Efficient order-preserving encryption and decryption methods based on commercial cryptographic algorithm, and computer device

Abstract

An efficient order-preserving encryption method based on a commercial cryptographic algorithm, comprising: (011) dividing plaintext data into a plurality of lists, and using the lists to store ciphertext data mapped to the plaintext data; (012) performing a pseudo-random algorithm on the basis of a key and midpoint data of the ciphertext data to obtain a random number; (013) generating a probability factor set on the basis of the random number and a probability factor derivation algorithm; and (014) on the basis of the probability factor set and the ciphertext data, determining ciphertext data corresponding to first plaintext data, wherein the first plaintext data is plaintext data currently needing to be encrypted.

Description

Efficient order-preserving encryption / decryption method and computer equipment based on commercial cryptographic algorithms

[0001] Priority information

[0002] This application claims priority and benefit to patent application No. 202411007779.X, filed with the China National Intellectual Property Administration on July 25, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of information security technology, and in particular to an efficient order-preserving encryption method based on commercial cryptographic algorithms, an efficient order-preserving decryption method based on commercial cryptographic algorithms, and a computer device. Background Technology

[0004] With the development of information technology, businesses and individuals are accumulating more and more data, which requires encryption to ensure security. However, current encryption algorithms cannot preserve the data's order information, resulting in low accuracy when sorting and querying data.

[0005] Therefore, existing order-preserving encryption and decryption algorithms, while ensuring the accuracy of data sorting and querying, require multiple complex calculations of the pseudo-random sampling probabilities generated in the order-preserving encryption and decryption algorithm, which reduces the overall operating efficiency of the order-preserving encryption and decryption algorithm.

[0006] Summary of the Invention

[0007] This application provides an efficient order-preserving encryption method based on commercial cryptographic algorithms, an efficient order-preserving decryption method based on commercial cryptographic algorithms, and a computer device.

[0008] This application provides an efficient order-preserving encryption method based on commercial cryptographic algorithms, comprising: dividing plaintext data into multiple lists to store ciphertext data mapped to the plaintext data; performing a pseudo-random algorithm to obtain random numbers based on a key and the midpoint data of the ciphertext data; generating a probability factor set based on the random numbers and a probability factor derivation algorithm; and determining the ciphertext data corresponding to a first plaintext data based on the probability factor set and the ciphertext data, wherein the first plaintext data is the plaintext data that needs to be encrypted.

[0009] Thus, by dividing the plaintext data into multiple lists, duplicate data appearing in the plaintext data can be stored in the corresponding lists, eliminating the need to re-encrypt each piece of plaintext data. This improves the overall efficiency of the order-preserving encryption algorithm and solves the data formatting problem, supporting the encryption of larger datasets. Furthermore, by using random numbers and probability factor derivation algorithms to generate the probability factors required for each encryption, the algorithm avoids the need to re-collect random numbers and calculate probability factors for each encryption, further improving the overall efficiency of the order-preserving encryption algorithm.

[0010] In some implementations, the plaintext data includes a plaintext field, the ciphertext data includes a ciphertext field, the plaintext data is divided into a list according to single bytes, and the plaintext field is determined to be 0 to 255, and the ciphertext field is one of two bytes or multiple bytes.

[0011] Thus, by dividing plaintext data into lists based on single bytes, the data formatting issue can be resolved, enabling encryption and decryption of larger datasets and improving the accuracy of fuzzy queries. Dividing the ciphertext field into double-byte or multi-byte segments increases decryption complexity and enhances confidentiality.

[0012] In some implementations, the key is a quantum secure key generated by quantum key distribution.

[0013] Thus, by using quantum secure keys, the principle of quantum superposition can be used to use multiple quantum states as keys for secure communication. Once the key is eavesdropped on or measured, the other quantum states will randomly disappear. The presence of the eavesdropper will introduce additional errors. Both the sender and receiver can quickly measure this change, thereby interrupting the key transmission and resetting the quantum key until the quantum key is securely transmitted to the receiver, thereby improving the security of encryption and decryption.

[0014] In some implementations, the step of using a pseudo-random algorithm based on the key and the midpoint data of the ciphertext data to obtain a random number includes using the midpoint data of the key and the ciphertext data as input parameters for the SM3 cryptographic hash algorithm to obtain a message authentication code; and then calculating the message authentication code using the SM4 block cipher algorithm to obtain a random number.

[0015] Thus, by using SM3 and SM4 in commercial cryptography systems, the security requirements of various cryptographic applications can be met, thereby improving the security of encryption and decryption and preventing plaintext data from being stolen and tampered with by third parties during transmission.

[0016] In some implementations, generating a probability factor set based on the random number and the probability factor derivation algorithm includes: determining the probability factor required for each encryption based on the quotient of the data represented in each table of the probability derivation table in the probability factor derivation algorithm and the total number of bytes in the probability derivation table; determining whether the starting byte and the number of bytes have reached their maximum values; if both the starting byte and the number of bytes are less than the maximum values, looping the probability factor derivation algorithm to obtain the probability factor required for each encryption of the plaintext data; and if both the starting byte and the number of bytes are equal to the maximum values, re-entering the steps of calculating the random number and generating the probability factor set based on the random number and the probability factor derivation algorithm.

