Data search method, device, storage medium and computer program product

Abstract

The present application discloses a data search method, device, storage medium and computer program product. The method includes: obtaining a search keyword input by a user, using an asymmetric scalar product-preserving encryption algorithm, encrypting the search keyword according to a first secret key, and obtaining an encrypted keyword; determining an encrypted index in a database of a cloud server that matches the encrypted keyword, and obtaining an encrypted data block corresponding to the encrypted index in the database, wherein the encrypted index in the database is obtained by using an asymmetric scalar product-preserving encryption algorithm and encrypting the index information corresponding to the encrypted data block according to the first secret key; decrypting the encrypted data block, and merging the decrypted data blocks to obtain a search result corresponding to the search keyword. The present application solves the technical problem of poor security of data search technology in related technologies.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and more specifically, to a data search method, device, storage medium, and computer program product. Background Art

[0002] With the rapid advancement of cloud computing, big data, the Internet of Things, and network technology, the amount of data generated worldwide has exploded, prompting companies and individuals to increasingly rely on cloud storage and remote access services to manage their valuable information assets. However, with the centralized storage and widespread transmission of data in the cloud, data privacy and security are also facing huge risks, and there are problems such as poor security of data search technology.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a data search method, device, storage medium and computer program product to at least solve the technical problem of poor security of data search technology in related technologies.

[0005] According to one aspect of an embodiment of the present application, a data search method is provided, including: obtaining a search keyword input by a user, using an asymmetric scalar product preserving encryption algorithm to encrypt the search keyword according to a first secret key to obtain an encrypted keyword; determining an encrypted index in a database of a cloud server that matches the encrypted keyword, and obtaining an encrypted data block corresponding to the encrypted index in the database, wherein the encrypted index in the database is obtained by using an asymmetric scalar product preserving encryption algorithm to encrypt index information corresponding to the encrypted data block according to a first secret key; decrypting the encrypted data block, and merging the decrypted data blocks to obtain a search result corresponding to the search keyword.

[0006] Optionally, the method also includes: obtaining the original data uploaded by the data holder, and processing the original data in blocks to obtain multiple data blocks; determining the index information corresponding to each data block, wherein the index information is used to characterize the semantic subject of the data block; using an asymmetric scalar product preserving encryption algorithm, encrypting the index information according to a first secret key to obtain an encrypted index, and encrypting the data block according to a second secret key to obtain an encrypted data block; uploading the encrypted index and the corresponding encrypted data block to the database of the cloud server.

[0007] Optionally, uploading the encrypted index and the corresponding encrypted data block to the database of the cloud server includes: determining the performance status parameters corresponding to each cloud server, wherein the performance status parameters are used to characterize the load performance corresponding to the cloud server; determining the weighted allocation probability corresponding to each cloud server based on the performance status parameters, wherein the weighted allocation probability is used to indicate the probability of uploading an encrypted index and the corresponding encrypted data block to the cloud server; and randomly uploading all the encrypted indexes and the corresponding encrypted data blocks corresponding to the original data to the database of each cloud server according to the weighted allocation probability.

[0008] Optionally, determining the index information corresponding to each data block includes: extracting keywords in each data block; determining a weight coefficient of the keyword based on the frequency of occurrence of the keyword and the position in the original data, wherein the weight coefficient is used to characterize the degree of influence of the keyword on the semantic expression of the data block; based on the weight coefficient, mapping each keyword in the data block to a preset vector space to obtain the index information corresponding to the data block.

[0009] Optionally, the encrypted data blocks and encrypted indexes corresponding to the original data are distributed in the databases of multiple different cloud servers; determining the encrypted index in the database of the cloud server that matches the encrypted keyword includes: determining a similarity parameter between the encrypted keyword and each encrypted index, wherein the similarity parameter is used to characterize the degree of semantic relevance between the encrypted keyword and the encrypted index; and determining the encrypted index whose similarity parameter exceeds a preset similarity threshold as an encrypted index that matches the encrypted keyword.

