A cloud computing-based communication information query method, device, equipment and storage medium

Abstract

The present application relates to the technical field of data query, in particular to a communication information query method based on cloud computing, comprising: S1, obtaining an input query request and performing standardized processing on the input query request to obtain a converted standardized query set; S2, sending the converted standardized query set to an untrusted execution environment of a query cloud node and obtaining an odd-even check value calculated by the untrusted execution environment according to the corresponding records of the standardized query set; S3, performing inverse transformation on each target index according to the preprocessed prompt entry set, the replacement entry set and the calculated odd-even check value to obtain a query result set. The method provides more reliable security guarantee in information query by using the standardized construction method of the linkage of "query index-prompt entry set-replacement entry set", replacing the real location with the replacement entry preset in the partition to form a standardized query set without any real location.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data query, in particular to a communication information query method and device based on cloud computing, equipment and storage medium. BACKGROUND

[0002] Under the rapid development of mobile Internet, short messages, multimedia messages, instant messaging messages, voice calls, emails and notification information in various embedded applications in mobile terminals such as smart phones and tablets are often collected and gathered to the cloud through cloud computing technology, and can be quickly queried through the construction of a unified communication information management and query platform. Cloud computing technology deploys a lightweight collection component on the mobile terminal side, and under the premise of user authorization or business triggering, regularly or in real time, the local communication records are packaged, encrypted and transmitted to the cloud data center, and stored and indexed by the database system in the cloud. The cloud usually uses relational databases, distributed key-value databases or full-text query engines as basic components, and provides query interfaces based on time, number, account, keyword and even rule expressions to the upper layer, for case handling personnel or auditors to perform query operations through the web page or special client.

[0003] In the prior art, there are various cloud computing information query management architectures, such as converting uploaded communication information into a unified data format for storage, and the system constructs an index structure for different dimensions; larger systems also use database extension technologies such as sharding, routing and caching to support the query of hundreds of millions of communication information. With the increasing demand for the credibility of query results, verifiable query technology is introduced in the database in the prior art, and an authentication data structure is constructed on the cloud communication information to solve the problem of "whether the cloud tells the truth"; however, this scheme can only prove that "these records returned are indeed in the current version of the evidence base", but it is difficult to prove "whether there are other records that meet the conditions but are intentionally missed".

[0004] In addition, based on the strong sensitivity of the communication content and the query condition itself, a large number of cloud query schemes for privacy protection appear in the prior art, for example, a private information query (PIR) based manner, for example, a PIR protocol uses homomorphic encryption, multi-party computation or a garbled circuit and other cryptographic tools, so that the user can obtain target data from the server without exposing the access location; a multi-server PIR protocol distributes database copies to multiple non-colluding servers, and by randomly splitting the query vector into multiple sub-vectors and sending them to each server, any one of the servers cannot independently infer the real query location; however, this scheme theoretically improves the efficiency, but assumes that the servers do not collude at all, and once the non-collusion assumption is broken by the actual operation mode, the original privacy protection relying on information splitting is basically invalid, and the large calculation and communication overhead also makes it difficult to run in a real business system for a long time.

[0005] In order to further reduce the calculation overhead of the terminal side, in recent years, a scheme of using a hardware trusted execution environment (such as Intel SGX) to assist query has appeared. Such a scheme usually constructs a logically isolated "secure enclave" inside the cloud server, and performs query logic, decrypts data or runs sensitive algorithms inside the enclave, and the server operating system and other applications cannot directly access the keys and intermediate data in the enclave. In order to meet the comprehensive analysis needs across cases and across terminals, some systems also establish a unified communication behavior analysis engine on the cloud. The engine provides higher-level query semantics on top of the evidence library, such as multi-person conversation link analysis, frequent contact number mining, event timeline automatic reconstruction, etc. However, although this scheme can provide code and data isolation protection at the hardware level, many systems in practical applications tend to encapsulate the entire query engine or database instance directly into the SGX enclave. However, the available memory space of the enclave is limited, and frequent cross-border calls and page swapping in and out will cause significant performance loss, and it is difficult to meet the real-time requirements in large-scale evidence library scenarios.

