Data query method, electronic device, storage medium and program product

Abstract

The present disclosure provides a data query method, an electronic device, a readable storage medium and a computer program product. The data query method of the present disclosure comprises: in response to a query request, obtaining an initial query statement; replacing the plaintext keywords in the initial query statement with secret keywords to obtain an encrypted query statement; based on the encrypted query statement, querying the secret data with the closest query distance to the secret keyword in a secret database to obtain a secret query result; and decrypting the secret query result into a plaintext query result; wherein the query distance between the secret keyword and the secret query result is equal to the query distance between the plaintext keyword and the plaintext query result, and the query distance represents the similarity relationship between the keyword and the queried data.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data query method, electronic equipment, storage medium, and program product. Background Art

[0002] The general language model can query the data in the database based on the query text provided by the user. However, if the data in the database is private, the private data in the database may be leaked due to non-compliant data query and outgoing logic during the query process of the language model, which may cause data security issues. Summary of the invention

[0003] The present disclosure provides a data query method, an electronic device, a storage medium and a program product.

[0004] According to one aspect of the present disclosure, there is provided a data query method, comprising: obtaining an initial query statement in response to a query request; Replacing the plaintext keywords in the initial query statement with encrypted keywords to obtain an encrypted query statement; Based on the encrypted query statement, searching the encrypted database for the encrypted data with the closest query distance to the encrypted keyword to obtain a encrypted query result; Decrypting the encrypted query result into a plaintext query result; The query distance between the secret keyword and the secret query result is equal to the query distance between the plaintext keyword and the plaintext query result, and the query distance represents the similarity relationship between the keyword and the queried data.

[0005] According to at least one embodiment of the data query method of the present disclosure, the plaintext keywords in the initial query statement are replaced with encrypted keywords to obtain an encrypted query statement, including: Obtaining context information of the plaintext keyword; Determine the data type of the plaintext keyword query based on context information of the plaintext keyword in the query text; Determining an encryption strategy based on the data type of the plaintext keyword query; Encrypting the plaintext keywords into encrypted keywords based on the determined encryption strategy; The encrypted keyword is used to replace the corresponding plaintext keyword in the initial query statement.

[0006] According to at least one embodiment of the data query method of the present disclosure, an encryption strategy is determined based on the data type of the plaintext keyword query, including: In response to the data type of the plaintext keyword query being attribute data or relationship data, determining a first encryption strategy; In response to the data type of the plaintext keyword query being constant class data, further determining the query type of the constant class data; In response to the query type of the constant class data being a determined value query, determining the first encryption strategy; In response to the query type of the constant class data being a sequential query, determining a second encryption strategy; In response to the query type of the constant class data being a function query, determining a third encryption strategy; Among them, the first encryption strategy is used to encrypt the same plaintext data into the same encrypted data, the second encryption strategy is used to encrypt the plaintext data into the encrypted data with the same sequence, and the third encryption strategy is used to encrypt the plaintext data into the ciphertext data supporting addition and / or multiplication.

[0007] According to at least one embodiment of the data query method of the present disclosure, decrypting the encrypted query result into a plaintext query result includes: Determine a decryption strategy for the secret query result based on the encryption strategy corresponding to the secret keyword, the decryption strategy corresponding to the encryption strategy; The encrypted query result is decrypted into the plaintext query result based on the determined decryption strategy.

[0008] According to the data query method of at least one embodiment of the present disclosure, the encrypted data is data in vector format, and the encrypted query statement is configured as: Converting the encrypted keywords into vector format data; Traversing each secret state data in the secret state database, respectively calculating the cosine similarity between each secret state data and the secret state keyword, determining the cosine similarity as the query distance between the secret state keyword and the secret state data, and obtaining multiple query distances; The minimum query distance is determined among multiple query distances, and the secret data corresponding to the minimum query distance is determined as the query result.

[0009] According to at least one embodiment of the present disclosure, the data query method further includes: In response to the data addition request, obtaining the added plaintext data; Encrypting the newly added plaintext data into newly added encrypted data; The newly added confidential data is stored in the confidential database.

[0010] According to at least one embodiment of the data query method of the present disclosure, encrypting the newly added plaintext data into newly added encrypted data includes: Obtain the data type of the newly added plaintext data; In response to the data type of the newly added plaintext data being attribute data or relationship data, encrypting the newly added plaintext data into first encrypted data based on a first encryption strategy; In response to the data type of the newly added plaintext data being constant data, encrypting the newly added plaintext data into first encrypted data based on a first encryption strategy, encrypting the newly added plaintext data into second encrypted data based on a second encryption strategy, and encrypting the newly added plaintext data into third encrypted data based on a third encryption strategy; Among them, the first encryption strategy is used to encrypt the same plaintext data into the same encrypted data, the second encryption strategy is used to encrypt the plaintext data into the encrypted data with the same sequence, and the third encryption strategy is used to encrypt the plaintext data into the ciphertext data supporting addition and / or multiplication.

