CN113568927B - Data processing system, method, database engine and device for data processing - Google Patents

Data processing system, method, database engine and device for data processing Download PDF

Info

Publication number
CN113568927B
CN113568927B CN202110707550.7A CN202110707550A CN113568927B CN 113568927 B CN113568927 B CN 113568927B CN 202110707550 A CN202110707550 A CN 202110707550A CN 113568927 B CN113568927 B CN 113568927B
Authority
CN
China
Prior art keywords
queried
item
data
ciphertext
database engine
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202110707550.7A
Other languages
Chinese (zh)
Other versions
CN113568927A (en
Inventor
西方
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huakong Tsingjiao Information Technology Beijing Co Ltd
Original Assignee
Huakong Tsingjiao Information Technology Beijing Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huakong Tsingjiao Information Technology Beijing Co Ltd filed Critical Huakong Tsingjiao Information Technology Beijing Co Ltd
Priority to CN202110707550.7A priority Critical patent/CN113568927B/en
Publication of CN113568927A publication Critical patent/CN113568927A/en
Application granted granted Critical
Publication of CN113568927B publication Critical patent/CN113568927B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24Querying
    • G06F16/245Query processing
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database

Abstract

The embodiment of the invention provides a data processing system, a data processing method, a database engine and a device for data processing. The data query party can acquire attribute information of the item to be queried from a data query request sent by the local end user equipment by accessing the database engine to the MPC platform under the condition that the database engine is used as the data query party, wherein the attribute information is used for indicating whether the item to be queried is executed in plaintext or in ciphertext. Splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried, and sending the plaintext query task and/or the ciphertext query task to the MPC platform. The MPC platform is used for sending the plaintext inquiry task to the corresponding database engine and sending the ciphertext inquiry task to the corresponding ciphertext computing device, so that the mixed inquiry of the plaintext and the ciphertext is realized, the database engine has the capability of the mixed inquiry of the plaintext and the ciphertext, and the processing capability of the database engine is improved.

