Encrypted data query method, server, storage medium and program product

Abstract

The embodiment of the invention provides an encrypted data query method, a server, a storage medium and a program product. In the encrypted data query method, at least one piece of to-be-matched original data corresponds to ciphertext data obtained after word-by-word encryption, and the word-by-word encryption enables the ciphertext data to retain structural features among characters in the original data, so that the ciphertext data has the characteristics of being retrievable and matchable. According to the embodiment of the invention, after the target query keyword corresponding to the query request is obtained, the target query keyword can be encrypted word by word by adopting the encryption algorithm the same as the original data, so that the encrypted target query keyword can be matched with the ciphertext corresponding to the original data. On the basis of the implementation mode, the original data does not need to be encrypted after being subjected to word segmentation combination, so that the length expansion degree of the ciphertext data is reduced; besides, the encrypted word segmentation unit does not need to be stored by adopting an expansion column, so that the occupation of a storage space is reduced, and the cost of fuzzy query of the encrypted data is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a query method of encrypted data, a server, a storage medium and a program product. BACKGROUND

[0002] Fuzzy query is a database query technology, which allows the query to use incomplete accurate search conditions to find information. Compared with accurate query, fuzzy query can match data containing similar or partially consistent results, and is suitable for query scenarios where the exact search word is uncertain or a wider result set is desired. In some database application scenarios, such as the application scenario of digital certificate, sensitive information needs to be stored in encrypted form to ensure the security and confidentiality of the information. However, it is a difficult problem to perform fuzzy query on the encrypted information stored in encrypted form.

[0003] In some existing methods of performing fuzzy query on encrypted data, the original plaintext data can be segmented to obtain encrypted data of segmentation, and the encrypted data of segmentation is stored for matching based on the encrypted data of segmentation and the query keyword of encrypted data. However, the cost of this method is high. Therefore, a new solution is needed. SUMMARY

[0004] Aspects of the present application provide a query method of encrypted data, a server, a storage medium and a program product to reduce the cost of fuzzy query on encrypted data.

[0005] The query method of encrypted data provided by the embodiments of the present application comprises: in response to a query request, obtaining a target query keyword; obtaining first encrypted data corresponding to the target query keyword, the first encrypted data being obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm; matching the first encrypted data with at least one encrypted data to be matched to obtain target encrypted data matched with the first encrypted data; the at least one encrypted data to be matched being obtained by performing character-by-character encryption calculation on at least one original data using the preset target encryption algorithm; and taking the target encrypted data as a query result corresponding to the target query keyword.

[0006] Optionally, obtaining the first encrypted data corresponding to the target query keyword comprises: judging whether there is encrypted data matched with the target query keyword in the at least one encrypted data according to the query keywords corresponding to the at least one encrypted data respectively; if there is, taking the encrypted data matched with the target query keyword as the first encrypted data; and if there is not, performing character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm to obtain the first encrypted data.

[0007] Optionally, after the first ciphertext data is obtained by performing the character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm, the method further includes: saving a correspondence between the target query keyword and the first ciphertext data, so that when a new query request corresponding to the target query keyword is received, the first ciphertext data is obtained according to the correspondence.

[0008] Optionally, obtaining the first ciphertext data by performing the character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm includes: obtaining a first encryption key corresponding to the target query keyword; combining the target query keyword and the first encryption key to obtain first combination information; performing the character-by-character encryption calculation on the first combination information using the preset target encryption algorithm to obtain a first byte sequence; writing the first byte sequence into a specified position in a preset byte array to obtain a first byte array; and taking the first byte array as the first ciphertext data.

[0009] Optionally, when the character-by-character encryption calculation is performed on any of the at least one original data using the preset target encryption algorithm, the method further includes: obtaining a second encryption key corresponding to the original data; combining the original data and the second encryption key to obtain second combination information; performing the character-by-character encryption calculation on the second combination information using the preset target encryption algorithm to obtain a second byte sequence; writing the second byte sequence into a specified position in a preset byte array to obtain a second byte array corresponding to the original data; and taking the second byte array as second ciphertext data corresponding to the original data.

[0010] Optionally, matching the first ciphertext data with at least one ciphertext data to be matched to obtain target ciphertext data matched with the first ciphertext data includes: for the second ciphertext data in the at least one ciphertext data, traversing subarrays of a second byte array corresponding to the second ciphertext data, and determining whether a target subarray matched with the first byte array exists in the subarrays of the second byte array; and if the target subarray exists in the second byte array, taking the second ciphertext data as the target ciphertext data matched with the first ciphertext data.

[0011] Optionally, before the second byte sequence is written into a specified position in a preset byte array to obtain a second byte array corresponding to the original data, the method further includes: performing bit operation on the second byte sequence according to a preset bit operation strategy to encrypt the second byte sequence; and before the subarrays of the second byte array corresponding to the second ciphertext data are traversed, the method further includes: performing inverse operation corresponding to the bit operation on the second byte sequence in the second byte array.

[0012] This application embodiment also provides a method for querying encrypted data in a database, comprising: a database query engine responding to a query request and obtaining a target query keyword; obtaining first ciphertext data corresponding to the target query keyword, wherein the first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm; matching the first ciphertext data with at least one ciphertext data to be matched in the database to obtain target ciphertext data matching the first ciphertext data; wherein the at least one ciphertext data is obtained by the database storage engine performing character-by-character encryption calculation on at least one piece of original data using the preset target encryption algorithm; and using the target ciphertext data as the query result corresponding to the target query keyword.

[0013] This application also provides a server, including: a memory and a processor; the memory is used to store one or more computer instructions; the processor is used to execute the one or more computer instructions to perform the steps in the method provided in this application.

[0014] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the method provided in this application.

[0015] This application also provides a computer program product, including: a computer program / instructions, which, when executed by a processor, can implement the steps in the method provided in this application.