[0017] Thus, by using a probability factor derivation algorithm to calculate the probability factor, random numbers need to be calculated by sampling the ciphertext data when encryption is not required, thereby improving the running efficiency of the encryption algorithm.

[0018] In some implementations, the plaintext data includes a plaintext field, the ciphertext data includes a ciphertext field, and determining the ciphertext data corresponding to the first plaintext data based on the probability factor set and the ciphertext data includes calculating the second plaintext data corresponding to the intermediate ciphertext data of the current ciphertext field based on the current probability factors; comparing the second plaintext data with the first plaintext data to divide the current plaintext field and the current ciphertext field; if the second plaintext data is less than the first plaintext data, determining the new plaintext field as the largest plaintext data from the second plaintext data to the current plaintext field, and the new ciphertext field as the intermediate ciphertext data from the current ciphertext field to the current ciphertext field. The maximum ciphertext data; if the second plaintext data is greater than the first plaintext data, determine the new plaintext field as the minimum value of the current plaintext field to the second plaintext data, and the new ciphertext field as the minimum ciphertext data of the current ciphertext field to the intermediate ciphertext data of the current ciphertext field; determine whether the number of elements in the new plaintext field is one; if the number of elements in the new plaintext field is one, determine the ciphertext data in the new ciphertext field as the ciphertext data corresponding to the first plaintext data; if the number of elements in the new plaintext field is not one, re-enter the step of dividing the current plaintext field and the current ciphertext field until the number of elements in the new plaintext field is one.

[0019] In this way, by repeatedly performing a binary search operation to reduce the ciphertext and plaintext fields until the final ciphertext field contains only one element, which is the ciphertext data of the plaintext data, the encryption process of the plaintext data can be shortened, and the running efficiency of the order-preserving encryption algorithm can be improved.

[0020] In some implementations, after the step of determining the ciphertext data corresponding to the first plaintext data based on the probability factor set and the ciphertext data, a mapping relationship is established between the acquired ciphertext data and the first plaintext data, so that the ciphertext data can be stored in the list corresponding to the first plaintext data.

[0021] In this way, by storing the acquired ciphertext data into a list corresponding to the plaintext data, the order information of the plaintext data can be preserved during the decryption process.

[0022] This invention provides an efficient order-preserving decryption method based on commercial cryptographic algorithms, comprising: dividing ciphertext data into multiple lists according to two-byte or multi-byte bytes, and using the lists to store plaintext data mapped to the ciphertext data; performing a pseudo-random algorithm based on a key and the midpoint data of the ciphertext data to obtain random numbers; generating a probability factor set based on the random numbers and a probability factor derivation algorithm; and determining the plaintext data corresponding to a first ciphertext data based on the probability factor set and the ciphertext data, wherein the first ciphertext data is the ciphertext data currently to be decrypted.

[0023] Thus, by dividing the ciphertext data into multiple lists, duplicate data appearing in the plaintext data can be stored in the corresponding lists, eliminating the need to decrypt each piece of plaintext data again. This improves the overall efficiency of the order-preserving decryption algorithm and solves the data formatting problem, supporting encryption and decryption of larger datasets. Furthermore, by using random numbers and probability factor derivation algorithms to generate the probability factors needed for each decryption, the algorithm avoids the need to re-collect random numbers and calculate probability factors for each decryption, further improving the overall efficiency of the order-preserving decryption algorithm.

[0024] In some implementations, determining the plaintext data corresponding to the first ciphertext data based on the probability factor set and the ciphertext data includes calculating the third plaintext data corresponding to the intermediate ciphertext data of the current ciphertext field based on the current probability factors; comparing the first ciphertext data with the intermediate ciphertext data of the current ciphertext field to divide the current plaintext field and the current ciphertext field; if the first ciphertext data is less than or equal to the intermediate ciphertext data, determining a new plaintext field as the minimum plaintext data to the third plaintext data of the current plaintext field, and a new ciphertext field as the minimum ciphertext data to the intermediate ciphertext data of the current ciphertext field; in the case where... If the first ciphertext data is greater than or equal to the intermediate ciphertext data, the new plaintext field is determined to be the maximum value from the third plaintext data to the current plaintext field, and the new ciphertext field is the maximum ciphertext data from the intermediate ciphertext data to the current ciphertext field; it is then determined whether the number of elements in the new plaintext field is one; if the number of elements in the new plaintext field is one, the plaintext data in the new plaintext field is determined to be the plaintext data corresponding to the first ciphertext data; if the number of elements in the new plaintext field is not one, the process of dividing the current plaintext field and the current ciphertext field is repeated until the number of elements in the new plaintext field is one.

