Query protection method and device for off-line data and privacy protection method and device

Abstract

The invention discloses a query protection method and device and a privacy protection method and device for offline data, and relates to the technical field of data privacy processing. According to the main technical scheme, in the interaction process of a data provider and a data query party, off-line data provided by the data provider comprises two data sets and is sent to the data query party to serve as queriable off-line data; wherein the hidden content of the second data set comprises a mapping relation between different query conditions and decrypted data required for decrypting and encrypting the query record, original text data corresponding to each query condition and original text data corresponding to each decrypted data; for any query request initiated by a data query party side, if the original text of any target query condition in the second data set is blindly hit, the original text of'decryption data 'required for encrypting the query record is determined based on the mapping relation hidden in the second data set, and then subsequent decryption operation is completed to obtain a query result.

Description

Technical Field

[0001] This disclosure relates to the field of data privacy and security technology, and in particular to a method and apparatus for querying and protecting offline data, and a method and apparatus for privacy protection. Background Technology

[0002] Against the backdrop of the rapid development of the digital economy, data, as a key production factor, is increasingly valued and has become a new engine for promoting high-quality economic and social development. However, the widespread use of data has also brought about increasingly prominent governance issues such as privacy leaks and misuse, seriously hindering the healthy and orderly development of the data factor market. To address this, the government has successively introduced and continuously improved relevant policies on data compliance, aiming to build a "security lock" for data circulation and utilization, ensuring the efficient use of data under the premise of legality and compliance.

[0003] As data compliance requirements become increasingly stringent, enterprises face higher privacy and security standards during cross-organizational data interactions, while still needing to meet business demands for high-performance queries. Currently, a common cross-enterprise data query model is localized querying based on offline data: that is, based on a security agreement reached by both parties, the data provider transmits a large amount of data as an offline dataset to the data querying party, enabling the latter to perform efficient query operations locally to support diverse business scenarios.

[0004] However, this process involves dual privacy protection demands: on the one hand, data providers do not want data queryers to obtain the raw plaintext data; on the other hand, data queryers are unwilling to disclose their specific query intent (such as search criteria) to data providers. Therefore, there is an urgent need to build a two-way privacy protection mechanism that balances security and efficiency to effectively support compliant, trustworthy, and efficient cross-enterprise data collaboration. Summary of the Invention

[0005] This disclosure provides a method and apparatus for querying and protecting offline data, as well as a method and apparatus for protecting privacy. The main purpose is to meet the requirements of high-performance querying while protecting the security of the offline data pre-delivered by the data provider and its own privacy rights, and to protect the privacy of the querying party's query intent while supporting efficient local queries. This provides an effective solution that balances query efficiency and data query protection.

[0006] To achieve the above objectives, this disclosure mainly provides the following technical solutions: The first aspect of this disclosure provides a method for protecting offline data during querying, applied to a data querying party, the method comprising: Obtain offline data provided by a data provider. The offline data includes at least a first data set and a second data set. The first data set contains one or more encrypted query records after encryption processing. Each encrypted query record corresponds one-to-one with a unique query condition. The second data set contains at least the hidden information of the following data information: the data information includes the first original data corresponding to each query condition, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. In response to a query request received through the data querying party, if the target query condition carried in the query request hits any target first original data in the first original data hidden in the second data set, then based on the hidden information of the data information in the second data set, the target second original data corresponding to the first target original data is output. Using the target query conditions corresponding to the target first original data, search for target encrypted query records that match the target query conditions in the first data set; Using the decrypted data determined by the target second original data, a decryption operation is performed on the target encrypted query record to obtain the query result corresponding to the target query condition.

[0007] A second aspect of this disclosure provides a method for protecting the privacy of offline data, applied to a data provider, the method comprising: Retrieve one or more query conditions and the query records corresponding to each query condition; The plaintext information of the query record is encrypted using a first key and a random number to obtain the encrypted query record corresponding to each query condition, thereby constructing a first data set; For any of the encrypted query records, the decrypted data of the encrypted query record is constructed using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number; A second data set is constructed by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. The first data set and the second data set are sent to the data query party. The first data set and the second data set are considered as offline data. The offline data serves as the data source when the data query party receives a query request and performs a query operation.

[0008] A third aspect of this disclosure provides a query protection device for offline data, applied to a data querying party, the device comprising: The first acquisition unit is used to acquire offline data provided by the data provider. The offline data includes at least a first data set and a second data set. The first data set contains one or more encrypted query records after encryption processing. Each encrypted query record corresponds one-to-one with a unique query condition. The second data set contains at least the hidden information of the following data information: the data information includes the first original data corresponding to each query condition, the second original data of the decrypted data used for the encrypted query record, and the mapping relationship between the first original data and the second original data. The processing unit is used to respond to a query request received by the data querying party and determine whether the target query conditions carried in the query request can hit any one of the target first original data in the first original data hidden in the second data set. The output unit is used to output pseudo-random data in the same format as the second original data if the target query condition carried in the query request does not match any of the target first original data hidden in the second data set. The output unit is further configured to, if the target query condition carried in the query request hits any target first original data in the first original data hidden in the second data set, output the target second original data corresponding to the first target original data based on the hidden information of the data information in the second data set; The search unit is used to search for target encrypted query records that match the target query conditions in the first data set by using the target query conditions corresponding to the target first original data. The first decryption unit is used to perform a decryption operation on the target encrypted query record using the decryption data determined by the target second original data, so as to obtain the query result corresponding to the target query condition.

[0009] A fourth aspect of this disclosure provides a privacy protection device for offline data, applied to a data provider, the device comprising: The second acquisition unit is used to acquire one or more query conditions and query records corresponding to each query condition; The first encryption unit is used to perform encryption processing on the plaintext information of the query record using a first key and a random number to obtain the encrypted query record corresponding to each query condition, so as to construct a first data set; The first construction unit is used to construct the decrypted data of any encrypted query record using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number. The second construction unit is used to construct a second data set by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. The determining unit is used to send the first data set and the second data set to the data querying party. The first data set and the second data set are considered as offline data, which serves as the data source corresponding to the data querying party when it receives a query request and performs a query operation.

[0010] The fifth aspect of this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the offline data query protection method described above; or, when executed by a processor, the computer program implements the offline data privacy protection method described above.

[0011] A sixth aspect of this disclosure provides an electronic device, the device including at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is configured to call program instructions in the memory to execute the query protection method for offline data as described above; or, to execute the privacy protection method for offline data as described above.

[0012] The seventh aspect of this disclosure provides a computer program product, including a computer program / instructions, characterized in that, when the computer program / instructions are executed by a processor, they implement the query protection method for offline data as described above; or, when the computer program / instructions are executed by a processor, they implement the privacy protection method for offline data as described above.

