Data query method, device and electronic device based on data sandbox

Abstract

The present application provides a data query method, device and electronic device based on a data sandbox, which relates to the field of big data processing technology, including: in response to receiving an initial data query statement for an external database, debugging the initial data query statement in a debugging container to obtain a target data query statement and a keyword set that meet the preset query result requirements, and the preset query result requirements are to desensitize the most surface query result fields of the query result data; in a production container, data blocks are read from a data set in an external database, and based on a keyword set, each block of data is encrypted and a security index is constructed, and in response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data. The present application can realize accurate desensitization of the query result data and can improve the data security in the production container.

Description

Technical Field

[0001] The present application relates to the field of big data processing technology, and in particular to a data query method, device and electronic device based on a data sandbox. Background Art

[0002] With the widespread application of new generation information technologies such as cloud computing, big data and artificial intelligence, data, as a strategic and basic resource, is not only a bridge connecting virtual space and physical space, but also an important driving force for technological innovation, demand mining and efficiency improvement in the digital economy. However, in the process of continuously creating value, data's security protection and compliance application issues have also attracted widespread attention from the government, industry, academia, research institutions and users. The application of data involves the interests of multiple parties such as the government, society, enterprises and individuals, and is related to national security, economic operation, social governance and personal rights and interests. Therefore, not only is it necessary to innovate security management models, but also to adopt diversified innovative security compliance measures to cope with the reproducible and transferable characteristics of data.

[0003] Data sandbox technology came into being, which separates data ownership and usage rights by building completely isolated debugging environments and production environments, thereby ensuring data security. The data sandbox platform achieves isolation between the debugging environment and the production environment through functional components such as data access, data compliance, data management, analytical modeling, platform management, and environment orchestration. In the debugging environment, the program code is written and debugged using desensitized sample data; in the production environment, tasks are run based on the full amount of real data only by submitting modeling program code. In this way, while ensuring that the data is available and invisible, the concerns of various data participants about data security and privacy leakage are eliminated, the dilemma of "data islands" is solved, and the value of data is fully released.

[0004] For the SQL query statements used by developers in the program code, the sandbox mechanism often identifies the characteristics of these query statements, matches the output fields with the sensitive fields of the data set, and replaces them with desensitization rules if the names are the same. However, if this is a multi-layer nested or joint query statement, there are fields with the same name in multiple data tables, and some fields with the same name in some tables are not sensitive. Rough generalizations will make the conditional screening in the query statement invalid, or even query failure. In addition, although the code in the production environment is fully automatically executed, and the production container uses so-called security technology, "no human" intervention is required. However, there are people with ulterior motives who use specialized techniques and special roles to sneak into the production container, directly steal local data or obtain connection parameters to access remote databases, which will not effectively guarantee the security of data. Summary of the invention

[0005] The present invention provides a data query method, device and electronic device based on a data sandbox, which can optimize the function of processing sensitive fields in query statements and improve the data security in production containers. When synchronizing data sets, the data sets are encrypted and a security index is established, which can prevent data thieves from entering the production container to steal data through certain technical means, and can also realize more common data query functions based on full ciphertext data.

[0006] In a first aspect, a data query method based on a data sandbox is provided, wherein the data sandbox includes a debugging container and a production container, and the method includes: In response to receiving an initial data query statement for an external database, debugging the initial data query statement in a debugging container to obtain a target data query statement and a keyword set that meet a preset query result requirement, wherein the preset query result requirement is to perform desensitization processing on the most surface query result fields of the query result data; The data set in the external database is read in blocks within the production container. Based on the keyword set, each block of data is encrypted and a security index is constructed. In response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data. The security index includes an ordered hash table index and a one-way encrypted linked list index with key staggered storage.

[0007] In a second aspect, a data query device based on a data sandbox is provided, wherein the data sandbox includes a debugging container and a production container, and the device includes: A debugging module, configured to, in response to receiving an initial data query statement for an external database, debug the initial data query statement in a debugging container to obtain a target data query statement and a keyword set that meet a preset query result requirement, wherein the preset query result requirement is to perform desensitization processing on the most surface query result fields of the query result data; The processing module is used to read the data set in the external database in blocks within the production container, encrypt each block of data based on the keyword set and build a security index, and call the security index to decrypt the block encryption result in response to the target data query statement to obtain the query result data. The security index includes an ordered hash table index and a one-way encrypted linked list index with a staggered key storage.

[0008] According to a third aspect, an electronic device is provided, comprising: a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the method in the first aspect or its various implementations.

[0009] According to a fourth aspect, a computer-readable storage medium is provided for storing a computer program, wherein the computer program enables a computer to execute the method according to the first aspect or its various implementations.

[0010] Through the technical solution provided by the present invention, in response to receiving the initial data query statement for the external database, the initial data query statement can be debugged in the debugging container to obtain the target data query statement and keyword set that meet the preset query result requirements; then, the data set in the external database is read in blocks in the production container, and each block data is encrypted and a security index is constructed based on the keyword set, and in response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data, wherein the security index includes an ordered hash table index and a one-way encrypted linked list index stored in a misplaced key. The technical solution in this application can accurately locate the data source of the query statement output result field in the debugging container, and desensitize the most surface output field in the data table. It avoids the phenomenon of query failure, error, and failure when there are sensitive fields with the same name in each table, and the global processing causes the non-sensitive fields with the same name or the data of sensitive fields with the same name in other tables to be desensitized, thereby improving the data security in the production container. In the production container, by adopting the method of reading data in blocks, encrypting in blocks, and establishing a secure index, it can be ensured that the data set is always stored in ciphertext form during the life cycle of the production container. This can not only prevent data thieves from entering the production container to steal data through certain technical means, but also realize more common data query functions based on the full ciphertext data.

[0011] It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present invention. Other features and advantages of the present invention will be described in detail in the following specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 An application scenario diagram provided for an embodiment of the present application; Figure 2 A flowchart of a data query method based on a data sandbox provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a data sandbox provided in an embodiment of the present application; Figure 4 A flowchart of a data query method based on a data sandbox provided in another embodiment of the present application; Figure 5 A schematic diagram of a chain data structure of a sensitive transfer chain provided in an embodiment of the present application; Figure 6 A schematic diagram of the structure of a data query device based on a data sandbox provided in an embodiment of the present application; Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0015] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0016] In existing data sandbox products and solutions, data analysis projects run in debugging containers and production containers. In the debugging container, project developers use desensitized sample data to debug the code so that the code meets the development purpose; in the production container, project developers submit the debugged code, and the code uses the full amount of data for fully automated operation to obtain data analysis results.

