Data processing method and device, computer equipment, readable storage medium and program product
By using a hierarchical encryption algorithm to partially encrypt database field data, the problem of range queries being impossible in a fully encrypted database is solved, achieving a balance between data security and query visibility.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA TELECOM CLOUD TECH CO LTD
- Filing Date
- 2025-12-22
- Publication Date
- 2026-05-05
AI Technical Summary
Existing technologies cannot achieve range queries in fully encrypted databases, and data security is insufficient.
A hierarchical encryption algorithm is used to encrypt the data in the field to be encrypted. The field to be encrypted is determined by the parse tree result data, and it is encrypted according to the field encryption ratio to generate an encrypted parse tree. This achieves partial data encryption to ensure data security, while retaining partial data visibility.
While ensuring data security, it allows data querying, implements partial encryption of field data, and preserves data visibility to support query operations.
Smart Images
Figure CN121980600A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology
[0002] With the development of computer infrastructure, databases are increasingly used for data storage, and database security is of paramount importance in order to ensure the security of the data stored in the database.
[0003] In related technologies, protection measures are mainly specified according to the stage of the data to ensure data security. For example, SSL / TLS is used to implement data transmission at the data transmission node, transparent storage encryption is used in the data persistence storage stage, and RLS (Row Level Security) or data desensitization strategy is used in the result return stage.
[0004] However, among the methods for ensuring data security in related technologies, range queries cannot be implemented in fully encrypted databases, and the data security is insufficient. Summary of the Invention
[0005] Therefore, it is necessary to provide a data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can ensure data security in response to the above-mentioned technical problems.
[0006] In a first aspect, this application provides a data processing method, including:
[0007] Obtain the first query instruction, parse and process the first query instruction, and obtain the parse tree result data;
[0008] Based on the parse tree results, determine the field data to be encrypted;
[0009] The encryption ratio of the fields in the data to be encrypted is determined by using a hierarchical encryption algorithm, and the data to be encrypted is then encrypted according to the encryption ratio to obtain the encrypted parse tree.
[0010] The encrypted parse tree is serialized, and the serialized parse tree is sent to the database server;
[0011] The system retrieves the query results returned by the database server corresponding to the first query command. The query results are the parse tree data obtained by the database server after deserializing the serialized parse tree, and the query results are obtained based on the parse tree data.
[0012] In one embodiment, after obtaining the parse tree result data, the data processing method includes: associating the first query instruction with the parse tree result data and storing it in a cache; when a second query instruction is received, traversing the cache to query whether there is a first query instruction that matches the second query instruction; if there is a first query instruction that matches the second query instruction in the cache, then using the parse tree result data corresponding to the first query instruction as the query result corresponding to the second query instruction, and sending it to the database server.
[0013] In one embodiment, before determining the encryption ratio of the fields in the data to be encrypted using a hierarchical encryption algorithm, the data processing method includes: determining the field type of the data to be encrypted; and adding a preset encryption tag to the data to be encrypted based on the field type, wherein the preset encryption tag is used to determine the encryption ratio.
[0014] In an optional embodiment, a hierarchical encryption algorithm is used to determine the field encryption ratio in the field data to be encrypted, and the field data to be encrypted is encrypted according to the field encryption ratio to obtain an encrypted parse tree. This includes: obtaining the encryption ratio when the encryption label of the field data to be encrypted is a preset encryption label; dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio; encrypting the field data corresponding to the ciphertext suffix to obtain an encrypted ciphertext suffix; and concatenating the plaintext prefix and the encrypted ciphertext suffix to obtain the encrypted field data.
[0015] In one embodiment, after obtaining the query result returned by the database server corresponding to the first query instruction, the data processing method includes: obtaining the encrypted field in the query result, and decrypting the encrypted field in the query result to obtain the result data.
