Order-preserving encryption method, data query method and data storage method

Abstract

The invention provides an order-preserving encryption method, a data query method and a data storage method. The order-preserving encryption method comprises the following steps: acquiring plaintext data, and performing order-preserving random mapping on the plaintext data to obtain first order-preserving coded data; carrying out decryptable encryption processing on the plaintext data to obtain decryptable ciphertext data; and splicing the first order-preserving coded data and the decryptable ciphertext data to obtain order-preserving ciphertext data. And according to the size sequence relationship of the first order-preserving codes, operations such as sequence-related comparison sorting query and the like in the secret state database can be quickly completed, and a plaintext form result corresponding to query is obtained. Compared with a common order-preserving encryption algorithm, the order-preserving coding encryption method and device can realize an efficient and safe order-preserving coding encryption function with a controllable ciphertext length.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method for preserving order encryption, a method for querying data, and a method for storing data. Background Technology

[0002] Encryption systems are responsible for converting plaintext data into ciphertext data to ensure the confidentiality and security of data during storage, transmission, or computation. To perform order-dependent operations on ciphertext data, encryption systems prioritize using order-preserving encryption algorithms. However, these algorithms struggle to balance security and efficiency, often resulting in order-dependent encryption operations incurring significant storage and computational costs.

[0003] Therefore, how to ensure the security of plaintext data encryption while achieving more efficient and reliable order-preserving encryption and avoiding lengthy ciphertext data and complex encryption operations as much as possible has become an important problem that urgently needs to be solved. Summary of the Invention

[0004] This application provides a sequence-preserving encryption method, a data query method, and a data storage method to solve the problems of lengthy ciphertext data and complex encryption operations in current methods.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows: Firstly, an order-preserving encryption method is provided, including: Obtain plaintext data; The plaintext data is subjected to order-preserving random mapping to obtain the first order-preserving encoded data; The plaintext data is encrypted in a decryptable manner to obtain decryptable ciphertext data; The first sequence-preserving encoded data is concatenated with the decryptable ciphertext data to obtain the sequence-preserving ciphertext data.

[0006] Secondly, a data query method is provided, including: Send a encrypted query statement to the server, wherein the encrypted query statement includes encrypted sequential query morphemes; Receive the target ordered ciphertext data returned by the server according to the ciphertext query statement; Obtain the first order-preserving encoded data stored locally on the client, and extract decryptable ciphertext data from the target order-preserving ciphertext data based on the first order-preserving encoded data; The decryptable ciphertext data is decrypted using the decryption key to obtain plaintext data.

[0007] Thirdly, a data storage method is provided, including... Receive ordered ciphertext data sent by the client, wherein the ordered ciphertext data is obtained by concatenating first ordered encoded data and decryptable ciphertext data; The ordered ciphertext data is stored.

[0008] Fourthly, an electronic device is provided, comprising: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method as described in the first, second, or third aspect.

[0009] Fifthly, a computer-readable storage medium is provided, wherein when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method as described in the first, second, or third aspect.

[0010] A sixth aspect provides a computer program product comprising a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform some or all of the steps of the method described in the first, second, or third aspect.

[0011] In this embodiment, by performing order-preserving random mapping on the plaintext data to obtain first order-preserving encoded data, the first order-preserving encoded data hides sensitive information such as the original spacing and distribution characteristics of the plaintext, retaining only the order relationship. This avoids leaking the frequency information of the plaintext data and improves data security. By performing decryptable encryption processing on the plaintext data to obtain decryptable ciphertext data, the decryption function of the ciphertext is realized. By concatenating the first order-preserving encoded data with the decryptable ciphertext data, order-preserving ciphertext data is obtained. Therefore, based on the size and order relationship of the first order-preserving encoding, operations such as order-related comparison, sorting, and querying in the encrypted database can be quickly completed to obtain the corresponding plaintext form result. This embodiment utilizes a small number of mathematical operations to achieve efficient encryption operations, providing practical decryptable order-preserving ciphertext. While ensuring secure and efficient order-preserving encryption of plaintext data, the generated ciphertext with controllable length saves storage costs and effectively solves many problems faced by traditional order-preserving encryption technologies. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is an illustrative system architecture diagram provided in an embodiment of this application; Figure 2 This is a flowchart illustrating an embodiment of the order-preserving encryption method of this application; Figure 3 This is a schematic diagram illustrating the process of generating first order-preserving encoded data according to an embodiment of this application; Figure 4 This is a schematic diagram of the process for generating first order-preserving encoded data according to another embodiment of this application; Figure 5 This is a flowchart illustrating a data query method according to an embodiment of this application; Figure 6 This is a schematic flowchart of a data storage method according to an embodiment of this application; Figure 7 This is a schematic diagram of a data processing flow according to an embodiment of this application; Figure 8 This is a schematic diagram of the structure of an embodiment of the order-preserving encryption system of this application; Figure 9 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application; Figure 10 This is a schematic diagram of the structure of an electronic device according to another embodiment of this application. Detailed Implementation

[0014] The primary task of a cryptographic system is to encrypt raw data to ensure privacy and security during storage, transmission, and processing. To perform order-based operations on data in an encrypted state, systems tend to employ order-preserving encryption (OPE). However, while ensuring security, this technique often sacrifices efficiency, potentially requiring more storage and computational resources when performing order-related encryption operations.