[0006] Moreover, the above-mentioned schemes provided in the prior art are mostly designed from the perspective of general database or general file storage, and do not fully consider the particularity of mobile terminal communication information in data structure, query type and security requirements, such as a large number of records with time as the main line, highly concentrated participant information, and fuzzy matching requirements in message text, etc. Therefore, the existing communication information query scheme in the cloud computing environment is still difficult to provide more reliable security protection in multiple aspects. SUMMARY

[0007] Based on this, the application provides a communication information query method and device based on cloud computing, which introduces double-server cooperation at the architecture level, combines pre-processing PIR and verifiable computation at the protocol level, and fully utilizes cloud computing resources and trusted hardware capabilities at the implementation level, so as to achieve a better balance between reliability, efficiency and privacy protection.

[0008] In an embodiment, the application provides a communication information query method based on cloud computing, comprising:

[0009] S1, obtaining an input query request and performing standardized processing on the input query request to obtain a converted standardized query set;

[0010] S2, sending the converted standardized query set to an untrusted execution environment of a query cloud node, and obtaining a parity check value and a corresponding proof vector calculated by the untrusted execution environment according to the records corresponding to the standardized query set; wherein the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from a cloud storage center, performs an exclusive or operation on the read records one by one to obtain the corresponding parity check value, and calculates the corresponding proof vector according to the obtained parity check value;

[0011] S3, performing inverse transformation on each target index in the standardized query set according to the preprocessed prompt entry set, the replacement entry set and the calculated parity check value to obtain a query result set;

[0012] S4, verifying the parity check value and the corresponding proof vector using a verification function, and determining the query result according to the verification result.

[0013] Further, S1 comprises:

[0014] S11, performing semantic analysis on the input query request to obtain an analyzed query tuple;

[0015] S12, filtering to obtain a target index set satisfying the query tuple according to a keyword index file;

[0016] S13, finding the prompt entry set and the replacement entry set obtained by preprocessing, finding the random index set number of the same partition number in the prompt entry set for each target index in the target index set, determining the corresponding random index set, replacing the position of the target index partition with the replacement entry position corresponding to the replacement entry set, and constructing to obtain the converted standardized query set.

[0017] Further, in S11, the analyzed query tuple is expressed as, , wherein, is the query time, a keyword Boolean expression, representing a set of aggregation operations expected to be executed.

[0018] Further, in S13, the pre-processing obtains a set of hint entries and a set of replacement entries, including:

[0019] S131, generating a public key parameter and a random master key, and deriving a key sequence of a set of pseudo-random functions;

[0020] S132, generating a plurality of cross-partition random index sets using the pseudo-random functions;

[0021] S133, sending the key sequence of the pseudo-random functions and the random index set to the hint cloud node, and obtaining the set of hint entries and the set of replacement entries calculated by the hint cloud node according to the key sequence and the random index set of the pseudo-random functions; wherein the hint cloud node calculates the parity check value of the corresponding position content according to the random index set of each partition, and forms the set of hint entries and the set of replacement entries according to the parity check value.

[0022] Further, in S133, the parity check value of the byte XOR of the record content at the corresponding position calculated for each random index set is as follows:

[0023] wherein, is the record in the database, are the partition number and the offset in the partition of the record, respectively, is the number of the random index set, and the set of hint entries formed thereby is wherein, is the key sequence of the pseudo-random functions; and the set of replacement entries formed thereby is wherein, is the position of the record, is the content of the record.

[0024] Further, in S13, when the set corresponding to the target index is not found in the existing set of hint entries, a random index set is generated as the random index set corresponding to the current target.

[0025] In an embodiment, the present application provides a communication information query method based on cloud computing, comprising:

[0026] S1, the security area of the query cloud node performs semantic analysis on the input query request to obtain an analyzed query tuple;

[0027] S2, the security area filters a target index set satisfying the query tuple according to a keyword index file;

[0028] S3, the security area looks up the obtained pre-processed hint entry set and replacement entry set, looks up a random index set with the same partition number in the hint entry set for each target index of the target index set, determines the corresponding random index set, replaces the position of the target index corresponding partition with the replacement entry position corresponding to the replacement entry set of the target index, constructs a converted standardized query set, and sends the converted standardized query set to an untrusted execution environment of a query cloud node;

[0029] S4, the untrusted execution environment of the query cloud node reads a record corresponding to the standardized query set from a cloud storage center, performs an exclusive OR operation on each record read, obtains a corresponding parity check value, calculates a corresponding proof vector according to the obtained parity check value, and returns the proof vector to the security area;

[0030] S5, the security area performs inverse transformation on each target index in the standardized query set according to the pre-processed hint entry set, the replacement entry set, and the calculated parity check value, to obtain a query result set.

