Encrypted data transmission method and device, equipment, medium and product

Abstract

The embodiment of the invention discloses an encrypted data transmission method and device, equipment, a medium and a product, and the method comprises the steps: receiving an operation request of target equipment for ciphertext data; wherein the ciphertext data is data obtained by using a preset encryption public key and encrypting through a fully homomorphic encryption algorithm; performing homomorphic processing on the ciphertext data based on a homomorphic operation rule corresponding to the operation request to obtain target ciphertext data; and sending the target ciphertext data to the target device, so that the target device decrypts the target ciphertext data through a decryption private key matched with the encryption public key to obtain plaintext data. In the application, encryption operation can be completed for requests such as newly adding, updating, querying or deleting without decrypting ciphertext data. Therefore, the network transmission quantity and the cloud computing overhead are remarkably reduced, and high security, high concurrency performance and low delay cost are considered.

Description

Technical Field

[0001] The application generally relates to the field of network transmission, and in particular to a method, apparatus, device, medium and product for transmitting encrypted data. Background Technology

[0002] While cloud-native databases offer advantages in elastic scalability, their distributed storage and computing architecture exposes data to the risk of plaintext leakage during transmission. Traditional symmetric / asymmetric encryption can only maintain static confidentiality during the "storage-transmission" phase; once the data enters the query, update, or analysis phase, decryption is required, leading to the exposure of sensitive information in memory. Furthermore, key management and integrity verification further exacerbate performance degradation and operational complexity.

[0003] Among the related technologies, centralized encryption and decryption nodes are mainly used to reduce the risk of key diffusion, or multi-database heterogeneous key encryption is used to achieve ciphertext range query in a blockchain shared environment, and full homomorphic encryption is used to directly perform retrieval on the ciphertext. Although these technologies can avoid decryption leakage, the query time will increase linearly with the amount of data, making it difficult to meet the real-time requirements of high concurrency and low latency in cloud-native database scenarios. Summary of the Invention

[0004] In view of the above, this application provides a method, apparatus, device, medium and product for transmitting encrypted data, addressing some of the deficiencies mentioned in the background art.

[0005] In a first aspect, embodiments of this application provide a method for transmitting encrypted data, comprising: Receive an operation request from the target device for encrypted data; wherein the encrypted data is data obtained by encrypting it using a preset encryption public key and a fully homomorphic encryption algorithm; The ciphertext data is homomorphically processed based on the homomorphic operation rules corresponding to the operation request to obtain the target ciphertext data. The target ciphertext data is sent to the target device, so that the target device can decrypt the target ciphertext data using a decryption private key that matches the encryption public key, thereby obtaining plaintext data.

[0006] Optionally, before receiving the target device's operation request for encrypted data, the method includes: Initialize and generate the encryption public key and decryption private key; The data to be encrypted is encrypted using the aforementioned public key to obtain ciphertext data. The encrypted data is stored in the target database, and an operation request for the encrypted data is generated based on user requirements.

[0007] Optionally, the step of performing homomorphic processing on the ciphertext data based on the homomorphic operation rule corresponding to the operation request to obtain the target ciphertext data includes: In response to determining that the operation request is the first operation request, the encrypted data is subjected to first homomorphic processing based on preset homomorphic operation rules to obtain the first target data; In response to determining that the operation request is a second operation request, a multi-level query vector of the ciphertext data is generated, and the ciphertext data is subjected to a second homomorphic processing based on the multi-level query vector and the preset homomorphic operation rules to obtain the second target data; The first operation request includes a data addition request, and the second operation request includes a data query request, a data deletion request, and a data modification request.

[0008] Optionally, the first homomorphic processing of the ciphertext data based on preset homomorphic operation rules to obtain the first target data includes: Generate first tag information corresponding to the first operation request; Obtain the plaintext data to be written, and encrypt the plaintext data based on a preset public key to obtain the ciphertext data to be written. The encrypted data to be written and the first tag information are sent to the target database; The first tag information is parsed through the target database, and the first homomorphic processing is performed on the ciphertext data to be written based on the parsing result to obtain the first target data. The first homomorphic processing involves inserting the ciphertext data to be written into the target storage area.

[0009] Optionally, generating a multi-level query vector for the ciphertext data, and performing a second homomorphic processing on the ciphertext data based on the multi-level query vector and the preset homomorphic operation rules to obtain the second target data, includes: Generate second tag information corresponding to the second operation request, and a multi-level query vector of the encrypted data; wherein, the multi-level query vector includes the dimension signal of the encrypted data; The second tag information and the multi-level query vector are sent to the target database; The second label information is parsed using the target database, and the second homomorphic processing is performed based on the parsing results and the dimension signal to obtain the second target data.

