Query method, system and device, client and server

Abstract

The invention provides a query method, system and device, a client and a server. In the embodiment, the method is applied to a client and comprises the steps that a to-be-queried keyword is obtained, and the to-be-queried keyword comprises at least one to-be-queried feature; sending the security value of the at least one to-be-queried feature to a server; the security value of each to-be-queried feature is a numerical value after the to-be-queried feature is processed; receiving a data ciphertext sent by the server; the data ciphertext corresponds to a target array, the target array comprises all the to-be-queried features, and the target array is determined based on the security values of all the to-be-queried features. And the client only knows the security value of the feature and does not know the related information of the array, so that the security of searchable encrypted query performed by the server is improved.

Description

Technical Field

[0001] This invention relates to the field of query technology, and in particular to a query method, system, device, client, and server. Background Technology

[0002] Data security is a crucial issue for enterprise security. Currently, data security is improved by encrypting data to obtain ciphertext and then querying the ciphertext.

[0003] In related technologies, the client can build a tree index and store the encrypted data corresponding to the leaf nodes in the tree index on the server. When querying, the client determines the node position in the tree index corresponding to the keyword to be searched and sends the node position to the server. Based on the position, the server finds the leaf node related to the keyword, uses the encrypted data corresponding to the leaf node as the search result, and feeds the search result back to the client.

[0004] However, sending the node position of a keyword in the tree index to the server may expose the tree index, thus reducing the security of searchable encrypted queries. Summary of the Invention

[0005] This invention provides a query method, system, device, client, and server. The client only knows the security value of the feature and is unaware of the array-related information, thereby improving the security of the server's searchable encrypted query.

[0006] In a first aspect, embodiments of the present invention provide a query method applied to a client, comprising:

[0007] Obtain the keyword to be queried, which includes at least one feature to be queried; send the security value of at least one feature to be queried to the server; the security value of each feature to be queried is the value after processing; receive the encrypted data sent by the server; the encrypted data corresponds to a target array, which includes at least one feature to be queried, and the target array is determined based on the security value of at least one feature to be queried.

[0008] In this scheme, the client sends the security value of the feature of the keyword to be queried to the server. The server uses the security value to perform array queries. The client only knows the security value of the feature and does not know the relevant information of the array, which improves the security of the server's searchable encrypted queries.

[0009] In one possible implementation, the security value of each queried feature is used to indicate each queried feature with security characteristics. For example, the security value of each queried feature is a value after security processing of the queried feature, such as the value of the feature after operations on the key and the queried feature.

[0010] In one possible implementation, the target array is an array of multiple arrays.

[0011] In one possible implementation, a security value for each feature to be queried is used to determine the information needed to query multiple arrays.

[0012] In this solution, the process of querying the required information of the array based on the security value is entirely placed inside the server, thereby improving the security of searchable encrypted queries.

[0013] In one possible implementation, the server determines the target array from multiple arrays by traversing multiple arrays.

[0014] In this solution, the server can save storage overhead by directly storing the array and the corresponding encrypted data. The query can be performed by traversing multiple arrays, which can reduce the complexity of the query and thus improve the query efficiency.

[0015] In one possible implementation, each of the multiple arrays corresponds to a keyword, and the keyword includes at least one feature. Each array is constructed based on at least one feature of the keyword corresponding to each array. In other words, for a keyword, the array corresponding to the keyword is constructed based on the security value of at least one feature of the keyword. For example, for each of the multiple arrays, the array is constructed based on the security values ​​of several features of the keyword corresponding to that array.

[0016] In one possible implementation, the ciphertext of the target array corresponds to the keyword of the target array.

[0017] In one possible implementation, the target array is constructed based on the security values ​​of at least one feature of the keyword corresponding to the target array. It should be noted that at least one feature of the keyword corresponding to the target array includes all the query features of the keyword to be queried, thus enabling the server to retrieve the target array based on all the query features of the keyword to be queried.

[0018] In one possible implementation, for each of at least one feature of the keyword, a security value for each feature is used to determine a construction parameter corresponding to that feature. The construction parameter includes the position of the feature corresponding to the construction parameter in a target array. The target array is constructed based on the construction parameters corresponding to each of the at least one feature of the keyword. For example, for any feature of the keyword, the security value of that feature is used to determine a construction parameter corresponding to that feature. This construction parameter includes the position of the feature in the target array corresponding to the keyword. The target array corresponding to the keyword is constructed based on the construction parameters corresponding to each feature of the keyword.

[0019] In one possible implementation, the position of the feature corresponding to the construction parameter in the target array is obtained by mapping the security value of the feature corresponding to the construction parameter to a non-cryptographic hash function.

[0020] In this scheme, the unencrypted hash function has a faster computation speed, which can improve computational efficiency. It should be noted that since the client only determines the security value of the feature, and the server determines the position of the feature in the array, considering that the server does not need to communicate with the client to determine the position of the feature in the array, and does not involve data security in data transmission, there is no need to restrict the use of encrypted hash functions. Unencrypted hash functions can be selected to improve computational efficiency.

[0021] In one possible implementation, the construction parameters also include the fingerprint of the feature corresponding to the construction parameters.

[0022] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters of that feature, which include the position of the feature in the target array and the fingerprint of the feature.

[0023] In one possible implementation, the fingerprint of the feature corresponding to the construction parameter is determined by operating on the security value of the feature corresponding to the construction parameter and the identifier value of the target array.

[0024] In this solution, fingerprints are determined by the security value of features and the identifier value of data. This can distinguish the same features from different keywords, reduce the probability that the server can understand high-frequency features, and improve data security.

[0025] For example, for any feature of a keyword, a fingerprint of that feature is determined based on the security value of that feature and the identifier value of the target array.

[0026] In one possible implementation, the security value is the key-related hash message authentication code.

[0027] In one possible implementation, before obtaining the keywords to be queried, the following steps are also included:

[0028] Send the target array and the corresponding encrypted data to the server so that the server can store multiple arrays and the encrypted data for each array.

[0029] Secondly, embodiments of the present invention provide a query method applied to a server, the method comprising:

[0030] The system receives the security values ​​of the query features in the query keywords sent by the client. The query keywords include at least one query feature, and the security value of each query feature is the processed value of the query feature. Based on the security values ​​of at least one query feature, the system determines a target array. The target array includes at least one query feature. The system then sends the encrypted data corresponding to the target array to the client.

[0031] In this scheme, the client sends the security value of the feature of the keyword to be queried to the server. The server uses the security value to perform array queries. The client only knows the security value of the feature and does not know the relevant information of the array, which improves the security of the server's searchable encrypted queries.

[0032] In one possible implementation, the security value of each queried feature is the numerical value obtained by combining the key of each queried feature with the value of each queried feature, which is used to indicate the queried feature with security characteristics.

[0033] In one possible implementation, the target array is determined based on the security value of at least one feature to be queried, including:

[0034] The target array is determined from multiple arrays based on the security value of at least one feature to be queried.

[0035] In this implementation example, the server determines the target array from multiple arrays by traversing multiple arrays.

[0036] In this solution, the server can save storage overhead by directly storing the array and the corresponding encrypted data. The query can be performed by traversing multiple arrays, which can reduce the complexity of the query and thus improve the query efficiency.

[0037] For example, determining a target array from multiple arrays based on the security value of at least one feature to be queried includes:

[0038] Based on the security value of at least one feature to be queried, determine the query result corresponding to each of the multiple arrays. The query result is used to indicate whether the array corresponding to the query result includes at least one feature to be queried. The array that includes at least one feature to be queried among the multiple arrays is taken as the target array.

[0039] Specifically, for each of the multiple arrays, based on the security value of all query features of the query keyword, it is determined whether the array contains all query features. If so, the array is used as the target array.

[0040] In this implementation example, before receiving the security value of the query feature in the query keyword sent by the client, the method further includes:

[0041] Receive multiple arrays sent by the client and the ciphertext of the data corresponding to each array; store multiple arrays and the ciphertext of the data corresponding to each array.

[0042] In this implementation example, the security value of each feature to be queried is used to determine the information needed to query multiple arrays.