[0016] In the encrypted data query method provided in this application embodiment, each of the at least one original data to be matched corresponds to ciphertext data obtained by character-by-character encryption. This character-by-character encryption preserves the structural features between characters in the original data, making the ciphertext data searchable and matchable. After obtaining the target query keyword corresponding to the query request, the target query keyword can be encrypted character-by-character using the same encryption algorithm as the original data. This allows the encrypted target query keyword to be retrieved and matched against the ciphertext corresponding to the original data, satisfying fuzzy query requirements. Based on this implementation method, there is no need to encrypt the original data after word segmentation and combination, reducing the length expansion of the ciphertext data. In addition, there is no need to use "extended columns" to store the encrypted word segmentation units, reducing the storage space occupied and lowering the cost of fuzzy querying of encrypted data. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0018] Figure 1 A flowchart illustrating an exemplary embodiment of this application for querying encrypted data;

[0019] Figure 2 A schematic diagram of a first byte array provided for an exemplary embodiment of this application;

[0020] Figure 3 A schematic diagram illustrating fuzzy matching of a first byte array and a second byte array provided for an exemplary embodiment of this application;

[0021] Figure 4a A flowchart illustrating a method for querying encrypted data in a database, provided as an exemplary embodiment of this application;

[0022] Figure 4b A flowchart illustrating a method for querying encrypted data as provided in another exemplary embodiment of this application;

[0023] Figure 5 This is a schematic diagram of the structure of a server provided for an exemplary embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. “Multiple” generally includes at least two, but does not exclude the inclusion of at least one.

[0026] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0027] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes said element.

[0028] In some methods for fuzzy searching of encrypted data, the database can map the encrypted data to a plaintext mapping table, and then query the mapping table based on the plaintext query keywords to achieve fuzzy matching. However, this method requires storing the plaintext data in the database, thus reducing data security.

[0029] In some methods for fuzzy searching of encrypted data, the database query engine can first decrypt the encrypted data and then perform fuzzy matching based on the plaintext query keywords. In this method, the database query engine can add the entire encrypted data to memory for decryption, and then use a fuzzy search algorithm to perform fuzzy matching between the plaintext query keywords and the plaintext data. This method is suitable for scenarios with a small amount of encrypted data. When the amount of encrypted data is large, adding a large amount of encrypted data to memory for decryption will consume a lot of memory, thus increasing the cost of fuzzy searching of encrypted data.

[0030] In other methods for fuzzy searching of encrypted data, the plaintext query keywords can be encrypted using an encryption algorithm in the database, and fuzzy matching can be performed on the encrypted data based on the encrypted query keywords. However, on the one hand, the encrypted query keywords cannot be indexed, thus preventing the use of database indexes to optimize the query. On the other hand, it cannot be guaranteed that the encryption algorithm used by the database is consistent with the encryption algorithm corresponding to the encrypted data.

[0031] In some methods for fuzzy searching of encrypted data, the database can segment and combine the original plaintext data of certain fields into multiple units of fixed length. Then, an encryption algorithm is used to encrypt each of these units, resulting in encrypted units. For example, if the plaintext data is "abcdefgh", segmenting and combining it into groups of three characters yields units such as "abc", "bcd", "cde", "def", and so on. These encrypted units can be stored as new fields in an extended column. When searching based on keywords, the database query engine can use an encryption algorithm to encrypt the plaintext search keywords and match the encrypted units stored in the extended column based on the encrypted search keywords to achieve fuzzy searching. However, this method has several drawbacks. First, it requires segmenting and combining the original plaintext data, causing the encrypted ciphertext to expand several times in length. Second, adding extended columns requires adding extra fields to the data table, allocating space for each row. This incurs additional storage costs for storing the encrypted text units, thus increasing the cost of fuzzy matching. On the other hand, this method has certain limitations on the length of the query keywords. The length of the query keywords needs to match the length of the units obtained by segmenting and combining the ciphertext; otherwise, it will be impossible to match the encrypted units based on the ciphertext corresponding to the query keywords. Continuing with the plaintext data "abcdefgh," for example, when querying data containing the characters "bcd," the query keyword "bcd" can be encrypted, and the ciphertext corresponding to the query keyword "bcd" can be fuzzily matched with the encrypted units in the extended column. When querying data containing the characters "bcde," the ciphertext corresponding to the query keyword "bcde" cannot be fuzzily matched with the encrypted units in the extended column, thus no query result can be obtained.

[0032] To address the aforementioned technical problems, a solution is provided in some embodiments of this application. The technical solutions provided by each embodiment of this application are described in detail below with reference to the accompanying drawings.

[0033] Figure 1 This is a flowchart illustrating an exemplary embodiment of a method for querying encrypted data provided in this application. The method may include, for example: Figure 1 The steps shown are as follows:

[0034] Step 101: Respond to the query request and obtain the target query keywords.

[0035] Step 102: Obtain the first ciphertext data corresponding to the target query keyword. The first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm.

[0036] Step 103: Match the first ciphertext data with at least one ciphertext data to be matched to obtain target ciphertext data that matches the first ciphertext data; the at least one ciphertext data is obtained by performing word-by-word encryption calculation on at least one original data using the preset target encryption algorithm.

[0037] Step 104: Use the target encrypted data as the query result corresponding to the target query keyword.

[0038] This embodiment can be applied to a query system, which may include a query engine and a storage engine. The query engine is responsible for executing query requests, and the storage engine is used to store data and manage indexes, etc.

[0039] In step 101, the query request can be initiated by the query client corresponding to the query system based on the user's query operation, or it can be initiated by other applications or systems based on query needs. After obtaining the query request, the query engine can obtain the target query keywords based on the query request. Typically, the query request is expressed in a query statement, which the query engine can parse and obtain the query keywords based on the parsing results. In fuzzy query application scenarios, the target query keywords are usually part of the original data. For example, the target query keywords can be a specific prefix or suffix of the original data, or specific words or phrases in the text corresponding to the original data, etc.

[0040] In step 102, the query engine can obtain the first ciphertext data corresponding to the target query keyword. In this embodiment, the first ciphertext data is the ciphertext data obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm. The preset target encryption algorithm refers to an encryption algorithm that can encode input data into fixed-length binary data, such as including but not limited to Secure Hash Algorithm (SHA), Message-Digest Algorithm 5 (MD5), Base64 encoding, etc., which will be described in subsequent embodiments. Character-by-character encryption calculation refers to performing encryption calculation on each character in the encrypted data separately, and combining the encryption results of the characters according to the order of the characters in the data to obtain the corresponding ciphertext data.

[0041] Optionally, the first encrypted data can be stored in the form of a byte array, a string, a dictionary / hash table, or a queue; this embodiment does not impose any restrictions.