[0013] By means of the above technical solution, the technical solution provided in this disclosure has at least the following advantages: This disclosure provides a method and apparatus for querying and protecting offline data, as well as a method and apparatus for protecting privacy. During the interaction between a data provider and a data queryer, the offline data provided by the data provider comprises two data sets: a first data set containing multiple encrypted query records; and a second data set that hides both the original data information and its own data structure. The hidden content of the second data set includes both the mapping relationship between different query conditions and the decrypted data required to decrypt the encrypted query records, as well as the original data corresponding to each query condition and the original data corresponding to each decrypted data. After the data provider sends the offline data to the data queryer, the data queryer cannot obtain the plaintext information of the encrypted query records, nor can it access the hidden original data information and data structure in the second data set, thus achieving full-process privacy protection for the offline data.

[0014] In practice, the second dataset can be viewed as a "black box data structure." On the querying side, for any initiated query request, the querying party attempts to blindly match the data information contained in this "black box data structure" based on the target query conditions carried in the request. If the blind match is successful (i.e., a correspondence exists in the data structure that matches the target query conditions), then regardless of whether the querying party knows which query condition in the second dataset has been matched, it will accurately return the "target decrypted data" required for the encrypted query record based on the hidden mapping relationship within the dataset. Subsequently, the querying party will use this "target decrypted data" as a basis to locate and determine the target encrypted query record to be decrypted in the first dataset, and then perform the decryption operation to ultimately obtain the query result corresponding to the target query conditions.

[0015] Compared to existing technologies, this disclosure addresses the need to balance query efficiency and privacy protection. The proposed solution leverages an innovative offline data architecture to achieve efficient local queries on the data querying side. This solution safeguards the security and privacy rights of the offline data pre-delivered by the data provider while simultaneously protecting the privacy of the query intent during efficient local queries by the data querying party, ultimately forming an effective solution that balances query efficiency with dual privacy protection.

[0016] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, specific embodiments of this disclosure are described below. Attached Figure Description

[0017] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this disclosure. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart illustrating a method for protecting the privacy of offline data, as provided in this embodiment of the disclosure; Figure 2 A flowchart illustrating another method for protecting the privacy of offline data provided in this disclosure embodiment; Figure 3 A flowchart illustrating a method for querying and protecting offline data provided in this embodiment of the disclosure; Figure 4 Flowchart of another method for querying and protecting offline data provided in this disclosure embodiment; Figure 5 A block diagram illustrating the composition of a privacy protection device for offline data provided in this disclosure embodiment; Figure 6 A block diagram illustrating another privacy protection device for offline data provided in this disclosure embodiment; Figure 7 A block diagram illustrating the composition of an offline data query protection device provided in this embodiment of the present disclosure; Figure 8 A block diagram illustrating another offline data query protection device provided in this embodiment of the present disclosure; Figure 9 An electronic device provided as an embodiment of this disclosure. Detailed Implementation

[0018] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0019] In inter-enterprise data exchange scenarios, both privacy and business performance must be simultaneously met. This manifests as a two-way privacy protection requirement for both data providers and queryers: data providers must grant legitimate data query permissions to queryers, but must ensure that all data they store (including indexes and content) is always presented in a non-plaintext format to prevent data asset leakage; when initiating a query, the queryer must ensure that their query intent (including specific search conditions and query targets) is not known to the data provider to prevent the leakage of private information such as business needs and priorities. Therefore, inter-enterprise data exchange needs to construct a security mechanism that balances efficient query performance with two-way privacy isolation, achieving the goal of "data usable but invisible, query intent unknown."

[0020] To address this, the inventors proposed an optimization strategy: if data queryers can complete their queries locally, the time spent on network data transmission can be directly eliminated, while avoiding potential risks such as network throughput limitations and transmission interruptions, thereby significantly improving the efficiency and convenience of queries. However, this strategy relies on the data provider pre-transmitting and authorizing the queryer to store offline data. Therefore, key issues in offline scenarios need to be addressed: ensuring sufficient security for the offline data stored by the queryer, while maintaining two-way privacy isolation between the data provider and the queryer to prevent data leakage or the inference of query intent.

[0021] Based on the above considerations, the embodiments of this disclosure provide corresponding technical solutions for the two-way subjects of data interaction: for data providers, an offline data privacy protection method is provided to ensure the security of the offline data they pre-deliver and their own privacy rights; for data queryers, a query protection method for offline data adapted to offline scenarios is provided to support efficient local queries while protecting the privacy of their query intent.

[0022] The offline data privacy protection method provided in this disclosure will be described in detail below. The execution subject of this method can be a data provider-side terminal (including but not limited to servers, dedicated terminal devices, etc.), and its specific execution flow is shown in Figure 1, which includes at least steps 101 to 104. It should be noted that the step numbers in this disclosure are only used to distinguish the operation links and do not constitute a limitation on the execution order of each step.

[0023] 101. Retrieve one or more query conditions and the query records corresponding to each query condition.

[0024] In some embodiments, the query records stored by the data provider are not directly collected raw source data, but rather data information with clear data logical relationships and practical application value formed after preprocessing operations such as formatting, cleaning, integration, and analysis.

[0025] For example, for query records of credit information of financial institution customers, these records may include, but are not limited to, multiple attribute fields such as user name, contact information, and risk assessment level. Data providers can leverage their own data permissions and the rich and diverse data resources in massive databases to perform preprocessing, generating query records containing different attribute fields; simultaneously, they can configure corresponding query conditions for different query records, and accurately retrieve the target query record by executing a retrieval operation based on a single query condition.

[0026] Based on the above design, the embodiments of this disclosure may use, but are not limited to, a key-value pair data structure to store query conditions and query records, specifically represented as (Key, Value): where Key corresponds to "query conditions" and Value corresponds to "query records".

[0027] 102. Encrypt the plaintext information of the query record using the first key and a random number to obtain the encrypted query record corresponding to each query condition, so as to construct a first data set, wherein the first data set contains one or more encrypted query records after encryption, and each encrypted query record corresponds one-to-one with a unique query condition.

[0028] In this embodiment, a unique random symmetric encryption key is generated for each query record, and this key is used to encrypt the plaintext information of the query record. After encryption, random data of random length (e.g., within 16 bytes) can be written into the encryption result to increase the difficulty of cracking the encrypted query record, thus ultimately forming an encrypted query record.

[0029] For example, in some instances, the location where random data of a random length (e.g., within 16 bytes) is written into the encrypted result is not limited. It can be flexibly chosen to be at any position in the beginning, end, or middle of the encrypted result, or the random data can be split and written in multiple positions. The purpose is to increase the difficulty of cracking by scrambling the original structure and length characteristics of the encrypted data.

[0030] Specifically, taking "writing random data to the header and tail of the encryption result (split writing)" as an example, the following is an exemplary explanation: Suppose that the plaintext of a query record is encrypted to obtain ciphertext C (length N bytes), and random data R of random length (total length ≤ 16 bytes) is generated. For example, 10 bytes of random data R are generated and split into R1 (4 bytes) and R2 (6 bytes). R1 ​​is written into the header of ciphertext C and R2 is written into the tail of ciphertext C. The final encrypted query record structure is: [R1 (4 bytes) + ciphertext C (N bytes) + R2 (6 bytes)].

[0031] In this example, the random data is split and distributed at both ends of the encrypted result. This avoids the problem of random data being easily stripped away due to writing to a single location, and further obscures the true start and end positions of the ciphertext. This prevents attackers from inferring the ciphertext content through data length or byte distribution characteristics, thereby enhancing the security of encrypted query records.

