Database operation method supporting fuzzy search, and user side

Abstract

The present application discloses a database operation method supporting fuzzy search, and a user side. The method comprises: intercepting an INSERT statement of a user side for a database; calling a database password machine and using a data encryption key to encrypt plaintext data in the INSERT statement to obtain first ciphertext data; calling a database password machine and using a single byte encryption key corresponding to each column of plaintext data to carry out single byte encryption processing on each column of plaintext data in the INSERT statement according to bytes to obtain auxiliary data; and replacing the plaintext data in the INSERT statement with the spliced first ciphertext data and auxiliary data, and sending the spliced first ciphertext data and auxiliary data to a database server, so that the database server stores the first ciphertext data and the auxiliary data into the same list item. According to the present application, a user can conveniently carry out fuzzy search on data of encryption columns, the risk of plaintext leakage is not increased, and the storage capacity is only doubled.

Description

Database operation method and user terminal supporting fuzzy query

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on August 7, 2023, with application number 202310982875.5 and application name “Database operation method and user terminal supporting fuzzy query”, all contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of cryptographic application technology, and in particular to a database operation method and a user terminal supporting fuzzy query. Background Art

[0004] With database data encrypted, querying its contents presents certain challenges, particularly with fuzzy searches. This is because every piece of data in the database is encrypted in its entirety. While precise searches can be performed by encrypting the desired content using the same algorithm and key, and then performing a comparison and match, fuzzy searches only perform a partial search on the search keyword. Even with the same algorithm and key, the encrypted result for this portion of the search keyword will not match the result of the entire encrypted data containing the keyword. Decrypting each piece of data in the database column individually before performing a comparison and match is extremely inefficient and insecure.

[0005] In related technologies, data content is segmented, meaning commonly used keywords are separated and combined from the data content. These keywords are then encrypted and formed into sets. Fuzzy queries are then performed using encrypted query keywords and first compared against the keyword ciphertext set for a match. For example, based on the principle of word segmentation, plaintext is segmented into many small fields and encrypted to form a search set for fuzzy queries. However, if this method is to cover all word segmentation combinations, the resulting set would far exceed the capacity of the encrypted data content itself, resulting in considerable storage and computational complexity.

[0006] Summary of the Invention

[0007] The technical problem to be solved by this application is how to provide a database operation method that supports fuzzy query, realizes fuzzy search of encrypted content in the database, and has low storage capacity.

[0008] This application solves the above technical problems through the following technical means:

[0009] On the one hand, the present application proposes a database operation method supporting fuzzy query, which is applied to the user end and includes:

[0010] Intercept the user's insert statement to the database;

[0011] Calling the database cryptographic machine to encrypt the plaintext data in the insert statement using the data encryption key to obtain first ciphertext data;

[0012] Call the database cipher to encrypt each column of plaintext data in the insert statement using the corresponding single-byte encryption key to obtain auxiliary data.

[0013] The plaintext data in the insert statement is replaced with the concatenated first ciphertext data and auxiliary data and sent to the database server so that the database server stores the first ciphertext data and the auxiliary data in the same list item.

[0014] Furthermore, before intercepting the insert statement of the user terminal to the database, the method further includes:

[0015] Obtain the user's data definition statement for the database;

[0016] Based on the content of the data definition statement, send key request information to the database cryptographic machine;

[0017] Receive the key IDs and random numbers corresponding to each newly created column fed back by the database cryptographic machine. Each key ID includes the ID of the data encryption key, the ID of the single-byte obfuscation key, and the ID of the single-byte encryption key. The single-byte encryption key includes the single-byte obfuscation key and the single-byte encryption key.

[0018] Furthermore, before intercepting the insert statement of the user terminal to the database, the method further includes:

[0019] Generate a public-private key pair for the client and import the client's first public key into the database cryptographic machine;

[0020] Receive the second public key generated by the database cipher machine and establish a TLS secure channel.