[0010] Optionally, the step of performing a second homomorphic processing based on the parsing results and the dimensional signal to obtain the second target data includes: Based on the parsing results, the target operation corresponding to the second operation request is determined; and... The operation position corresponding to the second operation request is determined based on the dimension signal; The target operation is performed on the encrypted data at the operation location to obtain the second target data.

[0011] In a second aspect, embodiments of this application provide an apparatus for transmitting encrypted data, comprising: The request receiving module is configured to receive operation requests from the target device for encrypted data; wherein the encrypted data is data obtained by encrypting it using a preset encryption public key and a fully homomorphic encryption algorithm; The homomorphic processing module is configured to perform homomorphic processing on the ciphertext data based on the homomorphic operation rules corresponding to the operation request to obtain the target ciphertext data; The data decryption module is configured to send the target ciphertext data to the target device, so that the target device can decrypt the target ciphertext data using a decryption private key that matches the public key to obtain plaintext data.

[0012] In a third aspect, embodiments of this application provide a transmission device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the encrypted data transmission method described in the first aspect above.

[0013] In a fourth aspect, embodiments of this application provide a storage medium storing computer instructions for causing the computer to execute the encrypted data transmission method described in the first aspect.

[0014] In a fifth aspect, embodiments of this application provide a computer program product, including computer program instructions, which, when executed on a computer, cause the computer to perform the encrypted data transmission method described in the first aspect.

[0015] The encrypted data transmission method, apparatus, device, medium, and product provided in this disclosure, through multi-level query vector optimization and fully homomorphic operation rules, enable the cloud to complete operations such as adding, querying, updating, or deleting in the ciphertext domain without full decryption. The processed ciphertext results are returned to the terminal in one go, allowing the terminal to locally decrypt the ciphertext data using its private key to obtain usable plaintext data. This reduces network transmission volume and cloud computing overhead while ensuring zero plaintext exposure, achieving a balance between high security, high concurrency, and low latency. Therefore, it significantly reduces network transmission volume and cloud computing overhead, balancing high security, high concurrency performance, and low latency costs. Attached Figure Description

[0016] Figure 1A flowchart illustrating a method for transmitting encrypted data according to an embodiment of this application is shown; Figure 2 This illustration shows a flowchart of a target device pushing and receiving data according to an embodiment of this application; Figure 3 This illustration shows a flowchart of a target server modifying encrypted data according to an embodiment of this application. Figure 4 This paper shows a schematic diagram of the structure of an encrypted data transmission device provided in an embodiment of this application; Figure 5 A schematic diagram of a more specific electronic device hardware structure provided in this embodiment is shown. Detailed Implementation

[0017] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present application, not the entire structure.

[0018] As described in the background section, while cloud-native databases offer advantages in elastic scalability, their distributed storage and computing architecture exposes data to the risk of plaintext leakage during transmission. Traditional symmetric / asymmetric encryption can only maintain confidentiality during the "storage-transmission" stage; once the data enters the query, update, or analysis phase, decryption is required, leading to the exposure of sensitive information in memory. Furthermore, key management and integrity verification further exacerbate performance degradation and operational complexity.

[0019] Through observation and understanding of the relevant technology, the inventors of this application have also discovered the following more specific problems: (1) Although the encryption algorithms designed by the relevant technologies reduce the risk of data leakage, decryption is still required when processing data. In this process, sensitive information may be exposed, especially in multi-node or distributed environments, where data security and privacy face greater challenges.

[0020] (2) Related technologies use different keys to encrypt data across multiple database systems to support range matching of ciphertext fields. While this solves the problem of range querying of encrypted data, it increases the complexity of key management. Using different keys in multiple databases or systems can make key distribution, updating, and revocation complex and error-prone, thereby increasing system instability and security risks.

[0021] (3) Many privacy protection methods in related technologies mainly focus on the encrypted storage and transmission of data, while their support for ciphertext operations is relatively weak. This limits the ability of databases to process and analyze data in an encrypted state, reducing the practicality and flexibility of the database. In existing database privacy protection schemes, users often cannot fully manage their keys independently. This may lead to reduced user control over data and inconvenience in data sharing and collaboration scenarios.