[0017] Most solutions support using a database as a data source. In a production container, remote database data may be synchronized to a local file, or a remote database may be directly accessed using a remote connection. Although the code in the production environment is fully automated and the production container uses so-called security technology, "no human intervention is required", there are people with ulterior motives who use specialized techniques and special roles to sneak into the production container, directly steal local data, or obtain connection parameters to access the remote database.

[0018] In addition, developers may use SQL query statements that they are familiar with in their program code. Some sandbox mechanisms will identify the characteristics of these query statements and match the output fields with sensitive fields in the data set. If the names are the same, they will all be replaced by desensitization rules. If this is a multi-layer nested or joint query statement, multiple data tables have fields with the same name, and some tables have fields with the same name that are not sensitive, rough and general processing will make the conditional screening in the query statement invalid, or even query failure.

[0019] In order to solve the above technical problems, the inventive concept of the present invention is to adapt and design upgrades the basic functions of the data sandbox when the source of the data set is an external database and the project code mainly implements data analysis through database query statements. This design obtains the latest sample data during the code debugging phase, optimizes the function of processing query statements containing sensitive fields, improves data security in the production container, encrypts the data set when synchronizing the data set, and establishes a security index at the same time, which prevents data thieves from entering the production container to steal data through certain technical means, and realizes a more common data query function based on fully encrypted data. This solution is very friendly to database engineers using the data sandbox to participate in data analysis project development.

[0020] It should be understood that the technical solution of the present invention can be applied to the following scenarios, but is not limited to: In some possible implementations, Figure 1 An application scenario diagram provided by an embodiment of the present invention, such as Figure 1 As shown, the application scenario may include an electronic device 110 and a network device 120. The electronic device 110 may establish a connection with the network device 120 via a wired network or a wireless network.

[0021] Exemplarily, the electronic device 110 may be a desktop computer, a laptop computer, a tablet computer, etc., but is not limited thereto. The network device 120 may be a terminal device or a server, but is not limited thereto. In one embodiment of the present invention, the electronic device 110 may send a request message to the network device 120, and the request message may be used to request to obtain an initial data query statement for an external database. Further, the electronic device 110 may receive a response message sent by the network device 120, and the response message includes an initial data query statement for an external database.

[0022] also, Figure 1 An electronic device 110 and a network device 120 are provided as an example, but other numbers of electronic devices and network devices may be included in practice, and the present invention is not limited thereto.

[0023] In some other possible implementations, the technical solution of the present invention may also be executed by the above-mentioned electronic device 110, or the technical solution of the present invention may also be executed by the above-mentioned network device 120, and the present invention does not limit this.

[0024] After introducing the application scenarios of the embodiments of the present invention, the technical solutions of the present invention will be described in detail below: Figure 2 A flowchart of a data query method based on a data sandbox provided in an embodiment of the present invention. The method can be performed as follows: Figure 1 The electronic device 110 shown is executed, but is not limited thereto. Figure 2 As shown, the method may include the following steps: Step 210, in response to receiving an initial data query statement for an external database, the initial data query statement is debugged in a debugging container to obtain a target data query statement and a keyword set that meet preset query result requirements. The preset query result requirement is to desensitize the most surface query result fields of the query result data.

[0025] In specific application scenarios, such as Figure 3As shown, the debugging container may include a code download interface, a data source interface, a syntax parser, a query tracer, a sensitive link analyzer, a desensitizing processor, and a query processor. The code download interface is connected to the remote code library and can receive the initial data query statement for the external database; the syntax parser is connected to the code download interface, and the initial data query statement can be read in the syntax parser, and the syntax tree construction rules defined inside it are used to parse the initial data query statement into a tree structure; a special "field-table" dependency structure can be defined inside the query tracer, and SQL keyword nodes are identified according to the rules matching the syntax tree, and field nodes, leaf nodes, subquery nodes, and table nodes are combined to form a data structure with query dependencies. This data structure with query dependency is essentially to find out which table in the lower query the top-level output field of SQL comes from. Because the sensitive field configuration of the data set is marked at the table level, only by tracing back to the source of the output can we determine whether it is sensitive; the sensitive link analyzer further parses the fields or data tables of the deep subqueries that the top-level output fields of the query statement depend on based on the "field-table" dependency structure, and determines whether they are sensitive and marks the desensitization configuration; the desensitization processor is connected to the sensitive link analyzer and the desensitization rule management service, and can obtain the corresponding target desensitization rules in the desensitization rule management service. Based on the target desensitization rules, the identified sensitive The sensitive fields are desensitized; the query processor of the debugging container is used to process the SQL statement injected into the desensitizing rule, and then the sampling statement corresponding to the sampling rule is appended (that is, the combination of "desensitized SQL" and "sampling SQL"), and then the data source interface is called to query the data from the external database to obtain the first query result data; then, it is determined whether the first query result data meets the preset query result requirements; if the preset query result requirements are met, it means that the initial data query statement does not need to be debugged, otherwise, the initial data query statement needs to be iteratively debugged through the code debugging interface until the target data query statement that meets the preset query result requirements is obtained.

[0026] Among them, the preset query result requirement is to desensitize the most superficial output fields in the data table, and the desensitization accuracy is greater than the preset threshold.

[0027] In the disclosed embodiment, the data source of the query statement output result field can be accurately located in the debugging container, and the top output field in the data table can be desensitized. This avoids the phenomenon of query failure, error, and failure when there are sensitive fields with the same name in each table, and global processing causes non-sensitive fields with the same name or data of sensitive fields with the same name in other tables to be desensitized, thereby improving data security in the production container.

[0028] Step 220: In the production container, the data set in the external database is read in blocks. Based on the keyword set, each block of data is encrypted and a security index is constructed. In response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data. The security index includes an ordered hash table index and a one-way encrypted linked list index with a staggered key storage.

