A secure query method and system based on ciphertext data

Abstract

The application discloses a secure query method and system based on ciphertext data and belongs to the technical field of data processing, and comprises the following steps: S101, acquiring a service request message sent by a client, performing analysis and processing on the service request message according to a syntax analysis tree, obtaining a service calling link based on the analysis and processing, and obtaining a node execution state sequence corresponding to each service node in the service calling link; S102, extracting at least one target data identifier and an operation instruction type corresponding to the target data identifier according to the service calling link and the node execution state sequence; and S103, acquiring first ciphertext data from a pre-established distributed database based on the target data identifier, and judging whether the operation instruction type is a query instruction. The application improves the retrieval efficiency through the ciphertext index technology under the premise of ensuring the security of data ciphertext storage, simultaneously realizes fine-grained permission control and dynamic desensitization processing, and effectively balances the data security and the query performance.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a secure query method and system based on dense data. Background Technology

[0002] As businesses expand and user needs diversify, enterprise application systems face increasing complexity. Against this backdrop, building information systems that can both ensure data security and flexibly adapt to business changes has become a core issue in enterprise digital transformation.

[0003] Traditional monolithic architectures and tightly coupled design patterns often exhibit slow response times and scalability issues when dealing with high-concurrency access, large-scale data processing, and rapid business iterations, making it difficult to meet the dual requirements of modern enterprises for system agility and reliability.

[0004] Currently, while most solutions on the market can meet basic business needs at the functional level, they suffer from limitations in architectural design. These systems typically tightly bind business logic with data processing, requiring large-scale system overhauls when business processes need adjustment. More importantly, when faced with conflicting needs such as sensitive data protection and efficient data retrieval, existing solutions often have to compromise between security and performance, failing to achieve a harmonious balance between the two.

[0005] From a technical implementation perspective, the system faces the dual challenges of inter-service collaboration and flexible process orchestration when handling complex business scenarios. On the one hand, under a microservice architecture, each business module needs to maintain its independence to support rapid iteration, but this independence also requires the establishment of an efficient collaboration mechanism between modules to avoid performance degradation and a surge in management complexity caused by service decomposition.

[0006] On the other hand, frequent changes in business processes require systems with dynamic orchestration capabilities, enabling adjustments to business logic without modifying the code. However, traditional hard-coded processes struggle to meet these flexibility demands, while fully configurable solutions may sacrifice execution efficiency. Taking customer information queries as an example, the system needs to ensure encrypted storage of sensitive fields while supporting multi-dimensional, rapid retrieval and real-time anonymized display. This requires efficient indexing of encrypted data at the data processing level and dynamic control of anonymization granularity based on different user permissions at the display level. This process involves multiple operations including encrypted computation, permission verification, and data transformation; performance bottlenecks at any stage can cause the overall response time to exceed the user's acceptable range.

[0007] Therefore, how to build a service architecture that supports flexible orchestration of business processes and meets high-performance requirements while ensuring data security throughout its entire lifecycle, so that the system can achieve millisecond-level response and maintain high availability in complex business scenarios, has become a key issue that needs to be addressed in the construction of current enterprise application systems. Summary of the Invention

[0008] In view of the problems existing in the field of existing data processing technology, the present invention is proposed.

[0009] Therefore, one objective of this invention is to provide a secure query method and system based on encrypted data. This method parses business requests using a syntax tree to obtain service call chains and execution state sequences, extracts target data identifiers and operation instruction types, retrieves encrypted data from a distributed database, extracts features from query-type instructions to obtain encrypted feature vectors, compresses dimensions using a data dimensionality reduction algorithm, constructs an encrypted index structure, judges index quality using a hash collision rate metric, and performs rehashing optimization. Based on the optimized index structure, it achieves efficient encrypted matching retrieval, obtaining associated encrypted data and its access control list. This method improves retrieval efficiency while ensuring the security of encrypted data storage, and simultaneously achieves fine-grained access control and dynamic de-identification processing, effectively balancing data security and query performance.