[0025] In this way, by repeatedly performing a binary search operation to reduce the ciphertext and plaintext fields until the plaintext field contains only one element, which is the plaintext data corresponding to the ciphertext data, the decryption process of the ciphertext data can be shortened, and the running efficiency of the order-preserving decryption algorithm can be improved.

[0026] The computer device according to the embodiments of this application includes a processor, a memory, and a computer program. The memory stores the computer program, and when the computer program is executed by the processor, it implements the instructions of the efficient order-preserving encryption method based on commercial cryptographic algorithms described above and / or the instructions of the efficient order-preserving decryption method based on commercial cryptographic algorithms described above.

[0027] The non-volatile computer-readable storage medium of the embodiments of this application stores a computer program thereon. When the computer program is executed by a processor, the processor is able to implement the steps of the efficient order-preserving encryption method based on commercial cryptographic algorithms described in any one of the above claims and / or implement the steps of the efficient order-preserving decryption method based on commercial cryptographic algorithms described in any one of the above claims.

[0028] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0029] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein:

[0030] Figure 1 is a flowchart illustrating an efficient order-preserving encryption method based on commercial cryptographic algorithms according to certain embodiments of this application;

[0031] Figure 2 is a plan view of a computer device according to some embodiments of this application;

[0032] Figure 3 is a flowchart illustrating an efficient order-preserving encryption method based on commercial cryptographic algorithms according to certain embodiments of this application;

[0033] Figure 4 is a flowchart illustrating an efficient order-preserving encryption method based on commercial cryptographic algorithms according to certain embodiments of this application.

[0034] Figure 5 is a schematic diagram of the principle of the probability factor derivation algorithm in some embodiments of this application;

[0035] Figure 6 is a schematic diagram of the principle of the probability factor derivation algorithm in some embodiments of this application;

[0036] Figure 7 is a flowchart illustrating an efficient order-preserving encryption method based on commercial cryptographic algorithms according to certain embodiments of this application;

[0037] Figure 8 is a flowchart illustrating an efficient order-preserving encryption method based on commercial cryptographic algorithms according to certain embodiments of this application;

[0038] Figure 9 is a flowchart illustrating an efficient order-preserving decryption method based on commercial cryptographic algorithms according to certain embodiments of this application;

[0039] Figure 10 is a flowchart illustrating an efficient order-preserving decryption method based on commercial cryptographic algorithms according to certain embodiments of this application.

[0040] Figure 11 is a schematic diagram of the connection state between a non-volatile computer-readable storage medium and a processor according to certain embodiments of this application. Detailed Implementation

[0041] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0042] Please refer to Figures 1 and 2. This application provides an efficient order-preserving encryption method based on commercial cryptographic algorithms, comprising:

[0043] Step 011: Divide the plaintext data into multiple lists to store the ciphertext data mapped to the plaintext data;

[0044] Step 012: Perform a pseudo-random algorithm based on the midpoint data of the key and ciphertext data to obtain random numbers;

[0045] Step 013: Generate a set of probability factors based on random numbers and probability factor derivation algorithms;

[0046] Step 014: Determine the ciphertext data corresponding to the first plaintext data based on the probability factor set and the ciphertext data. The first plaintext data is the plaintext data that needs to be encrypted at the moment.

[0047] Thus, by dividing the plaintext data into multiple lists, duplicate data appearing in the plaintext data can be stored in the corresponding lists, eliminating the need to re-encrypt each piece of plaintext data. This improves the overall efficiency of the order-preserving encryption algorithm and solves the data formatting problem, supporting the encryption of larger datasets. Furthermore, by using random numbers and probability factor derivation algorithms to generate the probability factors required for each encryption, the algorithm avoids the need to re-collect random numbers and calculate probability factors for each encryption, further improving the overall efficiency of the order-preserving encryption algorithm.

[0048] Plaintext data can be bitstreams in a communication system; for example, plaintext data can be text, bitmaps, digitized voice, or digitized video images. Ciphertext data can be data that is difficult to read or understand after encryption or hiding of plaintext data. The encryption operation on plaintext data can be performed in computer device 100. The computer includes a processor 10, a memory 20, and a computer program 21. The computer program 21 is stored in the memory 20 and executed by the processor 10. The computer program 21 includes instructions for executing any efficient order-preserving encryption method based on a commercial cryptographic algorithm.

[0049] Specifically, when performing order-preserving encryption on plaintext data, the processor 10 can partition the plaintext data into lists in the database of the computer device 100. The plaintext data can be partitioned into lists based on single-byte values. For example, if the plaintext data is text, one Chinese character occupies two bytes, so each of the two bytes can be partitioned into a separate list in the database, meaning one Chinese character occupies two lists. The lists of plaintext data partitioned into single-byte values ​​can be used to store ciphertext data, and the ciphertext data corresponding to each single-byte plaintext data needs to be stored in the corresponding list.

