Data query method and device and multi-party security database

Abstract

The embodiment of the invention provides a multi-party security database and a data query method and device for the multi-party security database. The multi-party security database comprises a central node and a plurality of databases, the central node is provided with a public first interface, and a plurality of query engines corresponding to the plurality of databases respectively comprise a second interface used for interacting with the first interface. Wherein the central node can determine a plurality of target databases related to a query request from a plurality of databases according to the query request, and sends a query instruction to a plurality of target query engines corresponding to the plurality of target databases through a first interface; the plurality of target query engines can receive query instructions from the second interfaces thereof, execute the query instructions to obtain query results, and send the query results to the first interface of the central node through the second interfaces thereof.

Description

[0001] This application is a divisional application of the application for Invention Patent Application No. 202111126949.2, filed on September 18, 2021, and entitled "Data Query Method, Device and Multi-party Secure Database". TECHNICAL FIELD

[0002] One or more embodiments of the present specification relate to the field of computers, and in particular to a data query method, device and multi-party secure database. BACKGROUND

[0003] In some business scenarios, there is a need to jointly build a database using data of multiple institutions. The data of each institution may include or belong to private data. To solve the data security and privacy protection problems of the database built based on the data of multiple institutions, the concept of multi-party secure database is proposed. A multi-party secure database generally includes multiple databases and a central node for providing data query services to users. The data of different institutions is stored in different databases, and the data in different databases is not visible to each other, i.e., one database cannot directly access the data in another database.

[0004] It is desirable to have a new technical solution to make the multi-party secure database have better scalability. SUMMARY

[0005] One or more embodiments of the present specification provide a data query method, device and multi-party secure database, which can improve the scalability of the multi-party secure database.

[0006] In a first aspect, a multi-party secure database is provided, including a central node and a plurality of databases. The central node has a first interface that is public, and the plurality of query engines corresponding to the plurality of databases each include a second interface that interacts with the first interface. The central node can determine a plurality of target databases involved in a query request from the plurality of databases according to the query request, and send a query indication to a plurality of target query engines corresponding to the plurality of target databases through the first interface. The plurality of target query engines can receive the query indication from the second interface and execute the query indication to obtain a query result, and send the query result to the first interface of the central node through the second interface.

[0007] In one possible implementation, the plurality of databases belong to a plurality of groups; and the databases belonging to the same group have the same privacy algorithm.

[0008] In one possible implementation, the databases belonging to the same group are provided by the same service provider.

[0009] In a possible implementation, the center node stores metadata indicating groups to which the plurality of databases respectively belong, and indicating data information stored by the plurality of databases.

[0010] In a possible implementation, the center node can receive a registration request from a current database, the registration request at least indicating a group to which the current database belongs, the registration request being sent by the current database through a second interface of the current database; and the center node updates the metadata according to the registration request.

[0011] In a possible implementation, the query request includes a query statement and a first group identifier of a first group; the center node can determine a plurality of databases belonging to the first group according to the first group identifier, and determine a plurality of target databases from the plurality of databases according to the query statement.

[0012] In a possible implementation, the first interface sends the query indication to the second interface of the target query engine through a remote procedure call; and the second interface sends the query result to the first interface of the center node through a remote procedure call.

[0013] In a possible implementation, the plurality of target databases have privacy algorithms including a plurality of operation modes allowed by the plurality of target databases respectively correspond to a plurality of Multi-Party Computation (MPC) methods; and the query request involves at least one of the plurality of operation modes.

[0014] In a second aspect, a data query method for a plurality of secure databases is provided, the plurality of secure databases including a center node and a plurality of databases, the center node having a public first interface, and a plurality of query engines corresponding to the plurality of databases each including a second interface for interacting with the first interface. The method includes: the center node determining a plurality of target databases involved by a query request from the plurality of databases according to the query request; the center node sending a query indication to a plurality of target query engines corresponding to the plurality of target databases through the first interface of the center node; the plurality of target query engines receiving the query indication through the second interface of the plurality of target query engines, and executing the query indication to obtain a query result; and the plurality of target query engines sending the query result to the first interface of the center node through the second interface of the plurality of target query engines.