[0042] In this context, a byte array is a sequence of consecutive bytes, with each byte storing a portion of the target query keyword. Each plaintext character in the byte array occupies a fixed number of bytes. For example, a Chinese character in the target query keyword can be stored using four bytes of binary data, and a Chinese punctuation mark can be stored using one byte of binary data. The first encrypted data corresponding to the target query keyword obtained by the query engine can be the first byte array obtained by calculating each character of the target query keyword. The term "first" is used here to distinguish the byte array from subsequent byte arrays and does not limit its length or number. When the target query keyword includes multiple keywords, the first byte array can include the byte arrays corresponding to each of those keywords.

[0043] In this context, a string is an ordered sequence of zero or more characters, which can be letters, numbers, symbols, or spaces. When encrypting the target query keyword character by character, the keyword is converted into characters one by one, and the calculated characters are stored as a string, which serves as the ciphertext data corresponding to the keyword. A queue is used to store elements added to the queue sequentially based on a First-In-First-Out (FIFO) mechanism. When performing character-by-character encryption calculations on the ciphertext data, the continuously generated ciphertext data can be written sequentially into the queue for further processing.

[0044] Optionally, the query engine can store the encrypted data corresponding to the query keywords received in historical time periods. Based on this, when executing step 102, the query engine can determine whether there is encrypted data matching the target query keyword among the at least one stored encrypted data corresponding to each query keyword. If so, the encrypted data matching the target query keyword can be used as the first encrypted data corresponding to the target query keyword. If not, the query engine can use the preset target encryption algorithm to perform character-by-character encryption calculation on the target query keyword to obtain the first encrypted data. Based on this implementation, when the first encrypted data corresponding to the target query keyword is cached, the query engine can prioritize using the cached data to quickly obtain the first encrypted data, improving query speed and reducing the consumption of computing resources.

[0045] The following example illustrates the optional implementation methods for calculating the first ciphertext data, using the first byte array as an example of the first ciphertext data corresponding to the target query keyword.

[0046] In some exemplary embodiments, when the query engine performs character-by-character encryption calculations on the target query keywords, it can calculate the encryption value of each plaintext character in the order of the characters in the target query keywords. The encryption value of each plaintext character can be a binary number with a fixed byte length. Arranging the calculated encryption values ​​according to the order of the characters in the target query keywords yields the first byte sequence corresponding to the target query keywords. The query engine can write the first byte sequence to a specified position in a preset byte array to obtain the first byte array, and use the first byte array as the first ciphertext data corresponding to the target query keywords.

[0047] In other exemplary embodiments, when the query engine performs character-by-character encryption calculations on the target query keywords using a preset target encryption algorithm, it can use an encryption key to obfuscate the target query keywords, thereby increasing the difficulty of cracking the ciphertext data obtained after encryption calculation. The following will use a byte array as an example to illustrate an optional implementation method for obtaining the first ciphertext data corresponding to the target query keywords.

[0048] Optionally, the query engine can obtain a first encryption key corresponding to the target query keyword. This first encryption key can be obtained from a key management service or a key management object such as an encryption machine, and is used to enhance the security of the first encrypted data corresponding to the target query keyword. The query engine can combine the target query keyword and the first encryption key to obtain first combined information. Optionally, when combining the target query keyword and the first encryption key, the first encryption key can be appended before or after the target query keyword; this embodiment does not impose any limitations.

[0049] After obtaining the first set of information, the query engine can use the preset target encryption algorithm to perform character-by-character encryption calculations on the first set of information to obtain the first byte sequence. The first byte sequence contains the byte representation of each character in the first set of information, and the order of the byte representation of each character in the first byte sequence corresponds to the order of the character / byte in the first set of information. The query engine can write the first byte sequence into a specified position in a preset byte array to obtain the first byte array, and use the first byte array as the first ciphertext data corresponding to the target query keyword.

[0050] Among them, a pre-defined byte array is a data storage structure with a fixed length used to store binary data. For example... Figure 2As shown, the preset byte array can include a specified number of bytes. The first byte sequence can be written into the preset byte array starting from a preset write start position, thus obtaining the first byte array. In the preset byte array, the bytes not written into the first byte sequence can be padded with randomly generated binary numbers to obtain a first byte array of fixed length. Based on the first byte array, on the one hand, encryption of the target query keywords can be achieved without compromising data integrity, ensuring the security of the query operation; on the other hand, the sequential and structural features between different words / characters in the target query keywords can be preserved in the ciphertext data, thus facilitating fuzzy queries through byte matching in the ciphertext state.

[0051] In this implementation, by combining the key with the target query keyword, the byte sequence corresponding to each target query keyword is unique. Even if an attacker obtains the original text corresponding to the target query keyword, they cannot generate a completely identical byte sequence, thus effectively preventing the byte sequence corresponding to the target query keyword from being forged.

[0052] Optionally, the preset target encryption algorithm used by the query engine can be a secure hash algorithm. That is, the query engine can use a secure hash algorithm to perform character-by-character hash calculations on the first combination of information consisting of the target query keyword and the first encryption key, obtaining the hash value of each character in the first combination. During the secure hash calculation, a plaintext character in the first combination can be converted into a four-byte hash value, and a punctuation mark can be converted into a one-byte hash value. The hash values ​​of multiple characters in the first combination are arranged sequentially to obtain the first byte sequence. The secure hash algorithm can be a fixed-length secure hash algorithm, such as SHA-256 or SHA-512, depending on the length of the data to be encrypted; this embodiment does not impose any limitations.

[0053] Optionally, after the query engine performs character-by-character encryption calculations on the target query keywords using a preset target encryption algorithm to obtain the first ciphertext data, it can save the correspondence between the target query keywords and the first ciphertext data. This allows the engine to retrieve the first ciphertext data based on this correspondence when a new query request corresponding to the target query keywords is received. This implementation facilitates the reuse of the calculated ciphertext data, thereby improving query efficiency while reducing the consumption of computing resources.

[0054] After obtaining the first ciphertext data based on the above embodiments, step 103 can be used to match the first ciphertext data with at least one ciphertext data to be matched. The method for matching the first ciphertext data with any ciphertext data to be matched can be a fuzzy matching method. Fuzzy matching is a method that allows for a certain degree of error and is used to calculate the probability that the first ciphertext data belongs to the ciphertext data to be matched.

