CN116303591A - Method and device for data storage and query - Google Patents

Abstract

The embodiment of this specification provides a method and device for data storage and query, which is used to realize the privacy protection query that protects the privacy of the query party when the data storage party and the query party are inconsistent when multiple business parties in cooperation share data. . Specifically, the storage party builds a symmetric encryption key based on the agreed data identifier, and encrypts the data and stores it on the external storage platform. When the queryer queries data through the external storage platform, the data ciphertext can be obtained based on the agreed data identifier. , and through secure interaction with the storage party, a decryption key is constructed to decrypt the data ciphertext obtained from the external storage platform and obtain the data to be queried. This technical concept can improve query efficiency on the basis of effectively protecting data privacy.

Description

Method and device for data storage and query

technical field

One or more embodiments of this specification relate to the field of data security technology, and in particular to methods and devices for multi-party data storage and query.

Background technique

In the network environment, the internal environment isolated by hardware or network environment is usually called intra-domain, and the environment exposed to the public network or unlimited is called extra-domain. The domain often has a certain ability to block the access of other nodes in different environments, but it is limited by the infrastructure and resources in the domain, such as storage space, network environment, etc., and there is no specific restriction on access outside the domain, which can break through storage and bandwidth. restrictions, such as cloud servers.

With the development of the network, there is a large amount of business data that needs to be shared. For example, a group company and its subsidiaries need to share some or all business data, multiple sub-applications share user data of an application, and multiple cooperative alliance parties share data, such as network blacklist data. For shared data (which may be referred to as public data), there may be situations where multiple users have query requirements. When the public data is stored in the storage space in the domain, corresponding storage pressure and access pressure are generated in the domain, and the pressure is relatively high under massive data. If public data is stored outside the domain, there may be a risk of data breaches. Therefore, how to securely store and query data outside the domain is a problem worth studying.

Contents of the invention

One or more embodiments in this specification describe a method and device for data storage and query, so as to solve one or more problems mentioned in the background art.

According to the first aspect, a data storage method is provided, the method comprising: using a local private key Ka to encrypt the first data identifier of the data to be stored in a first encryption mode to obtain a first identifier ciphertext; using the The first identification ciphertext is used as an encryption key to encrypt the data to be stored to obtain a first data ciphertext; and the first data ciphertext and the first data identification are correspondingly stored in a predetermined external storage platform.

In one embodiment, the encrypting the first data identifier of the data to be stored by using the local private key Ka to obtain the first identifier ciphertext includes: calculating the first data identifier through a predetermined hash calculation to obtain the first Hash value; map the first hash value to the first point on the elliptic curve through elliptic curve encryption; use the local private key Ka to perform a point product operation on the first point to obtain the first identification code arts.

In one embodiment, the encryption method of using the first identification ciphertext as an encryption key to encrypt the data to be stored is symmetric encryption.

In one embodiment, the storing the first data ciphertext and the first data identifier correspondingly to a predetermined external storage platform includes: processing the first data identifier using a second encryption method to obtain a second identifier Ciphertext: correspondingly storing the first data ciphertext and the second identification ciphertext to a predetermined external storage platform.

In one embodiment, the storing the first data ciphertext and the first data identifier correspondingly to a predetermined external storage platform includes: storing the first data identifier, the first data ciphertext and the current The identity of the storage party is correspondingly stored on the external storage platform, so that the queryer can determine the identity of the current storage party according to the corresponding storage party ID when querying according to the first data identification.

In one embodiment, when the predetermined condition is satisfied, the local private key Ka is updated to Ka', and the data to be stored is stored again by using the updated local private key.

According to the second aspect, there is provided a data query method for querying data stored on an external storage platform via the method of claim 1, the method comprising: sending a query request to the external storage platform based on the current query data identifier, The external storage platform feeds back the second data ciphertext corresponding to the query data identifier; decrypting the second data ciphertext using the decryption key obtained through secure interaction with the storage party corresponding to the second data ciphertext , to obtain the data to be queried, wherein the decryption key is consistent with the query ID ciphertext obtained by encrypting the query data ID with the private key of the storage party in the first encryption mode.