[0032] Furthermore, in this embodiment, all encrypted query records obtained from encrypting each query record are integrated into a single data set and stored separately (i.e., stored separately from the query conditions). It should be noted that, to clearly distinguish the data sets constructed in steps 102 and 104 of this embodiment, they will be subsequently identified as "first data set" and "second data set," respectively.

[0033] 103. For any encrypted query record, construct the decrypted data of the encrypted query record using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number.

[0034] For any encrypted query record obtained by Institute 102, if the plaintext is encrypted using a "random symmetric key," then decryption must use the same "key" (i.e., the credential; without the key, the ciphertext itself cannot be decrypted). If "random data of random length" is added during encryption, then decryption requires a "data offset parameter" (to locate the true position of the ciphertext within the "random data + ciphertext" structure and remove interference from the random data). If encryption is based on "plaintext information," then decryption requires the "plaintext length" (to verify the integrity of the decryption result and avoid data loss or redundancy after decryption due to incomplete removal of random data or incomplete ciphertext extraction). Thus, the three essential elements required for an "encrypted query record with added random data" are clearly defined: a "random symmetric key," a "data offset parameter," and the plaintext length of the "plaintext information," and these three elements correspond completely to the encryption process.

[0035] 104. Construct a second data set by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query records, and the mapping relationship between the first original data and the second original data.

[0036] In this embodiment of the disclosure, "original text" and "plaintext" are two semantically distinct concepts that need to be clearly distinguished: "Original text" is a concept relative to the "hidden" characteristic, specifically referring to the original data (such as original query conditions, original decrypted data, etc.) that has not undergone "hiding processing," and its attribute is "not concealing the true identity / content," which is not directly related to "whether it is encrypted"; "plaintext" is a concept relative to the "encryption" operation, specifically referring to the original data that has not undergone "encryption processing" or the original data restored after decryption, and its attribute is "not converted by encryption algorithms," which is not directly related to "whether it is hidden."

[0037] This embodiment of the disclosure achieves the hiding of triple information through a second data set, specifically including: the first original data corresponding to the query conditions, the second original data corresponding to the data to be decrypted for the encrypted query record, and the mapping relationship between the first original data and the second original data.

[0038] Essentially, the aforementioned hiding logic serves to conceal and protect the original data information and data structure within the second dataset. If the second dataset, without data structure hiding, is directly sent to the querying party, the data provider's data privacy (such as the original query conditions, key decryption elements, and their relationship) will be directly exposed, potentially leading to data leakage. Therefore, hiding the data structure of the second dataset is a crucial step in ensuring the privacy and security of the data provider.

[0039] Specifically, embodiments of this disclosure may employ, but are not limited to, an Oblivious Key-Value Store (OKVS) data structure to construct a second data set. The OKVS data structure is characterized by its ability to hide the mapping relationship between key-value pairs and the original data. For the process of constructing a second data set based on the OKVS data structure, embodiments of this disclosure may employ, but are not limited to, the following steps (1)-(2): (1) Based on the mapping relationship between “query conditions” and “decryption data required for encrypted query records”, construct a basic data set. Specifically, a key-value pair data structure can be used to store the above two types of information, which can be represented as n (K, V) key-value pairs: where “K” corresponds to “query conditions” and “V” corresponds to “decryption data required for encrypted query records”.

[0040] It should be noted that, in order to simplify the representation of "K", the original data of the "query conditions" can be hashed to obtain the corresponding hash value. That is, at this time, "K" is the "hash value of the original data of the query conditions", and "V" is still the "decryption data required to encrypt the query record".

[0041] (2) Using the n (K, V) key-value pairs obtained in step (1), construct the OKVS data structure, and hide the original data of "K" and "V" and the mapping relationship between them through the structure.

[0042] In real-world privacy protection scenarios, encoding and decoding are the core operations of OKVS data structures to implement privacy protection functions, and the two are inverse operations of each other.

[0043] (21) Encoding: Encode the input n key-value pairs (K, V) = ((k1, v1), (k2, v2), ..., (k...). n v n Encode it as a vector S=(s1, s2, ..., s...). m The vector S can be viewed as an abstract data structure that has undergone special processing and integrates all key-value pair information. The encoding process involves various complex algorithms and mathematical operations to ensure the randomness and security of the data structure S. The purpose is to hide the original K value through this abstract data structure S, preventing attackers from obtaining query results by traversing the K value.

[0044] It should be noted that the complete process of constructing the OKVS data structure includes: preprocessing -> encoding -> post-security hardening, and an exemplary explanation is as follows: The preprocessing includes: ① constructing n (K, V) key-value pairs (K = query condition hash value, V = decrypted data); ② converting K and V into a format supported by the OKVS algorithm.

[0045] Encoding: Encode n (K, V) key-value pairs into an abstract vector S. Use complex algorithms to ensure the randomness and security of S, and hide the original K values ​​and mapping relationships.

[0046] Post-security hardening: Encrypt the vector S (e.g., "encrypt okvs data": random key encryption + random data padding at the beginning and end) to generate the final OKVS data structure (i.e., the second data set).

[0047] (22) Decoding: The decoding process is usually a linear operation, requiring the reconstruction of the key-value pair (K, V) information based on the specific algorithm or rules used during encoding (such as matrix multiplication, polynomial evaluation, etc.). Specifically, decoding does not use a traversal query method: if the input key to be queried is k... i For a correct value (i.e., the ability to blindly hit a value of K among n (K, V)), this K can be obtained through the decoding process of the abstract data structure S.i The corresponding v i (And this vᵢ originates from the corresponding V value in n (K, V); if the input k i If the value is an error (i.e., it is impossible to blindly hit any one of the K values ​​in n (K, V), the decoding process will return a random number (which is not derived from any one of the V values ​​in n (K, V)).

[0048] The embodiments of this disclosure, by leveraging the characteristics of the OKVS data structure, enable the constructed second data set to hide the original information of n key-value pairs, thereby achieving privacy protection for the data provider; simultaneously, based on the encoding and decoding logic of the OKVS data structure, when the data querying party uses a certain key k i When performing a query operation, even if n (K, V) original information are successfully blindly matched and the correct v is obtained, i The data provider also cannot know the specific k used by the querying party. i (i.e., the specific basis for success in blind quizzes cannot be known), thereby achieving privacy protection for the data querying party.

[0049] 105. Send a first data set and a second data set to the data query party. The first data set and the second data set are combined into offline data. The offline data serves as the data source when the data query party receives the query request and executes the query operation.

[0050] In this embodiment, the first data set stores multiple encrypted query records, while the decrypted data from these encrypted query records is stored in the second data set. This separate storage ensures the security of the encrypted query records, preventing them from being decrypted. Furthermore, because the second data set hides the original text data and mapping relationships of the query conditions, encrypted query records, and decrypted data, even if the data queryer obtains the offline data, they will not know the plaintext information of the query records in the first data set, nor the data structure in the second data set. Therefore, this embodiment uses such a first and second data set to send data to the data queryer as queryable offline data, ensuring the privacy and security of the offline data provided by the data provider.