[0015] In a possible implementation, the plurality of databases belong to a plurality of groups; and databases belonging to a same group have a same privacy algorithm.

[0016] In a possible implementation, databases belonging to a same group are provided by a same service provider.

[0017] In a possible implementation, the center node stores metadata indicating groups to which the plurality of databases respectively belong, and indicating data information stored in the plurality of databases.

[0018] In a possible implementation, the method further includes: receiving, by the center node, a registration request from a current database, the registration request at least indicating a group to which the current database belongs, the registration request being sent by the current database through the second interface; and updating, by the center node, the metadata according to the registration request.

[0019] In a possible implementation, the query request includes a query statement and a first group identifier of a first group. The center node determines, from the plurality of databases, a plurality of target databases involved in the query request according to the query request, specifically including: determining, by the center node, a plurality of databases belonging to the first group according to the first group identifier, and determining, from the plurality of databases, a plurality of target databases according to the query statement.

[0020] In a possible implementation, the first interface sends the query indication to the second interface of the target query engine through a remote procedure call; and the second interface sends the query result to the first interface of the center node through a remote procedure call.

[0021] In a possible implementation, the plurality of target databases have privacy algorithms including a plurality of operation modes allowed by the plurality of target databases, and each of the plurality of operation modes corresponds to a secure multi-party computation (MPC) method; and the query request involves at least one of the plurality of operation modes.

[0022] In a third aspect, a data query method for a multi-party secure database is provided. The multi-party secure database includes a center node and a plurality of databases. The center node has a public first interface. A plurality of query engines corresponding to the plurality of databases each include a second interface that interacts with the first interface. The method is applied to the center node. The method includes: determining, from the plurality of databases, a plurality of target databases involved in a query request according to the query request; sending, by the first interface, a query indication to a plurality of target query engines corresponding to the plurality of target databases, so that the plurality of target query engines execute the query indication to obtain a query result; and receiving, by the first interface, the query result sent by the plurality of target query engines through the second interfaces.

[0023] In a possible implementation, the query request includes a query statement and a first group identifier of a first group. The task processing unit is specifically configured to determine a plurality of databases belonging to the first group according to the first group identifier, and determine a plurality of target databases from the plurality of databases according to the query statement.

[0024] In a possible implementation, the method further includes: receiving a registration request from a current database, the registration request at least indicating a group to which the current database belongs, the registration request being sent by the current database through the second interface; and updating the metadata stored in the center node according to the registration request.

[0025] In a fourth aspect, a data query apparatus for a multi-party secure database is provided. The multi-party secure database includes a center node and a plurality of databases. The center node has a first interface that is public. The plurality of databases correspond to a plurality of query engines, and each of the plurality of query engines includes a second interface that interacts with the first interface. The apparatus is applied to the center node. The apparatus further includes a task processing unit configured to determine, according to a query request, a plurality of target databases from the plurality of databases involved in the query request; the first interface configured to send a query instruction to a plurality of target query engines corresponding to the plurality of target databases, so that the plurality of target query engines execute the query instruction to obtain a query result; and receive the query result sent by the plurality of target query engines through the second interface.

[0026] In a possible implementation, the query request includes a query statement and a first group identifier of a first group. The task processing unit is specifically configured to determine a plurality of databases belonging to the first group according to the first group identifier, and determine a plurality of target databases from the plurality of databases according to the query statement.

[0027] In a possible implementation, the first interface is further configured to receive a registration request from a current database, the registration request at least indicating a group to which the current database belongs, the registration request being sent by the current database through the second interface. The task processing unit is further configured to update the metadata stored in the center node according to the registration request.

[0028] In a fifth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. When the computer program is executed in a computing device, the computing device executes the method in any one of the third aspect.

[0029] In a sixth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method of any one of the third aspect.