[0043] In this solution, the process of querying the required information of the array based on the security value is entirely placed inside the server, thereby improving the security of searchable encrypted queries.

[0044] In one possible implementation, each of the multiple arrays corresponds to a keyword, and each array is constructed based on a security value of at least one feature of the keyword corresponding to that array. In other words, for a keyword, the array corresponding to the keyword is constructed based on a security value of at least one feature of the keyword.

[0045] In one possible implementation, the encrypted data corresponding to the keyword corresponds to the array corresponding to the keyword. For example, the encrypted data corresponding to the target array corresponds to the keyword corresponding to the target array. In another possible implementation, for each feature among at least one feature of the keyword, a security value for each feature is used to determine the construction parameter corresponding to each feature, the construction parameter including the position of the feature corresponding to the construction parameter in the array corresponding to the keyword; the array corresponding to the keyword is constructed using the construction parameter corresponding to each feature among at least one feature of the keyword.

[0046] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters corresponding to that feature. The construction parameters include the position of the feature in the array corresponding to the keyword, which is constructed based on the construction parameters corresponding to each feature of the keyword.

[0047] In one example of this implementation, a target array is determined from multiple arrays based on the security value of at least one query feature; the target array includes at least one query feature, including:

[0048] For each of the multiple arrays, based on the security value of at least one query feature, determine the construction parameters corresponding to each query feature in each array; based on the construction parameters corresponding to each query feature in each array, determine whether each array includes at least one query feature.

[0049] In one possible implementation, the position of the feature corresponding to the construction parameter in the array corresponding to the keyword is obtained by mapping the security value of the feature corresponding to the construction parameter to an unencrypted hash function.

[0050] In this scheme, the unencrypted hash function has a faster computation speed, which can improve computational efficiency. It should be noted that since the client only determines the security value of the feature, and the server determines the position of the feature in the array, considering that the server does not need to communicate with the client to determine the position of the feature in the array, and does not involve data security in data transmission, there is no need to restrict the use of encrypted hash functions. Unencrypted hash functions can be selected to improve computational efficiency.

[0051] In one possible implementation, the construction parameters also include the fingerprint of the feature corresponding to the construction parameters.

[0052] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters of that feature, which include the position of the feature in the array corresponding to the keyword and the fingerprint of the feature.

[0053] In one possible implementation, the fingerprint of the feature corresponding to the construction parameter is determined by operating on the security value of the feature corresponding to the construction parameter and the identifier value of the array corresponding to the keyword.

[0054] For example, for any feature of a keyword, the fingerprint of that feature is determined based on the security value of that feature and the identifier value of the array corresponding to the keyword.

[0055] In this solution, fingerprints are determined by the security value of features and the identifier value of data. This can distinguish the same features from different keywords, reduce the probability that the server can understand high-frequency features, and improve data security.

[0056] In one possible implementation, the security value is the key-related hash message authentication code.

[0057] Thirdly, embodiments of the present invention provide a query system, including: a client and a server;

[0058] The client is used to obtain the keywords to be queried, and the keywords to be queried include at least one feature to be queried.

[0059] The client sends the security value of at least one feature of the query keyword to the server; the security value of each query feature is the processed value of the query feature.

[0060] The server is used to determine the target array based on the security value of at least one feature to be queried;

[0061] The server is used to send encrypted data corresponding to the target array to the client.

[0062] In one possible implementation, the security value of each queried feature is the numerical value obtained by combining the key of each queried feature with the value of each queried feature, which is used to indicate the queried feature with security characteristics.

[0063] In one possible implementation, the server is used to determine the target array from multiple arrays based on a security value of at least one feature to be queried.

[0064] In this implementation example, the server is used to determine the target array from multiple arrays by traversing multiple arrays.

[0065] In this solution, the server can save storage overhead by directly storing the array and the corresponding encrypted data. The query can be performed by traversing multiple arrays, which can reduce the complexity of the query and thus improve the query efficiency.

[0066] For example, the server is used to determine the query result corresponding to each of the multiple arrays based on the security value of at least one feature to be queried, the query result being used to indicate whether the array corresponding to the query result includes at least one feature to be queried; and the array that includes at least one feature to be queried among the multiple arrays is used as the target array.

[0067] Specifically, for each of the multiple arrays, based on the security value of all query features of the query keyword, it is determined whether the array contains all query features. If so, the array is used as the target array.

[0068] In this implementation example, the server is used to receive multiple arrays sent by the client and the ciphertext of the data corresponding to each array; and to store the multiple arrays and the ciphertext of the data corresponding to each array.

[0069] In this implementation example, the security value of each feature to be queried is used to determine the information needed to query multiple arrays.

[0070] In this solution, the process of querying the required information of the array based on the security value is entirely placed inside the server, thereby improving the security of searchable encrypted queries.

[0071] In one possible implementation, each of the multiple arrays corresponds to a keyword, and each array is constructed based on a security value of at least one feature of the keyword corresponding to that array. In other words, for a keyword, the array corresponding to the keyword is constructed based on a security value of at least one feature of the keyword.

[0072] In one possible implementation, the encrypted data corresponding to the keyword corresponds to the array corresponding to the keyword. For example, the encrypted data corresponding to the target array corresponds to the keyword corresponding to the target array. In another possible implementation, for each feature among at least one feature of the keyword, a security value for each feature is used to determine the construction parameter corresponding to each feature, the construction parameter including the position of the feature corresponding to the construction parameter in the array corresponding to the keyword; the array corresponding to the keyword is constructed using the construction parameter corresponding to each feature among at least one feature of the keyword.

[0073] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters corresponding to that feature. The construction parameters include the position of the feature in the array corresponding to the keyword, which is constructed based on the construction parameters corresponding to each feature of the keyword.

[0074] In one example of this implementation, the server determines, for each of the multiple arrays, the construction parameters corresponding to each query feature in each array based on the security value of at least one query feature; and determines whether each array includes at least one query feature based on the construction parameters corresponding to each query feature in each array.

[0075] In one possible implementation, the position of the feature corresponding to the construction parameter in the array corresponding to the keyword is obtained by mapping the security value of the feature corresponding to the construction parameter to an unencrypted hash function.

[0076] In this scheme, the unencrypted hash function has a faster computation speed, which can improve computational efficiency. It should be noted that since the client only determines the security value of the feature, and the server determines the position of the feature in the array, considering that the server does not need to communicate with the client to determine the position of the feature in the array, and does not involve data security in data transmission, there is no need to restrict the use of encrypted hash functions. Unencrypted hash functions can be selected to improve computational efficiency.

[0077] In one possible implementation, the construction parameters also include the fingerprint of the feature corresponding to the construction parameters.

[0078] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters of that feature, which include the position of the feature in the array corresponding to the keyword and the fingerprint of the feature.

[0079] In one possible implementation, the fingerprint of the feature corresponding to the construction parameter is determined by operating on the security value of the feature corresponding to the construction parameter and the identifier value of the array corresponding to the keyword.

[0080] For example, for any feature of a keyword, the fingerprint of that feature is determined based on the security value of that feature and the identifier value of the array corresponding to the keyword.

[0081] In this solution, fingerprints are determined by the security value of features and the identifier value of data. This can distinguish the same features from different keywords, reduce the probability that the server can understand high-frequency features, and improve data security.

[0082] In one possible implementation, the security value is the key-related hash message authentication code.

[0083] Fourthly, embodiments of the present invention provide a query device applied to a client, comprising:

[0084] The acquisition module is used to acquire the keywords to be queried, and the keywords to be queried include at least one feature to be queried.

[0085] The sending module is used to send the security value of at least one feature of the keyword to be queried to the server; the security value of each feature is the value after processing the feature.

[0086] The receiving module is used to receive encrypted data sent by the server; the encrypted data corresponds to a target array, the target array includes at least one feature to be queried, and the target array is determined based on the security value of at least one feature to be queried.

[0087] Fifthly, embodiments of the present invention provide a query device applied to a guest server, comprising:

[0088] The receiving module is used to receive the security values ​​of the query features in the query keywords sent by the client; the query keywords include at least one query feature, and the security value of each query feature is the value after processing the query feature.