[0029] In specific application scenarios, such as Figure 3 As shown, the production container may include a data source interface, a block reader, an index builder, an index storage, an encryption and decryption component, an encrypted data table storage, a data query, a program controller, and a code download interface. The block reader is connected to the external database through the data source interface, and can be used to read the data set in the external database in blocks with a suitable data offset, hand over the read block data to the index builder for processing, and clean up the memory in time until the data set is acquired. The index builder is connected to the query tracer in the debugging container, and can be used to obtain a keyword set, based on the keyword set, encrypt the keyword data in each block data and build a security index, and use the encryption and decryption component to encrypt the non-keyword data in each block data to obtain full ciphertext data. Among them, the encryption and decryption component provides an encryption and decryption component, a homomorphic encryption component, and a key generation component. The program controller can be used to control the start and stop of the production code and monitor the life cycle of the code process. Specifically, it can respond to the target data query statement, call the security index in the index storage, and call the encryption key for the non-keyword data in the encrypted data table storage, decrypt the block encryption result, and obtain the final query result data.

[0030] For the embodiments of the present disclosure, in the production container, by adopting the method of reading data in blocks, encrypting in blocks, and establishing a security index at the same time, it can be ensured that the data set is always stored in ciphertext form during the life cycle of the production container. This can prevent data thieves from entering the production container to steal data through certain technical means, and can also realize more common data query functions based on the full ciphertext data.

[0031] In summary, according to the data query method based on data sandbox provided by the present invention, in response to receiving the initial data query statement for the external database, the initial data query statement can be debugged in the debugging container to obtain the target data query statement and keyword set that meet the preset query result requirements; then, the data set in the external database is read in blocks in the production container, and each block data is encrypted and a security index is constructed based on the keyword set, and in response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data, wherein the security index includes an ordered hash table index and a one-way encrypted linked list index stored in a key misalignment. The technical solution in this application can accurately locate the data source of the query statement output result field in the debugging container, and desensitize the most surface output field in the data table. It avoids the phenomenon of query failure, error, and failure when there are sensitive fields with the same name in each table, and the global processing causes the non-sensitive fields with the same name or the data of sensitive fields with the same name in other tables to be desensitized, thereby improving the data security in the production container. In the production container, by adopting the method of reading data in blocks, encrypting in blocks, and establishing a secure index, it can be ensured that the data set is always stored in ciphertext form during the life cycle of the production container. This can not only prevent data thieves from entering the production container to steal data through certain technical means, but also realize more common data query functions based on the full ciphertext data.

[0032] based on Figure 2 The embodiment shown is a refinement and extension of the above embodiment. In order to fully illustrate the specific implementation process of the method of this embodiment, this embodiment provides the following Figure 4 The specific method shown. Figure 4 based on Figure 2 As shown in Figure 4, the method comprises the following steps: Step 410: In response to receiving the initial data query statement for the external database, repeatedly execute the following iterative debugging process for the initial data query statement until a target data query statement that meets the preset query result requirements is obtained.

[0033] For the embodiment of the present disclosure, the iterative debugging process of the initial data query statement in the step may include the following steps: Step 410 - 1 : Create a syntax tree of an initial data query statement in the debugging container.

[0034] In specific application scenarios, such as Figure 3As shown, the syntax parser in the debugging container can use the syntax tree construction rules defined internally to create the syntax tree of the initial data query statement. The rule of the tree structure is defined as follows: each layer of query statements will be constructed as a layer of tree structure, and each layer of the tree structure has a root node, and the root node is connected by the associated keywords of the query statement of the previous layer. Multiple first-level keyword nodes are connected under the root node, such as query keywords "select" and "from", associated keywords "join" and "union", condition keywords "on" and "where", etc. The query field name, table name, subquery root node, etc. are connected under the first-level keyword node. In addition, there will be second-level keyword nodes below the first-level keyword node, such as the keyword "as" representing the field and table alias.

[0035] Correspondingly, for the embodiments of the present disclosure, the embodiment steps may include: determining the query level number of the grammatical tree structure corresponding to the initial data query statement; for each query level in the multiple query levels, iteratively executing the iterative construction process of the tree structure corresponding to the initial data query statement described below, until the number of iterations is equal to the number of query levels, and obtaining the grammatical tree of the initial data query statement; the iterative construction process of the tree structure includes: locating the sub-query statement corresponding to the initial data query statement at the current query level; determining the root node of the sub-query statement and the keyword node under the root node, the keyword node including the query keyword node, the associated keyword node and the conditional keyword node; constructing the tree structure at the current query level based on the root node and the keyword node, wherein, when the current query level is not the first query level, the root node is connected to the associated keyword node in the tree structure at the previous query level.

[0036] Step 410 - 2 , parse the syntax tree in a top-down order of the query level to obtain the data source link of the most surface query result field corresponding to the initial data query statement.

[0037] The data source link includes the leaf node information of the query keyword node at each query level and the information of the data table child node.

[0038] In specific application scenarios, such as Figure 3As shown, the query tracer can parse the syntax tree from top to bottom to obtain the data source link of the query result field at the most superficial level of the query statement. Each query level defines a dictionary trace to store the node information of the syntax tree at that level, where the trace contains level_num, filed_list, and table_list, which respectively store the number of levels, query leaf nodes, and data table child nodes of this level. Definition of query leaf nodes and data table child nodes: composed of node name (name), original name (original_name), attribute (attribute), and source (from). Node names are divided into four types: field name: FieldName (FN), field alias: AliasName (AN), table name: TableName (TN), and subquery alias: SubQueryAliasName (SQAN).

[0039] The specific implementation process can be: 1. Locate the root node of the syntax tree *_root and set the trace.level_num level; 2. Retrieve the query keyword child nodes under the root node, such as the "select" node, count all leaf nodes under the node, and add child node information to trace.filed-list: a) The leaf node tag attribute is FN, which records the node name and source (table name or subquery name); b) Non-leaf node judgment keywords, such as "as", mark the node attribute as FN, and record the node alias, original name and source (table name or subquery name); 3. Retrieve the relationship keyword nodes such as "join", "from", "union" under the root node, and add the child node information in trace.table_list: a) The leaf node tag attribute is TN, which records the node name and source (NULL); b) Non-leaf nodes, with the tag attribute SQAN. When the node is a keyword, such as "as", the child node alias, original name and source (NULL) are recorded. Otherwise, the node name and source (which can be the root node of the next level) are recorded. 4. After the query node traversal of this layer is completed, the child node with the attribute SQAN in the trace.table_list list is locked, and the next level of the syntax tree is traversed according to its from information; Repeat steps 1, 2, 3, and 4 until the bottom layer of the syntax tree is reached to obtain the data source link list for the most superficial query result field corresponding to the initial data query statement. <trace>.

