CN109800235B - Outsourcing database full-operation query verification system and method based on authentication tree - Google Patents

Outsourcing database full-operation query verification system and method based on authentication tree Download PDF

Info

Publication number
CN109800235B
CN109800235B CN201910078738.2A CN201910078738A CN109800235B CN 109800235 B CN109800235 B CN 109800235B CN 201910078738 A CN201910078738 A CN 201910078738A CN 109800235 B CN109800235 B CN 109800235B
Authority
CN
China
Prior art keywords
tree
query
data
result
verification
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201910078738.2A
Other languages
Chinese (zh)
Other versions
CN109800235A (en
Inventor
周福才
崔宁
高源�
王强
玄鹏开
吴淇毓
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Northeastern University China
Original Assignee
Northeastern University China
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Northeastern University China filed Critical Northeastern University China
Priority to CN201910078738.2A priority Critical patent/CN109800235B/en
Publication of CN109800235A publication Critical patent/CN109800235A/en
Application granted granted Critical
Publication of CN109800235B publication Critical patent/CN109800235B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Abstract

The invention provides a certification tree-based outsourcing database full-operation query verification system and method, and relates to the technical field of network security. The invention carries out functional design and class design aiming at a data owner, an outsourcing database server and a user three-party entity, and provides the realization of a key functional module; the SQL query verification system comprises an initialization module, an SQL query verification module, an updating module and a display module; the initialization module is used for generating a key and constructing an authentication tree for data provided by a data owner; the SQL query verification module is used for distributing the content queried by the user to a unit matched with the SQL query verification module, extracting data from the initialization module, verifying the data and sending the data to the display module; the updating module is embedded in the outsourced data server and updates the data in the initializing module according to the insertion, deletion and modification requests of the user; the display module is used for inputting data to be inquired by a user and displaying data required by the user. The invention realizes public verifiability and public renewability.

