JSON (JavaScript Object Notation) data secure storage and retrieval method and device

Abstract

The invention belongs to the technical field of data security, and particularly discloses a JSON (JavaScript Object Notation) data security storage and retrieval method and device.The method comprises the steps of creating a security-related data type in a database kernel, and analyzing JSON data into a structured object based on the security-related data type; performing homomorphic encryption on a semantic unit in the JSON data, combining the encrypted semantic unit with plaintext structure metadata, generating binary format data of a security related data type, performing persistent storage, and keeping the binary format data in a ciphertext state in a life cycle of a database; receiving a data query statement sent to the database, wherein the data query statement comprises a query condition for the binary format data; performing homomorphic encryption on a constant value in the query condition to obtain a query parameter ciphertext; and executing the ciphertext query plan, performing homomorphic calculation operation based on the query parameter ciphertext and the ciphertext data in the binary format data, and obtaining a retrieval result based on a calculation result.

Description

Technical Field

[0001] This application belongs to the field of data security technology, and more specifically, relates to a method and apparatus for secure storage and retrieval of JSON data. Background Technology

[0002] With the rapid development of the internet and cloud computing, JSON (JavaScript Object Notation), as a lightweight data exchange format, has been widely used in data storage and transmission across various application systems due to its ease of reading and writing, and its convenience for machine parsing and generation. However, JSON data often contains a large amount of sensitive information, such as user personal information, transaction records, and business configurations. This data faces security risks such as leakage and tampering during storage and transmission. Traditional data security solutions often use transparent encryption or application-layer encryption to encrypt the entire JSON data. While this ensures the security of static data storage, the encrypted data cannot be directly read using the key and value, thus preventing effective retrieval and computation, resulting in low data usability. Summary of the Invention

[0003] In view of the shortcomings of the prior art, the purpose of this application is to provide a method and apparatus for secure storage and retrieval of JSON data, which aims to solve the problem of low data availability caused by traditional data security solutions that often use transparent encryption or application layer encryption to encrypt the entire JSON data.

[0004] To achieve the above objectives, in a first aspect, this application provides a secure storage and retrieval method for JSON data, including: Create security-related data types in the database kernel, and parse JSON data into structured objects based on the security-related data types; The semantic units in the JSON data are homomorphically encrypted, and the encrypted semantic units are combined with the plaintext structure metadata of the JSON data to generate binary format data of the security-related data type for persistent storage. The binary format data remains in ciphertext state throughout the lifecycle of the database. Receive a data query statement sent to the database, the data query statement containing query conditions for the binary format data; The constant values ​​in the query conditions are homomorphically encrypted to obtain the ciphertext of the query parameters. The encrypted query plan is executed, and a homomorphic computation operation is performed based on the encrypted query parameters and the encrypted data in the binary format data. The search results are obtained based on the computation results.

[0005] This application creates security-related data types within the database kernel, enabling the database system to automatically and transparently process JSON structures from an encrypted perspective from the moment it receives data. This ensures that sensitive content is never leaked while maintaining awareness of the data format. By homomorphically encrypting the semantic units in the JSON data and combining them with plaintext metadata to form binary data of the security-related data type, the data remains encrypted throughout its lifecycle (storage, logs, and backups), fundamentally eliminating the risk of static data leakage. Since the data is encrypted at the kernel entry point, an end-to-end security loop is constructed from the application interface to the storage medium, effectively defending against deep threats including high-privilege distributed backdoor attacks (DBA), log theft, and backup leaks, thus improving data security. During data retrieval, by rewriting the query statement as a homomorphic computation on the encrypted domain and executing it directly on the encrypted data, only matching encrypted results are returned, achieving "usable but invisible" data. It also enables precise equality, range, and array inclusion queries without decryption, improving data availability.