[0022] (4) The relevant technologies do not incorporate a complete data privacy protection process for adding, deleting, modifying, and querying data using cloud-native databases. Furthermore, most of them use fully homomorphic encryption to query ciphertext, which has low efficiency and increases linearly with the amount of data.

[0023] Therefore, there is an urgent need for an encrypted data transmission method to address the real-time requirements of high concurrency and low latency in cloud-native database scenarios.

[0024] Figure 1 The diagram illustrates a flowchart of an encrypted data transmission method according to an embodiment of the present invention, the method comprising the following steps: S102: Receive an operation request from the target device for encrypted data; wherein the encrypted data is data obtained by encrypting it using a preset encryption public key and a fully homomorphic encryption algorithm.

[0025] In some optional embodiments, the data transmission method of this disclosure can be executed by a transmission system. Specifically, the transmission system can first have the client (e.g., the target device in this disclosure) initialize and generate an encryption public key and a decryption private key. Then, the client uses the encryption public key and a fully homomorphic encryption algorithm to locally encrypt the plaintext data to be encrypted, thereby obtaining ciphertext data. The client then stores the encrypted ciphertext data in a target database to respond to user requests.

[0026] Understandably, if client resources are limited, the aforementioned key generation, data encryption, and ciphertext data writing to the database can also be completed independently by the security module built into the transmission system. The terminal only needs to provide the data to be encrypted to obtain ciphertext with the same level of security in the seamless encryption mode, which significantly reduces the client's deployment burden in key management, encryption implementation, and interface development, and adapts to more lightweight application scenarios.

[0027] Furthermore, it should be noted that when the client encrypts plaintext data locally using a public key, it needs to use the fully homomorphic encryption algorithm disclosed herein. This algorithm possesses homomorphic operation characteristics of addition and multiplication, and the encrypted ciphertext data can be directly adapted to the privacy enhancement module of the target database in this disclosure. This ensures that the database can directly perform complete business operations such as adding, deleting, modifying, or querying the ciphertext based on preset homomorphic operation rules without subsequently decrypting it, providing a core technical foundation for the privacy protection of data in this disclosure.

[0028] In some optional embodiments, the fully homomorphic encryption algorithm in this disclosure supports addition, multiplication, and matrix operations within the ciphertext field, ensuring that the operation result is equivalent to the plaintext field, and that the ciphertext encrypted with the same public key can be homomorphically computed arbitrarily multiple times, thereby ensuring that the data remains encrypted throughout its entire lifecycle and eliminating the risk of plaintext leakage.

[0029] In some optional embodiments, the additive homomorphism of the fully homomorphic encryption algorithm in this disclosure can be expressed as:

[0030] in, This is a homomorphic addition operation. and These are plaintext data. and These are the encryption results.

[0031] In some optional embodiments, the multiplicative homomorphism of the fully homomorphic encryption algorithm in this disclosure can be expressed as:

[0032] in, This is a homomorphic multiplication operation. and These are plaintext data. and These are the encryption results.

[0033] In some optional embodiments, when a client has a need to process encrypted data (e.g., add, delete, or modify data), they can initiate a corresponding operation request on the client side. At this time, the transmission system can receive the user's operation request for encrypted data sent by the client and execute the corresponding operation based on this request. It is understood that the transmission system can also directly receive the client's operation request and execute the corresponding operation based on it.

[0034] S104: Perform homomorphic processing on the ciphertext data based on the homomorphic operation rules corresponding to the operation request to obtain the target ciphertext data.

[0035] In this step, by differentiating and adapting to the type of operation request, targeted homomorphic processing logic is constructed, thereby enabling closed-loop operation of the entire business process (e.g., adding or deleting data) without decryption of encrypted data throughout the entire process. This ensures both data privacy and security while maintaining processing efficiency, solving the privacy leakage risks and performance bottlenecks caused by the need for decryption during data transmission in related technologies. Next, this disclosure will provide an exemplary description of the specific execution flow of the "first homomorphic processing" and "second homomorphic processing" to more clearly demonstrate how to complete operations such as adding, querying, deleting, and modifying data without decryption throughout the entire process. Specifically: In some optional embodiments, when the transmission system determines that the operation request is the first operation request (e.g., a data addition request), the system can first generate first tag information corresponding to the request and obtain the plaintext data to be written. Then, it uses a preset public key to perform fully homomorphic encryption on the plaintext data to generate ciphertext data to be written. Next, the ciphertext data and the first tag information are sent together to the target database. Upon receiving this information, the target database parses the first tag information and inserts the ciphertext data into the target storage area according to the parsing result, completing the data addition operation and obtaining the first target data (i.e., the complete data after addition). During this process, the database does not need to decrypt the data and can directly store the ciphertext data, ensuring that data privacy is not leaked.