[0089] An array determination module is used to determine a target array based on a security value of at least one feature to be queried; the target array includes at least one feature to be queried.

[0090] The sending module is used to send encrypted data corresponding to the target array to the client.

[0091] In a sixth aspect, embodiments of the present invention provide a client machine, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the method provided in the first aspect.

[0092] In a seventh aspect, embodiments of the present invention provide a server, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the method provided in the second aspect.

[0093] Eighthly, embodiments of the present invention provide a query device, characterized in that the device executes computer program instructions to perform the method provided in the first aspect, or to perform the method provided in the second aspect. Exemplarily, the device may be a chip or a processor.

[0094] In one example, the device may include a processor that may be coupled to memory, read instructions from the memory and execute the methods provided in the first aspect, or execute the methods provided in the second aspect, according to those instructions. The memory may be integrated into the chip or processor, or it may be independent of the chip or processor.

[0095] Ninthly, embodiments of the present invention provide a computer storage medium storing instructions that, when executed on a computer, cause the computer to perform the method provided in the first aspect or the method provided in the second aspect.

[0096] In a tenth aspect, embodiments of the present invention provide a computer program product comprising instructions that, when executed on a computer, cause the computer to perform the method provided in the first aspect or the method provided in the second aspect. Attached Figure Description

[0097] Figure 1 This is a system architecture diagram of the query system provided in the embodiments of the present invention;

[0098] Figure 2 This is a flowchart illustrating the query method provided in this embodiment of the invention. Figure 1 ;

[0099] Figure 3 This is a schematic diagram of a query scenario provided in an embodiment of the present invention;

[0100] Figure 4 This is an illustration of the query method provided in the embodiments of the present invention. Figure 2 ;

[0101] Figure 5 This is a schematic diagram of the array construction process provided in an embodiment of the present invention;

[0102] Figure 6 This is a schematic diagram of the structure of the query device provided in the embodiment of the present invention. Figure 1 ;

[0103] Figure 7 This is a schematic diagram of the structure of the query device provided in the embodiment of the present invention. Figure 2 ;

[0104] Figure 8 This is a schematic diagram of the structure of the client 110 provided in an embodiment of the present invention. Detailed Implementation

[0105] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be described below with reference to the accompanying drawings.

[0106] In the description of the embodiments of the present invention, the words "exemplary," "for example," or "for instance" are used to indicate that they are examples, illustrations, or descriptions. Any embodiment or design that is described as "exemplary," "for example," or "for instance" in the embodiments of the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Rather, the use of the words "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a specific manner.

[0107] In the description of the embodiments of this invention, the term "and / or" is merely a description of the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, B existing alone, and A and B existing simultaneously. Furthermore, unless otherwise stated, the term "multiple" means two or more. For example, multiple systems refer to two or more systems, and multiple terminals refer to two or more terminals.

[0108] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and their variations all mean "including but not limited to," unless otherwise specifically emphasized.

[0109] The following explanations cover some of the terms used in this embodiment. It should be noted that these explanations are for the convenience of those skilled in the art and are not intended to limit the scope of protection claimed by this invention.

[0110] The exclusive OR (XOR) operation returns 0 if the corresponding bits are the same, and 1 if they are different. Specifically, if two corresponding bits are the same, the result is 0; otherwise, it is 1. The mathematical symbol for XOR is "⊕", and the computer symbol is "xor". Its operation is equivalent to binary addition without carry. In binary, 1 represents true and 0 represents false, so the XOR operation rules are: 0⊕0 = 0, 1⊕0 = 1, 0⊕1 = 1, 1⊕1 = 0.

[0111] Hash-based Message Authentication Code (HMAC): Proposed in 1996 by H. Krawezyk, M. Bellare, and R. Canetti, this method of message authentication based on a hash function and a key has become a de facto Internet security standard. It can be used in conjunction with any iterative hash function.

[0112] A trapdoor is a hidden mechanism within a system or file that allows a violation of security policies when specific input data is provided. This is typically a secret entry point set up for debugging and testing programs, allowing an insider to bypass normal security controls and directly access the program. In cryptography, the concept of a trapdoor can be extended to allow bypassing the security checks of an encryption system under certain conditions. For example, an encryption system might contain a trapdoor that prevents only those with specific information from decrypting data.

[0113] A Bloom filter (BF) is essentially a long binary vector and a series of random mapping functions. A Bloom filter can be used to determine whether an element is in a set.

[0114] First, we will introduce the query systems that may be applied to the query method provided in the embodiments of the present invention. Figure 1 This diagram illustrates an example architecture of a query system provided by an embodiment of the present invention. The query method provided by this embodiment can be applied to, for example... Figure 1 The system architecture diagram shown is as follows. Figure 1 As shown, the query system includes client 101, server 102, client 110, and server 120.

[0115] Here, client 101 can be understood as an application used to implement business logic. In practical applications, client 101 can run on electronic devices, such as several client machines 110, for example... Figure 1The diagram shows client machines 110A and 110B. A user runs client machine 101 through client machine 110, enabling client machine 101 to provide services and meet business needs. Of course, in some cases, client machine 110 may have a browser installed, allowing the user to access client machine 101 through the browser.

[0116] In this embodiment, server 102 provides services to clients and fulfills business requirements. In this embodiment, server 102 can be understood as an application that provides services to clients. In practical applications, server 102 can run on an electronic device such as server 120. This embodiment uses server 120 as an example for description; server 102 runs on server 120 to provide services to clients and meet business needs.

[0117] The client 110 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. Exemplary embodiments of the terminal devices involved in this solution include, but are not limited to, electronic devices running iOS, Android, Windows, Harmony OS, or other operating systems. This embodiment of the invention does not specifically limit the type of electronic device.

[0118] Among them, server 120 can be used to provide cloud services. It can be a device that can establish communication connections with other devices and provide computing and / or storage functions for other devices, such as a hardware server.

[0119] In this configuration, client 110 communicates with server 120 via a network. The network can be a wired network or a wireless network. It is understood that the network can use any known network communication protocol to achieve different communications; the aforementioned network communication protocol can be various wired and / or wireless communication protocols.

[0120] In the relevant technology, client 110 runs client 101 to extract the features of each keyword into three categories (A, AB, and BF), and store them in a tree index (divided into A layer, AB layer, and BF layer). Among them, the BF category can be understood as the features related to the Bloom filter (BF). The BF layer is used to store the Bloom filter (BF). The BF layer includes multiple leaf nodes, each of which is used to store the Bloom filter (BF). The encrypted data corresponding to each Bloom filter (BF) is used as the encrypted data corresponding to the leaf node. Finally, the tree index and the encrypted data corresponding to the leaf nodes in the BF layer are stored in server 120.

[0121] In practical implementation, client 110 runs client 101 to extract three types of features (A, AB, and BF) of the keywords to be searched, and determines the trapdoor Tr = (trA tr AB tr BF ), where tr A Used to indicate the node position of type A feature in layer A of the tree index, tr AB Used to indicate the node position of type B features in the AB layer of the tree index, tr BF Used to indicate the location of BF-class features within the BF layer. Sends a trapdoor Tr = (tr...) to server 120. A tr AB tr BF Server 120 runs server 102 to output search results and sends the search results back to client 110; the specific steps performed by server 120 are as follows:

[0122] Step 1. Based on tr A Search the encrypted index of layer A to determine the starting search node set of layers A and B;

[0123] Step 2. Based on tr AB Based on the initial search node set of layer AB, determine the set of nodes to be searched in layer BF;

[0124] Step 3. For each leaf node in the BF layer search node set obtained in Step 2, based on tr BF The content is used to determine whether the Bloom filter (BF) stored in the leaf node contains all the features of the keyword to be searched. If it does, the encrypted data corresponding to this leaf node is added to the search results.

[0125] However, client 110 directly sends the position of the keyword in the tree index (tr) to server 120. A tr AB tr BF This could expose the tree index, leading to reduced security for searchable encrypted queries.

[0126] Based on this, the present invention proposes a query method.