[0030] By the method and the device provided in one or more embodiments of the present specification, by taking the first interface in the center node for interacting with the database as a public protocol layer and publicly exposing, each service provider can provide a database using a certain privacy algorithm according to its own business needs. For a single database, its service provider only needs to ensure that the second interface for interacting with the first interface has been configured in the query engine corresponding to the database, and the database can join the multi-party secure database to which the center node belongs and communicate with the center node, so that the database receives the query indication corresponding to the query request involving the database from the center node, and after using the privacy algorithm adopted by the database to jointly execute the query indication with other databases in the multi-party secure database to obtain the query result, returns the query result to the center node. In other words, the multi-party secure database does not require that the center node and the plurality of databases must be provided by a single service provider, and does not require that all databases in the multi-party secure database must use the same privacy algorithm, and does not need to completely expose the software code actually used by the center node and each database, which is beneficial to expand the existing multi-party secure database, that is, the multi-party secure database has better scalability. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present specification, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0032] Figure 1 The architecture diagram of the multi-party secure database exemplarily provided in the embodiments of the present specification;

[0033] Figure 2 The schematic diagram of adding a database in the multi-party secure database in the embodiments of the present specification;

[0034] Figure 3 The schematic diagram of a data query method for the multi-party secure database provided in the embodiments of the present specification;

[0035] Figure 4 The schematic diagram of a data query device for the multi-party secure database provided in the embodiments of the present specification. DETAILED DESCRIPTION

[0036] The various non-limiting embodiments provided in this specification will now be described in detail with reference to the accompanying drawings.

[0037] When a central node of a multi-party secure database receives a data query request from a user, and this request involves multiple data points stored in multiple databases, each database involved in the query can perform corresponding secure multi-party computations on those data points to obtain the query results, which are then returned to the user through the central node. It is important to note that because the multi-party secure database provides data query services to users through the central node, and requires secure multi-party computations from the multiple databases involved in the query request to obtain the corresponding query results, it can also be said that the multi-party secure database logically constitutes a new type of virtual database.

[0038] If a multi-party secure database has good scalability, its application scope will be greatly enhanced.

[0039] This specification provides at least one multi-party secure database and a data query method and apparatus for the multi-party secure database, which has better scalability.

[0040] Figure 1 This is an example architecture diagram of a multi-party security database provided in the embodiments of this specification. Figure 1 As shown, the multi-party secure database includes a central node 10 and multiple databases. The central node 10 has a public first interface (i.e., interface P1) that supports interaction between the central node 10 and the multiple databases. Each of the multiple query engines corresponding to the multiple databases includes a second interface (i.e., interface P2) for interacting with interface P1; for example, the multiple databases include database A1, database A2, database A3, database B1, and database B2, and the query engines Q1-Q5 corresponding to the multiple databases in the aforementioned example all include interface P2.

[0041] By exposing the interface P1 in the center node 10 for interacting with the database as a public protocol layer, each service provider can provide a database with a certain privacy algorithm according to its own business needs. For a single database, its service provider only needs to ensure that the interface P2 for interacting with the interface P1 has been configured in the query engine corresponding to the database, and the database can join the multi-party secure database to which the center node 10 belongs and communicate with the center node 10, so that the database receives the query indication corresponding to the query request of the database from the center node 10, and after jointly executing the query indication with other databases in the multi-party secure database using the privacy algorithm it adopts to obtain the query result, returns the corresponding query result to the center node 10. In other words, the multi-party secure database does not require that the center node and the plurality of databases must be provided by a single service provider, does not require that all databases in the multi-party secure database must adopt the same privacy algorithm, and does not need to completely expose the software code actually used by the center node and each database, which is beneficial to the expansion of the multi-party secure database, i.e., the multi-party secure database has better scalability.

[0042] In a more specific example, the interface P1 can specifically communicate with the query engine corresponding to the database through a remote procedure call, for example, the interface P1 can send a query indication to the interface P2 of the target query engine through a remote procedure call. Similarly, the interface P2 can communicate with the center node 10 through a remote procedure call, for example, the interface P2 can send a query result to the interface P2 of the center node through a remote procedure call. More specifically, the remote procedure call relies on the session established between the center node 10 and the query engine, and the service provider of the database can deploy the interface P2 containing the interface functions message start session for establishing a session, message run session dag for activating a session, and message end session for ending a session, etc. in the query engine corresponding to the database based on the exposed interface P1, so that the interface P1 calls the interface functions in the interface P2 according to the actual business needs of the center node 10, and the interface P2 calls back the interface P1 according to the business needs of the query engine it belongs to.