[0036] Accordingly, when the transmission system determines that the operation request is a second operation request (e.g., a data query, deletion, or modification request), the system can generate second tag information corresponding to the request and construct a multi-level query vector related to the request. This query vector may include dimension signals or location identifier information of the encrypted data. Subsequently, the second tag information and the multi-level query vector can be sent to the target database. After receiving the information, the target database can parse the second tag information to determine the specific operation type (e.g., query, deletion, or modification), and locate the operation position of the target encrypted data based on the multi-level query vector. Then, the encrypted data is adjusted accordingly to obtain the second target data (i.e., the complete target data after deletion or modification).

[0037] Based on this, the database can perform corresponding homomorphic processing operations on the located ciphertext data without decryption. For example, in a query operation, the located ciphertext data can be returned directly; in a delete operation, the ciphertext data at that location can be removed; in a modify operation, homomorphic addition or multiplication operations can be used to update the original ciphertext data and generate updated ciphertext data. All of the above operations are completed within the ciphertext domain, without the need for data decryption, thus effectively avoiding the risk of sensitive information being exposed in memory or during computation.

[0038] In this embodiment, by distinguishing operation request types and adapting differentiated homomorphic processing logic, the computational overhead in different business scenarios can be reduced in a targeted manner. For example, data addition requests do not need to perform location operations and can directly achieve encrypted writing. Data query, deletion, and modification requests accurately locate target data through multi-level query vectors, avoiding full data traversal and significantly improving processing efficiency. At the same time, the alternative solution can adjust the complexity of homomorphic operation rules according to the database computing power configuration. In scenarios with sufficient computing power, high-precision operation rules are used to ensure data processing accuracy, while in scenarios with limited computing power, lightweight operation rules are used to prioritize processing response speed.

[0039] The following section will elaborate on the complete execution path of obtaining "first target data" and "second target data" through "first homomorphic processing" and "second homomorphic processing," to further demonstrate an exemplary implementation of the add, delete, modify, and query processes without decryption. Specifically: In this step, the process of obtaining the first target data can be specified as follows: First, generate the corresponding first tag information based on the substantive content of the first operation request. This tag information can be regarded as a summary metadata of several newly added sub-requests, which can usually include plaintext fields such as operation type code, target table / column family identifier, tenant unique ID and write timestamp.

[0040] Subsequently, the transmission system can acquire the plaintext data to be written, and then perform fully homomorphic encryption on it using a preset public key to obtain the ciphertext data to be written. Next, the transmission system can send the ciphertext data and the first tag information together to the target database. After receiving the data, the target database parses the first tag information, determines the storage location based on the parsing result, and completes the first homomorphic processing, that is, directly inserts the ciphertext data to be written into the target storage area.

[0041] In this disclosure, the above process ensures that no decryption is required throughout the entire process, guaranteeing that no sensitive information is exposed during the data addition phase. Furthermore, to avoid location conflicts caused by concurrent writes, the target database can first add a "ciphertext-level" lock to the determined storage area after parsing the first tag information. Specifically, a consistent snapshot of the existing bucket digest is performed using homomorphic hashing. If the snapshot matches expectations, the ciphertext to be written is directly inserted and the lock is released. If a version offset is detected, a new random offset can be generated using homomorphic addition, the storage location is recalculated, and the process is repeated until the write is successful. This process also requires no decryption, ensuring write consistency in high-concurrency scenarios and eliminating plaintext intermediate states caused by lock waiting. This allows the addition operation to be completed within milliseconds of latency while maintaining a "zero plaintext" security boundary.

[0042] Accordingly, in this step, the process of obtaining the second target data can be specified as follows: the transmission system can generate corresponding second tag information for the second operation request, and simultaneously construct a multi-level query vector of the ciphertext data. This query vector can contain the dimension signal of the ciphertext data for rapid location in the ciphertext database.

[0043] Subsequently, the transmission system can send the second tag information and multi-level query vector to the target database. Upon receiving the data, the target database can parse the second tag information to confirm the specific operation type (query, deletion, or modification) and determine the operation location by combining it with the dimension signal. Based on this, the database can perform the target operation on the ciphertext data at the determined operation location. For example, during a query, it directly returns the located ciphertext; during deletion, it removes the ciphertext at that location; and during modification, it updates the original ciphertext using homomorphic addition or homomorphic multiplication, thereby generating the updated ciphertext as the second target data.