[0006] According to the secure storage and retrieval method for JSON data provided in this application, the step of homomorphically encrypting the semantic units in the JSON data includes: Using a homomorphic encryption public key integrated in the database kernel, differential nested encryption is performed on the key strings, scalar values, and array values ​​in the JSON data; The process of encrypting the key string in the JSON data includes: A character-by-character encoding encryption strategy is adopted to convert the key string into an encoding sequence, and each encoded value in the sequence is independently homomorphically encrypted to generate a ciphertext vector.

[0007] This application employs a homomorphic encryption algorithm, using a recursive nested encryption method to perform differentiated nested encryption on key strings, scalar values, and array values ​​in JSON data, thereby improving data security and enabling the handling of more basic data types.

[0008] According to the JSON data secure storage and retrieval method provided in this application, the method further includes: Load or dynamically generate a key pair for a homomorphic encryption algorithm, integrate the public key of the key pair into the global context of the database kernel for encryption, and hold the private key of the key pair by a trusted manager outside the database or a securely authenticated client session, and do not store it in the database server.

[0009] This application generates a key pair for a homomorphic encryption algorithm and holds the public and private keys separately to improve data security.

[0010] According to the JSON data secure storage and retrieval method provided in this application, obtaining the retrieval result based on the calculation result includes: The private key is used to decrypt all binary data corresponding to calculation results of 0, and the decrypted data is returned as the search results.

[0011] Secondly, this application provides a JSON data secure storage and retrieval device, comprising: The parsing module is used to create security-related data types in the database kernel and parse JSON data into structured objects based on the security-related data types. An encrypted storage module is used to perform homomorphic encryption on the semantic units in the JSON data, and combine the encrypted semantic units with the plaintext structure metadata of the JSON data to generate binary format data of the security-related data type for persistent storage, wherein the binary format data remains in ciphertext state throughout the lifecycle of the database. The receiving module is used to receive data query statements sent to the database, wherein the data query statements contain query conditions for the binary format data; An encryption module is used to homomorphically encrypt the constant values ​​in the query conditions to obtain ciphertext query parameters, and generate a ciphertext query plan based on the query conditions. The retrieval module is used to execute the ciphertext query plan, perform homomorphic computation operations based on the ciphertext query parameters and the ciphertext data in the binary format data, and obtain the retrieval results based on the computation results.

[0012] Thirdly, this application provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the JSON data secure storage and retrieval method described in the first aspect or any possible implementation thereof.

[0013] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to perform the JSON data secure storage and retrieval method described in the first aspect or any possible implementation thereof.

[0014] Fifthly, this application provides a computer program product that, when run on a processor, causes the processor to execute the JSON data secure storage and retrieval method described in the first aspect or any possible implementation thereof.

[0015] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0016] Overall, the technical solutions conceived in this application have the following beneficial effects compared with the prior art: This application creates security-related data types within the database kernel, enabling the database system to automatically and transparently process JSON structures from an encrypted perspective from the moment it receives data. This ensures that sensitive content is never leaked while maintaining awareness of the data format. By homomorphically encrypting the semantic units in the JSON data and combining them with plaintext metadata to form binary data of the security-related data type, the data remains encrypted throughout its lifecycle (storage, logs, and backups), fundamentally eliminating the risk of static data leakage. Since the data is encrypted at the kernel entry point, an end-to-end security loop is constructed from the application interface to the storage medium, effectively defending against deep threats including high-privilege DBA attacks, log theft, and backup leaks, thus improving data security. During data retrieval, by rewriting the query statement as a homomorphic computation on the encrypted domain and executing it directly on the encrypted data, only matching encrypted results are returned, achieving "usable but invisible" data. It also enables precise equality, range, and array inclusion queries without decryption, improving data availability. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is one of the flowcharts illustrating the secure storage and retrieval method for JSON data provided in the embodiments of this application; Figure 2 This is the second flowchart illustrating the secure storage and retrieval method for JSON data provided in this application embodiment; Figure 3 This is a schematic diagram of the process for securely storing JSON data provided in an embodiment of this application; Figure 4 This is a schematic diagram of the JSON data retrieval process provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of the JSON data secure storage and retrieval device provided in the embodiments of this application; Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] In this article, the term "and / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The symbol " / " in this article indicates that the related objects are in an "or" relationship; for example, A / B means A or B.

