Data security storage and retrieval method and device and medium
By generating unique encrypted identifiers for user data and combining them with an index table, along with encryption techniques using random numbers and keys, the problem of insufficient data security storage and retrieval efficiency in existing technologies is solved, achieving a balance between data security and retrieval efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-31
- Publication Date
- 2026-03-31
AI Technical Summary
Existing data security storage technologies are insufficient in balancing retrieval efficiency and protection strength. Simple encryption is easily cracked, while high-strength algorithms cause system response delays, making it difficult to maintain performance in scenarios such as real-time transaction risk control.
By acquiring the characteristic information of user data, unique encrypted identification information is generated. The data is stored and retrieved using an index table and a database. A combination of random numbers and keys is used for encryption to ensure the security of data during transmission and storage. An efficient obfuscated data retrieval algorithm is also developed.
It achieves a balance between data security and retrieval efficiency, ensuring data security during transmission and storage, while optimizing retrieval logic to provide secure and efficient data retrieval functions.
Smart Images
Figure CN121765751A_ABST
Abstract
Description
Technical Field
[0001] This application relates to at least the field of data processing technology, and in particular to a method, apparatus and medium for secure data storage and retrieval. Background Technology
[0002] Existing data security storage and processing technologies have shortcomings: simple encryption techniques are easily cracked, and if high-strength encryption methods are used, it will lead to system response delays and create performance bottlenecks in scenarios such as real-time transaction risk control. Retrieval relies on plaintext information, and the storage system cannot balance retrieval efficiency and protection strength. Summary of the Invention
[0003] To address the aforementioned shortcomings, this application provides a data security storage and retrieval method, apparatus, and medium to solve the following technical problem: how to balance data security and retrieval efficiency.
[0004] Firstly, this application provides a method for secure data storage and retrieval, the method comprising:
[0005] The process involves obtaining sensitive information from the first data, including feature information, generating corresponding encryption parameters based on the feature information, encrypting the sensitive information based on the corresponding encryption parameters to obtain the second data, and using the encrypted feature information to form a unique encrypted identifier. The feature information and corresponding encryption parameters are stored in an index table, and the second data is stored in a database.
[0006] Data retrieval is performed using feature information. The index table is queried based on the feature information to obtain the corresponding encryption parameters. A unique encryption identifier is obtained based on the feature information and the corresponding encryption parameters. The database is queried based on the unique encryption identifier to obtain the second data. The encrypted sensitive information in the second data is decrypted based on the corresponding encryption parameters to obtain the first data.
[0007] Furthermore, sensitive information of the first data is obtained, including feature information, specifically:
[0008] Obtain the original user data to be stored as the first data;
[0009] Obtain user personal information that can uniquely identify a user from the original user data, which is the feature information of the first data;
[0010] To obtain sensitive information other than the feature information that needs to be encrypted and protected when stored in the original user data.
[0011] Furthermore, corresponding encryption parameters are generated based on the feature information, and sensitive information is encrypted based on the corresponding encryption parameters to obtain the second data. The encrypted feature information constitutes a unique encrypted identifier, specifically including:
[0012] A first random number is generated based on the feature information, a key is generated based on the first random number, and the feature information is encrypted based on the key. If the encrypted feature value is unique, the first random number and / or the key are used as the corresponding encryption parameters; otherwise, the first random number and the key are replaced to encrypt the feature information until the encrypted feature value is unique.
[0013] The first data includes several feature information items. At least one feature information item in the first data is replaced with a feature encryption value. If there are other feature information items that are not replaced with feature encryption values, they are replaced with random scrambling characters. If there are other sensitive information items, they are replaced with key encryption operations to obtain second data with feature encryption values as the unique encrypted identifier information.
[0014] Furthermore, obtaining the first random number and / or key as the corresponding encryption parameters specifically includes:
[0015] If the key can be recovered based on the first random number, then the first random number is used as the corresponding encryption parameter; otherwise, the key or the first random number and the key are used as the corresponding encryption parameters.
[0016] Furthermore, data retrieval based on feature information specifically includes:
[0017] The system receives search information input by the user. If the search information includes some items of a certain feature, it queries the index table based on the search information to obtain all items of the certain feature, or prompts the user to input the remaining items of the certain feature, until the search information includes all items of the certain feature, and then starts the data retrieval.
[0018] Furthermore, based on the feature information and corresponding encryption parameters, a unique encryption identifier is obtained. The database is then queried using the unique encryption identifier to obtain the second data. Finally, the encrypted sensitive information in the second data is decrypted based on the corresponding encryption parameters. Specifically, this includes:
[0019] Use the corresponding encryption parameters to encrypt the feature information to obtain the unique encrypted identifier information. Obtain the second data in the database that includes the unique encrypted identifier information. Use the feature information to restore the feature encryption value in the second data. If there is random garbled text in the second data, use the feature information to restore it. If there is other sensitive encrypted information in the second data, use the corresponding encryption parameters to decrypt and restore it.
[0020] Furthermore, based on the key-encrypted feature information, if the encrypted feature value is unique, then the first random number and / or the key are obtained as the corresponding encryption parameters, specifically including:
[0021] If a certain feature information corresponds to multiple first data, the number of first data records corresponding to that feature information is recorded in the index table. The order in which each first data is stored is used as the derivation base. A derivation salt is generated for each first data based on the first random number and the derivation base. The derivation salt can be restored based on the first random number and the derivation base. A certain feature information is encrypted based on the key and the derivation salt. If the feature encryption value of each first data is unique after encryption of a certain feature information, then the first random number or the first random number and the key are obtained as the corresponding encryption parameters.
[0022] Furthermore, data retrieval is performed using feature information. The index table is queried based on the feature information to obtain the corresponding encryption parameters. A unique encryption identifier is then obtained based on the feature information and the corresponding encryption parameters. Specifically, this includes:
[0023] Receive search information input by the user. If the search information includes some items of a certain feature, query the index table according to the search information to obtain all items of the certain feature, or prompt the user to input the remaining items of the certain feature, prompt the user to input the number of first data items to be searched in order, until the search information includes all items of the certain feature and the number of first data items to be searched in order, and then start data retrieval.
[0024] The index table is queried based on a certain feature information to obtain a first random number or a first random number and a key. Based on the first random number and the order of the number of each first data to be retrieved, the derived salt of each first data to be retrieved is obtained. If only the first random number is obtained from the index table, the key is obtained based on the first random number. Based on a certain feature information, the key and the derived salt, the unique encrypted identifier information of each first data to be retrieved is obtained.
[0025] Secondly, this application provides a data security storage and retrieval device, the device comprising:
[0026] The data storage module is used to obtain sensitive information of the first data, including feature information, generate corresponding encryption parameters based on the feature information, encrypt the sensitive information based on the corresponding encryption parameters to obtain the second data, and the encrypted feature information constitutes a unique encrypted identifier. The feature information and the corresponding encryption parameters are stored in an index table, and the second data is stored in a database.
[0027] The data retrieval module, connected to the data storage module, is used to retrieve data based on feature information. It queries the index table based on the feature information to obtain the corresponding encryption parameters, obtains unique encryption identifier information based on the feature information and the corresponding encryption parameters, queries the database based on the unique encryption identifier information to obtain the second data, and decrypts the encrypted sensitive information in the second data based on the corresponding encryption parameters to obtain the first data.
[0028] Thirdly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the data security storage and retrieval method described above.
[0029] This application provides a data security storage and retrieval method, apparatus, and medium. When encrypting sensitive information in the stored data, a unique encrypted identifier is formed based on feature information. Data storage information is recorded through an index table and a database. During the retrieval stage, the index table is queried through feature information, and the database is retrieved through the unique encrypted identifier. Finally, the retrieved data is restored. This provides a data security management scheme that achieves a balance between data security and retrieval efficiency. Attached Figure Description
[0030] Figure 1 This is a flowchart illustrating a data security storage and retrieval method according to an embodiment of this application;
[0031] Figure 2 This is a schematic diagram of the structure of a data security storage and retrieval device according to an embodiment of this application;
[0032] Figure 3 This is a flowchart of a data security storage method according to an embodiment of this application;
[0033] Figure 4 This is a flowchart of a data security retrieval method according to an embodiment of this application;
[0034] Figure 5 This is a flowchart of another data security storage method according to an embodiment of this application;
[0035] Figure 6 This is a schematic diagram of another data security storage and retrieval device according to an embodiment of this application;
[0036] Figure 7 This is a schematic diagram of the structure of a computer-readable storage medium according to an embodiment of this application;
[0037] Figure 8 This is a schematic diagram of the structure of a computer device according to an embodiment of this application. Detailed Implementation
[0038] To enable those skilled in the art to better understand the technical solution of this application, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.
[0039] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining this application and are not intended to limit this application.
[0040] It is understood that, without conflict, the various embodiments and features in the embodiments of this application can be combined with each other.
[0041] It is understood that, for ease of description, only the parts relevant to this application are shown in the accompanying drawings, while parts unrelated to this application are not shown in the drawings.
[0042] It is understood that each module or unit involved in the embodiments of this application may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple modules or units may be integrated into one entity structure.
[0043] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this application may occur in a different order than that marked in the accompanying drawings.
[0044] It is understood that the flowcharts and block diagrams of this application illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, unit, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagrams and flowcharts may be implemented using a hardware-based device to implement the specified function, or using a combination of hardware and computer instructions.
[0045] It is understood that the modules and units involved in the embodiments of this application can be implemented by software or by hardware. For example, the modules and units can be located in the processor.
[0046] Example 1:
[0047] like Figure 1 As shown, this application provides a method for secure data storage and retrieval, the method comprising:
[0048] S1. Obtain sensitive information of the first data, including feature information. Generate corresponding encryption parameters based on the feature information. Encrypt the sensitive information based on the corresponding encryption parameters to obtain the second data. The encrypted feature information constitutes a unique encrypted identifier. Store the feature information and corresponding encryption parameters in the index table and store the second data in the database.
[0049] S2. Perform data retrieval based on feature information, query the index table based on feature information to obtain corresponding encryption parameters, obtain unique encryption identifier information based on feature information and corresponding encryption parameters, query the database based on unique encryption identifier information to obtain second data, and decrypt the encrypted sensitive information in the second data based on corresponding encryption parameters to obtain first data.
[0050] In this embodiment, the provided method, when encrypting sensitive information in stored data, forms a unique encrypted identifier based on feature information, records data storage information through an index table and a database, queries the index table using feature information during the retrieval phase, performs database retrieval using the unique encrypted identifier, and finally restores the retrieved data. This provides a data security management scheme that achieves a balance between data security and retrieval efficiency. Figure 1 The method shown is applicable to, for example, Figure 2 The apparatus shown.
[0051] Specifically, this embodiment provides a method for secure data storage and processing, employing a data obfuscation and precise retrieval mechanism. Using data obfuscation technology, the original structure of the data is broken during the data storage stage, making it impossible for external parties to directly interpret and recover the original information. Furthermore, the data is encrypted to ensure security during transmission and storage. In addition, a highly efficient obfuscated data retrieval algorithm is developed, capable of quickly locating and restoring target data during retrieval while ensuring data security. This retrieval algorithm relies on key management and data indexing mechanisms to achieve secure and efficient data retrieval functionality.
[0052] More specifically, this embodiment designs a novel data security storage method. This method employs a data algorithm processing mechanism to shuffle the original data arrangement during data storage, making the original information difficult to directly identify or recover. Simultaneously, an advanced encryption algorithm system is used to encrypt the data, ensuring more secure data transmission and storage. Considering the limitations of current data storage models, two data algorithms are constructed based on the principle of random number generation. These algorithms can securely protect sensitive personal information and safeguard personal privacy data. Based on the sensitivity level of user privacy data, data at each level is shuffled with varying strengths to protect user data security. Furthermore, corresponding retrieval schemes are designed based on the unique characteristics of the two data algorithms. When a user searches for data, this design can accurately locate the target data and restore complete information, ensuring data security throughout the entire process. This scheme constructs secure protection for transmission and storage, optimizes retrieval logic, achieves a balance between data security and retrieval efficiency, and guarantees the security of sensitive information.
[0053] In one embodiment, in S1, sensitive information of the first data is obtained. The sensitive information includes feature information, specifically including:
[0054] Obtain the original user data to be stored as the first data;
[0055] Obtain user personal information that can uniquely identify a user from the original user data, which is the feature information of the first data;
[0056] To obtain sensitive information other than the feature information that needs to be encrypted and protected when stored in the original user data.
[0057] In this embodiment, against the backdrop of rapid development in digital finance, ensuring the security of critical information assets has become a core challenge for the industry. On the one hand, financial institutions possess massive amounts of high-value customer data and fund transfer records, which face severe threats during both static storage and dynamic interaction. Malicious attackers are constantly upgrading their penetration methods, and there are instances of exploiting system vulnerabilities to steal confidential data, causing not only direct economic losses but also triggering a chain reaction of market trust crises. On the other hand, the current technical architecture has significant bottlenecks. Although encryption methods can provide basic protection, high-strength algorithms lead to system response delays, creating performance bottlenecks in scenarios such as real-time transaction risk control. At the same time, the exponential growth of heterogeneous data makes it difficult for traditional centralized storage systems to balance retrieval efficiency and protection strength, especially highlighting technological lag when handling cross-institutional data collaboration. This contradiction severely restricts the development efficiency of intelligent financial services.
[0058] Existing data security storage and processing technologies have several shortcomings: In terms of security, encryption technology is easily cracked, key management is complex, and the data storage and transmission process is vulnerable; in terms of storage management, storage efficiency is low, flexibility and scalability are lacking, and data retrieval is complex; in terms of data processing, processing speed is slow, it is difficult to guarantee data integrity and consistency, and there is a lack of intelligence and automation; in terms of compliance and privacy, privacy protection is insufficient, compliance risks are high, and cross-border data transmission faces challenges.
[0059] In view of this, this embodiment designs a new data security storage architecture, namely a system employing data obfuscation and precise retrieval mechanisms. This system utilizes data obfuscation technology to extract personal characteristic information (such as name + number) from user data during the data storage stage. This data is then rearranged to form a personal identification code, and this information is encrypted, thereby breaking the original data structure and preventing external parties from directly interpreting and recovering the original information. Based on this, the system also applies advanced encryption technology for deep encryption of the data, including using different encryption methods for characteristic information and other sensitive information to ensure data security during transmission and storage. Furthermore, a highly efficient obfuscated data retrieval algorithm has been developed, capable of quickly locating and restoring target data during retrieval while ensuring data security. This retrieval algorithm relies on key management and data indexing mechanisms to achieve secure and efficient data retrieval functions.
[0060] In one embodiment, in S1, corresponding encryption parameters are generated based on feature information, and sensitive information is encrypted based on the corresponding encryption parameters to obtain second data. The encrypted feature information constitutes unique encrypted identification information, specifically including:
[0061] A first random number is generated based on the feature information, a key is generated based on the first random number, and the feature information is encrypted based on the key. If the encrypted feature value is unique, the first random number and / or the key are used as the corresponding encryption parameters; otherwise, the first random number and the key are replaced to encrypt the feature information until the encrypted feature value is unique.
[0062] The first data includes several feature information items. At least one feature information item in the first data is replaced with a feature encryption value. If there are other feature information items that are not replaced with feature encryption values, they are replaced with random scrambling characters. If there are other sensitive information items, they are replaced with key encryption operations to obtain second data with feature encryption values as the unique encrypted identifier information.
[0063] In this embodiment, to meet different scenarios, two encrypted retrieval algorithms are designed based on the principle of random numbers. These algorithms securely encrypt and store sensitive user data. For example... Figure 3 As shown, a random number scrambling algorithm is provided, including:
[0064] In the random number generation stage, information with personal characteristics is extracted from user data (e.g., for financial clients, personal identifiers are extracted from user asset information data). Then, a noise chip is used to generate corresponding random numbers based on the user's name, phone number, and other personal identifiers. Simultaneously, a uniquely matched scrambling key is created to encrypt the personal identifiers.
[0065] When constructing the index table, the name and number of each piece of personal information are combined to form a personal identification code. Using a data key and encryption technology based on data algorithms, the personal information is encrypted to generate corresponding ciphertext, which is then named. If the encrypted value is duplicated, a new data key must be generated and encryption performed again. Finally, the unique personal identification information—name and number (personal identification identifier)—is placed in the storage index table and stored in the database for subsequent lookup operations.
[0066] In the data processing stage, random numbers for the name and number are used as a basis to generate randomly scrambled codes for both. The personal identification replacement rules are then activated. The information input through the algorithm is recorded, and the name and identification number fields (any information unique to the user) are replaced with the corresponding name and number scrambled codes. This replacement completes the process, creating storable data, which is then securely stored in a dedicated data security database. The replaced data should contain complete and unique identification information. This information can be implemented in one place (e.g., replacing the name) or in multiple places in combination (e.g., partially replacing the name and number). If other information requires encryption, key encryption can be used.
[0067] In one embodiment, obtaining the first random number and / or key as the corresponding encryption parameters specifically includes:
[0068] If the key can be recovered based on the first random number, then the first random number is used as the corresponding encryption parameter; otherwise, the key or the first random number and the key are used as the corresponding encryption parameters.
[0069] In this embodiment, the implementation of the random number scrambling algorithm may include the following steps:
[0070] 1) Preprocess the data by extracting the name, number type, and number from the information, and combine this information into personal information identifiers for subsequent storage and retrieval.
[0071] 2) Generate a corresponding random number from the name and number.
[0072] 3) Construct a scrambled key, extract the item and number from the personal identifier and merge them into one field. Use this scrambled key to encrypt the data based on the data algorithm to obtain the value of the personal identifier. Determine the uniqueness of the generated number. If it is unique, proceed to the next step. If it is not unique, return to step 2) and execute again.
[0073] 4) Use the generated personal identifiers and random numbers corresponding to names and numbers to construct a scrambled character search table and save it to the database.
[0074] 5) Based on the random number generated in step 2), scramble the name and number respectively to generate corresponding scrambled numbers. Then, replace the original name and number with these scrambled numbers to form data for storage.
[0075] 6) Save the generated data to the database.
[0076] The key is generated based on random numbers, and can be a random number scrambling algorithm. If the decryption process can be achieved based on random numbers, or if the encrypted part only includes feature information (which is recorded in the index table), then the key does not need to be stored in the index table; otherwise, the key needs to be stored in the index table.
[0077] In one embodiment, S2, data retrieval using feature information specifically includes:
[0078] The system receives search information input by the user. If the search information includes some items of a certain feature, it queries the index table based on the search information to obtain all items of the certain feature, or prompts the user to input the remaining items of the certain feature, until the search information includes all items of the certain feature, and then starts the data retrieval.
[0079] In this embodiment, data retrieval can be initiated in response to a user's retrieval action. When a user needs to perform a retrieval, the system can first verify the user's permissions, and then determine the content the user wants to retrieve based on the retrieval information entered by the user. If the user uses unencrypted parts as retrieval conditions, it can be done directly. If the retrieval conditions contain encrypted information, the unique encrypted identifier information of this embodiment needs to be used to achieve the retrieval. These information that may become retrieval conditions are pre-composed into feature information. During retrieval, it is necessary to find complete feature information to obtain the unique encrypted identifier information as a condition for querying the database. It is not limited to the user retrieving data corresponding to multiple feature information at once, but the data corresponding to each feature information needs to be queried based on its unique encrypted identifier information.
[0080] In one embodiment, in S2, a unique encrypted identifier is obtained based on feature information and corresponding encryption parameters; the database is queried based on the unique encrypted identifier to obtain second data; and the encrypted sensitive information in the second data is decrypted based on the corresponding encryption parameters. Specifically, this includes:
[0081] Use the corresponding encryption parameters to encrypt the feature information to obtain the unique encrypted identifier information. Obtain the second data in the database that includes the unique encrypted identifier information. Use the feature information to restore the feature encryption value in the second data. If there is random garbled text in the second data, use the feature information to restore it. If there is other sensitive encrypted information in the second data, use the corresponding encryption parameters to decrypt and restore it.
[0082] In this embodiment, as Figure 4 As shown, for Figure 3 The data security algorithm shown implements data storage and designs a matching data retrieval scheme. This scheme uses the user's personal information as an identifier to generate retrieval values as key retrieval items. The retrieval work is carried out in the index table. If the corresponding data item is retrieved, the algorithm will extract the corresponding name and ID number random numbers from the index table, and then generate corresponding name and number scrambled codes. These scrambled codes are then combined with the ID type to obtain a complete set of retrieval information. The retrieval information is used to search the database to obtain the user's information records.
[0083] In one embodiment, based on the key-encrypted feature information, if the encrypted feature value is unique, then a first random number and / or key are obtained as the corresponding encryption parameters, specifically including:
[0084] If a certain feature information corresponds to multiple first data, the number of first data records corresponding to that feature information is recorded in the index table. The order in which each first data is stored is used as the derivation base. A derivation salt is generated for each first data based on the first random number and the derivation base. The derivation salt can be restored based on the first random number and the derivation base. A certain feature information is encrypted based on the key and the derivation salt. If the feature encryption value of each first data is unique after encryption of a certain feature information, then the first random number or the first random number and the key are obtained as the corresponding encryption parameters.
[0085] In this embodiment, as Figure 5 As shown, a scrambling algorithm for derived random numbers is provided. While random number-based scrambling algorithms can ensure user data security and retrieval, they suffer from low efficiency. This algorithm generates independent random values for each user record and scrambles them, resulting in a large amount of duplicate data in the index table in systems involving numerous user information entries, thus consuming storage space.
[0086] Based on the random number-based scrambling algorithm, a derived scrambling retrieval algorithm is used to determine whether the personal identification identifier is unique. If so, it means that the current user is generating information records for the first time, and it is necessary to generate the first random number for their name and ID number, generate a storage index table, and store it in the database. Otherwise, it means that the user's information record already exists in the database, and the collision count field in the user's storage index table is modified for subsequent retrieval.
[0087] This algorithm treats the user as a whole as the key point of retrieval, generating an initial random value only when the first piece of user information is stored, and all subsequent random numbers are derived from it. The derived random number scrambling algorithm significantly reduces the number of times random numbers are generated, thereby reducing the size of the index table. Recording the number of collisions allows for the generation of all random numbers for the user within the system; after scrambling the derived random numbers, a safe and efficient system is achieved.
[0088] In the architecture of the derived random number scrambling algorithm, when determining the uniqueness of an individual's identifier, if it is unique, it indicates that the user is entering information for the first time. In this case, a unique random number needs to be generated for the name and number, and an index table is built simultaneously, with the field values set to their initial values. If the identifier is not unique, it means that the user's information has already been stored in the database. In this case, the user's fields in the index table are adjusted, and the collision frequency is recorded so that the necessary random numbers can be generated later during the retrieval process.
[0089] The biggest difference between derived random number generation algorithms and random number generation algorithms lies in the generation mode of random numbers for names and numbers. During execution, this algorithm first calculates a value for the individual's identifier, then retrieves the corresponding parameter from the index table, and iterates through the data in order from the initial value of 0 to the actual recorded value.
[0090] In one embodiment, in S2, data retrieval is performed using feature information, the index table is queried based on the feature information to obtain the corresponding encryption parameters, and unique encryption identifier information is obtained based on the feature information and the corresponding encryption parameters, specifically including:
[0091] Receive search information input by the user. If the search information includes some items of a certain feature, query the index table according to the search information to obtain all items of the certain feature, or prompt the user to input the remaining items of the certain feature, prompt the user to input the number of first data items to be searched in order, until the search information includes all items of the certain feature and the number of first data items to be searched in order, and then start data retrieval.
[0092] The index table is queried based on a certain feature information to obtain a first random number or a first random number and a key. Based on the first random number and the order of the number of each first data to be retrieved, the derived salt of each first data to be retrieved is obtained. If only the first random number is obtained from the index table, the key is obtained based on the first random number. Based on a certain feature information, the key and the derived salt, the unique encrypted identifier information of each first data to be retrieved is obtained.
[0093] In this embodiment, the retrieval system based on the derived scrambling algorithm uses individual users as the core retrieval unit. In the index table, each user corresponds to a unique table, which contains a field specifically for counting the frequency of repeated identity information occurrences; this value is equivalent to the total number of records for that user in the database. During algorithm execution, random scrambling of names and phone numbers is generated through specific computational logic, forming a complete set of retrieval information. This set of retrieval information accurately reflects the total number of all information records for that user.
[0094] The derived random number scrambling algorithm, also known as the derived salt scrambling search algorithm, consists of six core steps in its execution process:
[0095] Step 1: Data Preprocessing and Classification / Scrambling System. The system initializes the input raw data, extracting three elements—name, number, and number type—from the identity information to construct basic identifiers. Simultaneously, the remaining data is divided into direct identifiers and quasi-identifiers, and differentiated scrambling strategies are applied to each category to transform the data, completing the initial de-identification process of the raw data.
[0096] Step Two: Identity Generation and Uniqueness Verification. A fixed-length identity hash value is generated by calling an encryption function, using the pre-processed identifier as input. The system performs a global uniqueness check on this hash value and executes branch logic based on the check result: if the hash value is unique, proceed to Step Three; if a duplicate exists, jump to Step Four.
[0097] Step 3: Initial Random Number Generation and Index Table Construction. After ensuring uniqueness, the system generates random numbers for the name and number. These parameters are then integrated with the initial collision counter to construct a complete index table entry, which is then persistently stored in the index.
[0098] Step 4: Collision Handling and Counter Update. If a duplicate record is detected, the system locates the corresponding entry in the index table, increments the collision counter, and records the number of times the identity is repeated, providing a parameter basis for the subsequent random number generation algorithm.
[0099] Step 5: Salt Derivation and Data Scrambling. Based on the updated index table data, the system uses a deterministic algorithm to scramble the data, generating the final scrambled numbers, replacing sensitive information in the original data, and forming the encrypted dataset.
[0100] Step Six: Data Storage and Result Return. The data with garbled characters processed is written to the database, and a set of complete paths and index information is returned for subsequent retrieval.
[0101] This embodiment addresses the information security needs in the field of big data credit reporting. Through in-depth analysis of personal information and sensitive data, it proposes a complete credit reporting data security processing system. This system constructs a standardized structure for data files within the credit reporting system, designs a multi-level coding mechanism based on information sources, and realizes data classification management and source tracing.
[0102] To address the varying security needs of different query subjects, a dual-track scrambling storage scheme is proposed: for single-query subjects, a dynamic scrambling algorithm based on random numbers is used; for high-frequency query subjects, a scrambling algorithm based on derived random numbers is introduced. Both algorithms employ a multi-layered encryption strategy, achieving privacy protection for sensitive information through the dynamic binding of random values to data.
[0103] In terms of retrieval process design, a reverse query mechanism corresponding to the scrambling algorithm is provided. The random number scheme achieves fast decryption by constructing a multi-level index tree, while the derived random number scheme adopts an iterative decryption strategy driven by collision counting. Both schemes effectively prevent the risk of data leakage while ensuring query efficiency.
[0104] like Figure 6As shown, this embodiment can also provide a data security and garbled character retrieval system. Based on random number technology, a complete data storage security and garbled character retrieval system is designed and constructed. This system can provide users with real-time and dynamic storage security solutions, while also providing accurate and efficient garbled character retrieval functions and secure and reliable user and device management services.
[0105] A distributed privacy-preserving computing framework is constructed, consisting of five core functional modules operating collaboratively: a cross-organizational secure communication module, a trusted data access module, a hierarchical obfuscation module, an encrypted data hosting module, and a fuzzy query module. Among these, the encrypted data hosting and fuzzy query modules employ storage encryption technology and probabilistic retrieval mechanisms to address key technical challenges such as secure persistence of sensitive information and privacy-preserving computation. The cross-organizational secure communication module, serving as the system entry point, handles interactive requests and computation tasks from clients. When a data sharing request is detected, this module establishes a secure channel with the corresponding component of the collaborating party to achieve cross-domain data flow. The trusted data access module completes identity verification and real-time decryption of transmitted data through a dynamic session key system. The hierarchical obfuscation module uses a differentiated perturbation strategy to transform sensitive user fields. The encrypted data hosting module is responsible for persistent storage and returning the processing results to the communication module. The fuzzy query module meets the data exploration needs in a trusted execution environment.
[0106] (1) Cross-agency secure communication module
[0107] In the data interaction process, when a client initiates an information sharing request, the supply-side cross-organizational secure communication module transmits the de-identified resources to the receiving-side cross-organizational secure communication module via an encrypted channel. After receiving the encrypted data, this component transfers the processed information to downstream functional modules via a dedicated link. If the client initiates an analysis task command, the receiving-side collaborative component will use its built-in message routing mechanism to direct the calculation parameters to the fuzzy query module.
[0108] (2) Trusted data access module
[0109] Upon receiving encrypted data, the system generates a dedicated key using the transmission key material to decrypt the data and then transmits the decrypted data in plaintext to subsequent subsystems. This process ensures that the data remains encrypted throughout transmission, and a key management mechanism guarantees that only authorized users and devices can access the system, thereby achieving secure access control.
[0110] (3) Hierarchical Obfuscation Processing Module
[0111] After acquiring the dataset to be processed, the system performs differential perturbation processing on all attributes except the core identity authentication field (key retrieval combinations, such as "name + document type + document code") based on the classification criteria of the primary key field and related fields. The core identity field is transformed through an encryption obfuscation algorithm, and the usable dataset carrying the obfuscation mark is transmitted to the subsequent processing module.
[0112] (4) Encrypted data hosting module
[0113] When handling archiving operations involving sensitive user information, a dynamic key generation mechanism is used to encrypt and protect the usable dataset after it has been marked with scrambled characters. After the data entry process is completed, the system will synchronize the processing status to the cross-organizational secure communication module in real time through a secure message channel.
[0114] (5) Fuzzy query module
[0115] In the information processing architecture, the obfuscation query component serves as a core functional unit, undertaking a dual responsibility: performing data scrambling and relational query operations, and enabling secure information flow across systems. This module employs a specific algorithmic transformation mechanism to ensure that sensitive information remains obfuscated throughout the interaction process, while simultaneously supporting efficient data location and exchange functions.
[0116] In addition to its application in the financial industry, this technical solution also has broad application prospects in the medical, government, and e-commerce industries.
[0117] Healthcare Industry: Medical data contains a large amount of patient privacy information, making data security paramount. This technical solution can effectively protect patient medical records, examination results, and other data, preventing data leaks while improving data retrieval efficiency and facilitating telemedicine and medical data sharing.
[0118] In the government sector, government data involves sensitive content such as national security and citizen information. Data obfuscation and encryption technologies can ensure the security of government data during storage and transmission, preventing malicious tampering or theft and improving the level of government informatization.
[0119] E-commerce industry: E-commerce platforms store massive amounts of user transaction records and personal information. This technical solution effectively prevents user data leaks, ensures transaction security, optimizes data retrieval efficiency, improves user experience, and enhances user trust.
[0120] Example 2:
[0121] like Figure 2 As shown, this application provides a data security storage and retrieval device, the device comprising:
[0122] Data storage module 1 is used to obtain sensitive information of the first data, including feature information, generate corresponding encryption parameters based on the feature information, encrypt the sensitive information based on the corresponding encryption parameters to obtain the second data, the encrypted feature information constitutes a unique encrypted identifier, the feature information and the corresponding encryption parameters are stored in an index table, and the second data is stored in a database.
[0123] The data retrieval module 2, connected to the data storage module 1, is used to retrieve data based on feature information. It queries the index table based on the feature information to obtain the corresponding encryption parameters, obtains unique encryption identification information based on the feature information and the corresponding encryption parameters, queries the database based on the unique encryption identification information to obtain the second data, and decrypts the encrypted sensitive information in the second data based on the corresponding encryption parameters to obtain the first data.
[0124] In one embodiment, the data storage module 1 data information selection unit is specifically used for:
[0125] Obtain the original user data to be stored as the first data;
[0126] Obtain user personal information that can uniquely identify a user from the original user data, which is the feature information of the first data;
[0127] To obtain sensitive information other than the feature information that needs to be encrypted and protected when stored in the original user data.
[0128] In one embodiment, the data storage module 1 includes an encryption unit, specifically comprising:
[0129] The encryption parameter unit is used to generate a first random number based on the feature information, generate a key based on the first random number, and encrypt the feature information based on the key. If the encrypted feature value is unique, the first random number and / or the key are obtained as the corresponding encryption parameters; otherwise, the first random number and the key are replaced to encrypt the feature information until the encrypted feature value is unique.
[0130] An encrypted data unit, connected to an encrypted parameter unit, is used to replace at least one of the features in the first data with a feature encryption value. If there are other features that are not replaced with a feature encryption value, they are replaced with random scrambling. If there are other sensitive information, they are replaced with key encryption operations to obtain second data with a unique encrypted identifier information using the feature encryption value.
[0131] In one embodiment, the encryption parameter unit specifically includes components for:
[0132] If the key can be recovered based on the first random number, then the first random number is used as the corresponding encryption parameter; otherwise, the key or the first random number and the key are used as the corresponding encryption parameters.
[0133] In one embodiment, the data retrieval module 2 includes a retrieval initiation unit, specifically used for:
[0134] The system receives search information input by the user. If the search information includes some items of a certain feature, it queries the index table based on the search information to obtain all items of the certain feature, or prompts the user to input the remaining items of the certain feature, until the search information includes all items of the certain feature, and then starts the data retrieval.
[0135] In one embodiment, the data retrieval module 2 includes an information restoration unit, specifically comprising:
[0136] Use the corresponding encryption parameters to encrypt the feature information to obtain the unique encrypted identifier information. Obtain the second data in the database that includes the unique encrypted identifier information. Use the feature information to restore the feature encryption value in the second data. If there is random garbled text in the second data, use the feature information to restore it. If there is other sensitive encrypted information in the second data, use the corresponding encryption parameters to decrypt and restore it.
[0137] In one embodiment, the encryption parameter unit specifically includes:
[0138] The derived parameter unit is used to generate a derived salt for each first data if a certain feature information corresponds to multiple first data, and to record the number of first data corresponding to the certain feature information in the index table. The derived base is the order in which each first data is stored. The derived salt can be generated based on the first random number and the derived base. The derived salt can be restored based on the first random number and the derived base. The feature information is encrypted based on the key and the derived salt. If the feature encryption value of each first data is unique after the feature information is encrypted, the first random number or the first random number and the key are obtained as the corresponding encryption parameters.
[0139] In one embodiment, the data retrieval module 2 specifically includes:
[0140] The retrieval unit is activated to receive retrieval information input by the user. If the retrieval information includes some items of a certain feature, the index table is queried according to the retrieval information to obtain all items of the certain feature, or the user is prompted to input the remaining items of the certain feature, or the user is prompted to input the number of first data entries in the order range, until the retrieval information includes all items of the certain feature and the number of first data entries in the order range, and then the data retrieval is activated.
[0141] The derived information restoration unit, connected to the retrieval unit, is used to query the index table based on a certain feature information to obtain a first random number or a first random number and a key. Based on the first random number and the order of the number of each first data to be retrieved, the derived salt of each first data to be retrieved is obtained. If only the first random number is obtained from the index table, the key is obtained based on the first random number. Based on a certain feature information, the key, and the derived salt, the unique encrypted identifier information of each first data to be retrieved is obtained.
[0142] Example 3:
[0143] like Figure 7 As shown, Embodiment 3 of this application provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it implements the data security storage and retrieval method as described in Embodiment 1.
[0144] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program units, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.
[0145] like Figure 8 As shown, this application can also provide a computer device, including a memory and a processor. The memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the data security storage and retrieval method as described in Embodiment 1. This computer device can be the data security storage and retrieval device as described in Embodiment 2.
[0146] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.
[0147] Embodiments 1-3 of this application provide a data security storage and retrieval method, apparatus, and medium. When encrypting sensitive information in the stored data, a unique encrypted identifier is formed based on feature information. Data storage information is recorded through an index table and a database. During the retrieval stage, the index table is queried through feature information, and database retrieval is achieved through the unique encrypted identifier. Finally, the retrieved data is restored, providing a data security management scheme that achieves a balance between data security and retrieval efficiency.
[0148] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of this application, and this application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this application, and these modifications and improvements are also considered to be within the scope of protection of this application.
Claims
1. A method for secure storage and retrieval of data, characterized by, The method comprises: Obtaining sensitive information of the first data, the sensitive information comprising feature information, generating corresponding encryption parameters based on the feature information, encrypting the sensitive information based on the corresponding encryption parameters to obtain second data, the feature information constituting unique encryption identification information after encryption, storing the feature information and the corresponding encryption parameters in an index table, and storing the second data in a database; Performing data retrieval based on the feature information, querying the index table based on the feature information to obtain the corresponding encryption parameters, obtaining the unique encryption identification information based on the feature information and the corresponding encryption parameters, querying the database based on the unique encryption identification information to obtain the second data, and decrypting the encrypted sensitive information in the second data based on the corresponding encryption parameters to obtain the first data.
2. The method of claim 1, wherein, Obtaining sensitive information of the first data, the sensitive information comprising feature information, specifically comprising: Obtaining the original user data to be stored as the first data; Obtaining user personal information capable of uniquely identifying a user in the original user data as the feature information of the first data; Obtaining the remaining sensitive information in the original user data except the feature information that needs to be encrypted and protected during storage.
3. The method according to claim 1 or 2, characterized in that, Generating corresponding encryption parameters based on the feature information, encrypting the sensitive information based on the corresponding encryption parameters to obtain second data, and the feature information constituting unique encryption identification information after encryption, specifically comprising: Generating a first random number based on the feature information, generating a key based on the first random number, encrypting the feature information based on the key, if the feature encryption value after encryption of the feature information is unique, obtaining the first random number and / or the key as the corresponding encryption parameters, otherwise, replacing the first random number and the key to encrypt the feature information, until the feature encryption value is unique; The feature information of the first data comprises a plurality of items, at least one item of feature information in the first data is replaced by a feature encryption value, if there is remaining item of feature information that is not replaced by the feature encryption value, the remaining item of feature information is replaced by random code, and if there is remaining sensitive information, the remaining sensitive information is replaced by key encryption operation, to obtain second data with the feature encryption value as the unique encryption identification information.
4. The method of claim 3, wherein, Obtaining the first random number and / or the key as the corresponding encryption parameters, specifically comprising: If the key can be restored based on the first random number, the first random number is used as the corresponding encryption parameter, otherwise, the key or the first random number and the key are used as the corresponding encryption parameter.
5. The method of claim 3, wherein, Performing data retrieval based on the feature information, specifically comprising: Receiving search information input by a search user, if the search information comprises part of an item of certain feature information, querying the index table based on the search information to obtain all items of the certain feature information, or prompting the search user to input the remaining items of the certain feature information, until the search information comprises all items of the certain feature information, and starting data retrieval.
6. The method of claim 3, wherein, Obtaining the unique encryption identification information based on the feature information and the corresponding encryption parameters, querying the database based on the unique encryption identification information to obtain the second data, and decrypting the encrypted sensitive information in the second data based on the corresponding encryption parameters, specifically comprising: The feature information is encrypted by using the corresponding encryption parameter to obtain unique encrypted identification information, second data including the unique encrypted identification information in a database is obtained, the feature encryption value in the second data is restored by using the feature information, and if there is random code in the second data, the feature information is used for restoration, and if there is encrypted information of the rest sensitive information in the second data, the encrypted information is decrypted and restored by using the corresponding encryption parameter.
7. The method of claim 3, wherein, The feature information is encrypted by using the corresponding encryption parameter to obtain unique encrypted identification information, second data including the unique encrypted identification information in a database is obtained, the feature encryption value in the second data is restored by using the feature information, and if there is random code in the second data, the feature information is used for restoration, and if there is encrypted information of the rest sensitive information in the second data, the encrypted information is decrypted and restored by using the corresponding encryption parameter. If a certain feature information corresponds to multiple pieces of first data, the number of pieces of first data corresponding to a certain feature information is recorded in the index table, and the number of pieces of first data stored is used as a derived base number, a derived salt of each piece of first data is generated based on the first random number and the derived base number, the derived salt can be restored according to the first random number and the derived base number, and a certain feature information is encrypted based on the key and the derived salt, if the feature encryption value of each piece of first data after the encryption of a certain feature information is unique, the first random number or the first random number and the key are obtained as the corresponding encryption parameter.
8. The method of claim 7, wherein, The data is retrieved by using the feature information, the corresponding encryption parameter is obtained by querying the index table according to the feature information, and the unique encrypted identification information is obtained based on the feature information and the corresponding encryption parameter, and specifically includes: The retrieval information input by the retrieval user is received, if the retrieval information includes part of the items of a certain feature information, the index table is queried according to the retrieval information to obtain all the items of a certain feature information, or the retrieval user is prompted to input the remaining items of a certain feature information, the user is prompted to input the range of the number order of the first data to be retrieved, until the retrieval information includes all the items of a certain feature information and the range of the number order of the first data to be retrieved, and the data retrieval is started; The index table is queried according to a certain feature information to obtain the first random number or the first random number and the key, the derived salt of each piece of first data to be retrieved is obtained based on the first random number and the number order of each piece of first data to be retrieved, if only the first random number is obtained from the index table, the key is obtained based on the first random number, and the unique encrypted identification information of each piece of first data to be retrieved is obtained based on a certain feature information, the key and the derived salt.
9. A data security storage and retrieval apparatus, characterized by, The device includes: The data storage module is used for obtaining the sensitive information of the first data, the sensitive information includes the feature information, the corresponding encryption parameter is generated based on the feature information, the sensitive information is encrypted based on the corresponding encryption parameter to obtain the second data, the feature information after encryption constitutes the unique encrypted identification information, the feature information and the corresponding encryption parameter are stored in the index table, and the second data is stored in the database; The data retrieval module is connected with the data storage module, and is used for retrieving data by using the feature information, obtaining the corresponding encryption parameter by querying the index table according to the feature information, obtaining the unique encrypted identification information based on the feature information and the corresponding encryption parameter, obtaining the second data by querying the database according to the unique encrypted identification information, and decrypting the encrypted sensitive information in the second data based on the corresponding encryption parameter to obtain the first data.
10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and when the computer program is run by a processor, the data security storage and retrieval method in any one of claims 1-8 is implemented.