[0021] Furthermore, calling the database cryptographic machine to use the data encryption key to encrypt the plaintext data in the insert statement to obtain the first ciphertext data includes:

[0022] Based on the ID of the data encryption key corresponding to each column of plaintext data in the newly added data row in the insert statement, the database cryptographic machine is called to use the data encryption key corresponding to the data encryption key ID to perform symmetric block encryption on the plaintext data in the insert statement to obtain ciphertext data.

[0023] Furthermore, the database cryptographic machine is called to perform single-byte encryption processing on each column of plaintext data in the insert statement using the single-byte encryption key corresponding to each column to obtain auxiliary data, including:

[0024] Based on the ID of the single-byte encryption key corresponding to each column of data under the newly added data row in the insert statement, the database cryptographic machine is called to use the corresponding single-byte encryption key to perform single-byte encryption processing;

[0025] The receiving database cipher returns a byte each time it performs single-byte encryption processing, and sequentially combines the returned bytes into auxiliary data of the same length as the ciphertext data of the column.

[0026] Furthermore, the single-byte encryption key includes a single-byte obfuscation key, a single-byte encryption key, and a random number;

[0027] Based on the ID of the single-byte encryption key corresponding to each column of data in the newly added data row in the insert statement, the database cryptographic machine is called to use the corresponding single-byte encryption key to perform single-byte encryption processing, including:

[0028] Based on the ID of the single-byte obfuscation key, the ID of the single-byte encryption key, and the random number corresponding to each column of data under the newly added data row in the insert statement, the database cryptographic machine is called to use the corresponding random number to perform block length modulo on the column of data, and the corresponding byte of the single-byte obfuscation key is selected according to the modulo result to perform an XOR operation on the byte and the single byte to be encrypted, and then the single-byte encryption key is used to perform symmetric block encryption on the single-byte obfuscation key to obtain the encrypted result;

[0029] Correspondingly, the bytes returned by the received database cipher machine are the bytes corresponding to the modulo result selected from the encryption result.

[0030] Furthermore, the method further comprises:

[0031] Intercept the user's read operation statement on the database;

[0032] Call the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keywords in the read operation statement using the single-byte encryption key corresponding to the relevant column;

[0033] The receiving database cryptographic machine encrypts each byte of the fuzzy search keyword and returns a byte, and sequentially combines the returned bytes to replace the plaintext keyword in the read operation statement to obtain a new read operation statement;

[0034] Sending a new read operation statement to the database server so that the database server executes the new read operation statement and queries the corresponding data row;

[0035] Receive the data row returned by the database server, and based on the data encryption key ID corresponding to each column of the data row, call the database cipher machine to use the corresponding data encryption key to perform symmetric group decryption on the data of each column of the data row to obtain the plaintext data corresponding to the fuzzy search keyword;

[0036] Receive the plaintext data returned by the database cipher machine.

[0037] Furthermore, the method further comprises:

[0038] Intercept the user's write operation statement to the database;

[0039] Call the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the write operation statement using the single-byte encryption key corresponding to the relevant column to obtain the ciphertext keyword;

[0040] According to the data encryption key ID corresponding to the column related to the write operation statement, the database cipher machine is called to perform symmetric block encryption processing on the plaintext data in the write operation statement to obtain second ciphertext data;

[0041] According to the ID of the single-byte encryption key corresponding to the column related to the write operation statement, the database cipher machine is called to perform single-byte encryption processing on the plaintext data of the column in the write operation statement;

[0042] receiving a byte returned by the database cipher machine each time it performs single-byte encryption processing, and sequentially combining the returned bytes into query auxiliary data of the same length as the second ciphertext data;

[0043] The query auxiliary data and the second ciphertext data are concatenated to replace the plaintext data in the write operation statement to obtain a new write operation statement;

[0044] The new write operation statement is sent to the database server, so that the database server stores the query auxiliary data and the second ciphertext data into the row of the database where the ciphertext keyword hits.