[0011] According to another aspect of the present disclosure, an electronic device is provided, comprising: a memory storing execution instructions; and a processor executing the execution instructions stored in the memory, so that the processor executes the data query method of any embodiment of the present disclosure.

[0012] According to another aspect of the present disclosure, a readable storage medium is provided, in which execution instructions are stored. When the execution instructions are executed by a processor, they are used to implement the data query method of any embodiment of the present disclosure.

[0013] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the data query method of any embodiment of the present disclosure is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings illustrate exemplary embodiments of the present disclosure and together with the description serve to explain the principles of the present disclosure. These drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification.

[0015] Figure 1 It is a flowchart of a data query method according to an embodiment of the present invention.

[0016] Figure 2 It is a schematic diagram of an application scenario of a data query method according to an embodiment of the present invention.

[0017] Figure 3 It is a flowchart of a data query method according to an embodiment of the present invention.

[0018] Figure 4It is a flowchart of a data query method according to an embodiment of the present invention.

[0019] Figure 5 It is a flowchart of a data query method according to an embodiment of the present invention.

[0020] Figure 6 It is a flowchart of a data query method according to an embodiment of the present invention.

[0021] Figure 7 It is a flowchart of a data query method according to an embodiment of the present invention.

[0022] Figure 8 It is a flowchart of a data query method according to an embodiment of the present invention.

[0023] Fig. 9 It is a schematic block diagram of the structure of a data query device according to an embodiment of the present disclosure.

[0024] Fig.10 It is a schematic block diagram of the structure of an electronic device equipped with a data query device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The present disclosure is further described in detail below in conjunction with the accompanying drawings and examples. It is understood that the specific examples described herein are only used to explain the relevant content, rather than to limit the present disclosure. It should also be noted that, for ease of description, only the parts related to the present disclosure are shown in the accompanying drawings.

[0026] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in the present disclosure can be combined with each other. The technical solution of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] In order to protect the privacy data in the database, some existing databases store data in the form of ciphertext, so that even if the data is leaked during the query process, since the leaked data is in the form of ciphertext, the leaked data can still maintain its privacy. However, when querying the data stored in the ciphertext form in the database, it is necessary to convert all the data stored in the ciphertext form in the database into plaintext data, and then query the plaintext data based on the query text provided by the user. In this way, each query requires the database to convert all ciphertexts into plaintext, which on the one hand consumes more computing resources, and on the other hand reduces the efficiency of the query, so that the user needs to wait longer for the query results to be returned. On the other hand, since the ciphertext data in the database needs to be converted into plaintext data first, that is to say, during the query process, it is still possible that the converted plaintext data in the database may be leaked due to non-compliant data query and outgoing logic, and there are still security risks.

[0028] The embodiments of the present disclosure provide a data query method that can be implemented on a server. For example, a user enters a query text in a large language model (LLM) to perform a query. LLM initiates a query request to query data in a database. The server responds to the query request of LLM, executes the data query method provided by the present disclosure, queries the data in the database to obtain a query result, and returns the query result to LLM. After LLM obtains the query result from the server, it sends the query result to the user end.

[0029] Figure 1 FIG. 1 is a schematic diagram showing the overall process of a data query method M100 according to an embodiment of the present disclosure. Figure 1 The method shown includes steps S110 to S170, wherein the method may be executed by a server device.

[0030] Specifically, Figure 1 The methods shown include: S110: In response to the query request, obtain an initial query statement.

[0031] The query request is a request generated by the LLM for obtaining data in the database.

[0032] A query statement is a programming language generated by LLM based on the query text provided by the user. It is used to query the data in the database. For example, the query statement can be a SQL statement (Structured Query Language, abbreviated as: SQL). The query text provided by the user is used to describe the data that the user expects to query. In one example, the query text is a prompt provided by the client. The prompt is used to guide LLM to output the expected results. The prompt can be a question, an instruction, a description text, etc.

[0033] S130: Replace the plaintext keywords in the initial query statement with encrypted keywords to obtain an encrypted query statement.

[0034] A query statement can contain one or more keywords. The keywords in the initial query statement are called plaintext keywords. Plaintext keywords are keywords in plaintext form. Keywords are used to represent the core content and theme of the query text provided by the user. In the query statement, the plaintext keywords are used as the specified query conditions. For example, the query statement can be constructed as: query the text that is most similar to the plaintext keyword "Apple".

[0035] In one example, after LLM obtains the query text, it uses natural language processing technology to extract one or more plaintext keywords from the query text provided by the user. As an example, an NLP library (such as NLTK, spaCy) can be used to perform keyword extraction.

[0036] When the server responds to the query request of the LLM, the initial query statement generated by the LLM can be obtained, and the plaintext keywords extracted by the LLM can be obtained from the initial query statement.