[0015] The mainstream encryption system currently uses Modified Order Preserving Encryption (mOPE) algorithms based on order-preserving coding trees. These algorithms rely on order-preserving index structures for efficient order-preserving encoding and use variable ciphertext to ensure security. However, this algorithm lacks differentiation for identical plaintext values, still revealing frequency information and making it vulnerable to statistical attacks. Furthermore, decryption requires reverse matching to find the order-preserving index structure, necessitating constant maintenance and updates, consuming significant local storage and computing resources. Similarly, the commonly used Order-Revealing Encryption (ORE) algorithm first groups the plaintext byte-by-byte and then performs a series of complex mathematical operations to achieve decryptable order-preserving encryption. However, its encryption computation efficiency is not ideal in practical use, and its ciphertext length is excessively long, placing considerable storage pressure on the system.

[0016] Therefore, in practical applications, how to reduce the consumption of storage space and computing resources caused by encryption while ensuring the security of plaintext data is a pressing problem. This issue is particularly prominent in the context of the big data era, where the surge in data volume has exacerbated it. We need an encryption method that can both maintain data order and efficiently process large amounts of data to cope with the increasingly complex data security environment.

[0017] This application provides a sequence-preserving encryption method, a data query method, and a data storage method, which specifically combines sequence-preserving encryption technology and symmetric encryption technology to achieve efficient, secure, and controllable ciphertext length sequence-preserving encoding encryption function.

[0018] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in this application will be clearly and completely described below with reference to the accompanying drawings of one or more embodiments. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this application.

[0019] The terms "first," "second," etc., used in the embodiments of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data used in this way can be interchanged where appropriate so that this application can be implemented in orders other than those illustrated or described herein. Furthermore, in this application and in the claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0020] Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application. Figure 1 The implementation environment shown includes: client 110, network layer 120 and server 130, wherein client 110 is equipped with an order-preserving encryption system 111, and server 130 is equipped with a storage system 131 and a ciphertext calculation module 132.

[0021] Client 110 can be an application or a module within an application. It can be used to send encrypted data append requests or sequence-related query requests to server 130 via network layer 120, and can also be used to receive encrypted feedback from server 130 via network layer 120. Client 110 can encrypt plaintext instructions or decrypt encrypted feedback using the order-preserving encryption system 111.

[0022] The order-preserving encryption system 111 is used to encrypt plaintext instructions created by the client 110 or to decrypt ciphertext feedback received by the client 110.

[0023] The network layer 120 is used to receive encryption instructions from one or more clients 110 and send them to the server 130 in sequence, or to receive ciphertext feedback from the server 130 and send it to the corresponding client 110.

[0024] Server 130 is used to receive ciphertext instructions from network layer 120 or send ciphertext feedback to network layer 120. After receiving the ciphertext instruction, it generates ciphertext feedback by calling storage system 131 and ciphertext calculation module 132. Server 130 can be a cryptographic database or a big data engine, etc., without specific limitations here.

[0025] The storage system 131 stores the data received by the storage client 130 after being encrypted by the encryption system 111, and can transmit encrypted information to the ciphertext calculation module 132.

[0026] The encrypted calculation module 132 is used to receive the calculation instructions received by the server 130 and the relevant encrypted information transmitted by the storage system 131, and after calculation, transmit the result to the server 130. If necessary, the intermediate result is stored in the storage system 131.

[0027] Figure 1 The implementation environment shown can be a physical machine environment or a cloud environment, etc., without specific limitations.

[0028] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0029] Figure 2 This is a flowchart illustrating an embodiment of the order-preserving encryption method of this application. Figure 2 The order-preserving encryption method shown can be derived from... Figure 1The sequence-preserving encryption system shown is executed. Figure 2 The order-preserving encryption method shown is as follows.

[0030] Step S100: Obtain plaintext data.

[0031] In some implementations, plaintext data originates from a database or big data engine, referring to unencrypted raw data stored in the database or big data engine. Plaintext data can exist in numerical form, such as integers, decimals, or floating-point numbers, and is used to represent quantity, measurement, or other quantifiable attributes.

[0032] Step S200: Perform order-preserving random mapping on the plaintext data to obtain the first order-preserving encoded data.

[0033] In the embodiments of this application, the first order-preserving encoded data is obtained by using different strictly monotonically continuous nonlinear mapping functions. The first order-preserving encoded data only retains the order relationship and hides sensitive information such as the original spacing and distribution characteristics of the plaintext.

[0034] For step S200, as Figure 3 As shown, Figure 3 This is a schematic diagram illustrating the process of generating first order-preserving encoded data according to an embodiment of this application, specifically including: Step S202: Perform random mapping processing on the plaintext data based on the preset monotonic convex function algorithm to obtain the second order-preserving encoded data.

[0035] The property of strictly monotonically convex functions can "expand" plaintext data to a larger range, performing an "expansion mapping" on the plaintext data. The upward-opening parabolic shape of the graph of a strictly monotonically convex function ensures that as the independent variable increases or decreases, the function value will move closer or further away from the x-axis accordingly. Its convexity ensures that the function value between any two points is always lower than the line segment connecting those two points. This characteristic pushes the data points onto a wider range of y-values ​​on the function graph. At the same time, its monotonicity ensures that any change in the independent variable will produce a consistent directional change in the function value, further enhancing the data expansion effect.