[0045] Furthermore, the method further comprises:

[0046] Intercept the user's statements on the database that contain fuzzy search operations;

[0047] Call the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the statement using the single-byte encryption key corresponding to the relevant column to obtain the ciphertext keyword;

[0048] The ciphertext keyword replaces the plaintext keyword in the statement containing the fuzzy search operation to obtain a new statement containing the fuzzy search operation;

[0049] The new statement containing the fuzzy search operation is sent to the database server, so that the database server deletes the row data of the database that is matched with the ciphertext keyword.

[0050] In addition, the present application also proposes a user terminal, in which a service grid is deployed, and the service grid is used to execute the above-mentioned database operation method supporting fuzzy query.

[0051] The advantages of this application are:

[0052] This application establishes auxiliary data for the database column that needs to be encrypted, and only adds one auxiliary search byte for each plaintext byte, so that users can perform fuzzy searches on the data in the encrypted column. The search auxiliary data is encrypted and transformed for each byte, which makes the search more efficient and flexible. Moreover, the established query auxiliary data is based on the same strength of the cryptographic algorithm and key length, and will not increase the risk of plaintext leakage, and the storage capacity is only doubled.

[0053] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] FIG1 is a flow chart of a database operation method supporting fuzzy query proposed in an embodiment of the present application;

[0055] FIG2 is a schematic diagram of the structure of a database operating system supporting fuzzy query proposed in an embodiment of the present application;

[0056] FIG3 is a schematic diagram of the workflow of a database operating system supporting fuzzy query proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0057] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0058] As shown in FIG1 , an embodiment of the present application discloses a database operation method supporting fuzzy query, which is applied to a user terminal and includes the following steps:

[0059] S10, intercepting the user's insert statement to the database;

[0060] S20, calling the database cryptographic machine to use the data encryption key to encrypt the plaintext data in the insert statement to obtain first ciphertext data;

[0061] S30, calling the database cryptographic machine to perform single-byte encryption processing on each column of plaintext data in the insert statement using the single-byte encryption key corresponding to each column to obtain auxiliary data;

[0062] S40: Replace the plaintext data in the insert statement with the concatenated first ciphertext data and auxiliary data and send the result to the database server so that the database server stores the first ciphertext data and auxiliary data in the same list item.

[0063] This embodiment calls the database cryptographic machine to use the data encryption key to encrypt the plaintext data to obtain first ciphertext data, uses the single-byte encryption key corresponding to each column of plaintext data to perform single-byte encryption processing to obtain auxiliary data, and stores the first ciphertext data and the auxiliary data together in the same list item in the database; by establishing auxiliary data for the database column that needs to be encrypted, it is convenient for users to perform fuzzy searches on the data in the encrypted column, and the established query auxiliary data is based on the same strength cryptographic algorithm and key length, does not increase the risk of plaintext leakage, and the storage capacity is only doubled.

[0064] In one embodiment, before step S10: intercepting the insert statement of the user terminal to the database, the method further includes the following steps:

[0065] Obtain the user's data definition statement for the database;

[0066] Based on the content of the data definition statement, send key request information to the database cryptographic machine;

[0067] Receive the key IDs and random numbers corresponding to each newly created column fed back by the database cryptographic machine. Each key ID includes the ID of the data encryption key, the ID of the single-byte obfuscation key, and the ID of the single-byte encryption key. The single-byte encryption key includes the single-byte obfuscation key and the single-byte encryption key.

[0068] This embodiment deploys a service grid on the user side to obtain the content of the user's DDL statements (database definition statements) for the database, and applies to the database cryptographic machine for three symmetric encryption keys for each newly created column: a data encryption key, a single-byte obfuscation key (the same length as the symmetric encryption algorithm block length), a single-byte encryption key, and a random number. The key IDs and random numbers returned by the database cryptographic machine are then saved to the user side.

[0069] The data encryption key is used to encrypt the plaintext data. The single-byte obfuscation key, the single-byte encryption key and the random number constitute the single-byte encryption key, which is used to perform single-byte special encryption on each column of data byte by byte.