[0043] In a more specific example, different databases can have different privacy algorithms, and databases with the same privacy algorithm can be divided into the same group. For example, database Al, database A2, and database A3 of the foregoing example have the same privacy algorithm, and they can be divided into the same group A; database Bl and database B2 of the foregoing example have the same privacy algorithm, and they can be divided into the same group B. The privacy algorithm possessed by a single database can specifically include the MPC method corresponding to each operation mode allowed by the database, and the operation mode can include but is not limited to one or more of the following various operation modes: join operation, comparison operation, IN operation, and aggregation operation; the join operation is, for example, “inner join” or “cross join”, the comparison operation is, for example, “<”, “<=”, “=”, “!=”, “>=” or “>”, and the aggregation operation is, for example, “MIN”, “MAX”, “SUM” or “AVG”, and the like.

[0044] For any two databases belonging to different groups, the same operation mode can correspond to different MPC methods in the privacy algorithms possessed by the two databases respectively. For example, the operation modes allowed by the databases in group A and group B both include IN operation, when a plurality of target databases in group A or a plurality of target databases in group B execute the query indication received by each of the plurality of target databases, the query plan actually required to be jointly executed by the plurality of target databases can include a logical operation belonging to IN operation, and the plurality of target databases need to use private set intersection (PSI) technology to complete the logical operation; however, the databases in group A and group B can use different PSI, specifically, the databases in group A can use PSI based on naive hash, and the databases in group B can use PSI based on DH on finite field, PSI based on DH on elliptic curve, or other forms of PSI.

[0045] All databases in a single group can be provided by the same service provider, so as to ensure that the databases in the single group adopt the same privacy algorithm. Correspondingly, in order to distinguish different groups, the group identifier of the single group can specifically include the identifier of the service provider providing the databases in the group, for example, the name of the service provider. In addition, a single service provider can provide multiple databases adopting different privacy algorithms, for example, the databases in group A and group B can have the same service provider, but the databases in group A and the databases in group B adopt different privacy algorithms; assuming that the databases adopting the same privacy algorithm correspond to the same version number, and the databases adopting different privacy algorithms correspond to different version numbers, the group identifier of the single group can further include the version number corresponding to the databases in the group in addition to the identifier of the corresponding service provider.

[0046] The center node 10 can specifically process the query request from the data requester to obtain a query plan, and send a query instruction obtained based on the query plan to the plurality of target databases involved in the query request through the interface PI. More specifically, the center node 10 can obtain a query plan corresponding to a query statement in the query request by parsing the query request, the query plan can include a plurality of logical operations to be executed and an execution order corresponding to the plurality of logical operations. The query statement can be implemented in structured query language (SQL), and can also be implemented in other language formats supported by the multi-party secure database.

[0047] In a possible implementation, the center node 10 stores metadata of the multi-party secure database, which at least indicates the groups to which the plurality of databases in the multi-party secure database belong respectively and the data information stored in the plurality of databases. The data information, for example, the table names of a plurality of database tables respectively stored in the plurality of databases, the content information of each database table and the security information of each database table, and the like; wherein the content information of a single database table is, for example, the field names of a plurality of fields included in the database table respectively, and the security information of a single database table is, for example, the operation modes allowed by a plurality of fields included in the database table respectively. Correspondingly, when the center node 10 receives a query request from a data requester, it can determine the plurality of target databases involved in the query request from the plurality of groups according to the metadata stored therein.

[0048] In a more specific example, the query request can include a group identification of the group it involves, and the center node 10 can determine the databases belonging to the group involved by the query request according to the group identification, for example, determine the databases belonging to the group involved by the query request according to the metadata stored therein and the group identification; and then determine the target databases from the databases according to the query statement, for example, determine the target databases from the databases according to the metadata stored therein and the query statement. For example, it is assumed that the database Al stores data tables with table names ant1 and ant2, the database A2 stores data tables with table names isv1 and isv2, the database A3 stores a data table with table name special_item_list1, the database Bl stores a data table with table name L1, and the database B2 stores a data table with table name L2; and the metadata stored in the center node 10 can be, for example, the mapping relationship shown in Table 1 below.