[0010] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0011] On the one hand, the present invention provides a secure query method based on encrypted data, comprising the following steps:

[0012] S101: Obtain the business request message sent by the client, parse the business request message according to the syntax analysis tree, obtain the service call chain based on the parsing process, and the node execution state sequence corresponding to each service node in the service call chain;

[0013] S102: Extract at least one target data identifier and the operation instruction type corresponding to the target data identifier based on the service call chain and node execution state sequence;

[0014] S103: Based on the target data identifier, obtain the first encrypted data from the pre-established distributed database, and determine whether the operation instruction type is a query instruction;

[0015] If the operation instruction type is a query instruction, then feature extraction is performed on the first encrypted data, and the encrypted feature vector is obtained based on the feature extraction.

[0016] S104: For the encrypted feature vector, a data dimensionality reduction algorithm is used to perform dimensionality compression calculation to obtain the encrypted index structure, extract the hash collision rate index corresponding to the encrypted index structure, and preset the collision threshold.

[0017] S105: Determine whether the hash collision rate index is greater than a preset collision threshold. If the hash collision rate index is greater than the collision threshold, then rehash the dense index structure to obtain an updated dense index structure.

[0018] S106: Based on the updated encrypted index structure, perform encrypted matching retrieval in the distributed database to obtain second encrypted data associated with the target data identifier, and access control list corresponding to the second encrypted data;

[0019] S107: Obtain the user permission level parameter corresponding to the second encrypted data from the access control list, and preset the permission threshold for the user permission level parameter;

[0020] If the user permission level parameter is lower than the permission threshold, a classification algorithm is used to classify and identify the second encrypted data to determine the target de-identification rule;

[0021] S108: Replace characters in the second encrypted data according to the target desensitization rule to obtain target display data, and return the target display data in reverse order of the service call chain.

[0022] On the other hand, the present invention provides a system for applying a secure query method based on dense data as described above, comprising:

[0023] The parsing module is used to obtain the business request message sent by the client, parse the business request message according to the syntax analysis tree, obtain the service call chain based on the parsing process, and the node execution state sequence corresponding to each service node in the service call chain.

[0024] The extraction module is used to extract at least one target data identifier and the operation instruction type corresponding to the target data identifier based on the service call chain and node execution state sequence.

[0025] The acquisition and judgment module is used to acquire first encrypted data from a pre-established distributed database based on the target data identifier, and to determine whether the operation instruction type is a query instruction; if the operation instruction type is a query instruction, then feature extraction is performed on the first encrypted data, and encrypted feature vector is obtained based on the feature extraction.

[0026] The compression calculation module is used to perform dimensionality compression calculation on the encrypted feature vector using a data dimensionality reduction algorithm to obtain a dense index structure, extract the hash collision rate index corresponding to the dense index structure, and preset a collision threshold.

[0027] The collision detection module is used to determine whether the hash collision rate index is greater than a preset collision threshold. If the hash collision rate index is greater than the collision threshold, the dense index structure is rehashed to obtain an updated dense index structure.

[0028] The retrieval module is used to perform encrypted matching retrieval in the distributed database based on the updated encrypted index structure to obtain second encrypted data associated with the target data identifier, and an access control list corresponding to the second encrypted data;

[0029] The permission identification module is used to obtain the user permission level parameter corresponding to the second encrypted data from the access control list, and preset the permission threshold for the user permission level parameter; if the user permission level parameter is lower than the permission threshold, a classification algorithm is used to classify and identify the second encrypted data to determine the target de-identification rule;

[0030] The processing return module is used to perform character replacement on the second encrypted data according to the target desensitization rule to obtain the target display data, and return the target display data in the reverse order of the service call chain.