[0070] In one embodiment, before step S10: intercepting the insert statement of the user terminal to the database, the method further includes the following steps:

[0071] Generate a public-private key pair for the client and import the client's first public key into the database cryptographic machine;

[0072] Receive the second public key generated by the database cipher machine and establish a TLS secure channel.

[0073] Specifically, this embodiment installs a service grid for each user's device or application. The service grid generates a public-private key pair for the user, imports each user's public key into a database cryptographic machine, and the database cryptographic machine generates a device public-private key pair and imports the device public key into each service grid. A TLS secure channel is established between each service grid and the database cryptographic machine based on the above public-private key pair.

[0074] In one embodiment, step S20: calling a database cryptographic machine to use a data encryption key to encrypt the plaintext data in the insert statement to obtain first ciphertext data, specifically includes:

[0075] Based on the ID of the data encryption key corresponding to each column of plaintext data in the newly added data row in the insert statement, the database cryptographic machine is called to use the data encryption key corresponding to the data encryption key ID to perform symmetric block encryption on the plaintext data in the insert statement to obtain ciphertext data.

[0076] In one embodiment, step S30: calling a database cryptographic machine to perform single-byte encryption processing on each column of plaintext data in the insert statement using a single-byte encryption key corresponding to each column to obtain auxiliary data, specifically includes the following steps:

[0077] S31. Based on the ID of the single-byte encryption key corresponding to each column of data in the newly added data row in the insert statement, call the database cryptographic machine to use the corresponding single-byte encryption key to perform single-byte encryption processing;

[0078] S32. Receive a byte returned by the database cipher machine each time it performs single-byte encryption processing, and sequentially combine the returned bytes into auxiliary data of the same length as the ciphertext data of the column.

[0079] In one embodiment, step S31: based on the ID of the single-byte encryption key corresponding to each column of data under the newly added data row in the insert statement, calling the database cryptographic machine to use the corresponding single-byte encryption key to perform single-byte encryption processing, includes the following steps:

[0080] Based on the ID of the single-byte obfuscation key, the ID of the single-byte encryption key, and the random number corresponding to each column of data under the newly added data row in the insert statement, the database cryptographic machine is called to use the corresponding random number to perform block length modulo on the column of data, and the corresponding byte of the single-byte obfuscation key is selected according to the modulo result to perform an XOR operation on the byte and the single byte to be encrypted, and then the single-byte encryption key is used to perform symmetric block encryption on the single-byte obfuscation key to obtain the encrypted result;

[0081] Correspondingly, the bytes returned by the received database cipher machine are the bytes corresponding to the modulo result selected from the encryption result.

[0082] It should be noted that this embodiment uses a database cryptographic machine to perform single-byte special encryption processing on the plaintext data of each column insert byte by byte using the single-byte obfuscation key ID, single-byte encryption key ID, and random number corresponding to the column. The single-byte special encryption processing process of the database cryptographic machine is as follows: a random number (symmetric encryption algorithm) is used to modulo the block length, and the corresponding byte of the single-byte obfuscation key is selected according to the modulo result. The byte is XORed with the single byte to be encrypted, and then the single-byte encryption key is used to perform symmetric block encryption on the single-byte obfuscation key. The byte corresponding to the above modulo result is selected from the encryption result as the return result, and the returned bytes are sequentially combined into data of the same length as the ciphertext data of the column as auxiliary data, and the auxiliary data and the ciphertext data are spliced ​​together to replace the plaintext insert data. The insert statement is executed on the database server, and the ciphertext data and the auxiliary data are stored together in the same list item of the database.

[0083] In one embodiment, the method further comprises the following steps:

[0084] Intercept the user's read operation statement on the database;

[0085] Call the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keywords in the read operation statement using the single-byte encryption key corresponding to the relevant column;

[0086] The receiving database cryptographic machine encrypts each byte of the fuzzy search keyword and returns a byte, and sequentially combines the returned bytes to replace the plaintext keyword in the read operation statement to obtain a new read operation statement;

[0087] Sending a new read operation statement to the database server so that the database server executes the new read operation statement and queries the corresponding data row;

[0088] Receive the data row returned by the database server, and based on the data encryption key ID corresponding to each column of the data row, call the database cipher machine to use the corresponding data encryption key to perform symmetric group decryption on the data of each column of the data row to obtain the plaintext data corresponding to the fuzzy search keyword;

[0089] Receive the plaintext data returned by the database cipher machine.