[0040] Step 410 - 3 : According to the leaf node information of the query keyword node at each query level and the information of the data table child node, determine the top query result field corresponding to the sensitive field at each query level.

[0041] In specific application scenarios, such as Figure 3 As shown, the sensitive link analyzer can be based on the data source link List <trace>Determine the transfer link from the sensitive fields in each query level in the initial data query statement to the surface result fields, and further determine the most surface query result fields corresponding to the sensitive fields.

[0042] Here are the steps: 1. Read List <trace>structure; 2. Set level_num to i, when i = 1; 3. Read List <trace>For the trace with level_num=i in the structure, i.e. trace[i], get trace[i].field_list; 4. Traverse each element item[j] of trace[i].field_list: a) When i=0, a bidirectional linked list storage space link[j] is allocated for each element item[j]. The link_item structure of each element in the linked list includes table_name (name of the table to which it belongs), fild_name (field name), is_private (sensitive), and rule_id (desensitization rule identifier); b) Retrieve the from field in each element item[j] and match it with the name field of each table element in trace[i].table_list. If the match is successful, append the linked list element link_item of the element to the corresponding link[j] and mark link_item.fild_name and link_item.table_name. c) If the attribute of the table element matched in trace [i].table_list is TN, it proves that the field comes from this table. According to the data set configuration, determine whether this field in the table is a sensitive field: i. If it is a sensitive field, modify the link_item.is_private=true of this linked list element, and mark link_item.rule_id as the desensitization rule identifier corresponding to this field configured in the data set. If this element is not the first element of the linked list, reverse the linked list element, return the "sensitive" mark to the first element of the linked list, and change the first element is_private=true and link_item.rule_id; ii. Otherwise, the current element of the linked list is_private = NULL; d) If the attribute of the table element matched in trace [i].table_list is SQAN, it proves that the field comes from the lower-level subquery result, execute i = i + 1, and execute steps 3 and 4; Until all elements of trace [0].field_list are traversed, we get Figure 5 The chain data structure shown in the figure shows that in the complex query results of the example, the result of the name field comes from the name column in the teacher table, which is a sensitive field; the result of the student_name field comes from the name column in the student table, which is a sensitive field; other fields have no sensitive configuration.

[0043] Step 410 - 4 : Desensitize the most superficial query result fields to obtain first query result data.

[0044] In specific application scenarios, such as Figure 3 As shown, the desensitization rule management service can provide SQL function statement customization function, provide a basic framework for function definition, and provide external function method name, input type, return type and function body customization entry. The main custom desensitization rules are implemented in the function body. For the disclosed embodiment, the desensitization processor obtains the required target desensitization rule (i.e., desensitization function) from the desensitization rule management service based on the "desensitization identifier" configured by the "sensitive field" obtained by the sensitive link analyzer. Based on the target desensitization rule, the identified sensitive field is desensitized to further obtain the first query result data.

[0045] Correspondingly, for the embodiments of the present disclosure, the steps of the embodiments may include: determining the sensitive field type of the most superficial query result field, and the desensitizing identifier configured corresponding to the sensitive field type; obtaining the target desensitizing rule corresponding to the desensitizing identifier in the desensitizing rule management service, wherein the desensitizing rule management service stores different desensitizing rules corresponding to different desensitizing identifiers; based on the target desensitizing rule, desensitizing the most superficial query result field; after completing the desensitizing processing of each sensitive field, obtaining the first query result data.

[0046] Step 410 - 5 : Determine whether the first query result data meets the preset query result requirements.

[0047] Step 410 - 6 : If the first query result data meets the preset query result requirement, the initial data query statement is determined as the target data query statement.

[0048] Step 410-7: If the first query result data does not meet the preset query result requirements, the initial data query statement is debugged, and the above iterative debugging process is repeatedly performed for the debugged initial data query statement.

[0049] Step 420: Determine a keyword set corresponding to the target data query statement.

[0050] Step 430: In the production container, the data set in the external database is read in blocks. Based on the keyword set, the keyword data in each block of data is encrypted and a security index is constructed.

[0051] In specific application scenarios, the full amount of data is used in the production container. However, the full amount of data is generally very large, and reading all of it at once will cause pressure and security issues. Therefore, a block reader is added to the production container to read the full amount of data piece by piece into the container for encrypted storage.

[0052] In this application, data can be downloaded in blocks, and a secure index can be built for each block of data. The index uses encrypted data, a one-way linked list with staggered storage of keys, and an ordered hash index table. Even if a thief obtains an element in the index linked list, he cannot trace it back to the correct key. Throughout the life cycle of the production container, the data set is always stored in full ciphertext, and the encryption keys for different values ​​of the conditional query fields are different, and the keys are stored in a staggered one-way linked list of the index. This solution is designed to obtain qualified data through index query in full ciphertext state, and supports general range queries, equal value queries, joint queries, numerical calculations, etc.

[0053] In this application, the security index is defined as consisting of two parts, namely the hash table index Hash-Table and the one-way encrypted linked table index EN-Link. When building a security index, the index builder can read a piece of data table data and build the security index according to the following process.

[0054] 1. Get a section of table data from a remote data source from the block reader; For example, the data table student_table is shown in Table 1: Table 1

[0055] 2. Get the keyword set keywords: The data table fields that participate in the conditional comparison in the query statement are called conditional keywords, which are composed of the leaf node fields under the "conditional keywords" such as "on" and "where" nodes in the syntax tree in the debugging container. 3. Add a new identification column: Add a unique identification column to each data table, record it as the sign_id column, and the serial number starts from 1 and increases; The example after adding a unique identifier column is shown in Table 2:

[0056] 4. Build a keyword equal value index set: define the keyword equal value index set IndexSet structure Map <keyword:List<Index-Item <key:value>>>, the equivalent index of keyword keywords[i] is IndexSet[i], where i is a specific keyword, such as age. That is, the different values ​​of the age column in the table are integrated, and the sign_id corresponding to the same value is recorded.

[0057] a) Specify the keywords keywords[i] to be indexed and create an empty index list IndexSet[i]=[]; b) Iterate through each value v in the keyword column in the data table and check whether the Index-Item.key of each element in IndexSet[i] contains v; c) If included, append the unique identifier sign_id of the row where the value v is located to the list of Index-Item.value corresponding to Index-Item[v]; d) If not, create a new Index-Item in IndexSet[i], with Index-Item.key=v, Index-Item.value=[], and append the unique identifier sign_id of the row where the value v is located to the list of Index-Item.value corresponding to Index-Item[v]; e) Finally, a set of equal-value indexes about keywords[i] is constructed.

