Database processing method and device, electronic equipment and storage medium

Abstract

The invention provides a database processing method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining to-be-encrypted data, performing encryption processing on the to-be-encrypted data to obtain ciphertext data, and constructing an index structure corresponding to the ciphertext data to obtain a ciphertext database; in response to a received query request for the ciphertext data, determining a ciphertext operation corresponding to the ciphertext database according to the query request; wherein the ciphertext operation is used for representing direct calculation operation on the ciphertext data; when it is determined that the data volume of the ciphertext database is larger than a preset data volume threshold value, dividing the ciphertext database into at least two ciphertext subsets, and executing ciphertext operation on the at least two ciphertext subsets to obtain a ciphertext query result corresponding to the query request; according to the method, direct query calculation is carried out on the ciphertext database, safety can be guaranteed without decryption, the processing efficiency is optimized by dividing a ciphertext subset and an index structure for ciphertext data with a large data volume, and calculation delay is avoided.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and in particular to a database processing method and apparatus, electronic device and storage medium. Background Technology

[0002] As enterprises deepen their digital transformation, the scale of data to be encrypted stored in enterprise databases continues to grow. This data includes private information such as basic customer information and transaction records, making the need for data privacy protection increasingly urgent.

[0003] In related technologies, fully homomorphic encryption schemes are used to protect the data to be encrypted in the database from being leaked; however, using fully homomorphic encryption schemes for encryption will cause the ciphertext data to expand, occupy a large amount of memory space and be computationally complex, thus reducing the query performance of ciphertext data in the database. Summary of the Invention

[0004] This disclosure provides a database processing method, apparatus, electronic device, and storage medium to solve problems in related technologies. By directly performing ciphertext operations on ciphertext data, query calculations can be completed without decryption, ensuring the security of ciphertext data during the query process. For ciphertext databases with data volume exceeding a preset threshold, a method of dividing ciphertext subsets and performing ciphertext operations is adopted. Combined with a pre-built index structure, the processing efficiency of ciphertext queries can be improved, avoiding computational delays when the data volume is large.

[0005] According to a first aspect of this disclosure, a database processing method is provided, comprising: Obtain the data to be encrypted, encrypt the data to be encrypted to obtain ciphertext data, and construct the index structure corresponding to the ciphertext data to obtain the ciphertext database; In response to a received query request for the encrypted data, the encrypted operation corresponding to the encrypted database is determined based on the query request; wherein the encrypted operation is used to represent a calculation operation performed directly on the encrypted data; If the amount of data in the ciphertext database is determined to be greater than a preset data volume threshold, the ciphertext database is divided into at least two ciphertext subsets, and the ciphertext operation is performed on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request.

[0006] In some embodiments, the steps of obtaining data to be encrypted, encrypting the data to be encrypted to obtain ciphertext data, and constructing an index structure corresponding to the ciphertext data to obtain a ciphertext database include: Convert the data to be encrypted into a plaintext vector; The ciphertext operation is performed on the plaintext vector to generate the ciphertext data; The data structure of the ciphertext data is formatted to obtain formatted ciphertext data; An index structure corresponding to the formatted ciphertext data is constructed to obtain the ciphertext database.

[0007] In some embodiments, the step of determining the ciphertext operation corresponding to the ciphertext database based on the received query request for the ciphertext data includes: Parse the query request to determine the operation type of the aggregate function corresponding to the query request; The operation type is broken down into basic operation combinations in the ciphertext space; wherein, the ciphertext space is the computing environment formed during the execution of the computation operation by the ciphertext operation, and the basic operation combinations include at least addition and multiplication operations; Design corresponding calculation templates for the aggregation function according to the different operation types; The ciphertext operation is generated based on the computation template and the index structure.

[0008] In some embodiments, the operation type includes at least summation, averaging, and counting operations, and the step of decomposing the operation type into a combination of basic operations in the ciphertext space includes: If the operation type is determined to be a summation operation, the ciphertext data is accumulated using a homomorphic adder to obtain the accumulated result. If the operation type is determined to be an averaging operation, the summation operation is performed, and the ciphertext data is calculated using a homomorphic multiplier to obtain the calculation result; If the operation type is determined to be a counting operation, the encrypted data is judged using a homomorphic comparator to obtain the judgment result.

[0009] In some embodiments, dividing the ciphertext database into at least two ciphertext subsets when the data volume of the ciphertext database is determined to be greater than a preset data volume threshold includes: Based on the ciphertext features of the ciphertext data, determine the number of ciphertext subsets in the ciphertext database; wherein, the ciphertext features include at least ciphertext size and distribution characteristics; The target number of partitions in the number of partitions of the ciphertext subset is determined based on the silhouette coefficient; wherein the silhouette coefficient is used to evaluate the clustering effect of the ciphertext subset; The target is divided into at least two ciphertext subsets.

[0010] In some embodiments, performing the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request includes: Assign computing nodes to each ciphertext subset, and perform the ciphertext operation on each ciphertext subset according to the computing nodes; Obtain the intermediate results corresponding to each computing node; The intermediate results of all ciphertext subsets are securely merged to obtain the ciphertext query result.

[0011] In some embodiments, the secure merging of the intermediate results of all ciphertext subsets to obtain the ciphertext query result includes: Distribute the intermediate results of all the ciphertext subsets to the corresponding number of servers; The intermediate results from a corresponding number of servers are securely merged through the ciphertext operation to obtain the ciphertext query result.

[0012] In some embodiments, when the ciphertext operation is performed on the ciphertext database, and the ciphertext data contains outliers, the method further includes: Based on the precision requirements of the ciphertext operation, the ciphertext data is processed to obtain similar ciphertext data; The similar ciphertext data is filtered out to obtain valid ciphertext data that does not belong to the preset set. A threshold is configured based on the distribution characteristics of the valid ciphertext data. Valid ciphertext data exceeding the calculated threshold are identified as outliers, and these outliers are filtered out. The distribution characteristics include at least one of mean, variance, and quantiles.

[0013] In some embodiments, processing the ciphertext data according to the precision requirements of the ciphertext operation to obtain similar ciphertext data includes: During the execution of the ciphertext operation, the calculation error corresponding to the accuracy requirement is monitored. If the calculation error is determined to be greater than the preset error boundary, the calculation error is corrected to obtain the corrected calculation result. The ciphertext data is then processed based on the corrected calculation result to obtain the similar ciphertext data. If the calculation error corresponding to the corrected calculation result is still greater than the preset error boundary, the preset gradient descent method is used for optimization until the calculation error is less than or equal to the preset error boundary, the corrected calculation result is obtained, and the ciphertext data is processed according to the corrected calculation result to obtain the similar ciphertext data.

[0014] In some embodiments, after performing the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request, the method further includes: The ciphertext polynomial is determined according to the ciphertext operation, the ciphertext polynomial is converted into an integer sequence, and the integer sequence is data encoded to obtain the data-encoded integer sequence. The encoded integer sequence is compressed to reduce the number of bits required to store each integer, resulting in a compressed integer sequence. The compressed integer sequence is compressed using a compression algorithm to obtain a multi-level compressed data sequence; Configure the storage format of the ciphertext data for the multi-level compressed data sequence; wherein the storage format includes at least a metadata area and a ciphertext data area; If the index structure corresponding to the ciphertext data meets the preset conditions, the storage format of the ciphertext data and the storage requirements corresponding to the index structure are determined, and the ciphertext query results are stored and managed according to the storage format and the storage requirements.

[0015] In some embodiments, the method further includes: The query request is parsed, and the metadata in the query request is extracted. The metadata is then converted into a secure form that supports the encrypted operation through a preset comparison protocol. The converted metadata is encrypted to obtain encrypted metadata; wherein the metadata includes at least user information and access policies; The encrypted metadata is stored in the metadata area, and the ciphertext data is stored in the ciphertext data area; A privacy protection gateway is constructed to verify the user information and the access policy, and to convert the verified query request into a query format adapted to the encrypted data, and to securely merge the query results corresponding to the query request.

[0016] In some embodiments, after performing the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request, the method further includes: Configure a secure computing framework and build a component library based on the secure computing framework; wherein the secure computing framework includes at least ciphertext length, polynomial degree, and noise level; Build an adaptation mode for the component library with different processing platforms to enable compatible calls to the component library on different processing platforms; Configure the query optimizer and the execution engine to support the index structure corresponding to the encrypted data in order to complete the query optimization.

[0017] According to a second aspect of this disclosure, a database processing apparatus is provided, comprising: The processing unit is used to acquire the data to be encrypted, encrypt the data to be encrypted to obtain ciphertext data, and construct an index structure corresponding to the ciphertext data to obtain a ciphertext database. A determining unit is configured to, in response to a received query request for the encrypted data, determine the encrypted operation corresponding to the encrypted database based on the query request; wherein the encrypted operation is used to characterize a direct computation operation on the encrypted data; A partitioning unit is used to divide the ciphertext database into at least two ciphertext subsets when the amount of data in the ciphertext database is determined to be greater than a preset data amount threshold. An execution unit is configured to perform the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request.

[0018] In some embodiments, the processing unit includes: A conversion module is used to convert the data to be encrypted into a plaintext vector; The first generation module is used to perform the ciphertext operation on the plaintext vector to generate the ciphertext data; The first processing module is used to format the data structure of the ciphertext data to obtain formatted ciphertext data. A construction module is used to construct an index structure that supports the formatted ciphertext data, thereby obtaining the ciphertext database.

[0019] In some embodiments, the determining unit includes: The parsing module is used to parse the query request and determine the operation type of the aggregate function corresponding to the query request; The splitting module is used to split the operation type into basic operation combinations in the ciphertext space; wherein, the ciphertext space is the computing environment constituted during the execution of the computation operation by the ciphertext operation, and the basic operation combinations include at least addition and multiplication operations; The design module is used to design corresponding calculation templates for the aggregation function according to different operation types; The second generation module is used to generate the ciphertext operation based on the calculation template and the index structure.