[0031] Beneficial effects:

[0032] This invention parses business requests using a syntax tree to obtain service call chains and execution state sequences, extracts target data identifiers and operation instruction types, retrieves encrypted data from a distributed database, extracts features for query-type instructions to obtain encrypted feature vectors, compresses dimensions using a data dimensionality reduction algorithm, constructs an encrypted index structure, judges index quality using a hash collision rate metric, and performs rehashing optimization. Based on the optimized index structure, it achieves efficient encrypted matching retrieval, obtains associated encrypted data and its access control list, determines whether de-identification processing is required based on user permission level parameters, and performs character replacement on data returned to low-privilege users according to de-identification rules determined by classification and identification. Finally, it returns secure and controllable display data in reverse order of the service call chain.

[0033] This invention improves retrieval efficiency through dense indexing technology while ensuring the security of data storage in a secure manner. It also achieves fine-grained access control and dynamic de-identification processing, effectively balancing data security and query performance. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the process structure of an embodiment of the present invention; Figure 3 This is a schematic diagram of the process structure for step S104 in an embodiment of the present invention; Figure 4 This is a schematic diagram of the modular structure of a secure query system based on encrypted data according to an embodiment of the present invention;

[0035] The diagram is labeled as follows: 110 - Parsing module; 120 - Extraction module; 130 - Acquisition and judgment module; 140 - Compression calculation module; 150 - Collision judgment module; 160 - Retrieval module; 170 - Permission recognition module; 180 - Processing and return module. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0037] The technology required cannot achieve millisecond-level response and maintain high availability in complex business scenarios.

[0038] Based on this, the present invention proposes a secure query method and system based on encrypted data. While ensuring the security of encrypted data storage, it improves retrieval efficiency through encrypted indexing technology, and at the same time realizes fine-grained access control and dynamic de-identification processing, effectively balancing data security and query performance.

[0039] The present solution will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0040] Reference Figures 1 to 4 This is one embodiment of the present invention, which provides a secure query method based on encrypted data, including the following steps:

[0041] S101: Obtain the business request message sent by the client, parse and process the business request message according to the syntax analysis tree, obtain the service call chain based on the parsing and processing, and the node execution state sequence corresponding to each service node in the service call chain;

[0042] S102: Extract at least one target data identifier and the operation instruction type corresponding to the target data identifier based on the service call chain and node execution status sequence;

[0043] S103: Based on the target data identifier, obtain the first dense state data from the pre-established distributed database and determine whether the operation instruction type is a query instruction;

[0044] If the operation instruction type is a query instruction, then feature extraction is performed on the first encrypted data, and the encrypted feature vector is obtained based on the feature extraction.

[0045] S104: For the ciphertext feature vector, a data dimensionality reduction algorithm is used to perform dimensionality compression calculation to obtain the ciphertext index structure, extract the hash collision rate index corresponding to the ciphertext index structure, and preset the collision threshold.

[0046] S105: Determine whether the hash collision rate index is greater than the preset collision threshold. If the hash collision rate index is greater than the collision threshold, then rehash the dense index structure to obtain an updated dense index structure.

[0047] S106: Based on the updated encrypted index structure, perform encrypted matching retrieval in the distributed database to obtain the second encrypted data associated with the target data identifier, and the access control list corresponding to the second encrypted data;

[0048] S107: Obtain the user permission level parameter corresponding to the second encrypted data from the access control list, and preset the permission threshold for the user permission level parameter;

[0049] If the user's permission level parameter is lower than the permission threshold, a classification algorithm is used to classify and identify the second-state data to determine the target de-identification rules.

[0050] S108: Replace characters in the second encrypted data according to the target de-identification rules to obtain the target display data, and return the target display data in reverse order of the service call chain.

[0051] In S102, at least one target data identifier and the corresponding operation instruction type are extracted based on the service call chain and node execution state sequence, including:

[0052] Traverse each service node in the service call chain, and based on each service node, read the status data corresponding to each service node from the node execution status sequence;

[0053] Parse the status data, obtain the business fields processed by the corresponding service nodes, and filter out the target data identifier from the business fields;

[0054] Extract the contextual semantic relationships of the target data identifier in the business request message;

[0055] Based on the contextual semantic relationship, determine the type of operation instruction corresponding to the target data identifier.