Description

Outsourcing database full-operation query verification system and method based on authentication tree
Technical Field
The invention relates to the technical field of network security, in particular to a system and a method for outsourcing database full-operation query verification based on an authentication tree.
Background
In recent years, internet technology has undergone a great change once and again, cloud computing technology has been developed unprecedentedly, and as a new internet computing business service mode, a user can provide services such as data storage, program running and computing execution at a remote cloud server at any time, which changes a traditional data storage mode to a great extent. Enterprises and users can therefore be freed from the expensive data storage costs, and outsourcing databases is therefore also proposed.
Outsourcing the database means that enterprises or individuals completely entrust professional database cloud storage providers to maintain and manage own data, own proprietary data centers are cancelled, and the database is used as a service. The method has many advantages, for enterprises and organizations, the method can save labor, maintenance and management cost, concentrate on the core business of the enterprises and the organizations, efficiently realize data sharing between the enterprises and the organizations, and realize multi-point operation for important information, thereby overcoming the defect of single-point storage and enhancing the reliability of data. For a service provider, the advantage of professional resource concentration of the service provider can be brought into play, the network bandwidth is improved, and the network delay is reduced. Based on the above advantages, more and more enterprises and users use cloud storage servers as their mainstream storage and computing servers.
For the external database server, the basic function is to provide various SQL query results, enterprises and individuals send various query requests, and the database is responsible for SQL query and sends the queried results to users. However, while the outsourced database is more widely applied, the security of the outsourced database is challenged, and the user cannot ensure the correctness and the integrity of the query result when uploading the outsourced database to the server, because the outsourced database server is not trusted, or once suffering from external attack or internal personnel attack in the data storage process, even if the server has a bug, the security of the data will be seriously damaged, and the correctness and the integrity of the data query result can not be protected. For example, in a set of 5 elements in the store set {3,6,7,14,16}, an element is requested to return a result of 5< x <15, the outsourced database may return {6,14}, where the returned result is incomplete, and if the result {3,6,7,14} is returned, the returned result is erroneous. Therefore, the problems of the completeness and the correctness of the query result of the outsourced database are researched and paid more extensive attention.
In the process, when the outsourced database executes a query request of a user, an evidence capable of verifying the correctness of a result is generated at the same time, the result and the evidence are sent to the user by a server, and the user verifies whether the result is correct according to a certain rule. In the process, even if the outsourced database server is not trusted, the user can still judge whether the result is correct and complete through verification, so that the server is prevented from providing wrong results, and the safety of the calculation result of the outsourced database server is effectively ensured.
In the previous research on database integrity verification, some problems exist, such as that the query types usually supported are relatively single, and the full operation cannot be supported, that is, the verification of all types of SQL query results cannot be supported; public updating of data cannot be supported, and a data owner needs to update the data by using a private key when updating the data; the efficiency is low, and the method cannot be applied to actual application scenes.
Disclosure of Invention
The invention aims to solve the technical problem of providing a full-operation query verification system and method for outsourced databases based on authentication trees, aiming at the defects of the prior art.
In order to solve the technical problems, the technical scheme adopted by the invention is as follows:
on one hand, the invention provides an outsourcing database full-operation query verification system based on a certification tree, which comprises an initialization module, an SQL query verification module, an updating module and a display module;
the initialization module is used for generating a key and constructing an authentication tree for data provided by a data owner;
the SQL query and verification module is embedded in the outsourced data server and comprises a range query and verification unit, a connection query and verification unit, a multi-dimensional range query and verification unit, a counting query and verification unit, a summing query and verification unit, a minimum query and verification unit and a maximum query and verification unit; the module is used for distributing the content inquired by the user to the inquiry unit matched with the user, extracting data in the initialization module, and sending the data to the display module after verification;
the updating module is embedded in the outsourced data server and used for updating the data in the initialization module according to an updating request of a user, wherein the updating request comprises insertion, deletion and modification;
the display module is used for inputting data which a user wants to inquire and displaying data required by the user.
On the other hand, the invention also provides a certification tree-based outsourcing database full-operation query verification method, which is realized by the certification tree-based outsourcing database full-operation query verification system and comprises the following steps:
step 1: a data owner executes a key generation algorithm by using a public parameter lambda to generate a public key PK and a private key SK;
step 2: the data owner sends the public key PK to an outsourcing database server and a user;
and step 3: data owner executes Setup initialization algorithm to generate authentication Tree A-Tree and authentication Tree digest dig by using public key PK and data set Dtree；
And 4, step 4: the data owner sends the authentication Tree A-Tree to the outsourcing database server and the summary dig of the authentication TreetreeSending the data to a user;
and 5: a user initiates a query request to an SQL query verification module of an outsourced database server;
step 6: outsourcing database server executes Query algorithm to generate result RηAnd evidence PηThe outsourcing database can call different query algorithms according to different query requests; the outsourcing database server then sends the result RηAnd evidence PηSending to the user terminal, where η ═ 1,2,3,4,5,6, 7; the user executes a Verify algorithm to Verify whether the result is correct or not according to the received result and the evidence, 1 is output if the verification is passed, and 0 is output if the verification is not passed; wherein the different query requests comprise range query and verification, connection query and verification, multi-dimensional range query and verification, counting query and verification, summation query and verification, minimum query and verification and maximum query and verification;