[0016] In one embodiment, before dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio, the data processing method includes: when the encryption tag of the field data to be encrypted is a preset encryption tag, converting the field data to be encrypted into a string; dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio includes: dividing the string into a plaintext prefix and a ciphertext suffix according to the encryption ratio.
[0017] Secondly, this application also provides a data processing apparatus, comprising:
[0018] The parse tree acquisition module is used to acquire the first query command, parse and process the first query command, and obtain the parse tree result data;
[0019] The encrypted data determination module is used to determine the field data to be encrypted based on the parse tree result data;
[0020] The encryption module is used to determine the encryption ratio of the fields in the data to be encrypted using a hierarchical encryption algorithm, and to encrypt the data according to the encryption ratio to obtain the encrypted parse tree.
[0021] The data sending module is used to serialize the encrypted parse tree and send the serialized parse tree to the database server;
[0022] The result acquisition module is used to acquire the query result returned by the database server corresponding to the first query instruction. The query result is the parse tree result data obtained by the database server after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data.
[0023] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method embodiments.
[0024] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method embodiments.
[0025] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method embodiments.
[0026] The aforementioned data processing methods, apparatus, computer equipment, computer-readable storage media, and computer program products utilize hierarchical encryption algorithms to encrypt the field data to be encrypted. This allows for partial encryption of the field data, ensuring data confidentiality and security while also preserving the visibility of some data within the field data, enabling data retrieval using the visible data. Attached Figure Description
[0027] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0028] Figure 1 This is a diagram illustrating the application environment of a data processing method in one embodiment.
[0029] Figure 2 This is a flowchart illustrating a data processing method in one embodiment;
[0030] Figure 3 This is a flowchart illustrating the data processing method in another embodiment;
[0031] Figure 4 This is a structural block diagram of a data processing device in one embodiment;
[0032] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0034] The data processing method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Terminal 102 obtains a first query instruction, parses and processes the first query instruction to obtain parse tree result data; based on the parse tree result data, it determines the field data to be encrypted; it uses a hierarchical encryption algorithm to determine the field encryption ratio in the field data to be encrypted, and encrypts the field data to be encrypted according to the field encryption ratio to obtain an encrypted parse tree; it performs a serialization operation on the encrypted parse tree and sends the serialized parse tree to the database server; it obtains the query result returned by database server 104 corresponding to the first query instruction. The query result is the parse tree result data obtained by database server 104 after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.
[0035] In one exemplary embodiment, such as Figure 2 As shown, a data processing method is provided, which can be applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps 202 to 210. Wherein:
[0036] Step 202: Obtain the first query instruction, parse and process the first query instruction to obtain the parse tree result data.
[0037] In one embodiment, the user generates the first query command using a terminal.
[0038] Alternatively, the terminal can be a psql client.
[0039] The psql client is a terminal-based front-end for PostgreSQL.
[0040] Optionally, users can use a psql client to type query commands. For example, query commands can be typed using the keyboard.
[0041] Optionally, the input can come from a file or command-line arguments. After receiving the input, the terminal generates a query command based on the input.
[0042] In an exemplary embodiment, after obtaining the first query instruction, the first query instruction can be parsed to obtain parse tree result data.
[0043] Optionally, the parsing algorithm can be related to the database type. For example, for the PostgreSQL database, the parsing algorithm can be related to the SQL statement. The specific parsing algorithm is not limited, as long as it parses the first query instruction.
[0044] For example, an SQL parser can be set up in the terminal to parse the first query command. Optionally, the SQL parser can be a lightweight parser.
[0045] The parse tree results are used to perform data queries.
[0046] Optionally, after obtaining the parse tree result data, the terminal can send the parse tree result data to the database server, and the database server can perform data queries based on the parse tree result data.
[0047] In an optional embodiment, the first query instruction can be associated with the parse tree result data and stored in a cache, so that when a subsequent query instruction matching the first query instruction is received, the parse tree result data can be directly retrieved from the cache, reducing the waste of data computing resources.
