Encrypted search method, apparatus, device, storage medium, computer program product

Abstract

The application discloses a data encryption retrieval method and device, equipment, storage medium and computer program product, and aims at solving the problems that when traditional data encryption scheme is used to encrypt and retrieve address data of 100 million levels, ciphertext expansion is easy to occur, storage cost is increased, and retrieval efficiency for encrypted data is low. The method comprises the following steps: generating a password book corresponding to a preset processing period according to obtained to-be-encrypted data in the preset processing period; performing word segmentation processing on the to-be-encrypted data to determine a hierarchical structure corresponding to the to-be-encrypted data; performing encryption processing on the to-be-encrypted data according to the password book and the hierarchical structure to obtain ciphertext data; writing the ciphertext data into a retrieval database to construct a ciphertext index; performing matching retrieval in the retrieval database according to a received retrieval request to obtain a ciphertext retrieval result; and decrypting the ciphertext retrieval result to obtain a plaintext retrieval result.

Description

Technical Field

[0001] This application relates to the field of wireless communication technology, and in particular to a data encryption retrieval method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] With the rapid development of big data and mobile internet technologies, address data, as a crucial component of digital infrastructure, is widely used in business scenarios such as broadband site selection, logistics planning, and smart cities. Particularly in telecom operator operations, the secure storage and efficient retrieval of user address data involving hundreds of millions of users are essential to support real-time queries and intelligent decision-making.

[0003] In existing technologies, encrypted retrieval of massive address data faces several challenges: First, traditional general-purpose encryption algorithms, such as AES-128, tend to produce significant ciphertext expansion when encrypting structured text data like addresses, leading to increased storage costs. Furthermore, limitations in field length within the retrieval system make it difficult to build effective ciphertext indexes, impacting retrieval usability. Second, address data inherently possesses a multi-level, tree-like structure, and existing encrypted retrieval solutions typically lack effective support for hierarchical queries, hindering cross-level semantic retrieval and address tracing. Moreover, while improving security, most existing solutions often reduce system retrieval efficiency, making it difficult to achieve efficient retrieval while ensuring data privacy. This is particularly problematic in real-time processing scenarios handling hundreds of millions of data streams, where significant retrieval latency fails to meet business requirements for response speed and user experience.

[0004] Therefore, designing an address data encryption scheme that can both ensure data storage security and enable high-speed retrieval has become a pressing technical problem in this field. Summary of the Invention

[0005] This application provides a data encryption retrieval method to solve the problems that traditional data encryption schemes can easily lead to ciphertext expansion when retrieving data with hundreds of millions of addresses, resulting in increased storage costs and low retrieval efficiency for encrypted data.

[0006] This application also provides a data encryption retrieval device to solve the problems that when using traditional data encryption schemes to encrypt and retrieve hundreds of millions of address data, ciphertext expansion is easy to occur, leading to increased storage costs and low retrieval efficiency for encrypted data.

[0007] This application also provides a data encryption retrieval device to solve the problems that traditional data encryption schemes can easily lead to ciphertext expansion when retrieving data at hundreds of millions of addresses, resulting in increased storage costs and low retrieval efficiency for encrypted data.

[0008] This application also provides a computer-readable storage medium to address the problems that traditional data encryption schemes can easily lead to ciphertext expansion, resulting in increased storage costs and low retrieval efficiency for encrypted data when performing encrypted retrieval of hundreds of millions of address data.

[0009] A computer program product is provided to address the problem that traditional data encryption schemes can easily lead to ciphertext bloat when performing encrypted retrieval of hundreds of millions of address data, resulting in increased storage costs and low retrieval efficiency for encrypted data.

[0010] The embodiments of this application adopt the following technical solutions: A data encryption retrieval method includes: generating a codebook corresponding to a preset processing period based on data to be encrypted within a preset processing period; performing word segmentation on the data to be encrypted to determine the hierarchical structure corresponding to the data to be encrypted; encrypting the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data; writing the ciphertext data into a retrieval database to construct a ciphertext index; performing a matching search in the retrieval database according to a received retrieval request to obtain ciphertext retrieval results; and decrypting the ciphertext retrieval results to obtain plaintext retrieval results.