[0050] Plaintext data can be divided into plaintext fields. By dividing the plaintext data into single-byte segments, the size of the plaintext field can range from 0 to 255. Thus, by dividing the plaintext data into lists of single bytes, the data formatting issues can be resolved, supporting the encryption and decryption of larger data sets, and improving the accuracy of fuzzy queries.

[0051] Ciphertext data can be divided into ciphertext fields. By dividing ciphertext data into two-byte or multi-byte segments, the complexity of decryption and the security can be improved. For example, if ciphertext data is divided into two-byte segments, the size of the ciphertext field can range from 0 to 65535.

[0052] A key can be a parameter, used as input in algorithms that convert plaintext to ciphertext or vice versa. This key can be a quantum-secure key generated by quantum key distribution (QKD). QKD utilizes quantum mechanics to ensure communication security. It enables both communicating parties to generate and share a random, secure quantum-secure key to encrypt and decrypt plaintext data. QKD is only used to generate and distribute quantum-secure keys; it does not transmit any actual message. The quantum-secure key can be used in order-preserving encryption algorithms to encrypt plaintext data, which can then be transmitted over standard channels.

[0053] During the encryption of plaintext data, the processor 10 can input the quantum secure key of the quantum key distribution and the intermediate ciphertext data of the ciphertext field as parameters into the pseudo-random algorithm for calculation, thereby obtaining a random number.

[0054] The processor 10 inputs the acquired random number as a parameter into the probability factor derivation algorithm, which can obtain the probability factor set required for encrypting the plaintext data. Thus, the processor 10 can calculate the ciphertext data corresponding to the first input plaintext data based on the probability factor set and the ciphertext data in the ciphertext field.

[0055] Please refer to Figure 3. In some implementations, step 012: performing a pseudo-random algorithm to obtain random numbers based on the midpoint data of the key and ciphertext data, including:

[0056] Step 0121: Use the intermediate ciphertext data of the key and ciphertext data as input data for the SM3 cryptographic hash algorithm to obtain the message authentication code;

[0057] Step 0122: Calculate the message authentication code using the SM4 block cipher algorithm to obtain a random number.

[0058] Thus, by using SM3 and SM4 in commercial cryptography systems, the security requirements of various cryptographic applications can be met, thereby improving the security of encryption and decryption and preventing plaintext data from being stolen and tampered with by third parties during transmission.

[0059] Specifically, because the intermediate ciphertext data of the ciphertext field is relatively small, the processor 10 inputs the quantum secure key and the intermediate ciphertext data of the ciphertext field as input parameters into the SM3 cryptographic hash algorithm, thereby obtaining an extended random 32-byte message authentication code. The expression can be represented as:

[0060] Sm3_hmac(q-rKey, mids, midsLen, mac)

[0061] Where q-rKey represents the quantum secure key; mids represents the intermediate ciphertext data of the ciphertext field; midsLen represents the length of the intermediate ciphertext data of the ciphertext field; and mac represents the message authentication code.

[0062] Then, processor 10 inputs the quantum security key and the obtained message authentication code into the SM4 block cipher algorithm for calculation, thereby obtaining a random 32-byte number. The expression can be represented as:

[0063] Sm4_cbc_encrypt(q-rKey, mac, macLen, eRng)

[0064] Where q-rKey represents the quantum secure key; mac represents the message authentication code; macLen represents the length of the message authentication code; and eRng represents a random number.

[0065] Please refer to Figures 4, 5, and 6. In some embodiments, step 013: generating a probability factor set based on a random number and probability factor derivation algorithm includes:

[0066] Step 0131: Determine the probability factor required for each encryption based on the product of the random number and the starting byte in the probability factor derivation table and the number of bytes represented by each table, and the quotient of the total number of bytes in the probability derivation table;

[0067] Step 0132: Determine if the starting byte and the number of bytes have reached their maximum values;

[0068] Step 0133: When both the starting byte and the number of bytes are less than the maximum value, use a cyclic probability factor derivation algorithm to obtain the probability factor required for each encryption of plaintext data;

[0069] Step 0134: If both the starting byte and the number of bytes are equal to the maximum value, re-enter the steps of calculating random numbers and generating a set of probability factors based on the random number and probability factor derivation algorithm.

[0070] Thus, by using a probability factor derivation algorithm to calculate the probability factor, random numbers need to be calculated by sampling the ciphertext data when encryption is not required, thereby improving the running efficiency of the encryption algorithm.

[0071] Specifically, after the processor 10 inputs a random number into the probability factor derivation algorithm, the algorithm generates a probability factor based on the starting byte in the probability factor derivation table and the number of bytes represented by each table in the table. For example, the probability factor required for each encryption is determined by the quotient of the data represented by each table in the probability factor derivation table and the total number of bytes in the probability derivation table. The expression is:

[0072] Among them, eRng ij represents the data value starting with byte i and having byte count j (i.e., the corresponding data value in each table of the probability factor derivation table); bm represents the m-th bit in the byte; PF n represents the set of probability factors; i represents the starting byte in the probability factor derivation table, and j represents the number of bytes represented by each table in the probability factor derivation table.