[0031] In an embodiment, the present application also provides a communication information query device based on cloud computing, comprising:

[0032] An acquisition module is configured to acquire an input query request and perform standardized processing on the input query request to obtain a converted standardized query set.

[0033] A transmission module is configured to send the converted standardized query set to an untrusted execution environment of a query cloud node, and acquire a parity check value and a corresponding proof vector calculated by the untrusted execution environment according to a record corresponding to the standardized query set; wherein the untrusted execution environment of the query cloud node reads the record corresponding to the standardized query set from a cloud storage center, performs an exclusive OR operation on each record read, obtains a corresponding parity check value, and calculates a corresponding proof vector according to the obtained parity check value.

[0034] A conversion module is configured to perform inverse transformation on each target index in the standardized query set according to a pre-processed hint entry set, a replacement entry set, and a calculated parity check value, to obtain a query result set.

[0035] A verification module is configured to verify a parity check value and a corresponding proof vector by using a verification function, and determine a query result according to a verification result.

[0036] In an embodiment, the present application also provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the communication information query method based on cloud computing when executing the computer program.

[0037] In an embodiment, the application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the cloud computing-based communication information query method.

[0038] The cloud computing-based communication information query method, through the standardized construction method of the linkage of the query index, the prompt item set and the replacement item set, the safety area first obtains a target index set from the local keyword-position mapping according to the time interval and the keyword condition input by the user; then, for each target index, the corresponding prompt item set is found to find the partition to which the target index belongs, and the real position is replaced by the replacement item preset in the partition to form a standardized query set without any real position. The method ensures that the external untrusted execution environment of the query cloud node always only observes the fixed replacement position and the random false position, and it is difficult to restore the real query intention of the user through the access track. BRIEF DESCRIPTION OF DRAWINGS

[0039] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and are used to interpret the application together with the description of the illustrative embodiments of the present application. The accompanying drawings should not be construed as an improper limitation of the present application.

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the accompanying drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and other accompanying drawings can be obtained by those skilled in the art without any creative labor on the basis of these accompanying drawings.

[0041] In addition, the drawings are not drawn in a 1:1 ratio, and the relative sizes of the various elements are only exemplarily drawn in the drawings, but not necessarily drawn in true scale.

[0042] Figure 1 The application environment diagram of the cloud computing-based communication information query method provided by an embodiment of the present application;

[0043] Figure 2 The flowchart of the cloud computing-based communication information query method provided by an embodiment of the present application;

[0044] Figure 3 Another flowchart of the cloud computing-based communication information query method provided by an embodiment of the present application;

[0045] Figure 4 The structural block diagram of the cloud computing-based communication information query device provided by an embodiment of the present application;

[0046] Figure 5The internal structure diagram of the computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application are described in detail below with reference to the drawings. In the following description, a large number of specific details are set forth in order to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without departing from the concept of the present application, so the present application is not limited to the specific embodiments disclosed below.

[0048] The communication information query method based on cloud computing provided by the embodiment of the present application can be applied to the application environment as shown in the figure. Figure 1 As shown in the figure, the terminal 102 communicates with the cloud storage center 104 and the query cloud node 106 through the network; the query cloud node 106 communicates with the prompt cloud node 108 through the background channel.

[0049] The terminal 102 (Client / Agent) can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices, the Internet of Things devices can be smart speakers, smart televisions, smart air conditioners, smart vehicle devices and the like, and the portable wearable devices can be smart watches, smart bracelets, head-mounted devices and the like, responsible for collecting communication information such as call records, short message records and instant messaging messages under user authorization, business triggering or timing, and uploading to the cloud storage center 104 through a secure channel; the terminal 102 itself does not save long-term communication information, but only retains necessary session information.

[0050] The cloud storage center 104 (Evidence Store) can be implemented by an independent server or a server cluster composed of multiple servers. Located in the cloud computing platform, used for centralized storage of communication information data from different terminals. Specifically, the cloud storage center can be a distributed database, an object storage or a log system, and the present application does not limit the specific implementation, which provides an interface for reading information according to record numbers.