[0037] The encrypted keyword refers to a keyword in ciphertext obtained by encrypting a plaintext keyword. After the plaintext keyword in the initial query statement is replaced with the encrypted keyword, the replaced initial query statement is called an encrypted query statement.

[0038] For example, if the ciphertext is in the form of a string, the plaintext keyword is encrypted and converted into a string. Assume that the initial query statement is constructed as follows: Query the text most similar to the plaintext keyword "Apple". And the encrypted keyword obtained by encrypting the plaintext keyword "Apple" is "M1". After replacing the plaintext keyword in the above initial query statement with the encrypted keyword, the encrypted query statement obtained is: Query the text most similar to the encrypted keyword "M1".

[0039] S150, based on the encrypted query statement, searching the confidential data in the confidential database for the confidential data with the closest query distance to the confidential keyword to obtain a confidential query result.

[0040] Among them, a secret database is a database that uses ciphertext to store queryable data. For example, the queryable data in the RAG (Retrieval-Augmented Generation, abbreviated as: RAG) database is all ciphertext data, so the RAG database is a secret database. The queryable data in the secret database is the secret data in the secret database, and the queried secret data is the secret query result.

[0041] The query distance is used to characterize the similarity relationship between the keyword and the queried data. The higher the similarity between the keyword and the queried data, the closer the query distance between the two. Conversely, the lower the similarity between the keyword and the queried data, the farther the query distance between the two. In this way, based on the nearest query distance, the queried data with the highest similarity to the keyword can be found as the query result, so that the query result is highly relevant to the query text provided by the user. Among them, when querying plaintext data based on plaintext keywords, the relationship represented by the query distance used is the similarity relationship between the plaintext keywords and the queried data in plaintext form. Similarly, when querying secret data based on ciphertext keywords, the relationship represented by the query distance used is the similarity relationship between the secret keyword and the queried data in ciphertext form.

[0042] In an example, parameters such as the Euclidean distance, Manhattan distance, and cosine similarity between two data may be used as the query distance between the two data.

[0043] S170. Decrypt the encrypted query result into a plaintext query result.

[0044] The secret data in the secret database is the data in ciphertext obtained by encrypting the plaintext data. Based on this, the secret data in the secret database can be decrypted into plaintext data using a decryption method corresponding to the encryption method. Among them, the secret query result is the secret data in the secret database, so the plaintext data obtained by decrypting the secret query result is the plaintext query result.

[0045] In the embodiments of the present disclosure, the encryption method used when encrypting plaintext keywords into secret keywords, and the encryption scheme used when encrypting plaintext data into secret data in a secret database, is a distance-preserving encryption (DPE) scheme. A distance-preserving encryption scheme refers to an encryption scheme that keeps the relative distance relationship between data unchanged while encrypting data. The embodiments of the present disclosure use a distance-preserving encryption scheme to encrypt plaintext keywords into secret keywords, and to encrypt plaintext data into secret data in a secret database, with the purpose of making the query distance between the secret keywords and the secret query results equal to the query distance between the plaintext keywords and the plaintext query results. In this way, the plaintext query result obtained after decrypting the secret query result obtained based on the query distance of the secret keyword is equivalent to the query result obtained based on the query distance of the plaintext keyword. That is to say, assuming that a plaintext query result A can be obtained by querying the plaintext database based on the initial query statement, and a secret query result B' can be obtained by querying the secret database based on the encrypted query statement, the secret query result B' can be decrypted into the plaintext query result B, and the secret keyword in the secret query statement is the keyword encrypted by the plaintext keyword in the initial query statement using the distance-preserving encryption scheme, then the plaintext query result A is equivalent to the plaintext query result B.

[0046] Thus, based on the embodiments of the present disclosure, the secret data in the secret database can be queried using secret keywords. Thus, when querying, it is not necessary to convert all the secret data in the secret database into plain text data, which can effectively save computing resources, improve query efficiency, and avoid leaking plain text data in the database during the query process.

[0047] Furthermore, the embodiments of the present disclosure do not need to modify the query logic of the LLM. The LLM can generate an initial query statement based on plaintext keywords according to the traditional query logic. The embodiments of the present disclosure process the initial query statement into an encrypted query statement so that the encrypted query statement can be used to query the confidential data in the confidential database, and the obtained confidential query result is converted into a plaintext query result and sent to the LLM. In this process, the steps of generating the initial query statement and obtaining the plaintext query result executed by the LLM do not change, so that the embodiments of the present disclosure can be applied without the LLM being aware. On the one hand, it has good versatility and can be widely used in various LLMs currently on the market. On the other hand, the feature of LLM being unaware can prevent the provider of the LLM from setting non-compliant data query and outgoing logic for the confidential database to a certain extent, thereby improving the security of data query.

[0048] Please combine Figure 2 , Figure 2A schematic diagram illustrating a scenario of a data query method in some embodiments of the present disclosure. Figure 2 In the illustrated scenario, the data query method disclosed above is executed using an encrypted query component, which may be software or an application on a server device.

