CN105791283A - Circle range search method specific to encrypted spatial data - Google Patents

Abstract

The invention belongs to the technical field of searchable encryption, and specifically relates to a circle range search method specific to encrypted spatial data. The method mainly comprises that a search user generates a search token according to a target circle search range and uploads the search token to a cloud server, wherein the search token comprises search ranges of a first square and a second square, the first square is the inscribed square of a target circle, and the second square is the circumscribed square of the target circle; the cloud server searches according to the search token, thus obtaining intermediate search results and sends the intermediate search results and the search token to a trustable third party; the trustable third party filters wrong results, encrypts the surplus final search results again and returns to the cloud server; and the cloud server sends the final search results to the search user. The method has the advantages that security and privacy are ensured, and moreover, the circle range search method specific to the encrypted spatial data is realized efficiently.

Description

A kind of circular scope searching method of the spatial data for encryption

Technical field

The invention belongs to and can search for encryption technology field, be specifically related to the circular scope searching method of a kind of spatial data for encryption.

Background technology

Cloud computing is the information technology (InformationTechnology of future generation that academia is paid close attention to the most with industrial quarters, IT) framework, it has and numerous up to now ripe is applied to many characteristics that the IT technology of industrial quarters does not have, such as: on-demand acquisition self-help service, ubiquitous network insertion, marry again independent of the resource pool in place, the quick-expansion of resource, pay-per-use and risk.Cloud computing summarizes huge calculating resource, storage resource and other Service Sources, has provided the user the convenient reliable service of multiple novelty, has brought huge business opportunity and interests to cloud service provider.In many services, data outsourcing service has provided the user more easy, the efficient and reliable data management mode of one due to it, and becomes the focus extensively paid close attention to industrial quarters by academia.The operations such as the mass data of oneself can be contracted out to Cloud Server by user, the inquiry that these data conducted interviews when needs.This service mode is the pressure that user releases its local datastore and maintenance, and can allow user's these data of on-demand access whenever and wherever possible.In a word, this service mode brings great convenience for user.

But, after the data of oneself are stored in Cloud Server by user, data are just completely controlled by server, then make the data being stored on cloud be faced with serious safety and privacy threats, are mainly manifested in the following aspects:

1. security threat.Although Cloud Server make use of safer memory technology and provides relatively reliable storage device, but, in actual cloud environment, there is the opponent of numerous malice, they are for respective interests, it is intended to distort or peep the user data being stored on Cloud Server.

2. privacy threats.Cloud Server is not completely believable.He perhaps can be interested for the particular content of the data of storage.Such as, for cloud service provider oneself, under the ordering about of economic interests, the data content of user is probably carried out the operations such as statistical analysis by them even can peep the sensitive data of individual.So the threat of privacy is also very big.

The safety of data and privacy concern serious constrain cloud computing service development.Further, if simple and crude adding ciphertext data with complicated AES and design strict access control mechanisms and can greatly reduce efficiency and the quality of service.Such as keyword search, range searching etc. services and even can provide.Cloud Server can become a simple expensive storage medium.

In order to solve the problems referred to above, designing one and can search for encryption method, the method must is fulfilled for several features:

1. the owner of data always on can not provide service to search user.Main storage and access task all must be provided by Cloud Server.Data owner only need to do some encryptions before outsourcing data and generate the basic operations such as index.Once data arrive Cloud Server, the owner of data only needs the regular task of doing the lightweights such as key updating

2., in order to ensure the efficiency of service, the searching algorithm under the AES of data and ciphertext all can not be too complicated.And, data must have good index structure.

3. the security and privacy of data and search content depends on AES and searching algorithm, and distinct methods has different safety and privacy intensity.In general can search for needing to balance between security privacy intensity and the efficiency of encryption method.