In one embodiment, the query data identifier is consistent with the second data identifier corresponding to the second data ciphertext, and the second data identifier is in the form of ciphertext obtained by processing the second encryption method with the second The data ciphertext is stored in the external storage platform; the sending of the query request to the external storage platform based on the current query data identification includes: processing the query data identification with a second encryption method to obtain the query identification ciphertext; sending the query request to the external storage platform The query request includes the query identification ciphertext, so that the external storage platform can feed back the second data ciphertext when the ciphertext form of the second data identification is consistent with the query identification ciphertext.

In one embodiment, the external storage platform also feeds back the identity of the storage party of the second data ciphertext, and the secure interaction with the storage party of the second data ciphertext further includes: based on the storage party The identity of the user determines the storage party of the second data ciphertext, so as to perform secure interaction with the storage party.

In one embodiment, the decryption key is obtained by: encrypting the query data identifier with the local key Kb to obtain the one-time ciphertext of the query data identifier; providing the one-time ciphertext of the query data identifier To the storage side, so that the storage side uses the local key Ka to encrypt the primary ciphertext of the query data identification, thereby feeding back the secondary ciphertext of the query data identification; through the reverse of the local key Kb, the Decrypt the secondary ciphertext identified by the query data to obtain the decryption key.

According to a third aspect, there is provided a data storage device, the device comprising:

The encryption unit is configured to use the local private key Ka to encrypt the first data identifier of the data to be stored in a first encryption mode to obtain a first identification ciphertext; and encrypt the first identification ciphertext as an encryption key The data to be stored is obtained by obtaining a first data ciphertext;

The storage unit is configured to use the first data ciphertext and the first data identifier to store in a predetermined external storage platform.

According to the fourth aspect, there is provided a data query device for querying data stored in an external storage platform via the device provided by the third aspect, the data query device includes:

The query unit is configured to send a query request to the external storage platform based on the current query data identifier, so that the external storage platform can feed back the second data ciphertext corresponding to the query data identifier;

The decryption unit is configured to decrypt the second data ciphertext by using a decryption key obtained through secure interaction with the storage party corresponding to the second data ciphertext to obtain the data to be queried, wherein the decryption key is the same as the The above-mentioned query data identifier is consistent with the query identifier ciphertext encrypted by the storage party's private key in the first encryption mode.

According to a fifth aspect, there is provided a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, it causes the computer to execute the method of the first aspect or the second aspect.

According to a sixth aspect, there is provided a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the first aspect or the first aspect is realized. two ways.

Through the method and device provided by the embodiment of this specification, in the case of multiple parties sharing service data, privacy protection query is performed. Under the specific technical conception, the storage party can encrypt the data and store it outside the domain (external storage platform), and the query party that needs business data can safely interact with the storage party through an exchangeable encryption scheme, so as not to disclose the local Securely obtain the decryption key of data outside the domain in the case of data, so as to decrypt the encrypted data obtained from outside the domain. This technical concept can not only protect the data security of the data outside the domain, but also protect the query conditions of the query party, and improve the security of data stored outside the domain and the reliability of the query when multiple parties share data.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without making creative efforts.

FIG. 1 shows a schematic diagram of an implementation architecture according to this specification;

Fig. 2 shows a flow chart of a data storage method according to an embodiment of the specification;

FIG. 3 shows a flowchart of a data query method according to an embodiment of the present specification;

FIG. 4 shows a schematic diagram of a specific implementation scenario according to this specification;

Figure 5 shows a schematic block diagram of a data storage device according to one embodiment;

Fig. 6 shows a schematic block diagram of a data query device according to an embodiment.

Detailed ways

The technical solutions provided in this specification will be described below in conjunction with the accompanying drawings.

In order to understand the technical solutions in this specification more clearly, firstly describe the technical background proposed by the technical solutions in this specification in combination with a specific implementation scenario.

Fig. 1 shows a specific implementation framework of this specification. The implementation architecture involves multiple business parties and external storage platforms. A single business party can provide corresponding business support for related businesses (such as search business, query business, collection and payment business, navigation business, etc.) performed by each user on the corresponding terminal, and record corresponding business data. Among them, various business parties may have an affiliation or cooperation relationship, so that part or all of the business data may be shared. For each business party, the external storage platform belongs to an external environment, and it belongs to other business service parties independent of each business party, or a third party, such as a cloud storage service provider that provides storage services.