[0049] First, a secret database is pre-built. The secret data in the secret database is data in ciphertext form obtained based on a distance-preserving encryption scheme, so that when the secret data is queried, the same distance characteristics as its plaintext form can be maintained.

[0050] When the user sends a query text to LLM, LLM extracts the plaintext keywords in the query text and generates an initial query statement based on the extracted plaintext keywords. Then, LLM sends a query request to the confidential database to perform data query based on the initial query statement.

[0051] The encrypted query component intercepts the query request sent by LLM, obtains the initial query statement generated by LLM, encrypts the plaintext keywords in the initial query statement into secret keywords based on the distance-keeping encryption scheme, and uses the secret keywords to replace the plaintext keywords in the initial query statement to obtain the encrypted query statement. In this process, the encrypted query component does not need to make complex modifications to the initial query statement, and the query logic of the encrypted query statement is still the query logic of the initial query statement, so that the encrypted query component does not need to consume large computing resources and is easier to configure.

[0052] After obtaining the encrypted query statement, the encrypted query statement is used to query the secret data in the secret database. Among them, the query logic configured in the initial query statement is to query the plaintext data with the closest query distance between the query and the plaintext keyword. Based on this, the query logic configured in the encrypted query statement is to query the secret data with the closest query distance between the query and the secret keyword, and the query logic is still based on the nearest query distance to query the target data. Among them, since the secret keywords and the secret data in the secret database are data encrypted based on the distance-maintaining encryption scheme, the encrypted secret keywords or secret data can maintain the same distance characteristics as the plaintext keywords or plaintext data before encryption, so that the query distance between the secret keywords and the secret query results is equal to the query distance between the plaintext keywords and the plaintext query results. In this way, the plaintext query result obtained by decrypting the secret query result is equivalent to the plaintext query result obtained based on the initial query statement, so that the results of the ciphertext query and the plaintext query have good consistency.

[0053] The encrypted query component obtains the confidential query result returned by the confidential database, decrypts the confidential query result into a plaintext query result, and sends the plaintext query result to the LLM. For the LLM end, when the data query method of the present invention is not used, the dynamics of the LLM end are to send a query request and obtain a plaintext query result. When the data query method of the present invention is used, the dynamics of the LLM end are still to send a query request and obtain a plaintext query result. Therefore, the LLM end is suitable for the data query method of the present invention without any modification to the LLM itself, and the data query method of the present invention has good universality.

[0054] Finally, LLM sends the plaintext query results sent by the encrypted query component to the user end, completing a query process.

[0055] Regarding step S130, in some embodiments of the present disclosure, it may include the following steps: Figure 3 Steps S1310 to S1350 are shown.

[0056] S1310. Obtain context information of the plaintext keyword.

[0057] Please combine Figure 2 , taking the encrypted query component executing step S1310 as an example. In one example, the encrypted query component can obtain the query text provided by the user from the LLM, and apply the natural language processing technology to obtain the context information of the plaintext keywords from the query text. In another example, the encrypted query component can initiate a request to the LLM to request the LLM to extract the context information of the plaintext keywords from the query text provided by the user, and return the extracted context information of the plaintext keywords to the encrypted query component, so that there is no need to configure the natural language processing function for the encrypted query component.

[0058] S1320: Determine the data type of the plaintext keyword query based on context information of the plaintext keyword in the query text.

[0059] Among them, determining the data type of the plaintext keyword query refers to what type of data the plaintext keyword is used to query, that is, the intention of using the plaintext keyword to query. The data type includes at least one of constant data, attribute data, and relationship data. Constant data is often a certain word, value, text and other data. The query data type is constant data, which means querying a certain data. Attribute data is data with attributes. The query data type is attribute data, which means one or more attributes of the query data. Relationship data is data with relationships. The query data type is relationship data, which means one or more relationships of the query data.

[0060] Please combine Figure 2, taking the encrypted query component executing step S1310 as an example. In one example, the encrypted query component may apply natural language processing technology to determine the data type of the plaintext keyword query based on the context information in the query text. In another example, the encrypted query component may initiate a request to the LLM to request the LLM to extract the data type of the plaintext keyword query, so that there is no need to configure the natural language processing function for the encrypted query component.

[0061] S1330. Determine an encryption strategy based on the data type of the plaintext keyword query.

[0062] In some embodiments of the present disclosure, the distance-maintaining encryption scheme ensures that data of different data types can have distance consistency before and after encryption, and multiple encryption strategies are configured for data of different data types. Based on this, when the data type of the plaintext keyword query is obtained, a suitable encryption strategy can be determined from multiple encryption strategies.

[0063] S1340. Encrypt the plaintext keywords into encrypted keywords based on the determined encryption strategy.