[0036] In some implementations, the monotonic convex function algorithm may include a negative interval flipped quadratic parabola function. The quadratic function can effectively avoid the excessive expansion of the results of high-order calculations, and the range of adjustment can control the changes in the interval after expansion mapping. The dynamically adjusted randomly generated interval can satisfy the requirement of maintaining the original data order relationship characteristics, while also leaving a suitable interval between the mapped data for subsequent compression mapping operations.

[0037] Specifically, a strictly monotonic convex function with a negative interval flipped quadratic parabola is used as the expansion mapping function to expand and map the plaintext data, resulting in the second order-preserving encoded data. Its expression is defined as follows: (Formula 1) This is a sign function used to flip the negative half-axis graph of a parabola function, maintaining the strict monotonicity of the function as a whole. These are confidential parameters used to control the extent and range of the extended mapping. Randomly select within an integer range, where the integer range can be... , Controlled by the range of the first plaintext data, its value can be... , Represents the first plaintext data; To maintain the original order and obfuscate the spacing information, the random number noise element is generated within a range determined by the confidentiality parameter. To determine, the range of values ​​can be... It should be understood that the value ranges of the above parameters can be adjusted according to the actual situation.

[0038] Step S204: Perform random mapping processing on the second order-preserving encoded data based on the preset monotonic concave function algorithm to obtain the first order-preserving encoded data.

[0039] The property of a strictly monotonically concave function can "compress" second-order-preserving encoded data into a smaller interval, performing a "compression mapping" on plaintext data. Due to its downward-opening parabolic shape, the strictly monotonically concave function exhibits a characteristic of decreasing as the independent variable increases. This monotonically decreasing property causes the function value to tend towards a smaller interval as the independent variable increases. Simultaneously, its concavity ensures that the function graph lies above the line connecting any two points, meaning that the change in the function value between these two points will not exceed the range defined by the line. This effectively "compresses" data points into a smaller interval on the function graph. This property can be used in data encryption to achieve data compression and efficient management, especially when it is necessary to reduce data storage space or transmission bandwidth. Through this compression effect of the strictly monotonically concave function, data storage and transmission efficiency can be optimized without losing critical information.

[0040] In some implementations, the monotonic concave function algorithm may include the arctangent function, which is a function that... Arctangent is a function that grows infinitely but at a gradually decreasing rate, meaning that for very large values ​​of x, the rate of change of arctan(x) decreases significantly. This property allows the arctangent function to map very large input values ​​to a relatively finite range of output values. This allows for data compression.

[0041] Specifically, the strictly monotonic concave arctangent function is used as the compression mapping function to compress and map the second order-preserving encoded data to obtain the first order-preserving encoded data, and its expression is set as follows: (Formula 2) in, These are confidential parameters used to adjust the magnitude and range of the compression mapping. Randomly select from a small range of integers. Controlled by the range of the first plaintext data; To maintain the original order and obfuscate the spacing information, the random number noise element is generated within a range determined by the confidentiality parameter. The decision is made by adjusting the confidentiality parameters. This allows for the modification of the distribution and sign characteristics of the final mapped data, thereby ensuring that no plaintext data information other than the order relation is leaked.

[0042] In some implementations, the first sequence-preserving encoded data may also be stored locally.

[0043] Figure 4 This is a schematic diagram of the process for generating first sequence-preserving encoded data according to another embodiment of this application.

[0044] In another embodiment of this application, the first order-preserving encoded data in step S200 can also be obtained by other means, such as... Figure 4 As shown, it specifically includes: Step S202: Perform random mapping processing on the plaintext data based on a preset monotonically convex function algorithm to obtain second order-preserving encoded data. This step is the same as step S202 in the previous embodiment.

[0045] Step S206: Perform random mapping processing on the second order-preserving encoded data based on the preset monotonic concave function to obtain the third order-preserving encoded data; the implementation of this step can be referred to step S204 of the previous embodiment.

[0046] Step S208: Obtain random encoded data.

[0047] The random encoded data is a string of random characters generated locally with a length comparable to the precision control. In other words, the length of the random encoded data is the same as that of the third order-preserving encoded data. In addition, the acquired random encoded data can be stored.

[0048] Step S210: Adjust the offset between the random encoded data and the third order-preserving encoded data to obtain the first order-preserving encoded data.

[0049] The random encoded data and the third order-preserving encoded data are uniformly offset and added or subtracted to obtain the first order-preserving encoded data.

[0050] It should be understood that this part can be replaced with other forms of encoding calculation functions to generate the encoding.

[0051] In this embodiment of the application, considering the accuracy and security of the data, the second order-preserving encoded data is designed to be mapped to using the arctangent function. Within the high-precision decimal real number field of the interval.

[0052] Optionally, in some implementations, to achieve higher accuracy in the calculation results, it is necessary to approximate the function's independent variable as close as possible to the interval where the arctangent function converges quickly, i.e., a value near the zero point. Therefore, this is achieved through the transformation property of the arctangent function, as shown in the following formula: (Formula 3.1) (Formula 3.2) (Formula 3.3) Transform the independent variable x into , The values ​​near zero are then substituted into the Taylor expansion for calculation, yielding more accurate results.

