A method and medium for supporting exact match and range query of ciphertext retrieval

Abstract

The application discloses a kind of support accurate matching and range query cryptogram retrieval method and medium;Through real-time acquisition and according to the processing business data retrieval request, by index construction and parallel processing method are handled, obtain target data record fusion type composite index item;Second index keeps in order cryptogram component as global sorting key, generates B+ tree ordered index data structure and target ordered leaf node chain table;Corresponding mixed query request condition is obtained with the processing business data retrieval request, and is combined B+ tree ordered index data structure and target ordered leaf node chain table, by collaborative traversal retrieval method is handled, obtains current cryptogram retrieval result, and current cryptogram retrieval result is fed back to user;Solve the problem that prior art cannot support size comparison or range retrieval, and low data security, improve the accuracy of cryptogram retrieval and data security, improve the adaptive capacity of cryptogram retrieval.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and medium for encrypted text retrieval that supports exact matching and range queries. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, outsourced data storage has become a mainstream choice for enterprises and institutions to reduce IT operation and maintenance costs and improve data availability. However, storing data (especially sensitive data) in plaintext on untrusted third-party cloud platforms poses a serious risk of data leakage. Encryption is the last line of defense for protecting data confidentiality, but traditional encryption algorithms (such as the Advanced Encryption Standard AES) transform data into an unordered, unstructured ciphertext stream, completely destroying the original searchability of the data. How to achieve efficient, secure, and fully functional data retrieval in ciphertext mode—that is, searchable encryption (SE)—has become a research hotspot in the field of information security in recent years.

[0003] In the process of developing this invention, the inventors discovered the following shortcomings in existing technologies: For conditions that simultaneously include exact matching criteria (such as discrete attributes like ID number and occupation) and range query criteria (such as continuous or ordered numerical attributes like timestamps, age, and amount), existing technologies generally perform exact matching retrieval based on hashing. However, hash transformation is essentially a one-way mapping from a high-entropy space to a low-entropy space, which destroys the order relationship inherent in the plaintext. Therefore, hash-based indexes naturally cannot support any form of size comparison or range retrieval. Based on the above scenario, standard order-preserving encryption suffers from a serious security flaw that has been widely studied: frequency analysis attacks. Because order-preserving encryption is deterministic (i.e., the same plaintext is always encrypted into the same ciphertext), and the ciphertext maintains the order and spacing information of the plaintext, attackers, after obtaining all or part of the ciphertext index, can infer the approximate distribution of the plaintext by statistically analyzing the distribution characteristics of the ciphertext (such as density estimation, spacing analysis, adjacent difference distribution, etc.), and even accurately recover the entire plaintext given partial plaintext and ciphertext pairs. This side-channel leakage greatly limits the application of order-preserving encryption in high-security scenarios, resulting in low data security. Summary of the Invention

[0004] This invention provides a encrypted retrieval method and medium that supports exact matching and range queries, thereby improving the accuracy of encrypted retrieval and data security, and enhancing the adaptive capability of encrypted retrieval.

[0005] According to one aspect of the present invention, a encrypted retrieval method supporting exact matching and range queries is provided, comprising:

[0006] The system acquires and processes data retrieval requests for business data in real time using a pre-defined index building and parallel processing method to obtain composite index items that integrate the target data records.

[0007] The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext;

[0008] The second index-preserving ciphertext component is used as the global sort key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list.

[0009] Obtain the mixed query request conditions corresponding to the business data retrieval request to be processed, and combine the B+ tree ordered index data structure and the target ordered leaf node linked list to process it through a preset collaborative traversal retrieval method to obtain the current encrypted retrieval result, and then feed back the current encrypted retrieval result to the user;

[0010] The mixed query request conditions include current exact match conditions and current range query conditions.

[0011] According to another aspect of the present invention, a encrypted retrieval device supporting exact matching and range queries is provided, comprising:

[0012] The target data record fusion composite index item determination module is used to obtain and process the target data record fusion composite index item in real time according to the business data retrieval request to be processed through the preset index construction and parallel processing method.

[0013] The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext;

[0014] The module for generating B+ tree ordered index data structure and target ordered leaf node linked list is used to generate B+ tree ordered index data structure and target ordered leaf node linked list by using the second index ordered ciphertext component as the global sort key.

[0015] The current encrypted search result determination and feedback module is used to obtain the mixed query request conditions corresponding to the business data retrieval request to be processed, and to process them by combining the B+ tree ordered index data structure and the target ordered leaf node linked list through a preset collaborative traversal retrieval method to obtain the current encrypted search result, and to feed back the current encrypted search result to the user.

[0016] The mixed query request conditions include current exact match conditions and current range query conditions.

[0017] According to another aspect of the present invention, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the encrypted retrieval method supporting exact matching and range query as described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the encrypted retrieval method supporting exact matching and range query as described in any embodiment of the present invention.