[0090] Specifically, the service grid intercepts the user's select and other read statements on the database, and for the fuzzy search keywords involved in the read statements, calls the database cryptographic machine to perform single-byte special encryption processing on the keywords byte by byte using the single-byte obfuscation key, single-byte encryption key, and random number corresponding to the relevant column. The returned bytes are combined in sequence to replace the plaintext keywords of the select statement. The select statement is executed on the database server. When the returned data row is hit, the database cryptographic machine is called using the ID of the data encryption key corresponding to each column of the row to perform symmetric group decryption on the column data to obtain the plaintext data and return it to the user end.

[0091] In one embodiment, the method further comprises the following steps:

[0092] Intercept the user's write operation statement to the database;

[0093] Call the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the write operation statement using the single-byte encryption key corresponding to the relevant column to obtain the ciphertext keyword;

[0094] According to the data encryption key ID corresponding to the column related to the write operation statement, the database cipher machine is called to perform symmetric block encryption processing on the plaintext data in the write operation statement to obtain second ciphertext data;

[0095] According to the ID of the single-byte encryption key corresponding to the column related to the write operation statement, the database cipher machine is called to perform single-byte encryption processing on the plaintext data of the column in the write operation statement;

[0096] receiving a byte returned by the database cipher machine each time it performs single-byte encryption processing, and sequentially combining the returned bytes into query auxiliary data of the same length as the second ciphertext data;

[0097] The query auxiliary data and the second ciphertext data are concatenated to replace the plaintext data in the write operation statement to obtain a new write operation statement;

[0098] The new write operation statement is sent to the database server, so that the database server stores the query auxiliary data and the second ciphertext data into the row of the database where the ciphertext keyword hits.

[0099] Specifically, the service grid intercepts user write statements containing fuzzy search operations such as database updates, and calls the database cryptographic machine to perform single-byte special encryption processing on the fuzzy search keywords contained therein to form ciphertext keywords to replace the plaintext keywords. Then, the database cryptographic machine is called using the data encryption key ID corresponding to the relevant column to be updated to perform symmetric group encryption on the updated plaintext data to obtain ciphertext data. The database cryptographic machine is called one by one to perform single-byte special encryption processing on the updated plaintext data of the relevant column to be updated using the single-byte obfuscation key ID, single-byte encryption key ID, and random number corresponding to the column. The returned bytes are sequentially combined into data of the same length as the ciphertext data of the column as query auxiliary data, and are spliced ​​with the ciphertext data to replace the plaintext update data. The update statement is executed on the database server, and the new ciphertext data and the auxiliary data are stored together in the row of the database where the ciphertext keyword matches the hit.

[0100] In one embodiment, the method further comprises the following steps:

[0101] Intercept the user's statements on the database that contain fuzzy search operations;

[0102] Call the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the statement using the single-byte encryption key corresponding to the relevant column to obtain the ciphertext keyword;

[0103] The ciphertext keyword replaces the plaintext keyword in the statement containing the fuzzy search operation to obtain a new statement containing the fuzzy search operation;

[0104] The new statement containing the fuzzy search operation is sent to the database server, so that the database server deletes the row data of the database that is matched with the ciphertext keyword.

[0105] Specifically, the service grid intercepts user statements such as delete on the database that do not actually read or write content but contain fuzzy search operations. It first calls the database cipher machine to perform special single-byte encryption processing on the fuzzy search keyword to form a ciphertext keyword to replace the plaintext keyword. Then, the delete statement is executed on the database server to delete the database rows where the ciphertext keyword matches.