[0051] The above-described embodiment of the present disclosure provides a method for protecting the privacy of offline data. The offline data provided by the data provider comprises two data sets: a first data set containing multiple encrypted query records; and a second data set that hides both the original data information and its own data structure. The hidden content of the second data set includes both the mapping relationship between different query conditions and the decrypted data required to decrypt the encrypted query records, as well as the original data corresponding to each query condition and the original data corresponding to each decrypted data. After the data provider sends the offline data to the data querying party, the data querying party cannot obtain the plaintext information of the encrypted query records, nor can it access the hidden original data information and data structure in the second data set, thereby achieving full-process privacy protection for the offline data.

[0052] In some modified embodiments, in order to further enhance the privacy and security of offline data provided by the data provider, this disclosure provides another method for protecting the privacy of offline data. The execution subject of this method can be the terminal on the data provider side (including but not limited to servers, dedicated terminal devices, etc.). Its specific execution flow is shown in Figure 1, which includes at least steps 201 to 209. It should be noted that the step numbers in this disclosure are only used to distinguish the operation links and do not constitute a limitation on the execution order of each step.

[0053] 201. Retrieve one or more query conditions and the query records corresponding to each query condition.

[0054] 202. Encrypt the plaintext information of the query record using the first key and a random number to obtain the encrypted query record corresponding to each query condition, so as to construct a first data set, wherein the first data set contains one or more encrypted query records after encryption, and each encrypted query record corresponds one-to-one with a unique query condition.

[0055] 203. For any encrypted query record, construct the decrypted data of the encrypted query record using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number.

[0056] 204. Construct a second data set by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query records, and the mapping relationship between the first original data and the second original data.

[0057] In this embodiment of the disclosure, the specific construction and implementation steps of the first data set and the second data set in steps 201-204 can be explained in detail by referring to the relevant content of steps 101-104 above, and will not be repeated here.

[0058] 205. Before sending the first data set and the second data set to the data queryer, encrypt the second data set using the second key.

[0059] 206. Send a first data set and an encrypted second data set to the data query party. The first data set and the second data set are combined into offline data, which serves as the data source when the data query party receives the query request and performs the query operation.

[0060] In this embodiment, the data provider and the data queryer can be two independent terminals protecting their own data privacy. In practical applications, they can be, for example, the data servers of two different companies. To further enhance the security of the transmission and storage of offline data provided by the data provider, this embodiment can encrypt the second data set (OKVS data structure) before sending the offline data to the data queryer. Accordingly, before performing a query operation, the data queryer needs to apply to the data provider for the corresponding decryption key in order to decrypt the encrypted second data set and then carry out the subsequent query process.

[0061] 207. Set authentication information for each round of query operations. The authentication information shall include at least the validity period, the preset maximum number of queries, the preset maximum amount of data to be queried and the second key for each round of query operations. The authentication information may also include the third key for the next round of query operations.

[0062] 208. In response to the query authentication request sent by the data query party to the data provider, the authentication information is sent to the data query party.

[0063] Steps 205 and 207-208 are explained below. For the offline data to be transmitted to the data querying party, this embodiment of the disclosure can configure corresponding authentication information for each round of query operations. This authentication information at least includes an encryption key corresponding to the second data set, used to verify the query request identity of the data querying party through this key, thereby restricting the query permissions for a single round of query operations.

[0064] In some embodiments, the encryption operation for the second data set can also be: encrypting the plaintext with a "random symmetric key" and adding "random data of random length" during encryption. Accordingly, in order for the data queryer to decrypt the encrypted second data set in the offline data, it is necessary to add the "random symmetric key" and the starting position of the second data set (i.e., the "data offset parameter" of the second data set caused by the "random data of random length") to the authentication information.

[0065] Furthermore, to avoid the risk of enumeration queries due to frequent or excessively large queries on offline data (such risks can lead to the leakage of query conditions, query records, and other content in offline data), this embodiment of the disclosure can supplement the above authentication information with relevant data restriction items, including at least the validity period corresponding to a single round of query operations, the preset upper limit of the number of queries, and the preset upper limit of the amount of data to be queried, thereby further restricting the scope of permissions for a single round of query operations.

[0066] Specifically, this disclosure uses a triple constraint of "time + frequency + data volume" to prevent risks such as enumeration queries and brute-force attacks. The following example illustrates this in a specific business scenario (such as offline credit data queries for financial institutions): Example 1: A data provider (a bank) authorizes a data queryer (a credit company) to query a batch of corporate credit data. The authentication information sets a "validity period of 24 hours per query." The data queryer must complete the query within 24 hours of obtaining the key. If the query is not completed within the time limit, the key automatically becomes invalid and cannot be used to decrypt the second data set. If further queries are needed, a new authentication information must be applied for from the bank. This avoids the authentication information being held indefinitely, reducing the risk of malicious use of the key after it is leaked.

[0067] Example 2: The lending company only needs to query the credit data of 10 target companies. The bank sets a limit of 15 queries per round in the authentication information (reserving a small number of redundant queries to handle query errors). If the lending company accumulates 15 queries, subsequent query requests will be rejected, and a new query request must be submitted and new authentication information obtained before continuing. This prevents the querying party from traversing all company information in the offline data through "batch enumeration queries," thus constraining query behavior to match actual needs.

[0068] Example 3: Banks set a limit of 50 records per query or 10KB of data returned per query. When a credit company queries credit data for a specific industry, even if there are 200 matching results, only 50 records can be returned in a single query. To obtain all results, multiple queries are required, and each query is subject to the "query limit," further reducing the risk of bulk data theft. This prevents the querying party from obtaining massive amounts of data in a single request, narrowing the potential scope of data leakage, and aligning with the privacy principle of "on-demand querying."

[0069] In addition, in some instances, in combination with the differentiated needs of actual business scenarios, the embodiments of this disclosure can flexibly configure query constraint strategies. Specifically, any one of the three types of constraints, namely "time", "frequency" and "data volume", can be selected to be used alone, or two or more types of constraints can be combined according to protection requirements. This can accurately achieve fine-grained constraints on the scope of permissions for a single round of query operations and ensure the privacy and security of offline data.

[0070] Furthermore, this embodiment of the disclosure can also add an "encryption key corresponding to the next round of query operations" to the authentication information, which is used to update and encrypt the second data set in the offline data. The specific logic is as follows: After the data querying party passes the authentication verification, it will obtain the authentication information corresponding to the current round of query operations (taking the "first round of query operations" as an example). This authentication information includes the "encryption key corresponding to the next round of query operations (i.e., the second round of query operations)". After the data querying party completes the current round of query operations, it will automatically use the "encryption key for the next round of query operations" in the authentication information to encrypt the second data set. When the data querying party initiates the next round (i.e., the second round) of query operations, it needs to apply for authentication verification from the data provider again to obtain new authentication information. This new authentication information includes at least the "encryption key corresponding to the second round of query operations" and the "encryption key corresponding to the next round (i.e., the third round) of query operations". And so on. After each round of query operations, the second data set in the offline data on the data querying party's side will be updated and encrypted using the "encryption key corresponding to the next round of query operations", thereby more effectively protecting the privacy and security of the offline data on the data querying party's side.