A single business party among multiple business parties can store the public data shared with other business parties in the storage space of the external storage platform, so that other business parties can query and use related data. Since storing business data on an external storage platform may reveal data privacy, encrypted storage can be used. In the form of encrypted storage, the query of other business parties involves the decryption process. The decryption process may involve data interaction between the query business party (hereinafter referred to as the query party) and the storage business party (hereinafter referred to as the storage party) that stores data on the external storage platform.

Usually, data privacy protection issues also exist between multiple business parties. For example, the query party does not want the storage party to know the target data it is querying, that is, it conducts a privacy-preserving query to protect the privacy of the query party. In this way, this manual proposes a solution to the following technical problem: how to securely interact between the querying party and the storage party, so that the querying party obtains the decryption key of the data stored by the storage party on the external storage platform, and does not disclose the query target to the storage party .

Specifically, this specification puts forward the following technical idea: when storing data on an external storage platform, the storage party stores it in the form of data identification and data ciphertext. Among them, the data ciphertext is determined by encrypting the corresponding business data. In order to facilitate the query party to obtain the decryption key, the business data is encrypted symmetrically, and the encryption key is constructed by the data identifier. Among them, the data identifier can be a unique identifier of business data, such as the user's unique ID or mobile phone number on the business platform, or a field identifier describing a certain field of business data, such as occupation, consumption item, etc. Among them, the data identification can be stored in the external storage platform in plain text or cipher text.

Furthermore, when querying business data, on the one hand, the querying party can use the data identifier as the query condition, send a query request to the external storage platform, query related data entries, and obtain the corresponding ciphertext data; on the other hand, it can safely interact with the storage party , obtain the encryption/decryption key of the relevant data entry, and decrypt the ciphertext data locally, so as to obtain the plaintext form of the data to be queried.

In the case of storage in ciphertext, it can disclose the corresponding encryption method to other business parties, so that other business parties can encrypt the local data identifier with the same encryption method, and use the encrypted data identifier to send a query request to the external storage platform.

In the case that multiple business parties share data as public data, the business data stored by the storage party on the external storage platform can also be associated with the storage party's identification, such as the storage party's name, code, etc. At this point, the querying party can first query the corresponding data entry from the external storage platform according to the querying conditions (such as plaintext or ciphertext data identification, etc.), which includes the storage party identification and ciphertext data. In this way, the query party can determine the data storage party based on the storage party ID, and then interact with the storage party to obtain a decryption key, thereby decrypting the ciphertext data.

In this way, the data provided by the storage party is stored in the form of ciphertext on the external storage platform, which effectively protects data privacy. The queryer and the storage party securely interact to obtain the decryption key, providing effective protection for the querying party's query conditions. In addition, storing data on an external storage platform can avoid the storage pressure and access pressure caused by the storage party providing shared data for multiple business parties, making the query more efficient.

In the following, a specific embodiment shown in FIG. 2 will be used to describe the safe storage process of data by the storage party.

Fig. 2 shows a data storage process according to an embodiment of this specification. The subject of execution of this process may be a computer, device, or server with certain computing capabilities, for example, it may be any one of the multiple business parties in FIG. 1 . The data storage process shown in FIG. 2 can be used to store data on an external storage platform. The process shown in FIG. 2 uses a piece of data to be stored as an example to describe the storage process. As shown in Figure 2, the data storage process may include: Step 201, use the local private key Ka to encrypt the first data identifier of the data to be stored in the first encryption mode to obtain the first identifier ciphertext; Step 202, use The first identification ciphertext is used as an encryption key to encrypt the data to be stored to obtain the first data ciphertext; step 203, store the first data ciphertext and the first data identification in correspondence to a predetermined external storage platform.

First, in step 201, the first data identifier of the data to be stored is encrypted using the local private key Ka in the first encryption mode to obtain the first identifier ciphertext. Here, the data to be stored may be any piece of business data that needs to be stored in the current batch. The current batch can store one or more pieces of data. The data identifier can be an identifier agreed upon by other business parties sharing data, such as a unique user ID, key data fields, etc.