[0020] In some embodiments, the splitting module includes: The accumulation submodule is used to accumulate the ciphertext data using a homomorphic adder when the operation type is determined to be a summation operation, and to obtain the accumulation result. The calculation submodule is used to perform the summation operation when the operation type is determined to be an average operation, and to calculate the ciphertext data using a homomorphic multiplier to obtain the calculation result; The judgment submodule is used to judge the ciphertext data using a homomorphic comparator when the operation type is determined to be a counting operation, and to obtain the judgment result.

[0021] In some embodiments, the partitioning unit includes: The first determining module is used to determine the number of ciphertext subsets in the ciphertext database based on the ciphertext features of the ciphertext data; wherein the ciphertext features include at least ciphertext size and distribution characteristics; A partitioning module is used to determine the target number of partitions in the number of partitions of the ciphertext subset based on the silhouette coefficient; wherein the silhouette coefficient is used to evaluate the clustering effect of the ciphertext subset; The second determining module is used to determine the target partitioning quantity as the at least two ciphertext subsets.

[0022] In some embodiments, the execution unit includes: An execution module is used to allocate computing nodes to each ciphertext subset and perform the ciphertext operation on each ciphertext subset according to the computing nodes; The acquisition module is used to acquire the intermediate results corresponding to each computing node. The merging module is used to securely merge the intermediate results of all ciphertext subsets to obtain the ciphertext query result.

[0023] In some embodiments, the merging module includes: The allocation submodule is used to allocate the intermediate results of all the ciphertext subsets to the corresponding number of servers; The merging submodule is used to securely merge the intermediate results from a corresponding number of servers through the ciphertext operation to obtain the ciphertext query result.

[0024] In some embodiments, the apparatus further includes an exception unit, the exception unit comprising: The second processing module is used to process the ciphertext data according to the precision requirements of the ciphertext operation to obtain similar ciphertext data. The filtering module is used to filter the similar ciphertext data, filter out the similar ciphertext data that does not belong to the preset set, and obtain valid ciphertext data; The configuration module is used to configure a calculation threshold based on the distribution characteristics of the valid ciphertext data, identify the valid ciphertext data that exceeds the calculation threshold as outliers, and filter the outliers; wherein the distribution characteristics include at least one of mean, variance, and quantile.

[0025] In some embodiments, the second processing module includes: The monitoring submodule is used to monitor the calculation error corresponding to the accuracy requirement during the execution of the ciphertext operation. If the calculation error is determined to be greater than the preset error boundary, the calculation error is corrected to obtain the corrected calculation result. The ciphertext data is then processed based on the corrected calculation result to obtain the similar ciphertext data. The processing submodule is used to perform optimization processing using a preset gradient descent method when it is determined that the calculation error corresponding to the corrected calculation result is still greater than the preset error boundary, until the calculation error is less than or equal to the preset error boundary, to obtain the corrected calculation result, and to process the ciphertext data according to the corrected calculation result to obtain the similar ciphertext data.

[0026] In some embodiments, the apparatus further includes: The conversion and encoding unit is configured to, after the execution unit performs the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request, determine the ciphertext polynomial according to the ciphertext operation, convert the ciphertext polynomial into an integer sequence, and perform data encoding on the integer sequence to obtain the data-encoded integer sequence. The first compression unit is used to reduce the storage bits of each integer in the encoded integer sequence using a compression mechanism to obtain a compressed integer sequence. The second compression unit is used to compress the compressed integer sequence using a compression algorithm to obtain a multi-level compressed data sequence. The first configuration unit is used to configure the storage format of the ciphertext data for the multi-level compressed data sequence; wherein the storage format includes at least a metadata area and a ciphertext data area; The first storage unit is used to determine the storage format of the ciphertext data and the storage requirements corresponding to the index structure when the index structure corresponding to the ciphertext data meets the preset conditions, and to store and manage the ciphertext query results according to the storage format and the storage requirements.

[0027] In some embodiments, the apparatus further includes: A conversion unit is used to parse the query request, extract the metadata in the query request, and convert the metadata into a secure form that supports the ciphertext operation through a preset comparison protocol. An encryption unit is used to encrypt the converted metadata to obtain encrypted metadata; wherein the metadata includes at least user information and access policies; The second storage unit is used to store the encrypted metadata in the metadata area and the ciphertext data in the ciphertext data area; The first construction unit is used to construct a privacy protection gateway, verify the user information and the access policy, convert the verified query request into a query form adapted to the encrypted data, and securely merge the query results corresponding to the query request.

[0028] In some embodiments, the apparatus further includes: The second configuration unit is configured to configure a secure computing framework and build a component library based on the secure computing framework after the execution unit performs the ciphertext operation on the at least two ciphertext subsets and obtains the ciphertext query result corresponding to the query request; wherein the secure computing framework includes at least ciphertext length, polynomial degree and noise level; The second building unit is used to build the adaptation mode between the component library and different processing platforms, so as to realize the compatible calling of the component library on different processing platforms; The third configuration unit is used to configure the query optimizer and the execution engine so that the query optimizer and the execution engine support the index structure corresponding to the encrypted data to complete the query optimization.

[0029] According to a third aspect of this disclosure, an electronic device is provided, comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect embodiment.

[0030] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are configured to cause the computer to perform the method described in the first aspect of the present disclosure.

[0031] According to a fifth aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method described in the first aspect of the preceding embodiments.

[0032] In summary, the database processing method, apparatus, electronic device, and storage medium provided in this disclosure include: acquiring data to be encrypted; encrypting the data to be encrypted to obtain ciphertext data; and constructing an index structure corresponding to the ciphertext data to obtain a ciphertext database; responding to a received query request for the ciphertext data; determining the ciphertext operation corresponding to the ciphertext database based on the query request; wherein the ciphertext operation is used to represent a direct computation operation on the ciphertext data; when the data volume of the ciphertext database is determined to be greater than a preset data volume threshold, dividing the ciphertext database into at least two ciphertext subsets, and performing ciphertext operations on at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request; by directly performing ciphertext operations on the ciphertext data, the query calculation can be completed without decryption, ensuring the security of the ciphertext data during the query process. For ciphertext databases with a data volume exceeding a preset threshold, the method of dividing ciphertext subsets and performing ciphertext operations, combined with a pre-constructed index structure, can improve the processing efficiency of ciphertext queries and avoid computational delays when the data volume is large.

[0033] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0034] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1 A schematic flowchart illustrating a database processing method provided in an embodiment of this disclosure; Figure 2 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 3 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 4 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 5 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 6 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 7 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 8 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 9A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 10 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 11 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 12 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 13 A schematic flowchart illustrating another database processing method provided in an embodiment of this disclosure; Figure 14 A schematic diagram of the structure of a database processing apparatus provided in an embodiment of this disclosure; Figure 15 A schematic diagram of the structure of another database processing apparatus provided in an embodiment of this disclosure; Figure 16 A schematic block diagram of an example electronic device provided for embodiments of this disclosure. Detailed Implementation

[0035] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0036] The following description, with reference to the accompanying drawings, outlines a database processing method and apparatus, an electronic device, and a storage medium according to embodiments of the present disclosure.

[0037] Figure 1 This is a schematic flowchart illustrating a database processing method provided in an embodiment of the present disclosure.

[0038] like Figure 1 As shown, the method includes the following steps: Step 101: Obtain the data to be encrypted, encrypt the data to be encrypted to obtain ciphertext data, and construct the index structure corresponding to the ciphertext data to obtain the ciphertext database.

[0039] In this embodiment, data to be encrypted is obtained from the raw data acquisition end. The obtained data to be encrypted covers business information, ensuring that the subsequently constructed database can meet business needs. After obtaining the data to be encrypted, it needs to be encrypted to convert the raw data into a ciphertext form that cannot be directly interpreted. Calculations are performed using an encryption key to finally generate ciphertext data. After generating the ciphertext data, a corresponding index structure is constructed to quickly locate the target ciphertext data during subsequent queries, avoiding the inefficiency caused by fully traversing the ciphertext database. The index structure needs to associate the ciphertext data with the physical address in the storage medium according to preset rules based on the characteristics associated with the ciphertext data. By storing all the encrypted ciphertext data together with the constructed index structure, a complete ciphertext database can be formed, achieving orderly management of the ciphertext data.

[0040] Step 102: In response to the received query request for the ciphertext data, determine the ciphertext operation corresponding to the ciphertext database according to the query request; wherein, the ciphertext operation is used to represent a calculation operation performed directly on the ciphertext data.

[0041] In some embodiments, user-initiated query requests are received through a preset query interface, such as a client operation interface or API interface. The query request must explicitly point to ciphertext data in the ciphertext database. Upon receiving a query request, a query processing flow is immediately triggered to ensure that the user's query needs are responded to in a timely manner. After the processing flow is initiated, the query request is first parsed and semantically extracted. From the parsing and semantic extraction, the operation object (i.e., the range of ciphertext data to be processed) and the operation intent (such as summation, counting, averaging, etc.) are determined. Then, according to the extracted operation intent, the corresponding calculation logic is matched. The calculation logic must meet the requirement of "directly calculating on ciphertext data," which is a ciphertext operation. The characteristic of ciphertext operation is that it does not require decrypting the ciphertext data into plaintext; all calculation processes are completed in ciphertext form to ensure data security.

[0042] Step 103: If it is determined that the amount of data in the ciphertext database is greater than a preset data amount threshold, the ciphertext database is divided into at least two ciphertext subsets, and the ciphertext operation is performed on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request.

[0043] In some embodiments, before performing ciphertext operations, the amount of data in the ciphertext database to be processed is counted, and the count is compared with a preset data volume threshold. The preset data volume threshold is pre-set based on computing resource configuration (such as the number of CPU cores and memory size) and query response time requirements. If the amount of data in the ciphertext database is greater than the preset data volume threshold, it indicates that a single processing operation is likely to cause computational delays due to the large amount of data, and it needs to be divided into at least two ciphertext subsets. When dividing the ciphertext subsets, the constructed index structure is combined, and the ciphertext features associated with the index (such as time and data category) are used to split the ciphertext database into at least two ciphertext subsets, ensuring that the amount of data in each ciphertext subset is less than or equal to the preset data volume threshold. Then, ciphertext operations are performed on each ciphertext subset to obtain intermediate results for each ciphertext subset. Finally, all intermediate results are integrated through operations that match the ciphertext operations (such as isomorphic addition) to generate the ciphertext query results corresponding to the query request.