[0053] Optionally, to improve the efficiency of high-precision calculations, array recursion and pre-defined values ​​can be used to reduce redundancy caused by recursion during computation. Only one call to the original Taylor expansion recursive formula is needed, resulting in a faster convergence speed and more accurate results, thus accelerating the efficiency of encoding and computation. Specifically, the accurate result is approximated using the following Taylor expansion: (Formula 4) The part within the parentheses in the Taylor expansion can be viewed as a recursive array: (Formula 5) The recurrence relation can be obtained ,when The larger the value, The closer the calculated result is to the exact value, the better. Therefore, when using Taylor expansion to calculate the result, the following algorithm can be used: (1) Let ; (2) For the value ,calculate ; (3) Calculate and return The result.

[0054] Specifically, after obtaining the arctangent function calculation result with high precision, a number string of appropriate length with the decimal point of the high-precision result is retained. Then, the decimal point identifier is removed, and it is converted into a string encoding including the sign bit. In this embodiment, the first order-preserving encoded data is calculated by controlling the mapping interval and the calculation precision. It uniformly maps numerical plaintext data to a random real number domain interval. By controlling the size of the mapping interval, the appropriate spacing of plaintext data is adjusted; and by controlling the calculation precision of the mapping process, a real number result with an appropriate number of bits is calculated. The result is truncated to a certain number of bits as the order-preserving code, thereby obtaining encrypted ciphertext with controllable length, forming a final controllable order-preserving code that is weakly correlated with the plaintext data and only retains the order and size relationship.

[0055] Step S300: Perform decryptable encryption processing on the plaintext data to obtain decryptable ciphertext data.

[0056] In this embodiment, the original plaintext data is converted into ciphertext data using an encryption algorithm. The encryption process is reversible, meaning the ciphertext data can be decrypted. Through appropriate decryption operations and using the correct key, the ciphertext can be restored to the original plaintext data. This encryption not only improves data security but also provides necessary protection for the legitimate use and access of the data.

[0057] Optionally, a symmetric encryption algorithm can be selected to perform decryptable encryption processing on the plaintext data. Symmetric encryption algorithms can provide efficient encryption and decryption processes when processing large amounts of data, simplify the complexity of key distribution and management, ensure rapid sharing and processing of data in multi-node environments, and maintain data integrity and authenticity by combining message authentication codes or digital signatures, making them particularly suitable for use in big data scenarios.

[0058] Regarding the choice of symmetric encryption algorithms, deterministic encryption algorithms offer computational efficiency and strong security. Compared to other encryption algorithms, deterministic encryption algorithms have higher encryption processing efficiency, generate shorter ciphertext, and their symmetric keys are better suited to meet the efficiency requirements of data encryption and decryption operations in the context of large datasets. Furthermore, deterministic encryption guarantees a unique correspondence between plaintext and ciphertext and does not contain any other plaintext information. Using deterministic encryption algorithms within the national commercial cryptography standard better meets the security requirements of the encryption scheme. It should be understood that other symmetric algorithms can be selected to generate decryptable ciphertext data, or other new lightweight symmetric cryptosystems can be used instead.

[0059] Optionally, the plaintext data can be deterministically encrypted using SM4 (a Chinese national standard symmetric encryption algorithm) in Electronic Codebook (ECB) mode to ensure sufficiently high security for the decryption function. Simultaneously, users can optionally use SM4 encryption in Cipher Block Chaining (CBC) mode, i.e., probabilistic encryption, to encrypt the same plaintext data into different decryptable ciphertext data, thus avoiding statistical analysis attacks.

[0060] Step S400: Concatenate the first order-preserving encoded data with the decryptable ciphertext data to obtain the order-preserving ciphertext data.

[0061] In this embodiment, plaintext data is converted into first-order-preserving encoded data that retains only the original data's order and size relationship. This encoding transformation process is irreversible. The first-order-preserving encoded data is then concatenated with decryptable ciphertext data to obtain the order-preserving ciphertext data. Based on the order relationship of the first-order-preserving encoded data, order-related comparison, sorting, and query operations in the encrypted database can be quickly completed.

[0062] It should be noted that the first sequence-preserving encoded data is placed before the decryptable ciphertext data as a prefix to achieve the concatenation process between the encoded data and the decryptable ciphertext. Alternatively, the first sequence-preserving encoded data can also be placed after the decryptable ciphertext data to achieve the concatenation process.

[0063] In some implementations, the ordered ciphertext data can also be sent to a server for storage.

[0064] Based on the order-preserving encryption method provided in the embodiments of this application, the embodiments of this application also provide a data query method, please refer to [link to relevant documentation]. Figure 5 . Figure 5 This is a flowchart illustrating a data query method according to an embodiment of this application. Figure 5 The data query method shown can be derived from Figure 1 The client-side order-preserving encryption system 111 shown is executed. Figure 5 The data query method shown is as follows.

[0065] Step S502: Send a ciphertext query statement to the server, wherein the ciphertext query statement includes encrypted sequential query morphemes.

[0066] In this embodiment of the application, the client sends a ciphertext query statement to the server through the client's order-preserving encryption system 111.