[0010] Optionally, the encrypted data block is decrypted and the decrypted data blocks are merged to obtain search results corresponding to the search keywords, including: using the second secret key to decrypt the encrypted data block to obtain the decrypted data blocks; using the first secret key to decrypt the encrypted index to obtain index information corresponding to the data block; based on the index information, the decrypted data blocks are combined to obtain search results corresponding to the search keywords.

[0011] Optionally, an asymmetric scalar product preserving encryption algorithm is used to encrypt the search keyword according to the first secret key, and obtaining the encrypted keyword includes: vectorizing the search keyword to obtain a query vector; using a virtual keyword to expand the query vector, wherein the vector length of the expanded query vector is a preset length; splitting the expanded query vector into a first sub-vector and a second sub-vector, and calculating the vector inner product between the first sub-vector and the second sub-vector; encrypting the first sub-vector and the second sub-vector according to the first secret key and the vector inner product to obtain the encrypted keyword.

[0012] According to another aspect of an embodiment of the present application, a data search device is also provided, including: a keyword encryption module, used to obtain a search keyword input by a user, and use an asymmetric scalar product preserving encryption algorithm to encrypt the search keyword according to a first secret key to obtain an encrypted keyword; an encryption matching module, used to determine an encrypted index in a database of a cloud server that matches the encrypted keyword, and obtain an encrypted data block corresponding to the encrypted index in the database, wherein the encrypted index in the database is obtained by using an asymmetric scalar product preserving encryption algorithm to encrypt the index information corresponding to the encrypted data block according to the first secret key; a decryption feedback module, used to decrypt the encrypted data block, and merge the decrypted data blocks to obtain a search result corresponding to the search keyword.

[0013] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the data search method by running the computer program.

[0014] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which implements the steps of the data search method when the computer program is executed by a processor.

[0015] In an embodiment of the present application, a search keyword input by a user is obtained, and an asymmetric scalar product preserving encryption algorithm is used to encrypt the search keyword according to a first secret key to obtain an encrypted keyword; an encrypted index matching the encrypted keyword in a database of a cloud server is determined, and an encrypted data block corresponding to the encrypted index in the database is obtained, wherein the encrypted index in the database is obtained by encrypting the index information corresponding to the encrypted data block according to a first secret key using an asymmetric scalar product preserving encryption algorithm; the encrypted data block is decrypted, and the decrypted data blocks are merged to obtain a search result corresponding to the search keyword. The asymmetric scalar product preserving encryption algorithm is used to protect the privacy and security of the user's search keyword and the original data uploaded by the data holder, while achieving efficient and accurate data search, thereby solving the technical problem of poor security of data search technology in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 It is a hardware structure block diagram of a computer terminal (or electronic device) for implementing a method for data search provided in an embodiment of the present application;

[0018] Figure 2 It is a schematic diagram of a data search method flow provided according to an embodiment of the present application;

[0019] Figure 3 It is a flowchart of a search technology based on ASPE anti-collusion attack in a cloud-network-end integrated environment provided according to an embodiment of the present application;

[0020] Figure 4 It is a structural schematic diagram of a data search device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In order to facilitate those skilled in the art to better understand the embodiments of the present application, some technical terms or nouns involved in the embodiments of the present application are explained as follows:

[0024] Cloud Computing, Internet, Intelligent Terminal: It is the abbreviation of cloud computing + mobile Internet + intelligent terminal. It refers to a network environment that can realize efficient data storage, processing, sharing and service, which has been gradually formed by the rapid development of cloud computing technology. It aims to realize the collaborative work among cloud computing, network and intelligent terminal through technical means, and provide users with richer and more convenient services.

[0025] ASPE (Adaptively Secure Privacy-Preserving Encryption): A cryptographic technique designed to preserve the privacy of data in an encrypted state while allowing certain computations or processing to be performed without decrypting the data.