[0011] A data encryption retrieval device includes: a codebook generation unit for generating a codebook corresponding to a preset processing period based on data to be encrypted within a preset processing period; a word segmentation unit for segmenting the data to be encrypted to determine the hierarchical structure corresponding to the data to be encrypted; an encryption unit for encrypting the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data; an indexing unit for writing the ciphertext data into a retrieval database to construct a ciphertext index; a retrieval unit for performing a matching retrieval in the retrieval database according to a received retrieval request to obtain ciphertext retrieval results; and a decryption unit for decrypting the ciphertext retrieval results to obtain plaintext retrieval results.

[0012] A data encryption retrieval device, comprising: The processor; and a memory arranged to store computer-executable instructions, which, when executed, cause the processor to perform the following operations: generating a codebook corresponding to a preset processing cycle of data to be encrypted based on the acquired data within a preset processing cycle; performing word segmentation on the data to be encrypted to determine the hierarchical structure corresponding to the data to be encrypted; encrypting the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data; writing the ciphertext data into a retrieval database to construct a ciphertext index; performing a matching retrieval in the retrieval database according to a received retrieval request to obtain ciphertext retrieval results; and decrypting the ciphertext retrieval results to obtain plaintext retrieval results.

[0013] A computer-readable storage medium stores one or more programs that, when executed by an electronic device including multiple applications, cause the electronic device to perform the following operations: generating a codebook corresponding to a preset processing period based on data to be encrypted within a preset processing period; performing word segmentation on the data to be encrypted to determine a hierarchical structure corresponding to the data to be encrypted; encrypting the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data; writing the ciphertext data into a retrieval database to construct a ciphertext index; performing a matching search in the retrieval database according to a received retrieval request to obtain ciphertext search results; and decrypting the ciphertext search results to obtain plaintext search results.

[0014] A computer program product includes a computer program that, when executed by a processor, performs the following: generating a codebook corresponding to a preset processing period based on data to be encrypted within a preset processing period; performing word segmentation on the data to be encrypted to determine the hierarchical structure corresponding to the data to be encrypted; encrypting the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data; writing the ciphertext data into a retrieval database to construct a ciphertext index; performing a matching search in the retrieval database based on a received retrieval request to obtain ciphertext retrieval results; and decrypting the ciphertext retrieval results to obtain plaintext retrieval results.

[0015] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects: The data encryption retrieval method provided in this application provides a codebook for data to be encrypted generated by an enterprise within a preset data processing cycle. Simultaneously, the data to be encrypted is segmented to determine its hierarchical structure. Then, based on the generated codebook and the hierarchical structure, the data is encrypted to obtain ciphertext data, which is then written into a retrieval database to construct a ciphertext index. Subsequently, based on received retrieval requests, a matching search is performed in the retrieval database to obtain ciphertext retrieval results. Finally, by decrypting the ciphertext retrieval results, plaintext retrieval results are obtained. The data encryption retrieval method provided in this application embodiment, on the one hand, introduces a password book dynamically generated based on a preset processing cycle, and uses character-level equal-length mapping encryption technology to encrypt the data according to the password book. This ensures that the length of the encrypted ciphertext data is consistent with the length of the original plaintext data, avoiding ciphertext length expansion caused by encryption. This allows the ciphertext data to be successfully written and an effective ciphertext index to be built without exceeding the field length limit of the underlying retrieval database. Thus, while ensuring data security, it greatly saves storage space and avoids the loss of retrieval function due to index failure. On the other hand, the data encryption retrieval scheme provided in this application embodiment first determines and retains the hierarchical structure between the data to be encrypted through word segmentation before encrypting the data, and retains this hierarchical structure during encryption. Therefore, when performing a retrieval, the parent-child and subordinate relationships between data items can be determined based on this hierarchical structure information, thereby supporting data retrieval needs by level or across levels, greatly improving the retrieval efficiency for encrypted data. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A schematic diagram of the specific structure of a data encryption retrieval system provided in this application embodiment; Figure 2 This is a schematic diagram illustrating the specific process of a data encryption retrieval method provided in an embodiment of this application; Figure 3 A schematic flowchart illustrating a streaming data processing method provided in this application embodiment; Figure 4 This is a schematic diagram illustrating a specific process of a data retrieval method provided in an embodiment of this application; Figure 5 This is a schematic diagram of the specific structure of a testing device provided in an embodiment of this application; Figure 6This is a schematic diagram of the specific structure of a testing device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] This application provides a data encryption retrieval method to address the problems that traditional data encryption schemes can easily lead to ciphertext expansion, resulting in increased storage costs, and low retrieval efficiency for encrypted data when performing encrypted retrieval of hundreds of millions of address data.