[0056] In S103, feature extraction is performed on the first encrypted data, and the ciphertext feature vector is obtained based on the feature extraction, including:

[0057] Obtain the pre-configured feature extraction operation function;

[0058] Determine the number of target dimensions corresponding to the ciphertext feature vector;

[0059] Based on the number of target dimensions, the feature extraction operation function is decomposed, and sub-feature extraction functions (multiple sub-feature extraction functions) are obtained based on the decomposition.

[0060] For the first dense state data, the sub-feature extraction functions are called sequentially to perform feature mapping processing;

[0061] Collect the mapping results output by each sub-feature extraction function;

[0062] The mapping results are concatenated and combined according to the number of target dimensions to obtain the ciphertext feature vector;

[0063] ;

[0064] In the formula, Represents the ciphertext feature vector;

[0065] Represents the first dense state data;

[0066] This represents the feature extraction operation function;

[0067] Indicates the first The dimension of each feature vector.

[0068] This calculation formula transforms dense-state data into encrypted feature vectors that can be used for subsequent processing through feature extraction operations.

[0069] Specifically, in the medical information query service, after the basic data service receives the 18-bit second-state data processed by the format preservation encryption algorithm, the system memory manager will read the access control list, determine that the current requester's permission level is level three, and then match the seventh target de-identification rule.

[0070] The de-identification engine executes a string index replacement algorithm according to this rule, extracts the first six and last four characters of the encrypted data, and replaces the remaining eight characters in the middle with Chinese characters. After this character replacement process, the system generates the target display data in memory for final presentation.

[0071] Subsequently, the basic data service extracts the globally unique tracking identifier from the current thread context, performs a depth-first traversal in the distributed tracing cache tree to locate the parent node of the current node, namely the aggregation service node. The basic data service encapsulates the target display data into a standard response message and sends it to the aggregation service node with the internal network address of 10.net segment 5 via the remote procedure call protocol. After receiving and verifying the integrity of the message, the aggregation service node reads its own call stack record again, identifies its superior caller as the gateway service node, and then forwards the message to the gateway service node with the internal network address of 10.net segment 2 via the transmission control protocol. The gateway service node then writes the target display data into the response buffer and pushes it to the front-end presentation layer.

[0072] In S104, a data dimensionality reduction algorithm is used to compress the dimensionality of the ciphertext feature vector to obtain the dense index structure. The hash collision rate index corresponding to the dense index structure is then extracted, including:

[0073] Obtain the target compression dimension and dimension reduction transformation matrix corresponding to the data dimensionality reduction algorithm;

[0074] A dimension reduction transformation matrix is ​​used to perform a linear transformation on the ciphertext feature vectors;

[0075] During the linear transformation process, the parameters of the dimension reduction transformation matrix are adjusted according to the principle of minimizing the reconstruction error;

[0076] Based on the parameter-adjusted dimensionality reduction transformation matrix and the target compression dimension, a dense state index structure is generated.

[0077] Perform simulated hash mapping operations on the dense index structure (multiple times);

[0078] Count the total number of simulated hash mapping operations performed;

[0079] Record the number of collisions that occur during the execution of simulated hash mapping operations;

[0080] Calculate the ratio between the number of collisions that occurred and the total number of collisions;

[0081] The hash collision rate index corresponding to the dense index structure is determined based on the ratio.

[0082] ;

[0083] In the formula, Represents a dense index structure;

[0084] This represents a data dimensionality reduction algorithm;

[0085] Indicates the target compression dimension;

[0086] Represents the dimension reduction transformation matrix;

[0087] This represents the hash collision rate metric.

[0088] Indicates the number of collisions that occurred;

[0089] This represents the total number of simulated hash mapping operations.

[0090] This calculation formula achieves dimensionality compression by minimizing the reconstruction error and calculates the collision rate.