[0067] For step S502, before sending the encrypted query statement to the server, the specific steps include: Step S5021: Obtain the plaintext query statement, which is used to indicate the sequential query morphemes.

[0068] Step S5022: Encrypt and rewrite the plaintext query statement to obtain the ciphertext query statement.

[0069] To ensure that sensitive information remains encrypted even during data transmission or on the database server, plaintext queries must be encrypted. In a cryptographic database, encrypted queries are tightly integrated with key management. A key management system is used to generate, store, and distribute keys, ensuring that only authorized users can encrypt and decrypt queries using the correct keys.

[0070] It's important to note that plaintext queries are used to indicate sequential query elements. In other words, plaintext queries are the basic SQL instructions used in database operations to retrieve data in a specific order. Common examples include simple select queries (such as selecting data from a specific column of a specific table), conditional filtering queries (such as selecting data that meets specific conditions from a specific column of a specific table), and sorting queries (such as selecting data that meets specific conditions from data sorted in ascending or descending order from a specific column of a specific table). Furthermore, data can be grouped and filtered using conditions, for example (selecting data within a specific value range from data sorted in ascending or descending order from a specific column of a specific table).

[0071] In this embodiment of the application, the plaintext query statement is encrypted and rewritten by encrypting and rewriting the elements in the plaintext query statement into ciphertext. The ciphertext includes symmetric encrypted ciphertext obtained by using a symmetric encryption algorithm and first order-preserving encoded data generated according to step S202, wherein the first order-preserving encoded data is stored locally on the client.

[0072] For example, a data user enters a sequential query statement in the local client database operation interface. Within the local encryption module, the elements in the query statement are encrypted and rewritten into corresponding ciphertext forms and encrypted user-defined functions according to the corresponding principles, and then sent to the encrypted database.

[0073] For example, in a PostgreSQL encrypted database, a data user writes a plaintext SQL query locally: `SELECT name FROM test WHERE id<5;`. This is then encrypted and rewritten into a ciphertext SQL statement by a local encryption module: `SELECT column_d1229fc FROM table_8b66920 WHERE udf_ore_lt(column_6be532d, ...`. '881894b78de497c73d2b'); where 'column_d1229fc', 'column_6be532d', and 'table_8b66920' are the deterministic encrypted ciphertexts of column names 'name', 'id', and table name 'test'; 'udf_ore_lt' is the user-defined function corresponding to the comparison symbol '<'; '881894b78de497c73d2b' is the order-preserving encoded encrypted ciphertext corresponding to the numeric data '5', in which '88189' is the irreversible order-preserving code (i.e., the first order-preserving encoded data generated through step S202), and '4b78de497c73d2b' is the deterministic encrypted ciphertext of the value 5.

[0074] Step S504: Receive the target ordered ciphertext data returned by the server based on the ciphertext query statement.

[0075] Next, combine Figure 1 The server 130 is shown below. After receiving the ciphertext instruction, the server 130 generates ciphertext feedback by calling the storage system 131 and the ciphertext calculation module 132. The storage system 131 stores the ordered ciphertext data received by the server 130 after being encrypted by the ordered encryption system 111, and can transmit encrypted information with the ciphertext calculation module 132. The ciphertext calculation module 132 receives the calculation instruction received by the server 130 and the relevant ciphertext information transmitted from the storage system 131. The ciphertext calculation module 132 can calculate the feedback result (target ordered ciphertext data) according to the ciphertext query statement and transmit it to the server 130. If necessary, the intermediate results are stored in the storage system 131.

[0076] Specifically, the server 130 can perform the corresponding query operation based on the encrypted and rewritten ciphertext query statement, and then perform sorting or comparison operations based on the stored ordered ciphertext column to obtain the encrypted result (target ordered ciphertext data) that meets the query conditions, and return it to the client 110.

[0077] Step S506: Obtain the first sequence-preserving encoded data stored locally on the client, and extract the decryptable ciphertext data from the target sequence-preserving ciphertext data based on the first sequence-preserving encoded data.

[0078] By comparing the first sequence-preserving encoded data stored locally, the target sequence-preserving ciphertext data is matched and compared to separate the first sequence-preserving encoded data and the symmetric encrypted ciphertext part.

[0079] Step S508: Decrypt the decryptable ciphertext data using the decryption key to obtain plaintext data.

[0080] Data users obtain the corresponding decryption key from the data uploader through authorization, use the key to decrypt the symmetric encrypted ciphertext, and finally obtain the corresponding plaintext data.

[0081] Based on the order-preserving encryption method provided in the embodiments of this application, the embodiments of this application also provide a data storage method, please refer to [link to relevant documentation]. Figure 6 . Figure 6 This is a schematic flowchart of a data storage method according to an embodiment of this application. Figure 6 The data storage method shown can be derived from Figure 1 The server-side storage system 131 shown is executed. Figure 6 The data storage method shown is described below.

[0082] Step 602: Receive the ordered ciphertext data sent by the client, wherein the ordered ciphertext data is obtained by concatenating the first ordered encoded data and the decryptable ciphertext data.

