Graph data security operation method based on format-preserving encryption and order-preserving encryption

Abstract

The invention discloses a graph data security operation method based on format-preserving encryption and order-preserving encryption, and belongs to the technical field of information security. The operation method comprises the steps of vertex encryption and decryption of graph data, weight encryption and decryption of edges between vertexes and integrity verification; vertex encryption and decryption use an SM4-based reserved format encryption and decryption algorithm, so that the confidentiality and integrity of vertex information are effectively ensured on the premise of not changing the vertex identifier format; the weight encryption and decryption of the edges between the vertexes use an order-preserving encryption and decryption algorithm for an adjacent matrix, so that the ciphertext data has a pseudo-linear characteristic, and the size order relationship of the original data is reserved; integrity verification uses a national cryptographic SM3 algorithm and an SM9 signature system to operate encrypted graph data to prevent data leakage or tampering; the size sequence relation between the format features of the graph vertexes and the original edge weights is reserved, the data integrity is guaranteed, the method meets actual requirements, and safe operation of graph data is achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a graph data security calculation method based on a format-preserving encryption algorithm and an order-preserving encryption algorithm. Background Art

[0002] With the advent of the big data era, graph data is ubiquitous across fields such as communications, the internet, e-commerce, social networks, and the Internet of Things. Its scale is enormous and continues to grow. Graph data contains a large number of vertices and edges, involving complex relationships and network structures, posing significant challenges to its security and privacy. Throughout the entire data collection, storage, analysis, and application process, any oversight at any stage could lead to the leakage of sensitive information, leading to a range of risks such as privacy exposure, identity tracing attacks, and theft of trade secrets. These risks pose a potential threat to individual rights, corporate security, and even social stability.

[0003] Format-Preserving Encryption (FPE) is a symmetric encryption technique that preserves the format and structure of data during encryption. FPE allows secure data processing and storage without changing the data structure. It supports the use of the same key for encryption and decryption, simplifying key management. In graph data processing, FPE can be used to encrypt vertex and edge attributes without changing the graph's topology.

[0004] The concept of format-preserving encryption methods can be traced back to the 1980s. However, the real breakthrough occurred in the early 21st century. In 2002, Black and Rogaway designed the Prefix algorithm, the Cycle-walking algorithm, and the Generalized-Feistel algorithm, which to a certain extent solved the format-preserving problem on integer sets. In 2010, Liu et al. proposed an encryption scheme based on random reference values to solve the format-preserving problem of date and time fields in the database. In 2020, Chen Jia proposed to design a format-preserving encryption algorithm based on the national secret SM4, and then combined the national secret SM3 algorithm to design an authenticated format-preserving encryption algorithm. In 2023, Jin Shiqing proposed to design a national secret-based integer domain format-preserving encryption method based on the FF1 algorithm model.

[0005] Order-Preserving Encryption (OPE) is an encryption technology that supports ciphertext order comparison, preserving the order of data during encryption. OPE allows encrypted data to be directly compared and sorted without decryption, which is extremely valuable in fields that process large amounts of sensitive data. In graph data processing, OPE can be used to encrypt edge weights or vertex attribute values without changing their ordering.

[0006] Regarding order-preserving encryption methods, in 2013, some scholars proposed an ideally secure OPE algorithm, but it later became vulnerable by inferring the potential frequency of repeated plaintext. In 2017, Sun Yanjun et al. proposed a variable order-preserving encoding scheme gmOPE, which not only preserves the order of plaintext but also enables efficient sequential queries on ciphertext. In 2020, in response to the problem that existing order-preserving encryption schemes are difficult to strike a balance between security, efficiency, and ease of use, Xu Yansheng et al. proposed a nonlinear mapping order-preserving encryption scheme based on random functions. In 2021, JiHye et al. proposed a more effective FH-OPE based on the security model of Maffei et al., and proposed an improved update algorithm suitable for repeated plaintext.

[0007] However, existing encryption technologies, such as symmetric and asymmetric encryption, are commonly used to protect data confidentiality but have limitations when processing graph data. Existing encryption methods can destroy the structure and format of the data, making it impossible to correctly restore the graph structure after decryption. For example, if vertices and edges in graph data are encrypted, the size relationship of the data before decryption may be unclear, and the original connectivity relationship of the data after decryption may not be maintained, thus affecting the analysis and processing of the graph data. Summary of the Invention

[0008] The present invention aims to solve the problem of preserving the format characteristics of graph vertices and the size order relationship of original edge weights, ensuring data integrity, meeting the actual graph data operation requirements based on format-preserving encryption and order-preserving encryption, and realizing secure operation of graph data.