Description

Data processing system, method, database engine and device for data processing
Technical Field
The present invention relates to the field of network technologies, and in particular, to a data processing system, a method, a database engine, and a device for data processing.
Background
Database engines are now widely used because of their simple standard interface language and powerful and flexible data processing and access capabilities. For example, database engines exist in almost all software systems, from the simplest form where various data is stored to a large database engine that is capable of mass data storage.
However, the existing database engine often only has the capability of processing plaintext data, can only directly inquire local data, and has the problem of weaker processing capability.
Disclosure of Invention
The embodiment of the invention provides a data processing system, a data processing method, a database engine and a device for data processing, so that the database engine has the capability of mixed query of explicit and cipher texts, and the processing capability of the database engine is improved.
To solve the above problems, an embodiment of the present invention discloses a data processing system, where the data processing system includes a multiparty secure computing MPC platform and at least two database engines connected to the MPC platform;
wherein, when any one of the at least two database engines is used as a data query party, the data query party is used for receiving a data query request sent by the local end user equipment;
The data inquiring party is further used for acquiring attribute information of an item to be inquired from the data inquiring request, wherein the attribute information is used for indicating whether the item to be inquired is executed in plaintext or ciphertext;
the data query party is further configured to split the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried;
the data inquiring party is further used for sending the plaintext inquiry task and/or the ciphertext inquiry task to the MPC platform;
the MPC platform is used for sending the plaintext inquiry task to a corresponding database engine and sending the ciphertext inquiry task to a corresponding ciphertext computing device.
In another aspect, an embodiment of the present invention discloses a data processing method, where the method is applied to a database engine in a data processing system, and the method includes:
receiving a data query request sent by local end user equipment;
acquiring attribute information of a to-be-queried item from the data query request, wherein the attribute information is used for indicating whether the to-be-queried item is executed in plaintext or ciphertext;
splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried;
And sending the plaintext inquiry task and/or the ciphertext inquiry task to an MPC platform in a data processing system, so that the MPC platform sends the plaintext inquiry task to a corresponding database engine and sends the ciphertext inquiry task to a corresponding ciphertext computing device.
In yet another aspect, an embodiment of the present invention discloses an apparatus for data processing, comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs comprising instructions for a data processing method as described in one or more of the foregoing.
In yet another aspect, embodiments of the invention disclose a machine-readable medium having instructions stored thereon that, when executed by one or more processors, cause an apparatus to perform a data processing method as described in one or more of the preceding.
The embodiment of the invention has the following advantages:
by accessing the database engine to the MPC platform, the data inquiring party can acquire attribute information of the item to be inquired from a data inquiring request sent by the local end user equipment under the condition that the database engine is used as the data inquiring party, and the attribute information is used for indicating whether the item to be inquired is plaintext execution or ciphertext execution. Splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried, and sending the plaintext query task and/or the ciphertext query task to the MPC platform. And finally, sending the plaintext inquiry task to a corresponding database engine through the MPC platform and sending the ciphertext inquiry task to a corresponding ciphertext computing device, so that the mixed inquiry of the plaintext and the ciphertext is realized. Compared with the situation that the database engine can only perform local plaintext query in the existing mode, the data processing system provided by the embodiment of the invention enables the database engine to have the capability of plaintext and ciphertext hybrid query, and improves the processing capability of the database engine.
Further, compared with a mode of needing to additionally deploy a separate component to realize joint ciphertext query calculation, the method and the device are based on the existing MPC platform, and the capability of the existing database engine is expanded, so that the database engine can provide the capability for plaintext and ciphertext hybrid query calculation, the capability of the existing database system is greatly expanded, and the existing database system can be conveniently accessed to the MPC platform seamlessly.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the description of the embodiments of the present invention will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic diagram of an embodiment of a data processing system of the present invention;
FIG. 2 is a schematic diagram of a portion of a database engine architecture according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a processing architecture according to an embodiment of the present invention;
FIG. 4 is a flow chart of steps of an embodiment of a data processing method of the present invention;
FIG. 5 is a block diagram of an apparatus 800 for data processing according to the present invention; and
Fig. 6 is a schematic diagram of a server in some embodiments of the invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
System embodiment
Referring to FIG. 1, there is shown a schematic diagram of an embodiment of a data processing system of the present invention, the data processing system 00 may include a Secure Multi-Party Computation (MPC) platform 001 and at least two database engines 002 accessing the MPC platform 001. The database engine 002 may represent a structured query language (Structured Query Language, SQL) database or database system, and any database engine 002 accessing the MPC platform 001 may be used as a data query party for data query processing. The database engine 002 may be communicatively coupled to the MPC platform 001, and the database engine 002 may be pre-registered with the MPC platform 001 to enable access.
Specifically, in the case that any one of the at least two database engines 002 is used as a data querying party, the data querying party is configured to receive a data query request sent by the local end user device. The local end user equipment can be any device managed by the data inquiring party, and the local end user equipment can be a computer, a mobile phone, a portable computing device and the like. The data query request may be sent when the local end user device needs to perform data query, and the data query request may be used to instruct the data query party to perform query on the item to be queried in the data query request. The item to be queried may be used to query specific data in the data held by the database engine, e.g., user IDs with incomes greater than 5000 among all user IDs.
The data query party is further configured to obtain attribute information of a term to be queried from the data query request, where the attribute information is used to indicate whether the term to be queried is a plaintext execution or a ciphertext execution. And splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried. And sending the plaintext query task and/or the ciphertext query task to the MPC platform 001. The MPC platform 001 is configured to send the plaintext inquiry task to a corresponding database engine, and send the ciphertext inquiry task to a corresponding ciphertext computing device.
In the embodiment of the invention, the database engine is connected to the MPC platform, so that the data inquiring party can acquire the attribute information of the item to be inquired from the data inquiring request sent by the local end user equipment under the condition that the database engine is used as the data inquiring party, and the attribute information is used for indicating whether the item to be inquired is plaintext execution or ciphertext execution. Splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried, and sending the plaintext query task and/or the ciphertext query task to the MPC platform. And finally, sending the plaintext inquiry task to a corresponding database engine through the MPC platform and sending the ciphertext inquiry task to a corresponding ciphertext computing device, so that the mixed inquiry of the plaintext and the ciphertext is realized. Compared with the situation that the database engine can only perform local plaintext query in the existing mode, the data processing system provided by the embodiment of the invention enables the database engine to have the capability of plaintext and ciphertext hybrid query, and improves the processing capability of the database engine.