Based on this, can search for encryption technology and obtain research and the contribution of a lot of scholar.But great majority are all based on keyword query and the method for square range searching.Method lacking very of circular scope search.Circular scope search be a kind of be recently proposed in border circular areas return point set can search for encryption method.It and kNN inquiry are more close, but need not preset the quantity k returning Query Result.Circular scope search needs the radius (query context) of definition circle.Recently, at present it has been proposed that two symmetric keys can search for AES to support that circular scope is searched for.But, wherein the efficiency comparison of the generation of search token, data encryption and query script is low.

This method is based on rectangular extent search, and in one rectangular area of rectangular extent searching requirement return, institute is a little.The rectangular area search realized at present is all based on public key cryptography.But both method data structures are all linear, are not suitable for big data environment.In order to solve this problem, many approach application tree such as R-tree and kd-tree is as index.The inquiry of these methods is faster than the method using linear structure.But these algorithms may cause important information to lose because of the leakage of order information.Some methods ensure that order information is not revealed and but sacrifice efficiency.With the accuracy sacrificing result, some methods guarantee that order information is not revealed.

Summary of the invention

The purpose of the present invention, it is simply that for the problems referred to above, it is proposed to the circular scope searching method of a kind of spatial data for encryption.

The technical method of the present invention is: the circular scope searching method of a kind of spatial data for encryption, it is characterised in that comprise the following steps:

A. search user produces search token according to target circle query context, and search token is uploaded to Cloud Server；Described search token includes the first square and the second foursquare query context, and the first square is for connecing square in target circle, and the second square is the external square that target is circular；

B. Cloud Server scans for obtaining intermediate search results according to search token, and intermediate search results and search token are sent to trusted third party；In described Cloud Server, storage has the spatial data of encryption；

C. intermediate search results and search token are deciphered by trusted third party, check when plaintext which result is not in target circle query context, and will will return Cloud Server after the result filtration of mistake after remaining final Search Results re-encrypted；

D. final searched result is sent to search user by Cloud Server.

Further, search for user described in step a and produce search token according to target circle query context method particularly includes: search user inputs the center of circle and the radius of circle, it is assumed that the center of circle is (X, Y), radius is R, then can obtain the first square query context Q_inFor $\{(X-\frac{\sqrt{2}}{2}R,Y-\frac{\sqrt{2}}{2}R),(X+\frac{\sqrt{2}}{2}R,Y+\frac{\sqrt{2}}{2}R)\},$ Second square query context Q_exFor { (X-R, Y-R), (X+R, Y+R) }.

Further, described in step a, the first square and the second foursquare query context are uploaded to Cloud Server after ASPE AES is encrypted.

Further, in Cloud Server described in step b, storage has the spatial data of encryption, the concrete encryption method of spatial data is: adopt R tree as data directory structure, under environment expressly, all of data point is all used corresponding grouping strategy to be divided into bucket, bucket is the minimum enclosed rectangle of R tree, and the leaf node of R tree is corresponding to the data point of spatial database；Adopt ASPE AES that bucket is encrypted: to use V ∈ R^dRepresenting the summit of minimum enclosed rectangle, and use ASPE AES to encrypt summit, the dimension of V is extended by ASPE AES, obtains V₊=(V^T|1)^T, then pass through use matrix key M and be encrypted and obtain V_E=M^-1V₊；Wherein, matrix key M is reversible (d+1) × (d+1) matrix；Then in Cloud Server, the spatial data of the encryption of storage at least includes the relation of encryption data point, the parent node of R tree and child nodes.

Further, the search of Cloud Server described in step b token scans for method particularly includes:

According to the first square query context generated in step a and the second square query context, judge whether four limits of query context intersect with bucket, if, then judge successively the child node of this node whether with the intersecting of query context, repeating inquiry till data point, crossing data point is also generated intermediate search results by all limits this step of backed off after random of traversal queries scope.

Beneficial effects of the present invention is, the present invention achieves the circular scope searching method of the spatial data for encryption efficiently while ensureing safety and privacy.