[0019] The execution subject of the data encryption retrieval method provided in this application embodiment may be, but is not limited to, at least one of a security server, an encryption server, and a streaming data processing server; in addition, the execution subject of the method may also be the system or application (APP) itself running on these servers.

[0020] For ease of description, the following description uses a data encryption retrieval system as the execution subject of this method as an example to introduce its implementation. It should be understood that using a data encryption retrieval system as the execution subject is merely an illustrative example and should not be construed as a limitation of the method.

[0021] In one embodiment, the specific structure of the data encryption retrieval system provided in this application can be as follows: Figure 1 As shown, it mainly includes: provincial company server, group server, big data platform, password book service module, Flink program, elastic search Elasticsearch module and Hive data warehouse.

[0022] Based on the above Figure 1 The data encryption retrieval system shown in this application is illustrated in the following schematic diagram of the specific implementation process of the data encryption retrieval method provided in this application. Figure 2 As shown, the main steps include the following: Step 11: Generate a password book corresponding to the preset processing period based on the data to be encrypted within the obtained preset processing period; In this embodiment of the application, the preset processing cycle can be set according to business needs. For example, the processing cycle can be set to one week, and the data encryption retrieval system will obtain the address data to be encrypted from various data sources (such as the provincial company servers) at a fixed time every week.

[0023] In this embodiment of the application, the data encryption retrieval system can generate a password book by the following method: obtaining the encoding value of a character in the data to be encrypted; generating a random offset sequence based on the encoding value; and generating a password book for the current preset processing cycle according to the random offset sequence, wherein the password book is used to perform encryption and decryption mapping processing with a fixed offset on the same character.

[0024] Specifically, in the embodiments of this application, the data encryption retrieval system can generate a random offset sequence in the following ways, and then generate a codebook using the random offset sequence, including: Option 1: Generate a random offset based on the encoded value; Specifically, the data encryption retrieval system can extract the character set of the data to be encrypted, such as Chinese characters, numbers, and letters in GB2312 / UTF-8 encoding, and obtain the encoded value of each character. For each character in the character set, a random integer is independently generated as an offset, forming a random offset sequence. This random offset sequence constitutes the codebook for the current period. The codebook defines a one-to-one equal-length mapping relationship from plaintext characters to ciphertext characters, thus ensuring that the character length remains unchanged before and after encryption, fundamentally avoiding ciphertext inflation.

[0025] Specifically, for a plaintext character P, its encoding value is Code(P), and its corresponding random offset is Offset(P) found in the codebook, the encrypted ciphertext character encoding value CipherCode(P) can be determined by the following formula [1]: CipherCode(P) = (Code(P) + Offset(P)) mod M [1] Where M is the size of the encoded character set, and mod is the modulo operation to ensure that the result falls within the valid character encoding range. Decryption is performed by performing the inverse operation.

[0026] Option 2: Generate pseudo-random sequences based on Logistic mapping; To enhance the unpredictability of the codebook, in one implementation, a chaotic system, such as a Logistic map, can be used to generate a pseudo-random sequence as the basis for the offset.

[0027] Specifically, the iterative formula for the Logistic mapping is shown in the following formula [2]: X {n+1} =μ×X n ×(1 - X n [2] Where μ is the control parameter, X n∈ (0, 1), by setting the initial value X0 and the parameter μ, a chaotic sequence is generated and then mapped to the required integer offset range.

[0028] Option 3: Generate random offsets based on vectorized offsets; Specifically, the data encryption retrieval system can extract the character set of data to be encrypted and assign a multi-dimensional offset vector to each character in the character set. During encryption, the plaintext character encoding can be regarded as a basis vector, and specific vector operations are performed with the corresponding offset vector to obtain the ciphertext vector.

[0029] It should be noted that this application does not specifically limit the method used to generate the offset sequence, or the method for generating the current processing cycle codebook based on the offset sequence.

[0030] Additionally, it's important to note that the codebook generated using the above scheme is globally unique within the current processing cycle and securely stored on a trusted server for encryption and decryption operations on all data within the week. At the end of the cycle (e.g., one week), this codebook will be automatically discarded, and the data encryption retrieval system can automatically generate and activate a new codebook for the next cycle, achieving dynamic rotation and enhancing the system's long-term security.