[0127] This method involves a client 110 sending the security value of a feature of a keyword to be queried to a server 120. The server 120 then performs an array search based on the security value of the feature. In this embodiment, the security value indicates a feature with security properties. For example, the security value can be a key to the feature and the numerical value obtained after processing the feature. In this solution, the client only knows the security value of the feature and not the relevant information of the array, thus improving the security of the server's searchable encrypted query. It should be noted that the security value is used to determine the information needed to query the array, and the entire process of querying the required information based on the security value is performed internally by the server, thereby improving the security of the searchable encrypted query.

[0128] In addition, server 120 stores multiple arrays and the corresponding encrypted data for each array. During the encrypted data query process, the encrypted data is queried by traversing multiple arrays. On the one hand, compared with tree index, directly storing arrays and their corresponding encrypted data can save storage overhead. On the other hand, compared with tree index-based queries, directly traversing multiple arrays can reduce query complexity and thus improve query efficiency.

[0129] This is only a brief overview of the method; for more details, please refer to the description below.

[0130] Next, in conjunction with the query system provided above, a query method provided by an embodiment of the present invention will be described in detail. The present invention will use a client 110 running client 101 and a server 120 running server 102 as an example to illustrate the solution provided by the present invention.

[0131] Figure 2 This is a flowchart illustrating the query method provided in this embodiment of the invention. This embodiment can be applied to electronic devices, specifically servers or general computers.

[0132] like Figure 2 As shown, the query method provided in this embodiment of the invention includes at least the following steps:

[0133] Step 201: Client 110 determines the index information, which includes multiple arrays and the encrypted data corresponding to each array. Each array corresponds to a keyword, and each array is constructed using the security values ​​of several features of the corresponding keyword. The security values ​​are numerical values ​​after feature processing.

[0134] In this embodiment of the invention, the security value is the numerical value after the feature has undergone security processing. For example, the security value can be the numerical value after the feature has been processed by a cryptographic algorithm. The cryptographic algorithm is an algorithm that processes data through encrypted mathematical functions to ensure information security. Therefore, the security value calculated by the cryptographic algorithm is used to indicate a feature with security characteristics. For example, the cryptographic algorithm can be a Key-Associated Hash Message Authentication Code (HMAC) algorithm. The encrypted mathematical function in the HMAC algorithm can be F(ki, i), where i represents the feature and ki represents the key of the feature. Only the feature needs to be considered; the array-related content does not need to be considered.

[0135] In this embodiment of the invention, for each of the multiple arrays, there is a corresponding keyword, and the array is constructed based on the security values ​​of several features of the keyword. In other words, for a keyword, the array corresponding to the keyword is constructed based on the security values ​​of several features of the keyword.

[0136] In one possible implementation, for each of the several features of a keyword, the safety value of that feature is used to determine the corresponding construction parameters, which include the position of that feature in the array corresponding to the keyword. Subsequently, based on the construction parameters corresponding to each of the several features of the keyword, the array corresponding to the keyword is constructed.

[0137] In its implementation, client 110 extracts M (positive integers greater than or equal to 1) features for each keyword from a pool of multiple keywords. These M features can be in ascending order, descending order, n (greater than or equal to 2)-grams, or spaced m (greater than or equal to 1) positions apart. For each feature i among the M features, a security value is calculated, and based on this security value, the corresponding construction parameters are determined. Based on the construction parameters corresponding to each of the M features, the array corresponding to the keyword is determined. It should be noted that client 110 pre-sets the arrays corresponding to the keywords for a pool of keywords. It is also worth noting that the number of features for each keyword can be different.

[0138] The construction parameters for each feature can include its position within the array corresponding to the keyword. Client 110 constructs the array corresponding to the keyword based on the position of each of the M features of the keyword within the data corresponding to the keyword. In specific implementation, for each feature i among the M features, client 110 substitutes the security value corresponding to feature i into N (positive integers greater than or equal to 1) position functions to determine the N positions corresponding to feature i. It should be noted that since client 110 pre-sets the array corresponding to the keyword, and this array has a specific size, N position functions need to be set according to the size of the array. The position functions can be hash functions, for example, h(F(ki, i)), and the N position functions can be denoted as h0(F(ki, i)), h1(F(ki, i)), ..., h... n (F(ki, i)); This embodiment of the invention does not limit the type of hash function. For example, it can be an unencrypted hash function, which has a faster operation speed and can improve the operation efficiency, but has lower security; or it can be an encrypted hash function, which is more complex to operate and takes more time, but has higher security.

[0139] Furthermore, the construction parameters corresponding to the features can also include the fingerprints of the features. Then, client 110 constructs an array corresponding to the keywords based on the position of each of the M features of the keywords in the data corresponding to the keywords and the fingerprint of each of the M features of the keywords. In specific implementation, for each feature i among the M features of the keywords, client 110 substitutes the security value corresponding to feature i into the fingerprint function to determine the fingerprint f corresponding to feature i. It is worth noting that client 110 pre-sets the array corresponding to the keywords, which has a specific size, and sets the fingerprint function according to the size of the array. The fingerprint function can be determined based on the security value of the features and the identifier value of the array corresponding to the keywords. Correspondingly, the identifier value of the array corresponding to the keywords can be the identifier value of the keywords; for example, the identifier value of the array corresponding to the keywords can be the keyword's sequence number; for example, the fingerprint function can be f(F(ki, i), j), where j represents the keyword's sequence number. It should be noted that the fingerprint function considers the identifier value of the keywords, which can distinguish the same features of different keywords, reduce the probability that server 120 understands high-frequency features, and improve data security.

[0140] In some possible embodiments, the array corresponding to the keywords can be constructed based on the construction parameters corresponding to each of the M features of the keywords in several ways:

[0141] Implementation Method A1: The construction parameters corresponding to the features can be the N positions of the features in the array corresponding to the keywords. Client 110 constructs the array corresponding to the keywords based on the N positions of each of the M features of the keywords in the data corresponding to the keywords. For each keyword, client 110 pre-sets the element value at each position in the array corresponding to the keywords to a single bit value: 0. For each feature i in the M features of the keyword, the values ​​at the N positions corresponding to feature i in the array corresponding to the keywords are set to preset non-zero values, such as a preset value of 1. After processing the M features, the array corresponding to the keywords is obtained.

[0142] Implementation method A2: The construction parameters corresponding to the features can include the N positions of the features in the array corresponding to the keywords and the fingerprint of the features. Then, client 110 constructs the array corresponding to the keywords based on the N positions of each of the M features of the keywords in the data corresponding to the keywords and the fingerprint of each of the M features of the keywords. For the M features of the keywords, client 110 records the target positions where unique features exist based on the N positions of each feature i in the array, deletes the unique features present in the target positions, and records the unique positions (also called target positions) of each of the M features of the keywords in the array corresponding to the keywords in order. The unique positions of different features i in the array corresponding to the keywords are different. According to the order of recording the target positions from late to early, the fingerprint of the unique feature at the target position and the contents of multiple positions in the array corresponding to the keywords are XORed, and the result of the XOR operation is put into the target position.

[0143] In practical implementation, client 110, based on the N positions of each feature i in the array corresponding to the keyword among the M features of the keyword, puts the M features into a pre-set array corresponding to the keyword. If a position containing only one feature is found in the array corresponding to the keyword, the coordinates of that position are added to a queue. Subsequently, position coordinates are continuously taken from the head of the queue, and the taken position coordinates are recorded.<key,index> The process involves creating a binary tuple where the key represents the unique feature at that position, and the index represents the position within the array corresponding to the keyword. Each position in the keyword array corresponding to that key is then removed. If, after removal, the keyword array contains a position with only one feature, the coordinate of that position is added to a queue. This process is repeated until a sequence of records is obtained.<key,index> Set the value of each element in the array corresponding to the pre-defined keywords to a multi-bit value, such as 000000, starting from the last recorded...<key,index> First, perform an operation (e.g., XOR) on the fingerprint f of the key and the contents of the N positions of the key in the array corresponding to the keyword, excluding the index, and place the result at the index position; then, for the previous record...<key,index> The fingerprint of the key and the contents of the key at the N positions outside the index in the array corresponding to the keyword are operated on, such as by XOR operation, and the process is repeated to obtain the array corresponding to the keyword.