[0064] Among them, different encryption strategies implement different encryption algorithms for encryption. The specific encryption strategies and the encryption algorithms implemented by the encryption strategies will be introduced in detail below and will not be described here.

[0065] S1350. Use the encrypted keyword to replace the corresponding plaintext keyword in the initial query statement.

[0066] If the initial query statement contains multiple plaintext keywords, the plaintext keywords are replaced with the encrypted ciphertext keywords during the replacement process. In this process, other content items and formats in the initial query statement do not need to be changed.

[0067] Regarding step S1330, in some embodiments of the present disclosure, it may include: Figure 4 Steps S1331 to S1335 are shown.

[0068] S1331. In response to the data type of the plaintext keyword query being attribute data or relationship data, determine a first encryption strategy.

[0069] The first encryption strategy is a deterministic encryption strategy (Deterministic Encryption, abbreviated as: DET), which is used to encrypt the same plaintext data into the same encrypted data.

[0070] For example, the plaintext data is "apple", and the secret data obtained by encrypting the plaintext data "apple" using the first encryption strategy is "M1". Each time the plaintext data "apple" is encrypted using the first encryption strategy, the encrypted secret data is "M1".

[0071] When querying, for attribute data or relationship data, the query distance is equivalent to the point-to-point distance, so a deterministic encryption strategy must be used to ensure that the correct attributes or relationships can be accessed when the query is executed.

[0072] In one example, the encryption algorithms that can be implemented by the deterministic encryption policy include AES, DES, 3DES, RC4, RC5, IDEA, etc.

[0073] S1332. In response to the data type of the plaintext keyword query being constant data, further determine the query type of the constant data.

[0074] The query types for constant data include queries on constant values, queries on the order of constants, and queries on constants that represent functions. Different query types require different encryption strategies to ensure that the correct constants can be accessed when the query is executed.

[0075] S1333. In response to the query type of the constant class data being a determined value query, determine a first encryption strategy.

[0076] When the query type for constant class data is a deterministic value query, the query distance during the query is equivalent to the point-to-point distance, so a deterministic encryption strategy must be used to ensure correct point-to-point access.

[0077] S1334. In response to the query type of the constant class data being a sequential query, determine a second encryption strategy.

[0078] The second encryption strategy is order preserving encryption (OPE), which is used to encrypt plaintext data into encrypted data with the same order.

[0079] For example, assuming that x and y represent plaintext data, OPE(x) represents the encrypted data obtained by encrypting the plaintext data x based on the order-preserving encryption strategy, and OPE(y) represents the encrypted data obtained by encrypting the plaintext data y based on the order-preserving encryption strategy. In this case, if x<y, then OPE(x)<OPE(y).

[0080] When the query type of constant class data is a sequential query, as long as the sequence of query distances is ensured to be consistent during the query, the plaintext query result and the encrypted query result can be ensured to be equivalent.

[0081] For example, assume that x, y, and z represent plaintext data, respectively; OPE(x), OPE(y), and OPE(z) represent the encrypted data obtained by encrypting the above plaintext data based on the order-preserving encryption strategy, respectively; w is the plaintext keyword, and OPE(w) is the ciphertext keyword. Among them, the similarity between w and x is recorded as (w, x), (w, x) = 0.1; the similarity between w and y is recorded as (w, y), (w, y) = 0.50; the similarity between w and z is recorded as (w, z), (w, z) = 0.52; the similarity between OPE(w) and OPE(x) is recorded as (OPE(w), OPE(x)), (OPE(w), OPE(x)) = 0.1; the similarity between OPE(w) and OPE(y) is recorded as (OPE(w), OPE(y)), (OPE(w), OPE(y)) = 0.96; the similarity between OPE(w) and OPE(z) is recorded as (OPE(w), OPE(z)), (OPE(w), OPE(z)) = 0.98.

[0082] Therefore, the plaintext data corresponding to the similarity with the plaintext keyword w from small to large are x, y, and z; the plaintext data corresponding to the similarity with the encrypted keyword OPE(w) from small to large are OPE(x), OPE(y), and OPE(z). It can be seen that before and after encryption, although the similarity between the keyword and the queried data has changed, the order of the similarity remains unchanged.

[0083] Based on this, assume that: the query distance between the plaintext keyword w and the plaintext data with the greatest similarity is set to 1, the query distance between the plaintext data with the second greatest similarity is set to 2, and the query distance between the plaintext data with the third greatest similarity is set to 3; then we can get: the query distance between w and z is 1, the query distance between w and y is 2, and the query distance between w and x is 3. In addition, the query distance between the secret keyword OPE(w) and the secret data with the greatest similarity is set to 1, the query distance between the secret data with the second greatest similarity is set to 2, and the query distance between the secret data with the third greatest similarity is set to 3, then we can get: the query distance between OPE(w) and OPE(z) is 1, the query distance between OPE(w) and OPE(y) is 2, and the query distance between OPE(w) and OPE(x) is 3. It can be seen that the query distance between w and z in plain text is equal to the query distance between OPE(w) and OPE(z) in cipher text, the query distance between w and y in plain text is equal to the query distance between OPE(w) and OPE(y) in cipher text, and the query distance between w and x in plain text is equal to the query distance between OPE(w) and OPE(x) in cipher text.