[0019] The technical solution of this invention obtains and processes the target data record fusion composite index item by acquiring and processing the business data retrieval request in real time through index construction and parallel processing methods; uses the second index's ordered ciphertext component as the global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list; obtains the mixed query request conditions corresponding to the business data retrieval request, and processes them through a collaborative traversal retrieval method in combination with the B+ tree ordered index data structure and the target ordered leaf node linked list to obtain the current ciphertext retrieval result, and then feeds the current ciphertext retrieval result back to the user; this solves the problems of existing technologies not being able to support size comparison or range retrieval, and having low data security, thereby improving the accuracy and security of ciphertext retrieval and enhancing the adaptive capability of ciphertext retrieval.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a encrypted retrieval method that supports exact matching and range query according to Embodiment 1 of the present invention;

[0023] Figure 2 This is a detailed flowchart of a encrypted retrieval method that supports exact matching and range query according to Embodiment 2 of the present invention;

[0024] Figure 3This is a schematic diagram of the structure of a ciphertext retrieval device that supports exact matching and range query according to Embodiment 3 of the present invention;

[0025] Figure 4 This is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "target," "current," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] It is worth noting that in the technical solution of this application, the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse; if the user chooses to refuse, the process will proceed to the expert decision-making process.

[0029] Example 1

[0030] Figure 1 The flowchart of an embodiment of the present invention provides a method for encrypted text retrieval that supports exact matching and range query. This embodiment is applicable to scenarios where encrypted text retrieval processing is performed under mixed retrieval conditions of exact matching and range query. The method can be executed by an encrypted text retrieval device that supports exact matching and range query, which can be implemented in hardware and / or software.

[0031] Correspondingly, such as Figure 1As shown, the method includes:

[0032] S110. Real-time acquisition and processing of the business data retrieval request based on the data to be processed, through a preset index construction and parallel processing method, to obtain the target data record fusion composite index item.

[0033] The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext.

[0034] The target data record fusion composite index entry can serve as the basic storage unit of the index structure. The target data record fusion composite index entry may include a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext.

[0035] Optionally, the real-time acquisition and processing of the target data record fusion composite index item based on the business data retrieval request to be processed through a preset index construction and parallel processing method includes: using the index construction and parallel processing method, encrypting the business data using a pre-built first pipeline to generate the current encrypted business data; using a pre-built second pipeline to extract the plaintext values ​​of the first field and the second field, as well as the unique identifier of the data record, corresponding to the business data retrieval request to be processed; and obtaining the target data record fusion composite index item based on the plaintext values ​​of the first field and the second field, as well as the unique identifier of the data record.

[0036] Specifically, obtaining the target data record fusion composite index item based on the plaintext value of the first field, the plaintext value of the second field, and the unique identifier of the data record includes: processing the plaintext value of the first field using a preset hash operation method to obtain a first index hash component; processing the plaintext value of the second field using a preset order-preserving ciphertext method to obtain a second index order-preserving ciphertext component; performing symmetric encryption on the unique identifier of the data record to generate data identifier ciphertext; and obtaining the target data record fusion composite index item based on the first index hash component, the second index order-preserving ciphertext component, and the data identifier ciphertext; wherein the first index hash component is used to support exact matching operations for equality queries; and the second index order-preserving ciphertext component is used for sequential comparisons for range queries.

[0037] Specifically, each composite index item can correspond to one data record, and the data structure of a composite index item mainly includes three core fields.

[0038] The second index's order-preserving ciphertext component is a variable-length integer or floating-point number, designed for range queries. It utilizes a dynamic bucketing adaptive order-preserving encryption algorithm to encrypt the plaintext of the searchable field. This field retains the original plaintext's size and order characteristics and can be used as a sorting key in the B+ tree index structure to complete range retrieval operations. The first index's hash component can use a 256-bit fixed-length hash value, calculated using the salted HMAC-SHA256 (Hash-based Message Authentication Code - Secure Hash Algorithm 256 bit) algorithm. This component serves as the core component for exact matching, used to verify exact matches within the query conditions. The unique identifier of a data record is a fixed-length ciphertext of 256 bits, which is obtained by using the symmetric encryption method AES-256-GCM (Advanced Encryption Standard with 256-bit key in Galois / Counter Mode) as the unique identifier of the data record. The corresponding complete data record can be retrieved from the ciphertext storage area after a successful retrieval.

[0039] In this embodiment, the business data to be processed is first encrypted using a first pipeline through an index building and parallel processing method to generate the current encrypted business data. Then, a second pipeline is used to extract the plaintext values ​​of the first field and the second field corresponding to the retrieval request of the business data to be processed, as well as the unique identifier of the data record, to obtain the target data record fusion composite index item.

[0040] Specifically, the first step is to acquire data records and extract fields. A business data retrieval request message (r) can be edited through the application client. This message data contains structured fields: message number (exact match field, type string; can be the plaintext value of the first field), sending timestamp (range query field, type 64-bit unsigned integer, representing the number of milliseconds since the Unix epoch; can be the plaintext value of the second field), and message body (encrypted stored content).