[0009] According to the first main aspect of the present invention, a method for secure computation of graph data based on format-preserving encryption and order-preserving encryption is provided, the method comprising one or a combination of the following steps:

[0010] Graph vertex encryption, using a format-preserving encryption algorithm based on SM4;

[0011] Graph vertex decryption, using a format-preserving decryption algorithm based on SM4;

[0012] The weights of the edges between graph vertices are encrypted using an order-preserving encryption algorithm for the adjacency matrix;

[0013] Decrypt the weights of the edges between graph vertices using an order-preserving decryption algorithm for the adjacency matrix;

[0014] Graph data integrity authentication uses the national secret SM3 algorithm and SM9 signature system.

[0015] As a further preferred solution, the graph vertex encryption includes: obtaining the vertex identifier data to be encrypted in the graph; judging whether the character length of the identifier is an odd number or an even number, and determining the encryption structure type; using the SM4 algorithm to expand the key and construct a round function; splitting the identifier and using the Feistel structure to perform r-round iterative encryption; splicing the encrypted results and performing a legitimacy check to ensure that the ciphertext meets the predefined format requirements.

[0016] As a further preferred solution, the graph vertex decryption includes: obtaining the encrypted vertex identifier data; judging the character length of the ciphertext identifier and determining the decryption structure type; performing key expansion based on the SM4 algorithm and constructing a round function consistent with the encryption process; splitting the ciphertext identifier according to the method in the encryption process; performing r rounds of Feistel decryption operations in the reverse order of the round keys to restore the original plaintext identifier; performing a legitimacy check on the decryption result to ensure that the format is consistent and meets predefined requirements; if the decryption fails, retrying decryption using the recorded encryption parameters.

[0017] As a further preferred solution, the weight encryption of the edges between the graph vertices includes: obtaining the weights of the graph edges to be encrypted and sorting them; prioritizing the encryption of the data in the middle of the sort; calculating the maximum and minimum values based on the plaintext data domain and the ciphertext data domain, and determining the new data range; limiting the range of random number values to ensure that the ciphertext data is evenly distributed in the ciphertext domain; selecting a new ciphertext position through hypergeometric distribution sampling, and recursively updating the plaintext and ciphertext domains until the ciphertext is generated.

[0018] As a further preferred solution, the weight decryption of the edges between the vertices of the graph includes: obtaining the ciphertext data to be decrypted; restoring the ciphertext values one by one by reversely searching the encrypted ciphertext and the corresponding plaintext mapping relationship in the key table, ensuring that the decrypted result restores the original plaintext data order, and obtaining a complete decryption result; performing a legitimacy check on the decryption result to ensure that the decrypted plaintext data meets the predefined format requirements; if the decryption fails, returning an error message or re-encrypting until the decryption result is correct.

[0019] As a further preferred solution, the graph data integrity authentication includes: using the SM3 algorithm to generate a summary of the graph data, and encrypting the summary with a private key through the SM9 signature system; sending the encrypted summary together with the encrypted graph data matrix to the recipient; the recipient uses the SM9 public key to decrypt the summary and compare it with the graph data. If they match, it confirms that the data has not been tampered with or damaged.

[0020] As a further preferred solution, the legitimacy check includes: checking whether the length of the vertex identifier to be encrypted meets the predefined fixed length requirement; checking whether the identifier is a legal numeric data; checking whether each character in the identifier still belongs to the originally defined character set; if any check fails, adjusting the identifier to a required format or returning an error until the identifier meets the predefined format requirements.

[0021] As a further preferred solution, the hypergeometric distribution sampling includes: checking whether the current ciphertext candidate position is occupied; if it is occupied, obtaining the corresponding plaintext position and adjusting the sampling strategy; adjusting the sampling distribution based on different parameters so that the ciphertext meets specific security requirements; and adding the newly generated plaintext-ciphertext mapping to the key table.

