frequency attacks, and plaintext attacks, etc.

[0250] Example 3

[0251] This embodiment provides three exemplary schematic processes of encryption methods for unstructured data. The first exemplary schematic process of encryption method for unstructured data is for unstructured data of text data type, wherein:

[0252] The sample text is: " User information: Name: Alice, Address: 123 Street, Transaction details: Purchased 500 Taste". Based on this, the example schematic process is as follows:

[0253] S1. Data layered encryption

[0254] 1. Encryption strategy selection:

[0255] (1) High-sensitivity block (block 1): uses the AES-256 encryption algorithm, uses a fine-grained block strategy, and combines order-preserving encryption (OPE) to support range queries.

[0256] (2) Medium sensitivity block (block 2): uses the AES-128 encryption algorithm and a medium-granularity block strategy.

[0257] (3) Low sensitivity block (block 3): None.

[0258] 2. Encryption process: For each data block, encrypt it according to the encryption strategy:

[0259] EncryptedBlock1=OPE_AES256_Encrypt(Block1,Key1)

[0260] EncryptedBlock2=AES128_Encrypt(Block2,Key2)

[0261] S2. Dynamic encryption adjustment mechanism

[0262] 1. The initial settings are as follows:

[0263] (1) Access frequency threshold: Set the threshold FreqThreshold = 0.1 times / minute and PatternThreshold = 0.75.

[0264] (2) Query history: Initialized to empty.

[0265] 2. Simulated query scenario: The user frequently queries transaction details (block 2) and transaction personnel information (block 1), and the number of queries reaches 12 times, exceeding the threshold.

[0266] 3. High-frequency query detected: Freq(Block2)=0.12>FreqThreshold.

[0267] 4. Analyze the user's query pattern to obtain: AnomalyScore (c k )=0.8>PatternThreshold

[0268] 5. Reduce the encryption level:

[0269] Adjust the encryption algorithm of block 2 from AES-128 to a lightweight encryption algorithm, such as AES-64, to improve query efficiency, and recalculate: AdjustedBlock2 = AES64_Encrypt (Block2, Key2′).

[0270] 6. Record metadata and indexes: Record changes in encryption algorithms to ensure correct decryption for subsequent queries.

[0271] 7. Due to the anomaly score AnomalyScore (c k ) is greater than the threshold, so it is necessary to generate a virtual query to confuse the real query and protect highly sensitive data.

[0272] S3, Virtual Query Generation and Processing

[0273] 1. Generate a virtual query:

[0274] (1) Assume that the probability of virtual query p = 3 and the number of virtual queries N max =10.

[0275] (2) User real query: query "transaction details"

[0276] (3) Generate virtual query quantity:

[0277] N k =min(round(p×AnomalyScore(c k )),N max )

[0278] =min(round(3×0.8),10)

[0279] =3

[0280] (4) Generate two virtual queries:

[0281] ① Virtual query 1: Select a virtual item with similar type and sensitivity to "Transaction details". Suppose "Transaction history: 300 items purchased" is selected. The query content is: "Query transaction history".

[0282] ② Virtual query 2: Randomly select a data item with similar sensitivity and construct a similar query request. Assume that "transfer record: transfer 200 to user Bob" is selected. The query content is: "query transfer record".

[0283] ③ Virtual query 3: Select a data block of related information to simulate the user's query on sensitive account information. Assume that "Account balance: Account balance 5000" is selected. The query content is: "Query account balance".

[0284] 2. Virtual query processing:

[0285] (1) Hybrid query: The real query "transaction details" and the generated virtual query are sent to the query processing module together.

[0286] (2) Execute the query: perform index matching, decryption, and return results for the "transaction details" (real query). For the return results of the virtual query, the system can use templated data or forged data to prevent the leakage of actual data; for example, a fixed-format "query success" message can be returned for the virtual query without involving the real data content.

[0287] 3. Defense effect: Attackers cannot infer the user's true query intention through query frequency, which enhances the security of the system.

[0288] S4. Key Management

[0289] 1. Dynamic key rotation. When the encryption algorithm or key needs to be updated, the system generates a new key through a secure key management module (such as HSM). The specific rotation process is as follows:

[0290] (1) Generate new keys: K1′, K2′.

[0291] (2) Update encryption and re-encrypt the affected data blocks.

[0292] (3) Abandon old keys: Safely destroy old keys K1 and K2 to prevent leakage.