[0041] Furthermore, the first pipeline is used to generate the current encrypted business data and data encryption identifier. The system calls the UUID (Universally Unique Identifier) ​​generator to produce a 128-bit globally unique identifier (uuid). Using the AES-256-GCM algorithm, the uuid is encrypted under the control of the key, generating uuid_enc. Simultaneously, the complete business data is encrypted using the key to obtain the ciphertext. uuid_enc can be stored in a composite index entry for subsequent retrieval of the ciphertext upon a search hit.

[0042] Accordingly, the plaintext value of the first field is processed using a hash operation method to obtain the first index hash component. Specifically, this involves extracting the plaintext value of the message number field; and obtaining the salt value of the currently active session from the system key management service. (This salt value is rotated periodically, such as updating every 24 hours) and the HMAC (Hash-based Message Authentication Code) key. The formula for calculating the first index hash component is: ;in, This represents the byte string concatenation operation; HMAC-SHA256 is a keyed hash transformation function. This represents the plaintext value of the first field. This operation is performed in a trusted execution environment, ensuring that the key and plaintext value are not exposed to the operating system or cloud server.

[0043] Then, the plaintext value of the second field is processed using a preset order-preserving ciphertext method to obtain the second index order-preserving ciphertext component. In detail, it can extract the plaintext value t (in milliseconds) of the sending timestamp; and check the dynamic bucket partitioning currently maintained by the system. (Maintained by an online learning engine). Assume t falls into the bucket. B represents the total number of buckets; b is the independent variable for each bucket; and the plaintext interval for that bucket is... ,in, This represents the left boundary of the plaintext interval; This represents the right boundary of the plaintext interval; the corresponding ciphertext interval is... , This represents the left boundary of the ciphertext interval; The right boundary of the ciphertext interval; bucket width ciphertext capacity A random offset e is sampled from a cryptographically secure random number generator, such that it is within... The upper part is evenly distributed, among which, ; This is an intermediate variable value. It can then be calculated: Where base is an intermediate parameter; this is a rounding operation. To ensure the underlying mapping is an integer value and monotonically increasing. Since e is a random number, even if the timestamp t is the same, numbers generated at different times will be different. They may also be different (as long as the sampling results of e are different).

[0044] S120. Use the second index-preserving ciphertext component as the global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list.

[0045] In this embodiment, the target data record fusion composite index item order is converted into a triple fixed-length byte array; the insertion interface of the B+ tree index engine is called, and the triple fixed-length byte array is inserted into the unified B+ tree with the second index-preserving ciphertext component as the global sort key.

[0046] Furthermore, during the insertion process, the B+ tree may undergo node splitting and merging operations, but its atomicity is guaranteed by the transaction log of the underlying storage engine; this allows the generation of an ordered B+ tree index data structure and a linked list of the target ordered leaf nodes. It enables the maintenance of a single B+ tree using the second index-preserved ciphertext component as the global sort key, replacing the existing technology's maintenance of two trees and reducing storage overhead.

[0047] S130. Obtain the mixed query request conditions corresponding to the business data retrieval request to be processed, and process them by combining the B+ tree ordered index data structure and the target ordered leaf node linked list through a preset collaborative traversal retrieval method to obtain the current encrypted retrieval result, and then feed the current encrypted retrieval result back to the user.

[0048] The mixed query request conditions include current exact match conditions and current range query conditions.

[0049] In this embodiment, based on the current exact matching conditions and current range query conditions corresponding to the retrieval request for the business data to be processed, the B+ tree ordered index data structure and the target ordered leaf node linked list are processed by the collaborative traversal retrieval method to obtain the corresponding ciphertext retrieval results. This can achieve a one-time reduction collaborative traversal retrieval, thereby reducing the complexity of ciphertext retrieval and improving its efficiency.

[0050] Optionally, the step of processing the plaintext value of the second field using a preset order-preserving ciphertext method to obtain the second index order-preserving ciphertext component includes: adjusting the partition boundary of the bucket corresponding to the plaintext value of the second field using a dynamic bucketing order-preserving ciphertext method; wherein each bucket is assigned to a non-overlapping sub-interval in the ciphertext space; for the plaintext value of the second field falling into the target bucket, calculating a basic mapping value based on the plaintext interval and ciphertext interval of the target bucket; sampling a random offset within a preset noise amplitude range, and superimposing the random offset onto the basic mapping value to obtain the ciphertext output; based on the ciphertext output, if the upper limit of the noise amplitude range is less than the order-preserving mapping interval of adjacent plaintexts in the target bucket, generating the second index order-preserving ciphertext component; wherein the second index order-preserving ciphertext component is generated by mapping the same plaintext value of the second field at different encryption times; and recording the encryption version and bucket identification information corresponding to the second index order-preserving ciphertext component in the target data record fusion composite index item to achieve noise restoration processing during decryption.