[0049]

[0050]

[0051] Table 1

[0052] It is assumed that the query request specifically includes the query statement of the example below:

[0053]

[0054] For the query statement of the foregoing example, the center node 10 can perform syntax analysis on the query statement to obtain the table names ant1, isv1 and special_item_list from the query statement, and then determine the databases Al, A2 and A3 belonging to the group A based on the mapping relationship of the foregoing Table 1 example and the group identification "A" in the query request, and further determine the databases Al, A2 and A3 as the target databases involved by the query request based on the foregoing table names obtained thereby. In addition, it should be particularly noted that the table names of the respective data tables in the foregoing Table 1 example are all different, but the data of different institutions are stored in different databases, and there can be data tables with the same table name but different data content in different databases, for example, the database Bl can also contain a data table with table name ant1, but the data table can have completely different data content from the data table with table name ant1 stored in the database Al.

[0055] In another more specific example, the metadata stored by the center node 10 can also define a mapping table name of a data table in the query statement, i.e., the aforementioned data information can also include the mapping table name of the data table in the query statement; in this way, the group identifier of the group involved in the query request does not need to be included in the query request, but the center node 10 can directly determine the target databases in the group involved in the query request from the plurality of groups according to the query statement and the metadata stored by the center node 10. For example, for the table names ant1, isv1, and special_item_list, the mapping table names L3, L4, and L5 corresponding thereto can be defined based on the aforementioned table 1, and the center node 10 can publicly disclose the mapping table names and does not disclose the table names of the data tables stored in the respective databases; therefore, the mapping table names L3, L4, and L5 are included in the query statement instead of the table names ant1, isv1, and special_item_list; and the center node 10 can determine the databases A1, A2, and A3 storing the data tables with the table names ant1, isv1, and special_item_list as the target databases based on the mapping relationship between L3 and ant1, the mapping relationship between L4 and isv1, and the mapping relationship between L5 and special_item_list defined in the metadata.

[0056] For the metadata stored in the center node 10, when a new database requests to join the multi-party secure database, or when a new data table is added to or a data table is deleted from a database in the multi-party secure database, the center node 10 can update the metadata. In a more specific example, when a new database C1 requests to join the multi-party secure database, the center node 10 can receive a registration request from the database C1, the registration request at least indicating the group to which the database C1 belongs, e.g., the registration request including the group identifier of the group to which the database C1 belongs or indicating the privacy algorithm possessed by the database C1; wherein the query engine corresponding to the database C1 has deployed the interface P2 corresponding to the interface P1 disclosed by the center node 10, and the registration request is sent by the database C1 through the interface P2 in the corresponding query engine. Correspondingly, the center node 10 can update the metadata stored by the center node 10 according to the registration request from the database C1, e.g., adding a mapping relationship between the identifier of the database C1 and the group identifier of the group to which the database C1 belongs in the metadata.

[0057] Before the service provider joins the multi-party secure database with the database provided by the service provider, the service provider can also pre-register the corresponding group to the center node 10. For example, please refer to Figure 2, the service provider of the center node 10 is service provider M1, service provider M2 expects to add the aforementioned database C1 which employs a certain privacy algorithm in the multi-party secure database, and service provider M2 has not added other databases which employ the certain privacy algorithm to the multi-party secure database before providing the database C1; then service provider M2 can implement the registration of the group to which the database C1 belongs to the center node 10 through any possible implementation manner, such as through negotiation with service provider M1 and configuration of the center node 10 by service provider M1, or calling other interfaces exposed by the center node 10 by service provider M2, for example, registering the group identifier of the group to which the database C1 belongs or the privacy algorithm employed by the database C1 to the center node 10. Correspondingly, when the center node 10 receives the registration request from the database C1, the center node 10 can only update the metadata stored by the center node 10 according to the registration request from the database C1 when it is determined that the group to which the database C1 belongs has been registered in the center node 10 based on the registration request, so as to complete the addition of the database C1 in the multi-party secure database.