Compared with the existing federal database query, the method and the device do not need to collect the data of all the participants to one side, so that the data is leaked, and the joint query of multi-party data can be realized under the condition of effectively ensuring the data privacy of each party.
The database engine to which the item to be queried belongs may be a database engine that holds data corresponding to the item to be queried. For example, assume that item A to be queried is data table 1 and item B to be queried is data table 2. Wherein, data table 1 is held by database engine sql-c1, data table 2 is held by database engine sql-c2, then the database engine to which query term A belongs may be sql-c1, and the database engine to which query term B belongs may be sql-c2.
In one implementation, the data querying party may be specifically configured to: and acquiring attribute information through keywords added in the items to be queried. The keywords added in the item to be queried can be added through the local end user equipment, and the keywords added in the item to be queried can be sent to a data querying party through a data querying request. Different keywords may represent different attribute information, for example, the keyword "AA" may represent attribute information of plaintext execution and the keyword "BB" may represent attribute information of ciphertext execution. Of course, other forms of keywords may be used, and embodiments of the present invention are not limited in this regard. Accordingly, the keyword added in the item to be queried can be directly used as the attribute information, or the attribute information represented by the keyword can be selected according to the keyword added in the item to be queried, so that the operation of acquiring the attribute information is realized. In the embodiment of the invention, the data inquirer can realize the operation of acquiring the attribute information directly according to the keywords added in the item to be inquired by adding the keywords in the item to be inquired, thereby ensuring the acquisition efficiency of the attribute information to a certain extent.
Alternatively, in another implementation, the data querying party may be specifically configured to: and acquiring attribute information through the database engine information of the item to be queried carried in the item to be queried. The database engine information of the item to be queried, which is carried in the item to be queried, can be added through the local end user equipment, and the database engine information of the item to be queried, which is carried in the item to be queried, can be sent to a data querying party through a data querying request. The database engine information of the item to be queried can be used for representing the database engine of the item to be queried, and different database engine information represents different database engines. By way of example, the database engine information may be an identification of the database engine, e.g., may be an identification of a name, number, address, etc. of the database engine. When the data is obtained specifically, whether the database engine to which the item to be queried belongs is the data query party or not can be determined according to the information of the database engine to which the item to be queried belongs, so that the attribute information of the item to be queried is determined. In the embodiment of the invention, the data query party can realize the operation of acquiring the attribute information by directly according to the carried database engine information of the item to be queried, which is carried in the item to be queried, so that the attribute information acquisition efficiency can be ensured to a certain extent.
Optionally, the data querying party may be further specifically configured to: if the database engine represented by the database engine information of the item to be queried is a non-local end, determining the attribute information of the item to be queried as attribute information representing ciphertext execution, and if the database engine represented by the database engine information of the item to be queried is a local end, determining the attribute information of the item to be queried as attribute information representing plaintext execution, so as to realize the operation of acquiring the attribute information through the database engine information of the item to be queried carried in the item to be queried. Specifically, the attribute information representing the execution of the plaintext and the specific form of the attribute information representing the execution of the ciphertext may be preset according to actual requirements. For example, the attribute information characterizing the plaintext execution may not add an additional tag, and the attribute information characterizing the ciphertext execution may be "BB", which is not limited in this embodiment of the present invention.
Further, under the condition that the database engine to which the item to be queried belongs is a non-home terminal, the data to be queried of the item to be queried is held by the non-home terminal, namely, held by other database engines except for the data querying party, so that the attribute information of the item to be queried can be determined to be the attribute information representing ciphertext execution, and further, the follow-up generation of a plaintext query task which is executed locally on the database engine to which the item to be queried belongs, namely, a plaintext query task which is executed on other database engines, can be ensured. Accordingly, under the condition that the database engine to which the item to be queried belongs is the home terminal, the data to be queried of the item to be queried is held by the home terminal, so that the attribute information of the item to be queried can be determined to be attribute information representing plaintext execution, and further, the plaintext query task executed at the home terminal can be generated for the item to be queried. Therefore, when the cross-library joint query is needed, the local end user only needs to send a data query request through the local end user equipment, and the data query party can distinguish whether the data table of the query item to be queried in the data query party is a plaintext data table or a ciphertext data table, so that attribute information is automatically identified, namely whether the execution of plaintext or the execution of ciphertext is automatically identified, and the cross-library query requirement of the local end user can be met to a certain extent.
Optionally, the data querying party may be further specifically configured to: aiming at the attribute information, representing a plaintext executed item to be queried, dividing the item to be queried into a plaintext query task executed at a local end; and characterizing the ciphertext-executed item to be queried according to the attribute information, and splitting the item to be queried into a plaintext query task which is executed locally in a database engine to which the item to be queried belongs and a ciphertext query task which is executed in a ciphertext computing device, so that the data query request is split into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried. In the embodiment of the invention, according to the attribute information of each item to be queried, a plaintext query task or a ciphertext query task is generated in a targeted manner, so that each item to be queried can be ensured to be realized smoothly, and various query requirements of the local terminal user equipment are met.
In specific implementation, the data query party can characterize the item to be queried executed in the plaintext according to the attribute information, and generate a plaintext query task executed at the local end. And according to the attribute information, representing the item to be queried executed by the ciphertext, generating a plaintext query task executed at the local side of the database engine to which the item to be queried belongs, namely, a ciphertext query task executed at a non-local side and a ciphertext query task executed at ciphertext computing equipment. Under the condition that attribute information characterizes a ciphertext-executed item to be queried, a plaintext query task executed by a database engine to which the item to be queried belongs and a ciphertext query task executed by a ciphertext computing device are generated at the same time, so that query result data of the plaintext query task executed by a non-local end can be subjected to further ciphertext computing processing by the ciphertext computing device and then acquired by a data querying party, thereby ensuring data safety to a certain extent and improving query operation precision.