[0031] Step 12: Perform word segmentation on the data to be encrypted to determine the hierarchical structure corresponding to the data to be encrypted; It should be noted that, in one embodiment, the data to be encrypted is usually an address string with a natural hierarchical relationship, such as: "Room 102, Unit 3, Building 11, Fangchengyuan Street, Fengtai District, Beijing".

[0032] In this embodiment of the application, natural language processing (NLP) word segmentation technology or a word segmenter based on predefined rules can be used to segment the address string into independent words, such as: [“Beijing”, “Fengtai District”, “Fangchengyuan Street”, “Building 11”, “Unit 3”, “Room 102”].

[0033] It should be noted that, in this embodiment, the data encryption retrieval system can predefine standard address levels according to business needs, such as: Level 1 province, Level 2 city, Level 3 district, Level 4 street, Level 5 community / administrative village, Level 6 residential area, Level 7 building, Level 8 unit, Level 9 floor, Level 10 room number, etc. In this embodiment, the data encryption retrieval system can match and map the word segmentation results with the predefined levels, assigning a clear level identifier to each word.

[0034] Meanwhile, the data encryption retrieval system can generate an identification field (e.g., parent_id) for each data item, which is used to point to the identifier of its corresponding parent data item, thereby logically constructing a multi-level address tree and clarifying the parent-child association relationship between the various tokens segmented from the data to be encrypted.

[0035] Step 13: According to the ciphertext book obtained by executing Step 11, encrypt the data to be encrypted according to the hierarchical structure determined by executing Step 12 to obtain ciphertext data. In one implementation, the specific implementation of Step 13 may include: according to the hierarchical structure, based on the ciphertext book, perform equal-length mapping encryption on the segmented data to be encrypted to obtain ciphertext data.

[0036] Specifically, the data encryption retrieval system can encrypt each segmented token level by level according to the hierarchical order determined in Step 12. For example, first encrypt "Beijing City", then encrypt "Fengtai District", and so on. This sequential encryption method implicitly retains the hierarchical order information in the ciphertext.

[0037] In one implementation, for each character in each token, the data encryption retrieval system can use the ciphertext book generated in Step 11 and encrypt it according to the encryption method provided in Step 11. Additionally, it should be noted here that since the encryption method adopted in this application is character-level equal-length mapping encryption, the length of the encrypted token is exactly the same as that before encryption. For example, the three characters of "Beijing City" are still three ciphertext characters after encryption. Finally, the entire address string is converted into a ciphertext string with exactly the same length.

[0038] Meanwhile, metadata such as the hierarchical identifier (level) and parent identifier (parent_id) of the data item also need to be encrypted using the same ciphertext book or undergo reversible confusion processing to ensure the security of the association relationship.

[0039] Step 14: Write the ciphertext data into the retrieval database to build a ciphertext index. It should be noted here that to support different business scenarios, in the embodiments of this application, the data encryption retrieval system can adopt a dual-path writing strategy and write the ciphertext data into different index databases respectively. Specifically, the data encryption retrieval system can synchronously write the ciphertext data into the first database and the second database.

[0040] In this embodiment, the first database is used for data retrieval. Typically, the first database is a high-performance search engine, such as an Elasticsearch cluster. Ciphertext data is written into a specific index of Elasticsearch, and its inverted index mechanism is used to build an efficient ciphertext retrieval index. Simultaneously, the first database is equipped with a corresponding ciphertext segmenter, which can segment ciphertext query terms in a manner compatible with the encryption process.

[0041] The second database is primarily used for offline data analysis. In this embodiment, the second database is typically a data warehouse, such as Hive. Encrypted data is written to Hive tables to support offline tasks such as batch data analysis, data quality auditing, and historical data mining.

[0042] In this embodiment of the application, the encryption and writing processes of steps 11 to 14 described above can be integrated into, for example... Figure 3 The data is processed in the streaming computing framework shown. The data source is accessed in the form of a stream. After real-time word segmentation, hierarchical recognition and encryption, it is written to the downstream storage in two paths, realizing high throughput and low latency processing of hundreds of millions of data streams.

[0043] The main processing flow includes the following: Process 1, Provincial Company Data Reporting: Each provincial branch company, in accordance with the group's unified standards and within a preset processing cycle (e.g., from Monday to Saturday each week), uploads its provincial spatial address data file and its corresponding verification file to the group's server.