The private key Ka may be a value randomly generated by the storage party. The first encryption method can be an encryption method agreed upon with other data parties. In order to facilitate safe interaction with other business parties so that other business parties can securely obtain the decryption key, the first encryption method can adopt an encryption method that satisfies the commutative law, for example Elliptic curve encryption, etc.

Taking the first encryption method as an elliptic curve encryption method (ECC) as an example, the storage party can map the first data identifier to a point on the elliptic curve, and then use the key Ka to perform a point product operation on the point on the elliptic curve, the result Can still be a point on an elliptic curve. The point on the elliptic curve or the coordinates of the corresponding point can be used as the encryption result, such as denoted as Ka(IDa).

In an optional embodiment, in order to further protect the data identifier, ECC hashing may also be used as the first encryption method. At this time, the storage party can map the hash value obtained by the hash calculation of the first data identifier to a point on the elliptic curve, and then use the key Ka to perform a point product operation on the point on the elliptic curve to obtain The point or the coordinates of the corresponding point is used as the encryption result, such as Ka(H(IDa)).

In other implementation manners, the first encryption method may also be other encryption methods satisfying the commutative law, which will not be repeated here. The encryption result for the first data identifier may be called the first identifier ciphertext correspondingly. In the case that there are multiple pieces of data to be stored in the current batch, for each piece of data to be stored, corresponding identification ciphertexts are determined for each data identifier.

Then, via step 202, the data to be stored is encrypted by using the first identification ciphertext as an encryption key to obtain a first data ciphertext.

Here, the current piece of data to be stored corresponds to the first data identifier, so the first identification ciphertext can be used as an encryption key to encrypt the current piece of data to be stored to obtain the corresponding first data ciphertext. Correspondingly, when there are multiple pieces of data to be stored in the current batch, for each piece of data to be stored, the corresponding data to be stored is encrypted using the corresponding identification ciphertext to obtain the corresponding data ciphertext.

For a single piece of data to be stored, symmetric encryption can be used to encrypt business data. Among them, in the symmetric encryption mode, the same key can be used for encryption and decryption. Therefore, in the case of the same data identifier, it is convenient to construct a decryption key through the data identifier in the query condition of the inquiring party. The symmetric encryption method may be, for example, an encryption algorithm such as DES (Data Encryption Standard, Data Encryption Standard) or AES (Advanced Encryption Standard, Advanced Encryption Standard), which will not be repeated here.

The storage party may use the first identification ciphertext to encrypt only the business data, or may encrypt the first data identification or the concatenated data of the first identification ciphertext and the business data (value), as the data corresponding to the relevant data entry. For example, an encryption result of encrypting the concatenated data of the first identification ciphertext and the service data is recorded as Cipher=Enc(Ka(H(IDa)), value).

Further, according to step 203, the first data ciphertext and the first data identifier are correspondingly stored in a predetermined external storage platform.

The first data identifier can be used as a data index item for obtaining the first data ciphertext, and in the key-value pair Key-Value storage mode, it is used as a key, so it is correspondingly stored with the first data ciphertext. As a specific example, the first data ciphertext may be stored in the form of (ID, Cipher) tuples. The storage party can store data to the external storage platform by calling the data storage interface, submitting transactions, etc.

The predetermined external storage platform may be a storage space in a predetermined external storage platform (such as a cloud storage server). The predetermined external storage platform may be a dedicated public data storage space provided for the current storage party and its business parties sharing data, or it may be a storage space determined by the external storage platform according to its own storage rules, which is not limited in this specification.

In an optional implementation mode, multiple business parties can store locally generated business data to a predetermined external storage platform, and multiple business parties can perform data query, and they can also use data identification and data ciphertext when storing data 1. Store data on the external storage platform in a storage method corresponding to the identity of the storage party. For example, data can be stored in the form of a triple (ID, Merchant, Cipher), where the Merchant can be the identity of the storage party, such as the name, abbreviation, and identity code of the business party.