[0058] For the aforementioned query indication, which is obtained based on the query plan corresponding to the query request, it is an indicative message for instructing the joint execution of the query plan by the plurality of target databases. More specifically, the query indication can be a single message containing the query plan and sent to the plurality of target databases; or the query indication can be a plurality of messages corresponding to the plurality of target databases and different from each other, which are obtained by task decomposition of the query plan based on a predetermined rule, and sent to the plurality of target databases correspondingly.

[0059] For the aforementioned query result, depending on the process of executing the query indication by the plurality of target query engines, i.e., the process of jointly executing the query plan by the plurality of target query engines, the query result can be specifically obtained by one of the plurality of target query engines, wherein the target query engine obtaining the query result can send the query result to the center node 10 through the interface P2 configured by the target query engine, so that the center node 10 returns the query result to the data requester sending the query request. Or, different query results can be obtained by the plurality of target query engines respectively, the plurality of target query engines send the query results to the center node 10 through the interfaces P2 respectively, the center node 10 merges the query results from the plurality of target query engines, and returns the merged query result to the data requester sending the query request.

[0060] It should be particularly noted that, in the foregoing Figure 1 The multi-party secure database provided in the embodiments of the present specification is described exemplarily, however, it should be understood that Figure 1The multi-party secure database of the example is only used to assist in describing the technical solutions provided in the embodiments of the present specification, and the multi-party secure database in the actual business scenario can obviously include more or fewer groups, and each group can include more or fewer databases.

[0061] Based on the same concept as the foregoing method embodiments, the present specification also provides a data query method for a multi-party secure database, the multi-party secure database including a center node and a plurality of databases, the center node having a public interface P1, and the plurality of databases corresponding to a plurality of query engines each including an interface P2 for interacting with the interface P1. As shown in Figure 3 The method can include some or all of the following steps 301-307, for example, for the data query method performed by the center node, the following steps 301, 203 and 307 can be included in each of the following steps.

[0062] First, in step 301, the center node 10 determines a plurality of target databases involved in the query request from the plurality of databases according to the query request. In Figure 3 The plurality of target databases are exemplified as database A1, database A2 and database A3 belonging to group A.

[0063] Next, in step 303, the center node 10 sends a query instruction to the plurality of target query engines corresponding to the plurality of target databases through its interface P1.

[0064] Next, in step 305, the plurality of target query engines receive the query instruction through their interface P2 and execute the query instruction to obtain the query result.

[0065] Finally, in step 307, the center node 10 receives the query result from the plurality of target query engines through its interface P1. The query result is sent by the plurality of target query engines through their interface P2.

[0066] Based on the same concept as the foregoing embodiments, the present specification also provides a data query device for a multi-party secure database, the multi-party secure database including a center node 10 and a plurality of databases, the center node 10 having a public first interface 401, and the plurality of databases corresponding to a plurality of query engines each including a second interface for interacting with the first interface 401, the device being deployed in the center node 10. As shown in Figure 4As shown, the apparatus further comprises a task processing unit 403 configured to determine, from the plurality of databases, a plurality of target databases involved in the query request according to the query request; the first interface 401 is configured to send a query instruction to a plurality of target query engines corresponding to the plurality of target databases, so that the plurality of target query engines receive the query instruction through the second interface and execute the query instruction to obtain a query result; and configured to receive the query result sent by the plurality of target query engines through the second interface.

[0067] In a possible implementation, the query request comprises a query statement and a first group identifier of a first group. The task processing unit 403 is specifically configured to determine a plurality of databases belonging to the first group according to the first group identifier, and determine a plurality of target databases from the plurality of databases according to the query statement.

[0068] In a possible implementation, the first interface 401 is further configured to receive a registration request from a current database, the registration request at least indicating a group to which the current database belongs, and the registration request is sent by the current database through the second interface. The task processing unit 403 is further configured to update the metadata stored in the center node according to the registration request.