[0051] The query cloud node 106 (Query Node, referred to as Q node) can also be implemented by an independent server or a server cluster composed of multiple servers. Responsible for obtaining online query requests from terminals and processing them. The Q node integrates a secure processing subsystem (hereinafter referred to as a secure area) formed by a trusted execution environment (such as Intel SGX) inside. The secure area is used to parse query statements, maintain keys, reconstruct and verify query results and drive prompt refresh logic; the untrusted execution environment outside the secure area is responsible for large-scale data scanning and basic operator calculation.

[0052] Hint Node (H-Node): A logical server that can be deployed in the same cloud computing platform as the Cloud Storage Center 104 but is physically independent. The H-Node is responsible for generating hint entries and replacement entries for privacy protection and result verification during the offline phase, and participating in refreshing the corresponding hint entries and replacement entries as needed during the online phase.

[0053] It is understood that the above-mentioned architecture of the present application can be deployed as a standalone "communication information cloud query platform", or integrated into existing electronic information forensics systems or enterprise log audit systems as middleware components. At the software level, the secure area of the query cloud node can implement the core protocol logic using C / C++ or Rust that supports SGX, and the external untrusted execution environment can use any web framework or microservice architecture to implement the query interface and task scheduling. At the hardware level, the Q-Node and H-Node can be deployed on different physical servers in the same data center, or in different cloud regions to improve resistance to collusion. At the interface level, the system provides a unified query interface based on REST / JSON or gRPC, and users only need to submit query conditions and receive results and verification status without needing to understand the internal two-node collaboration mechanism.

[0054] The present application decouples the "cloud storage center" and "query service node" in the cloud, introducing a hint cloud node (Hint Node) responsible only for preprocessing and a query cloud node (Query Node) responsible for online query and result return. The hint cloud node only contacts the index set selected by the pseudo-random function and the encrypted communication information, and does not participate in user query semantic analysis; the query cloud node only performs XOR calculation and proof generation based on the standardized query vector without knowing the hint entries and real indexes. Through this dual-cloud separation architecture, the trust root is minimized to the inside of the hardware-measurable secure area without changing the existing cloud storage system, realizing secure communication information query under the realistic deployment assumption that "the cloud cannot be fully trusted".

[0055] In the embodiment of the present application, the database in the cloud storage center that saves communication information data is denoted as: , where the i-th record can be abstracted as a triple . represents the timestamp field, indicating the time when the call or message occurs; represents the numerical field, which can represent call duration, amount, transfer value, etc.; represents the keyword label set, such as the caller number, the called number, the session account number, the location label, the case number, etc.

[0056] The cloud storage center divides all records into several logical partitions with fixed length:

[0057]

[0058] The partitions contain the same number of records, denoted as partition size B, and the number of partitions satisfies , and the location of each record in the database is uniquely identified by "partition number + offset in the partition", denoted as . .

[0059] In one embodiment, as shown in Figure 2 , the present application provides a cloud computing-based communication information query method. Taking the query cloud node 106 in Figure 1 as an example, the "secure processing subsystem" formed by the trusted execution environment (such as Intel SGX) integrated in the query cloud node performs, including the following steps:

[0060] S1, obtaining the input query request and performing standardized processing on the input query request to obtain a converted standardized query set;

[0061] Specifically, step S1 includes:

[0062] S11, performing semantic analysis on the input query request to obtain an analyzed query tuple;

[0063] In order to cover the actual case handling scenarios, the present application supports three types of basic query forms:

[0064] (1) Boolean combination query: the user gives a time interval and a keyword Boolean expression , for example, "call between number A and number B AND involving keyword 'transfer'". The system needs to return all records that satisfy the time condition and the keyword set satisfy the Boolean expression.

[0065] (2) Range filtering query: increase the numerical interval filtering on the basis of the Boolean condition, such as "call duration is more than 60 seconds and the theme contains 'international roaming'" and the like.

[0066] (3) Aggregation analysis query: taking the results of the previous two types of queries as input, performing sum, count, maximum, minimum or average value, etc. Aggregation functions on fields , used for case amount statistics, frequent contact analysis and other advanced needs.