[0058] 5. Read the next segment of table data and repeat steps 3-4 until the data set is read. Each data segment adds a new sign_id column number that continues the last number of the previous segment. 6. Sorting: If the keyword data type is a numeric type, the keyword equal value index is sorted from small to large according to the Index-Item.key value of IndexSet[i]; 7. Construct Hash-Table and encrypted linked list EN-Link: a) Select the equivalent index IndexSet[i] whose keyword is keywords[i]; b) Create the first element EN-Link-first-item of the encryption linked list EN-Link, which is empty, and define an element structure in the encryption linked list, which consists of sign-List, EN(v), next-priKey, and next-address, and stores: Index-Item.value, the encrypted Index-Item.key value, the encryption key next_priKey of Index-Item.key in the next element EN-Link-next-item, and the next element address next_adderss respectively; c) Create a Hash-Table consisting of the hash of the Index-Item.key value and the element address pointing to the corresponding Index-Item information in the EN-Link; d) Traverse the equal index IndexSet[i] of keyword keywords[i], the key generation component generates an encryption key priKey for each Index-Item.key, uses priKey to encrypt the Index-Item.key value to obtain EN(Index-Item.key), stores the key priKey in the next_priKey of the current element EN-Link-current-item of the linked list, creates a new element EN-Link-next-item, and makes EN-Link-current-item.next_address point to the new element address, and stores Index-Item.value and EN(Index-Item.key) in the new element.

[0059] e) The hash of the Index-Item.key and the address of the current element EN-Link-current-item in the linked list are stored as a row of data in the Hash-Table; f) Replace EN (Index-Item.key) to the corresponding position of the encrypted data table to complete the encryption of the data table.

[0060] Accordingly, for the embodiment of the present disclosure, the encryption processing of each block data and the construction of a security index based on the keyword set in step 430 may include the following steps: Step 430 - 1 : Determine a conditional keyword in the keyword set, and determine keyword data corresponding to each conditional keyword in each block of data.

[0061] Step 430 - 2 : Create an equivalent index set corresponding to each conditional keyword based on the keyword data. The equivalent index set includes at least one equivalent index, and each equivalent index contains different keyword data.

[0062] Step 430-3: Encrypt the keyword data and create a hash table index and a one-way encrypted linked list index corresponding to the equal value index set.

[0063] Among them, the hash table index stores the hash value corresponding to each keyword data and the element index position of each keyword data in the one-way encrypted linked list index. The one-way encrypted linked list index contains multiple element indexes, and each element index in the multiple element indexes is used as a target element index to determine the next element index of the target element index. When the target element index is the first element index in the multiple element indexes, the target element index contains the encryption key of the encrypted value stored in the next element index and the element address of the next element index; when the target element index is any element index in the multiple element indexes except the first element index, the target element index contains the encryption value for the current keyword data, the identification index of the data table location where the current keyword data is located, the encryption key of the encrypted value stored in the next element index and the element address of the next element index.

[0064] Step 440: Encrypt the non-keyword data in each block of data and store the encryption key.

[0065] In specific application scenarios, you can use Figure 3 The encryption and decryption components shown encrypt the non-keyword data in each block of data separately. The encryption and decryption components can be combined by components that provide key generation, key distribution, symmetric encryption, and homomorphic encryption functions on the market. Correspondingly, the encryption and decryption components provide encryption and decryption components, homomorphic encryption components, and key generation components internally, and provide a calling interface externally. Specifically, the data blocks read by the block reader can be decomposed into three categories: table name, field name, and value. The string encryption component interface is called for symmetric encryption of the table name and field name. The values ​​in the table are marked in the form of coordinates, and the value type is determined. If it is a string type, symmetric encryption is performed, and if it is a value type, homomorphic encryption is performed. Finally, the encrypted table name and field name are used as parameters to call the data receiving interface, a local table is built in the data table storage area, and the encrypted values ​​are filled into the local table according to the coordinate mark. (The newly added unique identification column sign_id is not encrypted) In this process, the encrypted data table records the corresponding table name, field name, and the encryption key of each field column.

[0066] Accordingly, for the embodiment of the present disclosure, the encryption processing of the non-keyword data in each block of data and the storage of the encryption key in step 440 may include the following steps: Step 440 - 1 : Determine non-keyword data other than keyword data in each block of data.

[0067] Step 440 - 2 : Decompose the non-keyword data to obtain the table name, field name and value contained in the non-keyword data.

[0068] Step 440-3: perform symmetrical encryption on the table name and field name, and store the encrypted table name, field name, table name encryption key, and field name encryption key into the encrypted data table.

[0069] Step 440 - 4 , encrypt the value based on the value type of the value, and store the encrypted value and the value encryption key in the encryption data table according to the coordinate mark.

[0070] Among them, when the value type is a string type, the value is symmetrically encrypted; when the value type is a number type, the value is homomorphically encrypted.

[0071] Step 450: In response to the target data query statement, call the security index to decrypt the block encryption result to obtain the query result data.

[0072] The block encryption result may include the encryption result of key data using the security index and the encryption result of non-keyword data using the encryption key.