[0048] For example, the first query instruction is associated with the parse tree result data and stored in the cache. When the second query instruction is received, the cache is traversed to check if there is a first query instruction that matches the second query instruction. If there is a first query instruction that matches the second query instruction in the cache, the parse tree result data corresponding to the first query instruction is used as the query result corresponding to the second query instruction and sent to the database server.
[0049] Step 204: Determine the field data to be encrypted based on the parse tree result data.
[0050] Step 206: Use a hierarchical encryption algorithm to determine the field encryption ratio in the field data to be encrypted, and encrypt the field data to be encrypted according to the field encryption ratio to obtain the encrypted parse tree.
[0051] In an optional embodiment, after parsing the first query instruction and obtaining the parse tree result data, the field data to be encrypted can be determined through the parse tree result data, and the field data to be encrypted can be identified as the field data to be encrypted.
[0052] In one embodiment, after obtaining the field data to be encrypted, the field data can be encrypted. Optionally, the encryption algorithm is not limited, as long as encryption is achieved.
[0053] In one embodiment, a hierarchical encryption algorithm can be used to encrypt the field data to be encrypted.
[0054] Among them, the hierarchical encryption algorithm can be used to determine the encryption ratio of the fields in the data to be encrypted, and can encrypt the data according to the encryption ratio.
[0055] In one alternative embodiment, the field encryption ratio can be input by the user using a terminal.
[0056] For example, when a user generates a first query instruction using a terminal, the user inputs the field encryption ratio and encapsulates the input field encryption ratio in the first query instruction so that the terminal can process it based on the first query instruction.
[0057] In one embodiment, the field type of the encrypted field can be set, and a corresponding field encryption ratio can be set. After obtaining the parse tree result data and determining the field data to be encrypted, the data type of the field data to be encrypted is determined, and the corresponding field encryption ratio is obtained according to the data type.
[0058] For example, if the data type of the field is a first data type, the corresponding encryption ratio is a first encryption ratio; if the data type of the field is a second data type, the corresponding encryption ratio is a second encryption ratio.
[0059] In an alternative embodiment, the field encryption ratio can be determined by the user when generating the first query instruction using the terminal and encapsulated in the first query instruction.
[0060] In one embodiment, it can be determined whether to use a hierarchical encryption algorithm to encrypt the field data to be encrypted based on the field type of the field data.
[0061] Alternatively, if the field data needs to be encrypted, the encryption ratio can be determined by the field type of the field data.
[0062] In one exemplary embodiment, the field type of the field data to be encrypted is determined; a preset encryption tag is added to the field data to be encrypted based on the field type, and the preset encryption tag is used to determine the encryption ratio.
[0063] For example, if the data type of the field data is a first data type, then the field data to be encrypted is encrypted using a determined first encryption ratio.
[0064] In one embodiment, the field data can be labeled to distinguish whether the field data is encrypted.
[0065] For example, if the data type of the field is a first data type, then the field data can be encrypted using a first encryption ratio.
[0066] For example, if the data type of the field data is a third data type, and the third data type indicates that the corresponding field data does not need to be encrypted, then the field data with the third data type is not encrypted.
[0067] In an optional embodiment, the hierarchical encryption algorithm may include: when the encryption label of the field data to be encrypted is a preset encryption label, obtaining an encryption ratio; dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio; encrypting the field data corresponding to the ciphertext suffix to obtain the encrypted ciphertext suffix; and concatenating the plaintext prefix and the encrypted ciphertext suffix to obtain the encrypted field data.
[0068] The preset encryption tag is used to determine whether to use a hierarchical encryption algorithm.
[0069] For example, assuming the field data is "1234567891", and the encryption tag of the field data is a preset encryption tag, the encryption ratio can be determined to be 0.6 based on the preset encryption tag. Therefore, the prefix ratio can be considered to be 0.4 and the suffix ratio to be 0.6.