[0021] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0022] In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more, for example, multiple processing units means two or more processing units, multiple elements means two or more elements, etc.

[0023] First, let's introduce the following: Homomorphic encryption (HE) is a cryptographic technique that allows direct computation on encrypted data without decryption. The key algorithms involved in this application are shown below: Homomorphic addition: (1) in It is homomorphic encryption. This is a homomorphic addition.

[0024] Homomorphic multiplication: (2) in This is a homomorphic multiplication operation.

[0025] Next, combined Figures 1-4 The secure storage and retrieval methods for JSON data provided in the embodiments of this application are described.

[0026] Figure 1This is one of the flowcharts illustrating the secure storage and retrieval method for JSON data provided in this application embodiment, such as... Figure 1 As shown, the method includes the following steps: Step S1: Create security-related data types in the database kernel, and parse JSON data into structured objects based on security-related data types; Figure 2 This is a second flowchart illustrating the secure storage and retrieval method for JSON data provided in this application embodiment, as shown below. Figure 2 As shown, the process of this application includes a secure storage process and a retrieval process. In the secure storage process, homomorphic encryption algorithms are used to encrypt semantic units in JSON data, such as objects, scalars, arrays, etc., to generate binary format data of security-related data types, i.e., JSON binary ciphertext.

[0027] Figure 3 This is a schematic diagram of the process for securely storing JSON data provided in an embodiment of this application, such as... Figure 3 As shown, key initialization and kernel integration are performed first, followed by plaintext JSON parsing.

[0028] Optionally, a new data type (memory struct structure) named SecureJSONB can be created in the database kernel, which is the aforementioned security-related data type, and its corresponding input and output functions can be registered.

[0029] Optionally, when the kernel executes an INSERT or UPDATE statement and processes input to a field of data type SecureJSONB, it calls the input function defined for that type. This input function first calls a standard JSON parser to convert the input text or binary JSON into an in-memory tree structure, namely an Abstract Syntax Tree (AST).

[0030] Step S2: Homomorphically encrypt the semantic units in the JSON data, and combine the encrypted semantic units with the plaintext structure metadata of the JSON data to generate binary format data of security-related data types for persistent storage. The binary format data remains in ciphertext state throughout the lifecycle of the database. like Figure 3 As shown, this application uses a homomorphic encryption algorithm to encrypt semantic units in JSON data. Homomorphic encryption technology allows specific operations to be performed directly on the ciphertext, and the result is the ciphertext of the corresponding plaintext operation result, which makes it possible to realize the computability of ciphertext data.

[0031] Optionally, the semantic unit is encrypted using a homomorphic encryption public key, and the encrypted semantic unit is combined with the plaintext structure metadata of the JSON data to generate binary format data of security-related data types. A new binary object describing the original JSON structure is then constructed for persistent storage. The metadata can be metadata of the JSON structure, such as key, value, etc.

[0032] Optionally, the generated binary format data can be written to the corresponding row of the data table through the database's storage engine interface to achieve secure persistent storage.

[0033] Because all sensitive content is encrypted before entering the storage engine, the data files (such as heap table files) are all stored in ciphertext, and the data written to the write-ahead log is also in ciphertext in SecureJSONB format, ensuring log security. Any data backup or logical replication stream generated as a result is also protected ciphertext, achieving security throughout the entire data lifecycle (storage, transmission, backup).