[0055] Specifically, the at least one encrypted data is obtained by performing word-by-word encryption calculations on at least one original data using the preset target encryption algorithm. In different application scenarios, the original data can be implemented as different types of data, such as order data and recipient information data in e-commerce scenarios, or sensitive data such as bank card numbers and credit card verification codes in the financial field, and so on.

[0056] In this embodiment, the original data and the target query keywords use the same encryption algorithm. It should be understood that the encrypted value obtained by encrypting the same characters using the same encryption algorithm is the same, while the encrypted values ​​obtained by encrypting different characters using the same encryption algorithm are different. Therefore, using the same encryption algorithm for the original data and the target query keywords ensures that the ciphertext data corresponding to the original data and the ciphertext data corresponding to the target query keywords are searchable and comparable, thereby ensuring fuzzy matching is possible.

[0057] The following will use any original data as an example to illustrate the encryption calculation method for the original data.

[0058] Optionally, when the storage engine obtains the at least one piece of original data, it may use the preset target encryption algorithm to perform word-by-word encryption calculations on the at least one piece of original data.

[0059] In some exemplary embodiments, when the storage engine performs character-by-character encryption calculations on any piece of raw data in at least one set of raw data using a preset target encryption algorithm, it can sequentially calculate the encryption value of each plaintext character according to the order of the characters in the raw data. The encryption value of each plaintext character can be a binary number with a fixed byte length. Arranging the sequentially calculated encryption values ​​according to the order of the characters in the target query keywords yields the second byte sequence corresponding to the raw data. The query engine can write the second byte sequence to a specified position in a preset byte array to obtain the second byte array, and use the second byte array as the second ciphertext data corresponding to the raw data.

[0060] In other exemplary embodiments, when the storage engine performs word-by-word encryption calculations on any of the original data in at least one set of original data using a preset target encryption algorithm, it can use an encryption key to obfuscate the original data, thereby increasing the difficulty of cracking the ciphertext data obtained after the encryption calculation. Optionally, the storage engine can obtain a second encryption key corresponding to the original data. The second encryption key can be obtained from a key management service or a key management object such as an encryption machine, and is used to enhance the security of the ciphertext data corresponding to the original data. The storage engine can combine the original data and the second encryption key to obtain second combined information. Optionally, when combining the original data and the second encryption key, the second encryption key can be appended to the beginning of the original data, or it can be appended to the end of the original data; this embodiment does not impose any limitations.

[0061] After obtaining the second combination of information, the query engine can use a preset target encryption algorithm to perform character-by-character encryption calculations on the second combination of information, obtaining a second byte sequence. The second byte sequence contains the byte representation of each character in the second combination of information, and the order of the byte representation of each character in the second byte sequence corresponds to the order of that character / byte in the second combination of information. The storage engine can write the second byte sequence into a specified position in a preset byte array to obtain a second byte array, and use the second byte array as the second ciphertext data corresponding to the original data. Based on the second byte array, on the one hand, encryption of the original data can be achieved without compromising data integrity, ensuring data security; on the other hand, the sequential and structural features between different characters in the original data can be preserved in the ciphertext data, thus facilitating fuzzy queries through byte matching in the ciphertext state.

[0062] Optionally, the storage engine may use a preset target encryption algorithm, such as a secure hash algorithm, to encrypt the original data. Specifically, the storage engine may employ a secure hash algorithm to perform word-by-word hash calculations on the original data and the second encryption key, obtaining the hash value of each word in the second combination of information. During secure hash calculation, a plaintext word in the second combination of information can be converted into a four-byte hash value, and a punctuation mark can be converted into a one-byte hash value. The hash values ​​of multiple words in the second combination of information are arranged sequentially to obtain the first byte sequence. The secure hash algorithm can be a fixed-length secure hash algorithm, such as SHA-256 or SHA-512. When the length of the original data is too short to generate a fixed-length hash array, byte padding can be performed in the byte sequence after the original data has been converted.

[0063] In this implementation, by combining the key with the original data, the byte sequence corresponding to each piece of original data is unique, thereby effectively resisting dictionary attacks that use a pre-calculated hash table to quickly look up the original data.

[0064] Optionally, the second byte sequence is written to a specified position in a preset byte array. Before obtaining the second byte array, the storage engine can perform bitwise operations on the second byte sequence according to a preset bitwise operation strategy. Bitwise operations refer to operations on the bits of a binary number, including but not limited to: bitwise XOR (^), bitwise NOT (~), left shift (<<), and right shift (>>). Bitwise XOR (^) and bitwise NOT (~) operations can be used to change the value of the binary number in the second byte sequence, while left shift (<<) and right shift (>>) operations can be used to transform the positional distribution of hash values ​​in the second byte sequence, thereby increasing the difficulty of decrypting the bitwise-operated second byte sequence and improving the security of the bitwise-operated hash array. Optionally, the displacement length used when left-shifting or right-shifting the second byte sequence can be specified in advance.

[0065] After performing bitwise operations on the second byte sequence based on the above implementation method, the bitwise-operated second byte sequence can be written into a specified position in a preset byte array to obtain the second byte array. Based on this implementation method, the value or position of the binary number in the second byte sequence can be changed through bitwise operations, providing more comprehensive security protection for the second byte sequence obtained through encryption calculation.

[0066] Optionally, when performing fuzzy matching between the first byte array and any byte array, at least one of the following methods can be used: regular expression matching, wildcard matching (e.g., the `LIKE` statement in a database), Longest Common Subsequence (LCS) matching, cosine similarity matching, and filter-based matching. This embodiment includes, but is not limited to, these methods.

[0067] In some optional embodiments, when performing fuzzy matching between the first byte array and at least one byte array to be matched, a subarray of the byte array corresponding to each ciphertext data to be matched can be obtained, and each subarray of the byte array to be matched can be matched bit-by-bit with the first byte array corresponding to the first ciphertext data. Here, a subarray of any byte array refers to a new byte array formed by continuously taking a certain number of elements starting from any starting position of the original byte array; that is, the subarray is a segment of the original byte array. In this embodiment, the length of the subarray can be set to be the same as the length of the first byte array to facilitate bit-by-bit matching.