[0071] In steps 101-105 and 201-208 above, this embodiment of the disclosure uses the data provider-side terminal as the execution subject to provide a method for protecting the privacy of offline data. Below, as a data provider in contrast to the data provider, this embodiment of the disclosure provides a method for querying and protecting offline data. The execution subject of this method can be a data query-side terminal (including but not limited to servers, dedicated terminal devices, etc.), and its specific execution flow is shown in Figure 3, including at least steps 301 to 304. It should be noted that the step numbers in this embodiment of the disclosure are only used to distinguish operational steps and do not constitute a limitation on the execution order of each step.

[0072] 301. Obtain offline data provided by the data provider.

[0073] The offline data includes at least a first data set and a second data set. The first data set contains one or more encrypted query records, each of which corresponds to a unique query condition. The second data set contains at least the hidden information of the following data information: the first original data corresponding to each query condition, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data.

[0074] In this embodiment of the disclosure, the construction operations of the first data set and the second data set are both completed on the data provider side. After the construction is completed, the two will be integrated into offline data, which is sent by the data provider to the data query party. For the specific construction process of the offline data, the detailed implementation steps can be referred to the relevant descriptions of steps 101-105 above, which will not be repeated here.

[0075] 302. In response to a query request received by the data querying party, determine whether the target query condition carried in the query request can hit any target first original data in the first original data hidden in the second data set.

[0076] In this embodiment of the disclosure, the second data set in the offline data essentially hides its stored data information (original data) and the data structure (mapping relationship) of that data information. Therefore, the "hit" achieved in step 302 is essentially a "blind hit". The goal of the "blind hit" operation is to only verify "whether the target exists", but not to obtain "the target itself" and "the related information of the verification process". For example, taking the second data set as an "OKVS data structure" as an example, the explanation includes the following: The data querying party only holds the encrypted second data set (which hides the first original data, the second original data, and the mapping relationship), and cannot know which first original data (i.e. the original query conditions) are actually contained in the second data set.

[0077] The data queryer can only input the "target query condition" (after hashing) from its own query request into the second data set, and verify through OKVS's decoding operation whether "the first original data corresponding to the target query condition exists in the second data set".

[0078] The verification result is only "success (hit)" or "failure (miss)": if successful, the corresponding second original data (decrypted data) is returned; if unsuccessful, a random number is returned. Throughout the process, the data queryer cannot traverse or spy on other first original data in the second data set, and the data provider cannot know the specific target query conditions entered by the data queryer. This is the core logic of "blind hit", rather than the ordinary hit of "precise matching after clearly knowing the target".

[0079] Therefore, the use of this "blind" mechanism in the embodiments of this disclosure is the key to achieving two-way privacy protection for both the data provider and the queryer, that is, ensuring that the information of the data provider is not leaked, and also ensuring that the queryer's query intent is not known.

[0080] 303a. If the target query condition carried in the query request does not match any of the target first original data in the first original data hidden in the second data set, then output pseudo-random data with the same format as the second original data.

[0081] After executing step 302, a branch result is obtained. For example, when there is a "miss", random data (also known as "pseudo-random data") with the same format as the valid decrypted data is output, instead of "garbled data". This design is deeply bound to the privacy protection logic of the data structure of the second data set, which can better guarantee two-way privacy security than simple "garbled data".

[0082] Specifically, when a "miss" occurs, the output format is completely identical to the "second original data" (decrypted data) output when a "hit" occurs (e.g., same byte length, same data type), thus disguising it as a "valid result" and blocking the attacker's judgment path.

[0083] 303b. If the target query condition carried in the query request can hit any target first original data in the first original data hidden in the second data set, then based on the hidden information of the data information in the second data set, the target second original data corresponding to the first target original data is output.

[0084] After executing step 302, another branch result is obtained. For example, when "hit", the target second original data corresponding to the first target original data is output. Since the essence of "hit" is "blind hit" (as explained in step 302), it ensures that the information of the data provider is not leaked and that the query intent of the data query party is not known.

[0085] 304b. Using the target query conditions corresponding to the target first original data, search for the target encrypted query record that matches the target query conditions in the first data set.

[0086] Based on the target second original data (i.e., the decrypted data corresponding to the encrypted query record) obtained in step 303b, the data queryer needs to locate and filter the target encrypted query record to be decrypted in the first data set using the target query conditions as an index. Since the encrypted query records and query conditions in the first data set have a one-to-one correspondence, the "location and filtering" here does not need to traverse the entire data set. It can be quickly matched by preset association identifiers, taking into account both efficiency and privacy protection.

[0087] 305b. Using the decrypted data determined by the second original data of the target, perform a decryption operation on the encrypted query record of the target to obtain the query results corresponding to the target query conditions.

[0088] In this embodiment of the disclosure, when constructing the first data set, encryption processing and random number filling operations can be performed on the original query records (this method is optional and not limited to this), and the finally generated encrypted query records have high confidentiality and complexity.

[0089] Correspondingly, the decryption data required to decrypt the encrypted query record contains at least three elements: the encryption key, the original plaintext length corresponding to the encrypted query record, and the data offset parameter corresponding to the random number padding. The decryption operation must be performed in the following fixed order: First, based on the original plaintext length and data offset parameter corresponding to the encrypted query record, accurately locate the starting position of the valid ciphertext data in the encrypted query record and complete the stripping of the random padding data; then, using the aforementioned encryption key, perform the decryption operation on the valid ciphertext data after stripping the random data to restore the original query record.

[0090] The above-described method for protecting offline data in this disclosure involves a second data set that can be considered a "black box data structure." On the data querying side, for any initiated query request, the data querying party attempts to blindly match the data information in this "black box data structure" based on the target query conditions carried in the request. If the blind match is successful (i.e., a correspondence exists in the data structure that matches the target query conditions), regardless of whether the data querying party knows which query condition in the second data set has been matched, it will accurately return the "target decrypted data" required for the encrypted query record based on the hidden mapping relationship within the set. Subsequently, the data querying party will use the obtained "target decrypted data" to locate and determine the target encrypted query record to be decrypted in the first data set, and then perform the decryption operation to finally obtain the query result corresponding to the target query conditions, thus protecting the privacy of the data querying party's query intent during efficient local querying.

[0091] In some modified embodiments, corresponding to the "offline data privacy protection method" (such as steps 201-208) provided by the data provider, this disclosure also provides another method for querying and protecting offline data. The execution subject of this method can be the data querying party's terminal (including but not limited to servers, dedicated terminal equipment, etc.). Its specific execution flow is shown in Figure 4, which includes at least steps 401 to 406. It should be noted that the step numbers in this disclosure are only used to distinguish the operation links and do not constitute a limitation on the execution order of each step.

[0092] 401. Obtain offline data provided by the data provider.