[0034] Step S3: Receive a data query statement sent to the database. The data query statement contains query conditions for binary format data. like Figure 2 As shown, in the retrieval process, based on the SecureJSONB ciphertext data generated by the secure storage method, accurate queries on encrypted JSON data without decryption are realized at the database kernel level. By extending the query compiler and execution engine, standard plaintext query conditions are automatically converted into homomorphic computation operations on the ciphertext domain.

[0035] Figure 4 This is a schematic diagram of the JSON data retrieval process provided in an embodiment of this application, such as... Figure 4 As shown, the plaintext query is first received and parsed.

[0036] Alternatively, the application or user may send a standard Structured Query Language (SQL) query to the database, which contains filtering conditions for SecureJSONB type fields, such as where C1 = xxxx, where C1 is a column of type SecureJSONB.

[0037] Step S4: Homomorphically encrypt the constant values ​​in the query conditions to obtain the ciphertext of the query parameters, and generate a ciphertext query plan based on the query conditions. like Figure 4As shown, after receiving and parsing the plaintext query, query rewriting and parameter encryption are performed. Specifically, the query optimizer intervenes to rewrite the AST, especially handling operations involving SecureJSONB. This step transforms the plaintext query conditions into computational tasks with ciphertext as operands.

[0038] First, constant encryption is performed. For constant values ​​in the query conditions, the kernel uses the public key (PubicKey, PK) of homomorphic encryption to call the same encryption function as in the storage stage to encrypt them into the corresponding query parameter ciphertext.

[0039] Then, a ciphertext query plan is generated: the optimizer generates a physical query execution plan that includes special ciphertext operation operators. This plan contains query conditions for binary format data and no longer includes the "compare plaintext" operation. Instead, it specifies the operation of extracting the ciphertext of the target value from the SecureJSONB column according to the path.

[0040] Step S5: Execute the ciphertext query plan, perform homomorphic computation based on the ciphertext of the query parameters and the ciphertext data in the binary format data, and obtain the search results based on the computation results.

[0041] like Figure 4 As shown, the database's execution engine loads and runs the encrypted query plan. The core process involves looping through each row in the table (or the row located by the index): Encrypted data extraction: For the current data row, the execution engine reads the SecureJSONB binary data.

[0042] Homomorphic computation: Recursively traversing each item in SecureJSONB And calculate: ; in The query parameters are encrypted.

[0043] According to formulas (1) and (2), we can obtain: ; Optionally, when the result is 0, it indicates and It is equivalent.

[0044] Optionally, return the search results based on rows that result in 0.

[0045] By following the steps above, secure, efficient, and transparent retrieval of homomorphically encrypted JSON data can be achieved within the database kernel. Throughout the process, sensitive data does not need to be decrypted, and the query logic is preserved, achieving a fundamental balance between security and availability.

[0046] The JSON data secure storage and retrieval method provided in this application creates security-related data types in the database kernel. The database system can automatically and transparently process the JSON structure from an encrypted perspective from the moment it receives data. This ensures that sensitive content is never leaked while maintaining awareness of the data format. By homomorphically encrypting the semantic units in the JSON data and combining them with plaintext structure metadata into binary format data of the security-related data type, the data remains encrypted throughout its lifecycle (storage, logs, and backups), fundamentally eliminating the risk of static data leakage. Since the data is encrypted at the kernel entry point, an end-to-end security loop is constructed from the application interface to the storage medium, effectively defending against deep threats including high-privilege DBA attacks, log theft, and backup leaks, thus improving data security. During data retrieval, by rewriting the query statement as a homomorphic computation on the encrypted domain and executing it directly on the encrypted data, only matching encrypted results are returned, achieving "usable but invisible" data. It also enables precise equality, range, and array inclusion queries without decryption, improving data availability.

[0047] In some embodiments, step S2 specifically includes: Use the homomorphic encryption public key integrated into the database kernel to perform differential nested encryption on key strings, scalar values, and array values ​​in JSON data; The process of encrypting the key string in the JSON data includes: A character-by-character encoding encryption strategy is adopted to convert the key string into an encoded sequence, and each encoded value in the sequence is independently homomorphically encrypted to generate a ciphertext vector.