[0044] The above methods achieve privacy protection for the data to be encrypted through encryption, and provide a fast locator for queries by combining the index structure; ciphertext operations avoid the decryption process, eliminating the risk of data leakage; dividing the ciphertext subset and distributed computing reduces the computational pressure under large data volumes, improves query response speed, and ensures that the ciphertext database operates stably and efficiently in real business scenarios.

[0045] In summary, the database processing method provided in this disclosure includes: acquiring data to be encrypted, encrypting the data to be encrypted to obtain ciphertext data, and constructing an index structure corresponding to the ciphertext data to obtain a ciphertext database; responding to a received query request for the ciphertext data, determining the ciphertext operation corresponding to the ciphertext database based on the query request; wherein the ciphertext operation is used to represent direct computation operations on the ciphertext data; when the data volume of the ciphertext database is determined to be greater than a preset data volume threshold, dividing the ciphertext database into at least two ciphertext subsets, and performing ciphertext operations on at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request; by directly performing ciphertext operations on the ciphertext data, the query calculation can be completed without decryption, ensuring the security of the ciphertext data during the query process. For ciphertext databases with a data volume exceeding a preset threshold, the method of dividing ciphertext subsets and performing ciphertext operations, combined with a pre-constructed index structure, can improve the processing efficiency of ciphertext queries and avoid computational delays when the data volume is large.

[0046] Figure 2 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The illustrated embodiment further explains step 101. Figure 2 This may include the following steps: Step 201: Convert the data to be encrypted into a plaintext vector.

[0047] In some embodiments, sensitive data is classified and labeled according to database characteristics and business needs, and an open-source database sensitive information scanning tool (such as SQLMap) is used to perform automated scanning to identify data to be encrypted (such as data tables and fields containing private content such as customer information and transaction records). Batch processing technology is used to integrate and package data of the same type into plaintext vectors.

[0048] Step 202: Perform the ciphertext operation on the plaintext vector to generate the ciphertext data.

[0049] In some embodiments, integer and floating-point numbers in the plaintext vector are labeled to obtain a structured plaintext dataset to be encrypted. Appropriate polynomial parameters are selected for the integer and floating-point numbers in the structured plaintext dataset to construct a lattice cryptography system. A lattice basis matrix with good geometric properties is constructed using a lattice cryptography algorithm (Lenstra-Lenstra-Lovász, LLL). Public and private key pairs are generated through random sampling using a uniform or discrete Gaussian distribution. The key is then executed in parallel on a multi-core processor (such as a CPU) using an interface (such as the OpenMP library). The algorithm improves key generation efficiency and verifies the correctness of generated key pairs. It ensures key pair availability by encrypting and decrypting sample data. A lattice-based fully homomorphic encryption scheme is applied to the structured plaintext dataset. Integer data is encoded into polynomial plaintext using binary factorization, and floating-point data is processed and converted into polynomial plaintext using fixed-point representation. The encoded polynomial plaintext is then encrypted using a verified public key. The encryption algorithm is executed in parallel on a multi-core CPU using the OpenMP library, accelerating the entire encryption process and ultimately yielding the encrypted ciphertext data.

[0050] Step 203: Format the data structure of the ciphertext data to obtain formatted ciphertext data.

[0051] In some embodiments, the encrypted data is adapted to the index structure to be built. Different index structures have specific requirements for the storage format, field order, and data length of the encrypted data. If the structure of the encrypted data does not match the index structure, the index will not be able to associate the encrypted data. During processing, the adaptation rules of the index structure must be determined first, and then the field order of the encrypted data and the storage length of the encrypted elements must be adjusted to ensure that the formatted encrypted data can be recognized and associated by the index structure.

[0052] Step 204: Construct an index structure that supports the formatted ciphertext data to obtain the ciphertext database.

[0053] In some embodiments, different types of ciphertext data are stored in corresponding data tables, and an index structure that supports ciphertext data retrieval is constructed using Bloom filter technology. This avoids directly establishing a mapping relationship between plaintext and ciphertext, ultimately forming a fully homomorphic encrypted ciphertext database to achieve secure storage and management of sensitive data.

[0054] To facilitate understanding, an example is given below: 100 customer records are packaged into a plaintext vector, where integer types such as age and account balance are labeled as integers, while floating-point types such as transaction amounts are labeled as floating-point numbers; the polynomial modulus is then selected. A lattice cryptography system with a polynomial degree n=1024 was constructed; the LLL algorithm was used to generate the lattice basis matrix, and public and private key pairs were generated through discrete Gaussian distribution sampling. The key generation process was parallelized using OpenMP on an 8-core CPU, reducing the original 10-minute key generation time to approximately 2 minutes; the generated key pairs were verified by selecting 10 sample data for encryption and decryption tests to ensure that the decrypted plaintext was completely consistent with the original data; during ciphertext operations, integer ciphertext data, such as age 25, was encoded into a polynomial [1,1,0,0,1] using binary factorization, while floating-point data... For example, an account balance of 3.14 is first converted to 314 and then encoded as a polynomial [0,1,0,1,1,1,1,0,0]. These polynomial plaintexts are then encrypted using a verified public key. The encryption process is parallelized on an 8-core CPU using OpenMP, reducing the encryption time for 100,000 records from 30 minutes to approximately 5 minutes. The encrypted ciphertext data is then formatted, and different types of ciphertext data are stored in corresponding data tables, such as storing encrypted customer information in an encrypted customer table. A Bloom filter is used to construct an index structure that supports ciphertext data retrieval, with the Bloom filter length set to [value missing]. Using three independent hash functions, the system can quickly retrieve approximately one million encrypted records while maintaining a false positive rate of less than 1%. The resulting fully homomorphic encrypted ciphertext database expands the original 10GB plaintext database to approximately 50GB, achieving secure storage and management of ciphertext data. It should be noted that the above example is for illustrative purposes only and does not limit the specific content.

[0055] By employing the above methods, the data to be encrypted is converted into a plaintext vector, providing a standardized data format for subsequent encryption operations and ensuring that data features are not lost. Ciphertext operations generate directly computable ciphertext data, protecting data privacy while supporting subsequent query needs. Formatting processes adapt the ciphertext data to the index structure, resolving compatibility issues between data and the index. The construction of the index structure and the formation of a ciphertext database not only achieves orderly storage of ciphertext data but also provides a foundation for rapid location in response to subsequent query requests, thus comprehensively improving the security and query efficiency of the ciphertext database.

[0056] Figure 3 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The illustrated embodiment further explains step 102. Figure 3 This may include the following steps: Step 301: Parse the query request and determine the operation type of the aggregate function corresponding to the query request.

[0057] In some embodiments, parsing a query request requires combining the structure of the encrypted database with the user's intent to avoid parsing deviations due to data encryption characteristics. The specific process is as follows: First, the query request statement is broken down using a syntax parser to extract the "target field" (such as the salary field "salary"), "filtering conditions" (such as the department "Technical Department", the time "2024"), and "operation descriptions" (such as "calculate average", "calculate sum", "statistical quantity"); then, according to the preset mapping rules of the encrypted database, the operation descriptions and aggregation functions are matched one-to-one, and combined with the encryption type of the target field (such as "salary" being a fully homomorphic encrypted field that supports homomorphic operations), the operation type of the aggregation function is finally determined. The entire process must ensure that the parsing result is compatible with the computational capabilities of the encrypted space.

[0058] To facilitate understanding, the following example illustrates the process: Taking the query "Query the average salary of 1 million employee salary records in the Technology Department for 2024" as an example: First, the query request is parsed, extracting the target field "salary" (encrypted using the BFV algorithm in the encrypted database), the filter conditions "department=Technology Department" and "year=2024" (both are encrypted association features bound to salary data), and the operation description "calculate the average". Then, according to the preset mapping rules, "calculate the average" is matched to the AVG aggregate function. Simultaneously, the encryption type of the "salary" field is verified to support homomorphic addition and multiplication operations, ultimately determining that the aggregate function operation type corresponding to the query request is AVG. If the user request is "Statistics on the number of employees in the Technology Department in 2024", the operation description "statistics on the number" is matched to the COUNT type, and the filter conditions remain unchanged. It should be noted that the above example is merely illustrative and does not limit the specific content.

[0059] Step 302: Decompose the operation type into basic operation combinations in the ciphertext space; wherein, the ciphertext space is the computing environment formed during the execution of the computation operation by the ciphertext operation, and the basic operation combinations include at least addition and multiplication operations.

[0060] In some embodiments, the definition of the ciphertext space is first clarified. The ciphertext space is a dedicated computing environment for ciphertext operations. All operations are performed in ciphertext form based on the fully homomorphic encryption algorithm. When splitting operation types, it is necessary to combine the configured fully homomorphic encryption computing circuit to decompose aggregate functions such as SUM, AVG, and COUNT into combinations of "addition operation", "multiplication operation" or "comparison operation + addition operation", and each basic operation corresponds to a specific circuit design.

[0061] To facilitate understanding, an example is provided below: Based on the determined AVG operation type, the "Calculation of the average salary of the Technology Department in 2024" is first broken down into two basic operations: First, a homomorphic addition operation is performed on the encrypted data of the "salary" field (to calculate the total salary); second, a homomorphic multiplication operation is performed on the "total salary encrypted data" and the "reciprocal encrypted data of the number of employees in the Technology Department in 2024" (to calculate the average value). Among them, the addition operation is implemented through "cascaded 8-bit full adder circuits" (to adapt to the accumulation requirement of 1 million data entries), and the multiplication operation is performed through the configured homomorphic multiplier circuit (to ensure compatibility with the encrypted format of the addition result). If the operation type is SUM (such as "Total Salary of the Computing Technology Department in 2024"), then only the "Homomorphic Addition Operation" is split, and the cascaded 8-bit full adder circuit is used directly for processing; if the operation type is COUNT (such as "Number of Employees in the Statistics Technology Department in 2024"), then the homomorphic comparator circuit is used to determine whether the ciphertext of "Employee Identifier" is non-zero, and then the adder circuit is used to accumulate the non-zero items to obtain the number of employees.