[0093] The offline data includes at least a first data set and a second data set. The first data set contains one or more encrypted query records, each of which corresponds to a unique query condition. The second data set contains at least the hidden information of the following data information: the first original data corresponding to each query condition, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data.

[0094] In this embodiment of the disclosure, the construction operations of the first data set and the second data set are both completed on the data provider side. After the construction is completed, the two will be integrated into offline data, which is sent by the data provider to the data query party. For the specific construction process of the offline data, the detailed implementation steps can be referred to the relevant descriptions of steps 101-105 above, which will not be repeated here.

[0095] 402. Send a query authentication request to the data provider. The query authentication request is used to obtain authentication information from the data provider. The authentication information includes at least: the key required to decrypt the second data set, the validity period corresponding to the authorized query operation, the maximum number of preset queries allowed for the authorized query operation, and the maximum amount of preset data allowed for the authorized query operation.

[0096] Referring to the detailed explanation of setting "authentication information" for the data provider in step 208, the key required to decrypt the second data set is used to verify the query permission of the data queryer. If the verification is successful, the data queryer is authorized to execute the query operation in this round. The validity period corresponding to the authorized query operation, the upper limit of the preset number of queries allowed for the authorized query operation, and the upper limit of the preset amount of data to be queried for the authorized query operation are all included. In order to achieve the three types of constraints of "time", "frequency" and "data volume", and to combine the differentiated needs of actual business scenarios, the embodiments of this disclosure can flexibly configure the query constraint strategy. Specifically, any one of the three types of constraints of "time", "frequency" and "data volume" can be used alone, or two or more types of constraints can be combined according to the protection requirements. This can accurately achieve fine-grained constraints on the scope of permissions for a single round of query operation and ensure the privacy and security of offline data.

[0097] 403. After the data query is authenticated by the data provider, the key contained in the authentication information issued by the data provider is used to perform a decryption operation on the second data set.

[0098] In this embodiment, the data provider has encrypted the second data set in the offline data and incorporated the corresponding encryption key into the authentication information. The data querying party needs to use this encryption key to indirectly verify its identity: if the verification is successful, it can obtain authorization for this round of query operation and simultaneously decrypt the encrypted second data set.

[0099] It should be noted that the decrypted second data set still retains the characteristic of hiding the original data information (including the first original data, the second original data, and their mapping relationship) and data structure, which can effectively protect the privacy and security of the data provider. After completing the above operations, the data querying party can proceed with subsequent processes, such as: responding to the received query request and determining whether the target query conditions carried in the request can blindly hit any of the target first original data hidden in the second data set. (Specifically, the process of responding to the query request received by the data querying party is as shown in steps 302-305b, which will not be explained in detail here).

[0100] 404. In the process of responding to a query request received through the data querying party, if there is at least one query request, the query request shall be subject to a triple constraint of "time + frequency + data volume" to block risks such as enumeration query and brute force.

[0101] Specifically, constraint operations are performed based on the "time" constraint: the data query volume corresponding to at least one query request is accumulated; if the data query volume exceeds the preset upper limit of the query data volume contained in the authentication information, the current query request is rejected.

[0102] Based on the "frequency" constraint, the following constraint operations are performed: the number of queries corresponding to at least one query request is accumulated; if the number of queries exceeds the preset query limit contained in the authentication information, the last query request initiated in at least one query request is rejected.

[0103] Constraint operations are performed based on the "data volume" constraint: if the query time corresponding to the query request exceeds the validity period of the query operation contained in the authentication information, the query request is rejected.

[0104] Based on the triple constraints of "time + frequency + data volume", if any constraint condition is not met, the query request is rejected and the current query operation is stopped to avoid the risk of enumeration query due to multiple frequent queries or excessive query data volume in offline data (such risk will lead to the leakage of query conditions, query records and other content in offline data).

[0105] 405. In the process of responding to a query request received by the data querying party, the authentication information also includes a new key required for the next round of query operations. The new key is used to decrypt the second data set in the next round of query operations. After completing the current round of query operations based on the authentication information, the second data set is re-encrypted using the new key to update the encryption operation of the second data set in the offline data.

[0106] 406. When sending a request for authentication of the next round of queries to the data provider, after the data provider has authenticated the data, the system receives new authentication information from the data provider. The new authentication information includes at least the new key required for the next round of query operations and another new key set for the next round of query operations. The other new key is used to iteratively execute the encryption operation of the second data set in the offline data after the next round of query operations are completed based on the new authentication information.

[0107] Steps 405-406 are explained below. Because the authentication information includes the "encryption key corresponding to the next round of query operations," which is used to update and encrypt the second data set in the offline data, the data queryer's executable logic includes the following: Once the data querying party passes authentication, it will obtain the authentication information corresponding to this round of query operation (taking the "first round of query operation" as an example). This authentication information includes the "encryption key corresponding to the next round of query operation (i.e., the second round of query operation)". After the data querying party completes this round of query operation, it will automatically use the "encryption key for the next round of query operation" from the authentication information to encrypt the second data set. When the data querying party initiates the next round (i.e., the second round) of query operation, it needs to apply for authentication verification from the data provider again to obtain new authentication information. This new authentication information includes at least the "encryption key corresponding to the second round of query operation" and the "encryption key corresponding to the next round (i.e., the third round of query operation)". And so on. After each round of query operation, the second data set in the offline data on the data querying party's side will be updated and encrypted using the "encryption key corresponding to the next round of query operation", thereby more effectively protecting the privacy and security of the offline data on the data querying party's side.

[0108] As a response to the above Figure 1 , Figure 2 The implementation of the method shown in this disclosure provides a privacy protection device for offline data, applied to a data provider. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be understood that the device in this embodiment can implement all the contents of the foregoing method embodiment. This device is used to ensure the security of the pre-delivered offline data and its own privacy rights, specifically as follows... Figure 5 As shown, the device includes: The second acquisition unit 51 is used to acquire one or more query conditions and query records corresponding to each query condition; The first encryption unit 52 is used to perform encryption processing on the plaintext information of the query record using a first key and a random number to obtain the encrypted query record corresponding to each query condition, so as to construct a first data set; The first construction unit 53 is used to construct the decryption data of any encrypted query record using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number. The second construction unit 54 is used to construct a second data set by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. The determining unit 55 is used to send the first data set and the second data set to the data query party. The first data set and the second data set are considered as offline data, which serves as the data source when the data query party receives the query request and performs the query operation.

[0109] Furthermore, such as Figure 6 As shown, the device further includes: The second encryption unit 56 is used to perform an encryption operation on the second data set using a second key before sending the first data set and the second data set to the data query party. Setting unit 57 is used to set the validity period, preset query count limit and preset query data volume limit for each round of query operation; The third construction unit 58 is used to combine the validity period, the preset upper limit of the number of queries, the preset upper limit of the amount of query data, and the second key corresponding to each round of query operation to form the authentication information for each round of query operation; The second sending unit 59 is used to send the authentication information to the data query party in response to the query authentication request sent by the data query party to the data provider.