[0073] Then, processor 10 determines whether the starting byte and the number of bytes have reached their maximum values. If both the starting byte and the number of bytes have reached their maximum values, it indicates that the probability factor set corresponding to the random number has been completely used up during the encryption process, and it is necessary to re-enter the steps of calculating the random number and generating the probability factor set based on the random number and probability factor derivation algorithm.

[0074] When both the starting byte and the number of bytes are less than the maximum value, the processor 10 can iterate through the probability factor derivation algorithm to obtain the probability factor required for each encryption of plaintext data.

[0075] Please refer to Figure 7. In some embodiments, plaintext data includes a plaintext field, and ciphertext data includes a ciphertext field. Step 014: Determine the ciphertext data corresponding to the first plaintext data based on the probability factor set and the ciphertext data, including:

[0076] Step 0141: Calculate the second plaintext data corresponding to the intermediate ciphertext data of the current ciphertext field based on the current probability factor;

[0077] Step 0142: Compare the second plaintext data with the first plaintext data to divide the current plaintext field and the current ciphertext field;

[0078] Step 0143: If the second plaintext data is less than the first plaintext data, determine the new plaintext field as the maximum plaintext data from the second plaintext data to the current plaintext field, and the new ciphertext field as the maximum ciphertext data from the middle ciphertext data of the current ciphertext field to the current ciphertext field.

[0079] Step 0144: If the second plaintext data is greater than the first plaintext data, determine the new plaintext field as the minimum value of the current plaintext field to the second plaintext data, and the new ciphertext field as the minimum ciphertext data of the ciphertext field to the intermediate ciphertext data of the current ciphertext field.

[0080] Step 0145: Determine if the number of elements in the new plaintext field is one;

[0081] Step 0146: If the number of elements in the new plaintext field is one, determine that the ciphertext data in the new ciphertext field is the ciphertext data corresponding to the first plaintext data;

[0082] Step 0147: If the number of elements in the new plaintext field is not one, re-enter the step of dividing the current plaintext field and the current ciphertext field until the number of elements in the new plaintext field is one.

[0083] In this way, by repeatedly performing a binary search operation to reduce the ciphertext and plaintext fields until the final ciphertext field contains only one element, which is the ciphertext data of the plaintext data, the encryption process of the plaintext data can be shortened, and the running efficiency of the order-preserving encryption algorithm can be improved.

[0084] Specifically, when the probability factor for encrypting the current plaintext data is obtained, the processor 10 can calculate the second plaintext data corresponding to the intermediate ciphertext data of the current ciphertext field based on the current probability factor.

[0085] Then, the processor 10 compares the second plaintext data with the first plaintext data, and divides the current plaintext field and the current ciphertext field according to the result. Specifically, if the second plaintext data is less than the first plaintext data, the processor 10 can divide the new plaintext field into the range from the second plaintext data to the maximum plaintext data in the current plaintext field, and the new ciphertext field into the range from the middle ciphertext data in the current ciphertext field to the maximum ciphertext data in the current ciphertext field; if the second plaintext data is greater than the first plaintext data, the processor 10 can divide the new plaintext field into the range from the minimum value in the current plaintext field to the second plaintext data, and the new ciphertext field into the range from the minimum ciphertext data in the current ciphertext field to the middle ciphertext data in the current ciphertext field.

[0086] For example, if the current plaintext field size is 0 to 255, the current ciphertext field size is 0 to 65535, and the first plaintext data is 50, and the probability factor is determined to be 10% based on the intermediate ciphertext data 32768, then the second plaintext data can be calculated as 255 * 10% = 25.5. Since the second plaintext data is less than the first plaintext data, the new plaintext field can be determined to be 25 to 255, and the new ciphertext field to be 32768 to 65535. If the probability factor is determined to be 30% based on the intermediate ciphertext data 32768, then the second plaintext data can be calculated as 255 * 30% = 76.5. Since the second plaintext data is greater than the first plaintext data, the new plaintext field can be determined to be 0 to 76.5, and the new ciphertext field to be 0 to 32768.

[0087] After acquiring the new plaintext field, the processor 10 needs to determine whether the number of elements in the plaintext field is one; that is, the processor 10 needs to determine whether the element in the new plaintext field is the first plaintext data. If the number of elements in the current plaintext field is one, the processor 10 can determine that the ciphertext data in the new ciphertext field is the ciphertext data corresponding to the first plaintext data; if the number of elements in the new plaintext field is not one, the processor 10 re-enters the step of dividing the plaintext field and the ciphertext field until the number of elements in the new plaintext field is one.