[0293] 2. Key storage and distribution.

[0294] (1) Keys are stored in a secure key management module and can only be accessed by authorized system components.

[0295] (2) Key access control: Role-based access control (RBAC) can be used to ensure that only those with necessary permissions can access the key.

[0296] The second example schematic flow of the encryption method for unstructured data is for image data type, wherein:

[0297] The example scenario is: a user uploads a photo of his ID card that contains his face and ID card number. The image needs to be securely stored and managed while supporting efficient query and defending against potential attacks. Based on this, the example process is as follows:

[0298] S1. Data encryption

[0299] 1. Encryption strategy selection: Select appropriate encryption algorithms and strategies based on the sensitivity and access frequency of the data block.

[0300] (1) Block 1 and Block 2 (high sensitivity): AES-256 encryption algorithm is used to ensure high security. Order-Preserving Encryption (OPE) is used to support range queries on encrypted data, such as retrieving facial areas by location or features.

[0301] (2) Block 3 (low sensitivity): uses a lightweight encryption algorithm, such as RC4, to improve processing efficiency.

[0302] 2. Encryption process: Encrypt each data block.

[0303] (1) For each facial data block B 1,k , calculate E 1,k =OPE_AES256_Encrypt(B 1,k ,K1).

[0304] (2) Encrypt block 2 and calculate E2 = OPE_AES256_Encrypt (B2, K2).

[0305] (3) Encrypt block 3: For each background data block B 3,l Calculate E 3,l =RC4_Encrypt(B 3,l ,K3).

[0306] (3) Key management: Generate independent keys K1, K2, and K3 for different encryption algorithms and data blocks, and use a secure key management module to store and manage them.

[0307] S2. Dynamic encryption adjustment mechanism

[0308] 1. Query frequency monitoring: The system monitors the access frequency of data blocks in real time and records it in the query history QueryHistory. Set the access frequency threshold, assuming the threshold is 0.1 times / minute.

[0309] 2. When the access frequency reaches the set threshold, the encryption strength is dynamically adjusted.

[0310] (1) Detect high-frequency access: By calculating the access frequency of different blocks, we can find a certain data block, such as B 2,k The access frequency exceeds the threshold, that is, Freq(B 2,k )>0.1, the encryption strength is reduced.

[0311] (2) Reduce encryption strength:

[0312] ① Generate a new key K′2 and update it in the key management module.

[0313] ②Data block B2,k The encryption algorithm of the system is adjusted from AES-256 to AES-128 to improve query efficiency: 2,k =AES128_Encrypt(B 2,k ,K′2).

[0314] (3) Update metadata and indexes: Record changes in encryption algorithms and new key information in metadata; and update indexes to ensure that subsequent queries can be correctly matched and decrypted.

[0315] (4) When it is detected that the abnormal score of a certain highly sensitive data block exceeds the threshold, a virtual query is generated to confuse the user's real query.

[0316] S3, Virtual Query Generation and Processing

[0317] 1. User real query: The user requests to query facial features, that is, the data block E 1,k Make a query.

[0318] 2. Generate a virtual query:

[0319] (1) First, set the virtual query parameters: virtual query probability p = 1; maximum number of virtual queries N max =10.

[0320] (2) Calculate the number of virtual queries:

[0321] N k =min(round(p×AnomalyScore(c k )),N max )

[0322] =min(round(1×0.8),10)

[0323] =1

[0324] (3) Generate virtual query content: Randomly select other data blocks in the system, such as background data block E 3,l , generate a virtual query VQ i .

[0325] 3. Mixed query processing and query execution: Submit the real query and virtual query together to the query processing module.

[0326] 4. Process the query results: For the data blocks of the real query, perform decryption and decompression, and return the results to the user. For the data blocks of the virtual query, no results are returned, but the query behavior is recorded in the query log.

[0327] 5. Security Enhanced Analysis: By introducing virtual queries, attackers cannot infer the user’s true query intent by analyzing query frequency and patterns.

[0328] S4. Key Management

[0329] 1. Dynamic key rotation. When the encryption algorithm or key needs to be updated, the system generates a new key through a secure key management module (such as HSM). The key update process is as follows:

[0330] (1) Generate a new key: K 1′ , K 2′ , K 3′

[0331] (2) Update encryption: Re-encrypt the affected data blocks.

[0332] (3) Abandon old keys: Safely destroy old keys K1, K2, and K3 to prevent leakage.