[0026] Collusion Attack: refers to an attack method in which two or more malicious nodes in a network environment or distributed system are connected in series to disrupt normal network behavior or system security by sharing information and coordinating actions.

[0027] With the rapid advancement of cloud computing, big data, the Internet of Things, and network technology, the amount of data generated worldwide has exploded, prompting companies and individuals to increasingly rely on cloud storage and remote access services to manage their valuable information assets. This trend has not only greatly improved data processing efficiency and flexibility, but also promoted cross-regional and cross-industry collaboration. However, the centralized storage and extensive transmission of data in the cloud is also like a double-edged sword, exposing unprecedented security challenges, among which collusion attacks are one of the most difficult problems.

[0028] Collusion attacks break through the limitations of traditional single-point attacks. Through close cooperation between multiple malicious entities, they jointly use their own resources, permissions or technical vulnerabilities to form a joint force to carry out more complex, covert and efficient attacks on target data. This attack method can bypass many single defense mechanisms and seriously threaten the confidentiality, integrity and availability of data. Although related technologies have achieved certain results in defending against collusion attacks, they still face significant challenges. The complexity of the technology and high cost limit its widespread application, especially in environments with limited resources. At the same time, these technologies often have a trade-off between real-time and system performance, making it difficult to ensure security without sacrificing user experience. More importantly, with the continuous development of technology, new collusion attack methods emerge in an endless stream, and the defense methods in related technologies often find it difficult to effectively defend against unknown attacks. This creates the risk of data privacy leakage in data search scenarios.

[0029] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which can improve search efficiency and anti-attack capabilities while ensuring data privacy and security, and are described in detail below.

[0030] According to an embodiment of the present application, a method embodiment of data search is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or electronic device) for implementing a data search method. Figure 1 As shown, the computer terminal 10 (or electronic device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data search method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned data search method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0036] In the above operating environment, the present application embodiment provides a data search method. Figure 2 is a schematic diagram of a data search method flow according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0037] Step S202, obtaining a search keyword input by a user, using an asymmetric scalar product preserving encryption algorithm, encrypting the search keyword according to a first secret key, and obtaining an encrypted keyword;

[0038] Step S204, determining an encryption index matching the encryption keyword in the database of the cloud server, and obtaining an encrypted data block corresponding to the encryption index in the database, wherein the encryption index in the database is obtained by encrypting index information corresponding to the encrypted data block according to the first secret key by using an asymmetric scalar product preserving encryption algorithm;

[0039] Step S206, decrypting the encrypted data blocks and merging the decrypted data blocks to obtain search results corresponding to the search keyword.

[0040] Through the above steps, the asymmetric scalar product preserving encryption algorithm is used to protect the privacy and security of user search keywords and the original data uploaded by the data holder, while achieving efficient and accurate data search, thereby solving the technical problem of poor security of data search technology in related technologies.

[0041] The data search method in steps S202 to S206 of the embodiment of the present application is further introduced below.

[0042] Figure 3 : is a flowchart of a search technology based on ASPE anti-collusion attack in a cloud-network-end integrated environment provided by an embodiment of the present application, such as Figure 3 shown.

[0043] First, when the data holder uploads the original data to the cloud, the original data needs to be preprocessed and encrypted. The specific steps are as follows.

[0044] In some embodiments of the present application, the method also includes the following steps: obtaining the original data uploaded by the data holder, and processing the original data in blocks to obtain multiple data blocks; determining the index information corresponding to each data block, wherein the index information is used to characterize the semantic subject of the data block; using an asymmetric scalar product preserving encryption algorithm, encrypting the index information according to a first secret key to obtain an encrypted index, and encrypting the data block according to a second secret key to obtain an encrypted data block; uploading the encrypted index and the corresponding encrypted data block to the database of the cloud server.