[0084] If the initial query statement is constructed as follows: query the first two plaintext data with the closest query distance to the plaintext keyword "w", the secret query results obtained are "z" and "y", and "z>y". If the encrypted query statement is: query the first two plaintext data with the closest query distance to the secret keyword "OPE(w)", the secret query results obtained are "OPE(z)" and "OPE(y)", and "OPE(z)>OPE(y)". The plaintext query results obtained by decrypting the secret query results are "z" and "y", and "z>y". It can be seen that the secret query results obtained based on the encrypted query statement are equivalent to the plaintext query results obtained based on the initial query statement, and the sequential relationship between them remains unchanged.

[0085] In one example, algorithms that can be implemented by the order-preserving encryption strategy include OPES, PEKS, etc.

[0086] S1335. In response to the query type of the constant class data being a function query, determine a third encryption strategy.

[0087] Among them, the third encryption strategy is a homomorphic encryption strategy (HE), which is used to encrypt plaintext data into ciphertext data that supports addition and / or multiplication.

[0088] When querying, function queries on constant class data involve addition and / or multiplication, so a deterministic encryption strategy must be used to ensure that the encrypted data supports addition and / or multiplication when the query is executed.

[0089] In one example, the homomorphic encryption strategy can implement algorithms including Paillier, Benaloh, RSA, ElGamal, Gentry, etc.

[0090] Regarding step S170, in some embodiments of the present disclosure, it may include the following steps: Figure 5 Steps S1701 to S1702 are shown.

[0091] S1701. Determine a decryption strategy for the confidential query result based on the encryption strategy corresponding to the confidential keyword, where the decryption strategy corresponds to the encryption strategy.

[0092] S1702: Decrypt the encrypted query result into a plaintext query result based on the determined decryption strategy.

[0093] The decryption strategy corresponding to the encryption strategy refers to a decryption strategy that uses the same algorithm as the encryption strategy. For example, the plaintext data "x" is encrypted into the secret data "OPE (x)" based on the second encryption strategy. When decrypting the secret data "OPE (x)", the second decryption strategy is selected for decryption, wherein the second decryption strategy and the second decryption strategy both use the OPES algorithm.

[0094] In some embodiments of the present disclosure, the encrypted query statement is configured as: Convert the dense keywords into vector format data; Traversing each secret state data in the secret state database, respectively calculating the cosine similarity between each secret state data and the secret state keyword, determining the calculated cosine similarity as the query distance between the secret state keyword and the secret state data, and obtaining multiple query distances; The minimum query distance is determined among multiple query distances, and the secret data corresponding to the minimum query distance is determined as the query result.

[0095] In this way, when the secret state database stores secret state data in the form of vectors, the cosine similarity between vectors can be used as the query distance between the secret state data and the secret state keyword for query, so that the embodiments of the present disclosure can be applied to data query of the vector database.

[0096] In some embodiments of the present disclosure, the data query method M100 further includes: Figure 6 Step S190 is shown.

[0097] S190. In response to the data addition request, the newly added confidential data is stored in the confidential database.

[0098] Step S190 is used to add the newly added data to the secret database. In some application scenarios, the secret database periodically obtains the newly added data from the knowledge base. If the newly added data is in plain text, it can be added by Figure 7 Steps S1910 to S1930 shown convert the new data in plain text and store them in the encrypted database.

[0099] S1910. In response to a request for adding new data, obtain new plaintext data.

[0100] The data addition request may be a request generated periodically by the secret database, which is used to obtain new knowledge data from the knowledge base to ensure the timeliness of the data in the secret database. The data in the knowledge base is in plain text. In an example, the new plain text data in the knowledge base refers to the data newly stored in the knowledge base within a certain period, such as the data newly stored in the knowledge base within 3 days from the current date.

[0101] S1920. Encrypt the newly added plaintext data into newly added encrypted data.

[0102] The encryption scheme adopts the distance-keeping encryption scheme described above.

[0103] S1930. Store the newly added confidential data into the confidential database.

[0104] In one example, the above steps S1910 to S1930 are performed by the encrypted query component described above. For example, the secret database sends a data addition request to the encrypted query component, and the encrypted query component forwards the data addition request to the knowledge base and obtains the newly added plaintext data returned by the knowledge base. Subsequently, the encrypted query component encrypts the newly added plaintext data into newly added secret data, and sends the newly added secret data to the secret database for storage.

[0105] Regarding step S1920, in some embodiments of the present disclosure, it may include: Figure 8 Steps S1921 to S1923 are shown.