[0070] Optionally, after determining the encryption ratio, the field data is divided into a plaintext prefix and a ciphertext suffix. For example, "1234" in "1234567891" can be used as the plaintext prefix, while "567891" in "1234567891" can be used as the ciphertext suffix.
[0071] Optionally, after obtaining the ciphertext suffix, the ciphertext suffix is encrypted to obtain an encrypted ciphertext suffix. For example, the encrypted ciphertext suffix can be "******". Optionally, the encryption algorithm used to encrypt the ciphertext suffix is not limited, as long as encryption is achieved.
[0072] In one embodiment, after encrypting the ciphertext suffix to obtain the encrypted ciphertext suffix, the plaintext prefix and the encrypted ciphertext suffix can be concatenated to form the encrypted field data. For example, if the field data is "1234567891", the encrypted field data can be "1234******".
[0073] In one embodiment, after obtaining the encrypted field data, the encrypted field data is used to replace the original field data to generate encrypted parse tree result data.
[0074] In an optional embodiment, when determining to encrypt field data, if the format of the encrypted field data does not match, the field data is converted into a string to ensure accurate data processing. For example: when the encryption tag of the field data to be encrypted is a preset encryption tag, the field data to be encrypted is converted into a string; according to the encryption ratio, the string is divided into a plaintext prefix and a ciphertext suffix.
[0075] In one embodiment, the database server can use a plaintext prefix to perform data queries. By setting the encryption ratio, range searches can be performed using the plaintext prefix while the data is encrypted.
[0076] Optionally, the database server can also perform data processing on the queried data, such as sorting and filtering.
[0077] Step 208: Serialize the encrypted parse tree and send the serialized parse tree to the database server.
[0078] Step 210: Obtain the query results returned by the database server that correspond to the first query command.
[0079] The query result is the parse tree result data obtained by the database server after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data.
[0080] In one embodiment, after obtaining the encrypted parse tree, the encrypted parse tree can be serialized to make it conform to the format requirements of the database server.
[0081] For example, after the serialized and encrypted parsing tree is completed, the terminal can send the serialized and encrypted parsing tree file to the server, and the server can perform data processing based on the received serialized and encrypted parsing file.
[0082] For example, after receiving the serialized parsed file, the server performs a deserialization operation to obtain an encrypted parse tree. The server then performs a data query based on the parse tree, encapsulates the query results to generate query result feedback information, and sends the query result feedback information to the terminal, which then obtains the result data from the query result feedback information.
[0083] In one embodiment, if the query result feedback information includes encrypted information, the encrypted fields in the query result can be obtained, and the encrypted fields in the query result can be decrypted to obtain the result data. Optionally, the specific decryption algorithm is not limited, as long as it can be used to decrypt the query result feedback information.
[0084] In the above data processing method, the hierarchical encryption algorithm is used to encrypt the field data to be encrypted. This can partially encrypt the field data to be encrypted. While using encryption to achieve data confidentiality and ensure data security, it can also retain the visibility of some data in the field data so that the visible data can be used for data querying.
[0085] In one exemplary embodiment, such as Figure 3 As shown, a data processing method is provided, which can be applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps 302 to 332. Wherein:
[0086] Step 302: Obtain the first query instruction, parse and process the first query instruction to obtain the parse tree result data.
[0087] Step 304: Associate the first query instruction with the parse tree result data and store it in the cache.
[0088] Step 306: When the second query instruction is received, traverse the cache to check if there is a first query instruction that matches the second query instruction.
[0089] Step 308: Determine whether there is a first query instruction in the cache that matches the second query instruction. If yes, proceed to step 310; otherwise, proceed to step 314.
[0090] Step 310: The parse tree result data corresponding to the first query instruction is used as the query result corresponding to the second query instruction and sent to the database server.
[0091] Step 312: Parse the second query command to obtain the parse tree result data.
[0092] Step 314: Determine the field data to be encrypted based on the parse tree result data.