[0144] Implementation method A3: The construction parameters corresponding to the features can include the N positions of the features in the array corresponding to the keywords and the fingerprint of the features. Then, client 110 constructs the array corresponding to the keywords based on the N positions of each of the M features of the keywords in the data corresponding to the keywords and the fingerprint of each of the M features of the keywords. The N position functions are used to map to hash buckets. The N positions of each of the M features in the array corresponding to the keywords represent the positions of the N hash buckets. The number of bits in each position in the array corresponding to the keywords is multi-bit. Client 110 sets the element value of each position in the array corresponding to the keywords to a multi-bit value, such as 000000. For each feature i in the M features of the keywords, the fingerprint f of feature i is put into the hash bucket with free space in the N positions of feature i in the array corresponding to the keywords.

[0145] After obtaining the arrays corresponding to multiple keywords, for each keyword, the encrypted data and the keyword's identifier value are associated with the corresponding array to determine the array's identifier value and the encrypted data. It should be noted that the lengths of the arrays corresponding to at least some of the keywords can be different or the same; this embodiment of the invention does not impose specific limitations on this.

[0146] It is worth noting that the above implementation is merely an example and does not constitute a specific limitation. In other possible implementations, the M features of multiple keywords can be combined to obtain multiple feature groups. The encrypted data can correspond to the feature groups. In this way, the array is used to represent all the features in the feature group corresponding to the array.

[0147] Step 202: Client 110 sends index information to server 120.

[0148] Server 120 pre-stores multiple arrays and the corresponding encrypted data for each array based on index information.

[0149] Step 203: Client 110 obtains the keyword to be queried, which includes at least one feature to be queried.

[0150] In this embodiment of the invention, the client 110 can display a query interface, where the user enters keywords to be queried. The keywords to be queried may include wildcards such as ? and *.

[0151] Step 204: Client 110 determines the security values ​​of all query features of the keyword to be queried.

[0152] In practical implementation, client 110 extracts several query features from the query keyword, and calculates the security value of each query feature i. For example, the security value is HMAC. It should be noted that the number of query features for the query keyword can be one or more, depending on the content of the query keyword.

[0153] It is worth noting that if the keyword to be queried contains wildcards, then when extracting the query features of the keyword to be queried, it is not necessary to extract the wildcards.

[0154] Step 205: Client 110 sends the security values ​​of all the features to be queried for the keyword to be queried to server 120.

[0155] Step 206: Server 120 determines the target array from multiple pre-stored arrays based on the security values ​​of all query features of the query keyword. The target array includes several query features of the query keyword.

[0156] In its implementation, server 120 determines a target array from multiple arrays based on the security values ​​and construction parameters of several query features of the query keyword. Specifically, for each array, server 120 determines the query parameters corresponding to each query feature in that array based on the security value of each query feature among all query features of the query keyword; and determines whether the array contains all query features of the query keyword based on the query parameters corresponding to each query feature in that array. It should be noted that the target array includes each query feature of the query keyword, that is, the target array includes all query features of the query keyword.

[0157] In some possible embodiments, server 120 reconstructs the construction parameters of each array based on the security values ​​of all query features of the query keyword, obtains the query parameters of each array, and determines the target array among multiple arrays based on the query parameters of each array. For example, if the query parameters of the data are used to indicate the N positions of the query feature in the array, then the query parameters corresponding to each query feature in that array may include the N positions of each query feature in the array; for example, if the query parameters of the data are the N positions of the query feature in the array and the fingerprint f of the query feature, then the query parameters corresponding to each query feature in that array may include the N positions of each query feature in the array and the fingerprint f of each query feature.

[0158] In some alternative implementations, server 120 determines the target array by traversing multiple arrays.

[0159] For example, for the array constructed in implementation method A1 in step 201, in step 206, the server 120 performs the following for each of the pre-stored arrays:

[0160] For each query feature i among all the query features of the query keyword, substitute the security value corresponding to query feature i into the N positional functions corresponding to the array: h0(F(ki,i)), h1(F(ki,i)), ..., h n (F(ki, i)) determines the query parameters, which are the N positions of each query feature i in the array of all query features of the query keyword; it is determined whether the content of the position of the query feature i in the array is a preset non-zero value. If it is, it means that the array contains the query feature; when the array contains each query feature i in the array of all query features of the query keyword, the array is used as the target array.

[0161] For example, for the array constructed in implementation method A2 in step 201, in step 206, the server 120 performs the following for each of the pre-stored arrays:

[0162] For each query feature i among several query features of the query keyword, substitute the security value corresponding to query feature i into N position functions: h0(F(ki,i)), h1(F(ki,i)), ..., h n (F(ki, i)), and, substitute the security value of the query feature i and the identifier value of the array into the fingerprint function f(F(ki, i), j) to obtain the query parameters, which are the fingerprint f of the query feature i and the N positions in the array; perform an operation such as XOR operation on the contents of the N positions of the query feature i in the array to obtain the operation result. If the operation result is the same as the fingerprint f of the query feature i, it means that the array contains the query feature; if the array contains each query feature i in all the query features of the query keyword, the array is used as the target array.

[0163] For example, for the array constructed in implementation method A3 in step 201, in step 206, the server 120 performs the following for each array in the index information:

[0164] For each query feature i among all the query features of the query keyword, substitute the security value corresponding to query feature i into the N positional functions corresponding to the array: h0(F(ki,i)), h1(F(ki,i)), ..., h n (F(ki, i)) and the fingerprint function determine the query parameters, which are the N positions of each query feature i in the array and the fingerprint f of all query features of the query keyword; determine whether the content of the query feature i at its position in the array contains the fingerprint of the query feature i. If so, it means that the array contains the query feature; when the array contains each query feature i in the array of all query features of the query keyword, the array is used as the target array.

[0165] It should be noted that there can be multiple target arrays, and each target array includes all the query features of the keyword to be queried.

[0166] Step 207: Server 120 sends the encrypted data corresponding to the target array to client 110.

[0167] In this scheme, the client only knows the security value of the feature and does not know the relevant information of the array. The server internally determines the information required to query the array through the security value, thereby improving the security of searchable encrypted queries.

[0168] It should be noted that the client 110 executing steps 201 and 202 can be the same client 110 as the client 110 executing steps 203, 204, and 205, or they can be different clients 110. For example, client 110A executes steps 201 and 202, client 110B executes steps 203, 204, and 205, and server 120 sends the encrypted data corresponding to the target array to client 110B.

[0169] In some possible implementations, client 110 can use the security values ​​of several query features of the keyword to be queried as trapdoors; client 110 sends the trapdoors to server 120; server 120 obtains a target array containing the trapdoors based on the trapdoors.

[0170] In some possible scenarios, such as Figure 3 As shown, client 110 uploads encrypted data and an index set to server 120. The index set includes multiple arrays, and the identifier of the encrypted data corresponding to each array. There are four encrypted data sets: F1, F2, F3, and F4, identified as id1, id2, id3, and id4 respectively, and there are three arrays. Cat dog hat; The identifier of the encrypted data corresponding to Cat is id1, id 2， The encrypted data corresponding to "dog" is identified by id1, id3, and id4. The identifier for the encrypted data corresponding to 'hat' is id2. Client 110 uploaded the trapdoor. Send C*t to server 120, where * represents a wildcard. Server 120 then sends search results F1 and F2 back to client 110.

[0171] Based on the query methods provided above, the specific applications of these methods will be explained. Figure 4 This is a flowchart illustrating a specific application of a query method provided for the implementation of this invention. For example... Figure 4 As shown, the specific content includes:

[0172] Step 401: Client 101 constructs an index set, which includes multiple indexes. Each index is an XOR filter, and each index corresponds to encrypted data.

[0173] It should be noted that the indexes in the index set carry the corresponding ciphertext data.