[0091] In S105, the dense index structure is rehashed to obtain an updated dense index structure, including:

[0092] Obtain a set of alternative hash functions;

[0093] Select a target hash function that is different from the current hash function from the set of backup hash functions;

[0094] Extract the original hash key value from the dense index structure;

[0095] The original hash key value is recalculated using the target hash function to obtain a new hash key value;

[0096] The data storage locations in the dense index structure are reallocated based on the new hash key values;

[0097] An updated dense index structure is generated based on the reallocated data storage location.

[0098] In S106, based on the updated encrypted index structure, encrypted matching retrieval is performed in the distributed database to obtain second encrypted data associated with the target data identifier, and an access control list corresponding to the second encrypted data, including:

[0099] Parse the updated dense index structure to obtain the target retrieval path;

[0100] The search is performed along the target retrieval path, traversing and comparing data across the various storage nodes of the distributed database.

[0101] Locate the target storage node that matches the target data identifier;

[0102] Read the second encrypted data from the target storage node;

[0103] Extract metadata information from the second dense state data;

[0104] Parse the access control list corresponding to the second encrypted data from the metadata information.

[0105] In S107, a classification algorithm is used to classify and identify the second dense-state data, and the target desensitization rules are determined, including:

[0106] Extracting business attribute features from the second dense state data;

[0107] A classification algorithm is used to categorize business attribute features to obtain data sensitivity levels;

[0108] Based on the data sensitivity level, the corresponding desensitization processing function is matched from the preset rule base;

[0109] Parse the de-identification processing function to obtain the corresponding character replacement processing operation;

[0110] Based on the character replacement processing operation and the desensitization processing function, determine the target desensitization rules;

[0111] ;

[0112] In the formula, Indicates the target data display;

[0113] This represents the function for desensitization processing;

[0114] Represents the second dense state data;

[0115] Indicate the target desensitization rules;

[0116] This represents the user permission level parameter;

[0117] This indicates the preset permission threshold;

[0118] This indicates a character replacement operation.

[0119] The calculation formula determines whether to anonymize the data based on user permissions.

[0120] In S108, the second encrypted data is replaced with characters according to the target de-identification rules to obtain the target display data. The target display data is returned in reverse order of the service call chain, including:

[0121] Obtain the target desensitization rules and the second dense state data;

[0122] Regular expressions are used to parse the target de-identification rules to obtain the target replacement position and the target mask character;

[0123] Extract the plaintext fragment to be processed from the second dense state data based on the target replacement position, and preset a length threshold for the plaintext fragment to be processed;

[0124] Determine whether the length of the plaintext fragment to be processed is greater than the length threshold;

[0125] If the length of the plaintext fragment to be processed is greater than the length threshold, the target mask character is used to perform a character replacement operation on the plaintext fragment to be processed to obtain the target display data;

[0126] Obtain the service call chain bound to the target display data;

[0127] Extract the global trace code and forward node identifier (multiple forward node identifiers) from the service call chain.

[0128] The reverse node sequence is obtained by reversing the order of the forward node identifiers based on the global tracking code.

[0129] Construct a reverse backhaul path based on the reverse node sequence;

[0130] The target display data is transmitted layer by layer along the reverse transmission path to obtain the final response message;

[0131] A secure hash algorithm is used to calculate the digest of the final response message to obtain the message integrity check code.

[0132] Return the final response message carrying the message integrity check code in reverse order of the service call chain.

[0133] Based on the above, this application parses business requests using a syntax tree to obtain service call chains and execution state sequences, extracts target data identifiers and operation instruction types, retrieves encrypted data from a distributed database, extracts features for query-type instructions to obtain encrypted feature vectors, compresses dimensions using a data dimensionality reduction algorithm, and constructs an encrypted index structure. This approach improves retrieval efficiency while ensuring the security of encrypted data storage, and simultaneously achieves fine-grained access control and dynamic desensitization, effectively balancing data security and query performance.