[0044] In this disclosure, all the above processes are completed within the encrypted domain without decryption, thus effectively avoiding the risk of sensitive information leakage in computing or memory, and realizing encrypted closed-loop processing of the entire business process of adding, deleting, modifying, and querying. In addition, to prevent concurrent deletion and modification conflicts and ensure the verifiability of results, the target database can also perform a "homomorphic version snapshot" verification on the encrypted text at the operation location based on the version number field in the second tag information before executing the target operation.

[0045] Specifically, a homomorphic hash function can be used to calculate the digest ciphertext of the current ciphertext, and then homomorphically compared with the expected digest carried by the tag. If the comparison is successful, the corresponding operation (return, deletion, or homomorphic update) continues, and a new version digest ciphertext is generated and written back to the metadata area immediately after the operation is completed. If the comparison fails, a rollback is performed and a conflict signal is returned, triggering the client to retry. This snapshot process is completed entirely in the ciphertext domain without decryption, ensuring the atomicity and consistency of deletion and modification operations in concurrent scenarios, and eliminating plaintext intermediate states caused by version verification. This allows queries, deletions, and modifications to be completed securely within milliseconds, further consolidating the "zero plaintext" security boundary.

[0046] S106: The target ciphertext data is sent to the target device so that the target device can decrypt the target ciphertext data using a decryption private key that matches the public key to obtain plaintext data.

[0047] In some optional embodiments, after the transmission system completes the homomorphic processing or location operation of the ciphertext data using the methods of this disclosure, it can send the processed or filtered target ciphertext data to the target device. Upon receiving the target ciphertext data, the target device can first perform integrity verification on the ciphertext data (e.g., verifying the homomorphic MAC or digital signature). After confirming that the data has not been tampered with, it can then decrypt it using the decryption private key, thereby ensuring the integrity and security of the data.

[0048] In some optional embodiments, after the target device decrypts the plaintext data, it can also perform a legality check on the plaintext data (such as format verification, range verification, etc.). If the check passes, the plaintext data is used. If the check fails, the plaintext data is discarded and an alarm message is output to prevent illegal data from being used.

[0049] In some optional embodiments, after the target device completes decryption, it can also actively send a decryption confirmation message to the transmission system so that the transmission system can record the decryption log and statistically analyze the business processing status, thereby achieving business traceability and operation and maintenance visualization.

[0050] Figure 2 This illustration shows a flowchart of a target device pushing and receiving data according to an embodiment of this application. Figure 3 This illustration shows a flowchart of a target server modifying encrypted data according to an embodiment of this application.

[0051] like Figure 2 and Figure 3 As shown, the entire data transmission and privacy protection process in this disclosure can be divided into two parts: completion on the local side (i.e., the target device) and completion on the database side (i.e., the target database). Specifically, an encrypted closed loop can be formed between the "local side" and the "computer network database," thereby fully covering the four mainstream transactions of adding, deleting, modifying, and querying, and fully utilizing... Figure 2 and Figure 3 Each functional module within the system enables cloud-native data interaction that remains permanently encrypted. Specifically: In some optional embodiments, the local encryption module of this disclosure may perform the following: During user initialization, a public key pk and a private key sk are first generated in a trusted environment, and sk is permanently stored locally. Then, the plaintext data m to be written is encrypted using FHEenc(m, pk) to obtain the permanently encrypted ciphertext m. The encrypted message can then be sent to the cloud along with the transaction tag, without requiring further decryption throughout the process.

[0052] In some optional embodiments, the transaction encapsulation and sending module of this disclosure may perform the following: Add transaction: (Insert, m ) —— Directly transmit the ciphertext m As data to be written Delete transaction: (Delete, P) — Only carries a multi-level query vector P to locate the row to be deleted. Modify the transaction: (Update, P, m) ) —— Vector P locates the old row, m For new value ciphertext Query transaction: (Select, P) — Vector P locates the row to be returned. All four types of tuples are submitted to the computing network database in the form of "plaintext label + ciphertext". The database can identify the route based on the label without touching the private key.

[0053] like Figure 3 As shown, when the target database receives a ciphertext request with a transaction tag, it can first parse the operation type and location information in the ciphertext field according to the tag to complete the corresponding add, delete, modify or query processing without decryption. Then, the processed ciphertext result is returned as a response, realizing the closed-loop processing of the source transaction.