[0051] Specifically, adjusting the partitioning boundary of the bucket corresponding to the plaintext value of the second field using the dynamic bucketing and order-preserving ciphertext method includes: using the dynamic bucketing and order-preserving ciphertext method to count the data load of the bucket corresponding to the plaintext value of the second field within a predetermined time window; calculating the coefficient of variation of the load distribution based on the data load corresponding to each bucket; if the coefficient of variation exceeds a preset coefficient of variation threshold, performing bucket splitting and merging operations to rebalance the load, thereby completing the partitioning boundary of each bucket; wherein, after the partitioning boundary of the bucket is completed according to the rebalanced buckets, the capacity of the ciphertext interval is redistributed according to the load ratio of each bucket.

[0052] In this embodiment, a dynamic bucketing and order-preserving ciphertext method is used to achieve online adaptive adjustment of dynamic bucket boundaries. The specific triggering condition is: the online learning engine runs as a background daemon thread, and at intervals... Waking up every few minutes to scan the counters in each bucket. (Records the number of items falling into the bucket within this time window) (Number of plaintext); calculate total writes. and average data load Calculate the standard deviation of the load. ;in, These are preset parameters. Furthermore, the coefficient of variation of the load distribution can be calculated based on the data load corresponding to each bucket. If the coefficient of variation If the current bucket partitioning is severely unbalanced, an adjustment needs to be triggered. Here, τ represents the coefficient of variation threshold.

[0053] The specific adjustment execution can be as follows: Hotspot bucket splitting can determine if... Then the bucket These are labeled as hotspot buckets; for each hotspot bucket, the empirical frequency of the data distribution within it can be calculated. (Based on sampled data within the window). Find the optimal split point. This minimizes the load variance of the left and right child buckets; thus, it enables the... Split into and It can also include merging cold buckets, which involves traversing all buckets and obtaining two adjacent buckets. and The sum of the loads Determine if the sum of the loads is less than 1 / 3. If so, then merge the two into a new bucket. Merging operations reduce the number of buckets and lower metadata overhead. It can also involve the redistribution of encrypted ranges, i.e., partitioning based on new buckets. The encrypted space is redistributed according to the load ratio of each barrel. Let the total ciphertext space size be N (e.g., ... Then, through the formula ;in, is the number of new buckets; j is the variable for the new buckets; this determines the capacity of the newly allocated interval and the minimum reserved ciphertext capacity for each bucket, ensuring that even the coldest buckets have enough ciphertext space; the remaining space after rounding down the integer is allocated to the first few buckets in sequence.

[0054] Accordingly, after the bucket boundary redrawing and ciphertext interval redistribution are completed, the online learning engine will use the new parameters The version number is incremented and persisted to the configuration center. Subsequent new data will be encrypted using DBA-OPE (Dynamic Bucket-based Order-Preserving Encryption) with a new bucket partition. For historical data, its... No migration is needed because different versions of the parameters will not affect the correctness of the query. The parameters used in the query are always the current version, while historical data... The value remains constant. However, it's important to note that version switching may cause slight order deviations in the range boundaries when crossing versions. Therefore, a two-sided expansion strategy is used when querying: the query boundary is expanded outwards by a safety margin. To ensure no one is missed during inspection.

[0055] The advantage of this setup is that, through the dynamic bucketing and order-preserving ciphertext method, it is possible to adaptively track changes in data distribution and always maintain a high utilization rate of the ciphertext space and a good balance with the B+ tree.

[0056] The technical solution of this invention obtains and processes the target data record fusion composite index item by acquiring and processing the business data retrieval request in real time through index construction and parallel processing methods; uses the second index's ordered ciphertext component as the global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list; obtains the mixed query request conditions corresponding to the business data retrieval request, and processes them through a collaborative traversal retrieval method in combination with the B+ tree ordered index data structure and the target ordered leaf node linked list to obtain the current ciphertext retrieval result, and then feeds the current ciphertext retrieval result back to the user; this solves the problems of existing technologies not being able to support size comparison or range retrieval, and having low data security, thereby improving the accuracy and security of ciphertext retrieval and enhancing the adaptive capability of ciphertext retrieval.

[0057] Example 2

[0058] Figure 2 This document provides a detailed flowchart of a encrypted retrieval method supporting exact matching and range queries, as described in Embodiment 2 of the present invention. This embodiment refines the above embodiment by acquiring the mixed query request conditions corresponding to the retrieval request for the business data to be processed, and combining a B+ tree ordered index data structure and a target ordered leaf node linked list. A preset collaborative traversal retrieval method is then used to process the data to obtain the current encrypted retrieval result for further refinement.

[0059] S210. Real-time acquisition and processing of the business data retrieval request based on the data to be processed, through a preset index construction and parallel processing method, to obtain the target data record fusion composite index item.

[0060] The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext.

[0061] S220. Use the second index-preserving ciphertext component as the global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list.

[0062] S230, responding to the current exact match condition and the current range query condition corresponding to the mixed query request conditions.