[0134] This embodiment, in conjunction with the above-described secure query method based on dense data, also proposes a working system applied to this method, as follows:

[0135] The parsing module 110 is used to obtain the business request message sent by the client, parse and process the business request message according to the syntax analysis tree, and obtain the service call chain and the node execution state sequence corresponding to each service node in the service call chain based on the parsing and processing.

[0136] The extraction module 120 is used to extract at least one target data identifier and the operation instruction type corresponding to the target data identifier based on the service call chain and node execution state sequence.

[0137] The judgment module 130 is used to obtain the first encrypted data from a pre-established distributed database based on the target data identifier, and to determine whether the operation instruction type is a query instruction; if the operation instruction type is a query instruction, then the first encrypted data is subjected to feature extraction, and the encrypted feature vector is obtained based on the feature extraction.

[0138] The compression calculation module 140 is used to perform dimensionality compression calculation on the ciphertext feature vector using a data dimensionality reduction algorithm to obtain the ciphertext index structure, extract the hash collision rate index corresponding to the ciphertext index structure, and preset the collision threshold.

[0139] The collision detection module 150 is used to determine whether the hash collision rate index is greater than the preset collision threshold. If the hash collision rate index is greater than the collision threshold, the dense index structure is rehashed to obtain an updated dense index structure.

[0140] The retrieval module 160 is used to perform encrypted matching retrieval in the distributed database based on the updated encrypted index structure to obtain the second encrypted data associated with the target data identifier, and the access control list corresponding to the second encrypted data.

[0141] The permission identification module 170 is used to obtain the user permission level parameter corresponding to the second encrypted data from the access control list, and preset the permission threshold for the user permission level parameter; if the user permission level parameter is lower than the permission threshold, the second encrypted data is classified and identified using a classification algorithm to determine the target de-identification rule;

[0142] The processing return module 180 is used to replace characters in the second encrypted data according to the target de-identification rules to obtain the target display data, and return the target display data in the reverse order of the service call chain.

[0143] In summary, this invention parses business requests using a syntax tree to obtain service call chains and execution state sequences, extracts target data identifiers and operation instruction types, retrieves encrypted data from a distributed database, extracts features for query-type instructions to obtain encrypted feature vectors, compresses dimensions using a data dimensionality reduction algorithm, constructs an encrypted index structure, judges index quality using a hash collision rate metric, and performs rehashing optimization. Based on the optimized index structure, it achieves efficient encrypted matching retrieval, obtains associated encrypted data and its access control list, and improves retrieval efficiency through encrypted indexing technology while ensuring the security of encrypted data storage. It also achieves fine-grained access control and dynamic de-identification processing, effectively balancing data security and query performance.

[0144] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A secure query method based on dense data, characterized in that, Includes the following steps: S101: Obtain the business request message sent by the client, parse the business request message according to the syntax analysis tree, obtain the service call chain based on the parsing process, and the node execution state sequence corresponding to each service node in the service call chain; S102: Extract at least one target data identifier and the operation instruction type corresponding to the target data identifier based on the service call chain and node execution state sequence; S103: Based on the target data identifier, obtain the first encrypted data from the pre-established distributed database, and determine whether the operation instruction type is a query instruction; If the operation instruction type is a query instruction, then feature extraction is performed on the first encrypted data, and the encrypted feature vector is obtained based on the feature extraction. S104: For the encrypted feature vector, a data dimensionality reduction algorithm is used to perform dimensionality compression calculation to obtain the encrypted index structure, extract the hash collision rate index corresponding to the encrypted index structure, and preset the collision threshold. S105: Determine whether the hash collision rate index is greater than a preset collision threshold. If the hash collision rate index is greater than the collision threshold, then rehash the dense index structure to obtain an updated dense index structure. S106: Based on the updated encrypted index structure, perform encrypted matching retrieval in the distributed database to obtain second encrypted data associated with the target data identifier, and access control list corresponding to the second encrypted data; S107: Obtain the user permission level parameter corresponding to the second encrypted data from the access control list, and preset the permission threshold for the user permission level parameter; If the user permission level parameter is lower than the permission threshold, a classification algorithm is used to classify and identify the second encrypted data to determine the target de-identification rule; S108: Replace characters in the second encrypted data according to the target desensitization rule to obtain target display data, and return the target display data in reverse order of the service call chain.