[0044] Process 2, Group Server Verification: After receiving the file, the group server immediately performs format verification and integrity verification according to predefined data standards (field format, file organization, etc.) to ensure the basic quality of the imported data.

[0045] Process 3, Password Book Generation: During the data reporting period, the password book service module responds to the password book request from the big data platform. It can generate a random offset password book based on the ASCII values ​​of Chinese characters. That is, it uses the ASCII encoding values ​​of Chinese characters as the basis to generate a unique random offset for each possible character, thereby forming a unique dynamic password book for the week, and returns the generated password book to the big data platform.

[0046] Step 4: Big Data Platform and Index Preparation The data to be encrypted, which has been reported and verified, enters the big data platform. The Flink program, which has been configured with a word segmenter, performs word segmentation on the data to be encrypted.

[0047] Step 5, Task Triggering and Data Acquisition: The big data platform periodically triggers batch processing tasks to retrieve data to be encrypted from storage and provide this batch of plaintext data to the Flink program.

[0048] Step 6, Codebook Acquisition: Before processing data, the Flink program requests a codebook from the codebook service module, which returns a generated codebook valid for the current processing cycle.

[0049] Step 7, Dual-path parallel processing and writing: Path 1: Write to the Elasticsearch module: Specifically, the Flink program uses a tokenizer to parse the address string into hierarchical tokens, and uses the obtained dynamic cryptography to perform equal-length mapping encryption on each character after tokenization to obtain ciphertext data. The generated ciphertext data and its encrypted hierarchical relationship information are then written to the Elasticsearch (ES) cluster to build an efficient index that supports ciphertext retrieval.

[0050] Path 2: Write to the Hive data warehouse: It's important to note that, to meet data governance and analysis needs, the same encrypted data can also be directly written to a Hive data warehouse. This allows the Elasticsearch module to act as the primary database for retrieval tasks, while the Hive data warehouse serves as the secondary database for data analysis tasks.

[0051] Step 15: Based on the received search request, perform a matching search in the database to obtain the encrypted search results; It should be noted that, in this embodiment of the application, the data encryption retrieval system can perform retrieval in the following two ways, the specific process of which is as follows: Figure 4 As shown, it includes: Search path 1: Direct search path; Specifically, users can input plaintext addresses in the front-end app. The app sends a query request containing the plaintext address to the retrieval service. The retrieval service requests and retrieves the current password set from the password book service module. The retrieval service segments the user-input plaintext address and encrypts the segmentation results using the password book, generating a ciphertext query request. The retrieval service then sends the ciphertext query request to Elasticsearch. Elasticsearch uses the same custom tokenizer as when creating the index to match the results in the ciphertext index and returns a ciphertext result set. The retrieval service decrypts the ciphertext result set using the password book to obtain the plaintext address result set, which is finally displayed to the user through the app.

[0052] Search Path 2: Intelligent Assisted Search Path This retrieval method is suitable for scenarios where user input is fuzzy, requires intelligent completion, or necessitates optimal recommendation. In this implementation, the user can input a plaintext address in the front-end app and select to invoke the Lingxi assisted address selection service through the app. The Lingxi service forwards the received plaintext address to the retrieval service, triggering the same general retrieval processing flow as in retrieval path 1 above. After word segmentation, obtaining the password book, encryption, ES encrypted retrieval, and decryption, an initial plaintext address result set is obtained, such as the top 100 with the highest matching degree. Then, based on its intelligent matching capabilities, the Lingxi service performs in-depth analysis, sorting, and refinement on this initial result set, ultimately generating an optimized address selection result. Finally, the optimized result is returned to the app and displayed to the user.

[0053] It should also be noted that the data encryption retrieval system provided in this application can also perform cross-level retrieval. For example, one can search for a residential community based on a room number, or search for all buildings based on a residential community. Specifically, in this embodiment, the data encryption retrieval system can achieve cross-level retrieval based on encrypted hierarchical relationship metadata through the following method: determining the query level corresponding to the encrypted query instruction according to the query conditions; retrieving encrypted search results matching the query level in the retrieval database according to the encrypted query instruction; determining the hierarchical relationship between the parent identifier and the query level according to the hierarchical structure; and retrieving the sub-level data and / or parent level data of the query level in the retrieval database according to the hierarchical relationship.