[0048] like Figure 3 As shown, after parsing the plaintext JSON, homomorphic encryption is performed based on the type-oriented semantic unit. The system uses the integrated public key PK to perform differential encryption on the semantic unit, as follows: Key and Scalar Encryption: For all key strings and scalar values ​​(numbers or booleans), directly apply a homomorphic encryption algorithm. (PK, m) is encrypted, and the Boolean values ​​true and false are mapped to agreed-upon numerical values ​​(such as 1 and 0) before encryption; the string uses a character-by-character encoding encryption strategy, converting the string into a Unicode or UTF-8 encoded sequence, and then independently performing homomorphic encryption on each encoded value in the sequence to generate a ciphertext vector. (PK, code1) (PK, code2),...).

[0049] Array value encryption: Iterate through each element in the array, and recursively apply the above rules to encrypt each scalar or string element in the array. Finally, the entire array is converted into a nested ciphertext vector.

[0050] If the value is another JSON object, then that object is treated as a whole and the above rules are recursively applied for encryption, and the final encrypted result is a composite ciphertext block.

[0051] In some embodiments, the method further includes: Load or dynamically generate key pairs for homomorphic encryption algorithms, integrate the public key of the key pair into the global context of the database kernel for encryption, and hold the private key of the key pair by a trusted manager outside the database or a securely authenticated client session, and do not store it in the database server.

[0052] Optionally, when the database instance starts or the security module is loaded, the database system loads or dynamically generates a key pair for the homomorphic encryption algorithm from the security configuration. The public key PK is integrated into the global memory context of the database kernel for use in all subsequent encryption operations. The private key (Secret Key, SK) is held by a trusted manager outside the database or a securely authenticated client session and is never stored on the database server.

[0053] In some embodiments, step S5 includes: The private key is used to decrypt all binary data corresponding to calculation results of 0, and the decrypted data is returned as the search results.

[0054] After homomorphic computation, all binary data with a computed value of 0 are collected and decrypted via the homomorphic decryption interface using the private key SK. (SK, reulst) decrypts and returns.

[0055] In one embodiment of this application, an enterprise employee information management system is used as an example to illustrate the specific application of the method described in this application. This system uses a database (such as PostgreSQL) that supports the kernel extension of this application to store employee files containing sensitive information. 1. Scenario and Data Definition CREATE TABLE employees ( id INT PRIMARY KEY, name TEXT, -- plaintext, used for non-sensitive queries secure_profile SecureJSONB -- An extended type for securely storing sensitive information ); Example data (plain text view): The secure_profile field of employee Alice contains the following JSON data: { “department” means “research and development”. “salary”: 95000 "performance": [8, 9, 9], “personal”:{ "location": "Shanghai" "level": "P8" } } 2. Secure stored procedure (data insertion) INSERT INTO employees (id, name, secure_profile) VALUES (1, 'Alice', '{"department": "R&D", "salary": 95000, "performance": [8, 9, 9], "personal": {"location": "Shanghai", "level": "P8"}}'); The kernel automatically executes the following process: The parser recognizes the secure_profile field as being of type SecureJSONB and calls its input function.

[0056] The input function decomposes and encrypts JSON: The key “department” is encrypted as E(PK, “department”), and the value “research and development” is encrypted as E(PK, “research and development”).

[0057] The key “salary” is encrypted as E(PK, “salary”), and the value 95000 is encrypted as E(PK, 95000).

[0058] The array [8, 9, 9] is encrypted into the ciphertext vector [E(PK, 8), E(PK, 9), E(PK, 9)].

[0059] The nested object `personal` is processed recursively, and its internal key-value pairs are also encrypted.

[0060] All ciphertext units are assembled with plaintext structure tags, serialized into binary SecureJSONB format, and written to disk. At this point, the field recorded in the database data file and transaction log is ciphertext that cannot be directly deciphered.