In a possible design, in order to avoid leakage of data identification information, when storing data, the first data identification may be in the form of a second identification ciphertext encrypted by a second encryption method. The second encryption method may include, for example, one or more of calculating a hash value according to an agreed hash calculation method, adding salt and encrypting according to an agreed salt value (inserting an agreed value at an agreed position), and the like.

In addition, according to an embodiment, considering the effectiveness of privacy protection, the storage party's local private key Ka can be updated according to predetermined conditions, such as periodic conditions (such as updating once every other month), or being read Conditions for fetching the number of data pieces (for example, every 1000 pieces of data are read and updated once). When the local private key Ka is updated to Ka', the stored data can be stored again according to the updated private key Ka=Ka'. The current storage process is also applicable to the process of using the new key Ka' to store service data.

Fig. 3 shows a flowchart of a data query method according to a specific embodiment. The query process shown in FIG. 3 is used to query the service data stored on the external storage platform by the storage party according to the process shown in FIG. 2 . The subject of execution of this process may be a computer, device, or server with certain computing capabilities, for example, it may be any one of the multiple business parties in FIG. 1 . The data query process shown in FIG. 3 can be used to obtain shared data stored by cooperative business parties from an external storage platform. The process shown in FIG. 3 uses a piece of data to be queried as an example to describe the storage process. As shown in Figure 3, the data query process may include: step 301, based on the current query data identification, send a query request to the external storage platform, for the external storage platform to feed back the second data ciphertext corresponding to the query data identification; step 302. Use the decryption key obtained through secure interaction with the storage party corresponding to the second data ciphertext to decrypt the second data ciphertext to obtain the data to be queried, wherein the decryption key and the query data identifier are stored in the The query identification ciphertext obtained by encrypting in the first encryption mode is consistent.

First, through step 301, based on the current query data identifier, a query request is sent to the external storage platform, so that the external storage platform can feed back the second data ciphertext corresponding to the query data identifier.

The current query data identifier can be the data identifier agreed with other business parties for query, such as user unique ID, data key field, etc. Such as recorded as IDi. During the period of time, the inquiring party can use one or more query data identifiers to perform data query at a time, and the current query data identifier can be any one of them.

It is worth noting that, according to the storage rules agreed by each business party, the data identifiers that the storage party can store on the external storage platform can be in plain text or cipher text. Therefore, the query request sent by the query party can include query The plaintext or ciphertext of the data identifier. As a specific example, when the storage party uses the second encryption method to process the local data identifier and obtains the ciphertext form of the data identifier and stores it on the external storage platform together with the corresponding data ciphertext, the queryer can use the same encryption method to encrypt the query Data ID, and include the ciphertext of the query data ID in the query request. This encryption method is called the second encryption method, for example, and the second encryption method may include calculating the hash value according to the agreed hash calculation method, adding salt encryption according to the agreed salt value (inserting the agreed value at the agreed position), etc. one or more.

The external storage platform can match the plaintext or ciphertext form of the query data identifier included in the query request with the data identifier in plaintext or ciphertext form in the predetermined storage space, so as to determine the second data identifier consistent with the query data identifier, And feed back the corresponding second data ciphertext to the querying party. That is to say, based on the above query request, the querying party can receive the data ciphertext matching the query data identifier from the external storage platform.

In an optional implementation, multiple business parties can store corresponding business data to the external storage platform according to the data identification format agreed above, and the external storage platform also feeds back the identity of the storage party with the second data ciphertext for The query party determines the storage party of the data according to the identity.

Then, through step 302, the second data ciphertext is decrypted by using the decryption key obtained through secure interaction with the storage party of the second data ciphertext, to obtain the data to be queried.

After the querying party obtains the second data ciphertext, it needs to decrypt it. Since the storage party uses symmetric encryption when storing data, and the encryption key is determined by the second data identifier corresponding to the second data ciphertext, and the second data identifier is consistent with the query data identifier, therefore, the query data identifier can be used to determine the decryption key. key.