[0068] The following example uses the second byte array corresponding to the second ciphertext data in at least one ciphertext data to be matched. Optionally, the subarrays of the second byte array can be traversed, and it can be determined whether there is a target subarray in the subarrays of the second byte array that matches the first byte array. Specifically, when traversing to any subarray of the second byte array, the subarray can be matched bit by bit with the first byte array to determine whether the subarray matches the first byte array. If the subarray matches every bit of the first byte array, then the subarray is determined to be a target subarray that matches the first byte array.

[0069] Optionally, if the second byte array contains a target subarray that matches the first byte array, the query engine can use the second byte array as the target byte array that matches the first byte array, and can use the target byte array as the query result corresponding to the target query keyword. If the second byte array does not contain a target subarray that matches the first byte array, the query engine can determine that the second byte array does not match the first byte array.

[0070] Optionally, when traversing subarrays of the second byte array, a sliding window can be defined, and the sliding window can be used to extract subarrays from the second byte array. The length of the sliding window is the same as or greater than the length of the first byte array. The sliding window can move gradually to the right from the left boundary of the second byte array, with a step size of one byte. Each time it moves, a portion of the bytes from the second byte array entering the sliding window is obtained as a subarray, and this subarray is matched bit-by-bit with the first byte array. If at least one mismatched byte exists, the movement continues to the right by one byte, and the portion of the bytes from the second byte array entering the sliding window is obtained again, and this portion of the bytes in the sliding window is matched bit-by-bit with the first byte array. When the portion of bytes in the sliding window matches every byte in the first byte array, it can be determined that there is a target subarray in the second byte array that matches the first byte array. Based on this implementation, the first and second byte arrays can be matched bit-by-bit by sliding the sliding window byte-by-byte, thereby obtaining accurate fuzzy query results.

[0071] For example, such as Figure 3 As shown, the first byte array is 2 bytes long. A sliding window of 2 bytes can be set, which slides across the second byte array. The sliding window's step size is one byte. Each slide retrieves a subarray of the second byte array, and this subarray can be matched bit-by-bit with the first byte array. Figure 3 As shown, when the sliding window slides for the second time, the subarray within the window completely matches the first byte array, so the subarray within the window can be used as the target subarray.

[0072] It is worth noting that before performing fuzzy matching between the first and second byte arrays, if the second byte array uses bitwise XOR (^) or bitwise NOT (~) operations, to ensure the accuracy of the fuzzy matching result, the inverse bitwise operation can be performed on the second byte sequence in the second byte array to restore the second byte sequence to its state before the bitwise operation. Therefore, the first and second byte arrays can be matched using the same algorithm.

[0073] For example, after performing a bitwise AND (&) operation on the second byte sequence using a specified binary array, the resulting second byte sequence can be written to a specified position in a preset byte array to obtain the second byte array. When performing fuzzy matching between the first byte array and the second byte array corresponding to the target query keyword, the reverse bitwise AND (&) operation on the second byte sequence using the specified binary array can be performed first to obtain the restored second byte array. Then, fuzzy matching can be performed between the first byte array and the restored second byte array, which will not be elaborated further.

[0074] In this embodiment, each of the at least one original data to be matched corresponds to ciphertext data obtained by character-by-character encryption. This character-by-character encryption preserves the structural features between characters in the original data, making the ciphertext data searchable and matchable. After obtaining the target query keyword corresponding to the query request, the target query keyword can be encrypted character-by-character using the same encryption algorithm as the original data. This allows the encrypted target query keyword to be retrieved and matched against the ciphertext corresponding to the original data, satisfying fuzzy query requirements. Based on this implementation method, there is no need to encrypt the original data after word segmentation and combination, reducing the length expansion of the ciphertext data. In addition, there is no need to use "extended columns" to store the encrypted word segmentation units, reducing the storage space occupied and lowering the cost of fuzzy querying of encrypted data.

[0075] In this data encryption and query method, the original data is encrypted character by character, thus supporting fuzzy matching of query keywords of arbitrary length without requiring a limit on the length of the query keywords. Compared to word segmentation and combination schemes, fuzzy queries offer greater freedom and flexibility.

[0076] It is also worth noting that in this implementation, encrypting the original data word by word to obtain the complete ciphertext data of the original data allows the ciphertext data to retain the complete structural information of the original data. Compared with word segmentation and combination schemes, this reduces the risk of damaging the integrity of the original data and is conducive to decryption to obtain accurate plaintext data.

[0077] This embodiment can be applied to various fuzzy query scenarios, such as search engine queries, natural language processing scenarios, e-commerce scenarios, and database scenarios. In a search engine query scenario, when a user enters a target query keyword into the search engine, the search engine can use the query method provided in this embodiment to retrieve web pages matching the target query keyword from encrypted web page information. In a natural language processing scenario, when a user enters an article keyword, the query engine can use the query method provided in this embodiment to retrieve articles corresponding to the target query keyword from encrypted text information. In an e-commerce scenario, when a user enters a product keyword, the e-commerce platform's query engine can search for products corresponding to the product keyword from encrypted product data based on the query method provided in this embodiment. In a database scenario, the database query engine can obtain the target query keyword and use the query method provided in this embodiment to retrieve encrypted data corresponding to the target query keyword from encrypted stored data.

[0078] The following will use a database scenario as an example to further illustrate the query method provided in the embodiments of this application.

[0079] Figure 4a This is a flowchart illustrating an exemplary embodiment of the present application of a method for querying encrypted data in a database, as shown below. Figure 4a As shown, the method mainly includes:

[0080] Step 401: The database query engine responds to the query request and obtains the target query keywords.

[0081] Step 402: Obtain the first ciphertext data corresponding to the target query keyword. The first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm.

[0082] Step 403: Match the first ciphertext data with at least one ciphertext data to be matched in the database to obtain target ciphertext data that matches the first ciphertext data; the at least one ciphertext data is obtained by the database storage engine using the preset target encryption algorithm to perform word-by-word encryption calculation on at least one original data.

[0083] Step 404: Use the target encrypted data as the query result corresponding to the target query keyword.

[0084] This embodiment can be applied to a database management system, which may include a database query engine and a database storage engine. The database query engine is responsible for executing query requests, while the database storage engine is used to store data and manage indexes, etc.