Accompanying drawing explanation

Fig. 1 is the schematic flow sheet of the method for the present invention；

Fig. 2 is the logical schematic of the search token that user produces；

Wherein, center represents the center of circle, and Radius represents radius.

Detailed description of the invention

Below the present invention is described in detail

In EP-CRS, adopt R tree as data directory structure.Under environment expressly, all of data point is all used corresponding grouping strategy to be divided into bucket.Bucket is the MBR (Minimumboundingrectangle, minimum enclosed rectangle) of R tree.The non-leaf nodes of R tree is all the child node of higher level node, and the leaf node of R tree all corresponds to the data point of spatial database.

The non-leaf nodes of R tree is different with the cipher mode of the leaf node of R tree.Non-leaf nodes R_i(i∈Z^*) by two summit (V_m,V_n) represent, wherein m, n ∈ Z^*.Use V ∈ R^dRepresent the summit of MBR, and use ASPE AES to encrypt it.First the dimension of V is extended by this algorithm, obtains V₊=(V^T|1)^T.Then, by using matrix key M, reversible (d+1) × (d+1) matrix encrypts V.Encrypted vertex representation is V_E=M^-1V₊.In the present invention, all summits of the MBR of R tree are encrypted in an identical manner.For the consideration improving encryption efficiency, for leaf node (data point), it is possible to encrypted by any effective safe cryptographic technique.The present invention adopts Advanced Encryption Standard AES to carry out encrypted source data point.

As it is shown in figure 1, be the concrete grammar flow process of the present invention, the concrete implementation method of the present invention is as follows:

One circular space range searching generates a search token method particularly includes: in reality, user wonders nearest place (such as: the nearest hotel within 2 kilometers), so, the query context of location Based service naturally becomes a circle；User needs the geographical position (longitude and latitude) providing oneself as the center of inquiry circle；Additionally, user also needs to specify the radius of circle.Therefore, user inputs all of information should be (longitude, latitude) and radius.

As in figure 2 it is shown, the circle search scope provided according to search user, first, it is converted into two foursquare query contexts by changing circular query context.One of them connects square in circular, and another is the external square of circle.So easily calculate two square query contexts.Allow (X, Y) as the coordinate in the center of circle, and R is as the value of radius.Then, internal inquiry Q_inJust can be expressed as $\{(X-\frac{\sqrt{2}}{2}R,Y-\frac{\sqrt{2}}{2}R),(X+\frac{\sqrt{2}}{2}R,Y+\frac{\sqrt{2}}{2}R)\},$ And external inquiry Q_ex{ (X-R, Y-R), (X+R, Y+R) } can be expressed as.Finally, it is possible to use normal rectangular extent search technique to solve Q_inAnd Q_ex.In rectangular extent is searched for, Q_inAnd Q_exShould first be converted to four half-planes.Therefore, haveQ_inCalculating process and Q_exIt is duplicate, here with Q_exBe calculated as example.

Four hyperplane of square query context there are eight anchor points.Owing to four hyperplane are all of equal value, with one of them some H₁Be calculated as example.H₁It is by the determination of two parameter a and b.Randomly choose an anchor pointWhereinIt isThe anchor point of opposite side.According to linear algebra, allow A:Then there is B:Obviously, solve equation A and B to obtainIn this manner it is possible to be that each hyperplane generates two anchor points, the anchor point of all hyperplane in like manner can be obtained.

Followed by query context encryption expressly.Before encryption first by one-dimensional for anchor point vector extensions: α^≤=((α^≤)^T(-0.5||α^≤||²))^TWithThen, key M is used to encrypt α^≤And α^>: with ${\mathrm{\α}}_E^{>}=M^T{\mathrm{\α}}_{+}^{>}.$

Finally, it is thus achieved that the ciphertext of H is $H_E=r({\mathrm{\α}}_E^{\≤}-{\mathrm{\α}}_E^{>}),$ Wherein r is a random normal number.