[0062] Step 303: Design corresponding calculation templates for the aggregation function according to different operation types.

[0063] In some embodiments, the design of calculation templates requires the use of pre-compilation technology to build a query template library. The templates are stored in a specific format (such as JSON) and include information such as query type (corresponding operation type), target field, filter field, basic operation order, and associated circuit type to realize the solidification and reuse of operation logic. At the same time, a template matching algorithm is designed (such as using an edit distance algorithm with a threshold of 3). When the edit distance between the user query and the pre-stored template is less than 3, it is determined to be a successful match. For different operation types such as SUM, AVG, and COUNT, the templates need to be configured differently. For example, the SUM template only contains the addition operation order, the AVG template contains the "addition → multiplication" order, and the COUNT template contains the "comparison to addition" order to ensure that each operation type corresponds to the calculation template.

[0064] Step 304: Generate the ciphertext operation based on the calculation template and the index structure.

[0065] In some embodiments, the ciphertext generation operation requires integrating a computation template with a multi-level index structure (including Bloom filters and skip lists), and combining it with a parallel computing strategy: firstly, using a Bloom filter (such as length...) The system quickly filters out mismatched ciphertext data using bits, three independent hash functions, and a false positive rate of ≤1%. Then, it locates the target ciphertext data using a skip list (e.g., a maximum of 16 levels, with an average search time complexity of 10 ...

[0066] For example, the corresponding AVG query template is first found through template matching. Then, a Bloom filter is used to quickly filter out records that cannot be matched. Next, a skip list is used to perform an exact search on the remaining approximately 500,000 records. Finally, homomorphic SUM and COUNT operations are executed in parallel under the MapReduce framework to obtain an encrypted sum count. Homomorphic division is then performed to obtain the ciphertext result of the average salary. The query process is completed in the ciphertext space without decrypting the original data. It should be noted that the above example is only for illustrative purposes and does not limit the specific content.

[0067] By employing the above methods, we ensure that the aggregate function operation types are precisely matched with query requirements and ciphertext characteristics; by splitting basic operations and configuring circuits, we solve the implementation challenges of complex aggregate functions in the ciphertext space; by using pre-compiled templates and matching algorithms, we reduce the cost of repetitive design and improve the efficiency of ciphertext operation generation; by combining multi-level indexes and MapReduce parallel strategies, we optimize data filtering speed through Bloom filters and skip lists, and reduce large-scale computational pressure through data block partitioning. The resulting ciphertext operations ensure execution throughout the ciphertext space while balancing query efficiency and computational accuracy.

[0068] Figure 4 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 3 The illustrated embodiment further explains step 302. Figure 4 This may include the following steps: Step 401: If the operation type is determined to be a summation operation, the ciphertext data is accumulated using a homomorphic adder to obtain the accumulated result.

[0069] In some embodiments, the summation operation (corresponding to the aggregation function SUM) transforms the accumulation calculation of ciphertext data into a chain of homomorphic addition operations in the ciphertext space. This process relies on a dedicated circuit for SUM (such as a 32-bit homomorphic full adder circuit) in a pre-designed fully homomorphic encryption calculation circuit template. The accumulation of multiple bits of ciphertext data is achieved through cascading, ensuring that the accumulation process is adapted to the number of bits of the ciphertext data (such as 1024-bit ciphertext). When performing the summation operation, after locating the target ciphertext data from the ciphertext database, the homomorphic adder is called to perform homomorphic addition operations on each piece of ciphertext data in sequence, and the summation is gradually accumulated to obtain the ciphertext result, i.e., the accumulation result. The circuit belongs to an extended application of the basic circuit library containing 16-bit homomorphic AND gates, OR gates, and XOR gates, ensuring compatibility with the computational environment of the ciphertext space.

[0070] Step 402: If the operation type is determined to be an averaging operation, the summation operation is performed, and the ciphertext data is calculated using a homomorphic multiplier to obtain the calculation result.

[0071] In some embodiments, the averaging operation (corresponding to the aggregation function AVG) is implemented based on a combination of summation and homomorphic multiplication, relying on the homomorphic addition and multiplication properties of fully homomorphic encryption. First, the summation operation is performed to obtain the ciphertext result of the sum by accumulating the ciphertext data of the target. Then, the homomorphic multiplier circuit is called to perform homomorphic multiplication on the ciphertext result of the sum and the pre-calculated ciphertext value of the "reciprocal of the number of data" (such as stored in 32-bit fixed-point form) to obtain the ciphertext result of the average, i.e., the calculation result. The circuit template corresponding to this process is part of the fully homomorphic encryption calculation circuit template, wherein the multiplier circuit is compatible with the adder circuit to ensure that the ciphertext format remains consistent during the operation.

[0072] Step 403: If the operation type is determined to be a counting operation, the ciphertext data is judged using a homomorphic comparator to obtain the judgment result.

[0073] In some embodiments, the counting operation (corresponding to the aggregation function COUNT) transforms the logic of "counting the number of non-zero elements" into a combination of "homomorphic comparison and homomorphic accumulation" operations in the ciphertext space, based on the homomorphic comparison and addition properties of fully homomorphic encryption. This process relies on a homomorphic comparator and a homomorphic adder: First, the homomorphic comparator is called to perform a non-zero judgment on each ciphertext data, and the judgment result is represented by a single bit of ciphertext (e.g., non-zero is a specific ciphertext identifier, and zero is another identifier); then, the homomorphic adder circuit is called to perform an accumulation operation on the ciphertext identifiers of all non-zero judgment results to obtain the counted ciphertext result, i.e., the judgment result; wherein, the homomorphic comparator is a component of the basic circuit library, ensuring that the comparison logic is executed accurately in the ciphertext space.

[0074] Through the above methods, for summation, averaging, and counting operations, based on a fully homomorphic encrypted computation circuit template (such as one containing a 32-bit homomorphic full adder, homomorphic multiplier, 16-bit homomorphic comparator, and a basic logic gate library), the homomorphic addition, multiplication, and comparison properties of fully homomorphic encryption are utilized to transform aggregation function calculations into basic operations in the ciphertext space, ensuring that all operations are completed without decrypting the original data. Simultaneously, through the cascading and combination of dedicated circuits, the bit depth and format of the ciphertext data are adapted to ensure the accuracy of the accumulation, multiplication, division, and counting results, ultimately achieving the security and effectiveness of aggregation calculations in the ciphertext state.

[0075] Figure 5 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The illustrated embodiment further explains step 103. Figure 5 This may include the following steps: Step 501: Determine the number of ciphertext subsets in the ciphertext database based on the ciphertext features of the ciphertext data; wherein the ciphertext features include at least ciphertext size and distribution characteristics.

[0076] In some embodiments, based on the size of the ciphertext database and a preset size threshold, a clustering algorithm (such as K-means) is used to determine the number of ciphertext subsets. First, the ciphertext features (ciphertext size and distribution features) of the ciphertext data are extracted. The ciphertext size refers to the storage capacity of a single piece or block of ciphertext data, and the distribution features refer to the distribution pattern of the ciphertext data in the storage medium (such as the distribution according to the generation time and associated fields). By calculating the differences in ciphertext size and the distribution concentration of different data blocks, the ciphertext database is initially divided into multiple candidate clusters (i.e., the number of partitions), ensuring that the ciphertext features within each candidate cluster have high similarity, laying the foundation for accurately determining the number of partitions in the future.

[0077] Step 502: Determine the target number of partitions in the number of partitions of the ciphertext subset based on the silhouette coefficient; wherein the silhouette coefficient is used to evaluate the clustering effect of the ciphertext subset.

[0078] In some embodiments, the silhouette coefficient is used to quantitatively evaluate the clustering quality corresponding to different candidate partition numbers (i.e., K values ​​in the K-means algorithm). By calculating the similarity between each ciphertext data block and its own cluster, and its similarity with other clusters, the silhouette coefficient of the data block is obtained. Then, the average of the silhouette coefficients of all data blocks is taken as the overall clustering effect score for the corresponding K value. The preset range of K values ​​(e.g., 5-15) is traversed to calculate the silhouette coefficient of each K value. Finally, the K value with the largest silhouette coefficient is selected as the target partition number, ensuring that the partitioned ciphertext subset avoids computational redundancy caused by excessive data dispersion, and also prevents excessive data concentration from affecting parallel efficiency.

[0079] Step 503: Determine the target partitioning quantity as the at least two ciphertext subsets.

[0080] In some embodiments, the clustering (such as K-means) results corresponding to the determined target number of partitions (i.e., the optimal K value) are directly determined as the final ciphertext subsets. Each cluster is an independent ciphertext subset, and all subsets together cover the complete ciphertext database without data omission or duplication. At the same time, each ciphertext subset after partitioning must meet the requirement that its size is less than or equal to a preset size threshold, providing an adaptation basis for the resource configuration of parallel computing nodes.

[0081] By using the above methods, the initial rationality of the partitioning is ensured based on the ciphertext features and K-means clustering; the silhouette coefficient is used to accurately select the number of partitions, avoiding efficiency losses caused by subjectively setting the K value; the subset partitioning results are clearly defined, providing structurally regular processing objects for parallel computing, and ensuring the scientificity and adaptability of the ciphertext subset partitioning as a whole.

[0082] Figure 6 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The illustrated embodiment further explains step 103. Figure 6 This may include the following steps: Step 601: Assign a computing node to each ciphertext subset, and perform the ciphertext operation on each ciphertext subset according to the computing node.

[0083] In some embodiments, a distributed computing framework (such as MapReduce) is used to achieve parallel processing. Based on the number of ciphertext subsets and the resource configuration of computing nodes (such as the number of CPU cores and memory size), an independent computing node is allocated to each ciphertext subset to ensure load balancing across nodes. The computing nodes perform fully homomorphic encryption operations (such as the BGV scheme, with the key length configurable as needed) on the allocated ciphertext subsets. The entire operation is completed in the ciphertext space without plaintext conversion, and the computing process of each node is independent of each other, avoiding the risk of leakage caused by data interaction.

[0084] Step 602: Obtain the intermediate results corresponding to each computing node.