Further, the generated query task may include: task data sources, task codes, and task result parties. Wherein the task data source may indicate a party holding data of a query required for the query task, the task code may be a code for implementing a query function, and the task result party may indicate a party returning a query result of the query task.
Optionally, in the data processing system 00 according to the embodiment of the present invention, each database engine 002 is configured to register, in a startup phase, a data table held in the MPC platform 001; the data table is used to describe the data held by the database engine 002. The MPC platform 001 is further configured to set related information for each registered data table. By way of example, database engine 002 may perform registration operations at startup as the data holder. Specifically, each data table held may be registered with the MPC platform 001 in a data source format. By way of example, the data source format may be: the name/database name/data table name registered by the cipher/database engine to the MPC, the database engine sql-c1 may register the held data table as a name: the database engine sql-c2 may register the held data table xf1testdata as a data table of// sql-c 1/test/tabledata with the name: the data table of cipher/(sql-c 2/test/xf1 testdata. Further, the MPC platform 001 sets related information for each registered data table, the related information of different data tables may be different, and the related information of a data table may be used to locate the data table in the MPC platform 001, so as to avoid the problem of collision when the renaming of the data table occurs, and facilitate the management of the registered data table by the MPC platform 001. For example, the MPC platform 001 may use the content in the data source format registered in the data table as the relevant information. For example, the relevant information of the data table tabledata held by the database engine sql-c1 can be "cipher:// sql-c 1/test/tabledata". Further, the relevant information of the data table xf1testdata held by sql-c2 can be "cipher:// sql-c2/test/xf1testdata".
For any one of the database engines 002, the local end user device of the database engine 002 may further obtain related information of the data tables held by other database engines, and create the ciphertext data table locally in the database engine 002 by using the data tables held by other database engines as the ciphertext data table. In the embodiment of the invention, the data table held by other database engines is used as the ciphertext data table, and the ciphertext data table is locally created in the database engine 002 according to the related information of the data table held by other database engines, so that each database engine can conveniently know which data is held by other database engines in particular, and further the database engine to which the item to be queried belongs is conveniently determined.
Optionally, the related information may be a registration name of the data table in the MPC platform 001, and the home terminal user equipment of the database engine 002 may carry a preset keyword and the registration name in a table establishment statement, so as to use the registration name as a table name of the ciphertext data table, and establish the ciphertext data table in the database engine, thereby implementing an operation of establishing the ciphertext data table. Therefore, the local end user can establish the ciphertext data table only by setting preset keywords and registration names in the establishment statement, so that the establishment efficiency of the ciphertext data table can be ensured to a certain extent.
The preset keywords may be preset, and are used to characterize that the data described by the data table to be created at this time is held by other database engines. Accordingly, if the data described by the data table to be created is held by the database engine itself, the preset keywords and the registration names may not be carried in the table-building statement. For example, the preset keyword may be TBLPROPERTIES. In one implementation example, if the data described by the data table to be created is held by the database engine itself, then the table-building statement may build the table statement for plaintext: the create table xf1test (id INT, mole INT). If the data described by the data table to be created is held by the other database engine, the creation of the ciphertext data table can be performed by adding a preset keyword and a registration name on the basis of the plaintext table creation sentence. Specifically, statements may be created in the plaintext table: the suffix TBLPROPERTIES is added to the create table xf1test (id INT, mole INT) ((ds. Dataset '=' cipher:// xxx-c1/gold/gold 20;)) to indicate that the xf1test table is a ciphertext data table and to alias this table: cipher/(xxx-c 1/gold/gold 20) to facilitate positioning of the MPC platform.
By way of example, assuming that the other database engine holds data described by data table and data described by data table xf1test, then the ciphertext data table may be created by creating a table sentence as follows:
create table tablea(id int(32),price int(32))TBLPROPERTIES('DS.dataset'='cipher://sql-c1/test/tableadata;)
create table xf1test(id int(32),money int(32))TBLPROPERTIES('DS.dataset'='cipher://sql-c2/test/xf1testdata;)
for example, fig. 2 is a schematic diagram of a database engine architecture according to an embodiment of the present invention, as shown in fig. 2, a ciphertext metadata management module may be added to metadata management of the database engine, where the ciphertext metadata management module has a capability of creating and managing a ciphertext data table different from a plaintext data table, and may specifically implement an operation of creating the ciphertext data table locally based on the ciphertext metadata management module.
Optionally, the data querying party may be further specifically configured to: detecting whether the preset keywords are carried in table building sentences corresponding to the data tables to be queried of the items to be queried; if the preset keywords are carried, determining that the database engine to which the item to be queried belongs is a non-home terminal; and if the preset keywords are not carried, determining that the database engine to which the item to be queried belongs is the home terminal.
In particular, each database engine 002 of the data processing system 00 may store the table-building sentence in association with the data table created by the table-building sentence each time a table-building sentence is received. Accordingly, when detecting whether the preset keywords are carried in the table-building statement corresponding to the data table to be queried of each item to be queried, searching the table-building statement corresponding to the data table to be queried of the item to be queried according to the corresponding relation between the pre-stored table-building statement and the data table created by the table-building statement. The data table to be queried for the item to be queried may be pre-designated, and by way of example, the data table to be queried for the item to be queried a may be data table 1, and the data table to be queried for the item to be queried B may be data table 2. And finally, detecting whether the list building statement comprises a preset keyword. In the embodiment of the invention, the data query party can conveniently determine whether the database engine to which the item to be queried belongs is the local end only according to whether the preset keywords are carried in the table-building statement corresponding to the data table to be queried of the item to be queried, so that the efficiency of generating a plaintext query task and/or a ciphertext query task according to the item to be queried can be improved.
In the embodiment of the present invention, after the database engine corresponding to the plaintext query task performs the plaintext query task, the obtained query result data may be sent to the ciphertext computing device. Wherein, the query result data can be all sent in the form of ciphertext. Accordingly, the ciphertext computing device may perform a ciphertext query task to perform ciphertext computing processing on the received query result data to obtain target result data. The data querying party can obtain the target result data.
By way of example, assume that a data querying party receives a data query request of "select id from tablea where price >5000union select id from xf1test where money>4000; "wherein the data described by the data table is held by the data querying party's home terminal and the data described by the data table xf1test is held by the non-home terminal. Then the data inquirer may generate a task:
1. plaintext query task executed by the home terminal: select id from tablea where price >5000 to the ciphertext computing device.