[0061] 3. Encrypted text retrieval process (data query) SELECT id, name FROM employees WHERE secure_profile->'department'='R&D'; Kernel execution flow: Rewrite: The optimizer rewrites the query. It encrypts the constant 'R&D' into E(PK, "R&D") and generates an execution plan containing the HomomorphicEquals ciphertext operator.

[0062] implement: The execution engine scans the employees table.

[0063] For each line, extract the ciphertext C_dept under the department path and the ciphertext C_salary under the salary path from the SecureJSONB binary data.

[0064] Calculate directly in memory: Calculate C_diff = HomomorphicSub(C_dept, E(PK, "R&D")), and call IsZero(C_diff) to get the boolean result B1.

[0065] According to the encoding scheme, when B1 is true, the id and name (plaintext) of the row are put into the result set.

[0066] Return: The database decrypts the result set into [(1, "Alice")] and returns it to the application.

[0067] This application directly embeds homomorphic encryption logic into the database kernel's type system, query optimizer, and execution engine. By creating the SecureJSONB native data type, the database system automatically and transparently processes the JSON structure from a ciphertext perspective from the moment it receives the data. This ensures that sensitive content is never leaked while maintaining the database's awareness of the data format. This application abandons the traditional path of "decryption before filtering" or "complex protocol interaction," and utilizes the mathematical properties of homomorphic encryption to propose a ciphertext domain query rewriting and execution technique. The system can compile standard WHERE conditions into a series of atomic operations such as homomorphic subtraction that are directly executed on the ciphertext. The query filters the ciphertext data directly within the database execution engine, returning only matching ciphertext results, achieving true "usable but invisible," and striking a balance between security and query performance. Furthermore, because the data is encrypted at the kernel entry point, the security boundary of this application far exceeds that of traditional solutions. Not only is statically stored data ciphertext, but sensitive data also remains ciphertext in the database's runtime memory data pages, write-ahead logs, SQL execution plan cache, logical replication streams, and backup files. This creates an end-to-end security loop from the application interface to the storage medium, effectively defending against deep threats including high-privilege DBA attacks, log theft, and backup leaks.

[0068] The following describes the JSON data secure storage and retrieval apparatus provided in this application. The JSON data secure storage and retrieval apparatus described below can be referred to in correspondence with the JSON data secure storage and retrieval method described above.

[0069] Figure 5 This is a schematic diagram of the structure of a JSON data secure storage and retrieval device provided in an embodiment of this application, as shown below. Figure 5 As shown, the device 500 includes: Parsing module 510 is used to create security-related data types in the database kernel and parse JSON data into structured objects based on security-related data types; The encrypted storage module 520 is used to perform homomorphic encryption on the semantic units in the JSON data, and combine the encrypted semantic units with the plaintext structure metadata of the JSON data to generate binary format data of security-related data types for persistent storage. The binary format data remains in ciphertext state throughout the lifecycle of the database. The receiving module 530 is used to receive a data query statement sent to the database, the data query statement containing query conditions for binary format data; The encryption module 540 is used to homomorphically encrypt the constant values ​​in the query conditions to obtain the ciphertext of the query parameters, and generate a ciphertext query plan based on the query conditions. The retrieval module 550 is used to execute the ciphertext query plan, perform homomorphic computation operations based on the ciphertext data in the query parameter ciphertext and the ciphertext data in the binary format data, and obtain the retrieval results based on the computation results.

[0070] It should be understood that the above-described device is used to execute the methods in the above embodiments. The implementation principle and technical effect of the corresponding program modules in the device are similar to those described in the above methods. The working process of the device can be referred to the corresponding process in the above methods, and will not be repeated here.

[0071] Based on the methods in the above embodiments, Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown in the illustration, this application provides an electronic device that may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640. The processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can invoke logical instructions stored in the memory 630 to execute the JSON data secure storage and retrieval method described in the above embodiment.