[0174] Construct initial XOR filters corresponding to multiple keywords. The XOR filters include a fingerprint function f(F(ki,i),j) and N position functions: h0(F(ki,i)), h1(F(ki,i)), ..., h n (F(ki, i)), array, and filtering algorithm. In some possible scenarios, all keywords can share the XOR filter, but since each keyword is different, the contents of the array in the XOR filter are different, but the fingerprint function f(F(ki, i), j), N position functions, and filtering algorithm are the same. In some possible scenarios, some keywords have different XOR filters. In this case, the length of the array in these different XOR filters is different, and the fingerprint function f(F(ki, i), j) and N position functions are different.

[0175] Next, for each keyword j, client 101 extracts M features of keyword j; for each feature i among the M features, it calculates the HAMC value of feature i, and substitutes the HAMC value into the N position functions in the XOR filter: h0(F(ki,i)), h1(F(ki,i)), ..., h n (F(ki, i)) is used to obtain N positions. The HAMC value and the index j of keyword j are substituted into the fingerprint function f(F(ki, i), j) in the XOR filter to obtain the fingerprint f. Then, based on the N positions corresponding to each of the M features, the unique position of each of the M features in the array is determined. Next, for each feature i among the M features, an operation such as XOR is performed on the fingerprint of feature i and the contents of the corresponding N positions. The result is placed in the unique position of feature i in the array. After processing the M features, the array corresponding to keyword j is obtained. array Fingerprint function f(F(ki,i),j), N position functions: h0(F(ki,i)), h1(F(ki,i)), ..., h n (F(ki,i)) and the filtering algorithm are used as the XOR filter corresponding to keyword j.

[0176] In some possible embodiments, such as Figure 5 The array is constructed through the following steps:

[0177] Step 1: Place each of the M features into a temporary array T using three position functions h0(F(ki,i)), h1(F(ki,i)), and h2(F(ki,i)). The position coordinates of the temporary array T are labeled as T[0], T[1], T[2], ... In the specific implementation, for each feature i in the M features, map it to three position coordinates in the temporary array T using the three position functions h0(F(ki,i)), h1(F(ki,i)), and h2(F(ki,i)). Then, obtain the fingerprint f(i) corresponding to feature i using the fingerprint function f(F(ki,i),j), where i represents the feature identifier.

[0178] Step 2. Traverse the temporary array T, find all position coordinates that contain only one feature, and put the position coordinates as elements into the stack P.

[0179] Step 3. If stack P is not empty, delete the position coordinate T[x] at the top of the stack; if the deleted position coordinate T[x] at the top of the stack corresponds to only one feature i, put (i, T[x]) into stack Q, and delete the feature i in the temporary array in turn. After deletion, put the position coordinates that are not in stack P and only have one feature left into stack P; repeat step 3.

[0180] Step 4. Obtain the sequentially recorded (i, T[x]): (a, T[4]), (d, T[2]), (c, T[5]), (b, T[1]); Set the element value of each position in the array of the XOR filter to a multi-bit value r, for example: 000000. Starting from the last recorded (i, T[x]): (a, T[4]), perform an XOR operation on the fingerprint f(F(ka, a), j) of feature a and the contents of the three positions of feature a: T[0], T[3], T[4] to obtain the result: Place it in position T[4]; then, for the previous record (i, T[x]): (d, T[2]), perform an XOR operation on the fingerprint f(F(kd, d), j) of feature d and the contents of positions T[2] and T[4] other than T[2] in the three positions where feature d is located: T[0], T[2], and T[4], to obtain the result. Place it at position T[2], and so on, process (c, T[5]) and (b, T[1]) in turn, so as to obtain the array corresponding to keyword j.

[0181] The filtering algorithm is used to determine whether an array contains a certain feature. In this embodiment of the invention, for the feature to be verified, the filtering algorithm inputs the HMAC value of the feature into N positional functions: h0(F(ki,i)), h1(F(ki,i)), ..., h nIn (F(ki, i)) and the fingerprint function f(F(ki, i), j), the fingerprint f of feature i and the N positions of the XOR filter are obtained. The contents of the N positions of the XOR filter are XORed. If the result of the operation is the same as the fingerprint f of feature i, it means that the XOR filter contains feature i.

[0182] Step 402: Client 110 sends the index set and data ciphertext to server 120.

[0183] Step 403: Server 120 stores the index set and data ciphertext.

[0184] Step 404: Client 110 obtains the keywords to be queried.

[0185] Step 405: Client 110 determines the HMAC values ​​of several query features of the keyword to be queried.

[0186] In practical implementation, client 110 performs feature extraction on query keywords to obtain a feature set. For example, if the keyword to be searched is "ad?" or "f*s", then... There are 6 query features c, in ascending order: a‖1, d‖2, f‖4, in descending order: s‖-1, 2-gram: ad, with a single character separating the two: df.

[0187] For each feature to be queried Perform the following operations:

[0188] Assign a number i to the feature to be queried, and obtain the HMAC value through a cryptographic algorithm, denoted as .

[0189] Step 406: Client 110 uses the HMAC values ​​of all the features to be queried for the keyword to be queried as a search trapdoor.

[0190] Step 407: Client 110 sends a search trapdoor to server 120.

[0191] In this embodiment of the invention, the client 110 will retrieve the information of each feature to be queried from the feature set. Send to the server.

[0192] Step 408: Server 120 inputs the HMAC values ​​of all query features of the keyword to be queried into each XOR filter in the index set, and each XOR filter outputs whether it contains all query features of the keyword to be queried.

[0193] In the specific implementation, for each XOR filter, the XOR filter index is the index j of the keyword corresponding to the XOR filter. For each query feature i among all query features of the query keyword, the HMAC value of the query feature i is input into N positional functions: h0(F(ki, i)), h1(F(ki, i)), ..., h n (F(ki, i)), and fingerprint function f(F(ki, i), j), obtain the fingerprint f of the feature to be queried i and the N positions of the XOR filter. Perform XOR operation on the N positions of the XOR filter. If the operation result is the same as the fingerprint f of the feature to be queried i, it means that the XOR filter contains the feature to be queried i.

[0194] In the actual implementation, the server obtains the trapdoor. Then it is decomposed to obtain Set an empty set Res; for each keyword, use a filter. Detection Does each queried feature i satisfy... Indicates to Perform an XOR operation on the contents at the location of the XOR filter.

[0195] Step 408: Server 120 sends encrypted data containing the index of all query features of the query keyword to client 110.

[0196] Step 409: Client 110 decrypts the received encrypted data to obtain the plaintext data.

[0197] It should be noted that the above XOR filter is merely an example and does not constitute a specific limitation. In specific implementations, the XOR filter can also be replaced with a Bloom filter, a Cuckoo filter, etc., and the embodiments of the present invention do not impose specific limitations on this.

[0198] Based on the same concept as the embodiments of the method of the present invention, the embodiments of the present invention also provide a query device. The query device includes several modules, each module being used to execute various steps in the query method provided in the embodiments of the present invention. The division of modules is not limited here. Those skilled in the art will clearly understand that in practical applications, the various steps in the query method provided in the embodiments of the present invention can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the functions described above. The modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the modules are only for easy differentiation and are not intended to limit the scope of protection of the present invention. The specific working process of the modules in the above device can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0199] For example, the query device is used to execute the query method of client 110 provided in the embodiments of the present invention; Figure 6 This is a schematic diagram of the structure of the query device provided in an embodiment of the present invention. Figure 6 As shown, the query device provided in this embodiment of the invention includes:

[0200] The acquisition module 601 is used to acquire the keyword to be queried, which includes at least one feature to be queried.

[0201] The sending module 602 is used to send the security value of at least one query feature of the query keyword to the server 120; the security value of each query feature is the value after the cryptographic algorithm processes each query feature.

[0202] The receiving module 603 is used to receive encrypted data sent by the server 120; the encrypted data corresponds to a target array, the target array includes at least one feature to be queried, and the target array is determined based on the security value of at least one feature to be queried.

[0203] In one possible implementation, the security value of each queried feature is used to indicate each queried feature with security characteristics. For example, the security value of each queried feature is the numerical value obtained by operating on the key and each queried feature.

[0204] In one possible implementation, the target array is an array of multiple arrays.

[0205] In one possible implementation, a security value for each feature to be queried is used to determine the information needed to query multiple arrays.

[0206] In this solution, the process of querying the required information of the array based on the security value is entirely placed inside the server, thereby improving the security of searchable encrypted queries.