2. Plaintext query tasks performed by non-native ends: select id from xf1test where mole >4000 to ciphertext computing device.
3. Ciphertext query task: and (5) a data merging task.
The data merging task may be a ciphertext python task:
Import pnumpy as pp
table_0=pp.ss("cipher://ds01/fund/t1_k")
table_0=pnp.reshape(table_0,table_0.shape)
table_1=pp.ss("cipher://ds02/fund/t2_1k")
table_1=pnp.reshape(table_1,table_1.shape)
table=table_0
table=pnp.concatenate((table,table_1),axis=0)
pp.reveal(table,"cipher://ds03/result/1621396614551571000"。
the pp.ss ("cipher:// sql-c 1/result/tabledata") may be used to notify an executive of the plaintext query task to encrypt the query result data and send the encrypted query result data to the ciphertext computing device.
The data inquiry party can send all the split tasks to the MPC platform 001 so as to facilitate the MPC platform 001 to store the certificate. And then the MPC platform 001 issues each task to a corresponding executive party, and specifically, a database engine corresponding to the task can be defined in the configuration information of the task so as to facilitate the MPC platform to issue. For example, the MPC platform may be informed of which data source (i.e., database engine) to send the task to by specifying the data source component name in the task. Specifically, the plaintext query task executed by the home terminal may be sent to the data querying party, and the plaintext query task executed by the non-home terminal may be sent to the database engine that holds the data described by the data table xf1 test. And sending the data merging task to the ciphertext computing device. And then, the ciphertext computing equipment performs data merging task to merge the received query result data, namely, queries the same data in the query result data returned by each database engine to obtain target result data. Wherein the tasks may be implemented based on a send computing task interface of the MPC platform 001. It should be noted that, the data querying party may also directly execute the plaintext query task executed by the local end locally, and send only the tasks except for the plaintext query task executed by the local end to the MPC platform 001, so as to save sending resources.
In the embodiment of the invention, the ciphertext calculation processing is further carried out on the query result data queried by each party, so that the data processing system can adapt to more data processing scenes, and the application range of the data processing system is improved.
Fig. 3 is a schematic diagram of a processing architecture according to an embodiment of the present invention, and as shown in fig. 3, a module is further extended in a database engine of the architecture: ciphertext physical plans and ciphertext plan execution, and a database engine of the framework is a new framework supporting plaintext and ciphertext hybrid computation.
Specifically, the ciphertext physical plans may generate query statements that adapt to the MPC platform, as well as partition locally executed database query tasks (i.e., generate plaintext query tasks that are executed by the home end) and non-home end plaintext query tasks and ciphertext query tasks. The data query request may be parsed into a plurality of pipelines by the syntax parsing unit, and the generation logic planning unit may collect various pieces of information required and generate an execution plan required by a specific engine based on the collected information. Specifically, when each step is encountered, the database engine may analyze whether the input of the step relates to a plaintext data table and a ciphertext data table, and if the input of the step relates to both the plaintext data table and the ciphertext data table, the operations after the step may be processed based on the ciphertext engine, that is, the ciphertext computing device performs joint processing in a ciphertext form, so as to avoid information exposure. If only a plaintext data table is involved, that operation may all be performed on the plaintext engine, i.e., specified locally at the database engine.
Further, the ciphertext plan execution module may send the tasks to a remote MPC platform, which may issue each task to a corresponding executive. For example, the plaintext inquiry task executed by the local end is issued to the local end of the data inquiry party, the plaintext inquiry task executed by the other database engine is issued to the corresponding other database engine, and the ciphertext inquiry task is issued to the ciphertext computing device. Further, the ciphertext plan execution module may schedule the local query and send the local partial query result to the ciphertext computing device, and then the ciphertext computing device performs ciphertext-based joint query according to the ciphertext of the query result data returned by each party, that is, execute the ciphertext query task, thereby obtaining the target result data. Finally, the plan execution module/ciphertext plan execution module may perform a result return operation to return the final query result to the home end user device.
Because the database engine participating in the plaintext and ciphertext joint processing can not send data in a plaintext form to other parties, the data sent out by the database engine is only encrypted data to the ciphertext computing equipment, and the ciphertext data table locally created by the database engine is also only created by the database engine, the real data described by the data table is not in the database engine but is registered in other data engines of the MPC system, thereby ensuring the data security.
Method embodiment
With reference to FIG. 4, there is shown a flow chart of steps of an embodiment of a data processing method of the present invention, the method being applied to a database engine in a data processing system, as shown in FIG. 4, the method comprising:
step 101, receiving a data query request sent by the home terminal user equipment.
Step 102, obtaining attribute information of the item to be queried from the data query request, wherein the attribute information is used for indicating whether the item to be queried is plaintext execution or ciphertext execution.
And step 103, splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried.
Step 104, the plaintext inquiry task and/or the ciphertext inquiry task are/is sent to an MPC platform in the data processing system, so that the MPC platform sends the plaintext inquiry task to a corresponding database engine, and sends the ciphertext inquiry task to a corresponding ciphertext computing device.
In the embodiment of the invention, the database engine is connected to the MPC platform, so that the database engine can acquire the attribute information of the item to be queried from the data query request sent by the local end user equipment, and the attribute information is used for indicating whether the item to be queried is plaintext execution or ciphertext execution. Splitting a data query request into a plaintext query task and/or a ciphertext query task according to attribute information of a to-be-queried item, and sending the plaintext query task and/or the ciphertext query task to an MPC platform so as to send the plaintext query task to a corresponding database engine through the MPC platform and send the ciphertext query task to a corresponding ciphertext computing device, thereby realizing the mixed query of plaintext and ciphertext. Compared with the situation that the database engine can only perform local plaintext query in the existing mode, the data processing system provided by the embodiment of the invention enables the database engine to have the capability of plaintext and ciphertext hybrid query, and improves the processing capability of the database engine.
Optionally, in an implementation manner, the step of acquiring attribute information of the item to be queried from the data query request may include:
and S21, acquiring the attribute information through the keywords added in the item to be queried.
Optionally, in another implementation manner, the step of acquiring attribute information of the item to be queried from the data query request may include:
and S31, acquiring the attribute information through the database engine information of the item to be queried carried in the item to be queried.
Optionally, the operation of obtaining the attribute information through the database engine information, which is carried in the item to be queried and to which the item to be queried belongs, may specifically include:
step S41, if the database engine represented by the database engine information of the item to be queried is a non-home terminal, determining that the attribute information of the item to be queried is attribute information representing ciphertext execution;
and step S42, if the database engine represented by the database engine information of the item to be queried is a local end, determining the attribute information of the item to be queried as the attribute information representing the execution of the plaintext.