[0085] In step 401, the query request may be initiated by the database client corresponding to the database management system based on the user's query operation, or it may be initiated by other applications or systems based on query requirements. After obtaining the query request, the database query engine can obtain the target query keywords based on the query request. Typically, the query request is expressed in a query statement, which the database query engine can parse and obtain the query keywords based on the parsing results. In fuzzy query application scenarios, the target query keywords are usually part of the original data. For example, the target query keywords may be a specific prefix or suffix of the original data, or specific words or phrases in the text corresponding to the original data, etc.

[0086] In step 402, the database query engine can obtain the first encrypted data corresponding to the target query keyword.

[0087] Optionally, when the database query engine obtains the first encrypted data corresponding to the target query keyword, it can determine whether there is encrypted data matching the target query keyword in the at least one encrypted data according to the query keywords corresponding to each of the at least one encrypted data that has been saved; if there is, the encrypted data matching the target query keyword is used as the first encrypted data; if there is, the preset target encryption algorithm is used to perform character-by-character encryption calculation on the target query keyword to obtain the first encrypted data.

[0088] Optionally, after the database query engine performs character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm to obtain the first ciphertext data, it can save the correspondence between the target query keyword and the first ciphertext data so that when a new query request corresponding to the target query keyword is received, the first ciphertext data can be obtained according to the correspondence.

[0089] Optionally, when the database query engine performs character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm to obtain the first ciphertext data, it can obtain the first encryption key corresponding to the target query keyword; combine the target query keyword and the first encryption key to obtain first combination information; perform character-by-character encryption calculation on the first combination information using the preset target encryption algorithm to obtain a first byte sequence; write the first byte sequence into a specified position in a preset byte array to obtain a first byte array; and use the first byte array as the first ciphertext data.

[0090] Optionally, in the database management system, the database storage engine can also be used to perform word-by-word encryption calculation on any of the original data in the at least one original data using the preset target encryption algorithm to obtain the second encryption key corresponding to the original data; combine the original data and the second encryption key to obtain the second combined information; perform word-by-word encryption calculation on the second combined information using the preset target encryption algorithm to obtain the second byte sequence; write the second byte sequence into a specified position in a preset byte array to obtain the second byte array corresponding to the original data; and use the second byte array as the second ciphertext data byte array corresponding to the original data.

[0091] Optionally, when the database storage engine matches the first ciphertext data with at least one ciphertext data to obtain target ciphertext data that matches the first ciphertext data, it specifically performs the following steps: for any second ciphertext data in the at least one ciphertext data, iterate through the subarrays of the second byte array corresponding to the second ciphertext data, and determine whether there is a target subarray in the subarrays of the second byte array that matches the first byte array, wherein the second byte array is obtained by performing word-by-word encryption calculation on the given original data using the encryption algorithm; if the target subarray exists in the second byte array, then the second ciphertext data is used as the target ciphertext data that matches the first ciphertext data.

[0092] Optionally, before writing the second byte sequence into a specified position in a preset byte array to obtain the second byte array corresponding to the original data, the database storage engine is further configured to: perform bit operations on the second byte sequence according to a preset bit operation strategy to encrypt the second byte sequence; correspondingly, before traversing the subarrays of the second byte array corresponding to the second ciphertext data, the database query engine is further configured to: perform the inverse operation corresponding to the bit operation on the second byte sequence in the second byte array.

[0093] In this embodiment, when performing fuzzy queries on encrypted data in the database, the database query engine can convert the target query keywords into first encrypted data by performing character-by-character encryption calculations on the target query keywords. Each of the at least one original data item to be matched in the database corresponds to encrypted encrypted data obtained through character-by-character encryption. This character-by-character encryption preserves the structural features between characters in the original data, making the encrypted data searchable and matchable. After obtaining the target query keywords corresponding to the query request, the same encryption algorithm as the original data is used to encrypt the target query keywords character-by-character. This allows the encrypted target query keywords to be retrieved and matched against the corresponding encrypted data, satisfying the fuzzy query requirements. Based on this implementation method, there is no need to encrypt the original data after word segmentation and combination, reducing the length expansion of the encrypted data. Furthermore, there is no need to use "extended columns" to store the encrypted word segments, reducing storage space usage and lowering the cost of fuzzy queries on encrypted data.

[0094] Figure 4b This is a flowchart illustrating a method for querying encrypted data provided in another exemplary embodiment of this application, such as... Figure 4b As shown, a key can be obtained through a key management service, and a target encryption algorithm can be used to perform word-by-word encryption calculations on the original data to obtain irreversible ciphertext. The ciphertext can be stored as a byte array, and the ciphertext obtained after word-by-word encryption of the original data is marked as the second byte array. When a query is needed, the query keyword can be obtained, and it can be checked whether a byte array corresponding to the query keyword exists in the cache. If it exists, the byte array corresponding to the query keyword is matched bit-by-bit with the byte array corresponding to the original data. For example... Figure 4b As shown, if the query keyword does not exist, a key is obtained, and the query keyword is encrypted and calculated using the key to obtain the byte array corresponding to the query keyword. This byte array is then matched bit-by-bit with the byte array corresponding to the original data. During the bit-by-bit matching process, if every byte of the byte array corresponding to the keyword matches every byte of the byte array corresponding to the original data, the fuzzy query result is considered a match; otherwise, the fuzzy query result is considered a mismatch.

[0095] Based on this implementation method, on the one hand, the original data and query keywords can be encrypted using encryption algorithms to improve data security. On the other hand, by encrypting the original data and query keywords character by character, the resulting ciphertext byte array has searchable characteristics, so that fuzzy queries can be performed directly based on the ciphertext byte array without additional calculation or storage of relevant data dedicated to fuzzy queries, thus reducing the cost required for fuzzy queries on ciphertext.

[0096] The encrypted data query methods provided in the embodiments of this application can be applied to various scenarios where sensitive information needs to be encrypted and stored, and at the same time, fuzzy queries are required for this sensitive information. Examples will be given below.

[0097] For example, in healthcare settings, medical records contain a large amount of personal privacy information, such as sensitive data like medical history, diagnoses, and treatment plans. Medical institutions must strictly adhere to privacy regulations when storing medical records. In this case, the target encryption algorithm provided in this application can be used to encrypt the medical records character by character, obtaining a corresponding byte array. This byte array is then stored to achieve encrypted storage of the medical records. When there is a need to query medical records, query keywords can be obtained, and the target encryption algorithm can be used to encrypt these keywords character by character, obtaining a corresponding byte array. Based on the byte array corresponding to the query keywords, fuzzy matching can be performed on the byte array corresponding to the medical records, thereby helping doctors quickly find relevant cases without disclosing the patient's privacy information.