[0069] Those skilled in the art should be aware that, in one or more examples described above, the functions described in the specification can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the computer program corresponding to the functions can be stored in a computer readable medium or transmitted as one or more instructions / code on a computer readable medium, so that the computer program corresponding to the functions is executed by a computer to implement the method described in any one of the embodiments of the specification.

[0070] The embodiments of the specification further provide a computer readable storage medium having a computer program / instruction stored thereon, when the computer program / instruction is executed in a computing device, the computing device executes the method performed by the center node 10 in any one of the embodiments of the specification.

[0071] The embodiments of the specification further provide a computing device comprising a memory and a processor, the memory having a computer program / instruction stored therein, and the processor executes the computer program / instruction to implement the method performed by the center node 10 in any one of the embodiments of the specification.

[0072] The various embodiments in this specification are described in a progressive manner. Similar or identical parts in each embodiment can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. Therefore, some embodiments may be described relatively simply; relevant parts can be referred to in the descriptions of other embodiments.

[0073] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0074] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multi-party secure database, comprising a center node and a plurality of databases, the plurality of databases belonging to a plurality of groups, the plurality of groups comprising a first group and a second group, databases belonging to the first group and databases belonging to the second group having different privacy algorithms; the center node having a first interface as a public protocol layer and being publicly exposed, and the plurality of databases corresponding to a plurality of query engines each comprising a second interface for interacting with the first interface; wherein, the center node is capable of determining a plurality of target databases involved in a query request from the plurality of databases according to the query request, the plurality of target databases belonging to the same group; and sending a query instruction to a plurality of target query engines corresponding to the plurality of target databases through the first interface thereof; the plurality of target query engines are capable of receiving the query instruction from the second interface and executing the query instruction to obtain a query result; and sending the query result to the first interface of the center node through the second interface thereof.

2. The multi-party secure database of claim 1, wherein, The databases belonging to the same group are provided by the same service provider.

3. The multi-party secure database of claim 1, wherein, The center node stores metadata for indicating the groups to which the plurality of databases respectively belong, and for indicating data information stored in the plurality of databases.

4. The multi-party secure database of claim 3, wherein, The center node is capable of receiving a registration request from a current database, the registration request at least indicating a group to which the current database belongs, the registration request being sent by the current database through the second interface thereof; and the center node updates the metadata according to the registration request.

5. The multi-party secure database of claim 1, wherein, The query request comprises a query statement and a first group identifier of the first group; the center node is capable of determining a plurality of databases belonging to the first group according to the first group identifier, and determining a plurality of target databases from the plurality of databases according to the query statement.

6. The multi-party secure database of any of claims 1-5, wherein, The first interface sends the query instruction to the second interface of the target query engine through a remote procedure call; The second interface sends the query result to the first interface of the center node through a remote procedure call.

7. The multi-party secure database of any of claims 1-5, wherein, The privacy algorithms of the plurality of target databases comprise secure multi-party computation (MPC) methods corresponding to a plurality of operation modes allowed thereby; the query request involves at least one of the plurality of operation modes. 8.A method for data query of a multi-party secure database, the multi-party secure database comprising a center node and a plurality of databases, the plurality of databases belonging to a plurality of groups, the plurality of groups comprising a first group and a second group, databases belonging to the first group and databases belonging to the second group having different privacy algorithms. The center node has a first interface as a public protocol layer and is publicly exposed, and the plurality of databases corresponding to a plurality of query engines each comprise a second interface for interacting with the first interface, comprising: the center node is capable of determining a plurality of target databases involved in a query request from the plurality of databases according to the query request, the plurality of target databases belonging to the same group; the center node sends a query instruction to a plurality of target query engines corresponding to the plurality of target databases through the first interface thereof; the plurality of target query engines receive the query instruction from the second interface and execute the query instruction to obtain a query result; the plurality of target query engines send the query result to the first interface of the center node through the second interface thereof.

9. The method of claim 8, wherein, The databases belonging to the same group are provided by the same service provider.

10. The method of claim 8, wherein, The center node stores metadata for indicating the groups to which the plurality of databases respectively belong, and for indicating data information stored in the plurality of databases.