[0083] In this embodiment, the storage system 131 receives the ordered ciphertext data sent by the client and places the first ordered coded data as a prefix before the decryptable ciphertext data to achieve concatenation of the coded data and the decryptable ciphertext. In some embodiments, the first ordered coded data can also be placed after the decryptable ciphertext data to achieve concatenation.

[0084] Step 604: Store the ordered ciphertext data.

[0085] Storage system 131 stores the ordered encrypted data.

[0086] For step 604, after storing the order-preserving ciphertext data, the specific steps include: Step 6041: Receive a ciphertext query statement sent by the client, wherein the ciphertext query statement includes encrypted sequential query morphemes.

[0087] In this embodiment of the application, the storage system 131 receives a encrypted query statement sent by the client.

[0088] In this embodiment of the application, the plaintext query statement is encrypted and rewritten by encrypting and rewriting the elements in the plaintext query statement into ciphertext. Part of the ciphertext is symmetric encryption ciphertext obtained using a symmetric encryption algorithm, and part of the ciphertext is first order-preserving encoded data generated according to step S202, which is stored locally.

[0089] Step 6042: Locate the corresponding target ordered ciphertext data based on the sequential query morphemes.

[0090] Storage system 131 searches for the corresponding target ordered ciphertext data based on the sequential query morpheme.

[0091] Step 6043: Send the target ordered ciphertext data to the client.

[0092] Storage system 131 sends the target ordered encrypted data to the client.

[0093] To facilitate understanding of how order-preserving encryption is used for data retrieval and storage, a more concrete implementation method will be described below. Please refer to... Figure 7 , Figure 7 This is a schematic diagram of a data processing flow according to an embodiment of this application.

[0094] This application provides a data processing flow in a PostgreSQL database. PostgreSQL supports strong symmetric encryption, primarily implemented through the built-in pgcrypto extension. Symmetric encryption means that the same key is used for both encryption and decryption, thus ensuring data confidentiality.

[0095] In symmetric encryption, deterministic encryption is a crucial concept. It refers to the ability to encrypt the same data using the same key and the same initialization vector (IV), always yielding the same encrypted result. This characteristic is essential for scenarios requiring data retrievability, such as database indexing and query optimization. In PostgreSQL, deterministic encryption can be implemented through carefully designed key management and IV generation strategies. Using deterministic encryption, even when data is stored encrypted, the database can still perform efficient search and sorting operations on the encrypted data without decryption. This not only protects data security but also maintains the efficiency of database operations. When designing database encryption strategies, developers need to balance security and performance; deterministic encryption provides a method to minimize the impact on database performance while protecting data privacy.

[0096] Step S710: Initialize parameters locally and store records locally.

[0097] For plaintext data of numeric type in PostgreSQL, the confidentiality parameters contained in the order-preserving random mapping function (monotonically convex function and monotonically concave function) used in the order-preserving random mapping process, as well as the encryption key used by the deterministic encryption algorithm, need to be initialized locally first.

[0098] Specifically, the confidentiality parameters are generated by a local random function, and the same confidentiality parameters are used for data within the same data column or for data columns that have been joined. The deterministic encryption key is either customized by the user or randomly generated locally. The same encryption key is used for the same encrypted column, while different encryption keys are used for encrypted columns across columns or tables, and the records are stored locally.

[0099] Step S720: The order-preserving encryption system obtains the plaintext data in PostgreSQL and generates the corresponding first order-preserving encoded data according to the original order of the plaintext data.

[0100] In this embodiment, two different strictly monotonically continuous functions, concave and convex, are selected as the basic framework of the mapping function. Strictly monotonically increasing downward concave functions exhibit a faster growth trend, which can "expand" the data to a larger interval. Strictly monotonically increasing upward convex functions exhibit a slower growth trend, which can "compress" the data interval to a more concentrated interval. Utilizing the difference in concavity and convexity, the plaintext data is first "expanded" to obtain the second order-preserving encoded data. Then, the second order-preserving encoded data is "compressed" to obtain the first order-preserving encoded data. Noise elements generated by random numbers within a suitable interval are added to the basic framework of the mapping function, making it a nonlinear order-preserving random mapping function that satisfies the order-preserving random mapping requirement.

[0101] In some embodiments, to further enhance the security of the encoding scheme, a random string of similar length to the precision control is generated locally and stored. A third order-preserving encoded data is obtained by high-precision calculation using the controlled precision bits. The third order-preserving encoded data is then added to the random string with a uniform offset to obtain the first order-preserving encoded data. This part can be replaced with other forms of encoding calculation functions to generate the encoding.

[0102] Step S730: Use the first order-preserving encoded data as a prefix code and concatenate it with the corresponding deterministic encrypted ciphertext to generate order-preserving ciphertext data.

[0103] The first order-preserving encoded data only retains the original data order and size relationship. Based on the size and order relationship of the encoding, the order-related comparison, sorting and query operations in the dense database can be completed quickly.

[0104] In this embodiment, the SM4 encryption algorithm in ECB mode is selected to perform deterministic encryption on the plaintext data to ensure that the decryption function has a sufficiently high level of security.

[0105] Step S740: Send the sequence-preserving ciphertext data to the PostgreSQL database for storage.

[0106] It should be understood that the ordered encrypted data is sent to the 131 storage system on the server for storage.

[0107] Step S750: Send the sequential correlation query statement, encrypt and rewrite it locally, and then send it to the PostgreSQL database.