[0073] When querying data in this application, general multi-layer nested queries, joint queries, equal value queries and range queries can be supported. When querying, the deepest internal condition filtering should be performed first, and the encrypted table should be decrypted layer by layer according to the query keywords. The specific process can be as follows: 1. Read the query statement; 2. Identify the lowest level query conditions at the current stage, identify the query keyword, and read the index Hash-Table and EN-Link corresponding to the keyword: a) Define the conditional query pointer point_B, such as field_B==13, which points to the row in the middle of the ordered Hash-Table; b) Use binary search to find equal values. The point_B pointer points to the middle row of Hash-Table-B. Read the address stored in the row, read the EN-Link-current-item and the next EN-Link-next-item linked list elements stored in the address, use EN-Link-current-item.next_priKey to decrypt EN (Index-Item.key) to get Index-Item.key, and compare it with the field_B value. c) If the Index-Item.key value is too small, the point_B pointer moves down to the middle of the lower half of the Hash-Table; if the Index-Item.key value is too large, the point_B pointer moves up to the middle of the upper half of the Hash-Table; d) Repeat steps b and c until the same or closest value is obtained; e) If the query condition is an equal value query, only select the row with the same value as point_B in the Hash-Table; f) If the query condition is a range query, select only all rows below or above point_B in the Hash-Table according to the query condition (e.g. greater than, less than); 3. At present, one or more rows of data that meet the conditions have been obtained from the Hash-Table. According to the address of each row, the corresponding elements EN-Link-current-item and EN-Link-next-item are found in the EN-Link list, and EN-Link-current-item.next_priKey and EN-Link-next-item. Sign-List are obtained; 4. Find the corresponding sign_id data row in the encrypted data table according to EN-Link-next-item. Sign-List; 5. Use EN-Link-current-item.next_priKey to decrypt the value corresponding to the keyword in the row; 6. Store the table that decrypts this keyword column in the cache for subsequent conditional queries; 7. Based on this cache, perform the conditional query of the previous layer, and execute steps 2-6 until the conditional query is completed. A data table with all plain text except the query keyword will be obtained in the cache; 8. Use the key used to encrypt the data table to decrypt the remaining fields; 9. Output result table; If it is a multi-table joint query, there will be multiple plaintext tables filtered by the lower-level conditions in the cache. These tables are used to directly execute the joint query and finally output the result table; If it is a single-table query, condition filtering is completed layer by layer on the single table in the cache, and the result table is output.

[0074] If a simple mathematical addition and subtraction operation is performed on a numeric type column during the query process, the homomorphic encryption component is first called using ciphertext to perform the calculation, and the resulting ciphertext replaces the original data in the cache table before decryption.

[0075] Accordingly, for the embodiment of the present disclosure, in response to the target data query statement in step 450, calling the security index to decrypt the block encryption result to obtain the query result data may include the following steps: Step 450 - 1 : extract query keywords in the target data query statement.

[0076] Step 450 - 2 : Determine the first index position of the query keyword in the hash table index.

[0077] Step 450-3: Based on the element index position of the keyword data stored at the first index position in the one-way encrypted linked list, determine the second index position of the query keyword in the one-way encrypted linked list index, and the third index position of the next element index corresponding to the second index position.

[0078] Step 450-4: Determine the identification index of the data table location where the keyword data stored at the second index location is located.

[0079] Step 450-5: Determine the query keyword data corresponding to the identification index.

[0080] Step 450-6: Decrypt the query keyword data using the encryption key stored in the third index position to obtain second query result data.

[0081] Step 450-7, obtain the table name encryption key, field name encryption key and value encryption key in the encrypted data table, and decrypt the non-keyword data in the second query result data based on the table name encryption key, field name encryption key and value encryption key to obtain the query result data.

[0082] In summary, the technical solution in the present application can accurately locate the data source of the query statement output result field in the debugging container, and desensitize the most superficial output field in the data table. It avoids the phenomenon of query failure, error, and failure when there are sensitive fields with the same name in each table, and the global processing causes the data of non-sensitive fields with the same name or sensitive fields with the same name in other tables to be desensitized, thereby improving the data security in the production container. In the production container, by adopting the method of reading data in blocks, encrypting in blocks, and establishing a security index at the same time, it can be ensured that the data set is always stored in ciphertext form during the life cycle of the production container, which can prevent data thieves from entering the production container to steal data through certain technical means, and can also realize more common data query functions based on full ciphertext data.

[0083] Based on the above Figure 2 , Figure 4 A detailed description of the data query method based on the data sandbox is provided, such as Figure 6 As shown, Figure 6 FIG. 1 is a structural block diagram of a data query device based on a data sandbox according to an exemplary embodiment. Figure 6 As shown, the device comprises: The debugging module 61 may be used to, in response to receiving an initial data query statement for an external database, debug the initial data query statement in a debugging container to obtain a target data query statement and a keyword set that meet a preset query result requirement, wherein the preset query result requirement is to perform desensitization processing on the most surface query result fields of the query result data; The processing module 62 can be used to read the data set in the external database in blocks within the production container, encrypt each block of data based on the keyword set and build a security index, and call the security index to decrypt the block encryption result in response to the target data query statement to obtain the query result data. The security index includes an ordered hash table index and a one-way encrypted linked list index with a staggered key storage.

[0084] In some embodiments of the present application, the debugging module 61 can be specifically used to respond to receiving an initial data query statement for an external database, repeatedly execute the following iterative debugging process of the initial data query statement until a target data query statement that meets the preset query result requirements is obtained; determine the keyword set corresponding to the target data query statement; wherein the iterative debugging process of the initial data query statement includes: creating a syntax tree of the initial data query statement in the debugging container; parsing the syntax tree in a top-down order of the query level to obtain a data source link of the most superficial query result field corresponding to the initial data query statement, the data source link containing leaf node information of the query keyword node under each query level and information of the data table child node; determining the most superficial query result field corresponding to the sensitive field under each query level according to the leaf node information of the query keyword node under each query level and information of the data table child node; desensitizing the most superficial query result field to obtain the first query result data; judging whether the first query result data meets the preset query result requirements; if so, determining the initial data query statement as the target data query statement; if not, debugging the initial data query statement, and repeating the above iterative debugging process for the debugged initial data query statement.

[0085] In some embodiments of the present application, when creating a syntax tree for an initial data query statement in a debugging container, the debugging module 61 can be specifically used to determine the number of query levels of the syntax tree structure corresponding to the initial data query statement; for each query level in the multiple query levels, the following iterative construction process of the tree structure corresponding to the initial data query statement is iteratively executed respectively until the number of iterations is equal to the number of query levels, thereby obtaining the syntax tree of the initial data query statement; the iterative construction process of the tree structure includes: locating the sub-query statement corresponding to the initial data query statement at the current query level; determining the root node of the sub-query statement and the keyword node under the root node, the keyword node including a query keyword node, an associated keyword node and a conditional keyword node; constructing a tree structure at the current query level based on the root node and the keyword node, wherein, when the current query level is not the first query level, the root node is connected to the associated keyword node in the tree structure at the previous query level.

[0086] In some embodiments of the present application, when the most superficial query result field is desensitized to obtain the first query result data, the debugging module 61 can be specifically used to determine the sensitive field type of the most superficial query result field, and the desensitizing identifier configured corresponding to the sensitive field type; obtain the target desensitizing rule corresponding to the desensitizing identifier in the desensitizing rule management service, wherein the desensitizing rule management service stores different desensitizing rules corresponding to different desensitizing identifiers; based on the target desensitizing rule, the most superficial query result field is desensitized; after completing the desensitizing processing of each sensitive field, the first query result data is obtained.