[0067] Specifically, when the security zone of query cloud node Q receives a user's query request, it first performs semantic parsing on the user's natural language or structured query statement, resolving it into a unified query tuple: ,in Represents the set of aggregate operations to be performed (can be empty).

[0068] S12, Filter the target index set that satisfies the query tuple based on the keyword index file;

[0069] Specifically, Boolean expressions are indexed through a keyword index file. Mapped to a set of target locations recorded in the database Then, a local filter is performed based on the query time and the numerical range to obtain the target index set that satisfies the above query tuples. .

[0070] S13, obtain the preprocessed prompt item set and replacement item set, for each target index in the target index set, find the random index set number with the same partition number in the prompt item set, determine the corresponding random index set, replace the position of the partition corresponding to the target index with the position of the replacement item corresponding to the replacement item set, and construct the transformed standardized query set.

[0071] Specifically, this invention performs a preprocessing step during system deployment or periodic maintenance, and stores the preprocessed random index set, prompt item set, and replacement item set in the secure area of ​​the query cloud node. When a user's query request is received, the query request can be standardized and transformed using the corresponding prompt item set and replacement item set, achieving privacy protection and verifiable results during communication information queries. It is understood that preprocessing can be implemented offline. Specifically, step S13, which involves preprocessing to obtain the prompt item set and replacement item set, includes:

[0072] S131, generate public key parameters and random master key, and derive a key sequence of pseudo-random functions;

[0073] Specifically, querying the integrated security zone in cloud node 106, the security zone generates public key parameters over a large number field and a random master key K based on the security parameter λ, and derives a key sequence {K} of a pseudo-random function. 1， K 2， ..., K N The generated public parameters are exposed to the external untrusted execution environment of nodes H and Q, including the random master key K and the key sequence {K} of the pseudo-random function. j It is encrypted and stored within the secure zone.

[0074] S132, generating a plurality of random index sets across partitions by using a pseudo-random function;

[0075] wherein the pseudo-random function is used to generate a plurality of random index sets across partitions The generated random index sets are: . wherein d is the size of the random index set, which is a function of the number of partitions M in the cloud storage center database, for example , to ensure that each set covers multiple different partitions. Each generated random index set is sent to the H node as an index template for subsequent hint calculation.

[0076] S133, sending the key sequence of the pseudo-random function and the random index set to the hint cloud node, and obtaining the hint entry set and the replacement entry set calculated by the hint cloud node according to the pseudo-random function on the key sequence and the random index set; wherein the hint cloud node calculates the parity value of the content at the corresponding position according to the random index set of each partition, and forms the hint entry set and the replacement entry set according to the parity value.

[0077] Specifically, after the H node receives and , for each set , the parity value of the byte XOR of the record content at the corresponding position is calculated: , and the H node forms the hint entry set . At the same time, a record is randomly selected for each partition as a replacement entry, and its position is recorded as , and the content is recorded as to form the replacement entry set , and the formed hint entry set and replacement entry set are sent to the security area of the Q node through a secure channel for encryption and storage.

[0078] After this preprocessing, the system has established a random hint system decoupled from the original database structure without accessing specific case queries, providing a basis for privacy protection and result verification in the online query stage.

[0079] In this step, after the target index set satisfying the query tuple is screened, for each target index , the security area finds the random set number j containing the same partition number in the pre-stored hint entry set Hint, and obtains its random index set . Then, the position originally located in the partition in is replaced by the replacement entry position preset for the partition in the preprocessing stage​ , construct a set of standardized queries . In this way, the set of queries exposed to the outside no longer contains real offsets , but uniformly uses the offsets of the replacement entries.

[0080] The present application generates a global random index set for each partition in the offline stage using a pseudo-random function PRF, and calculates the XOR check value for each random index set by the hint cloud node; at the same time, a number of records are randomly selected for each partition to form a set of replacement entries. The hint entry set and the replacement entry set are cached in the secure area in encrypted form, which is used for subsequent standardized construction and result reconstruction of online queries. By moving a large amount of computation and storage overhead to the preprocessing stage, the communication volume and computational complexity of online queries can be significantly reduced without increasing the burden on the terminal.

[0081] In an embodiment, if a certain target index cannot be found in the existing hint entry set, the secure area randomly constructs a completely unrelated index set , ensuring that the system appears to the outside as the same number of query requests, statistically hiding the real access times.