Optionally, the step of splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried may specifically include:
Step S51, representing a plaintext to-be-queried item aiming at attribute information, and dividing the plaintext to-be-queried item into a plaintext query task executed at a local end; and
and S52, representing the item to be queried executed by the ciphertext aiming at the attribute information, and splitting the item to be queried into a plaintext query task executed locally in a database engine to which the item to be queried belongs and a ciphertext query task executed in the ciphertext computing equipment.
For the method embodiment, since it is substantially similar to the system embodiment, the description is relatively simple, and the implementation manner of each step and the technical effect achieved may be referred to in part of the description of the system embodiment, which will not be described in detail herein.
In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described by differences from other embodiments, and identical and similar parts between the embodiments are all enough to be referred to each other.
The embodiment of the invention provides a database engine, which can be any database engine in the data processing system, and the database engine can be used for executing the data processing method.
An embodiment of the invention provides an apparatus for data processing, comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs comprising instructions for performing a data processing method as described above.
Fig. 5 is a block diagram illustrating an apparatus 800 for data processing according to an example embodiment. For example, apparatus 800 may be a mobile phone, computer, digital broadcast terminal, messaging device, game console, tablet device, medical device, exercise device, personal digital assistant, or the like.
Referring to fig. 5, apparatus 800 may include one or more of the following components: a processing component 802, a memory 804, a power component 806, a multimedia component 808, an audio component 810, an input/output (I/O) interface 812, a sensor component 814, and a communication component 816.
The processing component 802 generally controls overall operation of the apparatus 800, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to perform all or part of the steps of the methods described above. Further, the processing component 802 can include one or more modules that facilitate interactions between the processing component 802 and other components. For example, the processing component 802 can include a multimedia module to facilitate interaction between the multimedia component 808 and the processing component 802.
The memory 804 is configured to store various types of data to support operations at the apparatus 800. Examples of such data include instructions for any application or method operating on the device 800, contact data, phonebook data, messages, pictures, videos, and the like. The memory 804 may be implemented by any type or combination of volatile or nonvolatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.
The power supply component 806 provides power to the various components of the device 800. The power components 806 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power for the device 800.
The multimedia component 808 includes a screen between the device 800 and the user that provides an output interface. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may sense not only the boundary of a touch or slide action, but also the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and/or a rear camera. The front camera and/or the rear camera may receive external multimedia data when the apparatus 800 is in an operational mode, such as a photographing mode or a video mode. Each front camera and rear camera may be a fixed optical lens system or have focal length and optical zoom capabilities.
The audio component 810 is configured to output and/or input audio signals. For example, the audio component 810 includes a Microphone (MIC) configured to receive external audio signals when the device 800 is in an operational mode, such as a call mode, a recording mode, and a voice information processing mode. The received audio signals may be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, audio component 810 further includes a speaker for outputting audio signals.
The I/O interface 812 provides an interface between the processing component 802 and peripheral interface modules, which may be a keyboard, click wheel, buttons, etc. These buttons may include, but are not limited to: homepage button, volume button, start button, and lock button.
The sensor assembly 814 includes one or more sensors for providing status assessment of various aspects of the apparatus 800. For example, the sensor assembly 814 may detect an on/off state of the device 800, a relative positioning of the components, such as a display and keypad of the device 800, the sensor assembly 814 may also detect a change in position of the device 800 or a component of the device 800, the presence or absence of user contact with the device 800, an orientation or acceleration/deceleration of the device 800, and a change in temperature of the device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an acceleration sensor, a gyroscopic sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.
The communication component 816 is configured to facilitate communication between the apparatus 800 and other devices, either in a wired or wireless manner. The device 800 may access a wireless network based on a communication standard, such as WiFi,2G or 3G, or a combination thereof. In one exemplary embodiment, the communication component 816 receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component 816 further includes a Near Field Communication (NFC) module to facilitate short range communications. For example, the NFC module may be implemented based on radio frequency information processing (RFID) technology, infrared data association (IrDA) technology, ultra Wideband (UWB) technology, bluetooth (BT) technology, and other technologies.
In an exemplary embodiment, the apparatus 800 may be implemented by one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), digital Signal Processing Devices (DSPDs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic elements for executing the methods described above.
In an exemplary embodiment, a non-transitory computer readable storage medium is also provided, such as memory 804 including instructions executable by processor 820 of apparatus 800 to perform the above-described method. For example, the non-transitory computer readable storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.
Fig. 6 is a schematic diagram of a server in some embodiments of the invention. The server 1900 may vary considerably in configuration or performance and may include one or more central processing units (central processing units, CPU) 1922 (e.g., one or more processors) and memory 1932, one or more storage media 1930 (e.g., one or more mass storage devices) that store applications 1942 or data 1944. Wherein the memory 1932 and storage medium 1930 may be transitory or persistent. The program stored in the storage medium 1930 may include one or more modules (not shown), each of which may include a series of instruction operations on a server. Still further, a central processor 1922 may be provided in communication with a storage medium 1930 to execute a series of instruction operations in the storage medium 1930 on the server 1900.
The server 1900 may also include one or more power supplies 1926, one or more wired or wireless network interfaces 1950, one or more input/output interfaces 1958, one or more keyboards 1956, and/or one or more operating systems 1941, such as Windows Server, mac OS XTM, unixTM, linuxTM, freeBSDTM, and the like.
A non-transitory computer readable storage medium, which when executed by a processor of an apparatus (server or terminal) enables the apparatus to perform the data processing method shown in fig. 4.
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the invention and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.
It is to be understood that the invention is not limited to the precise arrangements and instrumentalities shown in the drawings, which have been described above, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the invention is limited only by the appended claims.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.
The foregoing has outlined rather broadly the principles and embodiments of the present invention in order that the detailed description of the invention may be better understood, and in order that the present invention may be better understood, a database engine, and a data processing system, method, and apparatus for data processing that are provided herein; meanwhile, as those skilled in the art will have variations in the specific embodiments and application scope in accordance with the ideas of the present invention, the present description should not be construed as limiting the present invention in view of the above.