11. The method of claim 10, further comprising: receiving, by the central node, a registration request from a current database, the registration request indicating at least a group to which the current database belongs, the registration request being sent by the current database via its second interface; updating, by the central node, the metadata according to the registration request.

12. The method of claim 8, wherein, the query request including a query statement and a first group identifier of a first group; and determining, by the central node, a plurality of target databases from the plurality of databases according to the query request, specifically including: determining, by the central node, a plurality of databases belonging to the first group according to the first group identifier, and determining a plurality of target databases from the plurality of databases according to the query statement.

13. The method of any one of claims 8-12, wherein, sending, by the first interface, the query indication to the second interface of the target query engine via a remote procedure call; and sending, by the second interface, the query result to the first interface of the central node via a remote procedure call.

14. The method of any one of claims 8-12, wherein, the plurality of target databases having a privacy algorithm including a plurality of operation modes allowed by the plurality of target databases, each of the plurality of operation modes corresponding to a secure multi-party computation (MPC) method; and the query request involving at least one of the plurality of operation modes.

15. A data query method for a plurality of secure databases, the plurality of secure databases including a central node and a plurality of databases, the plurality of databases belonging to a plurality of groups, the plurality of groups including a first group and a second group, databases belonging to the first group and databases belonging to the second group having different privacy algorithms; the central node having a first interface as a public protocol layer and being publicly exposed, and the plurality of query engines corresponding to the plurality of databases each including a second interface for interacting with the first interface, the method being applied to the central node and comprising: determining, according to a query request, a plurality of target databases from the plurality of databases, the plurality of target databases belonging to the same group; sending, by the first interface, a query indication to a plurality of target query engines corresponding to the plurality of target databases, so that the plurality of target query engines execute the query indication to obtain a query result; receiving, by the first interface, the query result sent by the plurality of target query engines via their second interfaces.

16. The method of claim 15, wherein, the query request including a query statement and a first group identifier of a first group; and the determining, according to the query request, a plurality of target databases from the plurality of databases, specifically including: determining a plurality of databases belonging to the first group according to the first group identifier, and determining a plurality of target databases from the plurality of databases according to the query statement.

17. The method of claim 15, further comprising: receiving, by the central node, a registration request from a current database, the registration request indicating at least a group to which the current database belongs, the registration request being sent by the current database via its second interface; updating, by the central node, the metadata according to the registration request.

18. A data query apparatus for a multi-party secure database, the multi-party secure database comprising a center node and a plurality of databases, the plurality of databases belonging to a plurality of groups, the plurality of groups comprising a first group and a second group, databases belonging to the first group and databases belonging to the second group having different privacy algorithms; the center node having a first interface as a public protocol layer and being publicly exposed, the plurality of databases each corresponding to a query engine comprising a second interface for interacting with the first interface, the apparatus being applied to the center node, the apparatus further comprising: a task processing unit configured to determine, according to a query request, a plurality of target databases from the plurality of databases, the plurality of target databases belonging to a same group; the first interface configured to send a query instruction to a plurality of target query engines corresponding to the plurality of target databases, so that the plurality of target query engines execute the query instruction to obtain a query result; and receive the query result sent by the plurality of target query engines through the second interface.

19. The apparatus of claim 18, wherein, the query request comprising a query statement and a first group identifier of the first group; and the task processing unit is specifically configured to determine a plurality of databases belonging to the first group according to the first group identifier, and determine the plurality of target databases from the plurality of databases according to the query statement.

20. The apparatus of claim 18, wherein the first interface is further configured to receive a registration request from a current database, the registration request at least indicating a group to which the current database belongs, the registration request being sent by the current database through the second interface; and the task processing unit is further configured to update metadata stored in the center node according to the registration request.

21. A computer readable storage medium having stored thereon a computer program, when the computer program is executed in a computing device, the computing device executes the method of any one of claims 15-17.

22. A computing device comprising a memory and a processor, the memory having stored therein a computer program, the processor, when executing the computer program, implements the method of any one of claims 15-17.

Images