[0082] Finally, the secure area obtains a set of standardized query sets and sends them to the external untrusted execution environment of the Q node for execution. The external untrusted execution environment can only see a certain position containing several partitions in each set, and does not know which one corresponds to the real target.

[0083] The present application proposes a standardized construction method of "query index-hint entry set-replacement entry set" linkage: the secure area first obtains the target index set from the local keyword-position mapping according to the time interval and keyword condition input by the user; then, for each target index, find its corresponding partition in the hint entry set, replace the real position with the pre-set replacement entry of the partition, and form a standardized query set without any real position; if there is no matching hint, construct a false query set of the same size to cover the access times. This method ensures that the cloud side always only observes fixed replacement positions and random false positions, making it difficult to restore the user's real query intention through access tracks.

[0084] S2, send the converted standardized query set to the untrusted execution environment of the query cloud node, and obtain the parity check value calculated by the untrusted execution environment according to the records corresponding to the standardized query set and the corresponding proof vector; wherein the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs XOR operation on the read records one by one, obtains the corresponding parity check value, and calculates the corresponding proof vector according to the obtained parity check value;

[0085] Specifically, the converted normalized query set is sent to the untrusted execution environment of the query cloud node, the external untrusted execution environment of the Q node reads the records involved in each set according to the target index of the normalized query set from the cloud storage center, and performs an exclusive or operation on each record to obtain the corresponding parity value: Meanwhile, according to the authentication data generated in the preprocessing stage, the proof vector is calculated for each The specific implementation can adopt group exponent commitment, bilinear pair verification or hash accumulator, and the present application does not limit the specific cryptographic algorithm. Finally, the untrusted execution environment of the Q node returns to the secure area.

[0086] S3, according to the preprocessed hint entry set, the replacement entry set and the calculated parity value, the inverse transformation is performed on each target index in the normalized query set to obtain the query result set;

[0087] Specifically, the secure area performs inverse transformation on each target query index according to the preprocessed hint entry set and replacement entry set. Let the target index be corresponding to the hint set number j, then the parity value of the record known in the preprocessing stage is and the corresponding parity value in the target query is The difference between the two is that: the real position is replaced by Therefore, the secure area can recover the target record content by the following formula: wherein The preprocessing stage has been calculated by the H node and saved in the secure area. Repeat the above operation for all real indexes, and the query result set can be obtained, if the current query contains an aggregate function , the secure area performs the corresponding summation, extreme value or average operation on the numerical field of the set to obtain the unified aggregate result.

[0088] S4, the verification function is used to verify the parity value and the corresponding proof vector, and the query result is determined according to the verification result.

[0089] Specifically, the secure area uses the hint entries and replacement entries consumed by the current query saved in the preprocessing stage to verify each parity value and proof vector ​Verification is performed. If all target query corresponding verification functions return 1, it is considered that the returned query result comes from an unaltered database and is not maliciously deleted; otherwise, an error flag is immediately returned to the user, and an alarm or audit process can be triggered. Through the above reconstruction and verification combination, even if the Q node maliciously tampers with the intermediate result or attempts to omit part of the record, it will lead to the inexistence of the authentication relationship, so as to be detected by the security zone.

[0090] The present application encapsulates the XOR reconstruction and correctness verification in the security zone in the query cloud node: the untrusted execution environment outside the query cloud node only performs XOR operation on the evidence records according to the standardized query set and generates a lightweight proof, and the security zone recovers the real records in the form of 'prompt entry ⊕ record content ⊕ replacement entry' by using the prompt entry and replacement entry cached in the preprocessing stage, and calls the bilinear pairing and other cryptographic primitives to quickly verify the proof vector. This mechanism avoids the leakage of evidence plaintext or key parameters in the untrusted environment, while ensuring that any tampering or omission of records on the cloud side cannot deceive the verification process.