[0085] In some embodiments, the security and traceability of intermediate results must be ensured simultaneously when acquiring them. First, the intermediate result collection mechanism of a distributed computing framework (such as MapReduce) is used to collect the intermediate results generated by encrypted operations from each computing node, and all intermediate results are kept in encrypted state (relying on the characteristics of fully homomorphic encryption). Second, a unique identifier (such as composed of "node ID_timestamp_serial number") is assigned to each intermediate result to associate the intermediate result with the generating node and the generation time, which facilitates traceability and management. Finally, the collected intermediate results are stored in a distributed encrypted storage system (such as an encrypted version of the Hadoop Distributed File System), and the intermediate results are encrypted twice before storage (such as using the AES-256-bit encryption algorithm) to further enhance storage security.

[0086] Step 603: Securely merge the intermediate results of all ciphertext subsets to obtain the ciphertext query result.

[0087] In some embodiments, secure merging relies on a secret-sharing scheme (such as Shamir's SecretSharing) and homomorphic encryption. First, the final aggregated result corresponding to all intermediate results is split into n parts and distributed to n participants (such as computing nodes or dedicated servers). Each participant only holds partial information and does not have full access to the result. Second, a reconstruction threshold k is set, specifying that at least k participants must collaborate to reconstruct the complete result through the secret-sharing mechanism. Finally, during the reconstruction process, homomorphic encryption is used to perform secure computation, ensuring that all data interactions between participants are in ciphertext form, and the final ciphertext query result remains encrypted, achieving privacy protection without decryption throughout the process.

[0088] Through the above methods, distributed node allocation and fully homomorphic operations can significantly improve the efficiency of ciphertext computation; ciphertext state preservation, unique identification, and secondary encryption can ensure the security of intermediate results from generation to storage; secret sharing and homomorphic reconstruction prevent data leakage during the merging process, thus achieving efficient computation and secure output of large-scale ciphertext databases.

[0089] Figure 7 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 6 The illustrated embodiment further explains step 603. Figure 7 This may include the following steps: Step 701: Distribute the intermediate results of all the ciphertext subsets to the corresponding number of servers.

[0090] In some embodiments, firstly, based on the number of intermediate results and the storage and computing capabilities of the servers, a corresponding number of target servers are determined (usually consistent with the number of participants, i.e., n servers correspond to n result splits); secondly, the intermediate results that have been double-encrypted are retrieved from the distributed encrypted storage system, and the intermediate results of all ciphertext subsets are distributed to each server according to a preset allocation rule (such as according to the generation order of intermediate results or segmentation by identifier), ensuring that each server only receives its corresponding share of intermediate results and does not access other shares; at the same time, the server performs local secure storage of the received intermediate results, continuing the protection mechanism of double encryption (such as AES-256 bits) to prevent local storage leakage.

[0091] Step 702: Securely merge the intermediate results from the corresponding number of servers through the ciphertext operation to obtain the ciphertext query result.

[0092] In some embodiments, the merging process relies on a dual security mechanism of "secret sharing + homomorphic encryption". First, a secret sharing scheme (such as Shamir's SecretSharing) is initiated, splitting the aggregated result corresponding to the intermediate result to be merged into n parts (consistent with the number of servers), with each part containing only partial information. Second, each server is triggered to perform ciphertext operations (based on the addition and multiplication properties of fully homomorphic encryption) to perform collaborative computation on its locally held share of the intermediate result. During the computation, the servers only transmit intermediate interaction data in ciphertext form, without revealing the original share information. Finally, when the number of servers participating in the collaborative computation reaches a threshold k, the complete aggregated result is reconstructed using homomorphic encryption technology. This aggregated result remains in ciphertext state, which is the final ciphertext query result. Throughout the merging process, the splitting, transmission, computation, and reconstruction of the intermediate result are all completed in the ciphertext space, and all servers only participate in a part of the process, with no single node able to obtain the complete result.

[0093] By employing the above methods, distributed allocation and secondary encryption storage are used to achieve decentralized and secure management of intermediate results, reducing the risk of single-point leakage. Secret sharing and homomorphic collaborative computation ensure that each step of the merging process complies with the principle of not decryption. Ultimately, while protecting data privacy, encrypted query results are accurately generated, adapting to the secure result merging requirements of large-scale encrypted databases.

[0094] Figure 8 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The embodiment shown, Figure 8 This may include the following steps: Step 801: Based on the precision requirements of the ciphertext operation, process the ciphertext data to obtain similar ciphertext data.

[0095] In some embodiments, a multi-level approximation calculation scheme is adopted with the goal of balancing computational accuracy and efficiency. Based on the accuracy requirements of ciphertext operations (such as a specific number of decimal places), multi-level processing strategies (such as different truncation or rounding accuracies) are set, and ciphertext data is approximated by truncation, rounding and other techniques. At the same time, the Taylor expansion method is used to perform error propagation analysis, calculate the error boundaries corresponding to different accuracy levels, and establish a correspondence table between error boundaries and accuracy requirements to ensure that the processed ciphertext data (i.e., similar ciphertext data) is within the controllable error range, thus preserving computational characteristics while simplifying computational complexity.

[0096] Step 802: Filter the similar ciphertext data, and filter out the similar ciphertext data that does not belong to the preset set to obtain valid ciphertext data.

[0097] In some embodiments, the filtering relies on a pre-built Bloom filter; the Bloom filter is configured with specific capacities and false positive rates (e.g., capacity). With a false positive rate of 0.01%, multiple independent hash functions (such as 3, with options including MurmurHash, FNV, and Jenkins algorithms) are used to judge similar ciphertext data. If the ciphertext data does not belong to the preset set after hash mapping (i.e., it does not meet the basic conditions required for calculation), it is filtered out. At the same time, the judgment result of the Bloom filter is converted into a binary mask, and only the ciphertext data belonging to the preset set is retained to obtain valid ciphertext data, ensuring that the calculation is only performed on data that meets the conditions.

[0098] Step 803: Configure a calculation threshold based on the distribution characteristics of the valid ciphertext data, identify the valid ciphertext data that exceeds the calculation threshold as outliers, and filter the outliers; wherein, the distribution characteristics include at least one of mean, variance, and quantile.

[0099] In some embodiments, this step is performed in the ciphertext state using a secure multi-party computation protocol. First, the distribution characteristics of the valid ciphertext data are calculated in the homomorphic encryption state, including but not limited to statistical quantities such as mean, variance, and quantiles (e.g., quartiles Q1, Q2, Q3). Second, a calculation threshold is configured based on these characteristic values ​​(e.g., setting μ±3σ as the threshold range based on the mean and variance). Finally, valid ciphertext data exceeding the threshold range is marked as outliers and excluded from the calculation process to avoid interference from outliers on the overall calculation results and ensure calculation stability.

[0100] By employing the above methods, multi-level approximation calculations simplify the encrypted data while controlling errors, balancing accuracy and efficiency; Bloom filters quickly filter out invalid data from participating in the calculation, improving processing speed; and outliers are filtered based on distribution characteristics to avoid interference from extreme data, ensuring the overall accuracy and stability of fully homomorphic encryption calculations while reducing unnecessary consumption of computing resources.

[0101] Figure 9 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 8 The illustrated embodiment further explains step 801. Figure 9 This may include the following steps: Step 901: During the execution of the ciphertext operation, the calculation error corresponding to the accuracy requirement is monitored. If the calculation error is determined to be greater than the preset error boundary, the calculation error is corrected to obtain the corrected calculation result. The ciphertext data is then processed based on the corrected calculation result to obtain the similar ciphertext data.

[0102] In some embodiments, during the execution of ciphertext operations, the deviation between the calculation result and the accuracy requirement (i.e., the calculation error) is monitored in real time. When the calculation error is detected to be greater than the preset error boundary (e.g., 1e-6 determined based on Taylor expansion), an automatic error correction mechanism is activated. Newton interpolation is used for correction. By selecting multiple reference points before and after the error point, an interpolation polynomial (e.g., a cubic polynomial) is constructed to adjust the calculation result, resulting in a corrected calculation result. Subsequently, the approximate processing method of the ciphertext data is adjusted in reverse according to the corrected result (e.g., adjusting the truncation or rounding precision), and the ciphertext data is reprocessed to obtain similar ciphertext data that meets the current error control requirements.

[0103] Step 902: If the calculation error corresponding to the corrected calculation result is still greater than the preset error boundary, a preset gradient descent method is used for optimization until the calculation error is less than or equal to the preset error boundary, the corrected calculation result is obtained, and the ciphertext data is processed according to the corrected calculation result to obtain the similar ciphertext data.

[0104] In some embodiments, if the corrected calculation result still does not meet the accuracy requirements (i.e., the error is still greater than the preset boundary), a recalculation process is triggered, and a preset gradient descent method is used for iterative optimization. During the optimization process, a specific learning rate (e.g., 0.01) and a maximum number of iterations (e.g., 100) are set, and the calculation parameters are continuously updated in the ciphertext space. The error is re-evaluated after each iteration. The calculation is continued until the calculation error is less than or equal to the preset error boundary, and the final corrected calculation result is obtained. Finally, the approximate processing strategy of the ciphertext data is adjusted according to the final corrected calculation result (e.g., further refine the truncation precision), and the ciphertext data is reprocessed to obtain similar ciphertext data that meets the accuracy requirements.

[0105] Through the above methods, real-time monitoring and Newton interpolation correction are used to quickly respond to calculation errors and initially ensure the accuracy of ciphertext data processing. Gradient descent iterative optimization is adopted to provide solutions for stubborn errors, ensuring that the final processed similar ciphertext data strictly meets the preset accuracy requirements, thereby improving the reliability and accuracy of fully homomorphic encryption calculation from the error control level.

[0106] Figure 10 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The embodiment shown, Figure 10 This may include the following steps: Step 1001: Determine the ciphertext polynomial according to the ciphertext operation, convert the ciphertext polynomial into an integer sequence, and encode the integer sequence to obtain the encoded integer sequence.