Claims (13)

1. A data processing system comprising a multi-party secure computing MPC platform and at least two database engines accessing the MPC platform;
wherein, each database engine is used for registering the data table held by the MPC platform in the starting stage; the data table is used for describing data held by the database engine;
the MPC platform is used for setting related information for each registered data table;
in the case that any one of the at least two database engines is used as a data query party, the data query party is used for receiving a data query request sent by the local end user equipment;
The data inquiring party is further used for acquiring attribute information of an item to be inquired from the data inquiring request, wherein the attribute information is used for indicating whether the item to be inquired is executed in plaintext or ciphertext;
the data query party is further configured to split the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried;
the data inquiring party is further used for sending the plaintext inquiry task and/or the ciphertext inquiry task to the MPC platform;
the MPC platform is used for sending the plaintext inquiry task to a corresponding database engine and sending the ciphertext inquiry task to a corresponding ciphertext computing device;
for any database engine, the local end user equipment obtains related information of a data table held by other database engines, wherein the related information is a registration name of the data table in the MPC platform; carrying preset keywords and the registration names in a table establishment statement to take the registration names as table names of a ciphertext data table, and establishing the ciphertext data table in the database engine local;
the data query party is further specifically configured to detect whether the preset keyword is carried in a table-building statement corresponding to a data table to be queried for each item to be queried; if the preset keywords are carried, determining that the database engine to which the item to be queried belongs is a non-home terminal; and if the preset keywords are not carried, determining that the database engine to which the item to be queried belongs is the home terminal.
2. The system according to claim 1, wherein the data querying party is specifically configured to obtain the attribute information through a keyword added in the item to be queried.
3. The system of claim 1, wherein the data querying party is specifically configured to obtain the attribute information through database engine information carried in the item to be queried and to which the item to be queried belongs.
4. The system of claim 3, wherein the data querying party is further configured to determine that the attribute information of the item to be queried is attribute information representing ciphertext execution if a database engine represented by the database engine information to which the item to be queried belongs is a non-home terminal; if the database engine represented by the database engine information of the item to be queried is the local end, determining the attribute information of the item to be queried as the attribute information representing the execution of plaintext.
5. The system according to any one of claims 1 to 4, wherein the data querying party is further specifically configured to characterize, for attribute information, a plaintext to be queried item, which is partitioned into a plaintext query task that is performed at a local end; and aiming at the attribute information, representing the ciphertext-executed item to be queried, splitting the item to be queried into a plaintext query task which is executed locally on a database engine to which the item to be queried belongs and a ciphertext query task which is executed on the ciphertext computing device.
6. A method of data processing, the method being applied to a database engine in a data processing system, the method comprising:
registering the held data table with the MPC platform in the starting stage; the data table is used for describing data held by the database engine;
setting related information for each registered data table;
for any database engine, the local end user equipment obtains related information of a data table held by other database engines, wherein the related information is a registration name of the data table in the MPC platform; carrying preset keywords and the registration names in a table establishment statement to take the registration names as table names of a ciphertext data table, and establishing the ciphertext data table in the database engine local; the preset keywords are used for representing that the data described by the data table required to be created at this time are held by other database engines;
receiving a data query request sent by local end user equipment;
acquiring attribute information of a to-be-queried item from the data query request, wherein the attribute information is used for indicating whether the to-be-queried item is executed in plaintext or ciphertext;
detecting whether the preset keywords are carried in table building sentences corresponding to the data tables to be queried of the items to be queried; if the preset keywords are carried, determining that the database engine to which the item to be queried belongs is a non-home terminal, and determining that the attribute information of the item to be queried is attribute information representing ciphertext execution; if the preset keywords are not carried, determining that the database engine to which the item to be queried belongs is a home terminal, and determining that the attribute information of the item to be queried is attribute information representing plaintext execution;
Splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried;
and sending the plaintext inquiry task and/or the ciphertext inquiry task to an MPC platform in a data processing system, so that the MPC platform sends the plaintext inquiry task to a corresponding database engine and sends the ciphertext inquiry task to a corresponding ciphertext computing device.
7. The method of claim 6, wherein obtaining attribute information of the item to be queried from the data query request comprises:
and acquiring the attribute information through the keywords added in the item to be queried.
8. The method of claim 6, wherein obtaining attribute information of the item to be queried from the data query request comprises:
and acquiring the attribute information through the database engine information of the item to be queried carried in the item to be queried.
9. The method of claim 8, wherein the obtaining the attribute information through database engine information, which is carried in the item to be queried and to which the item to be queried belongs, includes:
if the database engine represented by the database engine information of the item to be queried is a non-home terminal, determining the attribute information of the item to be queried as the attribute information representing ciphertext execution;
If the database engine represented by the database engine information of the item to be queried is the local end, determining the attribute information of the item to be queried as the attribute information representing the execution of plaintext.
10. The method according to claim 6, wherein splitting the data query request into a plaintext query task and/or a ciphertext query task according to the attribute information of the item to be queried comprises:
aiming at the attribute information, representing a plaintext executed item to be queried, dividing the item to be queried into a plaintext query task executed at a local end; and
aiming at the attribute information, representing the item to be queried executed by the ciphertext, splitting the item to be queried into a plaintext query task executed locally on a database engine to which the item to be queried belongs and a ciphertext query task executed on the ciphertext computing device.
11. A database engine, characterized in that the database engine is any one of the database engines in a data processing system, the database engine being adapted to perform the data processing method according to any one of claims 6 to 10.
12. An apparatus for data processing comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors, the one or more programs comprising instructions for performing the data processing method of any of claims 6 to 10.
13. A machine readable medium having instructions stored thereon which, when executed by one or more processors, cause an apparatus to perform the data processing method of any of claims 6 to 10.
CN202110707550.7A 2021-06-24 2021-06-24 Data processing system, method, database engine and device for data processing Active CN113568927B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110707550.7A CN113568927B (en) 2021-06-24 2021-06-24 Data processing system, method, database engine and device for data processing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110707550.7A CN113568927B (en) 2021-06-24 2021-06-24 Data processing system, method, database engine and device for data processing