[0045] Specifically, after the user inputs the original data, the original data can be cleaned, formatted and analyzed to ensure the reasonable segmentation of the data blocks. After that, the huge original data can be intelligently segmented into multiple smaller data blocks through the client. For example, the hash algorithm, content-based segmentation strategy or custom segmentation rules can be used to segment the original data into multiple data blocks with fixed sizes or based on content importance, and the ASPE encryption algorithm is used to independently encrypt each data block. After each data block is encrypted by ASPE, it is converted into an encrypted data block that is difficult to crack, ensuring the confidentiality and integrity of the data.

[0046] In addition, when encrypting a data block, the client will also generate a set of encryption indexes corresponding to the encrypted data block, recording key information of the encrypted data block (such as the encrypted form of keywords or metadata of the data block), so that the user can locate the relevant encrypted data block by searching the encryption index without knowing the original data content. The steps for determining the index information corresponding to each data block are as follows.

[0047] In some embodiments of the present application, determining the index information corresponding to each data block includes the following specific steps: extracting keywords in each data block; determining the weight coefficient of the keyword based on the frequency of occurrence of the keyword and the position in the original data, wherein the weight coefficient is used to characterize the degree of influence of the keyword on the semantic expression of the data block; based on the weight coefficient, mapping each keyword in the data block to a preset vector space to obtain the index information corresponding to the data block.

[0048] Specifically, through natural language processing technology (such as stem extraction, part-of-speech tagging, etc.), keywords are extracted from each data block in the original data, and then the weight coefficient corresponding to each keyword is determined according to the probability of keyword appearance and its position (for example, title position, illumination position, text position, etc.), so as to further generate index information for each data block through vectorization processing. This method of constructing index information based on keyword weight can more accurately reflect the semantic theme of the data block, improve the accuracy and relevance of the search, and is particularly suitable for efficient retrieval of text data.

[0049] After completing the data block encryption and generating the corresponding encryption index, the client can upload the encrypted data block and the encryption index to the cloud server through the secure data transmission channel on the network side.

[0050] For example, for the original data D input by the data holder, the client divides D into blocks to generate multiple data blocks Di; uses the ASPE encryption algorithm to encrypt each data block Di to generate an encrypted data block Ci, and generates an encryption index, and then uploads the encrypted data block Ci and the encryption index to the cloud server.

[0051] The specific steps of uploading the encrypted data block and the encrypted index to the cloud server are as follows.

[0052] In some embodiments of the present application, uploading the encrypted index and the corresponding encrypted data block to the database of the cloud server includes the following steps: determining the performance status parameters corresponding to each cloud server, wherein the performance status parameters are used to characterize the load performance corresponding to the cloud server; determining the weighted allocation probability corresponding to each cloud server based on the performance status parameters, wherein the weighted allocation probability is used to indicate the probability of uploading an encrypted index and the corresponding encrypted data block to the cloud server; and randomly uploading all the encrypted indexes and the corresponding encrypted data blocks corresponding to the original data to the database of each cloud server according to the weighted allocation probability.

[0053] Specifically, multi-party data distribution can be performed during the encrypted data upload process, and the encrypted data blocks and indexes are distributed to multiple cloud servers, each server only stores part of the data and index information, and decentralized storage of data is achieved. The embodiment of the present application distributes encrypted data and indexes among multiple cloud servers, and by introducing randomization and obfuscation techniques, it increases the difficulty for attackers to conduct collusion attacks, and can further enhance the system's ability to resist collusion attacks. Even if some cloud servers cooperate, the encrypted data cannot be cracked. In addition, through the load balancing strategy, the overload problem of a single cloud server is effectively avoided, the stability of the system and the efficiency of data access are improved, and it is suitable for cloud storage systems that require high availability and high concurrent access.

[0054] The following is a further introduction to the process of customers entering search keywords to search.

[0055] First, after obtaining the search keyword input by the user, the search keyword is encrypted using the ASPE encryption algorithm. The specific steps are as follows.