[0022] Based on the second main aspect of the present invention, an electronic device is provided, comprising: at least one processor; a memory communicatively connected to the at least one processor; the memory storing a computer program which, when executed by the at least one processor, enables the at least one processor to implement the aforementioned graph data security operation method based on format-preserving encryption and order-preserving encryption.

[0023] Based on the third main aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed, implements the aforementioned graph data security operation method based on format-preserving encryption and order-preserving encryption.

[0024] Advantages and beneficial effects of the present invention:

[0025] The proposed solution uses a format-preserving encryption algorithm based on SM4 to encrypt graph vertex information. By performing format-preserving encryption on graph vertices, the confidentiality and integrity of vertex information can be effectively ensured without changing the vertex identifier format. This method preserves data structure and characteristics while protecting data privacy, providing an effective solution for secure graph data processing.

[0026] The solution proposed in this paper uses an order-preserving encryption algorithm to encrypt the edge weights between graph vertices. While traditional OPE algorithms preserve the order of the original data, edge weight encryption in graph data often requires numerical calculations, such as shortest path and critical path calculations. Therefore, this paper proposes an OPE algorithm for adjacency matrices, which imparts pseudo-linear properties to the encrypted ciphertext data, facilitating the calculation of algorithms such as shortest path and critical path. This improvement effectively improves the operability and computational efficiency of encrypted data, thereby better adapting to the application requirements of graph data.

[0027] The present invention uses encrypted data to perform various common graph algorithm operations, including minimum spanning tree, shortest path, topological sorting and critical path solution, verifies the correctness of the encrypted data and the effectiveness of the algorithm, and demonstrates the importance and practicality of applying encryption algorithms in graph data processing.

[0028] The solution proposed in this paper uses the national secret SM3 algorithm and SM9 signature system to authenticate data integrity and operate on encrypted graph data to prevent data leakage or tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, without paying any creative work, other drawings obtained based on these drawings still fall within the scope of the present invention.

[0030] Figure 1 The following is an architecture diagram of a graph data encryption and decryption system provided by an embodiment of the present invention;

[0031] Figure 2 A flow chart of a method for preserving the format of graph vertices based on SM4 is shown in one embodiment of the present invention;

[0032] Figure 3 A flow chart of a method for encrypting the weights of graph vertices and edges in an order-preserving manner for an adjacency matrix provided by an embodiment of the present invention is shown;

[0033] Figure 4 A flow chart of a method for graph data integrity authentication provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0034] The preferred embodiments of the present invention will be described in detail below so that the purpose, features and advantages of the present invention can be more clearly understood. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are only intended to illustrate the substantive content of the technical solution of the present invention.

[0035] In the following description, for the purpose of illustrating the various disclosed embodiments, certain specific details are set forth in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the relevant art will recognize that the embodiments may be practiced without one or more of these specific details. In other cases, well-known techniques associated with this application may not be shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0036] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any manner in one or more embodiments.

[0037] The present invention's graph data security calculation method based on the format-preserving encryption algorithm and the order-preserving encryption algorithm includes the following embodiments:

[0038] An embodiment includes providing a method for encrypting and decrypting vertices in a format-preserving manner in conjunction with national encryption;

[0039] An embodiment includes providing a method for encrypting and decrypting the weights of edges between vertices in an order-preserving manner;

[0040] An embodiment includes providing a method for graph data integrity authentication, ensuring that the performance meets actual needs and the accuracy, integrity and security of the encrypted data.

[0041] In one embodiment of the present invention, a method for encrypting vertices in a format-preserving manner in combination with national encryption is provided, the method comprising:

[0042] Obtain vertex identifier data to be encrypted in the graph; the identifier is numerical data with a fixed length and must meet predefined format requirements;

[0043] Determine whether the character length of the identifier is an even number to determine the encryption structure type; if it is an even number, use a balanced Feistel structure for encryption; if it is an odd number, use an unbalanced Feistel structure for encryption;

[0044] Performing a key expansion operation on the algorithm key based on the SM4 algorithm to obtain multiple rounds of subkeys; the key expansion includes: using the SM4 round key generation mechanism to perform multiple rounds of expansion on the master key to obtain an independent subkey set for each round of the encryption function;

[0045] Construct a round function F based on the SM4 algorithm; the round function takes the input string and the corresponding subkey as parameters, encrypts it with the SM4 algorithm, and outputs an encrypted intermediate value of fixed length, which is used for the encryption calculation of the left and right parts in each round of the Feistel structure;

[0046] The vertex identifier is split into two parts according to the character position, denoted as L and R respectively. The splitting method is determined according to the total number of characters. If the number is even, the vertex identifier is split into equal lengths. If the number is odd, the right half has one more character to meet the input requirements of the unbalanced Feistel structure.