[0054] Specifically, the data encryption retrieval system can analyze retrieval requests to determine their target level, such as the room number level corresponding to "Room 102". Simultaneously, if the retrieval request carries superior information, such as "Room 501 in Fangchengyuan Street", the data encryption retrieval system can determine the corresponding parent identifier, parent_id.

[0055] Cross-level related searches: Downward query: Specifically, when querying a parent level (e.g., Fangchengyuan Street), the data encryption retrieval system can use the id as a condition to retrieve all ciphertext sub-items in the database that match the parent_id after matching the ciphertext at that level, such as all buildings and units belonging to Fangchengyuan Street.

[0056] Upward tracing: Specifically, when querying a sub-level, such as a specific room number, the data encryption retrieval system can use its parent_id to trace back and query the encrypted information of its parent level (such as the unit, building, community, etc. corresponding to the room number) after finding the encrypted item.

[0057] Skip-level retrieval: When data is incomplete, such as when intermediate levels are missing, the data encryption retrieval system can maliciously use multi-level parent_id chained queries to directly locate non-direct ancestor items from child items.

[0058] Step 16: Decrypt the encrypted search results to obtain the plaintext search results.

[0059] In this embodiment, the data encryption retrieval system can use the same codebook as during encryption to decrypt the ciphertext retrieval result obtained by executing step 15. The decryption process is the inverse operation of the encryption process. For a scheme based on random offsets, the decryption formula is as follows [3]: Code(P) = (CipherCode(P) - Offset(P) + M) mod M [3] After decryption, the original hierarchical plaintext address data is recovered and finally returned to the front-end application for display.

[0060] The data encryption retrieval method provided in this application provides a codebook for data to be encrypted generated by an enterprise within a preset data processing cycle. Simultaneously, the data to be encrypted is segmented to determine its hierarchical structure. Then, based on the generated codebook and the hierarchical structure, the data is encrypted to obtain ciphertext data, which is then written into a retrieval database to construct a ciphertext index. Subsequently, based on received retrieval requests, a matching search is performed in the retrieval database to obtain ciphertext retrieval results. Finally, by decrypting the ciphertext retrieval results, plaintext retrieval results are obtained. The data encryption retrieval method provided in this application embodiment, on the one hand, introduces a password book dynamically generated based on a preset processing cycle, and uses character-level equal-length mapping encryption technology to encrypt the data according to the password book. This ensures that the length of the encrypted ciphertext data is consistent with the length of the original plaintext data, avoiding ciphertext length expansion caused by encryption. This allows the ciphertext data to be successfully written and an effective ciphertext index to be built without exceeding the field length limit of the underlying retrieval database. Thus, while ensuring data security, it greatly saves storage space and avoids the loss of retrieval function due to index failure. On the other hand, the data encryption retrieval scheme provided in this application embodiment first determines and retains the hierarchical structure between the data to be encrypted through word segmentation before encrypting the data, and retains this hierarchical structure during encryption. Therefore, when performing a retrieval, the parent-child and subordinate relationships between data items can be determined based on this hierarchical structure information, thereby supporting data retrieval needs by level or across levels, greatly improving the retrieval efficiency for encrypted data.

[0061] In one embodiment, this application also provides a data encryption retrieval device to address the problems of ciphertext expansion leading to increased storage costs and low retrieval efficiency for encrypted data when using traditional data encryption schemes to encrypt and retrieve data at addresses of hundreds of millions. A schematic diagram of the specific structure of this data encryption retrieval device is shown below. Figure 5 As shown, it includes: a codebook generation unit 51, a word segmentation processing unit 52, an encryption unit 53, an indexing unit 54, a retrieval unit 5, and a decryption unit 56.

[0062] The password book generation unit 51 is used to generate a password book corresponding to the preset processing period based on the data to be encrypted within the preset processing period. The word segmentation processing unit 52 is used to perform word segmentation processing on the data to be encrypted and determine the hierarchical structure corresponding to the data to be encrypted. The encryption unit 53 is used to encrypt the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data. Index unit 54 is used to write the encrypted data into a retrieval database to construct an encrypted index; The retrieval unit 55 is used to perform a matching search in the retrieval database according to the received retrieval request and obtain the encrypted retrieval result; The decryption unit 56 is used to decrypt the ciphertext search results to obtain the plaintext search results.