The construction of the decryption key requires interaction with the storage party. As in the previous storage process, assuming that the private key of the storage party is Ka, and the second data identifier is marked as ID ₂ , the encryption key is, for example, Ka(ID ₂ ), Ka(H(ID ₂ )), etc. Recording the query key as ID _q requires the query party and the storage party to securely construct corresponding decryption keys Ka(IDq), Ka(H(IDq)), etc., so that the query party does not disclose ID _q to the storage party, and the storage party The party does not disclose Ka to the inquiring party.

In this way, secure computing can be performed by the query side and the storage side. Taking the decryption key as Ka(H(IDa)) as an example, the query party can first use the local private key Kb to encrypt the query data identifier ID _q to obtain the primary ciphertext corresponding to the query data identifier ID _q , and the encryption method is ECC hash Greek, if the one-time ciphertext is Kb(H(IDq)). Afterwards, the query party can provide the primary ciphertext to the storage party, and the storage party uses its local private key Ka to encrypt the primary ciphertext twice to obtain the secondary ciphertext KaKb(H(IDq)) to feed back to the query square. Due to the exchangeability of the encryption method, KaKb(H(IDq))=KbKa(H(IDq)). The inquiring party uses the inverse Kb ^-1 of the local key to decrypt the secondary ciphertext, such as Kb ^-1 KbKa(H(IDq)), and obtains the decryption key Ka(H(IDq))=Ka(H(ID ₂ )) .

If the encryption key is constructed in other ways, the querying party can also use other data interactions to securely obtain the decryption key, which will not be repeated here. In this way, the second party can decrypt the second data ciphertext through the decryption key, such as Cipher=Enc(Ka(H(ID ₂ )), value), and obtain the value of the data to be queried after decryption, or the decryption key and the data to be queried The splicing result of , that is, [Ka(H(ID ₂ )), value], just take out the value of the data to be queried from it.

Wherein, according to the different forms of data ciphertext stored by the storage party, the process of determining the decryption key may be performed before the query process, or may be performed after the query process, or may be performed in parallel with the query process. For example, when the query party stores the data in the form of (ID, Cipher), the storage party can execute the decryption key construction process in parallel before, after, and after the query, while the query party stores the data in the form of (ID, Merchant, Cipher). In the case of storing data, the inquiring party can first obtain the storage party's identity Merchant and the ciphertext Cipher of the data to be queried through the query process, and then perform secure interactions with the storage party indicated by the storage party's identity Merchant to determine the decryption key.

In order to clarify the technical concept of this specification, Figure 4 shows a schematic diagram of a specific application scenario for data storage and query using the technical concept of this specification. As shown in Fig. 4, system A, system B, system C, system D, system E, and system F are six business parties with a cooperative relationship, which can share part of business data. The business party (which can be used as a storage party) that provides shared business data includes at least A system and B system. Therefore, when system A and system B store locally generated data in an external storage system, they can store data in the format of (ID _i , Merchant _j , Cipher _i ). Among them, ID _i is the data identifier agreed upon by each business party, such as a mobile phone number, etc. Merchant represents the identity information of the storage party. Different values of Merchant _j can correspond to system A or system B. Cipher _i is the data corresponding to ID _i ciphertext form.

When business parties such as systems C, D, E, and F need to access shared data, they can first send a query request based on the query data identifier ID _q to the external storage platform to obtain the data "(ID _i , Merchant _j , Cipher _i ) ”, so as to determine whether the corresponding transfer data is stored by system A or system B based on Merchant _j . Furthermore, based on the query data identifier ID _q, interact with the storage party indicated by Merchant _j to obtain a decryption key, thereby decrypting Cipher _i to obtain the data to be queried.

It is worth noting that for system A and system B in Figure 4, the data shared locally to other systems can be directly retrieved from the local without querying the external storage system. In the case of using other shared data , since the other storage places are unique, the corresponding storage places can be determined directly. If other storage parties are not unique, you need to determine the storage party according to the storage party ID, and then interact with the storage party to obtain the decryption key. Accordingly, the corresponding query process and decryption key determination process can be carried out in any order described above. After obtaining the decryption key and the data ciphertext obtained from the query, use the decryption key to decrypt the data ciphertext to obtain the queried data.