[0056] In some embodiments of the present application, an asymmetric scalar product preserving encryption algorithm is used to encrypt the search keyword according to a first secret key, and obtaining the encrypted keyword includes the following steps: vectorizing the search keyword to obtain a query vector; using a virtual keyword to expand the query vector, wherein the vector length of the expanded query vector is a preset length; splitting the expanded query vector into a first sub-vector and a second sub-vector, and calculating the vector inner product between the first sub-vector and the second sub-vector; encrypting the first sub-vector and the second sub-vector according to the first secret key and the vector inner product to obtain the encrypted keyword.

[0057] Specifically, when the user enters the search keyword on the client interface, the client immediately starts the ASPE encryption algorithm to encrypt the search keyword. For example, an m-order plaintext query vector can be generated based on the query keyword, and then the query vector can be expanded to m+d order (preset length), and z virtual keywords are randomly selected from d virtual keywords, and their values ​​are set to a minimum value ε, and the rest are 0. After that, the expanded query vector is split into the first sub-vector and the second sub-vector, and then encrypted with the first secret key M2 to obtain the final encrypted keyword. This encryption method not only ensures the privacy security of the keyword, but also provides a basis for subsequent similarity matching through the calculation of the vector inner product. It is suitable for search engines and data retrieval systems that need to protect keyword privacy.

[0058] After encryption is completed, the client sends the encrypted keywords to the cloud server through a secure data transmission channel for subsequent search and matching. The specific steps are as follows.

[0059] In some embodiments of the present application, the encrypted data blocks and encrypted indexes corresponding to the original data are distributed in the databases of multiple different cloud servers; determining the encrypted index in the database of the cloud server that matches the encrypted keyword includes the following steps: determining the similarity parameter between the encrypted keyword and each encrypted index, wherein the similarity parameter is used to characterize the degree of semantic relevance between the encrypted keyword and the encrypted index; determining the encrypted index whose similarity parameter exceeds a preset similarity threshold as the encrypted index that matches the encrypted keyword.

[0060] Specifically, after receiving the encrypted keywords sent by the client, the cloud server uses the pre-built encrypted index to quickly locate the data blocks that match the encrypted keywords in the huge encrypted data warehouse. After a series of matching and screening operations, the cloud server collects all the encrypted data blocks that match the encrypted keywords, organizes them into an encrypted data block set, and returns this encrypted data block set to the client.

[0061] After obtaining the encrypted data block that matches the encrypted keyword, the encrypted data block can be decrypted, and the decrypted data blocks can be merged to obtain the search result corresponding to the search keyword. The specific steps are as follows.

[0062] In some embodiments of the present application, decrypting an encrypted data block and merging the decrypted data blocks to obtain search results corresponding to the search keyword includes the following steps: using the second secret key to decrypt the encrypted data block to obtain the decrypted data blocks; using the first secret key to decrypt the encrypted index to obtain index information corresponding to the data block; based on the index information, combining the decrypted data blocks to obtain search results corresponding to the search keyword.

[0063] Specifically, after receiving the encrypted data block set returned by the cloud server, the client immediately starts the decryption process. First, the client decrypts each encrypted data block in the encrypted data block set one by one. Since the encrypted data block is encrypted using the ASPE encryption algorithm, the client needs to use the same key or key pair as in the encryption process to decrypt. During the decryption process, the client will follow the decryption steps of the ASPE algorithm to gradually restore the original information in the encrypted data block, and finally obtain a series of decrypted original data blocks.

[0064] Next, the client merges the decrypted data blocks. This step is to reassemble the scattered, encrypted data blocks into the meaningful original data required by the user. During the merging process, the client will ensure the correct arrangement and combination of data blocks based on the identifiers, order or other metadata of the data blocks to avoid information loss or confusion.