[0093] Step 316: Determine the field type of the data to be encrypted.
[0094] Step 318: Add a preset encryption label to the field data to be encrypted based on the field type. The preset encryption label is used to determine the encryption ratio.
[0095] Step 320: When the encryption label of the field data to be encrypted is the preset encryption label, obtain the encryption ratio.
[0096] Step 322: Based on the encryption ratio, divide the field data to be encrypted into a plaintext prefix and a ciphertext suffix.
[0097] Step 324: Encrypt the field data corresponding to the ciphertext suffix to obtain the encrypted ciphertext suffix.
[0098] Step 326: Concatenate the plaintext prefix and the encrypted ciphertext suffix to obtain the encrypted field data.
[0099] Step 328: Generate an encrypted parse tree based on the encrypted field data and the parse tree result data.
[0100] Step 330: Serialize the encrypted parse tree and send the serialized parse tree to the database server.
[0101] Step 332: Obtain the query results returned by the database server that correspond to the first query command.
[0102] The query result is the parse tree result data obtained by the database server after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data.
[0103] In the above data processing method, the hierarchical encryption algorithm is used to encrypt the field data to be encrypted. This can partially encrypt the field data to be encrypted. While using encryption to achieve data confidentiality and ensure data security, it can also retain the visibility of some data in the field data so that the visible data can be used for data querying.
[0104] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0105] Based on the same inventive concept, this application also provides a data processing apparatus for implementing the data processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more data processing apparatus embodiments provided below can be found in the limitations of the data processing method described above, and will not be repeated here.
[0106] In one exemplary embodiment, such as Figure 4 As shown, a data processing device 400 is provided, including: a parse tree acquisition module 402, an encrypted data determination module 404, an encryption module 406, a data transmission module 408, and a result acquisition module 410, wherein:
[0107] The parse tree acquisition module 402 is used to acquire the first query instruction, parse and process the first query instruction, and obtain the parse tree result data.
[0108] The encrypted data determination module 404 is used to determine the field data to be encrypted based on the parse tree result data.
[0109] The encryption module 406 is used to determine the field encryption ratio in the field data to be encrypted using a hierarchical encryption algorithm, and to encrypt the field data to be encrypted according to the field encryption ratio to obtain the encrypted parse tree.
[0110] The data sending module 408 is used to serialize the encrypted parse tree and send the serialized parse tree to the database server.
[0111] The result acquisition module 410 is used to acquire the query result returned by the database server corresponding to the first query instruction. The query result is the parse tree result data obtained by the database server after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data.
[0112] In one embodiment, the data processing device further includes a caching module, which, after obtaining the parse tree result data, associates and stores the first query instruction with the parse tree result data in a cache area; when a second query instruction is received, it traverses the cache area to query whether there is a first query instruction that matches the second query instruction; if there is a first query instruction that matches the second query instruction in the cache area, the parse tree result data corresponding to the first query instruction is used as the query result corresponding to the second query instruction and sent to the database server.
[0113] In one embodiment, the data processing apparatus further includes an encryption tag adding module, which is used to determine the field type of the field data to be encrypted before determining the field encryption ratio in the field data to be encrypted using a hierarchical encryption algorithm; and to add a preset encryption tag to the field data to be encrypted based on the field type, wherein the preset encryption tag is used to determine the encryption ratio.
[0114] In an optional embodiment, the encryption module is further configured to: obtain an encryption ratio when the encryption label of the field data to be encrypted is a preset encryption label; divide the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio; encrypt the field data corresponding to the ciphertext suffix to obtain the encrypted ciphertext suffix; and concatenate the plaintext prefix and the encrypted ciphertext suffix to obtain the encrypted field data.
[0115] In one exemplary embodiment, the data processing apparatus further includes a decryption membrane, used to obtain encrypted fields in the query results returned by the database server corresponding to the first query instruction, and to decrypt the encrypted fields in the query results to obtain result data.