Publications (2)

Publication Number Publication Date
CN113568927A CN113568927A (en) 2021-10-29
CN113568927B true CN113568927B (en) 2024-03-29

Family

ID=78162661

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110707550.7A Active CN113568927B (en) 2021-06-24 2021-06-24 Data processing system, method, database engine and device for data processing

Country Status (1)

Country Link
CN (1) CN113568927B (en)

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105471826A (en) * 2014-09-04 2016-04-06 中电长城网际系统应用有限公司 Ciphertext data query method, device and ciphertext query server
CN107506659A (en) * 2017-07-27 2017-12-22 西安电子科技大学 A kind of data protection system and method for the Universal Database based on SGX
EP3471333A1 (en) * 2017-10-11 2019-04-17 Gemalto Sa A method for a communication device to retrieve a plaintext from a ciphertext memorized in a remote database
CN110825767A (en) * 2019-11-15 2020-02-21 江苏满运软件科技有限公司 Data query method, platform, equipment and storage medium
CN111221842A (en) * 2018-11-27 2020-06-02 北京奇虎科技有限公司 Big data processing system and method
CN112148739A (en) * 2020-09-25 2020-12-29 世融能量科技有限公司 Ciphertext indexing method and system independent of encryption database
CN112182644A (en) * 2020-09-11 2021-01-05 华控清交信息科技(北京)有限公司 Data processing method and device and electronic equipment
CN112800088A (en) * 2021-01-19 2021-05-14 东北大学 Database ciphertext retrieval system and method based on bidirectional security index

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9213867B2 (en) * 2012-12-07 2015-12-15 Microsoft Technology Licensing, Llc Secure cloud database platform with encrypted database queries
US10540356B2 (en) * 2017-10-25 2020-01-21 International Business Machines Corporation Transparent analytical query accelerator over encrypted data
US10698883B2 (en) * 2017-10-25 2020-06-30 International Business Machines Corporation Data coherency between trusted DBMS and untrusted DBMS

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105471826A (en) * 2014-09-04 2016-04-06 中电长城网际系统应用有限公司 Ciphertext data query method, device and ciphertext query server
CN107506659A (en) * 2017-07-27 2017-12-22 西安电子科技大学 A kind of data protection system and method for the Universal Database based on SGX
EP3471333A1 (en) * 2017-10-11 2019-04-17 Gemalto Sa A method for a communication device to retrieve a plaintext from a ciphertext memorized in a remote database
CN111221842A (en) * 2018-11-27 2020-06-02 北京奇虎科技有限公司 Big data processing system and method
CN110825767A (en) * 2019-11-15 2020-02-21 江苏满运软件科技有限公司 Data query method, platform, equipment and storage medium
CN112182644A (en) * 2020-09-11 2021-01-05 华控清交信息科技(北京)有限公司 Data processing method and device and electronic equipment
CN112148739A (en) * 2020-09-25 2020-12-29 世融能量科技有限公司 Ciphertext indexing method and system independent of encryption database
CN112800088A (en) * 2021-01-19 2021-05-14 东北大学 Database ciphertext retrieval system and method based on bidirectional security index

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
基于DBMS外层的数据库加密系统研究与设计;赵卓;刘博;厉京运;;计算机工程与设计;20080628(第12期);全文 *

Also Published As

Publication number Publication date
CN113568927A (en) 2021-10-29

Similar Documents

Publication Publication Date Title
WO2017084176A1 (en) Information pushing method and device
EP3041204A1 (en) Method for prompting calling request and device for the same
CN105843951B (en) Data query method and device
CN112187862B (en) Task processing method and device for task processing
CN106547547B (en) data acquisition method and device
WO2017185567A1 (en) Resource searching method and apparatus
CN111968640A (en) Voice control method and device, electronic equipment and storage medium
CN115185717A (en) Interface calling method and device, electronic equipment and storage medium
CN104951522B (en) Method and device for searching
US9854559B2 (en) Method and device for pushing user information
CN113568927B (en) Data processing system, method, database engine and device for data processing
CN112862349B (en) Data processing method, device and equipment based on ABS service data
CN112486617B (en) Ciphertext data processing architecture, method, apparatus and machine readable medium
CN110989987B (en) Portal webpage generation method and device, client, server and storage medium
CN110147426B (en) Method for determining classification label of query text and related device
CN112003788B (en) Data request sending method, device, equipment and medium
CN113778385B (en) Component registration method, device, terminal and storage medium
CN106528700B (en) Information processing method, device and equipment
CN112860771A (en) Architecture difference acquisition method and system
CN105550201B (en) Data display method and device
CN115827601A (en) Data processing method, device, equipment and storage medium
CN114168839A (en) Picture information processing method and device and electronic equipment
CN116232572A (en) Key application method and device, electronic equipment and storage medium
CN114612202A (en) Data processing method, device, equipment, readable storage medium and product
CN116246370A (en) Method and device for sharing digital car key and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant