Communication information query method, device and equipment based on cloud computing and storage medium

Abstract

The invention relates to the technical field of data query, in particular to a cloud computing-based communication information query method, which comprises the following steps of: S1, acquiring an input query request, and standardizing the input query request to obtain a converted standardized query set; s2, sending the converted standardized query set to an untrusted execution environment of a query cloud node, and obtaining a parity check value calculated by the untrusted execution environment according to a record corresponding to the standardized query set; and S3, performing inverse transformation on each target index to obtain a query result set according to the preprocessed prompt entry set, the replacement entry set and the parity check value obtained by calculation. According to the method, a real position is replaced by a replacement entry preset in a partition through a standardized construction method of linkage of query index, prompt entry set and replacement entry set, a standardized query set without any real position is formed, and a more reliable security guarantee is provided during information query.

Description

Technical Field

[0001] This invention relates to the field of data query technology, and in particular to a cloud computing-based communication information query method, apparatus, device, and storage medium. Background Technology

[0002] With the rapid development of the mobile internet, SMS, MMS, instant messaging, voice calls, emails, and notifications from various embedded applications on smartphones, tablets, and other mobile devices are often centrally aggregated in the cloud using cloud computing technology. A unified communication information management and query platform can then be built for rapid retrieval. Cloud computing technology deploys lightweight collection components on the mobile terminal side, and, with user authorization or business triggering, periodically or in real-time packages, encrypts, and transmits the local communication records to the cloud data center, where they are stored and indexed by the cloud's database system. The cloud typically uses relational databases, distributed key-value databases, or full-text query engines as basic components, providing upper-layer query interfaces based on time, number, account, keywords, and even rule expressions, allowing investigators or auditors to perform queries via web pages or dedicated clients.

[0003] In existing technologies, various cloud computing information query management architectures have emerged. For example, uploaded communication information is converted into a unified data format for storage, and the system builds index structures for different dimensions. Larger systems also employ database sharding, table partitioning, sharding routing, and caching technologies to expand the database and support queries of hundreds of millions of communication information entries. As the requirements for the credibility of query results continue to increase, existing technologies also introduce verifiable query techniques into the database, building authentication data structures on top of cloud communication information to address the question of "whether the cloud is telling the truth." However, this approach only allows the cloud to prove that "the returned records are indeed in the current version's evidence database," but it is difficult to prove "whether there are other records that meet the conditions but were deliberately omitted."

[0004] Furthermore, given the inherent sensitivity of communication content and query conditions, numerous cloud query solutions for privacy protection have emerged in existing technologies. These include Private Information Retrieval (PIR) methods, such as PIR protocols that use cryptographic tools like homomorphic encryption, multi-party computation, or obfuscated circuits to allow users to obtain target data from servers without revealing their access location. Multi-server PIR protocols distribute database copies across multiple non-colluding servers, randomly splitting the query vector into multiple sub-vectors and sending them to each server, preventing any single server from independently inferring the true query location. However, while this approach theoretically improves efficiency, it relies on the absolute non-collusion among these servers. If this non-collusion assumption is violated in actual operation, the privacy protection based on information splitting becomes essentially ineffective. Moreover, its excessive computational and communication overhead makes it difficult to operate sustainably in real-world business systems.

[0005] To further reduce computational overhead on the terminal side, solutions utilizing trusted execution environments (such as Intel SGX) to assist in queries have emerged in recent years. These solutions typically construct a logically isolated "secure enclave" within a cloud server. Within this enclave, query logic is executed, data is decrypted, or sensitive algorithms are run, while the server operating system and other applications cannot directly access the keys and intermediate data within the enclave. To meet the comprehensive analysis needs across cases and terminals, some systems have also established unified communication behavior analysis engines in the cloud. This engine provides higher-level query semantics on top of the evidence base, such as multi-person session link analysis, frequent contact number mining, and automatic reconstruction of event timelines. However, while this solution can provide code and data isolation protection at the hardware level, in practice, many systems tend to encapsulate the entire query engine or database instance directly within the SGX enclave. However, the available memory space in the enclave is limited, and frequent cross-boundary calls and page swapping in and out can lead to significant performance degradation, making it difficult to meet real-time requirements in large-scale evidence base scenarios.

[0006] Moreover, most of the solutions provided in existing technologies are designed from the perspective of general databases or general file storage, without fully considering the special characteristics of mobile terminal communication information in terms of data structure, query types, and security requirements. For example, a large number of records are based on time, the information of participating parties is highly concentrated, and there are fuzzy matching requirements in the message body. Therefore, existing communication information query solutions in cloud computing environments still cannot provide more reliable security guarantees at multiple levels. Summary of the Invention

[0007] Based on this, the present invention provides a new solution for querying communication information based on cloud computing. It introduces dual-server collaboration at the architecture level, combines preprocessing-type PIR with verifiable computing at the protocol level, and makes full use of cloud computing resources and trusted hardware capabilities at the implementation level, so as to achieve a better balance between reliability, efficiency and privacy protection.

[0008] In one embodiment, the present invention provides a communication information query method based on cloud computing, comprising: S1, obtain the input query request, and perform standardization processing on the input query request to obtain the transformed standardized query set; S2, the transformed standardized query set is sent to the untrusted execution environment of the query cloud node, and the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set are obtained; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; S3, based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, perform an inverse transformation on each target index in the standardized query set to obtain a query result set; S4. Use the verification function to verify the parity check value and the corresponding proof vector, and determine the query result based on the verification result.

[0009] Furthermore, S1 includes: S11, perform semantic parsing on the input query request to obtain the parsed query tuple; S12, Filter the target index set that satisfies the query tuple based on the keyword index file; S13, find and obtain the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, find the random index set number with the same partition number in the prompt entry set, determine the corresponding random index set, replace the position of the partition corresponding to the target index with the position of the replacement entry corresponding to the replacement entry set, and construct the transformed standardized query set.

[0010] Furthermore, in S11, the parsed query tuple is represented as follows: ,in, For query time, For keyword Boolean expressions, This represents the set of aggregate operations that are expected to be performed.

[0011] Furthermore, in S13, the preprocessing yields a set of prompt entries and a set of replacement entries, including: S131, generate public key parameters and random master key, and derive a key sequence of pseudo-random functions; S132, using a pseudo-random function to generate several sets of random indices across partitions; S133, the key sequence and random index set of the pseudo-random function are sent to the prompt cloud node, and the prompt cloud node obtains the prompt entry set and replacement entry set calculated by the prompt cloud node based on the key sequence and random index set of the pseudo-random function; wherein, the prompt cloud node calculates the parity check value of the content at the corresponding position based on the random index set of each partition, and forms the prompt entry set and replacement entry set based on the parity check value.

[0012] Furthermore, in S133, the parity check value of the record content at the corresponding position for each random index set is calculated by byte XOR as follows:

[0013] in, For records in the database, These are the partition number and the offset within the partition, respectively. The set of random indexes is the number of the set of prompt entries. ,in, The key sequence is a pseudo-random function; the set of replacement entries it forms is... ,in, For the location to be recorded, The content to be recorded.

[0014] Furthermore, in S13, if the set corresponding to the target index is not found in the existing set of prompt entries, a random set of indexes is constructed as the random set of indexes corresponding to the current target.

[0015] In one embodiment, the present invention provides a communication information query method based on cloud computing, comprising: S1, the security zone of the query cloud node performs semantic parsing on the input query request to obtain the parsed query tuple; S2, the security zone filters the target index set that satisfies the query tuple based on the keyword index file; S3, the security zone search obtains the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, the random index set number with the same partition number is searched in the prompt entry set, the corresponding random index set is determined, the position of the partition corresponding to the target index is replaced with the position of the replacement entry corresponding to the replacement entry set, the converted standardized query set is constructed, and it is sent to the untrusted execution environment of the query cloud node. S4, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, calculates the corresponding proof vector based on the obtained parity check value, and returns it to the secure area; S5, the security zone performs an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a query result set.

[0016] In one embodiment, the present invention also provides a cloud computing-based communication information query device, comprising: The acquisition module is used to acquire the input query request and perform standardization processing on the input query request to obtain the transformed standardized query set; The transmission module is used to send the converted standardized query set to the untrusted execution environment of the query cloud node, and to obtain the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; The transformation module is used to perform an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a set of query results. The verification module uses a verification function to verify the parity check value and the corresponding proof vector, and determines the query result based on the verification result.

[0017] In one embodiment, the present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the cloud computing-based communication information query method described above.

[0018] In one embodiment, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the cloud computing-based communication information query method described above.