Looking back at the above process, in the process of secure storage and query for data shared by multiple parties, the storage party can use the agreed-upon data identifier to encrypt the data and store the data in an external storage platform. The data identifier obtains the data ciphertext stored by the storage party, and securely interacts with the storage party to use the query data identifier to construct a decryption key, so that the data ciphertext obtained from the external storage platform can be decrypted to obtain the data to be queried. On the one hand, this technical concept protects the privacy of data stored in the external storage system, and on the other hand, it protects the privacy of the query data identification of the query party, and provides an effective solution for using external storage platforms to store data in the case of multi-system sharing, avoiding only local The storage pressure and access pressure caused by storing data can improve the efficiency of data query.

According to another embodiment, a device for data storage is also provided. Figure 5 shows a data storage device 500 according to one embodiment. As shown in Figure 5, the device 500 may include:

The encryption unit 501 is configured to use the local private key Ka to encrypt the first data identifier of the data to be stored in a first encryption mode to obtain a first identification ciphertext; and use the first identification ciphertext as an encryption key to encrypt the data to be stored Storing the data to obtain the first data ciphertext;

The storage unit 502 is configured to store the first data ciphertext and the first data identifier in a predetermined external storage platform correspondingly.

According to yet another embodiment, an apparatus for data query is also provided. Used to query data stored on an external storage platform via the apparatus 500 shown in FIG. 5 . Fig. 6 shows a data query device 600 according to an embodiment.

As shown in Figure 6, the device 600 may include:

The query unit 601 is configured to send a query request to the external storage platform based on the current query data identifier, so that the external storage platform can feed back the second data ciphertext corresponding to the query data identifier;

The decryption unit 602 is configured to decrypt the second data ciphertext by using the decryption key obtained through secure interaction with the storage party corresponding to the second data ciphertext to obtain the data to be queried, wherein the decryption key and the query data identifier are passed through the storage party The query identification ciphertext obtained by encrypting the private key in the first encryption mode is consistent.

According to a possible design, the apparatus 600 may further include an interaction unit (not shown). The interaction unit may be configured to securely interact with the storage party to determine a decryption key. Specifically, the interaction unit can be configured to determine the decryption key by:

Utilize the local key Kb to encrypt the query data identifier to obtain the primary ciphertext of the query data identifier;

The primary ciphertext of the query data identifier is provided to the storage party, so that the storage party uses the local key Ka to encrypt the primary ciphertext of the query data identifier, thereby feeding back the secondary ciphertext of the query data identifier;

The secondary ciphertext identified by the query data is decrypted by the inverse of the local key Kb to obtain the decryption key.

It is worth noting that the devices 500 and 600 shown in Figure 5 and Figure 6 correspond to the methods described in Figure 2 and Figure 3 respectively, and the corresponding descriptions in the method embodiments described in Figure 2 and Figure 3 are also applicable to the device 500 , 600, which will not be repeated here.

According to another embodiment, there is also provided a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, the computer is made to execute the methods described in conjunction with FIG. 2 , FIG. 3 , etc. .

According to yet another embodiment, there is also provided a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the implementation in conjunction with Fig. 2 and Fig. 3 is realized. etc. described methods.

Those skilled in the art should be aware that, in the above one or more examples, the functions described in the embodiments of this specification may be implemented by hardware, software, firmware or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The specific implementations described above further describe the purpose, technical solutions and beneficial effects of the technical concept of this specification in detail. It should be understood that the above description is only a specific implementation of the technical concept of this specification. It is not intended to limit the scope of protection of the technical concept of this specification. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification shall be included in the scope of protection of the technical concept of this specification. within.

Claims (14)

1. A method of data storage, the method comprising:

encrypting a first data identifier of data to be stored by adopting a local private key Ka in a first encryption mode to obtain a first identifier ciphertext;

encrypting the data to be stored by using the first identification ciphertext as an encryption key to obtain a first data ciphertext;

and storing the first data ciphertext and the first data identifier to a preset external storage platform correspondingly.

2. The method of claim 1, wherein encrypting the first data identifier of the data to be stored using the local private key Ka to obtain a first identifier ciphertext comprises:

after the first data identifier is subjected to hash calculation in a preset mode, a first hash value is obtained;

mapping the first hash value into a first point on an elliptic curve in an elliptic curve encryption mode;

and performing point multiplication operation on the first point by using a local private key Ka to obtain the first identification ciphertext.