[0333] 2. Key storage and distribution: Store keys in a secure key management module so that only authorized system components can access them. For example, role-based access control (RBAC) is used to ensure that only those with necessary permissions can access keys.

[0334] The third example schematic flow of the encryption method for unstructured data is for the video data type, wherein:

[0335] The example scenario is: the company's internal meeting record video contains sensitive business secrets, and the video needs to be securely stored and managed while supporting efficient query and defending against potential attacks. Based on this, the example schematic process is as follows:

[0336] S1. Data encryption

[0337] 1. Encryption strategy selection: Select appropriate encryption algorithms and strategies based on the sensitivity and access requirements of the data block.

[0338] (1) Block 1 (high sensitivity): AES-256 encryption algorithm is used to ensure high security. Order-preserving encryption (OPE) is also used to support time period queries on encrypted data, making it convenient for users to retrieve confidential discussion fragments by time range.

[0339] (2) Block 2 (medium sensitivity): uses the AES-128 encryption algorithm to balance security and performance.

[0340] (3) Block 3 (low sensitivity): Use a lightweight encryption algorithm (such as RC4) or do not perform encryption to improve processing efficiency.

[0341] 2. Encryption process: Encrypt each data block.

[0342] (1) Block 1 encryption: For each high-sensitivity data block B 1,k ,calculate:

[0343] E 1,k =OPE_AES256_Encrypt(B 1,k ,K1).

[0344] (2) Encryption of block 2: For each medium-sensitivity data block B 2,l ,calculate:

[0345] E 2,l =AES128_Encrypt(B 2,l ,K2).

[0346] (3) Block 3 encryption: For each low-sensitivity data block B 3,m Whether to encrypt depends on the needs (such as legal and regulatory requirements, company security policies require encryption; public data does not need to be encrypted). The encryption calculation method is E 3,m =RC4_Encrypt(B 3,m ,K3); unencrypted is E 3,m =B 3,m .

[0347] 3. Key management: Generate independent keys K1, K2, and K3 for different encryption algorithms and data blocks, and use a secure key management module (such as HSM) for storage and management.

[0348] S2. Dynamic encryption adjustment mechanism

[0349] 1. Query frequency monitoring: The system monitors the access frequency of data blocks in real time and records it in the query history QueryHistory. Set the total time TotalTime to 1 day. First, set the access frequency threshold. Assume that the threshold FreqThreshold of block 2 is 0.1 times / minute.

[0350] 2. When the access frequency reaches the set threshold, dynamically adjust the encryption strength. The specific method is:

[0351] (1) Detect high-frequency access: By calculating the access frequency of different blocks, we can find a certain data block, such as B 2,k The access frequency exceeds the threshold, that is, Freq(B 2,k )>0.1, the encryption strength is reduced.

[0352] (2) Reduce encryption strength:

[0353] ① Generate a new key K′2 and update it in the key management module.

[0354] ②Data block B 2,k The encryption algorithm of the system is adjusted from AES-256 to AES-128 to improve query efficiency: 2,k =AES128_Encrypt(B 2,k ,K′2).

[0355] (3) Update metadata and indexes: Record changes in encryption algorithms and new key information in metadata; and update indexes to ensure that subsequent queries can be correctly matched and decrypted.

[0356] (4) When it is detected that the abnormal score of a certain highly sensitive data block exceeds the threshold, a virtual query is generated to confuse the user's real query.

[0357] S3, Generation and Processing of Virtual Queries

[0358] 1. User real query: Set the user to query the confidential discussion fragment, that is, the highly sensitive data block E 1,k Make a query.

[0359] 2. Generate a virtual query. The generation process is as follows:

[0360] (1) Setting virtual query parameters: virtual query probability p = 1; maximum number of virtual queries N = 5.

[0361] (2) Calculate the number of virtual queries:

[0362] N k =min(round(p×AnomalyScore(c k )),N max )

[0363] =min(round(1×0.8),10)

[0364] =1

[0365] (3) Generate the number of virtual queries M = random(1,N).

[0366] (4) Generate virtual query content: Randomly select other data blocks in the system, such as low-sensitivity block E 3,m , generate a virtual query VQ i .

[0367] 3. Execute query: Submit the real query and virtual query together to the query processing module.

[0368] 4. Processing of query results: For the data blocks of real queries, decryption and decompression are performed, and the results are returned to the user. For the data blocks of virtual queries, no results are returned, but the query behavior is recorded in the query log.