[0019] The aforementioned cloud-based communication information query method employs a standardized construction approach that links the query index, the set of suggested entries, and the set of replacement entries. First, the security zone obtains the target index set from the local keyword-location mapping based on the user-input time interval and keyword conditions. Then, for each target index, it finds its corresponding partition within the suggested entry set and replaces the real location with a pre-defined replacement entry for that partition, forming a standardized query set containing no real locations. This method ensures that the untrusted execution environment outside the query cloud node only observes fixed replacement locations and random false locations, making it difficult to reconstruct the user's true query intent through access patterns. Attached Figure Description

[0020] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Furthermore, the accompanying drawings are not drawn to a 1:1 scale, and the relative dimensions of the various components are shown in the drawings only as examples and not necessarily to actual scale.

[0023] Figure 1 This is an application environment diagram of a cloud computing-based communication information query method provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating a cloud computing-based communication information query method according to an embodiment of the present invention. Figure 3 Another flowchart of a cloud computing-based communication information query method provided in one embodiment of the present invention; Figure 4 This is a structural block diagram of a cloud computing-based communication information query device provided in an embodiment of the present invention. Figure 5 This is an internal structural diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0024] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention can be practiced in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0025] The present invention provides a cloud computing-based communication information query method, which can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with cloud storage center 104 and query cloud node 106 via the network; query cloud node 106 communicates with prompt cloud node 108 through a background channel.

[0026] Among them, terminal 102 (Client / Agent) can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc., and portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. It is responsible for collecting communication information such as call records, SMS records, and instant messaging messages upon user authorization, business triggering or timed collection, and uploading them to the cloud storage center 104 through a secure channel. Terminal 102 itself does not store long-term communication information, but only retains necessary session information.

[0027] Cloud storage center 104 (Evidence Store): This can be implemented using a standalone server or a server cluster consisting of multiple servers. Located on a cloud computing platform, it is used to centrally store communication information data from different terminals. Specifically, this cloud storage center can be a distributed database, object storage, or log system. This invention does not limit the specific implementation; it provides an interface for retrieving information by record number.

[0028] Query Node 106 (Q Node): This can be implemented using a standalone server or a server cluster consisting of multiple servers. It is responsible for acquiring and processing online query requests from terminals. The Q Node integrates a trusted execution environment (such as Intel SGX) forming a "secure processing subsystem" (hereinafter referred to as the secure zone). The secure zone is used to parse query statements, maintain keys, reconstruct and verify query results, and drive refresh logic. The untrusted execution environment outside the secure zone is responsible for large-scale data scanning and basic operator computation.

[0029] Hint Node 108 (H Node): This is a logical server that can be deployed on the same cloud computing platform as Cloud Storage Center 104 but is a physically independent instance. H Node is responsible for preprocessing and generating hint and replacement entries for privacy protection and result verification during the offline phase. During the online phase, it participates in refreshing the corresponding hint and replacement entries as needed.

[0030] Understandably, the architecture described above can be deployed as a standalone "communication information cloud query platform" or integrated as a middleware component into existing electronic information forensics systems or enterprise log auditing systems. At the software level, the security zone of the query cloud node can utilize C / C++ or Rust supporting SGX to implement the core protocol logic, while the external untrusted execution environment can use any web framework or microservice architecture to implement the query interface and task scheduling. At the hardware level, Q nodes and H nodes can be deployed on different physical servers in the same data center or in different cloud regions to improve anti-collusion capabilities. At the interface level, the system provides a unified query interface based on REST / JSON or gRPC; users only need to submit query conditions and receive results and verification status, without needing to understand the internal dual-node collaboration mechanism.

[0031] This invention physically decouples the "cloud storage center" and the "query service node" in the cloud, introducing a hint cloud node responsible only for preprocessing and a query cloud node responsible for online querying and result return. The hint cloud node only has access to the index set selected by a pseudo-random function and the encrypted communication information, and does not participate in the semantic parsing of user queries; the query cloud node, without knowing the hint entries or the real index, only generates the result by performing XOR calculations and proofs based on the standardized query vector. Through this dual-cloud separation architecture, without changing the existing cloud storage system, the root of trust is minimized to a hardware-measurable security zone, achieving secure communication information querying under the realistic deployment assumption that "the cloud cannot be completely trusted".

[0032] In this embodiment of the invention, the database storing communication information data in the cloud storage center is denoted as: The i-th record can be abstracted as a triple. . The timestamp field indicates the time when the call or message occurred; Numeric fields can represent call duration, amount, transfer amount, etc. This represents a set of keyword tags, such as caller ID, called number, session account, location tag, case number, etc.

[0033] The cloud storage center divides all records into several logical partitions of fixed length:

[0034] Among them, partition If the number of records is the same, let B be the partition size and B be the number of partitions. ,satisfy Each record's unique position in the database is identified by "partition number + offset within the partition," which is denoted as follows in this invention: . In one embodiment, such as Figure 2 As shown, this invention provides a communication information query method based on cloud computing, which can be applied to... Figure 1 Taking query cloud node 106 as an example, the execution is carried out by the "secure processing subsystem" formed by the trusted execution environment (such as Intel SGX) integrated within the query cloud node, including the following steps: S1, obtain the input query request, and perform standardization processing on the input query request to obtain the transformed standardized query set; Specifically, step S1 includes: S11, perform semantic parsing on the input query request to obtain the parsed query tuple; To cover actual case-handling scenarios, this invention supports three basic query formats: (1) Boolean combination query: user-specified time interval and keyword Boolean expressions For example, "a call between number A and number B AND involving the keyword 'transfer'". The system needs to return a set of all calls that meet the time condition and the keyword. Records that satisfy the Boolean expression.

[0035] (2) Range filtering query: Add numerical range filtering on the basis of Boolean conditions, such as "call duration is more than 60 seconds and the subject contains 'international roaming'", etc.

[0036] (3) Aggregate analysis query: Takes the results of the first two types of queries as input and performs analysis on the fields. Perform aggregate functions such as summation, counting, maximum, minimum, or average values ​​for advanced needs such as case amount statistics and frequent contact analysis.

[0037] Specifically, when the security zone of query cloud node Q receives a user's query request, it first performs semantic parsing on the user's natural language or structured query statement, resolving it into a unified query tuple: ,in Represents the set of aggregate operations to be performed (can be empty).

[0038] S12, Filter the target index set that satisfies the query tuple based on the keyword index file; Specifically, Boolean expressions are indexed through a keyword index file. Mapped to a set of target locations recorded in the database Then, a local filter is performed based on the query time and the numerical range to obtain the target index set that satisfies the above query tuples. .

[0039] S13, obtain the preprocessed prompt item set and replacement item set, for each target index in the target index set, find the random index set number with the same partition number in the prompt item set, determine the corresponding random index set, replace the position of the partition corresponding to the target index with the position of the replacement item corresponding to the replacement item set, and construct the transformed standardized query set. Specifically, this invention performs a preprocessing step during system deployment or periodic maintenance, and stores the preprocessed random index set, prompt item set, and replacement item set in the secure area of ​​the query cloud node. When a user's query request is received, the query request can be standardized and transformed using the corresponding prompt item set and replacement item set, achieving privacy protection and verifiable results during communication information queries. It is understood that preprocessing can be implemented offline. Specifically, step S13, which involves preprocessing to obtain the prompt item set and replacement item set, includes: S131, generate public key parameters and random master key, and derive a key sequence of pseudo-random functions; Specifically, querying the integrated security zone in cloud node 106, the security zone generates public key parameters over a large number field and a random master key K based on the security parameter λ, and derives a key sequence {K} of a pseudo-random function. 1， K 2， ..., K N The generated public parameters are exposed to the external untrusted execution environment of nodes H and Q, including the random master key K and the key sequence {K} of the pseudo-random function. j It is encrypted and stored within the secure zone.

[0040] S132, using a pseudo-random function to generate several sets of random indices across partitions; Among them, using pseudo-random functions The generated set of random indices is: . Where d is the size of the random index set, which is approximately a function of the number of partitions M in the cloud storage center database, for example... This ensures that each set covers multiple different partitions. (Using a key) Each generated random index set Send it to node H as an index template for subsequent prompt calculations.

[0041] S133, the key sequence and random index set of the pseudo-random function are sent to the prompt cloud node, and the prompt cloud node obtains the prompt entry set and replacement entry set calculated by the prompt cloud node based on the key sequence and random index set of the pseudo-random function; wherein, the prompt cloud node calculates the parity check value of the content at the corresponding position based on the random index set of each partition, and forms the prompt entry set and replacement entry set based on the parity check value.

[0042] Specifically, node H receives and Then, for each set Calculate the parity value of the record content at the corresponding position by XORing the bytes: H nodes form a set of prompt items. At the same time, a record is randomly selected from each partition as the replacement entry, and its position is recorded as... The content is recorded as Form a set of replacement entries The generated set of prompt entries and the set of replacement entries are sent to the secure zone of the Q node via a secure channel for encrypted storage.

[0043] After this preprocessing, the system has established a random prompting system decoupled from the original database structure without accessing specific case queries, providing a foundation for privacy protection and result verification during the online query phase.

[0044] Specifically, in this step, after filtering to obtain the target index set that satisfies the query tuple, for each target index... The safe zone searches for entries with the same partition number in the pre-stored set of hint entries. Find the random set number j and obtain its random index set. Then, put Zhongyuan is located in the partition The position is replaced with the replacement entry position preset for this partition during the preprocessing stage. Construct a standardized query set In this way, the query set exposed to the outside world no longer contains the actual offsets. Instead, it uniformly uses the offset of the replacement entry.

[0045] This invention utilizes a pseudo-random function (PRF) to generate a globally covering set of random indexes for each partition during the offline phase. A prompt cloud node then calculates an XOR checksum for each random index set. Simultaneously, a set of replacement entries is randomly selected for each partition. Both the prompt entry set and the replacement entry set are encrypted and cached in a secure area for standardized construction and result reconstruction in subsequent online queries. By moving a significant amount of computational and storage overhead to the preprocessing stage, the communication volume and computational complexity of online queries can be significantly reduced without increasing the burden on the terminal.

[0046] In one embodiment, if a target index cannot be found in a suitable set of existing prompt entries, the security area randomly constructs a completely unrelated set of indexes. This ensures that the system appears to have the same number of query requests to the outside world, thus statistically hiding the actual number of accesses.

[0047] Ultimately, the safe zone yields a set of standardized query sets. It then sends the result to the external untrusted execution environment of the Q node for execution. The external untrusted execution environment can only see a certain location of several partitions in each set, and does not know which one corresponds to the real target.

[0048] This invention proposes a standardized construction method that links a query index, a set of suggested entries, and a set of replacement entries: First, the security zone obtains a target index set from the local keyword-location mapping based on the user-input time interval and keyword conditions. Then, for each target index, its corresponding partition is found in the suggested entry set, and the real location is replaced with a pre-defined replacement entry for that partition, forming a standardized query set without any real locations. If no matching suggestions exist, a fake query set of equal size is constructed to mask the number of accesses. This method ensures that the cloud side always observes only fixed replacement locations and random fake locations, making it difficult to reconstruct the user's true query intent through access patterns.

[0049] S2, the transformed standardized query set is sent to the untrusted execution environment of the query cloud node, and the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set are obtained; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; Specifically, the transformed standardized query set is sent to the untrusted execution environment of the query cloud node. The external untrusted execution environment of the Q node reads the records involved in each set from the cloud storage center according to the target index of the standardized query set, and performs an XOR operation on each record to obtain the corresponding parity check value: Simultaneously, based on the authentication data generated in the preprocessing stage, for each... Calculate the proof vector Its specific implementation can employ group exponential commitment, bilinear pairing verification, or hash accumulators; this invention does not limit the specific cryptographic algorithm. Ultimately, the untrusted execution environment of the Q node will... Return to the safe zone.

[0050] S3, based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, perform an inverse transformation on each target index in the standardized query set to obtain a query result set; Specifically, the security zone performs an inverse transformation on each target query index based on the pre-processed set of hint entries and the set of replacement entries. Let a target index... If the corresponding hint set number j is known during the preprocessing stage, then the parity check value of the record is... The corresponding parity check value during the target query is The only difference between the two is: The true location Replace with Therefore, the contents of the target record can be recovered from the safe zone using the following formula: ,in The preprocessing stage has been computed by the H node and stored in the safe zone. Repeating the above operations for all real indexes yields the query result set. If the current query contains aggregate functions The safe zone is a local collection numeric fields Perform the corresponding summation, extreme value finding, or average value finding operations to obtain a unified aggregated result.

[0051] S4. Use the verification function to verify the parity check value and the corresponding proof vector, and determine the query result based on the verification result.

[0052] Specifically, the security zone uses the prompts and replacements from the current query, saved during the preprocessing phase, to check each parity value returned from the cloud. and proof vector Verification is performed. If the verification function corresponding to all target queries returns 1, the returned query results are considered to come from an untampered database and have not been maliciously deleted; otherwise, an error flag is immediately returned to the user, and an alarm or audit process can be triggered. Through the above combination of reconstruction and verification, even if the Q node maliciously tampers with intermediate results or attempts to omit some records, the authentication relationship will be invalid, thus being detected by the security zone.

[0053] This invention encapsulates the entire XOR reconstruction and correctness verification process within a secure area within the query cloud node: the untrusted execution environment outside the query cloud node performs an XOR operation on the evidence records based on a standardized query set to generate a lightweight proof. The secure area utilizes the hint and replacement entries cached in the preprocessing stage to restore the true record in the manner of "hint entry ⊕ record content ⊕ replacement entry," and calls cryptographic primitives such as bilinear pairing to quickly verify the proof vector. This mechanism avoids the leakage of plaintext evidence or key parameters in an untrusted environment, while ensuring that any tampering or omission of records on the cloud side cannot fool the verification process.

[0054] To further illustrate the query method of the present invention, the following description focuses on the interaction between the secure zone of a query cloud node and an external untrusted execution environment, illustrating a cloud computing-based communication information query method provided by an embodiment of the present invention. Figure 3 As shown, it includes the following steps: S1, the security zone of the query cloud node performs semantic parsing on the input query request to obtain the parsed query tuple; S2, the security zone filters the target index set that satisfies the query tuple based on the keyword index file; S3, the security zone search obtains the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, the random index set number with the same partition number is searched in the prompt entry set, the corresponding random index set is determined, the position of the partition corresponding to the target index is replaced with the position of the replacement entry corresponding to the replacement entry set, the converted standardized query set is constructed, and it is sent to the untrusted execution environment of the query cloud node. S4, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, calculates the corresponding proof vector based on the obtained parity check value, and returns it to the secure area; S5, the security zone performs an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a query result set.

[0055] Furthermore, to prevent the pre-processed prompt entries and replacement entries from being exhausted after multiple queries, in this embodiment of the invention, after each query is completed, the security zone of the query cloud node will prompt the user to start a refresh process. The refresh process is as follows: (1) The Q node safety zone randomly selects several new indexes in each involved partition based on the set of prompt numbers J consumed in the current query; (2) Request H node to recalculate parity check value and authentication information according to these indices through the background channel to form new prompt entries and replacement entries; (3) Replace the consumed parts with new prompts to achieve "rolling updates" of auxiliary information; (4) If necessary, the security zone may periodically expand the size of the index set to accommodate the growth of the database size.

[0056] To address the issue of preprocessed auxiliary information being gradually "consumed" after multiple queries, this invention designs an online prompt refresh process: After each query, the security zone, based on the prompt number actually used in this round, re-extracts random indexes from each partition and requests the prompt node or local algorithm to recalculate the checksum and proof parameters, replacing the old entries with new prompts and replacement entries. This refresh process is executed asynchronously with business queries, without affecting user interface latency, and can maintain system availability for a long time without repeating full preprocessing, avoiding the problem of "system failure when auxiliary information is exhausted" in traditional preprocessing schemes.

[0057] The refresh process is asynchronous with the user's query perspective, and does not affect the real-time performance of the front-end interface. Since only a limited number of prompts are refreshed for each query, the preprocessing overhead is spread across a large number of queries, thus enabling the system to maintain stable safety margins and performance over long-term operation.

[0058] This invention provides a cloud-based communication information query method where, when a user initiates a query, a two-way secure session is established only with the Q node; the H node and Q node exchange auxiliary keys through a backend channel. No single cloud node can simultaneously possess "complete communication information data + query semantics + auxiliary key," thus reducing reliance on a single cloud service provider in the architecture. This invention, through a combined design of "data model standardization + dual-cloud node collaboration + preprocessing hint system + security zone reconstruction and verification," constructs a verifiable query method and system for mobile terminal communication information without altering existing cloud computing infrastructure. This approach balances query functionality and performance while significantly enhancing the ability to technically constrain cloud service providers.