[0087] In some embodiments of the present application, when encrypting each block data and constructing a security index based on a keyword set, the processing module 62 can be specifically used to determine a conditional keyword in the keyword set, and determine the keyword data corresponding to each conditional keyword in each block data; create an equivalent index set corresponding to each conditional keyword based on the keyword data, the equivalent index set includes at least one equivalent index, and each equivalent index contains different keyword data; encrypt the keyword data, and create a hash table index and a one-way encrypted linked list index corresponding to the equivalent index set; wherein the hash table index stores a hash value corresponding to each keyword data and a hash value of each keyword data in the one-way encrypted linked list index. The element index position in the reference, the one-way encrypted linked list index includes multiple element indexes, each element index in the multiple element indexes is used as the target element index, and the next element index of the target element index is determined. When the target element index is the first element index in the multiple element indexes, the target element index includes the encryption key of the encrypted value stored in the next element index and the element address of the next element index; when the target element index is any element index in the multiple element indexes except the first element index, the target element index includes the encryption value for the current keyword data, the identification index of the data table location where the current keyword data is located, the encryption key of the encrypted value stored in the next element index and the element address of the next element index.

[0088] In some embodiments of the present application, Figure 6 As shown, the device further includes: a determination module 63, a decomposition module 64, and an encryption module 65; A determination module 63, which can be used to determine non-keyword data other than keyword data in each block of data; A decomposition module 64 may be used to decompose the non-keyword data to obtain the table name, field name and value contained in the non-keyword data; The encryption module 65 may be used to symmetrically encrypt the table name and the field name, and store the encrypted table name, field name, table name encryption key, and field name encryption key in an encrypted data table; The encryption module 65 can also be used to encrypt a numerical value based on the numerical type of the numerical value, and store the encrypted numerical value and the numerical encryption key in an encrypted data table according to coordinate marks, wherein when the numerical type is a string type, the numerical value is symmetrically encrypted; when the numerical type is a numeric type, the numerical value is homomorphically encrypted.

[0089] In some embodiments of the present application, in response to a target data query statement, a security index is called to decrypt the block encryption result to obtain query result data, and the processing module 62 can be specifically used to extract the query keyword in the target data query statement; determine the first index position of the query keyword in the hash table index; based on the element index position of the keyword data stored at the first index position in the one-way encrypted linked list, determine the second index position of the query keyword in the one-way encrypted linked list index, and the third index position of the next element index corresponding to the second index position; determine the identification index of the data table location where the keyword data stored at the second index position is located; determine the query keyword data corresponding to the identification index; use the encryption key stored at the third index position to decrypt the query keyword data to obtain second query result data; obtain the table name encryption key, field name encryption key and value encryption key in the encrypted data table, and decrypt the non-keyword data in the second query result data based on the table name encryption key, field name encryption key and value encryption key to obtain query result data.

[0090] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0091] In the embodiment of the present application, in response to receiving the initial data query statement for the external database, the initial data query statement can be debugged in the debugging container to obtain the target data query statement and the keyword set that meet the preset query result requirements; then, the data set in the external database is read in blocks in the production container, and each block data is encrypted and a security index is constructed based on the keyword set, and in response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data, wherein the security index includes an ordered hash table index and a one-way encrypted linked list index with a key misplaced storage. The technical solution in the present application can accurately locate the data source of the query statement output result field in the debugging container, and desensitize the most surface output field in the data table. It avoids the phenomenon of query failure, error, and failure when there are sensitive fields with the same name in each table, and the global processing causes the non-sensitive fields with the same name or the data of sensitive fields with the same name in other tables to be desensitized, thereby improving the data security in the production container. In the production container, by adopting the method of reading data in blocks, encrypting in blocks, and establishing a secure index, it can be ensured that the data set is always stored in ciphertext form during the life cycle of the production container. This can not only prevent data thieves from entering the production container to steal data through certain technical means, but also realize more common data query functions based on the full ciphertext data.

[0092] In the above, the data query device based on the data sandbox of the embodiment of the present invention is described from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in the form of hardware, can be implemented by instructions in the form of software, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the data query method embodiment based on the data sandbox in the embodiment of the present invention can be completed by the hardware integrated logic circuit and / or software instructions in the processor, and the steps of the data query method based on the data sandbox applied in conjunction with the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or a combination of hardware and software modules in the decoding processor to execute. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps in the above-mentioned data query method embodiment based on the data sandbox in combination with its hardware.

[0093] Figure 7 It is a schematic block diagram of an electronic device 700 according to an embodiment of the present invention.

[0094] like Figure 7 As shown, the electronic device 700 may include: The memory 710 and the processor 720, the memory 710 is used to store the computer program and transmit the program code to the processor 720. In other words, the processor 720 can call and run the computer program from the memory 710 to implement the method in the embodiment of the present invention.

[0095] For example, the processor 720 may be configured to execute the above method embodiments according to instructions in the computer program.

[0096] In some embodiments of the present invention, the processor 720 may include but is not limited to: General-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0097] In some embodiments of the present invention, the memory 710 includes but is not limited to: Volatile memory and / or non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct memory bus random access memory (Direct Rambus RAM, DR RAM).

[0098] In some embodiments of the present invention, the computer program may be divided into one or more modules, which are stored in the memory 710 and executed by the processor 720 to complete the method provided by the present invention. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the controller.

[0099] like Figure 7 As shown, the electronic device 700 may further include: The transceiver 730 may be connected to the processor 720 or the memory 710 .

[0100] The processor 720 may control the transceiver 730 to communicate with other devices, specifically, to send data to other devices or receive data sent by other devices. The transceiver 730 may include a transmitter and a receiver. The transceiver 730 may further include an antenna, and the number of antennas may be one or more.

[0101] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0102] The present invention also provides a computer storage medium having a computer program stored thereon, which, when executed by a computer, enables the computer to perform the method of the above method embodiment. In other words, an embodiment of the present invention also provides a computer program product containing instructions, which, when executed by a computer, enables the computer to perform the method of the above method embodiment.