On the basis of above-mentioned analysis, it is possible to obtain to Q_exSearch token is (H_1E,H_2E,H_3E,H_4E), wherein H_1EIt is H₁Ciphertext.Additionally, in order to protect one-dimensional inquiry privacy, four elements of random alignment search token vector.This operation is without influence on Query Result.Q_inThe search generation of token and Q_exIt is duplicate.Search token is by userGenerate.

Cloud Server carries out the search under ciphertext and calculates: Cloud Server achieves rectangular extent search (Q_ex,Q_in).Cloud Server stores following information: encryption searching algorithm, the parent node of encryption data point and R tree and the relation of child nodes.And, the relation of parent node and child nodes is not encrypted.

First method to carry out intersection judgement.Obviously, it is impossible in inquiry rectangle, only whether judge the crossing instances of rectangle by testing the summit of an index rectangle.On the contrary, it should determine that summit is whether in suitable query context.And, the actual cross-mode having more than three kinds.Therefore, it is difficult to check all of cross-mode, and determine searching route.So, the present invention analyzes this problem from opposite angles.If the summit of an index range is at identical scope H^>In, it can be deduced that such conclusion: query context rectangle and index rectangle are non-intersect.Check that four hyperplane of inquiry rectangle judge whether index rectangle does not intersect with query context one by one.The present invention provides a Not_In_Halfspace (V by name_E,H_iE), the function of i=1,2,3,4 is as intersecting descriminator.The input of this function is a pass point V_EEncryption hyperplane H with an inquiry_iE.Its one bit of output showsWhether set up.Function needs to calculate H_iE·V_EExport result.Specifically it is calculated as follows:

$\begin{array}{c}{H}_{iE}\·V_E=r({\mathrm{\α}}_E^{\≤}-{\mathrm{\α}}_E^{>})\·V_E\\ =r{\left(\right(M^T{\mathrm{\α}}_{+}^{\≤})-(M^T{\mathrm{\α}}_{+}^{>}\left)\right)}^T{M}^{-1}{V}_{+}\\ =r{({\mathrm{\α}}_{+}^{\≤}-{\mathrm{\α}}_{+}^{>})}^T{V}_{+}\\ =r\left(\right||{\mathrm{\α}}^{>}-V||-||{\mathrm{\α}}^{\≤}-V|\left|\right)\end{array}$

WhereinWithIt is hyperplane H_iEThe anchor point encrypted.Parameter r is non-negative random integers and V_EIt it is the ciphertext of V.If H_iE·V_E< 0, then V does not existIn.If V does not existOn, it is possible to allow function export 1,

If as it has been described above, two summits of index rectangle are at identical half spaceMay determine that, inquiry matrix does not intersect with index matrix.When exporting four 0, matrix intersects.The details of crossing instances evaluation algorithm is as follows:

Cloud Server adopts above-mentioned algorithm to complete remaining search operation as basic tool.Γ is allowed to add overstocked R tree and Σ is Search Results.In the method for the invention, application BFT algorithm search Γ.First, the root of this algorithm accesses Γ and apply algorithm 1 to detect whether query context intersects with root node.If intersecting, the child that it will travel through all of from left to right.Otherwise, this algorithm stops and returning 0.For there being the node of grandchild node, if query context is non-intersect with it, algorithm will not access child nodes.But, when algorithm returns 1, this algorithm will travel through all of child nodes, and each child is carried out same operation.If the child of node is data point and algorithm return 1, searching algorithm will return all of child the element as Σ.Otherwise, other nodes of the Γ that this algorithm continues search for.

Γ is respectively adopted above-mentioned searching algorithm and calculates Q_exAnd Q_in.Σ ex and Σ in respectively Q_exAnd Q_inDisaggregation.Therefore, if a data point occurs in Σ ex and Σ in, it should put into last disaggregation Σ *.Otherwise, data point will be placed in intermediate object program set Σ+.Then, Σ+and search token Q_exAnd Q_inIt is sent to TTP.TTP can filter out Σ+in erroneous point and return remaining point to Cloud Server.Finally, Cloud Server is put into remaining point in last results set Σ * and returns to user.