[0207] In one possible implementation, the server determines the target array from multiple arrays by traversing multiple arrays.

[0208] In this solution, the server can save storage overhead by directly storing the array and the corresponding encrypted data. The query can be performed by traversing multiple arrays, which can reduce the complexity of the query and thus improve the query efficiency.

[0209] In one possible implementation, each of the multiple arrays corresponds to a keyword, and each array is constructed based on at least one feature of the keyword corresponding to that array. In other words, for a keyword, the array corresponding to the keyword is constructed based on the security value of at least one feature of the keyword. For example, for each of the multiple arrays, the array is constructed based on the security values ​​of several features of the keyword corresponding to that array.

[0210] In one possible implementation, the ciphertext of the target array corresponds to the keyword of the target array.

[0211] In one possible implementation, the target array is constructed based on the security value of at least one feature of the keyword corresponding to the target array.

[0212] In one possible implementation, for each of at least one feature of the keyword, a security value for each feature is used to determine a construction parameter corresponding to that feature. The construction parameter includes the position of the feature corresponding to the construction parameter in a target array. The target array is constructed based on the construction parameters corresponding to each of the at least one feature of the keyword. For example, for any feature of the keyword, the security value of that feature is used to determine a construction parameter corresponding to that feature. This construction parameter includes the position of the feature in the target array corresponding to the keyword. The target array corresponding to the keyword is constructed based on the construction parameters corresponding to each feature of the keyword.

[0213] In one possible implementation, the position of the feature corresponding to the construction parameter in the target array is obtained by mapping the security value of the feature corresponding to the construction parameter to a non-cryptographic hash function.

[0214] In this scheme, the unencrypted hash function has a faster computation speed, which can improve computational efficiency. It should be noted that since the client only determines the security value of the feature, and the server determines the position of the feature in the array, considering that the server does not need to communicate with the client to determine the position of the feature in the array, and does not involve data security in data transmission, there is no need to restrict the use of encrypted hash functions. Unencrypted hash functions can be selected to improve computational efficiency.

[0215] In one possible implementation, the construction parameters also include the fingerprint of the feature corresponding to the construction parameters.

[0216] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters of that feature, which include the position of the feature in the target array and the fingerprint of the feature.

[0217] In one possible implementation, the fingerprint of the feature corresponding to the construction parameter is determined by operating on the security value of the feature corresponding to the construction parameter and the identifier value of the target array.

[0218] In this solution, fingerprints are determined by the security value of features and the identifier value of data. This can distinguish the same features from different keywords, reduce the probability that the server can understand high-frequency features, and improve data security.

[0219] For example, for any feature of a keyword, a fingerprint of that feature is determined based on the security value of that feature and the identifier value of the target array.

[0220] In one possible implementation, the security value is the key-related hash message authentication code.

[0221] In one possible implementation, the sending module 601 is further configured to send a target array and corresponding ciphertext to the server, so that the server stores multiple arrays and corresponding ciphertext for each array.

[0222] For example, the query device is used to execute the query method of the server 120 provided in the embodiments of the present invention; Figure 7 This is a schematic diagram of the structure of the query device provided in an embodiment of the present invention. Figure 7 As shown, the query device provided in this embodiment of the invention includes:

[0223] The receiving module 701 is used to receive the security value of the query feature in the query keyword sent by the client; the query keyword includes at least one query feature, and the security value of each query feature is the value after processing the query feature.

[0224] The array determination module 702 is used to determine a target array based on the security value of at least one query feature; the target array includes at least one query feature.

[0225] The sending module 703 is used to send the encrypted data corresponding to the target array to the client 110.

[0226] In one possible implementation, the security value of each queried feature is the numerical value obtained by combining the key of each queried feature with the value of each queried feature, which is used to indicate the queried feature with security characteristics.

[0227] In one possible implementation, array determination module 702 is used to determine a target array from multiple arrays based on a security value of at least one feature to be queried.

[0228] In this implementation example, the array determination module 702 determines the target array from multiple arrays by traversing multiple arrays.

[0229] In this solution, the server can save storage overhead by directly storing the array and the corresponding encrypted data. The query can be performed by traversing multiple arrays, which can reduce the complexity of the query and thus improve the query efficiency.

[0230] For example, the array determination module 702 is used to determine the query result corresponding to each of the multiple arrays based on the security value of at least one query feature, wherein the query result is used to indicate whether the array corresponding to the query result includes at least one query feature; and the array that includes at least one query feature among the multiple arrays is used as the target array.

[0231] Specifically, the array determination module 702 is used to determine, for each of the multiple arrays, whether the array contains all the query features based on the security value of all the query features of the query keyword, and if so, to use the array as the target array.

[0232] In this implementation example, the receiving module 701 is also used to receive multiple arrays sent by the client and the ciphertext corresponding to each array; and to store the multiple arrays and the ciphertext corresponding to each array.

[0233] In this implementation example, the security value of each feature to be queried is used to determine the information needed to query multiple arrays.

[0234] In this solution, the process of querying the required information of the array based on the security value is entirely placed inside the server, thereby improving the security of searchable encrypted queries.

[0235] In one possible implementation, each of the multiple arrays corresponds to a keyword, and each array is constructed based on a security value of at least one feature of the keyword corresponding to that array. In other words, for a keyword, the array corresponding to the keyword is constructed based on a security value of at least one feature of the keyword.

[0236] In one possible implementation, the encrypted data corresponding to the keyword corresponds to the array corresponding to the keyword. For example, the encrypted data corresponding to the target array corresponds to the keyword corresponding to the target array.

[0237] In one possible implementation, for each feature among at least one feature of the keyword, a security value for each feature is used to determine the construction parameter corresponding to each feature, the construction parameter including the position of the feature corresponding to the construction parameter in the array corresponding to the keyword; the array corresponding to the keyword is constructed by the construction parameter corresponding to each feature among at least one feature of the keyword.

[0238] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters corresponding to that feature. The construction parameters include the position of the feature in the array corresponding to the keyword, which is constructed based on the construction parameters corresponding to each feature of the keyword.

[0239] In one example of this implementation, the array determination module 702 is used to determine, for each of the multiple arrays, the construction parameters corresponding to each query feature in each array based on the security value of at least one query feature; and to determine whether each array includes at least one query feature based on the construction parameters corresponding to each query feature in each array.

[0240] In one possible implementation, the position of the feature corresponding to the construction parameter in the array corresponding to the keyword is obtained by mapping the security value of the feature corresponding to the construction parameter to an unencrypted hash function.

[0241] In this scheme, the unencrypted hash function has a faster computation speed, which can improve computational efficiency. It should be noted that since the client only determines the security value of the feature, and the server determines the position of the feature in the array, considering that the server does not need to communicate with the client to determine the position of the feature in the array, and does not involve data security in data transmission, there is no need to restrict the use of encrypted hash functions. Unencrypted hash functions can be selected to improve computational efficiency.

[0242] In one possible implementation, the construction parameters also include the fingerprint of the feature corresponding to the construction parameters.

[0243] For example, for any feature of a keyword, the security value of that feature is used to determine the construction parameters of that feature, which include the position of the feature in the array corresponding to the keyword and the fingerprint of the feature.

[0244] In one possible implementation, the fingerprint of the feature corresponding to the construction parameter is determined by operating on the security value of the feature corresponding to the construction parameter and the identifier value of the array corresponding to the keyword.

[0245] For example, for any feature of a keyword, the fingerprint of that feature is determined based on the security value of that feature and the identifier value of the array corresponding to the keyword.

[0246] In this solution, fingerprints are determined by the security value of features and the identifier value of data. This can distinguish the same features from different keywords, reduce the probability that the server can understand high-frequency features, and improve data security.

[0247] In one possible implementation, the security value is the key-related hash message authentication code.

[0248] Based on the same concept as the method embodiment of the present invention, the present invention also provides a client 110. Figure 8 This is a schematic diagram of the structure of a client 110 provided in an embodiment of the present invention. Figure 8 As shown, client 110 includes processor 111, memory 112 and network interface 113.