3. The method of claim 1, wherein the encryption manner of encrypting the data to be stored using the first identification ciphertext as an encryption key is symmetric encryption.

4. The method of claim 1, wherein the storing the first data ciphertext corresponding to the first data identification to a predetermined external storage platform comprises:

processing the first data identifier by using a second encryption mode to obtain a second identifier ciphertext;

and storing the first data ciphertext and the second identification ciphertext to a preset external storage platform correspondingly.

5. The method of claim 1, wherein the storing the first data ciphertext corresponding to the first data identification to a predetermined external storage platform comprises:

and storing the first data identifier, the first data ciphertext and the identity identifier of the current storage party to the external storage platform correspondingly, so that the inquiring party can determine the identity of the current storage party according to the corresponding identity identifier of the storage party when inquiring according to the first data identifier.

6. The method of claim 1, wherein the local private key Ka is updated to Ka' and the data to be stored is restored using the updated local private key in case that a predetermined condition is satisfied.

7. A method of querying data stored on an external storage platform via the manner of claim 1, the method comprising:

based on the current query data identification, sending a query request to an external storage platform so that the external storage platform feeds back a second data ciphertext corresponding to the query data identification;

and decrypting the second data ciphertext by using a decryption key obtained by carrying out secure interaction with a storage party corresponding to the second data ciphertext to obtain data to be queried, wherein the decryption key is consistent with a query identification ciphertext obtained by encrypting the query data identification in a first encryption mode by using a private key of the storage party.

8. The method of claim 7, wherein the query data identifier is consistent with a second data identifier corresponding to the second data ciphertext, and the second data identifier is stored on an external storage platform in a ciphertext form processed by a second encryption method and the second data ciphertext;

the sending the query request to the external storage platform based on the current query data identifier comprises:

processing the query data identifier by using a second encryption mode to obtain a query identifier ciphertext;

and sending a query request containing the query identification ciphertext to an external storage platform, so that the external storage platform feeds back the second data ciphertext under the condition that the external storage platform compares the ciphertext form of the second data identifier consistent with the query identification ciphertext.

9. The method of claim 7, wherein the external storage platform further feeds back an identity of the party storing the second data ciphertext, and the securely interacting with the party storing the second data ciphertext further comprises:

and determining the storage party of the second data ciphertext based on the identity of the storage party, so as to perform safe interaction with the storage party.

10. The method of claim 7, wherein the decryption key is obtained by:

encrypting the query data identifier by using a local key Kb to obtain a primary ciphertext of the query data identifier;

providing the primary ciphertext of the query data identifier to the storage party so that the storage party encrypts the primary ciphertext of the query data identifier by using a local key Ka, thereby feeding back the secondary ciphertext of the query data identifier;

and decrypting the secondary ciphertext identified by the query data through the inverse of the local key Kb to obtain the decryption key.

11. A data storage device, the device comprising:

the encryption unit is configured to encrypt a first data identifier of data to be stored by adopting a local private key Ka in a first encryption mode to obtain a first identifier ciphertext; and

encrypting the data to be stored by using the first identification ciphertext as an encryption key to obtain a first data ciphertext;

and the storage unit is configured to store the first data ciphertext and the first data identifier to a preset external storage platform correspondingly.

12. An apparatus for querying data stored on an external storage platform via the apparatus provided in claim 11, the apparatus comprising:

the query unit is configured to send a query request to the external storage platform based on the current query data identifier so that the external storage platform feeds back a second data ciphertext corresponding to the query data identifier;

and the decryption unit is configured to decrypt the second data ciphertext by using a decryption key obtained by carrying out secure interaction with a storage party corresponding to the second data ciphertext to obtain data to be queried, wherein the decryption key is consistent with a query identification ciphertext obtained by encrypting the query data identification in a first encryption mode by a private key of the storage party.

13. A computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of any of claims 1-10.

14. A computing device comprising a memory and a processor, wherein the memory has executable code stored therein, which when executed by the processor, implements the method of any of claims 1-10.

Images