[0088] Please refer to Figure 8. In some embodiments, after step 014: determining the ciphertext data corresponding to the first plaintext data based on the probability factor set and the ciphertext data, the following steps are included:

[0089] Step 015: Establish a mapping relationship between the acquired ciphertext data and the first plaintext data so that the ciphertext data can be stored in the list corresponding to the first plaintext data.

[0090] In this way, by storing the acquired ciphertext data into a list corresponding to the plaintext data, the order information of the plaintext data can be preserved during the decryption process.

[0091] Specifically, after the processor 10 determines the ciphertext data corresponding to the first plaintext data, it establishes a mapping relationship by constructing a key-value data structure in software or by defining a single-byte maximum array to store the corresponding ciphertext, thereby storing the ciphertext data in the list corresponding to the first plaintext data. During subsequent plaintext data encryption, when encountering plaintext data identical to the first plaintext data, the processor 10 can store the corresponding ciphertext data in the list corresponding to the first plaintext data.

[0092] Please refer to Figure 9. An efficient order-preserving decryption method based on commercial cryptographic algorithms, according to an embodiment of this application, includes:

[0093] Step 021: Divide the ciphertext data into multiple lists according to two-byte or multi-byte bytes, so as to use the lists to store the plaintext data mapped to the ciphertext data;

[0094] Step 022: Perform a pseudo-random algorithm based on the midpoint data of the key and ciphertext data to obtain random numbers;

[0095] Step 023: Generate a set of probability factors based on the random number and probability factor derivation algorithm;

[0096] Step 024: Determine the plaintext data corresponding to the first ciphertext data based on the probability factor set and the ciphertext data. The first ciphertext data is the ciphertext data that needs to be decrypted.

[0097] Thus, by dividing the ciphertext data into multiple lists, duplicate data appearing in the plaintext data can be stored in the corresponding lists, eliminating the need to decrypt each piece of plaintext data again. This improves the overall efficiency of the order-preserving decryption algorithm and solves the data formatting problem, supporting encryption and decryption of larger datasets. Furthermore, by using random numbers and probability factor derivation algorithms to generate the probability factors needed for each decryption, the algorithm avoids the need to re-collect random numbers and calculate probability factors for each decryption, further improving the overall efficiency of the order-preserving decryption algorithm.

[0098] Specifically, after the plaintext data is encrypted and transmitted to the recipient via the communication channel, the ciphertext data needs to be decrypted. At this point, the recipient's computer device 100, through its processor 10, can partition the ciphertext data into a list in a database, thereby storing the plaintext data mapped to the ciphertext data in the list. The ciphertext data can be partitioned into lists using either double-byte or multi-byte methods. It should be noted that whether the ciphertext data uses double-byte or multi-byte methods during encryption must correspond to these methods during decryption.

[0099] The key used in the decryption process can be a quantum-safe key generated by quantum key distribution, and it corresponds to the key used in the encryption process. The quantum-safe key can be used in order-preserving decryption algorithms to decrypt ciphertext data.

[0100] During the decryption of ciphertext data, the processor 10 can input the quantum secure key of the quantum key distribution and the intermediate ciphertext data of the ciphertext field as parameters into the pseudo-random algorithm for calculation, thereby obtaining a random number.

[0101] The processor 10 inputs the acquired random number as a parameter into the probability factor derivation algorithm, which can obtain the probability factor set required for decrypting the plaintext data. Thus, the processor 10 can calculate the plaintext data corresponding to the first input ciphertext data based on the probability factor set and the ciphertext data in the ciphertext field.

[0102] Please refer to Figure 10. In some embodiments, step 024: determining the plaintext data corresponding to the first ciphertext data based on the probability factor set and the ciphertext data includes:

[0103] Step 0241: Calculate the third plaintext data corresponding to the intermediate ciphertext data of the current ciphertext field based on the current probability factor;

[0104] Step 0242: Compare the first ciphertext data with the middle ciphertext data of the current ciphertext field to divide the current plaintext field and the current ciphertext field;

[0105] Step 0243: If the first ciphertext data is less than or equal to the intermediate ciphertext data, determine the new plaintext field as the minimum plaintext data to the third plaintext data of the current plaintext field, and the new ciphertext field as the minimum ciphertext data to the intermediate ciphertext data of the current ciphertext field.

[0106] Step 0244: If the first ciphertext data is greater than or equal to the intermediate ciphertext data, determine the new plaintext field as the maximum value from the third plaintext data to the plaintext field, and the new ciphertext field as the maximum ciphertext data from the intermediate ciphertext data to the ciphertext field.

[0107] Step 0245: Determine if the number of elements in the new plaintext field is one;

[0108] Step 0246: If the number of elements in the new plaintext field is one, determine that the plaintext data in the new plaintext field is the plaintext data corresponding to the first ciphertext data;

[0109] Step 0247: If the number of elements in the new plaintext field is not one, re-enter the step of dividing the current plaintext field and the current ciphertext field until the number of elements in the new plaintext field is one.