[0047] Based on the constructed round function and extended key, r rounds of Feistel iterative encryption operations are performed on L and R, specifically including:

[0048] In each round, the right part R is used as the input of the round function and combined with the subkey of the current round to calculate the intermediate result F(R). F(R) is used to perform a bitwise XOR operation with the left part L to obtain the new right part R'. The original right part R is replaced with the new right part R', and the left and right parts are swapped to enter the next round of iteration. Multiple rounds of iterative encryption are performed until the set number of rounds is reached.

[0049] Concatenate L and R obtained from the last round of iteration to generate the encrypted ciphertext identifier;

[0050] The encryption result is subjected to a validity check; the check is used to confirm whether the ciphertext meets the structural constraints and character set requirements of the original identifier. If the check fails, the encryption is returned and re-encrypted until a legal ciphertext is output.

[0051] Optionally, in one embodiment, the legitimacy detection includes:

[0052] Verify whether the length of the vertex identifier to be encrypted meets the predefined fixed length requirement;

[0053] Check whether the identifier is a valid numeric data type to ensure that it meets the predefined data type requirements;

[0054] Check whether each character in the identifier still belongs to the originally defined character set;

[0055] If any check fails, the identifier is adjusted to meet the required format or an error is returned until the identifier meets the predefined format requirements.

[0056] In another embodiment of the present invention, a method for decrypting a vertex in a reserved format in combination with national encryption is provided, the method comprising:

[0057] Obtaining encrypted vertex identifier data; the identifier is ciphertext data obtained by encrypting the Feistel structure based on the SM4 algorithm, and has the same format and length as the original plaintext;

[0058] Determine whether the character length of the ciphertext identifier is an even number to determine the decryption structure type; if it is an even number, use the balanced Feistel structure for decryption; if it is an odd number, use the unbalanced Feistel structure for decryption;

[0059] Perform a key expansion operation on the algorithm key used for encryption based on the SM4 algorithm to obtain an expanded key sequence consistent with the encryption process;

[0060] Construct a round function F that is consistent with the encryption process; the round function is an encryption function generated by the SM4 algorithm, and its input parameters and structure are the same as those for encryption, which is used to ensure that the Feistel structure remains symmetric in the decryption direction;

[0061] Split the ciphertext identifier into two parts, L and R, according to the encryption process. The splitting method must be consistent with the encryption process. If the length is odd, the right half will have one more character.

[0062] Perform r rounds of Feistel decryption operations in reverse order of the round keys, including:

[0063] In each round, the current left part is input into the round function to obtain the intermediate encrypted value; this value is XORed with the current right part to restore the left part of the previous round; the current left part is then used as the right part of the previous round; and the process is repeated until the original L0 and R0 are restored.

[0064] Concatenate the left and right parts after the decryption iteration to obtain the plaintext identifier;

[0065] Perform a validity check on the decryption result; the verification includes format structure, character range and identifier integrity judgment to confirm whether the decryption is correct;

[0066] Outputs plaintext vertex identifiers in a consistent format.

[0067] Optionally, in one embodiment, the decryption process further includes:

[0068] The order of using the round keys is the reverse order of the encryption process, ensuring that the Feistel structure remains consistent in the decryption direction;

[0069] If the decryption result does not conform to the predefined format, you can retry decryption using the recorded encryption parameters or number of rounds.

[0070] In another embodiment of the present invention, a method for encrypting the weights of edges between vertices in an order-preserving manner is provided, the method comprising:

[0071] Encryption process Enc(key_table,D,R,m):

[0072] enter:

[0073] key_table: key table;

[0074] D: plaintext domain;

[0075] R: ciphertext field;

[0076] m: Plain text.

[0077] Output:

[0078] key_table: key table;

[0079] D: plaintext domain;

[0080] R: ciphertext field;

[0081] c: Plain text.

[0082] Obtaining plaintext data to be encrypted; the plaintext data includes edge weights of the graph, and is encrypted using the plaintext values;

[0083] Sort the plaintext data; sort all edges in the adjacency matrix of the graph, and arrange the sorted edges in ascending order of weight;

[0084] When encrypting, data in the middle of the sorting order is given priority;

[0085] Limit the selection of plaintext random numbers and take random numbers that are approximately half of the plaintext domain;

[0086] According to the plaintext data domain and the ciphertext data domain, the maximum value M and the minimum value m are calculated, and the new plaintext data range is determined;

[0087] M←max(D)-min(D)+1; N←max(R)+min(R)

[0088] Initialize the lower bound d of the plaintext domain and the lower bound r of the ciphertext domain;

[0089] d←min(D)-1; r←min(R)-1

[0090] Calculate the "midpoint" offset y of the ciphertext field and use it for subsequent encryption operations;

[0091]

[0092] Handle extreme cases; if M = 1, that is, the length of the plaintext field is 1, directly select a random ciphertext from the ciphertext field and return it;

[0093] IF M=1

[0094] RETURN c←{r+1,…,r+N-1}

[0095] Check whether the current candidate ciphertext position is already in use; if the ciphertext position r+y is already occupied by other plaintext, obtain the plaintext position x corresponding to the ciphertext; otherwise, perform hypergeometric distribution sampling and select a new plaintext position;

[0096] IF key_table(;,1).incontain(r+y)

[0097] index←key_table(;,1).find(r+y)

[0098] x←key_table(index,2)-d

[0099] ELSE

[0100] x←RD(min(D),max(D))

[0101] Add the newly generated plaintext and ciphertext mappings m→r+y and m→x to the key table;

[0102] key_table←{key_table,y,x}

[0103] Recursively update the plaintext domain D and ciphertext domain R based on the plaintext value m and the sampled x; if m ≤ x, limit the plaintext domain to the left half and reduce the ciphertext domain to the left half as well; otherwise, update to the right half;

[0104] IFm≤x

[0105] D←{d+1,…,d+x}

[0106] R←{r+1,…,r+y}

[0107] ELSE

[0108] D←{d+x+1,…,d+M}

[0109] R←{r+y+1,…,r+N}

[0110] Continue to recursively call the encryption function in the updated plaintext domain and ciphertext domain until the ciphertext value can be returned.

[0111] RETURN Enc(key_table,D,R,m)

[0112] Optionally, in the step of generating a random number and limiting the range, the value range of the random number is limited to avoid extreme values having a negative impact on the encryption effect, thereby ensuring that the ciphertext data is evenly distributed in the ciphertext domain R;

[0113] Optionally, when performing the hypergeometric distribution sampling, the sampling distribution may be adjusted based on different parameters so that the distribution of the ciphertext data better meets specific security requirements;

[0114] Optionally, in the step of updating the key table, the key table may be encrypted multiple times to enhance the complexity and encryption security of the key;

[0115] Optionally, in the step of adjusting the plaintext and ciphertext domains according to encryption requirements, the selection of the ciphertext domain R can be dynamically adjusted according to different application scenarios and security requirements to ensure the scalability and security of encrypted data.

[0116] In another embodiment of the present invention, a method for decrypting the weights of edges between vertices in an order-preserving manner is provided, the method comprising:

[0117] During the OPE algorithm encryption process, a key table is generated to record the mapping relationship between plaintext and ciphertext. During decryption, the plaintext value is obtained in reverse by looking up the corresponding mapping relationship in the key table, thereby decrypting the encrypted data. This method ensures that the data order and mapping relationship before encryption can be maintained during the decryption process.

[0118] In another embodiment of the present invention, a method for graph data integrity authentication is provided, the method comprising:

[0119] A summary of the encrypted graph data is generated by using the SM3 algorithm; the obtained summary is encrypted with the private key using the SM9 signature system; the encrypted summary is sent to the receiver together with the graph data matrix obtained using format-preserving and order-preserving encryption; after receiving the data, the receiver uses the SM9 public key to decrypt the encrypted summary, restore the original summary value, and compare it with the received graph data; if the two match, it can be confirmed that the graph data has not been tampered with or damaged during transmission or processing.