[0108] Data users input sequential query statements into the local client database operation interface. The order-preserving encryption system encrypts and rewrites the elements in the query statement into deterministic encrypted ciphertext and a user-defined encrypted function according to the corresponding principle, and then sends them to the PostgreSQL database.

[0109] For example, in a PostgreSQL encrypted database, a data user writes a plaintext SQL query locally: `SELECT name FROM test WHERE id<5`; this is then encrypted and rewritten into a ciphertext SQL statement by the local encryption module: `SELECT column_d1229fc FROM table_8b66920 WHERE udf_ore_lt(column_6be532d, '881894b78de497c73d2b');` Among them, 'column_d1229fc', 'column_6be532d', and 'table_8b66920' are the deterministic encrypted ciphertexts of column names 'name', 'id', and table name 'test'; 'udf_ore_lt' is the user-defined function corresponding to the comparison symbol '<'; '881894b78de497c73d2b' is the order-preserving ciphertext data corresponding to the numerical data '5', in which '88189' is an irreversible order-preserving code (i.e., the first order-preserving code data generated through step S202), and '4b78de497c73d2b' is the deterministic encrypted ciphertext of the value 5.

[0110] Step S760: The PostgreSQL database performs the corresponding query operation based on the ciphertext query statement and returns the corresponding target ordered ciphertext data to the local machine.

[0111] The PostgreSQL encrypted database executes the corresponding query operation based on the encrypted and rewritten query statement, and then performs sorting or comparison operations based on the stored ordered ciphertext data to obtain the encrypted result that meets the query conditions, and returns it to the local client.

[0112] Step S770: The data user uses the authorized key to decrypt the encryption result and obtain the plaintext data.

[0113] The order-preserving encryption system compares the encrypted ciphertext with the corresponding encoded plaintext stored locally, separating the encrypted ciphertext into first-order-preserving encoded data and deterministic encrypted ciphertext. The deterministic encrypted ciphertext is selected, and the data user, with authorization, obtains the corresponding decryption key from the data uploader. Using the key, the user decrypts the deterministic encrypted ciphertext to retrieve the final plaintext data.

[0114] The order-preserving encryption method in this application embodiment can also be applied in big data engine scenarios, such as Apache Hadoop and Apache Spark, designed to process large amounts of unstructured or semi-structured data. These systems can handle petabyte-scale data, support distributed processing to improve efficiency, are suitable for large-scale data analysis and machine learning tasks, can quickly process large-scale data, provide real-time or near real-time data analysis and prediction, and support data-driven decision-making and business optimization.

[0115] In Apache Spark, plaintext data can be stored and computed within Spark's Resilient Distributed Datasets (RDDs) or DataFrames. Spark supports various data sources, including the Hadoop Distributed File System (HDFS), HBase, and Cassandra. Spark supports Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) to ensure that only authorized users can access and manipulate encrypted data. These mechanisms enable secure authentication of users and services, further protecting data security and privacy.

[0116] In cloud storage systems, plaintext data is first encrypted and then stored on cloud servers. This ensures data security even if unauthorized access is granted.

[0117] Figure 8 This is a schematic diagram of the structure of an embodiment of the order-preserving encryption system of this application. Please refer to... Figure 8 In one software implementation, the order-preserving encryption 800 may include: a random mapping module 810, a symmetric encryption module 820, a ciphertext fusion module 830, and a ciphertext comparison module 840, wherein: Random mapping module 810: It is used to perform calculation fuzzification processing on plaintext data of numerical type through a nonlinear random mapping function, and map the original plaintext space to another random space that erases the data distribution, spacing and other information, and only retains the order relationship in the real number field space, so as to realize irreversible randomization and order-preserving encryption calculation of plaintext data.

[0118] Symmetric encryption module 820: Used to implement strong encryption of plaintext data using symmetric encryption algorithms, such as deterministic encryption algorithms. The ciphertext can only be decrypted by decrypting the symmetric key. Symmetric encryption ensures the information security of plaintext data and enables the decryption of ciphertext data.

[0119] Ciphertext fusion module 830: It is used to convert the real number field order-preserving encryption result previously calculated by the irreversible randomization mapping function into a character type order-preserving code (first order-preserving code data) and a strong security symmetric encryption ciphertext, and concatenate the two together to form order-preserving ciphertext data. The order-preserving ciphertext data only retains the order relationship of the plaintext data.

[0120] Ciphertext Comparison Module 840: Used to separate the first order-preserving encoded data and the symmetric encrypted ciphertext through ciphertext comparison, select the symmetric encrypted ciphertext part, and use the decryption symmetric key obtained through authorization to decrypt the ciphertext result and obtain the query result in plaintext form.

[0121] The order-preserving encryption system 800 provided in this application can also execute... Figures 2 to 5 The method, and implement the data encryption system 800 in Figures 2 to 5 The functions of the embodiments shown will not be described again in this application.