[0110] Furthermore, the authentication information also includes a third key corresponding to the next round of query operations. The third key is used to update the encryption operation of the second data set in the offline data on the data querying party. The second sending unit 59 is further specifically used for: when the data querying party initiates a query authentication request corresponding to the next round of query operation, after verifying that the data querying party's permissions are passed, sending new authentication information to the data querying party, wherein the new authentication information includes at least the third key required for the next round of query operation and a fourth key set for the next round of query operation, wherein the fourth key is used to iteratively execute and update the encryption operation of the second data set in the offline data.

[0111] As a response to the above Figure 3 , Figure 4 The implementation of the method shown in this disclosure provides a query protection device for offline data, applied to the data query party. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be understood that the device in this embodiment can implement all the contents of the foregoing method embodiment. This device is used to protect the privacy of the query intent while supporting efficient local queries, specifically as follows... Figure 7 As shown, the device includes: The first acquisition unit 61 is used to acquire offline data provided by the data provider. The offline data includes at least a first data set and a second data set. The first data set includes one or more encrypted query records after encryption processing. Each encrypted query record corresponds one-to-one with a unique query condition. The second data set includes at least the hidden information of the following data information: the data information includes the first original data corresponding to each query condition, the second original data of the decrypted data used by the encrypted query record, and the mapping relationship between the first original data and the second original data. Processing unit 62 is used to respond to a query request received by the data querying party and determine whether the target query conditions carried in the query request can hit any one of the target first original data in the first original data hidden in the second data set. Output unit 63 is used to output pseudo-random data in the same format as the second original data if the target query condition carried in the query request does not match any of the target first original data hidden in the second data set. The output unit 63 is further configured to output the target second original data corresponding to the first target original data based on the hidden information of the data information in the second data set if the target query condition carried in the query request hits any target first original data in the first original data hidden in the second data set. The search unit 64 is used to search for a target encrypted query record that matches the target query condition in the first data set by using the target query condition corresponding to the target first original text data; The first decryption unit 65 is used to perform a decryption operation on the target encrypted query record using the decryption data determined by the target second original data, so as to obtain the query result corresponding to the target query condition.

[0112] Furthermore, such as Figure 8 As shown, if the second set of data in the offline data has been encrypted in advance by the data provider, then the device further includes, before responding to a query request received through the data querying party: The first sending unit 66 is used to send a query authentication request to the data provider. The query authentication request is used to obtain authentication information from the data provider. The authentication information includes at least: the key required to decrypt the second data set, the validity period corresponding to the authorized query operation, the maximum number of preset queries allowed corresponding to the authorized query operation, and the maximum amount of preset query data allowed corresponding to the authorized query operation. The second decryption unit 67 is used to perform a decryption operation on the second data set using the key contained in the authentication information issued by the data provider after the data query has been authenticated by the data provider.

[0113] Furthermore, such as Figure 8 As shown, in the process of responding to a query request received through the data querying party, if the query request is at least one, the apparatus further includes: Accumulation unit 68 is used to accumulate the data query volume corresponding to at least one of the query requests; The first execution unit 69 is configured to reject the current query request if the data query volume exceeds the preset upper limit of the query data volume contained in the authentication information.

[0114] Furthermore, such as Figure 8 As shown, in the process of responding to a query request received through the data querying party, if the query request is at least one, the apparatus further includes: The accumulation unit 68 is also used to accumulate the number of queries corresponding to at least one of the query requests; The second execution unit 610 is configured to reject the last query request initiated in the at least one query request if the number of queries exceeds the preset query limit contained in the authentication information. The third execution unit 611 is used to reject the query request if the query time corresponding to the query request exceeds the validity period of the query operation contained in the authentication information.

[0115] Furthermore, the authentication information also includes a new key required for the next round of query operations. This new key is used to decrypt the second data set during the next round of query operations, such as... Figure 8 As shown, the device further includes: The encryption unit 612 is updated to re-encrypt the second data set using the new key after completing the current query operation based on the authentication information, so as to update the encryption operation on the second data set in the offline data. The updated encryption unit 612 is further configured to: when sending a next round of query authentication request to the data provider, after the data provider authenticates the request, receive new authentication information issued by the data provider. The new authentication information includes at least the new key required for the next round of query operation and another new key set for the next round of query operation. The other new key is used to iteratively execute the encryption operation of the second data set in the offline data after the next round of query operation is completed based on the new authentication information.

[0116] In this embodiment of the disclosure, a privacy protection device for offline data includes a processor and a memory. The second acquisition unit, the first encryption unit, the first construction unit, the second construction unit, and the determination construction unit are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0117] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and kernel parameters can be adjusted to ensure the security of pre-delivered offline data and protect the processor's own privacy.

[0118] In this embodiment of the disclosure, an offline data query protection device includes a processor and a memory. The first acquisition unit, processing unit, output unit, search unit, and first decryption unit are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0119] The processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured; by adjusting kernel parameters, efficient local queries can be supported while protecting the privacy of the query intent.

[0120] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the offline data query protection method described above; or, when executed by a processor, the computer program implements the offline data privacy protection method described above.

[0121] This disclosure also provides an electronic device, such as... Figure 9 As shown, the device includes at least one processor 71, at least one memory 72 connected to the processor 71, and a bus 73; wherein the processor 71 and the memory 72 communicate with each other through the bus 73; the processor 71 is used to call program instructions in the memory 72 to execute the above-mentioned method for querying and protecting offline data, or to execute the above-mentioned method for protecting the privacy of offline data.

[0122] This disclosure also provides a computer program product that, when executed on a data processing device, is adapted to execute a program that initializes a method for query protection of offline data, or a program that initializes a method for privacy protection of offline data.

[0123] The user data, data acquisition, and / or use involved in the embodiments of this disclosure strictly comply with the laws, regulations, and industry standards of relevant countries and regions. The collection and acquisition of data involved in the embodiments of this disclosure are all done in advance by actively prompting or prominently displaying information to inform users and obtaining authorization, or by obtaining full authorization from all parties. The processing, manipulation, forwarding, and use of data involved in the embodiments of this disclosure are all carried out on the premise that the user or relevant party is fully informed and authorized. When implementing the embodiments of this disclosure, the types of data or information, scope of use, and usage scenarios that may be involved are informed to users or relevant parties and authorization is obtained through appropriate means. The specific methods of notification and authorization may vary according to actual circumstances, and this disclosure is not limited in this regard. The processing of personal information involved in the embodiments of this disclosure is carried out under the premise of having a legal basis (such as obtaining the consent of the personal information subject or being necessary for the performance of a contract), and is only processed within the prescribed or agreed scope. Sensitive personal information such as biometric information, medical and health information, financial account information, and precise location information involved in the embodiments of this disclosure are all processed under the premise of having a specific purpose and sufficient necessity, and with the separate authorization and consent of the user or relevant party. In some embodiments of this disclosure, if a user or related party refuses to process personal information other than the information necessary for the basic functions, it will not affect the use of the basic functions of the embodiments of this disclosure.

[0124] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] In a typical configuration, the device includes one or more processors (CPUs), memory, and a bus. The device may also include input / output interfaces, network interfaces, etc.

[0126] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM, and memory includes at least one memory chip. Memory is an example of computer-readable media.