[0054] In some optional embodiments, the target database in this disclosure can also perform corresponding operations when it receives corresponding instructions (e.g., add, delete, modify, and query instructions). Specifically: Add: Parse(Insert, m) ), to m Insert target table / column family Delete: Parse (Delete, P), locate the corresponding ciphertext based on the coordinates of P, and remove it. Modified: First, use P to locate the old ciphertext, then use homomorphic addition / multiplication to update the old value to m.

[0055] Check: After using P to hit the ciphertext, directly return the ciphertext result. All operations are performed in encrypted form, and plaintext never appears in memory.

[0056] In some optional embodiments, the target database in this disclosure can also form a query feedback channel. For query or update results, the target database can send the latest ciphertext (i.e., the target ciphertext data m) to the database. ′)Return to local machine.

[0057] In some optional embodiments, the local decryption module in this disclosure may perform the following: The user received the target encrypted data m After that, you can call FHEdec(m) The plaintext m′ can be recovered by retrieving m′ from m′ and sk, thus completing the business loop. Since the private key sk always resides in the local trusted zone, it cannot be obtained by the cloud, transmission link, or other tenants, thereby achieving end-to-end protection of "data available but not visible".

[0058] In some alternative embodiments, Figure 3 The steps shown can also be further specified as follows: First, we can set the target database to be optimized using a two-level query vector. Then, here, the target database... for:

[0059] in, Pack the column vectors into blocks. It is a database specifically designed for privacy data.

[0060] Based on this, such as Figure 3 As shown, it can be broken down into the following processes: Adding a service: After receiving the transaction rules, the cloud-native database parses them to obtain the data to be inserted, c. The database then inserts this data into the privacy enhancement module database.

[0061] Deleting a service: After receiving the transaction rules, the cloud-native database parses them to obtain the vector to be queried. Calculate the corresponding position and delete the data.

[0062] This business logic involves the cloud-native database receiving and parsing the transaction rules to obtain the query vector. and Calculate the corresponding position and delete the data.

[0063] Check business details: Query optimization solutions: Most existing solutions use a query vector to perform calculations with the database to obtain the query data, resulting in a query time complexity of O(log n). The multi-level query vector designed in this disclosure effectively reduces the time complexity to O(n log n). in This refers to the dimensions of the database. The detailed design process is as follows: Step 1: Design the privacy enhancement module's database dimension, set to 2 here, making the current database a two-dimensional matrix. Pack each column vector into a block to obtain:

[0064] Step 2: The database is parsed using transaction rules. This is differentiated into multi-level vectors:

[0065] Step 3: Multilevel Vectors and Database Matrix operations can be performed using the formulas above:

[0066] in This is the data to be queried. First, use... Perform homomorphic operations to obtain the current block where the data is located. ,use Perform simultaneous processing to obtain the queryable data for this block. The entire process was carried out. The homomorphic operations effectively reduce the time complexity of query transactions.

[0067] Workflow: After receiving the transaction rules, the cloud-native database parses them to obtain the vector to be queried. The data to be searched was obtained through calculation. And feedback is sent to the user.

[0068] Parallel privacy computing optimization scheme: The total computational time complexity of the fully homomorphic encryption algorithm is By decomposing the computational task into Parallel computation can be achieved, thus theoretically reducing the computation time of each subtask. If the complexity of each subtask is equal, then the computation time of each subtask is:

[0069] In a distributed database system, each subtask is assigned to a different computing node, which effectively improves computing efficiency.

[0070] In practical applications, database nodes do not distribute tasks evenly; uneven load balancing can lead to actual computation times being higher than theoretical values. Assume a load imbalance factor of [missing value]. ,in The actual calculation time may be:

[0071] Here This indicates the additional computation time caused by factors such as load imbalance, task scheduling overhead, or synchronization overhead. Load balancing factor It may vary due to issues such as uneven task complexity and communication overhead between processor cores.

[0072] This paper optimizes the algorithm for calculating load balancing: set up The number of processors or computing nodes. For processors or nodes The workload under the current task assignment. The task Assigned to processor or node The compatibility score takes into account factors such as computing power and task type.

[0073] definition The ratio of the standard deviation of workload across processors or nodes to the average workload:

[0074] in It represents the average workload across all processors.

[0075] set up Assign a matrix to the task, with a size of ,in Indicates task Assigned to processor or node The score. This score can be calculated based on compatibility score, processor idle resources, and task priority.