[0106] S1921. Obtain the data type of the newly added plaintext data.

[0107] The data types have been introduced in the previous article and will not be repeated here.

[0108] S1922. In response to the data type of the newly added plaintext data being attribute data or relationship data, encrypt the newly added plaintext data into first encrypted data based on a first encryption strategy.

[0109] Combined with the previous description, when querying, for attribute data or relationship data, the query distance is equivalent to the point-to-point distance, so a deterministic encryption strategy must be used to ensure that the correct attributes or relationships can be accessed when the query is executed. Similarly, using a deterministic encryption strategy to encrypt the newly added plaintext data can ensure that the encrypted first secret data has the correct attributes or relationships when it is accessed.

[0110] S1923. In response to the data type of the newly added plaintext data being constant data, the newly added plaintext data is encrypted into first secret data based on a first encryption strategy, the newly added plaintext data is encrypted into second secret data based on a second encryption strategy, and the newly added plaintext data is encrypted into third secret data based on a third encryption strategy.

[0111] Combined with the description above, if the data type of the newly added plaintext data is constant data, when the query is executed, the query types faced by the encrypted data obtained by encrypting the newly added plaintext data include determined value query, sequential query and function query. When the above three types of queries are performed on the secret key words, the first encryption strategy, the second encryption strategy and the third encryption strategy need to be used respectively for encryption. Therefore, it is necessary to prepare three sets of secret data in the secret database, corresponding to the encryption methods of the above first encryption strategy, the second encryption strategy and the third encryption strategy respectively, so that no matter which encryption strategy is used for the secret key words to encrypt, the constant secret data encrypted with the same encryption strategy can be queried. Based on this, in the case where the data type of the newly added plaintext data is constant data, it is necessary to encrypt based on the first encryption strategy, the second encryption strategy and the third encryption strategy respectively, and obtain three sets of secret data, namely the first secret data, the second secret data and the third secret data, to cope with different query types.

[0112] Based on any of the above implementations, the present disclosure also provides a data query device. Fig. 9 It is a schematic block diagram of the structure of a data query device according to an embodiment of the present disclosure.

[0113] like Fig. 9 As shown, the data query device includes: The acquisition module 110 is used to acquire an initial query statement in response to a query request.

[0114] The keyword replacement module 120 is used to replace the plaintext keywords in the initial query statement with encrypted keywords to obtain an encrypted query statement.

[0115] The query module 130 is used to query the confidential data with the closest query distance to the confidential keyword in the confidential database based on the encrypted query statement to obtain the confidential query result.

[0116] The decryption module 140 is used to decrypt the encrypted query result into a plain text query result.

[0117] Each module in the above device may be software or an application program. The implementation process of the functions and effects of each module is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0118] Please combine Figure 2 In some embodiments of the present disclosure, the data query device may be Figure 2 The encrypted query component is illustrated in the application scenario of FIG.

[0119] The execution subject of the data query method in the specific implementation manner of the present disclosure may be an electronic device such as a server device.

[0120] Therefore, based on any of the above embodiments, the present disclosure further provides an electronic device, which can execute the data query method of any of the above embodiments of the present disclosure, and the data query device of any of the above embodiments can be configured on the electronic device.

[0121] Fig.10 It is a schematic block diagram of the structure of an electronic device 1000 configured with a data query device for data query according to an embodiment of the present disclosure.

[0122] The hardware structure of the electronic device 1000 can be implemented using a bus architecture. The bus architecture can include any number of interconnected buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus 1100 connects various circuits including one or more processors 1200, memory 1300 and / or hardware modules together. The bus 1100 can also connect various other circuits 1400 such as peripherals, voltage regulators, power management circuits, external antennas, etc.

[0123] The bus 1100 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Component (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the figure only uses one connecting line, but does not mean that there is only one bus or one type of bus.

[0124] The present disclosure also provides a readable storage medium, in which a computer program is stored, and the computer program is used to implement the above method when executed by a processor. "Readable storage medium" can be any device that can contain, store, communicate, propagate or transmit a program for use in an instruction execution system, device or equipment or in combination with these instruction execution systems, devices or equipment. More specific examples of readable storage media include the following: an electrical connection portion (electronic device) with one or more wirings, a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable read-only memory (CDROM), etc.

[0125] The present disclosure also provides a computer program product. The method of the present disclosure can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed, the process or function of the present disclosure is executed in whole or in part.

[0126] A computer program or instruction may be stored in a readable storage medium or transmitted from one readable storage medium to another readable storage medium, for example, a computer program or instruction may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The readable storage medium may be any available medium that can be accessed or a data storage device such as a server, data center, etc. that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid state drive. The computer readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0127] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0128] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data query device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data query device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data query device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0130] These computer program instructions may also be loaded onto a computer or other programmable data query device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] In the description of this specification, the description with reference to the terms "one embodiment / method", "some embodiments / methods", "example", "specific example", or "some examples" etc. means that the specific features, structures, or characteristics described in conjunction with the embodiment / method or example are included in at least one embodiment / method or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment / method or example. Moreover, the specific features, structures, or characteristics described may be combined in any one or more embodiments / methods or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments / methods or examples described in this specification and features of different embodiments / methods or examples, unless they are contradictory.