[0106] In one embodiment, the present application also discloses a user terminal, in which a service grid is deployed, and the service grid is used to execute the database operation method supporting fuzzy query as in the above embodiment, wherein the service grid is a network service agent running in a sidecar manner, and has security functions such as routing, flow control, identity authentication, access control, traffic analysis, and encrypted secure connection. It is a security agent for user-side devices or applications. The specific embodiment or implementation method of the service grid calling the database cryptographic machine for encryption and decryption processing of the read and write traffic accessing the database can refer to the above-mentioned method embodiments, which will not be repeated here.

[0107] In addition, as shown in FIG2 , an embodiment of the present application further proposes a database operating system that supports fuzzy queries. The system includes: a first user terminal, a second user terminal, a database server, and a database cryptographic machine. The first user terminal and the second user terminal are connected to the database server and the database cryptographic machine, respectively; wherein:

[0108] Both the first user terminal and the second user terminal are deployed with a service grid, which is used to execute the database operation method supporting modulus query as described in the above embodiment.

[0109] Specifically, the workflow of the database operating system supporting modular query proposed in this embodiment is shown in FIG3 , wherein the user end is generally a user-side device or application that calls a database client to remotely operate the database.

[0110] A service mesh is a network service proxy running as a sidecar. It provides security features such as routing, flow control, authentication, access control, traffic analysis, and encrypted secure connections. It acts as a secure proxy for user-side devices or applications. In this solution, the service mesh is responsible for encrypting and decrypting read and write traffic to the database using the database cipher.

[0111] The database cryptographic machine is a hardware cryptographic device that meets security requirements. It has a built-in random number generator and secure memory. It collects qualified random numbers from the random number generator as keys and stores them in the secure memory. It uses a uniformly numbered key ID for identification and indexing.

[0112] The database server is a device that provides public database services to users. This device is universal and runs a relational database.

[0113] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present application. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0114] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0115] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A database operation method supporting fuzzy query, characterized in that: Applied to a user terminal, the method includes: Intercept the user's insert statement to the database; Calling a database cryptographic machine to encrypt the plaintext data in the insert statement using a data encryption key to obtain first ciphertext data; Calling the database cryptographic machine to perform single-byte encryption processing on each column of plaintext data in the insert statement using a single-byte encryption key corresponding to each column to obtain auxiliary data; The plaintext data in the insert statement is replaced with the concatenated first ciphertext data and the auxiliary data and sent to a database server so that the database server stores the first ciphertext data and the auxiliary data in the same list item.

2. The database operation method supporting fuzzy query according to claim 1, characterized in that: Before intercepting the insert statement of the user terminal to the database, the method further includes: Obtain the data definition statement of the database from the user side; Based on the content of the data definition statement, sending key application information to the database cryptographic machine; Receive each key ID and random number corresponding to each newly created column fed back by the database cryptographic machine, each key ID includes the ID of the data encryption key, the ID of the single-byte obfuscation key and the ID of the single-byte encryption key, and the single-byte encryption key includes the single-byte obfuscation key and the single-byte encryption key.

3. The database operation method supporting fuzzy query according to claim 1, characterized in that: Before intercepting the insert statement of the user terminal to the database, the method further includes: Generate a public-private key pair for the client, and import the first public key of the client into the database cryptographic machine; Receive the second public key generated by the database cryptographic machine and establish a TLS secure channel.

4. The database operation method supporting fuzzy query according to claim 1, characterized in that: The calling database cryptographic machine uses a data encryption key to encrypt the plaintext data in the insert statement to obtain first ciphertext data, including: Based on the ID of the data encryption key corresponding to each column of plaintext data in the newly added data row in the insert statement, the database cryptographic machine is called to use the data encryption key corresponding to the ID of the data encryption key to perform symmetric block encryption on the plaintext data in the insert statement to obtain the ciphertext data.