2. The secure query method based on dense data as described in claim 1, characterized in that, In step S102, at least one target data identifier and the operation instruction type corresponding to the target data identifier are extracted based on the service call chain and node execution state sequence, including: Traverse each service node in the service call chain, and based on each service node, read the status data corresponding to each service node from the node execution status sequence; Parse the status data to obtain the corresponding service node's processing business fields, and filter out the target data identifier from the business fields; Extract the target data identifier from the contextual semantic relationship in the service request message; Based on the contextual semantic relationship, determine the operation instruction type corresponding to the target data identifier.

3. The secure query method based on dense data as described in claim 1, characterized in that, In step S103, feature extraction is performed on the first encrypted data, and a ciphertext feature vector is obtained based on the feature extraction, including: Obtain the pre-configured feature extraction operation function; Determine the number of target dimensions corresponding to the ciphertext feature vector; Based on the number of target dimensions, the feature extraction operation function is decomposed to obtain sub-feature extraction functions. For the first dense state data, each of the sub-feature extraction functions is called sequentially to perform feature mapping processing; Collect the mapping results output by each of the sub-feature extraction functions; The mapping results are concatenated and combined according to the target dimension number to obtain the ciphertext feature vector; ； In the formula, Represents the ciphertext feature vector; Represents the first dense state data; This represents the feature extraction operation function; Indicates the first The dimension of each feature vector.

4. The secure query method based on dense data as described in claim 1, characterized in that, In step S104, for the ciphertext feature vector, a data dimensionality reduction algorithm is used to perform dimensionality compression calculation to obtain a dense index structure. The hash collision rate index corresponding to the dense index structure is then extracted, including: Obtain the target compression dimension and dimension reduction transformation matrix corresponding to the data dimension reduction algorithm; The ciphertext feature vector is linearly transformed using the dimensionality reduction transformation matrix. During the linear transformation process, the parameters of the dimension reduction transformation matrix are adjusted according to the principle of minimizing reconstruction error; The dense-state index structure is generated based on the parameter-adjusted dimensionality reduction transformation matrix and the target compression dimension. Perform a simulated hash mapping operation on the dense index structure; Count the total number of simulated hash mapping operations performed; Record the number of collisions that occur during the execution of simulated hash mapping operations; Calculate the ratio between the number of collisions that occurred and the total number of collisions; The hash collision rate index corresponding to the dense index structure is determined based on the ratio. ； In the formula, Represents a dense index structure; This represents a data dimensionality reduction algorithm; Indicates the target compression dimension; Represents the dimension reduction transformation matrix; This represents the hash collision rate metric. Indicates the number of collisions that occurred; This represents the total number of simulated hash mapping operations.

5. The secure query method based on dense data as described in claim 1, characterized in that, In step S105, the dense index structure is rehashed to obtain an updated dense index structure, including: Obtain a set of alternative hash functions; Select a target hash function that is different from the current hash function from the set of backup hash functions; Extract the original hash key value from the dense index structure; The original hash key value is recalculated using the target hash function to obtain a new hash key value; The data storage locations in the dense index structure are reallocated according to the new hash key value; An updated dense index structure is generated based on the reallocated data storage location.

6. The secure query method based on dense data as described in claim 1, characterized in that, In step S106, based on the updated encrypted index structure, encrypted matching retrieval is performed in the distributed database to obtain second encrypted data associated with the target data identifier, and an access control list corresponding to the second encrypted data, including: Parse the updated dense index structure to obtain the target retrieval path; The search is performed along the target retrieval path, traversing and comparing data at each storage node of the distributed database. Locate the target storage node that matches the target data identifier; Read the second encrypted data from the target storage node; Extract the metadata information of the second dense state data; The access control list corresponding to the second encrypted data is parsed from the metadata information.