[0127] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0129] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] The above are merely embodiments of this disclosure and are not intended to limit the scope of this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of the claims of this disclosure.

Claims

1. A method for protecting offline data during querying, characterized in that, Applied to the data querying party, the method includes: Obtain offline data provided by a data provider. The offline data includes at least a first data set and a second data set. The first data set contains one or more encrypted query records after encryption processing. Each encrypted query record corresponds one-to-one with a unique query condition. The second data set contains at least the hidden information of the following data information: the data information includes the first original data corresponding to each query condition, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. In response to a query request received through the data querying party, if the target query condition carried in the query request hits any target first original data in the first original data hidden in the second data set, then based on the hidden information of the data information in the second data set, the target second original data corresponding to the first target original data is output. Using the target query conditions corresponding to the target first original data, search for target encrypted query records that match the target query conditions in the first data set; Using the decrypted data determined by the target second original data, a decryption operation is performed on the target encrypted query record to obtain the query result corresponding to the target query condition.

2. The method according to claim 1, characterized in that, If the second set of data in the offline data has been encrypted in advance by the data provider, then the method further includes, before responding to a query request received through the data querying party: A query authentication request is sent to the data provider. The query authentication request is used to obtain authentication information from the data provider. The authentication information includes at least: the key required to decrypt the second data set, the validity period corresponding to the authorized query operation, the maximum number of preset queries allowed for the authorized query operation, and the maximum amount of preset data that can be queried corresponding to the authorized query operation. After the data query is authenticated by the data provider, the second data set is decrypted using the key contained in the authentication information issued by the data provider.

3. The method according to claim 2, characterized in that, In responding to a query request received through the data querying party, if the query request is at least one, the method further includes: Accumulate the total data query volume corresponding to at least one of the aforementioned query requests; If the data query volume exceeds the preset query data volume limit contained in the authentication information, the current query request is rejected.

4. The method according to claim 2, characterized in that, In responding to a query request received through the data querying party, if the query request is at least one, the method further includes: Accumulate the total number of queries corresponding to at least one of the aforementioned query requests; If the number of queries exceeds the preset query limit contained in the authentication information, then in at least one query request, the last query request initiated is rejected; and / or, If the query time corresponding to the query request exceeds the validity period of the query operation contained in the authentication information, the query request is rejected.

5. The method according to any one of claims 2 to 4, characterized in that, The authentication information also includes a new key required for the next round of query operations. This new key is used to decrypt the second data set during the next round of query operations. The method further includes: After completing this round of query operations based on the authentication information, the second data set is re-encrypted using the new key to update the encryption operation on the second data set in the offline data; When a request for authentication for the next round of queries is sent to the data provider, after the data provider authenticates the request, the system receives new authentication information from the data provider. The new authentication information includes at least the new key required for the next round of query operations and another new key set for the next round of query operations. The other new key is used to iteratively perform an update of the encryption operation on the second data set in the offline data after the next round of query operations is completed based on the new authentication information.

6. A method for protecting the privacy of offline data, characterized in that, Applied to data providers, the method includes: Retrieve one or more query conditions and the query records corresponding to each query condition; The plaintext information of the query record is encrypted using a first key and a random number to obtain the encrypted query record corresponding to each query condition, thereby constructing a first data set; For any of the encrypted query records, the decrypted data of the encrypted query record is constructed using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number; A second data set is constructed by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. The first data set and the second data set are sent to the data query party. The first data set and the second data set are considered as offline data. The offline data serves as the data source when the data query party receives a query request and performs a query operation.

7. The method according to claim 6, characterized in that, Before sending the first data set and the second data set to the data queryer, the second data set is encrypted using the second key; Set the validity period, preset query limit, and preset query data volume limit for each round of query operations; The validity period, preset query limit, preset query data limit, and the second key corresponding to each round of query operations constitute the authentication information for each round of query operations; In response to a query authentication request sent by the data query party to the data provider, the authentication information is sent to the data query party.

8. The method according to claim 7, characterized in that, The authentication information also includes a third key corresponding to the next round of query operations. The third key is used to update the encryption operation of the second data set in the offline data on the data querying party. When the data querying party initiates a query authentication request corresponding to the next round of query operation, after verifying the data querying party's permissions, new authentication information is sent to the data querying party. The new authentication information includes at least the third key required for the next round of query operation and a fourth key set for the next round of query operation. The fourth key is used to iteratively execute and update the encryption operation of the second data set in the offline data.

9. A device for protecting offline data queries, characterized in that, The device, used in data querying, includes: The first acquisition unit is used to acquire offline data provided by the data provider. The offline data includes at least a first data set and a second data set. The first data set contains one or more encrypted query records after encryption processing. Each encrypted query record corresponds one-to-one with a unique query condition. The second data set contains at least the hidden information of the following data information: the data information includes the first original data corresponding to each query condition, the second original data of the decrypted data used for the encrypted query record, and the mapping relationship between the first original data and the second original data. The processing unit is used to respond to a query request received by the data querying party and determine whether the target query conditions carried in the query request can hit any one of the target first original data in the first original data hidden in the second data set. The output unit is configured to output pseudo-random data in the same format as the second original data if the target query condition carried in the query request does not match any of the target first original data hidden in the second data set. The output unit is further configured to, if the target query condition carried in the query request hits any target first original data in the first original data hidden in the second data set, output the target second original data corresponding to the first target original data based on the hidden information of the data information in the second data set; The search unit is used to search for target encrypted query records that match the target query conditions in the first data set by using the target query conditions corresponding to the target first original data. The first decryption unit is used to perform a decryption operation on the target encrypted query record using the decryption data determined by the target second original data, so as to obtain the query result corresponding to the target query condition.

10. A privacy protection device for offline data, characterized in that, Applied to a data provider, the device includes: The second acquisition unit is used to acquire one or more query conditions and query records corresponding to each query condition; The first encryption unit is used to perform encryption processing on the plaintext information of the query record using a first key and a random number to obtain the encrypted query record corresponding to each query condition, so as to construct a first data set; The first construction unit is used to construct the decrypted data of any encrypted query record using the first key, the plaintext length of the plaintext information contained in the encrypted query record, and the data offset parameter corresponding to the random number. The second construction unit is used to construct a second data set by hiding the first original data corresponding to the query conditions, the second original data of the decrypted data used in the encrypted query record, and the mapping relationship between the first original data and the second original data. The determining unit is used to send the first data set and the second data set to the data querying party. The first data set and the second data set are considered as offline data, which serves as the data source corresponding to the data querying party when it receives a query request and performs a query operation.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the method for querying and protecting offline data as described in any one of claims 1-5. Alternatively, when the computer program is executed by a processor, it implements the privacy protection method for offline data as described in any one of claims 6-8.

12. An electronic device, characterized in that, The device includes at least one processor, and at least one memory and bus connected to the processor; The processor and the memory communicate with each other via the bus. The processor is used to invoke program instructions in the memory to execute the query protection method for offline data as described in any one of claims 1-5, or to execute the privacy protection method for offline data as described in any one of claims 6-8.

Images