5. The database operation method supporting fuzzy query according to claim 1, characterized in that: The calling of the database cryptographic machine performs single-byte encryption processing on each column of plaintext data in the insert statement using a single-byte encryption key corresponding to each column to obtain auxiliary data, including: Based on the ID of the single-byte encryption key corresponding to each column of data under the newly added data row in the insert statement, the database cryptographic machine is called to use the corresponding single-byte encryption key to perform single-byte encryption processing; A byte returned by the database cryptographic machine each time a single-byte encryption process is performed is received, and the returned bytes are sequentially combined into auxiliary data of the same length as the current column ciphertext data.

6. The database operation method supporting fuzzy query according to claim 5, characterized in that: The single-byte encryption key includes a single-byte obfuscation key, a single-byte encryption key and a random number; The method of calling the database cryptographic machine to perform single-byte encryption processing using the corresponding single-byte encryption key based on the ID of the single-byte encryption key corresponding to each column of data under the newly added data row in the insert statement comprises: Based on the ID and single-byte encryption key corresponding to each column of the newly added data row in the insert statement The database cipher machine is called to perform group length modulo on the column data using the corresponding random number, and after selecting the corresponding byte of the single-byte obfuscation key according to the modulo result to perform an XOR operation on the byte and the single byte to be encrypted, the single-byte encryption key is used to perform symmetric group encryption on the single-byte obfuscation key to obtain an encryption result; Correspondingly, the bytes received and returned by the database cryptographic machine are bytes selected from the encryption result and corresponding to the modulo result.

7. The database operation method supporting fuzzy query according to claim 1, characterized in that: The method further comprises: Intercept the user's read operation statements on the database; Calling the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the read operation statement by using the single-byte encryption key corresponding to the relevant column; Receiving a byte returned by the database cryptographic machine after encrypting each byte of the fuzzy search keyword, and combining the returned bytes in order to replace the plaintext keywords in the read operation statement to obtain a new read operation statement; Sending a new read operation statement to the database server so that the database server executes the new read operation statement and queries the corresponding data row; Receive the data row returned by the database server, and based on the ID of the data encryption key corresponding to each column of the data row, call the database cryptographic machine to use the corresponding data encryption key to perform symmetric group decryption on the data of each column of the data row to obtain the plaintext data corresponding to the fuzzy search keyword; Receive the plaintext data returned by the database cryptographic machine.

8. The database operation method supporting fuzzy query according to claim 1, characterized in that: The method further comprises: Intercept the user's write operation statements to the database; Calling the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the write operation statement by using the single-byte encryption key corresponding to the relevant column to obtain the ciphertext keyword; According to the data encryption key ID corresponding to the column related to the write operation statement, calling the database cryptographic machine to perform symmetric block encryption processing on the plaintext data in the write operation statement to obtain second ciphertext data; According to the ID of the single-byte encryption key corresponding to the column related to the write operation statement, calling the database cryptographic machine to perform single-byte encryption processing on the plaintext data of the column in the write operation statement; Receiving a byte returned by the database cryptographic machine each time the single-byte encryption process is performed, and sequentially combining the returned bytes into query auxiliary data of the same length as the second ciphertext data; The query auxiliary data and the second ciphertext data are concatenated to replace the plaintext data in the write operation statement to obtain a new write operation statement; A new write operation statement is sent to the database server, so that the database server stores the query auxiliary data and the second ciphertext data into the row of the database hit by the ciphertext keyword.

9. The database operation method supporting fuzzy query according to claim 1, characterized in that: The method further comprises: Intercept the user's statements containing fuzzy search operations on the database; Calling the database cryptographic machine to perform single-byte encryption processing on the fuzzy search keyword in the statement by using the single-byte encryption key corresponding to the relevant column to obtain the ciphertext keyword; The ciphertext keyword replaces the plaintext keyword in the statement containing the fuzzy search operation to obtain a new packet Statements containing fuzzy search operations; A new statement containing a fuzzy search operation is sent to the database server, so that the database server executes deletion of the row data of the database that is matched with the ciphertext keyword.

10. A user terminal, characterized in that: A service grid is deployed in the user terminal, and the service grid is used to execute the database operation method supporting fuzzy query as described in any one of claims 1 to 9.

Images