7. The secure query method based on dense data as described in claim 1, characterized in that, In step S107, a classification algorithm is used to classify and identify the second dense-state data to determine the target desensitization rules, including: Extract the business attribute features of the second dense state data; The classification algorithm is used to categorize the business attribute features to obtain the data sensitivity level; Based on the data sensitivity level, the corresponding desensitization processing function is matched from the preset rule base; Parse the desensitization processing function to obtain the corresponding character replacement processing operation; The target desensitization rule is determined based on the character replacement processing operation and the desensitization processing function; ； In the formula, Indicates the target data display; This represents the function for desensitization processing; Represents the second dense state data; Indicate the target desensitization rules; This represents the user permission level parameter; This indicates the preset permission threshold; This indicates a character replacement operation.

8. The system of a secure query method based on encrypted data as described in claim 1, characterized in that, In step S108, the second encrypted data is replaced with characters according to the target de-identification rule to obtain the target display data. The target display data is then returned in reverse order of the service call chain, including: Obtain the target desensitization rule and the second dense state data; The target de-identification rules are parsed using regular expressions to obtain the target replacement position and target mask characters; Extract the plaintext fragment to be processed from the second dense state data according to the target replacement position, and preset a length threshold for the plaintext fragment to be processed; Determine whether the length of the plaintext fragment to be processed is greater than the length threshold; If the length of the plaintext segment to be processed is greater than the length threshold, then the target mask character is used to perform a character replacement operation on the plaintext segment to be processed to obtain the target display data; Obtain the service call chain bound to the target display data; Extract the global tracking code and the positive node identifier from the service call chain; The forward node identifiers are reversed according to the global tracking code to obtain the reverse node sequence; Construct a reverse backhaul path based on the reverse node sequence; The target display data is transmitted layer by layer along the reverse backhaul path to obtain the final response message; A secure hash algorithm is used to calculate the digest of the final response message to obtain the message integrity check code. Following the reverse order of the service call chain, a final response message carrying the message integrity check code is returned.

9. A system applied to the secure query method based on dense data as described in claim 1, characterized in that, include: The parsing module is used to obtain the business request message sent by the client, parse the business request message according to the syntax analysis tree, obtain the service call chain based on the parsing process, and the node execution state sequence corresponding to each service node in the service call chain. The extraction module is used to extract at least one target data identifier and the operation instruction type corresponding to the target data identifier based on the service call chain and node execution state sequence. The acquisition and judgment module is used to acquire first encrypted data from a pre-established distributed database based on the target data identifier, and to determine whether the operation instruction type is a query instruction; if the operation instruction type is a query instruction, then feature extraction is performed on the first encrypted data, and encrypted feature vector is obtained based on the feature extraction. The compression calculation module is used to perform dimensionality compression calculation on the encrypted feature vector using a data dimensionality reduction algorithm to obtain a dense index structure, extract the hash collision rate index corresponding to the dense index structure, and preset a collision threshold. The collision detection module is used to determine whether the hash collision rate index is greater than a preset collision threshold. If the hash collision rate index is greater than the collision threshold, the dense index structure is rehashed to obtain an updated dense index structure. The retrieval module is used to perform encrypted matching retrieval in the distributed database based on the updated encrypted index structure to obtain second encrypted data associated with the target data identifier, and an access control list corresponding to the second encrypted data; The permission identification module is used to obtain the user permission level parameter corresponding to the second encrypted data from the access control list, and preset the permission threshold for the user permission level parameter; if the user permission level parameter is lower than the permission threshold, a classification algorithm is used to classify and identify the second encrypted data to determine the target de-identification rule; The processing return module is used to perform character replacement on the second encrypted data according to the target desensitization rule to obtain the target display data, and return the target display data in the reverse order of the service call chain.

Images