[0369] 5. Security analysis: By introducing virtual queries, we can defend against attackers who can infer the user’s true query intention by analyzing query frequency and patterns.

[0370] S4. Key Management

[0371] 1. Dynamic key rotation. When the encryption algorithm or key needs to be updated, the system generates a new key through a secure key management module (such as HSM). The specific rotation process is as follows:

[0372] (1) Generate new keys: K′1, K′2.

[0373] (2) Update encryption and re-encrypt the affected data blocks.

[0374] (3) Abandon old keys: Safely destroy old keys K1 and K2 to prevent leakage.

[0375] 2. Key storage and distribution

[0376] (1) Keys are stored in a secure key management module and can only be accessed by authorized system components.

[0377] (2) Key access control: Role-based access control (RBAC) can be used to ensure that only those with necessary permissions can access the key.

[0378] It can be seen that the encryption method for unstructured data described in this embodiment can dynamically adjust the encryption strategy according to attribute information such as data sensitivity, access frequency, and usage scenarios, thereby ensuring the security of data encryption while solving performance bottleneck problems in high-frequency access scenarios.

[0379] Example 4

[0380] Please see Figure 4 , Figure 4 A schematic diagram of the structure of an unstructured data encryption device provided in this embodiment. Figure 4 As shown, the encryption device for unstructured data includes:

[0381] The acquisition unit 310 is used to acquire pre-processed data of the unstructured data; wherein the pre-processed data is block data;

[0382] An identification unit 320, used to identify attribute information of preprocessed data;

[0383] A first determining unit 330, configured to determine an initial encryption strategy for preprocessed data based on the attribute information;

[0384] The encryption unit 340 is used to encrypt the pre-processed data based on the initial encryption strategy to obtain encrypted data.

[0385] In this embodiment, the explanation of the encryption device for unstructured data can refer to the description in Embodiment 1 or Embodiment 2, which will not be further elaborated in this embodiment.

[0386] It can be seen that the encryption device for unstructured data described in this embodiment can dynamically adjust the encryption strategy according to attribute information such as data sensitivity, access frequency, and usage scenarios, thereby ensuring the security of data encryption while solving performance bottleneck problems in high-frequency access scenarios.

[0387] Example 5

[0388] Please see Figure 5 , Figure 5 A schematic diagram of the structure of an unstructured data encryption device provided in this embodiment. Figure 5 As shown, the encryption device for unstructured data includes:

[0389] The acquisition unit 310 is used to acquire pre-processed data of the unstructured data; wherein the pre-processed data is block data;

[0390] An identification unit 320, used to identify attribute information of preprocessed data;

[0391] A first determining unit 330, configured to determine an initial encryption strategy for preprocessed data based on the attribute information;

[0392] The encryption unit 340 is used to encrypt the pre-processed data based on the initial encryption strategy to obtain encrypted data.

[0393] As an optional implementation, the encryption device for unstructured data further includes:

[0394] An adjustment unit 350, configured to adjust the initial encryption strategy to a dynamic encryption strategy based on the query record of the encrypted data;

[0395] The encryption unit 340 is further used to dynamically encrypt the encrypted data based on the dynamic encryption strategy to obtain dynamic encrypted data.

[0396] In this embodiment, the attribute information includes sensitivity information, access frequency information, and usage scenario information;

[0397] The sensitivity information includes high sensitivity, medium sensitivity and low sensitivity;

[0398] The access frequency information includes high access frequency, medium access frequency, and low access frequency;

[0399] The usage scenario information includes real-time processing scenario, batch processing scenario and archiving scenario.

[0400] As an optional implementation manner, the first determination unit 330 is specifically configured to determine an initial encryption strategy for the preprocessed data based on a strong encryption algorithm when the sensitivity information in the attribute information is high sensitivity; or

[0401] When the sensitivity information in the attribute information is medium sensitivity, determining an initial encryption strategy for the preprocessed data based on a standard encryption algorithm; or

[0402] When the sensitivity information in the attribute information is low sensitivity, determining an initial encryption strategy for the preprocessed data based on a weak encryption algorithm; or

[0403] When it is determined based on the attribute information that the pre-processed data is data that does not need to be encrypted, the initial encryption policy of the pre-processed data is determined to be empty.