[0072] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the JSON data secure storage and retrieval method described in the various embodiments of this application.

[0073] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the JSON data secure storage and retrieval method in the above embodiments.

[0074] Based on the methods in the above embodiments, this application provides a computer program product that, when run on a processor, causes the processor to execute the JSON data secure storage and retrieval method in the above embodiments.

[0075] It is understood that the processor in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0076] The method steps in this application embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0077] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0078] It is understood that the various numerical designations used in the embodiments of this application are merely for the convenience of description and are not intended to limit the scope of the embodiments of this application.

[0079] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for secure storage and retrieval of JSON data, characterized in that, include: Create security-related data types in the database kernel, and parse JSON data into structured objects based on the security-related data types; The semantic units in the JSON data are homomorphically encrypted, and the encrypted semantic units are combined with the plaintext structure metadata of the JSON data to generate binary format data of the security-related data type for persistent storage. The binary format data remains in ciphertext state throughout the lifecycle of the database. Receive a data query statement sent to the database, the data query statement containing query conditions for the binary format data; The constant values ​​in the query conditions are homomorphically encrypted to obtain the ciphertext of the query parameters, and a ciphertext query plan is generated based on the query conditions. The encrypted query plan is executed, and a homomorphic computation operation is performed based on the encrypted query parameters and the encrypted data in the binary format data. The search results are obtained based on the computation results.

2. The JSON data secure storage and retrieval method according to claim 1, characterized in that, The homomorphic encryption of semantic units in the JSON data includes: Using a homomorphic encryption public key integrated in the database kernel, differential nested encryption is performed on the key strings, scalar values, and array values ​​in the JSON data; The process of encrypting the key string in the JSON data includes: A character-by-character encoding encryption strategy is adopted to convert the key string into an encoding sequence, and each encoded value in the sequence is independently homomorphically encrypted to generate a ciphertext vector.

3. The method for secure storage and retrieval of JSON data according to claim 1, characterized in that, The method further includes: Load or dynamically generate a key pair for a homomorphic encryption algorithm, integrate the public key of the key pair into the global context of the database kernel for encryption, and hold the private key of the key pair by a trusted manager outside the database or a securely authenticated client session, and do not store it in the database server.

4. The method for secure storage and retrieval of JSON data according to claim 1, characterized in that, The process of obtaining search results based on calculation results includes: The private key is used to decrypt all binary data corresponding to calculation results of 0, and the decrypted data is returned as the search results.

5. A JSON data secure storage and retrieval device, characterized in that, include: The parsing module is used to create security-related data types in the database kernel and parse JSON data into structured objects based on the security-related data types. An encrypted storage module is used to perform homomorphic encryption on the semantic units in the JSON data, and combine the encrypted semantic units with the plaintext structure metadata of the JSON data to generate binary format data of the security-related data type for persistent storage, wherein the binary format data remains in ciphertext state throughout the lifecycle of the database. The receiving module is used to receive data query statements sent to the database, wherein the data query statements contain query conditions for the binary format data; An encryption module is used to homomorphically encrypt the constant values ​​in the query conditions to obtain ciphertext query parameters, and generate a ciphertext query plan based on the query conditions. The retrieval module is used to execute the ciphertext query plan, perform homomorphic computation operations based on the ciphertext query parameters and the ciphertext data in the binary format data, and obtain the retrieval results based on the computation results.

6. An electronic device, characterized in that, include: At least one memory for storing computer programs; At least one processor is configured to execute a program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute the JSON data secure storage and retrieval method as described in any one of claims 1-4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is run on a processor, it causes the processor to perform the JSON data secure storage and retrieval method as described in any one of claims 1-4.

8. A computer program product, characterized in that, When the computer program product is run on a processor, the processor performs the JSON data secure storage and retrieval method as described in any one of claims 1-4.

Images