[0065] Finally, the client presents the merged data block set to the user as the final search results. These search results contain all the information or data that the user expects to obtain through the search keyword, and are presented to the user in original, unencrypted form. The user can view, edit or further process these search results on the client interface to meet their needs.

[0066] The embodiment of the present application performs ASPE encryption on the search keywords and sends the encrypted keywords to the cloud server through a secure data transmission channel. The cloud server uses the encrypted index to search and returns the matching encrypted data block set to the client for decryption. The search keywords always remain encrypted during the transmission and search process, which can prevent the leakage of sensitive information, and the cloud server only needs to process the search and matching operations of the encrypted data, without processing a large amount of raw data, thereby improving the efficiency of the system; and the encrypted data and indexes are distributed among multiple cloud servers, and the multi-party computing technology is used to realize the decentralized storage and calculation of data. Even if some cloud servers cooperate, the encrypted data cannot be cracked. Through the above method, the data is stored and processed in a decentralized manner on multiple servers, which improves the system's ability to resist collusion attacks. Even if a cloud server fails or is attacked, the data on other servers is still available, ensuring the continuity and availability of the system.

[0067] The present application scheme adopts an asymmetric scalar product preserving encryption algorithm, which can achieve efficient and accurate data search while protecting the privacy and security of user search keywords and the original data uploaded by the data holder. The encrypted data blocks and index information are distributed and stored in multiple cloud servers, which not only enhances the security of the data, but also improves the data access speed and the overall performance of the system through load balancing strategies. In addition, the scheme also supports semantic relevance search for encrypted data, greatly improving the accuracy of the search and the user experience. It is suitable for various cloud storage and search scenarios that need to protect data privacy, and has broad application prospects and commercial value.

[0068] According to an embodiment of the present application, an embodiment of a data search device is also provided. Figure 4 is a schematic diagram of the structure of a data search device provided according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0069] The keyword encryption module 40 is used to obtain the search keyword input by the user, and encrypt the search keyword according to the first secret key using an asymmetric scalar product preservation encryption algorithm to obtain an encrypted keyword;

[0070] The encryption matching module 42 is used to determine the encryption index matching the encryption keyword in the database of the cloud server, and obtain the encrypted data block corresponding to the encryption index in the database, wherein the encryption index in the database is obtained by encrypting the index information corresponding to the encrypted data block according to the first secret key by using an asymmetric scalar product preserving encryption algorithm;

[0071] The decryption feedback module 44 is used to decrypt the encrypted data blocks and merge the decrypted data blocks to obtain search results corresponding to the search keywords.

[0072] Optionally, the data search device is also used to: obtain the original data uploaded by the data holder, and process the original data in blocks to obtain multiple data blocks; determine the index information corresponding to each data block, wherein the index information is used to characterize the semantic subject of the data block; use an asymmetric scalar product preserving encryption algorithm to encrypt the index information according to a first secret key to obtain an encrypted index, and encrypt the data block according to a second secret key to obtain an encrypted data block; upload the encrypted index and the corresponding encrypted data block to the database of the cloud server.

[0073] Optionally, uploading the encrypted index and the corresponding encrypted data block to the database of the cloud server includes: determining the performance status parameters corresponding to each cloud server, wherein the performance status parameters are used to characterize the load performance corresponding to the cloud server; determining the weighted allocation probability corresponding to each cloud server based on the performance status parameters, wherein the weighted allocation probability is used to indicate the probability of uploading an encrypted index and the corresponding encrypted data block to the cloud server; and randomly uploading all the encrypted indexes and the corresponding encrypted data blocks corresponding to the original data to the database of each cloud server according to the weighted allocation probability.

[0074] Optionally, determining the index information corresponding to each data block includes: extracting keywords in each data block; determining a weight coefficient of the keyword based on the frequency of occurrence of the keyword and the position in the original data, wherein the weight coefficient is used to characterize the degree of influence of the keyword on the semantic expression of the data block; based on the weight coefficient, mapping each keyword in the data block to a preset vector space to obtain the index information corresponding to the data block.