[0404] As an optional implementation, the first determination unit 330 is further configured to determine an initial encryption strategy for the preprocessed data based on an order-preserving encryption algorithm when the data type of the preprocessed data in the attribute information is a string type or an integer type; or

[0405] When it is determined based on the attribute information that the pre-processed data is data that needs to support a sorting query or data that needs to support a range query, an initial encryption strategy for the pre-processed data is determined based on an order-preserving encryption algorithm; or

[0406] When it is determined based on the attribute information that the pre-processed data is data that needs to support permission access, an initial encryption strategy for the pre-processed data is determined based on an attribute-based encryption algorithm.

[0407] As an optional implementation, the adjustment unit 350 includes:

[0408] A calculation subunit 351, configured to perform calculation based on the query record of the encrypted data to obtain the query frequency of the encrypted data;

[0409] The adjustment subunit 352 is used to downgrade the initial encryption strategy to obtain a dynamic encryption strategy when the query frequency is greater than a preset frequency threshold and the sensitivity information in the attribute information is not high sensitivity;

[0410] The encryption strength downgrading process at least includes reducing the strength of the encryption algorithm in the initial encryption strategy.

[0411] As an optional implementation, the adjustment unit 350 includes:

[0412] The analysis subunit 353 is used to perform time pattern analysis, user pattern analysis and content pattern analysis based on the query record of the encrypted data to obtain a query pattern analysis result;

[0413] The calculation subunit 351 is further used to perform calculations based on the query pattern analysis results to obtain an abnormality score of the encrypted data;

[0414] The adjustment subunit 352 is further used to upgrade the encryption strength of the initial encryption strategy to obtain a dynamic encryption strategy when the abnormality score is greater than a preset score threshold and the sensitivity information in the attribute information is not high sensitivity;

[0415] The encryption strength upgrade process at least includes improving the strength of the encryption algorithm in the initial encryption strategy.

[0416] As an optional implementation, the encryption device for unstructured data further includes:

[0417] A calculation unit 360, configured to calculate the number of virtual queries based on a preset virtual query ratio parameter when the query frequency is greater than a preset frequency threshold and the sensitivity information in the attribute information is high sensitivity, or when the anomaly score is greater than a preset score threshold and the sensitivity information in the attribute information is high sensitivity, or when the encrypted data is repeatedly accessed by users of a preset user group;

[0418] A second determination unit 370, configured to determine a virtual query type and virtual query content based on the encrypted data;

[0419] A generating unit 380, configured to generate a virtual query request based on the number of virtual queries, the type of virtual queries and the content of virtual queries;

[0420] The inserting unit 390 is used to insert the virtual query request into the real query request sequence based on a preset insertion time requirement and a preset insertion priority requirement.

[0421] As an optional implementation, the encryption device for unstructured data further includes:

[0422] The key management unit 400 is used to generate a new key or a new encryption algorithm through the key management module when the initial encryption policy is updated;

[0423] The key updating unit 410 is used to update the old key or the old encryption algorithm in the initial encryption policy to a new key or a new encryption algorithm, and discard the old key or the old encryption algorithm.

[0424] In this embodiment, the explanation of the encryption device for unstructured data can refer to the description in Embodiment 1 or Embodiment 2, which will not be further elaborated in this embodiment.

[0425] It can be seen that the encryption device for unstructured data described in this embodiment can dynamically adjust the encryption strategy according to attribute information such as data sensitivity, access frequency, usage scenarios, etc., so as to meet the query requirements of data in an encrypted state and defend against inference attacks, frequency attacks, plaintext attacks, etc.

[0426] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the encryption method of unstructured data in Embodiment 1 or Embodiment 2 of the present application.

[0427] An embodiment of the present application provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are read and executed by a processor, the encryption method for unstructured data in Embodiment 1 or Embodiment 2 of the present application is executed.

[0428] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0429] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0430] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0431] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0432] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0433] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for encrypting unstructured data, characterized in that: include: Acquire preprocessed data of unstructured data; wherein the preprocessed data is block data; Identifying attribute information of the preprocessed data; Based on the attribute information, determining an initial encryption strategy for the preprocessed data; The pre-processed data is encrypted based on the initial encryption strategy to obtain encrypted data.

2. The method for encrypting unstructured data according to claim 1, characterized in that: The method further comprises: Based on the query record of the encrypted data, adjusting the initial encryption strategy to a dynamic encryption strategy; The encrypted data is dynamically encrypted based on the dynamic encryption strategy to obtain dynamic encrypted data.