[0098] For example, in financial services scenarios, banks and financial institutions store customers' financial information, including transaction records and personal identification information. This data needs to be strictly confidential, yet it must also be usable for risk assessment and market analysis. In this case, the target encryption algorithm provided in this application embodiment can be used to encrypt the customer's financial information character by character, obtaining the corresponding byte array, and storing this byte array. When there is a need to query financial information, query keywords can be obtained, and the target encryption algorithm can be used to encrypt the query keywords character by character, obtaining the corresponding byte array. Based on the byte array corresponding to the query keywords, fuzzy matching can be performed on the byte array corresponding to the financial information, thereby enabling the analysis and retrieval of financial data without exposing the financial information.

[0099] In addition to the above-mentioned application scenarios, the embodiments of this application can also be applied in e-commerce and marketing scenarios. They can be used to encrypt and store sensitive data such as users' purchase history data, order data, and delivery address information, and to realize modular query of encrypted data. Further details will not be elaborated here.

[0100] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 101 to 104 can be device A; or the execution subject of steps 101 and 102 can be device A, and the execution subject of step 103 can be device B; and so on.

[0101] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations appearing in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not represent any execution order. Additionally, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0102] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0103] Figure 5 This illustration shows a schematic diagram of the structure of a server provided in an exemplary embodiment of this application. This server is suitable for the encrypted data query method provided in the foregoing embodiments. Figure 5 As shown, the server includes: a memory 501, a processor 502, and a communication component 503.

[0104] Memory 501 is used to store computer programs and can be configured to store various other data to support operations on the server. Examples of this data include instructions for any application or method used to operate on the server.

[0105] Processor 502, coupled to memory 501, is used to execute computer programs in memory 501 for: responding to a query request and obtaining a target query keyword; obtaining first ciphertext data corresponding to the target query keyword, wherein the first ciphertext data is obtained by encrypting the target query keyword character by character using a preset target encryption algorithm; matching the first ciphertext data with at least one ciphertext data to be matched to obtain target ciphertext data matching the first ciphertext data; wherein the at least one ciphertext data is obtained by encrypting at least one original data character by character using the preset target encryption algorithm; and using the target byte array as the query result corresponding to the target query keyword.

[0106] Optionally, when the processor 502 obtains the first ciphertext data corresponding to the target query keyword, it specifically performs the following steps: based on the query keywords corresponding to each of the at least one ciphertext data that has been saved, it determines whether there is ciphertext data in the at least one ciphertext data that matches the target query keyword; if there is, it uses the ciphertext data that matches the target query keyword as the first ciphertext data; if there is, it uses the preset target encryption algorithm to perform character-by-character encryption calculation on the target query keyword to obtain the first ciphertext data.

[0107] Optionally, after the processor 502 performs character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm to obtain the first ciphertext data, it is further configured to: save the correspondence between the target query keyword and the first ciphertext data, so as to obtain the first ciphertext data according to the correspondence when a new query request corresponding to the target query keyword is received.

[0108] Optionally, when the processor 502 performs character-by-character encryption calculation on the target query keyword using the preset target encryption algorithm to obtain the first ciphertext data, it specifically performs the following steps: obtaining the first encryption key corresponding to the target query keyword; combining the target query keyword and the first encryption key to obtain first combination information; performing character-by-character encryption calculation on the first combination information using the preset target encryption algorithm to obtain a first byte sequence; writing the first byte sequence into a specified position in a preset byte array to obtain a first byte array; and using the first byte array as the first ciphertext data.

[0109] Optionally, the processor 502 is further configured to: when performing word-by-word encryption calculation on any of the original data in the at least one original data using the preset target encryption algorithm, obtain a second encryption key corresponding to the original data; combine the original data and the second encryption key to obtain second combined information; perform word-by-word encryption calculation on the second combined information using the preset target encryption algorithm to obtain a second byte sequence; write the second byte sequence into a specified position in a preset byte array to obtain a second byte array corresponding to the original data; and use the second byte array as the second ciphertext data corresponding to the original data.

[0110] Optionally, when the processor 502 matches the first ciphertext data with at least one ciphertext data to be matched to obtain target ciphertext data that matches the first ciphertext data, it specifically performs the following steps: for the second ciphertext data in the at least one ciphertext data, iterate through the subarrays of the second byte array corresponding to the second ciphertext data, and determine whether there is a target subarray in the subarrays of the second byte array that matches the first byte array; if there is a target subarray in the second byte array, then the second ciphertext data is used as the target ciphertext data that matches the first ciphertext data.

[0111] Optionally, before writing the second byte sequence into a specified position in a preset byte array to obtain the second byte array corresponding to the original data, the processor 502 is further configured to: perform bit operations on the second byte sequence according to a preset bit operation strategy to encrypt the second byte sequence; before traversing the subarrays of the second byte array corresponding to the second ciphertext data, the processor 502 is further configured to: perform the inverse operation corresponding to the bit operation on the second byte sequence in the second byte array.

[0112] Figure 5 The illustrated server can also be used to execute a method for querying encrypted data in a database. Specifically, the processor 502 is used to: respond to a query request using a database query engine to obtain a target query keyword; obtain first ciphertext data corresponding to the target query keyword, wherein the first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm; match the first ciphertext data with at least one ciphertext data to be matched in the database to obtain target ciphertext data matching the first ciphertext data; wherein the at least one ciphertext data is obtained by performing character-by-character encryption calculation on at least one piece of original data using the preset target encryption algorithm; and use the target byte array as the query result corresponding to the target query keyword.

[0113] Furthermore, such as Figure 5 As shown, the server also includes other components such as a power supply component 504, a display component 505, and an audio component 506. Figure 5 The diagram only shows some components and does not mean that the server only includes... Figure 5 The components shown. Figure 5 In this embodiment, the components within the dashed boxes are optional, not mandatory, and their specific requirements depend on the server's product form. The server in this embodiment can be a terminal device such as a desktop computer, laptop computer, smartphone, or IoT device, or a server-side device such as a conventional server, cloud server, or server array. If the server in this embodiment is implemented as a terminal device such as a desktop computer, laptop computer, or smartphone, it may include... Figure 5The components within the dashed box; if the server in this embodiment is implemented as a conventional server, cloud server, or server array, etc., it may be omitted. Figure 5 The component within the dashed box.