[0107] In some embodiments, firstly, the ciphertext polynomial (the output form of fully homomorphic encryption computation) is determined based on the computation result of the ciphertext operation; then, the coefficients of the ciphertext polynomial are extracted and converted into an integer sequence using polynomial coefficient representation, realizing a structured conversion of the ciphertext from polynomial form to integer form; subsequently, the integer sequence is encoded using differential coding technology, which reduces the numerical differences within the sequence by calculating the differences between adjacent integers, thereby reducing the complexity of data compression, and finally obtaining the encoded integer sequence.

[0108] Step 1002: For the integer sequence after the data is encoded, a compression mechanism is used to reduce the number of bits stored for each integer to obtain a compressed integer sequence.

[0109] In some embodiments, for the encoded integer sequence, bit compression technology is used to record the position of the most significant bit of each integer, store only the numerical information of non-zero bits, and ignore the redundant zero values ​​of high bits, thereby reducing the number of bits stored for each integer. The compression mechanism does not change the numerical characteristics of the integer, but only achieves storage optimization by removing redundant bits, and finally obtains the compressed integer sequence, reducing storage usage while maintaining data integrity.

[0110] Step 1003: Compress the compressed integer sequence using a compression algorithm to obtain a multi-level compressed data sequence.

[0111] In some embodiments, multiple compression algorithms are applied sequentially to the compressed integer sequence to form a multi-level compression process. First, Huffman coding is used to construct a coding tree for high-frequency data patterns (such as repeated differences or numerical segments) in the sequence, reducing the data volume by shortening the coding length of high-frequency patterns. Second, arithmetic coding is applied to the remaining data after Huffman coding, mapping the data stream to real numbers between 0 and 1, further compressing it with a higher-precision coding method. Finally, run-length encoding is used to process data segments that repeat more than three times consecutively, replacing the original repeating sequence by recording the repetition value and the number of repetitions. After multi-level compression, a multi-level compressed data sequence with a significantly reduced data volume is obtained.

[0112] Step 1004: Configure the storage format of the ciphertext data for the multi-level compressed data sequence; wherein the storage format includes at least a metadata area and a ciphertext data area.

[0113] In some embodiments, a structured storage format is used to achieve standardized management of encrypted data. The storage format design must be compatible with fully homomorphic encryption features and includes two areas—a metadata area and a ciphertext data area. The metadata area is used to record management information, including but not limited to version number, encryption parameters (such as key length and algorithm identifier), data encoding method, compression algorithm identifier, root node information of the index structure, and reserved space. The ciphertext data area is used to store multi-level compressed data sequences and adds a checksum field to ensure the integrity of data storage and prevent damage or tampering.

[0114] Step 1005: If the index structure corresponding to the ciphertext data meets the preset conditions, determine the storage format of the ciphertext data and the storage requirements corresponding to the index structure, and store and manage the ciphertext query results according to the storage format and the storage requirements.

[0115] In some embodiments, closed-loop management is achieved through index verification and storage adaptation. First, the index structure of the ciphertext data is constructed using searchable encryption technology based on Bloom filters. The ciphertext data is stored in blocks according to specific key values, and the index nodes record the encrypted location information and metadata references (such as the offset of the corresponding data in the ciphertext data area). The preset conditions include, but are not limited to, the validity of Bloom filter parameters (such as the number of hash functions and the false positive rate) and the integrity of the index tree structure (such as the block organization logic and hierarchical relationship). When the index structure meets the preset conditions, it is confirmed that the storage format (metadata area and ciphertext data area) is compatible with the storage requirements of the index structure (such as block size and index node capacity). Finally, according to the adapted storage format and requirements, the ciphertext query results (i.e., the multi-level compressed data sequence) are stored in the specified medium, and fast retrieval and access management are achieved through the index structure.

[0116] Through the above methods, polynomial transformation and differential coding achieve structured preprocessing of ciphertext data, reducing redundant storage bits; multi-level compression significantly reduces data volume; structured storage format ensures data management standardization; index verification and adaptation ensure efficient storage and retrieval; and overall, while being compatible with fully homomorphic encryption, it improves the storage efficiency, integrity, and accessibility of ciphertext data, achieving secure and efficient management of ciphertext query results.

[0117] Figure 11 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The embodiment shown, Figure 11 This may include the following steps: Step 1101: Parse the query request and extract the metadata from the query request. Convert the metadata into a secure form that supports the ciphertext operation using a preset comparison protocol.

[0118] In some embodiments, firstly, the input query request (such as an SQL query statement) is subjected to syntactic analysis and semantic parsing. Information is extracted using parsing tools. The parsed information includes, but is not limited to, table names, field names, predicate conditions, etc. Metadata (such as user information, access policies, and other privacy-related information) is also separated. Subsequently, for the privacy-related parts of the extracted metadata (such as the comparison logic in the predicate conditions), a preset comparison protocol (such as a homomorphic comparison protocol) is used to transform them into a secure form that supports ciphertext operations. Data comparison in the encrypted state is achieved through homomorphic encryption comparison logic, ensuring that the metadata does not leak the original information when participating in ciphertext operations and can be directly adapted to a fully homomorphic encryption computing environment.

[0119] Step 1102: Encrypt the converted metadata to obtain encrypted metadata; wherein the metadata includes at least user information and access policies.

[0120] In some embodiments, metadata (such as user information, access policies, etc.) after being converted to a secure form is encrypted using a Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme. A master key of a preset length (e.g., 256 bits) is used to generate a corresponding key based on user attributes (e.g., role, permission level), ensuring that the encrypted metadata can only be decrypted by users who meet the access policy attributes. The encryption process ensures the privacy of the metadata, preventing unauthorized parties from obtaining user information and access rules, and ultimately yields the encrypted metadata.

[0121] Step 1103: Store the encrypted metadata in the metadata area and store the ciphertext data in the ciphertext data area.

[0122] In some embodiments, encrypted metadata is stored in a dedicated metadata area (such as a key-value storage system), which focuses on metadata management and fast access. At the same time, the ciphertext data after fully homomorphic encryption is stored in a separate ciphertext data area (such as a distributed file system), which is physically isolated from the metadata area to avoid the risk of leakage caused by data co-storage. In addition, an association mapping relationship between metadata and ciphertext data is established. The correspondence between metadata ID and ciphertext data storage location is stored through a hash table (such as using the MurmurHash algorithm) to ensure that the two can be efficiently associated during querying, while controlling the hash collision rate (such as ≤0.1%).

[0123] Step 1104: Construct a privacy protection gateway to verify the user information and the access policy, convert the verified query request into a query format adapted to the encrypted data, and securely merge the query results corresponding to the query request.

[0124] In some embodiments, a multi-layered privacy protection gateway is constructed as an intermediary layer between user requests and the database, including: Identity and permission verification: using zero-knowledge proof protocols (such as the Schnorr protocol) to verify user information and access policies, confirming the legitimacy of the user's identity and whether the request is within the authorized scope, and filtering unauthorized requests; Query transformation: for verified query requests, query rewriting technology is used to transform the original query form (such as SQL statements) into a query form adapted to encrypted data, ensuring compatibility with encrypted operations; Secure result merging: when the query involves multiple data sources, a multi-party secure computation protocol (such as Yao's Garbled Circuits) is used to merge the query results from each data source, generating the final result without disclosing the original data; the entire process is uniformly managed by the gateway to prevent the leakage or inference of privacy information.

[0125] By employing the above methods, while ensuring the query function, we can prevent the leakage and inference of private information, thus achieving multi-layered security protection for encrypted databases.

[0126] Figure 12 A flowchart illustrating a database processing method provided in an embodiment of this disclosure is further shown. Based on Figure 1 The embodiment shown, Figure 12 This may include the following steps: Step 1201: Configure a secure computing framework and build a component library based on the secure computing framework; wherein the secure computing framework includes at least ciphertext length, polynomial degree, and noise level.

[0127] In some embodiments, firstly, based on the ciphertext database structure and privacy protection scheme, a secure computing framework is configured. Besides specifying core parameters such as ciphertext length, polynomial degree, and noise level, a unified ciphertext data format and encryption parameter standard (e.g., based on fully homomorphic encryption schemes like BGV) must be defined, and a key exchange protocol based on lattice ciphers (e.g., the Ring-LWE protocol) must be developed to ensure the security of data exchange and transmission. Secondly, a cross-platform cryptographic component library is built based on this secure computing framework. The component library must implement basic fully homomorphic encryption operations, including but not limited to key generation, encryption, decryption, homomorphic addition, and homomorphic multiplication, while integrating hardware acceleration technologies (e.g., the AES-NI instruction set) to improve computational efficiency. Furthermore, a cross-language standardized API interface is generated using the SWIG tool, supporting calls from mainstream programming languages ​​such as C++, Java, and Python, controlling interface call overhead, and ensuring the usability and compatibility of the component library.

[0128] Step 1202: Construct an adaptation mode for the component library with different processing platforms to enable compatible calls to the component library on different processing platforms.

[0129] In some embodiments, an adapter pattern (or bridge pattern) is used to construct an adaptation layer between the component library and different processing platforms (such as CPU, GPU, FPGA), achieving seamless integration between the component library and each platform. The fully homomorphic encryption algorithm implementation is optimized for the characteristics of different platforms. For example, on a CPU platform, OpenMP is used to implement multi-threaded parallel computing to improve computation speed; on a GPU platform, the OpenCL programming model is used to schedule a large number of parallel threads (such as thousands of threads) to enhance ciphertext computation performance; on an FPGA platform, dedicated cryptographic circuits (such as multiple parallel computing units) are designed to adapt to ciphertext computation requirements. Simultaneously, a hardware abstraction layer (such as the POCL framework) is introduced to uniformly manage the computing resources of different platforms, control platform switching time, and ensure that the component library can be flexibly and compatiblely called across platforms, fully utilizing the computational advantages of different hardware. It should be noted that the above examples are merely illustrative and do not limit the specific content.

[0130] Step 1203: Configure the query optimizer and the execution engine to support the index structure corresponding to the encrypted data in order to complete the query optimization.

[0131] In some embodiments, firstly, the existing relational database architecture is improved by reconfiguring the query optimizer and execution engine based on the characteristics of fully homomorphic encryption. The query optimizer needs to adopt a cost-based optimization strategy, evaluate multiple query plans within the encrypted domain, select the optimal execution path, and support ciphertext indexes based on homomorphic comparable encryption schemes (such as Order-Preserving Encryption). The execution engine needs to develop a query plan generation algorithm that supports encrypted states, ensuring that query operations can be executed based on ciphertext indexes (such as index structures that are more efficient than linear scans), avoiding full traversal of ciphertext data. Ultimately, the query optimizer and execution engine can complete query optimization and execution within the encrypted domain, improving the query efficiency of ciphertext data.

[0132] Through the above methods, the secure computing framework and component library provide standardized and efficient basic capabilities for ciphertext processing; the cross-platform adaptation mode fully leverages the computing advantages of different hardware to improve the flexibility and performance of ciphertext operations; the query optimizer and execution engine adapt to ciphertext indexes and encryption field optimizations to solve the problem of low efficiency in ciphertext queries; the three work together to form a complete technical support system, ensuring that the fully homomorphic encrypted database has efficient ciphertext processing and query capabilities while ensuring data security, meeting the needs of large-scale concurrent scenarios.

[0133] Figure 13 The following is a flowchart illustrating a database processing method provided by an embodiment of this disclosure, including steps S1-S7 as follows: S1: Obtain the data to be encrypted, encrypt the data to be encrypted to obtain ciphertext data, and build the index structure corresponding to the ciphertext data to obtain the ciphertext database; S2: Parse the query request and determine the operation type of the aggregate function corresponding to the query request; decompose the operation type into basic operation combinations in the ciphertext space; where the ciphertext space is the computing environment formed during the execution of computational operations in the ciphertext, and the basic operation combinations include at least addition and multiplication operations; design corresponding computation templates for the aggregate function according to different operation types; generate ciphertext operations based on the computation templates and index structure; S3: If the amount of data in the ciphertext database is greater than the preset data amount threshold, divide the ciphertext database into at least two ciphertext subsets and perform ciphertext operations on at least two ciphertext subsets to obtain the ciphertext query results corresponding to the query request. S4: Based on the precision requirements of the ciphertext operation, process the ciphertext data to obtain similar ciphertext data; filter the similar ciphertext data to obtain valid ciphertext data that does not belong to the preset set; configure the calculation threshold based on the distribution characteristics of the valid ciphertext data, identify valid ciphertext data that exceeds the calculation threshold as outliers, and filter outliers. S5: Determine the ciphertext polynomial based on the ciphertext operations, convert the ciphertext polynomial into an integer sequence, and encode the integer sequence to obtain the encoded integer sequence; use a compression mechanism to reduce the storage bits of each integer to obtain a compressed integer sequence; compress the compressed integer sequence using a compression algorithm to obtain a multi-level compressed data sequence; configure the storage format for the ciphertext data of the multi-level compressed data sequence; the storage format includes at least a metadata area and a ciphertext data area; if the index structure corresponding to the ciphertext data meets the preset conditions, determine the storage format of the ciphertext data and the storage requirements corresponding to the index structure, and store and manage the ciphertext query results according to the storage format and storage requirements; S6: Parse the query request and extract the metadata from it. Convert the metadata into a secure form that supports ciphertext operations using a preset comparison protocol. Encrypt the converted metadata to obtain encrypted metadata. The metadata includes at least user information and access policies. Store the encrypted metadata in the metadata area and store the ciphertext data in the ciphertext data area. Build a privacy protection gateway to verify user information and access policies. Convert verified query requests into query formats adapted to ciphertext data and securely merge the query results corresponding to the query requests. S7: Configure a secure computing framework and build a component library based on the secure computing framework; the secure computing framework shall include at least the ciphertext length, polynomial degree, and noise level; build an adaptation mode for the component library and different processing platforms to achieve compatible calls of the component library on different processing platforms; configure the query optimizer and execution engine to enable the query optimizer and execution engine to support the index structure corresponding to the ciphertext data to complete query optimization.

[0134] It should be noted that the details of steps S1-S7 can be found in the specific embodiments described above, and will not be repeated here.

[0135] Corresponding to the database processing method described above, the present invention also proposes a database processing apparatus. Since the apparatus embodiments of the present invention correspond to the method embodiments described above, details not disclosed in the apparatus embodiments can be referred to in the method embodiments described above, and will not be repeated here.

[0136] Figure 14 This is a schematic diagram of the structure of a database processing apparatus provided in an embodiment of the present disclosure, as shown below. Figure 14 As shown, it includes: a processing unit 51, a determination unit 52, a division unit 53, and an execution unit 54.

[0137] Processing unit 51 is used to acquire data to be encrypted, encrypt the data to be encrypted to obtain ciphertext data, and construct an index structure corresponding to the ciphertext data to obtain a ciphertext database. The determining unit 52 is configured to, in response to a received query request for the encrypted data, determine the encrypted operation corresponding to the encrypted database based on the query request; wherein the encrypted operation is used to characterize a calculation operation performed directly on the encrypted data; The partitioning unit 53 is used to partition the ciphertext database into at least two ciphertext subsets when the amount of data in the ciphertext database is determined to be greater than a preset data amount threshold. The execution unit 54 is used to perform the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request.

[0138] In summary, the database processing apparatus provided in this disclosure includes: acquiring data to be encrypted, encrypting the data to be encrypted to obtain ciphertext data, and constructing an index structure corresponding to the ciphertext data to obtain a ciphertext database; responding to a received query request for the ciphertext data, determining the ciphertext operation corresponding to the ciphertext database based on the query request; wherein the ciphertext operation is used to represent direct computation operations on the ciphertext data; when the data volume of the ciphertext database is determined to be greater than a preset data volume threshold, dividing the ciphertext database into at least two ciphertext subsets, and performing ciphertext operations on at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request; by directly performing ciphertext operations on the ciphertext data, the query calculation can be completed without decryption, ensuring the security of the ciphertext data during the query process. For ciphertext databases with a data volume exceeding a preset threshold, the method of dividing ciphertext subsets and performing ciphertext operations, combined with a pre-constructed index structure, can improve the processing efficiency of ciphertext queries and avoid computational delays when the data volume is large.

[0139] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the processing unit 51 includes: Conversion module 511 is used to convert the data to be encrypted into a plaintext vector; The first generation module 512 is used to perform the ciphertext operation on the plaintext vector to generate the ciphertext data. The first processing module 513 is used to format the data structure of the ciphertext data to obtain formatted ciphertext data. The construction module 514 is used to construct an index structure that supports the formatted ciphertext data, thereby obtaining the ciphertext database.

[0140] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the determining unit 52 includes: Parsing module 521 is used to parse the query request and determine the operation type of the aggregate function corresponding to the query request; The splitting module 522 is used to split the operation type into basic operation combinations in the ciphertext space; wherein, the ciphertext space is the computing environment formed during the execution of the computation operation by the ciphertext operation, and the basic operation combinations include at least addition and multiplication operations; Design module 523 is used to design corresponding calculation templates for the aggregation function according to different operation types; The second generation module 524 is used to generate the ciphertext operation based on the calculation template and the index structure.

[0141] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the splitting module 522 includes: The accumulation submodule 5221 is used to accumulate the ciphertext data using a homomorphic adder when the operation type is determined to be a summation operation, and to obtain the accumulation result. The calculation submodule 5222 is used to perform the summation operation when the operation type is determined to be an average operation, and to perform calculation on the ciphertext data using a homomorphic multiplier to obtain the calculation result; The judgment submodule 5223 is used to judge the ciphertext data using a homomorphic comparator when the operation type is determined to be a counting operation, and to obtain the judgment result.

[0142] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the dividing unit 53 includes: The first determining module 531 is used to determine the number of ciphertext subsets in the ciphertext database based on the ciphertext features of the ciphertext data; wherein the ciphertext features include at least ciphertext size and distribution characteristics; The partitioning module 532 is used to determine the target number of partitions in the number of partitions of the ciphertext subset based on the silhouette coefficient; wherein the silhouette coefficient is used to evaluate the clustering effect of the ciphertext subset. The second determining module 533 is used to determine the target partitioning quantity as the at least two ciphertext subsets.

[0143] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the execution unit 54 includes: Execution module 541 is used to allocate computing nodes to each ciphertext subset and perform the ciphertext operation on each ciphertext subset according to the computing nodes; The acquisition module 542 is used to acquire the intermediate results corresponding to each computing node. The merging module 543 is used to securely merge the intermediate results of all ciphertext subsets to obtain the ciphertext query result.

[0144] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the merging module 543 includes: The allocation submodule 5431 is used to allocate the intermediate results of all the ciphertext subsets to the corresponding number of servers; The merging submodule 5432 is used to securely merge the intermediate results from a corresponding number of servers through the ciphertext operation to obtain the ciphertext query result.

[0145] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the device further includes an malfunction unit 55, which includes: The second processing module 551 is used to process the ciphertext data according to the precision requirements of the ciphertext operation to obtain similar ciphertext data. The filtering module 552 is used to filter the similar ciphertext data, filter out the similar ciphertext data that does not belong to the preset set, and obtain valid ciphertext data; The configuration module 553 is used to configure a calculation threshold based on the distribution characteristics of the valid ciphertext data, determine the valid ciphertext data that exceeds the calculation threshold as outliers, and filter the outliers; wherein the distribution characteristics include at least one of mean, variance, and quantile.

[0146] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the second processing module 551 includes: The monitoring submodule 5511 is used to monitor the calculation error corresponding to the accuracy requirement during the execution of the ciphertext operation, and when it is determined that the calculation error is greater than the preset error boundary, to correct the calculation error, obtain the corrected calculation result, and process the ciphertext data according to the corrected calculation result to obtain the similar ciphertext data. The processing submodule 5512 is used to perform optimization processing using a preset gradient descent method when it is determined that the calculation error corresponding to the corrected calculation result is still greater than the preset error boundary, until the calculation error is less than or equal to the preset error boundary, to obtain the corrected calculation result, and to process the ciphertext data according to the corrected calculation result to obtain the similar ciphertext data.