3. The method for encrypting unstructured data according to claim 1, characterized in that: The attribute information includes sensitivity information, access frequency information and usage scenario information; The sensitivity information includes high sensitivity, medium sensitivity and low sensitivity; The access frequency information includes high access frequency, medium access frequency and low access frequency; The usage scenario information includes real-time processing scenarios, batch processing scenarios, and archiving scenarios.

4. The method for encrypting unstructured data according to claim 3, characterized in that: The determining, based on the attribute information, an initial encryption strategy for the pre-processed data includes: When the sensitivity information in the attribute information is high sensitivity, determining an initial encryption strategy for the preprocessed data based on a strong encryption algorithm; or When the sensitivity information in the attribute information is medium sensitivity, determining an initial encryption strategy for the preprocessed data based on a standard encryption algorithm; or When the sensitivity information in the attribute information is low sensitivity, determining an initial encryption strategy for the preprocessed data based on a weak encryption algorithm; or When it is determined based on the attribute information that the pre-processed data is data that does not need to be encrypted, the initial encryption policy of the pre-processed data is determined to be empty.

5. The encryption method for unstructured data according to claim 1 or 4, characterized in that: The determining, based on the attribute information, an initial encryption strategy for the pre-processed data includes: When the data type of the pre-processed data in the attribute information is a string type or an integer type, determining an initial encryption strategy for the pre-processed data based on an order-preserving encryption algorithm; or When it is determined based on the attribute information that the pre-processed data is data that needs to support a sorting query or data that needs to support a range query, determining an initial encryption strategy for the pre-processed data based on an order-preserving encryption algorithm; or When it is determined based on the attribute information that the pre-processed data is data that needs to support permission access, an initial encryption strategy for the pre-processed data is determined based on an attribute-based encryption algorithm.

6. The method for encrypting unstructured data according to claim 2, characterized in that: The adjusting the initial encryption strategy to a dynamic encryption strategy based on the query record of the encrypted data includes: Performing calculation based on the query record of the encrypted data to obtain the query frequency of the encrypted data; When the query frequency is greater than a preset frequency threshold and the sensitivity information in the attribute information is not high sensitivity, the initial encryption strategy is subjected to encryption strength downgrade processing to obtain a dynamic encryption strategy; The encryption strength downgrading process at least includes reducing the strength of the encryption algorithm in the initial encryption strategy.

7. The method for encrypting unstructured data according to claim 2, characterized in that: The adjusting the initial encryption strategy to a dynamic encryption strategy based on the query record of the encrypted data includes: Performing time pattern analysis, user pattern analysis, and content pattern analysis based on the query records of the encrypted data to obtain query pattern analysis results; Performing calculation based on the query pattern analysis result to obtain an anomaly score of the encrypted data; When the abnormality score is greater than a preset score threshold and the sensitivity information in the attribute information is not high sensitivity, performing encryption strength upgrade processing on the initial encryption strategy to obtain a dynamic encryption strategy; The encryption strength upgrade process at least includes improving the strength of the encryption algorithm in the initial encryption strategy.

8. The method for encrypting unstructured data according to claim 6 or 7, characterized in that: The method further comprises: When the query frequency is greater than the preset frequency threshold and the sensitivity information in the attribute information is high sensitivity, or when the anomaly score is greater than the preset score threshold and the sensitivity information in the attribute information is high sensitivity, or when the encrypted data is repeatedly accessed by users of a preset user group, the number of virtual queries is calculated based on a preset virtual query ratio parameter; Based on the encrypted data, determining a virtual query type and virtual query content; Generate a virtual query request based on the virtual query quantity, the virtual query type and the virtual query content; Based on a preset insertion time requirement and a preset insertion priority requirement, the virtual query request is inserted into a real query request sequence.

9. The method for encrypting unstructured data according to claim 1, characterized in that: The method further comprises: When the initial encryption strategy is updated, a new key or a new encryption algorithm is generated by a key management module; The old key or the old encryption algorithm in the initial encryption policy is updated to the new key or the new encryption algorithm, and the old key or the old encryption algorithm is discarded.

10. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the encryption method for unstructured data according to any one of claims 1 to 9.

11. A readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the method for encrypting unstructured data according to any one of claims 1 to 9 is executed.

12. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program executes the unstructured data encryption method according to any one of claims 1 to 9.

Images