[0075] Optionally, the encrypted data blocks and encrypted indexes corresponding to the original data are distributed in the databases of multiple different cloud servers; determining the encrypted index in the database of the cloud server that matches the encrypted keyword includes: determining a similarity parameter between the encrypted keyword and each encrypted index, wherein the similarity parameter is used to characterize the degree of semantic relevance between the encrypted keyword and the encrypted index; and determining the encrypted index whose similarity parameter exceeds a preset similarity threshold as an encrypted index that matches the encrypted keyword.

[0076] Optionally, the encrypted data block is decrypted and the decrypted data blocks are merged to obtain search results corresponding to the search keywords, including: using the second secret key to decrypt the encrypted data block to obtain the decrypted data blocks; using the first secret key to decrypt the encrypted index to obtain index information corresponding to the data block; based on the index information, the decrypted data blocks are combined to obtain search results corresponding to the search keywords.

[0077] Optionally, an asymmetric scalar product preserving encryption algorithm is used to encrypt the search keyword according to the first secret key, and obtaining the encrypted keyword includes: vectorizing the search keyword to obtain a query vector; using a virtual keyword to expand the query vector, wherein the vector length of the expanded query vector is a preset length; splitting the expanded query vector into a first sub-vector and a second sub-vector, and calculating the vector inner product between the first sub-vector and the second sub-vector; encrypting the first sub-vector and the second sub-vector according to the first secret key and the vector inner product to obtain the encrypted keyword.

[0078] It should be noted that the various modules in the above-mentioned data search device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0079] It should be noted that the data search device provided in this embodiment can be used to perform Figure 2 The data search method shown, therefore, the relevant explanations and instructions on the above data search method are also applicable to the embodiments of the present application and will not be repeated here.

[0080] An embodiment of the present application also provides a non-volatile storage medium, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following data search method by running the computer program: obtaining a search keyword input by a user, using an asymmetric scalar product preserving encryption algorithm, encrypting the search keyword according to a first secret key, and obtaining an encrypted keyword; determining an encrypted index in a database of a cloud server that matches the encrypted keyword, and obtaining an encrypted data block corresponding to the encrypted index in the database, wherein the encrypted index in the database is obtained by using an asymmetric scalar product preserving encryption algorithm to encrypt index information corresponding to the encrypted data block according to the first secret key; decrypting the encrypted data block, and merging the decrypted data blocks to obtain a search result corresponding to the search keyword.

[0081] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the data search method described in each embodiment of the present application: obtaining a search keyword input by a user, using an asymmetric scalar product preserving encryption algorithm, encrypting the search keyword according to a first secret key, and obtaining an encrypted keyword; determining an encrypted index in a database of a cloud server that matches the encrypted keyword, and obtaining an encrypted data block corresponding to the encrypted index in the database, wherein the encrypted index in the database is obtained by using an asymmetric scalar product preserving encryption algorithm to encrypt index information corresponding to the encrypted data block according to the first secret key; decrypting the encrypted data block, and merging the decrypted data blocks to obtain a search result corresponding to the search keyword.

[0082] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0083] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0084] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0085] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0086] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0087] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0088] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data search method, characterized in that: include: Obtaining a search keyword input by a user, and encrypting the search keyword according to a first secret key using an asymmetric scalar product preserving encryption algorithm to obtain an encrypted keyword; Determine an encryption index matching the encryption keyword in a database of the cloud server, and obtain an encrypted data block corresponding to the encryption index in the database, wherein the encryption index in the database is obtained by encrypting index information corresponding to the encrypted data block according to the first secret key using the asymmetric scalar product preserving encryption algorithm; The encrypted data blocks are decrypted, and the decrypted data blocks are merged to obtain search results corresponding to the search keywords.