[0103] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (Digital Video Disc, DVD)), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0104] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments applied herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0105] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0106] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0107] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in this application, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.< / key:value> < / trace> < / trace> < / trace> < / trace>

Claims

1. A data query method based on a data sandbox, characterized in that: The data sandbox includes a debugging container and a production container, and the method includes: In response to receiving an initial data query statement for an external database, debugging the initial data query statement in the debugging container to obtain a target data query statement and a keyword set that meet a preset query result requirement, wherein the preset query result requirement is to perform desensitization processing on the most surface query result fields of the query result data; The data set in the external database is read in blocks within the production container, and each block of data is encrypted and a security index is constructed based on the keyword set. In response to the target data query statement, the security index is called to decrypt the block encryption result to obtain the query result data, wherein the security index includes an ordered hash table index and a one-way encrypted linked list index with a key staggered storage.

2. The method according to claim 1, characterized in that In response to receiving an initial data query statement for an external database, debugging the initial data query statement in the debugging container to obtain a target data query statement and a keyword set that meet preset query result requirements includes: In response to receiving an initial data query statement for an external database, repeatedly executing the following iterative debugging process for the initial data query statement until a target data query statement that meets the preset query result requirements is obtained; Determine a keyword set corresponding to the target data query statement; The iterative debugging process of the initial data query statement includes: Creating a syntax tree of the initial data query statement in the debugging container; Parse the syntax tree in a top-down order of the query level to obtain a data source link for the most superficial query result field corresponding to the initial data query statement, wherein the data source link includes leaf node information of the query keyword node at each query level and information of the data table child node; Determine the most superficial query result field corresponding to the sensitive field at each query level according to the leaf node information of the query keyword node at each query level and the information of the data table child node; Desensitizing the most surface query result field to obtain first query result data; Determining whether the first query result data meets the preset query result requirements; If yes, determining the initial data query statement as the target data query statement; If not, the initial data query statement is debugged, and the above iterative debugging process is repeatedly performed for the debugged initial data query statement.

3. The method according to claim 2, characterized in that The creating a syntax tree of the initial data query statement in the debugging container includes: Determine the query level number of the syntax tree structure corresponding to the initial data query statement; For each query level in the multiple query levels, the following iterative construction process of the tree structure corresponding to the initial data query statement is iteratively executed respectively until the number of iterations is equal to the number of query levels, thereby obtaining a syntax tree of the initial data query statement; The iterative construction process of the tree structure includes: Locate the sub-query statement corresponding to the initial data query statement at the current query level; Determine a root node of the subquery statement and keyword nodes under the root node, wherein the keyword nodes include a query keyword node, an associated keyword node, and a condition keyword node; A tree structure under the current query level is constructed based on the root node and the keyword node, wherein when the current query level is not the first query level, the root node is connected to the associated keyword node in the tree structure under the previous query level.

4. The method according to claim 2, characterized in that: The top query result fields are desensitized to obtain first query result data, including: Determine the sensitive field type of the most superficial query result field, and the desensitization identifier configured corresponding to the sensitive field type; Obtaining a target desensitization rule corresponding to the desensitization identifier in a desensitization rule management service, wherein the desensitization rule management service stores different desensitization rules corresponding to different desensitization identifiers; Based on the target desensitization rule, desensitize the most superficial query result field; After completing the desensitization processing for each of the sensitive fields, the first query result data is obtained.

5. The method according to claim 1, characterized in that Based on the keyword set, each block of data is encrypted and a security index is constructed, including: Determine a conditional keyword in the keyword set, and determine keyword data corresponding to each conditional keyword in each block data; Creating an equivalent index set corresponding to each of the conditional keywords based on the keyword data, the equivalent index set including at least one equivalent index, each of the equivalent indexes including different keyword data; Encrypting the keyword data, and creating a hash table index and a one-way encrypted linked list index corresponding to the equal value index set; Among them, the hash table index stores the hash value corresponding to each of the keyword data and the element index position of each of the keyword data in the one-way encrypted linked list index, the one-way encrypted linked list index contains multiple element indexes, each of the multiple element indexes is used as a target element index, and the next element index of the target element index is determined. When the target element index is the first element index among the multiple element indexes, the target element index contains the encryption key of the encrypted value stored in the next element index and the element address of the next element index; when the target element index is any element index among the multiple element indexes except the first element index, the target element index contains the encryption value for the current keyword data, the identification index of the data table location where the current keyword data is located, the encryption key of the encrypted value stored in the next element index and the element address of the next element index.

6. The method according to claim 5, characterized in that The method further comprises: Determining non-keyword data other than the keyword data in each block of data; Decomposing the non-keyword data to obtain table names, field names and values ​​contained in the non-keyword data; Symmetrically encrypt the table name and the field name, and store the encrypted table name, field name, table name encryption key, and field name encryption key in an encrypted data table; Based on the numerical type of the numerical value, the numerical value is encrypted, and the encrypted numerical value and the numerical encryption key are stored in the encrypted data table according to the coordinate mark, wherein when the numerical type is a string type, the numerical value is symmetrically encrypted; when the numerical type is a number type, the numerical value is homomorphically encrypted.

7. The method according to claim 6, characterized in that The step of calling the security index to decrypt the block encryption result in response to the target data query statement to obtain the query result data includes: Extracting query keywords in the target data query statement; Determine a first index position of the query keyword in the hash table index; Based on the element index position of the keyword data stored at the first index position in the one-way encrypted linked list, determine the second index position of the query keyword in the one-way encrypted linked list index, and the third index position of the next element index corresponding to the second index position; Determine an identification index of a data table location where the keyword data stored at the second index location is located; Determine the query keyword data corresponding to the identification index; Decrypting the query keyword data using the encryption key stored in the third index position to obtain second query result data; The table name encryption key, the field name encryption key and the value encryption key are obtained in the encrypted data table, and non-keyword data in the second query result data are decrypted based on the table name encryption key, the field name encryption key and the value encryption key to obtain the query result data.

8. A data query device based on a data sandbox, characterized in that: The data sandbox includes a debugging container and a production container, and the device includes: A debugging module, configured to, in response to receiving an initial data query statement for an external database, debug the initial data query statement in the debugging container to obtain a target data query statement and a keyword set that meet a preset query result requirement, wherein the preset query result requirement is to perform desensitization processing on the most surface query result fields of the query result data; A processing module is used to read the data set in the external database in blocks within the production container, encrypt each block of data based on the keyword set and build a security index, and call the security index to decrypt the block encryption result in response to the target data query statement to obtain the query result data, wherein the security index includes an ordered hash table index and a one-way encrypted linked list index with a key staggered storage.

9. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 7.

Images