[0132] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0133] Those skilled in the art should understand that the above embodiments are only for the purpose of clearly illustrating the present disclosure, and are not intended to limit the scope of the present disclosure. For those skilled in the art, other changes or modifications may be made based on the above disclosure, and these changes or modifications are still within the scope of the present disclosure.

Claims

1. A data query method, characterized in that: include: In response to the query request, obtaining an initial query statement; Replacing the plaintext keywords in the initial query statement with encrypted keywords to obtain an encrypted query statement; Based on the encrypted query statement, searching the encrypted database for the encrypted data with the closest query distance to the encrypted keyword to obtain a encrypted query result; as well as Decrypting the encrypted query result into a plaintext query result; The query distance between the secret keyword and the secret query result is equal to the query distance between the plaintext keyword and the plaintext query result, and the query distance represents the similarity relationship between the keyword and the queried data.

2. The data query method according to claim 1, characterized in that: The plaintext keywords in the initial query statement are replaced with encrypted keywords to obtain an encrypted query statement, including: Obtaining context information of the plaintext keyword; Determine the data type of the plaintext keyword query based on context information of the plaintext keyword in the query text; Determining an encryption strategy based on the data type of the plaintext keyword query; Encrypting the plaintext keyword into a secret keyword based on the determined encryption strategy; and The encrypted keyword is used to replace the corresponding plaintext keyword in the initial query statement.

3. The data query method according to claim 2, characterized in that: Determining an encryption strategy based on the data type of the plaintext keyword query includes: In response to the data type of the plaintext keyword query being attribute data or relationship data, determining a first encryption strategy; In response to the data type of the plaintext keyword query being constant data, further determining a query type of the constant data; In response to the query type of the constant class data being a determined value query, determining the first encryption strategy; In response to the query type of the constant class data being a sequential query, determining a second encryption strategy; In response to the query type of the constant class data being a function query, determining a third encryption strategy; Among them, the first encryption strategy is used to encrypt the same plaintext data into the same encrypted data, the second encryption strategy is used to encrypt the plaintext data into the encrypted data with the same sequence, and the third encryption strategy is used to encrypt the plaintext data into the ciphertext data supporting addition and / or multiplication.

4. The data query method according to claim 2, characterized in that: Decrypting the encrypted query result into a plaintext query result includes: Determining a decryption strategy for the secret query result based on the encryption strategy corresponding to the secret keyword, the decryption strategy corresponding to the encryption strategy; and The encrypted query result is decrypted into the plaintext query result based on the determined decryption strategy.

5. The data query method according to claim 1, characterized in that: The encrypted data is data in vector format, and the encrypted query statement is configured as: Converting the encrypted keywords into vector format data; Traversing each secret state data in the secret state database, respectively calculating the cosine similarity between each secret state data and the secret state keyword, determining the cosine similarity as the query distance between the secret state keyword and the secret state data, and obtaining multiple query distances; as well as The minimum query distance is determined among multiple query distances, and the secret data corresponding to the minimum query distance is determined as the query result.

6. The data query method according to claim 1, characterized in that: Also includes: In response to the data addition request, obtaining the added plaintext data; Encrypting the newly added plaintext data into newly added encrypted data; as well as The newly added confidential data is stored in the confidential database.

7. The data query method according to claim 6, characterized in that: Encrypting the newly added plaintext data into newly added encrypted data includes: Obtain the data type of the newly added plaintext data; In response to the data type of the newly added plaintext data being attribute data or relationship data, encrypting the newly added plaintext data into first encrypted data based on a first encryption strategy; and In response to the data type of the newly added plaintext data being constant data, encrypting the newly added plaintext data into first encrypted data based on a first encryption strategy, encrypting the newly added plaintext data into second encrypted data based on a second encryption strategy, and encrypting the newly added plaintext data into third encrypted data based on a third encryption strategy; Among them, the first encryption strategy is used to encrypt the same plaintext data into the same encrypted data, the second encryption strategy is used to encrypt the plaintext data into the encrypted data with the same sequence, and the third encryption strategy is used to encrypt the plaintext data into the ciphertext data supporting addition and / or multiplication.

8. An electronic device, characterized in that: include: A memory storing execution instructions; as well as A processor, wherein the processor executes the execution instructions stored in the memory, so that the processor executes the data query method according to any one of claims 1 to 7.

9. A readable storage medium, characterized in that: The readable storage medium stores execution instructions, which are used to implement the data query method according to any one of claims 1 to 7 when executed by a processor.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data query method according to any one of claims 1 to 7 is implemented.

Images