[0249] The processor 111 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0250] Memory 112 may include volatile memory, such as random access memory (RAM). Memory 112 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0251] For example, a computer program may be stored on memory 112, and when processor 111 executes the computer program, it implements the steps in the above-described query method embodiment, for example... Figure 2The steps performed by the client 110 are shown. Alternatively, the processor 111 executes a computer program to implement the functions of each module in the above-described device embodiment. For example, the computer program can be divided into one or more modules / units, which can be a series of computer program instruction segments capable of performing a specific function. One or more modules / units are stored in the memory 112 and executed by the processor 111 to complete the present invention. For example, the computer program can be divided into an acquisition module 601, a sending module 602, and a receiving module 603; the specific functions of each module are described above.

[0252] The network interface 113 is used to send and receive data, for example, to send data processed by the processor 111 to other electronic devices, or to receive data sent by other electronic devices.

[0253] Of course, for the sake of simplicity, Figure 8 Only some of the components in the client 110 relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device 110 may include any other suitable components depending on the specific application.

[0254] Based on the same concept as the embodiments of the method of the present invention, the embodiments of the present invention also provide a server 120. The structure of the server 120 can be found in [reference needed]. Figure 8 .

[0255] In addition to the methods, apparatus, and devices described above, embodiments of the present invention may also provide a computer program product comprising computer program instructions. When executed by a processor, these computer program instructions cause the processor to perform the steps of the query methods of various embodiments of the present invention described in the "Methods" section of this specification. The computer program product may be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The computer program code may be in source code form, object code form, executable file, or some intermediate form. The computer program code may be executed entirely on a user's computing device, partially on a user's device, as a standalone software package, partially on a user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0256] Furthermore, embodiments of the present invention may also provide a computer-readable storage medium storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the display control method according to various embodiments of the present disclosure described in the "Method" section above. The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may include, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. It should be noted that the content contained in the computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, a computer-readable medium may not include electrical carrier signals and telecommunication signals.

[0257] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0258] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0259] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of the various embodiments of the present disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of the present disclosure to the necessity of employing the specific details described above.

[0260] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0261] It should also be noted that in the apparatus, devices, and methods of this disclosure, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions to this disclosure.

[0262] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

[0263] It is understood that the various numerical designations used in the embodiments of the present invention are merely for descriptive convenience and are not intended to limit the scope of the embodiments of the present invention.

Claims

1. A query method, characterized by, The method is applied to a client and comprises: obtaining a keyword to be queried, the keyword to be queried comprising at least one feature to be queried; sending, to a server, a security value of the at least one feature to be queried of the keyword to be queried, the security value of each feature to be queried being a value processed from the feature to be queried; receiving data ciphertext sent by the server, the data ciphertext corresponding to a target array, the target array comprising the at least one feature to be queried, and the target array being determined based on the security value of the at least one feature to be queried.

2. The method of claim 1, wherein, The target array corresponds to a keyword, the keyword comprising at least one feature, and the target array is constructed based on a security value of the at least one feature of the keyword.

3. The method of claim 2, wherein, The security value of each feature of the at least one feature of the keyword is used to determine a construction parameter corresponding to the feature, and the construction parameter comprises a position of the feature corresponding to the construction parameter in the target array. The target array is constructed by using the construction parameter.

4. The method of claim 3, wherein, The position of the feature corresponding to the construction parameter in the target array is obtained by mapping the security value of the feature corresponding to the construction parameter by using a non-encryption hash function.

5. The method according to claim 3 or 4, characterized in that, The construction parameter further comprises a fingerprint of the feature corresponding to the construction parameter.

6. The method of claim 5, wherein, The fingerprint is determined by operating the security value of the feature corresponding to the construction parameter and an identification value of the target array.

7. The method according to any one of claims 1 to 6, characterized in that, Before the keyword to be queried is obtained, the method further comprises: sending, to the server, the target array and data ciphertext corresponding to the target array.

8. A query method characterized by, The method is applied to a server and comprises: receiving, from a client, a security value of a feature to be queried in a keyword to be queried, the keyword to be queried comprising at least one feature to be queried, and the security value of each feature to be queried being a value processed from the feature to be queried; determining a target array based on the security value of the at least one feature to be queried, the target array comprising the at least one feature to be queried; and sending, to the client, data ciphertext corresponding to the target array.

9. The method of claim 8, wherein, The determining of the target array based on the security value of the at least one feature to be queried comprises: determining the target array from a plurality of arrays based on the security value of the at least one feature to be queried.

10. The method of claim 9, wherein, The determining of the target array from the plurality of arrays based on the security value of the at least one feature to be queried comprises: determining a query result corresponding to each array of the plurality of arrays based on the security value of the at least one feature to be queried, the query result being used to indicate whether the array corresponding to the query result comprises the at least one feature to be queried; and taking, as the target array, an array of the plurality of arrays that comprises the at least one feature to be queried.

11. The method according to any of claims 8-10, characterized by, Before the security value of the feature to be queried in the keyword to be queried is received from the client, the method further comprises: receiving, from the client, a plurality of arrays and data ciphertext corresponding to each array of the plurality of arrays; and storing the plurality of arrays and the data ciphertext corresponding to each array of the plurality of arrays.

12. The method according to any one of claims 9 to 11, characterized in that, Each array of the plurality of arrays corresponds to a keyword, and each array is constructed based on a security value of at least one feature of the keyword corresponding to the array.

13. The method of claim 12, wherein, Each of the at least one feature of the keyword is used to determine a construction parameter corresponding to the feature, the construction parameter including a position of the feature corresponding to the construction parameter in an array corresponding to the keyword; The array corresponding to the keyword is constructed by the construction parameter.

14. The method of claim 13, wherein, The position of the feature corresponding to the construction parameter in the array corresponding to the keyword is obtained by mapping a security value of the feature corresponding to the construction parameter by a non-encryption hash function.

15. The method according to claim 13 or 14, characterized in that, The construction parameter further includes a fingerprint of the feature corresponding to the construction parameter.

16. The method of claim 15, wherein, The fingerprint is determined by an operation of the security value of the feature corresponding to the construction parameter and an identification value of the array corresponding to the keyword.

17. A query system, comprising: Comprising: A client and a server; The client is configured to acquire a keyword to be queried, the keyword to be queried including at least one feature to be queried; The client is configured to send a security value of the at least one feature to be queried of the keyword to be queried to the server, the security value of each feature to be queried being a numerical value processed from the feature to be queried; The server is configured to determine a target array based on the security value of the at least one feature to be queried; The server is configured to send a data ciphertext corresponding to the target array to the client.

18. A query device, characterized in that Comprising: An acquisition module configured to acquire a keyword to be queried, the keyword to be queried including at least one feature to be queried; A sending module configured to send a security value of the at least one feature to be queried of the keyword to be queried to a server, the security value of each feature to be queried being a numerical value processed from the feature to be queried; A receiving module configured to receive a data ciphertext sent by the server; the data ciphertext corresponds to a target array, the target array including the at least one feature to be queried, and the target array being determined based on the security value of the at least one feature to be queried.

19. A query device, characterized in that Comprising: A receiving module configured to receive a security value of a feature to be queried in a keyword to be queried sent by a client; the keyword to be queried including at least one feature to be queried, and the security value of each feature to be queried being a numerical value processed from the feature to be queried; An array determination module configured to determine a target array based on the security value of the at least one feature to be queried; the target array including the at least one feature to be queried; A sending module configured to send a data ciphertext corresponding to the target array to the client.

20. A client, characterized by Comprising: At least one memory configured to store a program; At least one processor configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the method in any one of claims 1-7.

21. A server, comprising: Comprising: At least one memory configured to store a program; At least one processor configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the method in any one of claims 8-16.

22. A query device, characterized in that The device runs computer program instructions to execute the method in any one of claims 1-7, or to execute the method in any one of claims 8-16.

23. A computer storage medium, comprising, The computer storage medium stores instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1-7, or the method of any one of claims 8-16.

24. A computer program product comprising instructions, wherein: The instructions, when executed on a computer, cause the computer to perform the method of any one of claims 1-7, or the method of any one of claims 8-16.

Images