[0116] In one embodiment, the data processing apparatus further includes a conversion module, configured to convert the field data to be encrypted into a string when the encryption label of the field data to be encrypted is a preset encryption label, before dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio;
[0117] The encryption module is also used to divide a string into a plaintext prefix and a ciphertext suffix according to the encryption ratio.
[0118] Each module in the aforementioned data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.
[0119] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data processing method.
[0120] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0121] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method embodiments.
[0122] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method embodiments.
[0123] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the above-described method embodiments.
[0124] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.
[0125] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0126] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0127] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A data processing method, characterized in that, The method includes: Obtain the first query instruction, parse and process the first query instruction, and obtain the parse tree result data; Based on the parse tree result data, determine the field data to be encrypted; A hierarchical encryption algorithm is used to determine the encryption ratio of the fields in the data to be encrypted, and the data to be encrypted is then encrypted according to the encryption ratio to obtain the encrypted parse tree. The encrypted parse tree is serialized, and the serialized parse tree is sent to the database server; Obtain the query result returned by the database server corresponding to the first query instruction. The query result is the parse tree result data obtained by the database server after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data.
2. The method according to claim 1, characterized in that, After obtaining the parse tree result data, the method includes: The first query instruction is associated with the parse tree result data and stored in the cache area; When a second query instruction is received, the cache area is traversed to check whether a first query instruction that matches the second query instruction exists; If the cache contains a first query instruction that matches the second query instruction, the parse tree result data corresponding to the first query instruction is used as the query result corresponding to the second query instruction and sent to the database server.
3. The method according to claim 1, characterized in that, Before determining the encryption ratio of the fields in the data to be encrypted using a hierarchical encryption algorithm, the method includes: Determine the field type of the data to be encrypted; A preset encryption tag is added to the field data to be encrypted based on the field type. The preset encryption tag is used to determine the encryption ratio.
4. The method according to claim 3, characterized in that, The process of determining the encryption ratio of fields in the data to be encrypted using a hierarchical encryption algorithm, and encrypting the data according to the encryption ratio to obtain an encrypted parse tree, includes: When the encryption label of the field data to be encrypted is a preset encryption label, obtain the encryption ratio; Based on the encryption ratio, the field data to be encrypted is divided into a plaintext prefix and a ciphertext suffix; The field data corresponding to the ciphertext suffix is encrypted to obtain the encrypted ciphertext suffix; The plaintext prefix and the encrypted ciphertext suffix are concatenated to obtain the encrypted field data.
5. The method according to claim 4, characterized in that, After obtaining the query result returned by the database server corresponding to the first query instruction, the method includes: Obtain the encrypted fields from the query results, and decrypt the encrypted fields to obtain the result data.
6. The method according to claim 4, characterized in that, Before dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio, the method includes: When the encryption tag of the field data to be encrypted is a preset encryption tag, the field data to be encrypted is converted into a string; The step of dividing the field data to be encrypted into a plaintext prefix and a ciphertext suffix according to the encryption ratio includes: Based on the encryption ratio, the string is divided into a plaintext prefix and a ciphertext suffix.
7. A data processing apparatus, characterized in that, The device includes: The parse tree acquisition module is used to acquire the first query instruction, parse and process the first query instruction, and obtain parse tree result data. The encrypted data determination module is used to determine the field data to be encrypted based on the parse tree result data; The encryption module is used to determine the field encryption ratio in the field data to be encrypted using a hierarchical encryption algorithm, and to encrypt the field data to be encrypted according to the field encryption ratio to obtain an encrypted parse tree; The data sending module is used to serialize the encrypted parse tree and send the serialized parse tree to the database server; The result acquisition module is used to acquire the query result returned by the database server corresponding to the first query instruction. The query result is the parse tree result data obtained by the database server after deserializing the serialized parse tree, and the result data obtained by querying based on the parse tree result data.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.