[0059] It should be understood that, although Figures 2-3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 2-3At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0060] Based on the same inventive concept, such as Figure 4 As shown in the illustration, this application also provides a cloud computing-based communication information query device, including: The acquisition module M1 is used to acquire the input query request and perform standardization processing on the input query request to obtain the transformed standardized query set; The transmission module M2 is used to send the converted standardized query set to the untrusted execution environment of the query cloud node, and to obtain the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; The transformation module M3 is used to perform an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a set of query results. The verification module M4 uses a verification function to verify the parity check value and the corresponding proof vector, and determines the query result based on the verification result.

[0061] Other limitations regarding the cloud-based communication information query device can be found in the limitations of the cloud-based communication information query method described above, and will not be repeated here. Each module in the aforementioned cloud-based communication information query device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0062] In one embodiment, such as Figure 5 As shown, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0063] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0064] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0065] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0066] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this patent should be determined by the appended claims.

Claims

1. A communication information query method based on cloud computing, characterized in that, include: S1, obtain the input query request, and perform standardization processing on the input query request to obtain the transformed standardized query set; S2, the transformed standardized query set is sent to the untrusted execution environment of the query cloud node, and the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set are obtained; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; S3, based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, perform an inverse transformation on each target index in the standardized query set to obtain a query result set; S4. Use the verification function to verify the parity check value and the corresponding proof vector, and determine the query result based on the verification result.

2. The communication information query method according to claim 1, characterized in that, S1 includes: S11, perform semantic parsing on the input query request to obtain the parsed query tuple; S12, Filter the target index set that satisfies the query tuple based on the keyword index file; S13, find and obtain the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, find the random index set number with the same partition number in the prompt entry set, determine the corresponding random index set, replace the position of the partition corresponding to the target index with the position of the replacement entry corresponding to the replacement entry set, and construct the transformed standardized query set.

3. The communication information query method according to claim 2, characterized in that, In S11, the parsed query tuple is represented as follows: ,in, For query time, For keyword Boolean expressions, This represents the set of aggregate operations that are expected to be performed.

4. The communication information query method according to claim 1, characterized in that, In S13, the preprocessing yields a set of prompt entries and a set of replacement entries, including: S131, generate public key parameters and random master key, and derive a key sequence of pseudo-random functions; S132, using a pseudo-random function to generate several sets of random indices across partitions; S133, the key sequence and random index set of the pseudo-random function are sent to the prompt cloud node, and the prompt cloud node obtains the prompt entry set and replacement entry set calculated by the prompt cloud node based on the key sequence and random index set of the pseudo-random function; wherein, the prompt cloud node calculates the parity check value of the content at the corresponding position based on the random index set of each partition, and forms the prompt entry set and replacement entry set based on the parity check value.

5. The communication information query method according to claim 4, characterized in that, In S133, the parity check value of the record content at the corresponding position for each random index set is calculated by byte XOR as follows: in, For records in the database, These are the partition number and the offset within the partition, respectively. The set of random indexes is the number of the set of prompt entries. ,in, The key sequence is a pseudo-random function; the set of replacement entries it forms is... ,in, For the location to be recorded, The content to be recorded.

6. The communication information query method according to claim 2, characterized in that, In S13, if the set corresponding to the target index is not found in the existing set of prompt entries, a random set of indexes is constructed as the random index set corresponding to the current target.

7. A communication information query method based on cloud computing, characterized in that, include: S1, the security zone of the query cloud node performs semantic parsing on the input query request to obtain the parsed query tuple; S2, the security zone filters the target index set that satisfies the query tuple based on the keyword index file; S3, the security zone search obtains the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, the random index set number with the same partition number is searched in the prompt entry set, the corresponding random index set is determined, the position of the partition corresponding to the target index is replaced with the position of the replacement entry corresponding to the replacement entry set, the converted standardized query set is constructed, and it is sent to the untrusted execution environment of the query cloud node. S4, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, calculates the corresponding proof vector based on the obtained parity check value, and returns it to the secure area; S5, the security zone performs an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a query result set.

8. A communication information query device based on cloud computing, characterized in that, include: The acquisition module is used to acquire the input query request and perform standardization processing on the input query request to obtain the transformed standardized query set; The transmission module is used to send the converted standardized query set to the untrusted execution environment of the query cloud node, and to obtain the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; The transmission module is used to perform an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a set of query results. The transmission module uses a verification function to verify the parity check value and the corresponding proof vector, and determines the query result based on the verification result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images