[0063] Among them, the current exact match condition can be a condition for an exact match of the data retrieved. The current range query condition can be a retrieval condition for a range of data retrieved.

[0064] S240. On the target ordered leaf node linked list corresponding to the B+ tree ordered index data structure, a one-way sequential traversal is performed using the cooperative traversal retrieval method to obtain the current ciphertext retrieval result.

[0065] Optionally, the step of performing unidirectional sequential traversal processing through the collaborative traversal retrieval method to obtain the current encrypted retrieval result includes: generating the encrypted boundary of the current query range based on the upper and lower boundaries corresponding to the current range query conditions; locating the starting position in the B+ tree ordered index data structure corresponding to the encrypted boundary of the current query range, performing unidirectional sequential traversal processing from the starting position through the collaborative traversal retrieval method, verifying whether each second index order-preserving encrypted component falls within the encrypted boundary of the current query range, and generating each candidate index item; performing precise hash value matching processing on each candidate index item based on the current exact matching conditions and the first index hash component, and generating the current encrypted retrieval result.

[0066] Among them, the cooperative traversal retrieval method can be a one-time reduction cooperative traversal retrieval method. In a single range traversal of the B+ tree, the range boundary and hash exact match are verified simultaneously without the need for a second scan.

[0067] In a specific embodiment, suppose the request needs to retrieve all message data with message number MSG-2026-001 and a sending time between 00:00:00 on May 1, 2026 and 23:59:59 on May 31, 2026. First, query condition parsing and key acquisition are required. The client inputs the above conditions; the client decomposes the request for retrieving business data into an exact match condition (message number: MSG-2026-001) and a range condition (the time range that the sending time meets). The client performs two-way authentication with the key management service to obtain the currently valid hash key. Salinity and the encryption parameters of DBA-OPE Note that these key materials are transmitted via a secure channel and are retained in the client's memory only until the end of this query.

[0068] Furthermore, the query conditions can be transformed. The current exact match conditions can be transformed using the following formula: Then, a range boundary transformation is performed. Based on the upper and lower boundaries corresponding to the current range query conditions, an initial transformed query range ciphertext boundary is generated, assuming it is... It can be further converted into the following formula: This is used to generate the ciphertext boundary of the target query range; where, Indicates the setting parameters at the current moment; The lower boundary of the ciphertext for the query range; The upper boundary of the ciphertext for the query range is defined. During the query boundary transformation, the random offset e is forced to be 0 to ensure that the query boundary is deterministic, which facilitates precise positioning on the B+ tree.

[0069] Furthermore, a search request can be initiated; the client will , , The user's identity token is encapsulated as a retrieval request and sent to the query gateway on the cloud storage service provider's end. After verifying the token's validity, the query gateway performs a unidirectional sequential traversal from the starting position using a collaborative traversal retrieval method. Starting from the root node corresponding to the unified B+ tree, it recursively searches downwards to locate the first second-index-preserving ciphertext component. leaf nodes .from Begin by reading each composite index item sequentially along the ordered leaf node linked list of the target. For the current item: check... Check if the condition is met; if not, terminate the traversal. Check the first indexed ordered ciphertext component. The system checks if the condition is met; if not, it skips the current item and proceeds to the next. If both checks pass, the uuid_enc is added to the result set list. Furthermore, a query gateway operation can be performed to generate the corresponding current encrypted search results (i.e., the list of matched uuid_enc) and return it to the data user client. The client initiates a batch retrieval request to the encrypted storage domain based on the uuid_enc to obtain the corresponding encrypted message. The client decrypts the encrypted message using AES-256-GCM to recover the plaintext message, which is then presented to the data user.

[0070] The advantages of this setup are: using a collaborative traversal retrieval method for encrypted retrieval can reduce the complexity of encrypted retrieval, reduce the demand for memory storage, improve the efficiency and accuracy of encrypted retrieval, and directly enhance the user experience of encrypted retrieval.

[0071] The technical solution of this invention obtains a composite index item for the target data record fusion by acquiring and processing the retrieval request of the business data to be processed in real time through index construction and parallel processing methods; uses the second index's ordered ciphertext component as the global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list; responds to the current exact matching condition and the current range query condition corresponding to the mixed query request conditions; performs unidirectional sequential traversal processing on the target ordered leaf node linked list corresponding to the B+ tree ordered index data structure through the cooperative traversal retrieval method to obtain the current ciphertext retrieval result; this can reduce the complexity of ciphertext retrieval, reduce the demand for memory storage, improve the efficiency and accuracy of ciphertext retrieval, and directly improve the user experience of ciphertext retrieval; it also improves the accuracy and data security of ciphertext retrieval and enhances the adaptive capability of ciphertext retrieval.

[0072] Example 3

[0073] Figure 3This is a schematic diagram of a encrypted text retrieval device supporting exact matching and range queries, provided in Embodiment 3 of the present invention. The encrypted text retrieval device supporting exact matching and range queries provided in this embodiment can be implemented through software and / or hardware, and can be configured in a terminal device or server to implement an encrypted text retrieval method supporting exact matching and range queries according to an embodiment of the present invention. Figure 3 As shown, the device includes: a target data record fusion composite index item determination module 310, a B+ tree ordered index data structure and target ordered leaf node linked list generation module 320, and a current encrypted retrieval result determination and feedback module 330.

[0074] Among them, the target data record fusion composite index item determination module 310 is used to obtain and process the target data record fusion composite index item in real time according to the business data retrieval request to be processed through a preset index construction and parallel processing method.

[0075] The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext;

[0076] The B+ tree ordered index data structure and target ordered leaf node linked list generation module 320 is used to generate the B+ tree ordered index data structure and the target ordered leaf node linked list by using the second index ordered ciphertext component as the global sorting key.

[0077] The current encrypted search result determination and feedback module 330 is used to obtain the mixed query request conditions corresponding to the business data retrieval request to be processed, and combine the B+ tree ordered index data structure and the target ordered leaf node linked list to process it through a preset collaborative traversal retrieval method to obtain the current encrypted search result, and then feed the current encrypted search result back to the user.

[0078] The mixed query request conditions include current exact match conditions and current range query conditions.

[0079] The technical solution of this invention obtains and processes the target data record fusion composite index item by acquiring and processing the business data retrieval request in real time through index construction and parallel processing methods; uses the second index's ordered ciphertext component as the global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list; obtains the mixed query request conditions corresponding to the business data retrieval request, and processes them through a collaborative traversal retrieval method in combination with the B+ tree ordered index data structure and the target ordered leaf node linked list to obtain the current ciphertext retrieval result, and then feeds the current ciphertext retrieval result back to the user; this solves the problems of existing technologies not being able to support size comparison or range retrieval, and having low data security, thereby improving the accuracy and security of ciphertext retrieval and enhancing the adaptive capability of ciphertext retrieval.

[0080] Based on the above embodiments, the target data record fusion composite index item determination module 310 can be specifically used to: encrypt the business data to be processed using a pre-built first pipeline through the index construction and parallel processing method to generate current encrypted business data; extract the plaintext value of the first field, the plaintext value of the second field, and the unique identifier of the data record corresponding to the retrieval request of the business data to be processed using a pre-built second pipeline; and obtain the target data record fusion composite index item based on the plaintext value of the first field, the plaintext value of the second field, and the unique identifier of the data record.

[0081] Based on the above embodiments, the target data record fusion composite index item determination module 310 can also be specifically used for: processing the plaintext value of the first field using a preset hash operation processing method to obtain a first index hash component; processing the plaintext value of the second field using a preset order-preserving ciphertext method to obtain a second index order-preserving ciphertext component; performing symmetric encryption processing on the unique identifier of the data record to generate data identifier ciphertext; and obtaining the target data record fusion composite index item based on the first index hash component, the second index order-preserving ciphertext component, and the data identifier ciphertext; wherein, the first index hash component is used to support exact matching operations for equality queries; and the second index order-preserving ciphertext component is used for sequential comparison in range queries.

[0082] Based on the above embodiments, the current encrypted retrieval result determination and feedback module 330 can be specifically used to: in response to the current exact matching condition and the current range query condition corresponding to the mixed query request condition, perform unidirectional sequential traversal processing on the target ordered leaf node linked list corresponding to the B+ tree ordered index data structure through the cooperative traversal retrieval method to obtain the current encrypted retrieval result.

[0083] Based on the above embodiments, the current encrypted retrieval result determination and feedback module 330 may further include: a current query range encrypted boundary generation unit, used to generate a current query range encrypted boundary according to the upper and lower boundaries corresponding to the current range query conditions; a candidate index item generation unit, used to locate the starting position corresponding to the current query range encrypted boundary in the B+ tree ordered index data structure, perform unidirectional sequential traversal processing from the starting position using a cooperative traversal retrieval method, verify whether each second index order-preserving encrypted component falls within the current query range encrypted boundary, and generate each candidate index item; and a current encrypted retrieval result generation unit, used to perform precise hash value matching processing on each candidate index item according to the current exact matching conditions and the first index hash component, and generate the current encrypted retrieval result.

[0084] Based on the above embodiments, the target data record fusion composite index item determination module 310 can also be specifically used for: adjusting the division boundary of the bucket corresponding to the plaintext value of the second field through a dynamic bucketing order-preserving ciphertext method; wherein, each bucket is assigned to a non-overlapping sub-interval in the ciphertext space; for the plaintext value of the second field falling into the target bucket, calculating a basic mapping value based on the plaintext interval and ciphertext interval of the target bucket; sampling a random offset within a preset noise amplitude range, and superimposing the random offset onto the basic mapping value to obtain the ciphertext output; according to the ciphertext output, if the upper limit of the noise amplitude range is less than the order-preserving mapping interval of adjacent plaintexts in the target bucket, generating the second index order-preserving ciphertext component; wherein, the second index order-preserving ciphertext component is generated by mapping the same plaintext value of the second field at different encryption times; in the target data record fusion composite index item, recording the encryption version and bucket identification information corresponding to the second index order-preserving ciphertext component to realize noise restoration processing in the decryption process.

[0085] Based on the above embodiments, the method of adjusting the partition boundary of the bucket corresponding to the plaintext value of the second field through dynamic bucketing and order-preserving ciphertext can also be used to: statistically analyze the data load of the bucket corresponding to the plaintext value of the second field within a predetermined time window using the dynamic bucketing and order-preserving ciphertext method; calculate the coefficient of variation of the load distribution based on the data load corresponding to each bucket; if the coefficient of variation exceeds a preset coefficient of variation threshold, perform bucket splitting and merging operations to rebalance the load, so as to complete the partition boundary of each bucket; wherein, after the partition boundary of the bucket is completed according to the rebalanced partition boundary, the capacity of the ciphertext interval is redistributed according to the load ratio of each bucket.

[0086] The encrypted text retrieval device supporting exact matching and range query provided in the embodiments of the present invention can execute the encrypted text retrieval method supporting exact matching and range query provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0087] Example 4

[0088] Figure 4 A schematic diagram of an electronic device 10, which can be used to implement Embodiment 4 of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0089] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0090] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0091] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as encrypted retrieval methods that support exact matching and range queries.

[0092] In some embodiments, the encrypted retrieval method supporting exact match and range query can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the encrypted retrieval method supporting exact match and range query described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the encrypted retrieval method supporting exact match and range query by any other suitable means (e.g., by means of firmware).

[0093] The method includes: acquiring and processing the target data record fusion composite index item in real time according to the business data retrieval request to be processed through a preset index construction and parallel processing method; wherein, the target data record fusion composite index item includes: a first index hash component, a second index ordered ciphertext component, and a data identifier ciphertext; using the second index ordered ciphertext component as a global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list; acquiring the mixed query request conditions corresponding to the business data retrieval request to be processed, and processing them in combination with the B+ tree ordered index data structure and the target ordered leaf node linked list through a preset collaborative traversal retrieval method to obtain the current ciphertext retrieval result, and feeding back the current ciphertext retrieval result to the user; wherein, the mixed query request conditions include the current exact match condition and the current range query condition.

[0094] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0095] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0096] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0097] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0098] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0099] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0100] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0101] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

[0102] Example 5

[0103] Embodiment 5 of the present invention also provides a computer-readable storage medium, wherein the computer-readable instructions, when executed by a computer processor, are used to execute a encrypted retrieval method supporting exact matching and range queries. The method includes: acquiring and processing a retrieval request for business data to be processed in real time using a preset index construction and parallel processing method to obtain a target data record fusion composite index item; wherein the target data record fusion composite index item includes: a first index hash component, a second index ordered encrypted component, and a data identifier encrypted component; using the second index ordered encrypted component as a global sorting key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list; acquiring a mixed query request condition corresponding to the retrieval request for business data to be processed, and combining the B+ tree ordered index data structure and the target ordered leaf node linked list, processing it using a preset collaborative traversal retrieval method to obtain the current encrypted retrieval result, and providing feedback of the current encrypted retrieval result to the user; wherein the mixed query request condition includes a current exact matching condition and a current range query condition.

[0104] Of course, the computer-executable instructions provided in the embodiments of the present invention, which include a computer-readable storage medium, are not limited to the method operations described above, but can also perform related operations in the encrypted retrieval method that supports exact matching and range query provided in any embodiment of the present invention.

[0105] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0106] It is worth noting that in the embodiments of the encrypted retrieval method that supports exact matching and range query described above, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0107] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for encrypted text retrieval that supports exact matching and range queries, characterized in that, include: The system acquires and processes data retrieval requests for business data in real time using a pre-defined index building and parallel processing method to obtain composite index items that integrate the target data records. The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext; The second index-preserving ciphertext component is used as the global sort key to generate a B+ tree ordered index data structure and a target ordered leaf node linked list. Obtain the mixed query request conditions corresponding to the business data retrieval request to be processed, and combine the B+ tree ordered index data structure and the target ordered leaf node linked list to process it through a preset collaborative traversal retrieval method to obtain the current encrypted retrieval result, and then feed back the current encrypted retrieval result to the user; The mixed query request conditions include current exact match conditions and current range query conditions.

2. The method according to claim 1, characterized in that, The process of acquiring and retrieving business data in real time, based on the request, is performed using a preset index construction and parallel processing method to obtain a composite index item for the target data record fusion, including: The index building and parallel processing method is used to encrypt business data using a pre-built first pipeline to generate the current encrypted business data. Using a pre-built second pipeline, extract the plaintext values ​​of the first field, the second field, and the unique identifier of the data record corresponding to the data retrieval request to be processed. Based on the plaintext value of the first field, the plaintext value of the second field, and the unique identifier of the data record, the target data record fusion composite index item is obtained.

3. The method according to claim 2, characterized in that, The step of obtaining the target data record fusion composite index item based on the plaintext value of the first field, the plaintext value of the second field, and the unique identifier of the data record includes: The plaintext value of the first field is processed by a preset hash operation method to obtain the first index hash component; The plaintext value of the second field is processed by a preset order-preserving ciphertext method to obtain the second index order-preserving ciphertext component; The unique identifier of the data record is symmetrically encrypted to generate ciphertext of the data identifier; Based on the first index hash component, the second index order-preserving ciphertext component, and the data identifier ciphertext, the target data record fusion composite index item is obtained; The first index hash component is used to support exact matching operations for equality queries; the second index order-preserving ciphertext component is used for sequential comparisons in range queries.

4. The method according to claim 3, characterized in that, The process involves obtaining the mixed query request conditions corresponding to the business data retrieval request to be processed, and combining them with the B+ tree ordered index data structure and the target ordered leaf node linked list. This is then processed using a preset collaborative traversal retrieval method to obtain the current encrypted retrieval result, including: Responding to the current exact match condition and the current range query condition corresponding to the mixed query request conditions; On the target ordered leaf node linked list corresponding to the B+ tree ordered index data structure, a one-way sequential traversal is performed using the cooperative traversal retrieval method to obtain the current ciphertext retrieval result.

5. The method according to claim 4, characterized in that, The step of performing a one-way sequential traversal process using the cooperative traversal retrieval method to obtain the current ciphertext retrieval result includes: Generate the encrypted boundary of the current query range based on the upper and lower boundaries corresponding to the current range query conditions; Locate the starting position corresponding to the ciphertext boundary of the current query range in the B+ tree ordered index data structure, perform unidirectional sequential traversal processing from the starting position using a collaborative traversal retrieval method, verify whether each second index order-preserving ciphertext component falls within the ciphertext boundary of the current query range, and generate each candidate index item; Based on the current exact matching conditions and the first index hash component, the candidate index items are subjected to exact hash value matching processing to generate the current ciphertext retrieval result.

6. The method according to claim 3, characterized in that, The step of processing the plaintext value of the second field using a preset order-preserving ciphertext method to obtain the second index-preserving ciphertext component includes: The partitioning boundary of the bucket corresponding to the plaintext value of the second field is adjusted by a dynamic bucketing and order-preserving ciphertext method; wherein each bucket is assigned to a non-overlapping sub-interval in the ciphertext space. For the plaintext value of the second field that falls into the target bucket, a basic mapping value is calculated based on the plaintext range and ciphertext range of the target bucket; Random offsets are sampled within a preset noise amplitude range, and the random offsets are superimposed on the base mapping value to obtain the ciphertext output; Based on the ciphertext output, if the upper limit of the noise amplitude range is less than the order-preserving mapping interval of adjacent plaintexts in the target bucket, the second index-preserving ciphertext component is generated. The second index-preserving ciphertext component is generated by mapping the plaintext value of the same second field at different encryption times. In the target data record fusion composite index item, the encryption version and bucket identification information corresponding to the second index-preserving ciphertext component are recorded to realize noise restoration processing in the decryption process.

7. The method according to claim 6, characterized in that, The step of adjusting the partition boundary of the bucket corresponding to the plaintext value of the second field through the dynamic bucketing order-preserving ciphertext method includes: By using a dynamic bucketing and order-preserving ciphertext method, the data load of the bucket corresponding to the plaintext value of the second field within a predetermined time window is statistically analyzed. Calculate the coefficient of variation of the load distribution based on the data load corresponding to each of the aforementioned buckets; If the coefficient of variation exceeds a preset coefficient of variation threshold, bucket splitting and merging operations are performed to rebalance the load, thereby completing the division boundaries of each bucket. After the boundary division of the buckets is completed according to the rebalancing, the capacity of the encrypted interval is redistributed according to the load ratio of each bucket.

8. A encrypted retrieval device supporting exact matching and range queries, characterized in that, include: The target data record fusion composite index item determination module is used to obtain and process the target data record fusion composite index item in real time according to the business data retrieval request to be processed through the preset index construction and parallel processing method. The target data record fusion composite index item includes: a first index hash component, a second index order-preserving ciphertext component, and a data identifier ciphertext; The module for generating B+ tree ordered index data structure and target ordered leaf node linked list is used to generate B+ tree ordered index data structure and target ordered leaf node linked list by using the second index ordered ciphertext component as the global sort key. The current encrypted search result determination and feedback module is used to obtain the mixed query request conditions corresponding to the business data retrieval request to be processed, and to process them by combining the B+ tree ordered index data structure and the target ordered leaf node linked list through a preset collaborative traversal retrieval method to obtain the current encrypted search result, and to feed back the current encrypted search result to the user. The mixed query request conditions include current exact match conditions and current range query conditions.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a ciphertext retrieval method that supports exact matching and range query as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute and implement a encrypted retrieval method supporting exact matching and range query as described in any one of claims 1-7.

Images