[0147] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15As shown, the device further includes: The conversion encoding unit 56 is configured to, after the execution unit 54 performs the ciphertext operation on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request, determine the ciphertext polynomial according to the ciphertext operation, convert the ciphertext polynomial into an integer sequence, and perform data encoding on the integer sequence to obtain the data-encoded integer sequence. The first compression unit 57 is used to reduce the storage bits of each integer in the encoded integer sequence using a compression mechanism to obtain a compressed integer sequence. The second compression unit 58 is used to compress the compressed integer sequence using a compression algorithm to obtain a multi-level compressed data sequence. The first configuration unit 59 is used to configure the storage format of the ciphertext data for the multi-level compressed data sequence; wherein the storage format includes at least a metadata area and a ciphertext data area; The first storage unit 510 is used to determine the storage format of the ciphertext data and the storage requirements corresponding to the index structure when the index structure corresponding to the ciphertext data meets the preset conditions, and to store and manage the ciphertext query results according to the storage format and the storage requirements.

[0148] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the device further includes: The conversion unit 511 is used to parse the query request, extract the metadata in the query request, and convert the metadata into a secure form that supports the ciphertext operation through a preset comparison protocol. The encryption unit 512 is used to encrypt the converted metadata to obtain encrypted metadata; wherein the metadata includes at least user information and access policies; The second storage unit 513 is used to store the encrypted metadata in the metadata area and the ciphertext data in the ciphertext data area; The first construction unit 514 is used to construct a privacy protection gateway, verify the user information and the access policy, convert the verified query request into a query form adapted to the encrypted data, and securely merge the query results corresponding to the query request.

[0149] Furthermore, in one possible implementation of the embodiments of this disclosure, such as Figure 15 As shown, the device further includes: The second configuration unit 515 is configured to configure a secure computing framework and build a component library based on the secure computing framework after the execution unit 54 performs the ciphertext operation on the at least two ciphertext subsets and obtains the ciphertext query result corresponding to the query request; wherein the secure computing framework includes at least ciphertext length, polynomial degree and noise level. The second construction unit 516 is used to construct the adaptation mode between the component library and different processing platforms, so as to realize the compatible calling of the component library on different processing platforms; The third configuration unit 517 is used to configure the query optimizer and the execution engine so that the query optimizer and the execution engine support the index structure corresponding to the encrypted data to complete the query optimization.

[0150] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of the embodiments of this disclosure, and the principle is the same. Therefore, the embodiments of this disclosure are not limited thereto.

[0151] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0152] Figure 16 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0153] like Figure 16 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 602 or loaded from storage unit 608 into RAM (Random Access Memory) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An I / O (Input / Output) interface 605 is also connected to the bus 604.

[0154] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0155] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as database processing methods. For example, in some embodiments, the database processing methods may be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform the aforementioned database processing method by any other suitable means (e.g., by means of firmware).

[0156] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0157] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0158] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0159] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0160] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0161] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service system that addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0162] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0163] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0164] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A processing method of a database, characterized by, The method comprises: obtaining to-be-encrypted data, performing encryption processing on the to-be-encrypted data to obtain ciphertext data, and constructing an index structure corresponding to the ciphertext data to obtain a ciphertext database; in response to a received query request for the ciphertext data, determining a ciphertext operation corresponding to the ciphertext database according to the query request; wherein the ciphertext operation is used to represent a calculation operation directly performed on the ciphertext data; in a case where a data quantity of the ciphertext database is greater than a preset data quantity threshold, dividing the ciphertext database into at least two ciphertext subsets, and performing the ciphertext operation on the at least two ciphertext subsets to obtain a ciphertext query result corresponding to the query request.

2. The method of claim 1, wherein, The method comprises: converting the to-be-encrypted data into a plaintext vector; performing the ciphertext operation on the plaintext vector to generate the ciphertext data; performing format processing on a data structure of the ciphertext data to obtain formatted ciphertext data; constructing an index structure supporting the formatted ciphertext data to obtain the ciphertext database.

3. The method of claim 1, wherein, The method comprises: parsing the query request to determine an operation type of an aggregation function corresponding to the query request; splitting the operation type into a basic operation combination in a ciphertext space; wherein the ciphertext space is a calculation environment formed in a process in which the ciphertext operation performs the calculation operation, and the basic operation combination at least includes addition operation and multiplication operation; designing a corresponding calculation template for the aggregation function according to different operation types; generating the ciphertext operation based on the calculation template and the index structure.

4. The method of claim 3, wherein, The operation type at least includes summation operation, average operation and counting operation, and the splitting of the operation type into the basic operation combination in the ciphertext space comprises: in a case where the operation type is determined to be summation operation, performing accumulation on the ciphertext data by using a homomorphic adder to obtain an accumulation result; in a case where the operation type is determined to be average operation, performing the summation operation, and performing calculation on the ciphertext data by using a homomorphic multiplier to obtain a calculation result; in a case where the operation type is determined to be counting operation, performing judgment on the ciphertext data by using a homomorphic comparator to obtain a judgment result.

5. The method of claim 1, wherein, The method comprises: determining a division number of ciphertext subsets in the ciphertext database according to ciphertext features of the ciphertext data; wherein the ciphertext features at least include ciphertext size and distribution features; determining a target division number in the division number of the ciphertext subsets according to a contour coefficient; wherein the contour coefficient is used to evaluate clustering effects of the ciphertext subsets; determining the target division number as the at least two ciphertext subsets.

6. The method of claim 1, wherein, The performing the ciphertext operation on the at least two ciphertext subsets to obtain a ciphertext query result corresponding to the query request comprises: allocating a computing node to each ciphertext subset, and performing the ciphertext operation on each ciphertext subset according to the computing node; obtaining an intermediate result corresponding to each computing node; safely merging the intermediate results of all ciphertext subsets to obtain a ciphertext query result.

7. The method of claim 6, wherein, The safely merging the intermediate results of all ciphertext subsets to obtain a ciphertext query result comprises: allocating the intermediate results of all ciphertext subsets to a corresponding number of servers; safely merging the intermediate results in the corresponding number of servers by the ciphertext operation to obtain the ciphertext query result.

8. The method of claim 1, wherein, When the ciphertext data in the ciphertext database has an abnormal value, the method further comprises: processing the ciphertext data according to the accuracy requirement of the ciphertext operation to obtain similar ciphertext data; screening the similar ciphertext data, filtering the similar ciphertext data not belonging to a preset set to obtain valid ciphertext data; configuring a computing threshold based on the distribution characteristics of the valid ciphertext data, determining the valid ciphertext data greater than the computing threshold as an abnormal value, and filtering the abnormal value; wherein the distribution characteristics include at least one of mean, variance and quantile.

9. The method of claim 8, wherein, The processing the ciphertext data according to the accuracy requirement of the ciphertext operation to obtain similar ciphertext data comprises: monitoring a calculation error corresponding to the accuracy requirement in the process of performing the ciphertext operation, correcting the calculation error when it is determined that the calculation error is greater than a preset error boundary to obtain a corrected calculation result, and processing the ciphertext data according to the corrected calculation result to obtain the similar ciphertext data; when it is determined that the calculation error corresponding to the corrected calculation result is still greater than the preset error boundary, performing optimization processing by using a preset gradient descent method until the calculation error is less than or equal to the preset error boundary to obtain the corrected calculation result, and processing the ciphertext data according to the corrected calculation result to obtain the similar ciphertext data.

10. The method of claim 1, wherein, After the performing the ciphertext operation on the at least two ciphertext subsets to obtain a ciphertext query result corresponding to the query request, the method further comprises: determining a ciphertext polynomial according to the ciphertext operation, converting the ciphertext polynomial into an integer sequence, and performing data encoding on the integer sequence to obtain a data-encoded integer sequence; reducing the storage bits of each integer by using a compression mechanism on the data-encoded integer sequence to obtain a compressed integer sequence; compressing the compressed integer sequence by using a compression algorithm to obtain a multi-level compressed data sequence; configuring a storage format of the ciphertext data for the multi-level compressed data sequence; wherein the storage format at least includes a metadata area and a ciphertext data area. In a case where it is determined that the index structure corresponding to the ciphertext data meets a preset condition, a storage format of the ciphertext data and a storage requirement corresponding to the index structure are determined, and the ciphertext query result is stored and managed according to the storage format and the storage requirement.

11. The method of claim 1, wherein, The method further includes: parsing the query request and extracting metadata in the query request, converting the metadata into a secure form supporting the ciphertext operation through a preset comparison protocol; encrypting the converted metadata to obtain encrypted metadata; wherein the metadata at least includes user information and an access policy; storing the encrypted metadata to a metadata area and storing the ciphertext data to a ciphertext data area; constructing a privacy protection gateway, verifying the user information and the access policy, and converting the query request that passes the verification into a query form adapted to the ciphertext data, and securely merging the query result corresponding to the query request.

12. The method of claim 1, wherein, After the ciphertext operation is performed on the at least two ciphertext subsets to obtain the ciphertext query result corresponding to the query request, the method further includes: configuring a secure computing framework and constructing a component library based on the secure computing framework; wherein the secure computing framework at least includes ciphertext length, polynomial degree and noise level; constructing an adaptation mode of the component library and different processing platforms to realize compatible calling of the component library on different processing platforms; configuring a query optimizer and an execution engine, so that the query optimizer and the execution engine support the index structure corresponding to the ciphertext data to complete query optimization.

13. A processing device of a database, characterized by, The apparatus includes: a processing unit configured to obtain to-be-encrypted data, encrypt the to-be-encrypted data to obtain ciphertext data, and construct an index structure corresponding to the ciphertext data to obtain a ciphertext database; a determination unit configured to, in response to a received query request for the ciphertext data, determine a ciphertext operation corresponding to the ciphertext database according to the query request; wherein the ciphertext operation is used to represent a computing operation directly on the ciphertext data; a division unit configured to, in a case where a data amount of the ciphertext database is greater than a preset data amount threshold, divide the ciphertext database into at least two ciphertext subsets; an execution unit configured to perform the ciphertext operation on the at least two ciphertext subsets to obtain a ciphertext query result corresponding to the query request.

14. An electronic device, comprising: includes: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-12.

15. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-12.

16. A computer program product, characterised in that, includes a computer program, which, when executed by a processor, implements the method of any one of claims 1-12.

Images