2. The data search method according to claim 1, characterized in that: The method further comprises: Obtaining the original data uploaded by the data holder, and processing the original data into blocks to obtain multiple data blocks; Determine the index information corresponding to each of the data blocks, wherein the index information is used to represent the semantic theme of the data block; Using the asymmetric scalar product preserving encryption algorithm, encrypting the index information according to the first secret key to obtain the encrypted index, and encrypting the data block according to the second secret key to obtain the encrypted data block; The encrypted index and the corresponding encrypted data block are uploaded to the database of the cloud server.

3. The data search method according to claim 2, characterized in that: Uploading the encrypted index and the corresponding encrypted data block to the database of the cloud server includes: Determine a performance status parameter corresponding to each of the cloud servers, wherein the performance status parameter is used to characterize the load performance corresponding to the cloud server; Determine, according to the performance status parameter, a weighted allocation probability corresponding to each of the cloud servers, wherein the weighted allocation probability is used to indicate a probability of uploading one of the encryption indexes and the corresponding encrypted data block to the cloud server; According to the weighted distribution probability, all the encrypted indexes and the corresponding encrypted data blocks corresponding to the original data are randomly uploaded to the database of each cloud server.

4. The data search method according to claim 2, characterized in that: Determining the index information corresponding to each of the data blocks includes: Extracting keywords from each of the data blocks; Determining a weight coefficient of the keyword according to the occurrence frequency of the keyword and the position in the original data, wherein the weight coefficient is used to characterize the influence of the keyword on the semantic expression of the data block; According to the weight coefficient, each of the keywords in the data block is mapped to a preset vector space to obtain the index information corresponding to the data block.

5. The data search method according to claim 4, characterized in that: The encrypted data blocks and the encrypted indexes corresponding to the original data are distributed in databases of a plurality of different cloud servers; Determining an encrypted index in a database of the cloud server that matches the encrypted keyword includes: Determining a similarity parameter between the encrypted keyword and each of the encrypted indexes, wherein the similarity parameter is used to characterize the semantic relevance between the encrypted keyword and the encrypted index; The encrypted index whose similarity parameter exceeds a preset similarity threshold is determined as an encrypted index matching the encrypted keyword.

6. The data search method according to claim 5, characterized in that: Decrypting the encrypted data block and merging the decrypted data blocks to obtain search results corresponding to the search keyword include: Decrypting the encrypted data block using the second secret key to obtain decrypted data blocks; Decrypting the encrypted index using the first secret key to obtain the index information corresponding to the data block; The decrypted data blocks are combined according to the index information to obtain the search result corresponding to the search keyword.

7. The data search method according to claim 1, characterized in that: The search keyword is encrypted using an asymmetric scalar product preserving encryption algorithm according to a first secret key, and the encrypted keyword includes: Vectorizing the search keyword to obtain a query vector; Using a virtual keyword to expand the query vector, wherein the vector length of the query vector after expansion is a preset length; Splitting the expanded query vector into a first sub-vector and a second sub-vector, and calculating a vector inner product between the first sub-vector and the second sub-vector; The first sub-vector and the second sub-vector are encrypted according to the first secret key and the inner product of the vector to obtain the encrypted keyword.

8. A data search device, characterized in that: include: A keyword encryption module, used to obtain a search keyword input by a user, and encrypt the search keyword according to a first secret key using an asymmetric scalar product preservation encryption algorithm to obtain an encrypted keyword; an encryption matching module, used to determine an encryption index in a database of the cloud server that matches the encryption keyword, and obtain an encrypted data block in the database corresponding to the encryption index, wherein the encryption index in the database is obtained by encrypting the index information corresponding to the encrypted data block according to the first secret key using the asymmetric scalar product preserving encryption algorithm; The decryption feedback module is used to decrypt the encrypted data blocks and merge the decrypted data blocks to obtain search results corresponding to the search keywords.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the data search method according to any one of claims 1 to 7 by running the computer program.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data search method according to any one of claims 1 to 7 are implemented.

Images