[0120] Any related technologies in the field involved in the above implementation process that are not described in detail are common knowledge to those skilled in the art.

[0121] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A graph data security computing method based on format-preserving encryption and order-preserving encryption, characterized in that: The method comprises one or a combination of the following steps: Graph vertex encryption, using a format-preserving encryption algorithm based on SM4; Graph vertex decryption, using a format-preserving decryption algorithm based on SM4; The weights of the edges between graph vertices are encrypted using an order-preserving encryption algorithm for the adjacency matrix; Decrypt the weights of the edges between graph vertices using an order-preserving decryption algorithm for the adjacency matrix; Graph data integrity authentication uses the national secret SM3 algorithm and SM9 signature system.

2. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 1 is characterized in that: The graph vertex encryption includes: obtaining vertex identifier data to be encrypted in the graph; judging whether the character length of the identifier is an odd number or an even number, and determining the encryption structure type; using the SM4 algorithm to expand the key and construct a round function; splitting the identifier and using the Feistel structure to perform r-round iterative encryption; splicing the encrypted results and performing a legitimacy check to ensure that the ciphertext meets the predefined format requirements.

3. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 1 is characterized in that: The graph vertex decryption includes: obtaining encrypted vertex identifier data; judging the character length of the ciphertext identifier and determining the decryption structure type; performing key expansion based on the SM4 algorithm and constructing a round function consistent with the encryption process; splitting the ciphertext identifier according to the method in the encryption process; performing r rounds of Feistel decryption operations in the reverse order of the round keys to restore the original plaintext identifier; performing a validity check on the decryption result to ensure that the format is consistent and meets predefined requirements; if the decryption fails, retrying the decryption using the recorded encryption parameters.

4. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 1 is characterized in that: The weight encryption of the edges between graph vertices includes: obtaining the weights of the graph edges to be encrypted and sorting them; encrypting the data in the middle of the sorting first; calculating the maximum and minimum values based on the plaintext data domain and the ciphertext data domain, and determining a new data range; limiting the range of random number values to ensure that the ciphertext data is evenly distributed in the ciphertext domain; selecting a new ciphertext position through hypergeometric distribution sampling, and recursively updating the plaintext and ciphertext domains until the ciphertext is generated.

5. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 1 is characterized in that: The weighted decryption of the edges between the vertices of the graph includes: obtaining the ciphertext data to be decrypted; restoring the ciphertext values one by one by reversely searching the encrypted ciphertext and the corresponding plaintext mapping relationship in the key table, ensuring that the decrypted result restores the original plaintext data order, and obtaining a complete decryption result; performing a legitimacy check on the decryption result to ensure that the decrypted plaintext data meets the predefined format requirements; if the decryption fails, returning an error message or re-encrypting until the decryption result is correct.

6. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 1 is characterized in that: The graph data integrity authentication includes: using the SM3 algorithm to generate a summary of the graph data, and encrypting the summary with a private key through the SM9 signature system; sending the encrypted summary together with the encrypted graph data matrix to the recipient; the recipient uses the SM9 public key to decrypt the summary and compare it with the graph data. If they match, it is confirmed that the data has not been tampered with or damaged.

7. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 2 is characterized in that: The legitimacy check includes: checking whether the length of the vertex identifier to be encrypted meets the predefined fixed length requirement; checking whether the identifier is a legal numeric data; checking whether each character in the identifier still belongs to the originally defined character set; if any check fails, adjusting the identifier to a format that meets the requirements or returning an error until the identifier meets the predefined format requirements.

8. The graph data security computing method based on format-preserving encryption and order-preserving encryption according to claim 4 is characterized in that: The hypergeometric distribution sampling includes: checking whether the current ciphertext candidate position is occupied; if so, obtaining the corresponding plaintext position and adjusting the sampling strategy; adjusting the sampling distribution based on different parameters so that the ciphertext meets specific security requirements; and adding the newly generated plaintext-ciphertext mapping to the key table.

9. An electronic device, characterized in that: include: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores a computer program, which, when executed by the at least one processor, enables the at least one processor to implement the graph data security operation method based on format-preserving encryption and order-preserving encryption as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed, the graph data security operation method based on format-preserving encryption and order-preserving encryption as described in any one of claims 1 to 8 is implemented.

Images