[0110] In this way, by repeatedly performing a binary search operation to reduce the ciphertext and plaintext fields until the plaintext field contains only one element, which is the plaintext data corresponding to the ciphertext data, the decryption process of the ciphertext data can be shortened, and the running efficiency of the order-preserving decryption algorithm can be improved.

[0111] Specifically, when the probability factor for decrypting the first ciphertext data is obtained, the processor 10 can calculate the third plaintext data corresponding to the intermediate ciphertext data of the current ciphertext field based on the current probability factor.

[0112] Then, the processor 10 compares the first ciphertext data with the intermediate ciphertext data of the current ciphertext field, and divides the current plaintext field and the current ciphertext field according to the result. Specifically, if the first ciphertext data is less than or equal to the intermediate ciphertext data, the processor 10 can divide the new plaintext field into the minimum plaintext data to the third plaintext data of the current plaintext field, and the new ciphertext field is the minimum ciphertext data to the intermediate ciphertext data of the current ciphertext field; if the input ciphertext data is greater than or equal to the intermediate ciphertext data, the processor 10 can divide the new plaintext field into the third plaintext data to the maximum value of the current plaintext field, and the new ciphertext field is the intermediate ciphertext data to the maximum ciphertext data of the current ciphertext field.

[0113] For example, if the plaintext field is 0 to 255 and the ciphertext field is 0 to 65535, then the middle ciphertext data of the ciphertext field is 32768. Based on the current probability factor, the third plaintext data corresponding to the middle ciphertext data 32768 of the current ciphertext field is calculated to be 25. If the first ciphertext data is 20000, then since the first ciphertext data 20000 is less than the middle ciphertext data 32768 of the current ciphertext field, the new plaintext field can be determined to be 0 to 25, and the new ciphertext field to be 0 to 32768. If the first ciphertext data is 50000, then since the first ciphertext data 50000 is greater than the middle ciphertext data 32768 of the current ciphertext field, the new plaintext field can be determined to be 25 to 255, and the new ciphertext field to be 32768 to 65535.

[0114] After acquiring the new plaintext field, the processor 10 needs to determine whether the number of elements in the plaintext field is one. If the number of elements in the current plaintext field is one, the processor 10 can determine that the plaintext data in the new plaintext field is the plaintext data corresponding to the first ciphertext data; if the number of elements in the new plaintext field is not one, the processor 10 re-enters the step of dividing the plaintext field and the ciphertext field until the number of elements in the new plaintext field is one.

[0115] Please refer to Figure 2 again. The computer device 100 of this embodiment includes a processor 10 and a memory 20. The memory 20 stores a computer program 21. When the computer program 21 is executed by the processor 10, it can implement the instructions of the efficient order-preserving encryption method based on commercial cryptographic algorithms of any of the above embodiments and / or implement the instructions of the efficient order-preserving decryption method based on commercial cryptographic algorithms of any of the above embodiments. For the sake of brevity, it will not be described in detail here.

[0116] Please refer to Figure 11. This application also provides a computer-readable storage medium 300, on which a computer program 21 is stored. When the computer program 21 is executed by the processor 10, it implements the steps of the efficient order-preserving encryption method based on commercial cryptographic algorithms of any of the above embodiments and / or the steps of the efficient order-preserving decryption method based on commercial cryptographic algorithms of any one of the above embodiments. For the sake of brevity, these will not be described in detail here.

[0117] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, external hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0118] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0119] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0120] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. An efficient order preserving encryption method based on a commercial cipher algorithm, characterized in that, The method comprises the following steps: dividing the plaintext data into a plurality of lists to store the ciphertext data mapped with the plaintext data by using the lists; performing a pseudo-random algorithm according to the key and the intermediate ciphertext data of the ciphertext data to obtain a random number; generating a probability factor set according to the random number and a probability factor derivation algorithm; determining the ciphertext data corresponding to the first plaintext data according to the probability factor set and the ciphertext data, the first plaintext data being the plaintext data currently needing to be encrypted.

2. The method of claim 1, wherein the method is characterized by, The plaintext data comprises a plaintext domain, the ciphertext data comprises a ciphertext domain, the plaintext data is divided into lists according to single bytes, and the plaintext domain is determined as 0 to 255, and the ciphertext domain is determined as one of double bytes or multiple bytes.

3. The method of claim 1, wherein the method is characterized by, The key is a quantum security key generated by quantum key distribution.

4. The method of claim 1, wherein the method is characterized by, The pseudo-random algorithm performed according to the key and the intermediate point data of the ciphertext data to obtain a random number comprises the following steps: taking the key and the intermediate point data of the ciphertext data as input data of an SM3 cryptographic hash algorithm to obtain a message authentication code; performing calculation on the message authentication code by using an SM4 block cipher algorithm to obtain a random number.