[0114] The memory 501 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0115] The communication component 503 is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as Wi-Fi, 2G (e.g., Global System for Mobile Communications (GSM)), 3G (e.g., Wideband Code Division Multiple Access (WCDMA), 4G (e.g., Long Term Evolution (LTE)), 4G+ (e.g., LTE-Advanced (LTE-A)), or 5G (5th Generation Mobile Communication Technology), or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component may be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), and other technologies.

[0116] The power supply component 504 is used to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0117] The display component includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation.

[0118] An audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals may be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0119] In this embodiment, each of the at least one original data to be matched corresponds to ciphertext data obtained by character-by-character encryption. This character-by-character encryption preserves the structural features between characters in the original data, making the ciphertext data searchable and matchable. After obtaining the target query keyword corresponding to the query request, the target query keyword can be encrypted character-by-character using the same encryption algorithm as the original data. This allows the encrypted target query keyword to be retrieved and matched against the ciphertext corresponding to the original data, satisfying fuzzy query requirements. Based on this implementation method, there is no need to encrypt the original data after word segmentation and combination, reducing the length expansion of the ciphertext data. In addition, there is no need to use "extended columns" to store the encrypted word segmentation units, reducing the storage space occupied and lowering the cost of fuzzy querying of encrypted data.

[0120] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed, can implement the steps that can be executed by the server in the above method embodiments.

[0121] This application also provides a computer program product, including: a computer program / instructions, which, when executed by a processor, can implement the steps in the method provided in this application.

[0122] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM (Compact Disc Read-Only Memory), optical storage, etc.) containing computer-usable program code.

[0123] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0124] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0125] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0126] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0127] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0128] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0129] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, product, or apparatus that includes said element.

[0130] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A method for querying encrypted data, characterized in that, include: Respond to the query request and retrieve the target query keywords; Obtain the first ciphertext data corresponding to the target query keyword, wherein the first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm; The first ciphertext data is matched with at least one ciphertext data to be matched to obtain target ciphertext data that matches the first ciphertext data; The at least one encrypted data is obtained by performing word-by-word encryption calculation on at least one original data using the preset target encryption algorithm; The target encrypted data is used as the query result corresponding to the target query keyword.

2. The method according to claim 1, characterized in that, Obtaining the first encrypted data corresponding to the target query keyword includes: Based on the query keywords corresponding to each of the at least one saved ciphertext data, determine whether there is any ciphertext data in the at least one ciphertext data that matches the target query keyword; If it exists, the ciphertext data that matches the target query keyword will be used as the first ciphertext data; If it does not exist, the preset target encryption algorithm is used to perform character-by-character encryption calculation on the target query keyword to obtain the first ciphertext data.

3. The method according to claim 2, characterized in that, After performing character-by-character encryption calculations on the target query keywords using the preset target encryption algorithm to obtain the first ciphertext data, the method further includes: The correspondence between the target query keyword and the first encrypted data is saved so that when a new query request corresponding to the target query keyword is received, the first encrypted data can be obtained according to the correspondence.

4. The method according to claim 2, characterized in that, The first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keywords using the preset target encryption algorithm, including: Obtain the first encryption key corresponding to the target query keyword; The target query keyword and the first encryption key are combined to obtain the first combined information; The first combination of information is encrypted word by word using the preset target encryption algorithm to obtain the first byte sequence; Write the first byte sequence into a specified position in a preset byte array to obtain the first byte array; Use the first byte array as the first ciphertext data.

5. The method according to claim 4, characterized in that, Also includes: When performing word-by-word encryption calculation on any of the at least one original data using the preset target encryption algorithm, the second encryption key corresponding to the original data is obtained. The original data and the second encryption key are combined to obtain the second combined information; The second combination information is encrypted word by word using the preset target encryption algorithm to obtain the second byte sequence; Write the second byte sequence into a specified position in a preset byte array to obtain the second byte array corresponding to the original data; The second byte array is used as the second ciphertext data corresponding to the original data.

6. The method according to claim 5, characterized in that, The first ciphertext data is matched with at least one ciphertext data to be matched, to obtain target ciphertext data that matches the first ciphertext data, including: For the second ciphertext data in the at least one ciphertext data, traverse the subarrays of the second byte array corresponding to the second ciphertext data, and determine whether there is a target subarray in the subarrays of the second byte array that matches the first byte array; If the target subarray exists in the second byte array, then the second ciphertext data is used as the target ciphertext data that matches the first ciphertext data.

7. The method according to claim 5, characterized in that, Before writing the second byte sequence into a specified position in a preset byte array to obtain the second byte array corresponding to the original data, the method further includes: performing bit operations on the second byte sequence according to a preset bit operation strategy to encrypt the second byte sequence; Before traversing the subarrays of the second byte array corresponding to the second ciphertext data, the method further includes: performing the inverse operation corresponding to the bitwise operation on the second byte sequence in the second byte array.

8. A method for querying encrypted data in a database, characterized in that, include: The database query engine responds to the query request and retrieves the target query keywords; Obtain the first ciphertext data corresponding to the target query keyword, wherein the first ciphertext data is obtained by performing character-by-character encryption calculation on the target query keyword using a preset target encryption algorithm; The first ciphertext data is matched with at least one ciphertext data to be matched in the database to obtain target ciphertext data that matches the first ciphertext data; The at least one encrypted data is obtained by the database storage engine using the preset target encryption algorithm to perform word-by-word encryption calculation on at least one original data. The target encrypted data is used as the query result corresponding to the target query keyword.

9. A server, characterized in that, include: Memory and processor; The memory is used to store one or more computer instructions; The processor is configured to execute one or more computer instructions for performing the steps of the method according to any one of claims 1-8.

10. A computer-readable storage medium storing a computer program, characterized in that, When a computer program is executed by a processor, it can implement the method for querying encrypted data as described in any one of claims 1-8.

11. A computer program product, characterized in that, include: A computer program / instruction, which, when executed by a processor, enables the querying method for encrypted data as described in any one of claims 1-8.

Images