[0091] In order to further illustrate the query method of the present application, the following will illustrate a communication information query method based on cloud computing provided by an embodiment of the present application from the perspective of the interaction between the security zone and the untrusted execution environment of the query cloud node, as shown in Figure 3 As shown in the figure, it includes the following steps:

[0092] S1, the security zone of the query cloud node performs semantic analysis on the input query request to obtain the parsed query tuple;

[0093] S2, the security zone filters the target index set satisfying the query tuple according to the key index file;

[0094] S3, the security zone finds the prompt entry set and the replacement entry set obtained by preprocessing, finds the random index set number of the same partition number in the prompt entry set for each target index of the target index set, determines the corresponding random index set, replaces the position of the target index corresponding partition with the replacement entry position corresponding to the replacement entry set, constructs the converted standardized query set, and sends it to the untrusted execution environment of the query cloud node;

[0095] S4, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs XOR operation on the read records one by one, obtains the corresponding parity check value, calculates the corresponding proof vector according to the obtained parity check value, and returns it to the security zone;

[0096] S5, the security zone performs an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a query result set.

[0097] Furthermore, to prevent the pre-processed prompt entries and replacement entries from being exhausted after multiple queries, in this embodiment of the invention, after each query is completed, the security zone of the query cloud node will prompt the user to start a refresh process. The refresh process is as follows:

[0098] (1) The Q node safety zone randomly selects several new indexes in each involved partition based on the set of prompt numbers J consumed in the current query;

[0099] (2) Request H node to recalculate parity check value and authentication information according to these indices through the background channel to form new prompt entries and replacement entries;

[0100] (3) Replace the consumed parts with new prompts to achieve "rolling updates" of auxiliary information;

[0101] (4) If necessary, the security zone may periodically expand the size of the index set to accommodate the growth of the database size.

[0102] To address the issue of preprocessed auxiliary information being gradually "consumed" after multiple queries, this invention designs an online prompt refresh process: After each query, the security zone, based on the prompt number actually used in this round, re-extracts random indexes from each partition and requests the prompt node or local algorithm to recalculate the checksum and proof parameters, replacing the old entries with new prompts and replacement entries. This refresh process is executed asynchronously with business queries, without affecting user interface latency, and can maintain system availability for a long time without repeating full preprocessing, avoiding the problem of "system failure when auxiliary information is exhausted" in traditional preprocessing schemes.

[0103] The refresh process is asynchronous with the user's query perspective, and does not affect the real-time performance of the front-end interface. Since only a limited number of prompts are refreshed for each query, the preprocessing overhead is spread across a large number of queries, thus enabling the system to maintain stable safety margins and performance over long-term operation.

[0104] This invention provides a cloud-based communication information query method where, when a user initiates a query, a two-way secure session is established only with the Q node; the H node and Q node exchange auxiliary keys through a backend channel. No single cloud node can simultaneously possess "complete communication information data + query semantics + auxiliary key," thus reducing reliance on a single cloud service provider in the architecture. This invention, through a combined design of "data model standardization + dual-cloud node collaboration + preprocessing hint system + security zone reconstruction and verification," constructs a verifiable query method and system for mobile terminal communication information without altering existing cloud computing infrastructure. This approach balances query functionality and performance while significantly enhancing the ability to technically constrain cloud service providers.

[0105] It should be understood that, although Figures 2-3 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 2-3 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0106] Based on the same inventive concept, such as Figure 4 As shown in the illustration, this application also provides a cloud computing-based communication information query device, including:

[0107] The acquisition module M1 is used to acquire the input query request and perform standardization processing on the input query request to obtain the transformed standardized query set;

[0108] The transmission module M2 is used to send the converted standardized query set to the untrusted execution environment of the query cloud node, and to obtain the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value;

[0109] The transformation module M3 is used to perform an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a set of query results.

[0110] The verification module M4 uses a verification function to verify the parity check value and the corresponding proof vector, and determines the query result based on the verification result.