5. The method of claim 1, wherein the method is characterized by, The probability factor set generated according to the random number and the probability factor derivation algorithm comprises the following steps: determining the probability factor required for each encryption according to the quotient of the data represented by each table of the probability derivation table and the total byte number of the probability derivation table; judging whether the start byte and the byte number reach the maximum value; in the case that the start byte and the byte number are less than the maximum value, circulating the probability factor derivation algorithm to obtain the probability factor required for encrypting the plaintext data each time; in the case that the start byte and the byte number are equal to the maximum value, re-entering the steps of calculating the random number and generating the probability factor set according to the random number and the probability factor derivation algorithm.

6. The method of claim 1, wherein the method is characterized by, The plaintext data comprises a plaintext domain, the ciphertext data comprises a ciphertext domain, and the determination of the ciphertext data corresponding to the first plaintext data according to the probability factor set and the ciphertext data comprises the following steps: calculating the second plaintext data corresponding to the intermediate ciphertext data of the current ciphertext domain according to the current probability factor; comparing the second plaintext data with the first plaintext data to divide the current plaintext domain and the current ciphertext domain; in the case that the second plaintext data is less than the first plaintext data, determining that the new plaintext domain is the second plaintext data to the maximum plaintext data of the current plaintext domain, and the new ciphertext domain is the intermediate ciphertext data of the current ciphertext domain to the maximum ciphertext data of the current ciphertext domain; in the case that the second plaintext data is greater than the first plaintext data, determining that the new plaintext domain is the minimum value of the current plaintext domain to the second plaintext data, and the new ciphertext domain is the minimum ciphertext data of the current ciphertext domain to the intermediate ciphertext data of the current ciphertext domain; judging whether the element number of the new plaintext domain is one; in the case that the element number of the new plaintext domain is one, determining that the ciphertext data in the new ciphertext domain is the ciphertext data corresponding to the first plaintext data. If the number of elements of the new plaintext domain is not one, re-enter the step of dividing the current plaintext domain and the current ciphertext domain until the number of elements of the new plaintext domain is one.

7. The method of claim 1, wherein the method is characterized by, The step of determining the ciphertext data corresponding to the first plaintext data according to the probability factor set and the ciphertext data comprises: The obtained ciphertext data and the first plaintext data are mapped to establish a mapping relationship, so that the ciphertext data can be stored in the list corresponding to the first plaintext data of the ciphertext data.

8. An efficient in-order decryption method based on a commercial cipher algorithm, characterized by, It comprises: The ciphertext data is divided into multiple lists according to double bytes or multiple bytes, so as to store the plaintext data mapped with the ciphertext data by using the list; According to the midpoint data of the key and the ciphertext data, a pseudo-random algorithm is performed to obtain a random number; According to the random number and the probability factor derivation algorithm, a probability factor set is generated; According to the probability factor set and the ciphertext data, the ciphertext data corresponding to the first plaintext data is determined, and the first ciphertext data is the ciphertext data currently required to be decrypted.

9. The high- efficient order-preserving decryption method based on commercial cipher algorithm according to claim 8, characterized in that, The step of determining the ciphertext data corresponding to the first plaintext data according to the probability factor set and the ciphertext data comprises: According to the current probability factor, the third plaintext data corresponding to the intermediate ciphertext data of the current ciphertext domain is calculated; The first ciphertext data is compared with the intermediate ciphertext data of the current ciphertext domain to divide the current plaintext domain and the current ciphertext domain; In the case that the first ciphertext data is less than or equal to the intermediate ciphertext data, the new plaintext domain is determined to be the minimum plaintext data of the current plaintext domain to the third plaintext data, and the new ciphertext domain is determined to be the minimum ciphertext data of the current ciphertext domain to the intermediate ciphertext data; In the case that the first ciphertext data is greater than or equal to the intermediate ciphertext data, the new plaintext domain is determined to be the third plaintext data to the maximum value of the current plaintext domain, and the new ciphertext domain is determined to be the intermediate ciphertext data to the maximum ciphertext data of the current ciphertext domain; Determine whether the number of elements of the new plaintext domain is one; In the case that the number of elements of the new plaintext domain is one, the plaintext data in the new plaintext domain is determined to be the plaintext data corresponding to the first ciphertext data; In the case that the number of elements of the new plaintext domain is not one, re-enter the step of dividing the current plaintext domain and the current ciphertext domain until the number of elements of the new plaintext domain is one.

10. A computer device, comprising: It comprises: A processor, a memory; And A computer program, wherein the computer program is stored in the memory and executed by the processor, the computer program comprises instructions for executing the high-efficiency order-preserving encryption method based on a commercial cryptographic algorithm of any one of claims 1 to 7 and / or instructions for executing the high-efficiency order-preserving decryption method based on a commercial cryptographic algorithm of any one of claims 8 to 9.

11. A non-transitory computer readable storage medium containing a computer program which, when executed by a processor, causes the processor to perform the method of efficient order preserving encryption based on a commercial cipher algorithm according to any one of claims 1 to 7 and / or to perform the method of efficient order preserving decryption based on a commercial cipher algorithm according to any one of claims 8 to 9.

Images