[0063] In one embodiment, the codebook generation unit 51 is specifically used for: obtaining the encoding value of a character in the data to be encrypted; generating a random offset sequence based on the encoding value; and generating a codebook for the current preset processing cycle according to the random offset sequence, wherein the codebook is used to perform encryption and decryption mapping processing with a fixed offset on the same character.

[0064] In one embodiment, the encryption unit 53 is specifically used to: perform equal-length mapping encryption on the segmented data to be encrypted according to the hierarchical structure and based on the codebook, to obtain ciphertext data.

[0065] In one embodiment, the indexing unit 54 is specifically used to: write the encrypted data into a first database and a second database respectively; wherein the first database is used for data retrieval and the second database is used for data analysis.

[0066] In one embodiment, the retrieval unit 55 is specifically configured to: perform word segmentation processing on the retrieval request according to the hierarchical structure, and determine the parent identifier corresponding to the retrieval request in the hierarchical structure; encrypt the query conditions in the retrieval request and the parent identifier according to the codebook, and generate a ciphertext query instruction; and perform a matching search in the retrieval database according to the ciphertext query instruction to obtain a ciphertext search result.

[0067] In one embodiment, the retrieval unit 55 is specifically configured to: determine the query level corresponding to the encrypted query instruction based on the query conditions; retrieve encrypted search results matching the query level in the retrieval database based on the encrypted query instruction; determine the hierarchical relationship between the parent identifier and the query level based on the hierarchical structure; and retrieve the sub-level data and / or parent-level data of the query level in the retrieval database based on the hierarchical relationship.

[0068] The data encryption retrieval device provided in this application embodiment can generate a codebook corresponding to the data to be encrypted generated by an enterprise within a preset data processing cycle. Simultaneously, it performs word segmentation on the data to be encrypted to determine the hierarchical structure corresponding to the data. Then, based on the generated codebook and the hierarchical structure, it encrypts the data to obtain ciphertext data, which is then written into a retrieval database to construct a ciphertext index. Subsequently, based on received retrieval requests, it performs matching searches in the retrieval database to obtain ciphertext retrieval results. Finally, by decrypting the ciphertext retrieval results, it obtains plaintext retrieval results. The data encryption retrieval device provided in this application embodiment, on the one hand, introduces a password book dynamically generated based on a preset processing cycle, and uses character-level equal-length mapping encryption technology to encrypt the data according to the password book. This ensures that the length of the encrypted ciphertext data is consistent with the length of the original plaintext data, avoiding ciphertext length expansion caused by encryption. This allows the ciphertext data to be successfully written and an effective ciphertext index to be built without exceeding the field length limit of the underlying retrieval database. Thus, while ensuring data security, it greatly saves storage space and avoids the loss of retrieval function due to index failure. On the other hand, the data encryption retrieval scheme provided in this application embodiment first determines and retains the hierarchical structure between the data to be encrypted through word segmentation before encrypting the data, and retains this hierarchical structure during encryption. Therefore, when retrieval is performed, the parent-child and subordinate relationships between data items can be determined based on this hierarchical structure information, thereby supporting data retrieval needs by level or across levels, greatly improving the retrieval efficiency for encrypted data.

[0069] Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 6 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0070] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0071] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0072] The processor reads the corresponding computer program from non-volatile memory into main memory and then executes it, forming a data encryption and retrieval device at the logical level. The processor executes the program stored in memory and specifically performs the following operations: Based on the data to be encrypted within a preset processing period, a codebook corresponding to the preset processing period is generated; the data to be encrypted is segmented to determine the hierarchical structure corresponding to the data to be encrypted; according to the codebook and the hierarchical structure, the data to be encrypted is encrypted to obtain ciphertext data; the ciphertext data is written into a retrieval database to construct a ciphertext index; according to the received retrieval request, a matching retrieval is performed in the retrieval database to obtain ciphertext retrieval results; the ciphertext retrieval results are decrypted to obtain plaintext retrieval results.