[0111] Other limitations regarding the cloud-based communication information query device can be found in the limitations of the cloud-based communication information query method described above, and will not be repeated here. Each module in the aforementioned cloud-based communication information query device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0112] In one embodiment, such as Figure 5 As shown, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0113] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0114] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0115] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A communication information query method based on cloud computing, characterized in that, include: S1, obtain the input query request, and perform standardization processing on the input query request to obtain the transformed standardized query set; S2, the transformed standardized query set is sent to the untrusted execution environment of the query cloud node, and the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set are obtained; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; S3, based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, perform an inverse transformation on each target index in the standardized query set to obtain a query result set; S4. Use the verification function to verify the parity check value and the corresponding proof vector, and determine the query result based on the verification result. S1 includes: S11, perform semantic parsing on the input query request to obtain the parsed query tuple; S12, Filter the target index set that satisfies the query tuple based on the keyword index file; S13, find and obtain the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, find the random index set number with the same partition number in the prompt entry set, determine the corresponding random index set, replace the position of the partition corresponding to the target index with the position of the replacement entry corresponding to the replacement entry set, and construct the transformed standardized query set. In S13, the preprocessing yields a set of prompt entries and a set of replacement entries, including: S131, generate public key parameters and random master key, and derive a key sequence of pseudo-random functions; S132, using a pseudo-random function to generate several sets of random indices across partitions; S133, the key sequence and random index set of the pseudo-random function are sent to the prompt cloud node, and the prompt cloud node obtains the prompt entry set and replacement entry set calculated by the prompt cloud node based on the key sequence and random index set of the pseudo-random function; wherein, the prompt cloud node calculates the parity check value of the content at the corresponding position based on the random index set of each partition, and forms the prompt entry set and replacement entry set based on the parity check value.

2. The communication information query method according to claim 1, characterized in that, In S11, the parsed query tuple is represented as follows: ,in, For query time, For keyword Boolean expressions, This represents the set of aggregate operations that are expected to be performed.

3. The communication information query method according to claim 1, characterized in that, In S133, the parity check value of the record content at the corresponding position for each random index set is calculated by byte XOR as follows: in, For records in the database, These are the partition number and the offset within the partition, respectively. For a set of random indices, The set of random indexes is the number of the set of prompt entries. ,in, The key sequence is a pseudo-random function; the set of replacement entries it forms is... ,in, For the location to be recorded, The content to be recorded.

4. The communication information query method according to claim 1, characterized in that, In S13, if the set corresponding to the target index is not found in the existing set of prompt entries, a random set of indexes is constructed as the random index set corresponding to the current target.

5. A communication information query method based on cloud computing, characterized in that, include: S1, the security zone of the query cloud node performs semantic parsing on the input query request to obtain the parsed query tuple; S2, the security zone filters the target index set that satisfies the query tuple based on the keyword index file; S3, the security zone search obtains the preprocessed prompt entry set and replacement entry set, for each target index in the target index set, the random index set number with the same partition number is searched in the prompt entry set, the corresponding random index set is determined, the position of the partition corresponding to the target index is replaced with the position of the replacement entry corresponding to the replacement entry set, the converted standardized query set is constructed, and it is sent to the untrusted execution environment of the query cloud node. S4, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, calculates the corresponding proof vector based on the obtained parity check value, and returns it to the secure area; S5, the security zone performs an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a set of query results; In S3, the preprocessed set of prompt entries and the set of replacement entries include: S131, generate public key parameters and random master key, and derive a key sequence of pseudo-random functions; S132, using a pseudo-random function to generate several sets of random indices across partitions; S133, the key sequence and random index set of the pseudo-random function are sent to the prompt cloud node, and the prompt cloud node obtains the prompt entry set and replacement entry set calculated by the prompt cloud node based on the key sequence and random index set of the pseudo-random function; wherein, the prompt cloud node calculates the parity check value of the content at the corresponding position based on the random index set of each partition, and forms the prompt entry set and replacement entry set based on the parity check value.

6. A cloud computing-based communication information query device, used to implement the method according to any one of claims 1 to 4, characterized in that, include: The acquisition module is used to acquire the input query request and perform standardization processing on the input query request to obtain the transformed standardized query set; The transmission module is used to send the converted standardized query set to the untrusted execution environment of the query cloud node, and to obtain the parity check value and the corresponding proof vector calculated by the untrusted execution environment based on the records corresponding to the standardized query set; wherein, the untrusted execution environment of the query cloud node reads the records corresponding to the standardized query set from the cloud storage center, performs an XOR operation on each of the read records to obtain the corresponding parity check value, and calculates the corresponding proof vector based on the obtained parity check value; The transmission module is used to perform an inverse transformation on each target index in the standardized query set based on the preprocessed set of prompt entries, the set of replacement entries, and the calculated parity check value, to obtain a set of query results. The transmission module uses a verification function to verify the parity check value and the corresponding proof vector, and determines the query result based on the verification result.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images