TTP filters out the method for error result:

TTP is overall situation trusted third party, so TTP holds ASPE key and AES key.TTP receives intermediate object program Σ+or Σ ex and search token Q from Cloud Server there_exAnd sQ_in。

First TTP with matrix key M deciphering search token, can obtain connecing and external square in circular query context.Then euclidean geometry is utilized can to obtain the equation of circular query context.Then, TTP AES key is deciphered all of data point and the equation of the value substitution circle of point being judged, whether this point is in circle.If, this point is put into final disaggregation Σ * and otherwise filters out this point.

Finally, TTP by final disaggregation Σ * encrypting and transmitting to Cloud Server.

In sum, this method achieves the circular scope searching method of the spatial data for encryption efficiently while ensureing safety and privacy.

Claims (5)

1. the circular scope searching method for the spatial data of encryption, it is characterised in that comprise the following steps:

A. search user produces search token according to target circle query context, and search token is uploaded to Cloud Server；Described search token includes the first square and the second foursquare query context, and the first square is for connecing square in target circle, and the second square is the external square that target is circular；

B. Cloud Server scans for obtaining intermediate search results according to search token, and intermediate search results and search token are sent to trusted third party；In described Cloud Server, storage has the spatial data of encryption；

C. intermediate search results and search token are deciphered by trusted third party, check when plaintext which result is not in target circle query context, and will will return Cloud Server after the result filtration of mistake after remaining final Search Results re-encrypted；

D. final searched result is sent to search user by Cloud Server.

2. the circular scope searching method of a kind of spatial data for encryption according to claim 1, it is characterized in that, search for user described in step a and produce search token according to target circle query context method particularly includes: search user inputs the center of circle and the radius of circle, assume that the center of circle is for (X, Y), radius is R, then can obtain the first square query context Q_inFor $\{(X-\frac{\sqrt{2}}{2}R,Y-\frac{\sqrt{2}}{2}R),(X+\frac{\sqrt{2}}{2}R,Y+\frac{\sqrt{2}}{2}R)\},$ Second square query context Q_exFor { (X-R, Y-R), (X+R, Y+R) }.

3. the circular scope searching method of a kind of spatial data for encryption according to claim 2, it is characterised in that described in step a, the first square and the second foursquare query context are uploaded to Cloud Server after ASPE AES is encrypted.

4. the circular scope searching method of a kind of spatial data for encryption according to claim 3, it is characterized in that, in Cloud Server described in step b, storage has the spatial data of encryption, the concrete encryption method of spatial data is: adopt R tree as data directory structure, under environment expressly, all of data point is all used corresponding grouping strategy to be divided into bucket, and bucket is the minimum enclosed rectangle of R tree, and the leaf node of R tree is corresponding to the data point of spatial database；Adopt ASPE AES that bucket is encrypted: to use V ∈ R^dRepresenting the summit of minimum enclosed rectangle, and use ASPE AES to encrypt summit, the dimension of V is extended by ASPE AES, obtains V₊=(V^T|1)^T, then pass through use matrix key M and be encrypted and obtain V_E=M^-1V₊；Wherein, matrix key M is reversible (d+1) × (d+1) matrix；Then in Cloud Server, the spatial data of the encryption of storage at least includes the relation of encryption data point, the parent node of R tree and child nodes.

5. the circular scope searching method of a kind of spatial data for encryption according to claim 4, it is characterised in that the search token of Cloud Server described in step b scans for method particularly includes:

According to the first square query context generated in step a and the second square query context, judge whether four limits of query context intersect with bucket, if, then judge successively the child node of this node whether with the intersecting of query context, repeating inquiry till data point, crossing data point is also generated intermediate search results by all limits this step of backed off after random of traversal queries scope.