[0122] Figure 9 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 9 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0123] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0124] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0125] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a data processing device at the logical level. The processor executes the program stored in memory and specifically performs the following operations: Obtain plaintext data; The plaintext data is subjected to order-preserving random mapping to obtain the first order-preserving encoded data; The plaintext data is encrypted in a decryptable manner to obtain decryptable ciphertext data; The first order-preserving encoded data is concatenated with the decryptable ciphertext data to obtain order-preserving ciphertext data. This is as described in this application. Figure 9The data query device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0126] The electronic device can also perform Figure 2 The method, and implement the data query device in Figure 2 The functions described in the illustrated embodiments will not be repeated here.

[0127] Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0128] This application also discloses a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by a portable electronic device including multiple applications, enable the portable electronic device to perform... Figure 2 The method of the illustrated embodiment is specifically used to perform the following operations: Obtain plaintext data; The plaintext data is subjected to order-preserving random mapping to obtain the first order-preserving encoded data; The plaintext data is encrypted in a decryptable manner to obtain decryptable ciphertext data; The first sequence-preserving encoded data is concatenated with the decryptable ciphertext data to obtain the sequence-preserving ciphertext data.

[0129] Figure 10 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 10 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0130] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 10 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0131] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0132] The processor reads the corresponding computer program from non-volatile memory into main memory and then runs it, forming a data storage device at the logical level. The processor executes the program stored in memory and specifically performs the following operations: Receive ordered ciphertext data sent by the client, wherein the ordered ciphertext data is obtained by concatenating first ordered encoded data and decryptable ciphertext data; The ordered ciphertext data is stored.

[0133] The above is as stated in this application. Figure 10The method executed by the data storage device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0134] The electronic device can also perform Figure 6 The method, and implement the data storage device in Figure 6 The functions described in the illustrated embodiments will not be repeated here.

[0135] Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0136] In summary, the above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0137] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0138] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0139] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0140] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

Claims

1. A sequence-preserving encryption method, comprising: Obtain plaintext data; The plaintext data is subjected to order-preserving random mapping to obtain the first order-preserving encoded data; The plaintext data is encrypted in a decryptable manner to obtain decryptable ciphertext data; The first sequence-preserving encoded data is concatenated with the decryptable ciphertext data to obtain the sequence-preserving ciphertext data.

2. The method according to claim 1, characterized in that, The step of performing order-preserving random mapping on the plaintext data to obtain first order-preserving encoded data includes: The plaintext data is randomly mapped based on a preset monotonic convex function algorithm to obtain second order-preserving encoded data; The second order-preserving encoded data is randomly mapped based on a preset monotonic concave function algorithm to obtain the first order-preserving encoded data.

3. The method according to claim 2, characterized in that, The monotonically convex function algorithm includes a quadratic parabola function with a negative interval flip.

4. The method according to claim 2, characterized in that, The monotonic concave function is the arctangent function.

5. The method according to claim 2, characterized in that, The first order-preserving encoded data is obtained by randomly mapping the second order-preserving encoded data using a preset monotonic concave function algorithm, including: The second order-preserving encoded data is randomly mapped based on the preset monotonic concave function to obtain the third order-preserving encoded data; Obtain randomly encoded data; The random encoded data and the third order-preserving encoded data are offset and adjusted to obtain the first order-preserving encoded data; The random encoded data has the same length as the third order-preserving encoded data.

6. The method according to claim 1, characterized in that, The step of performing decryptable encryption processing on the plaintext data to obtain decryptable ciphertext data includes: The plaintext data is encrypted using a symmetric encryption algorithm to obtain decryptable ciphertext data.

7. The method according to claim 1, characterized in that, After obtaining the first sequence-preserving encoded data, the following is also included: The first sequence-preserving encoded data is stored locally.

8. The method according to claim 7, characterized in that, After obtaining the ordered ciphertext data, the following is also included: The ordered ciphertext data is sent to the server so that the ordered ciphertext data can be stored on the server.

9. A data query method, the method comprising: Send a encrypted query statement to the server, wherein the encrypted query statement includes encrypted sequential query morphemes; Receive the target ordered ciphertext data returned by the server according to the ciphertext query statement; Obtain the first order-preserving encoded data stored locally on the client, and extract decryptable ciphertext data from the target order-preserving ciphertext data based on the first order-preserving encoded data; The decryptable ciphertext data is decrypted using the decryption key to obtain plaintext data.

10. The method according to claim 9, characterized in that, Before sending the encrypted query statement to the server, the process also includes: Obtain the plaintext query statement, which is used to indicate the sequential query morphemes; The plaintext query statement is encrypted and rewritten to obtain the ciphertext query statement.

11. A data storage method, the method comprising: Receive ordered ciphertext data sent by the client, wherein the ordered ciphertext data is obtained by concatenating first ordered encoded data and decryptable ciphertext data; The ordered ciphertext data is stored.

12. The method according to claim 11, characterized in that, After storing the ordered ciphertext data, the method further includes: Receive a ciphertext query statement sent by the client, the ciphertext query statement including encrypted sequential query morphemes; Search for the corresponding target order-preserving encrypted data based on the sequential query morphemes; The target ordered ciphertext data is sent to the client.

13. An electronic device, comprising: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method as described in any one of claims 1 to 12.

14. A computer-readable storage medium, wherein instructions in the storage medium, when executed by a processor of an electronic device, enable the electronic device to perform the method as claimed in any one of claims 1 to 12.

15. A computer program product comprising a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform some or all of the steps of the method as claimed in any one of claims 1 to 12.

Images