[0076] Algorithm steps: Step 1: Initialize the task allocation matrix ; Step 2: For each task : Iterate through each processor or node sequentially , will compute tasks Assigned to processor or node Total utility calculate:

[0077] renew for ; Step 3: For each processor or node Find an optimal task allocation , making Maximum and not exceeding the processor's processing power If found Update task workload and allocation matrix Remove task To avoid duplicate allocation. Otherwise, the processor or node will be left empty; Step 4: Repeat steps 2 and 3 until all tasks are assigned or the assignment process cannot continue; Step 5: According to Step 1 Calculation method, calculate the current Fraction; Step 6: If The algorithm terminates when the score falls below a preset threshold.

[0078] Step 7: Otherwise, adjust the task allocation matrix. The weights are adjusted (e.g., based on the largest imbalance in task allocation), and then the process returns to step 2.

[0079] This disclosure allows for more scientific task allocation by more accurately calculating the compatibility score between tasks and processors and considering more factors (such as computing power and task type). Secondly, each node traversal better allocates tasks, ensuring a more balanced workload for each processor or node, reducing situations where some nodes are overloaded while others are idle, thereby improving overall resource utilization. Finally, it better handles dynamically changing load conditions, such as variations in processor load and task type, providing greater adaptability and flexibility.

[0080] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides an encrypted data transmission device.

[0081] Figure 4 This is a schematic diagram of a data transmission device for leased line services provided in an embodiment of this application.

[0082] refer to Figure 4 As shown, the data transmission device for the leased line service includes: S202: Request receiving module, configured to: receive operation request from target device for encrypted data; wherein the encrypted data is data obtained by encrypting it using a preset encryption public key and a fully homomorphic encryption algorithm.

[0083] In some optional embodiments, step S202 may be preceded by: Initialize and generate the encryption public key and decryption private key; The data to be encrypted is encrypted using the aforementioned public key to obtain ciphertext data. The encrypted data is stored in the target database, and an operation request for the encrypted data is generated based on user requirements.

[0084] S204: Based on the homomorphic operation rules corresponding to the operation request, perform homomorphic processing on the ciphertext data to obtain the target ciphertext data.

[0085] In some optional embodiments, step S204 further includes: In response to determining that the operation request is a first operation request, the encrypted data is subjected to a first homomorphic processing based on a preset homomorphic operation rule to obtain the first target data. This further includes: Generate first tag information corresponding to the first operation request; Obtain the plaintext data to be written, and encrypt the plaintext data based on the encryption public key to obtain the ciphertext data to be written; The encrypted data to be written and the first tag information are sent to the target database; The first tag information is parsed through the target database, and the first homomorphic processing is performed on the ciphertext data to be written based on the parsing result to obtain the first target data. The first homomorphic processing involves inserting the ciphertext data to be written into the target storage area.

[0086] In response to determining that the operation request is a second operation request, a multi-level query vector of the encrypted data is generated, and a second homomorphic processing is performed on the encrypted data based on the multi-level query vector and the preset homomorphic operation rules to obtain the second target data. Further including: Generate second tag information corresponding to the second operation request, and a multi-level query vector of the encrypted data; wherein, the multi-level query vector includes the dimension signal of the encrypted data; The second tag information and the multi-level query vector are sent to the target database; The second label information is parsed using the target database, and second homomorphic processing is performed based on the parsing results and dimension signals to obtain the second target data; further including: Generate second tag information corresponding to the second operation request, and a multi-level query vector of the encrypted data; wherein, the multi-level query vector includes the dimension signal of the encrypted data; The second tag information and the multi-level query vector are sent to the target database; The second label information is parsed using the target database, and the second homomorphic processing is performed based on the parsing results and the dimension signal to obtain the second target data.

[0087] The first operation request includes a data addition request, and the second operation request includes a data query request, a data deletion request, and a data modification request.

[0088] S206: A data decryption module is configured to send the target ciphertext data to the target device, so that the target device can decrypt the target ciphertext data using a decryption private key that matches the public key to obtain plaintext data.

[0089] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0090] The apparatus of the above embodiments can be used to implement the corresponding encrypted data transmission method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0091] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the encrypted data transmission method described in any of the above embodiments.

[0092] Figure 5 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 810, a memory 820, an input / output interface 830, a communication interface 840, and a bus 850. The processor 810, memory 820, input / output interface 830, and communication interface 840 are interconnected internally via the bus 850. The processor 810 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the encrypted data transmission method provided in any of the foregoing embodiments of this specification.

[0093] The memory 820 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 820 can store operating devices and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 820 and is called and executed by the processor 810.

[0094] The input / output interface 830 is used to connect input / output modules to enable information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0095] The communication interface 840 is used to connect the communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 850 includes a pathway for transmitting information between various components of the device, such as processor 810, memory 820, input / output interface 830, and communication interface 840.

[0096] It should be noted that although the above-described device only shows the processor 810, memory 820, input / output interface 830, communication interface 840, and bus 850, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures. The electronic devices described above are used to implement the corresponding encrypted data transmission methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here. Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the encrypted data transmission method as described in any of the above embodiments.

[0097] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. The aforementioned non-transitory computer-readable storage media can be any available medium or data storage device that a computer can access, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)). The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the encrypted data transmission method as described in any of the embodiments in the exemplary method section above, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0098] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0099] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0100] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0101] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A method for transmitting encrypted data, characterized in that, include: Receive an operation request from the target device for encrypted data; wherein the encrypted data is data obtained by encrypting it using a preset encryption public key and a fully homomorphic encryption algorithm; The ciphertext data is homomorphically processed based on the homomorphic operation rules corresponding to the operation request to obtain the target ciphertext data. The target ciphertext data is sent to the target device, so that the target device can decrypt the target ciphertext data using a decryption private key that matches the encryption public key, thereby obtaining plaintext data.

2. The transmission method according to claim 1, characterized in that, Before receiving the target device's operation request for encrypted data, the method includes: Initialize and generate the encryption public key and decryption private key; The data to be encrypted is encrypted using the aforementioned public key to obtain ciphertext data. The encrypted data is stored in the target database, and an operation request for the encrypted data is generated based on user requirements.

3. The transmission method according to claim 2, characterized in that, The process of performing homomorphic processing on the ciphertext data based on the homomorphic operation rule corresponding to the operation request to obtain the target ciphertext data includes: In response to determining that the operation request is the first operation request, the encrypted data is subjected to first homomorphic processing based on preset homomorphic operation rules to obtain the first target data; In response to determining that the operation request is a second operation request, a multi-level query vector of the ciphertext data is generated, and the ciphertext data is subjected to a second homomorphic processing based on the multi-level query vector and the preset homomorphic operation rules to obtain the second target data; The first operation request includes a data addition request, and the second operation request includes a data query request, a data deletion request, and a data modification request.

4. The transmission method according to claim 3, characterized in that, The first homomorphic processing of the ciphertext data based on preset homomorphic operation rules to obtain the first target data includes: Generate first tag information corresponding to the first operation request; Obtain the plaintext data to be written, and encrypt the plaintext data based on the encryption public key to obtain the ciphertext data to be written; The encrypted data to be written and the first tag information are sent to the target database; The first tag information is parsed through the target database, and the first homomorphic processing is performed on the ciphertext data to be written based on the parsing result to obtain the first target data. The first homomorphic processing involves inserting the ciphertext data to be written into the target storage area.

5. The transmission method according to claim 3, characterized in that, The process of generating a multi-level query vector for the ciphertext data and performing a second homomorphic processing on the ciphertext data based on the multi-level query vector and the preset homomorphic operation rules to obtain the second target data includes: Generate second tag information corresponding to the second operation request, and a multi-level query vector of the encrypted data; wherein, the multi-level query vector includes the dimension signal of the encrypted data; The second tag information and the multi-level query vector are sent to the target database; The second label information is parsed using the target database, and the second homomorphic processing is performed based on the parsing results and the dimension signal to obtain the second target data.

6. The transmission method according to claim 5, characterized in that, The second homomorphic processing based on the analysis results and dimensional signals to obtain the second target data includes: Based on the parsing results, the target operation corresponding to the second operation request is determined; and... The operation position corresponding to the second operation request is determined based on the dimension signal; The target operation is performed on the encrypted data at the operation location to obtain the second target data.

7. A device for transmitting encrypted data, characterized in that, include: The request receiving module is configured to receive operation requests from the target device for encrypted data; wherein the encrypted data is data obtained by encrypting it using a preset encryption public key and a fully homomorphic encryption algorithm; The homomorphic processing module is configured to perform homomorphic processing on the ciphertext data based on the homomorphic operation rules corresponding to the operation request to obtain the target ciphertext data; The data decryption module is configured to send the target ciphertext data to the target device, so that the target device can decrypt the target ciphertext data using a decryption private key that matches the public key to obtain plaintext data.

8. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The medium stores computer instructions for causing the computer to perform the method according to any one of claims 1-6.

10. A computer program product, characterized in that, It includes one or more computer programs that, when executed by one or more processors, implement the method as described in any one of claims 1-6.

Images