[0073] The above is as stated in this application. Figure 6The data encryption retrieval electronic device method disclosed in the illustrated embodiments can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0074] Of course, in addition to software implementation, the electronic device of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0075] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by a portable electronic device including multiple applications, enable the portable electronic device to perform... Figure 2 The data encryption retrieval method shown in the embodiment is specifically used to perform the following operations: Based on the data to be encrypted within a preset processing period, a codebook corresponding to the preset processing period is generated; the data to be encrypted is segmented to determine the hierarchical structure corresponding to the data to be encrypted; according to the codebook and the hierarchical structure, the data to be encrypted is encrypted to obtain ciphertext data; the ciphertext data is written into a retrieval database to construct a ciphertext index; according to the received retrieval request, a matching retrieval is performed in the retrieval database to obtain ciphertext retrieval results; the ciphertext retrieval results are decrypted to obtain plaintext retrieval results.

[0076] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.

[0080] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0081] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0082] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0083] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0084] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data encryption retrieval method, characterized in that, include: Based on the data to be encrypted within the preset processing period, a password book corresponding to the preset processing period is generated; The data to be encrypted is segmented into words to determine the hierarchical structure corresponding to the data to be encrypted; According to the codebook and the hierarchical structure, the data to be encrypted is encrypted to obtain ciphertext data; The encrypted data is written into the retrieval database to construct an encrypted index; Based on the received search request, a matching search is performed in the search database to obtain encrypted search results; The encrypted search results are decrypted to obtain the plaintext search results.

2. The method according to claim 1, characterized in that, The step of generating a codebook corresponding to the preset processing period based on the acquired data to be encrypted within the preset processing period specifically includes: Obtain the encoded values ​​of the characters in the data to be encrypted; Generate a random offset sequence based on the encoded value; Based on the random offset sequence, a password book for the current preset processing cycle is generated, wherein the password book is used to perform encryption and decryption mapping processing on the same character with a fixed offset.

3. The method according to claim 1, characterized in that, The step of encrypting the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data specifically includes: According to the hierarchical structure and based on the codebook, the segmented data to be encrypted is encrypted using equal-length mapping to obtain ciphertext data.

4. The method according to claim 1, characterized in that, The step of writing the encrypted data into the retrieval database specifically includes: The encrypted data is written into the first database and the second database respectively; The first database is used for data retrieval, and the second database is used for data analysis.

5. The method according to claim 1, characterized in that, The step of performing a matching search in the search database based on the received search request to obtain encrypted search results specifically includes: Based on the hierarchical structure, the retrieval request is segmented into words to determine the parent identifier corresponding to the retrieval request in the hierarchical structure; The query conditions and the parent identifier in the retrieval request are encrypted according to the codebook to generate a ciphertext query instruction. The encrypted query command is used to perform a matching search in the retrieval database to obtain the encrypted search results.

6. The method according to claim 5, characterized in that, The step of performing a matching search in the retrieval database according to the encrypted query instruction specifically includes: Based on the query conditions, determine the query level corresponding to the encrypted query instruction; According to the encrypted query instruction, retrieve the encrypted search results that match the query level in the retrieval database; Based on the hierarchical structure, determine the hierarchical relationship between the parent identifier and the query level; Based on the hierarchical relationship, the sub-level data and / or parent-level data of the query level are retrieved in the retrieval database.

7. A data encryption retrieval device, characterized in that, include: The codebook generation unit is used to generate a codebook corresponding to the preset processing period based on the data to be encrypted within the preset processing period. The word segmentation processing unit is used to segment the data to be encrypted and determine the hierarchical structure corresponding to the data to be encrypted. An encryption unit is used to encrypt the data to be encrypted according to the codebook and the hierarchical structure to obtain ciphertext data. An indexing unit is used to write the encrypted data into a retrieval database to construct an encrypted index; The retrieval unit is used to perform a matching search in the retrieval database according to the received retrieval request and obtain the encrypted retrieval results; The decryption unit is used to decrypt the ciphertext search results to obtain the plaintext search results.

8. A data encryption retrieval device, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the following operations: Based on the data to be encrypted within the preset processing period, a password book corresponding to the preset processing period is generated; The data to be encrypted is segmented into words to determine the hierarchical structure corresponding to the data to be encrypted; According to the codebook and the hierarchical structure, the data to be encrypted is encrypted to obtain ciphertext data; The encrypted data is written into the retrieval database to construct an encrypted index; Based on the received search request, a matching search is performed in the search database to obtain encrypted search results; The encrypted search results are decrypted to obtain the plaintext search results.

9. A computer-readable storage medium storing one or more programs that, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the data encryption retrieval method as described in any one of claims 1-6.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the data encryption retrieval and generation method as described in any one of claims 1-6.

Images