and 7: the user sends an update request upd to an update module of the outsourcing database server;
and 8: user executes UpdateDig update abstract algorithm to generate new authentication tree abstract value digtree-updAnd the outsourcing database server executes UpdateTree operation to generate a new data set DupdAnd authentication Tree A-Treetree-upd。
The step 1 specifically comprises the following steps:
step 1.1: the data owner reads the security parameter lambda;
step 1.2: group G construction by executing Bilinergen algorithm1,G2And a generator g;
step 1.3: selecting a random number r, s as a private key SK;
step 1.4: calculated as the public key PK using the security parameters and the private key,
Figure BDA0001959732720000031
wherein q is poly (λ).
The step 3 specifically comprises the following steps:
step 3.1: assuming that n columns exist in the list, constructing an authentication tree by any two columns, constructing the authentication tree by a first column and other columns, and then constructing an authentication tree by a second column till a last column; firstly, judging whether the tree is empty or not, if the tree is empty, executing initTreeNode to initialize a root node, and if the tree is not empty, executing insert functions according to the sequence in a data table to insert leaf nodes;
step 3.2: when inserting, firstly judging whether the tree is empty, if so, setting the tree as a root node, otherwise, judging the sizes of leaf nodes and root nodes to be inserted;
step 3.3: if the number of the nodes is smaller than the root node, inserting the nodes into the left subtree, and if the number of the nodes is larger than the root node, inserting the nodes into the right subtree;
step 3.4: recording the key and value of the node, wherein the key value stores the data key in the ith column as viValue stores the data and digest value of column j, denoted as
Figure BDA0001959732720000032
Wherein C represents a set formed by the j-th column of data corresponding to all leaf child nodes contained in the node,
Figure BDA0001959732720000033
representing the abstract value of the node, and recording the abstract value stored in the root node as the authentication tree abstract digtreeI.e. by
Figure BDA0001959732720000034
Where E represents all the data contained in the j-th column and is denoted as digtree＝(digtree[0],digtree[1])。
Step 3.5: after insertion, whether left and right subtrees of the current node are balanced is checked, if so, single rotation or double rotation is required to be executed to balance the authentication tree, and meanwhile, the abstract value of the node is updated;
step 3.6: and 3.1, after the data is judged to be inserted into the last line, executing the construction of the next authentication tree in the step 3.1 until the construction of all the authentication trees is completed.
The step 6 specifically comprises the following steps:
step 6.1: a user initiates a range query and verification;
step 6.1.1: authentication Tree A-Tree constructed by taking ith column and ith column in certain table of databasei×iIs subjected to [ alpha, beta ]]Wherein α, β represent data in the table, and returning the value stored in [ α, β ] in the query result]The set of elements corresponding to the ith column in the range is denoted as R1；
Step 6.1.2: recording abstract value dig stored by value in query resultj[0](j∈R1) And authenticating the digest value dig of the nodes on the Path A-Pathj[0](j. epsilon. A-Path) as evidence P1；
Step 6.1.3: using authentication tree digest digtree[0]And evidence P1Stored digest value digj[0](j∈R1)、digj[0](j ∈ A-Path) calculate the equation digtree[0]＝digj[0](j∈R1)·digj[0](j ∈ A-Path), and if not, outputs 0,rejection result R1(ii) a If yes, 1 is output, and the result R of the connection inquiry is accepted1；
Step 6.2: a user initiates connection inquiry and verification;
step 6.2.1: A-Tree constructed in the ith column and the ith column in a certain table of the databasei×iPerform range query of (-infinity, + ∞) and return query result
Figure BDA0001959732720000041
Step 6.2.2: A-Tree constructed in jth column and jth column of certain table in databasej×jPerform range query of (-infinity, + ∞) and return query result
Figure BDA0001959732720000042
Step 6.2.3: perform intersection operation on the instruction
Figure BDA0001959732720000043
(where x, y represent unknowns), calculating
Figure BDA0001959732720000044
Simplified and integrated
Figure BDA0001959732720000045
Step 6.2.4: computing
Figure BDA0001959732720000046
Qs，r＝gq(s，r)；
Step 6.2.5: output result R2Set of indices for x in polynomial I (x), evidence P ═ Ir,Qs,r) Evidence P2Contains two tuples, denoted as P2＝(P2[1],P2[2])；
Step 6.2.6: judgment equation
Figure BDA0001959732720000047
If true, if false, 0 is output, and the result R is rejected2(ii) a If yes, continuing to operate;
step 6.2.7: computing A Using public Key PKs＝gA(s)，Br,s＝gB(r,s)；
Step 6.2.8: judgment equation
Figure BDA0001959732720000048
If true, if false, 0 is output and the result R is rejected2(ii) a If yes, accepting the result R of the connection inquiry2(ii) a Wherein e represents a bilinear map;
step 6.3: a user initiates multi-range query and verification;
step 6.3.1: the tth column in a certain table of the user-defined database is a reference column, wherein each element can be used as a unique identifier of a row;
step 6.3.2: let the range to be queried be the range of the ith and jth columns, where satisfying the ith column as [ alpha, beta ]]Denotes the ith column data v for any row in the databaseiAll have alpha < vi< beta, satisfies the jth column
Figure BDA0001959732720000049
Representing the jth column data v for any row in the databasejAre all provided with
Figure BDA00019597327200000410
Wherein phi,
Figure BDA00019597327200000411
Represents the data in the table;
step 6.3.3: constructing an authentication Tree A-Tree by taking the ith column and the tth column in the tablei×tIs subjected to [ alpha, beta ]]Is returned to the query result, value is stored in [ alpha, beta ]]The set of elements corresponding to the t-th column in the range is denoted as
Figure BDA00019597327200000412
Step 6.3.4: get in the tableThe jth column and the tth column of (A) construct an authentication Tree A-Treej×tTo proceed with
Figure BDA0001959732720000051
In the range query, values stored in the returned query result
Figure BDA0001959732720000052
The set of elements corresponding to the t-th column in the range is denoted as
Figure BDA0001959732720000053
Step 6.3.5: to pair
Figure BDA0001959732720000054
And
Figure BDA0001959732720000055
performing intersection operation; order to
Figure BDA0001959732720000056
Computing
Figure BDA0001959732720000057
Obtained by simple arrangement
Figure BDA0001959732720000058
Calculation of Ir＝gI(r)，Qs,r＝gq(s,r)；
Step 6.3.6: output result R3Set of indices for x in the polynomial I (x), evidence P3＝(Ir,Qs,r) Evidence P3Contains two tuples, denoted as P3＝(P3[1],P3[2])；
Step 6.3.7: judgment equation
Figure BDA0001959732720000059
If true, if false, 0 is output, and the result R is rejected3(ii) a If yes, continuing to operate;
step 6.3.8: using public key PK countsCalculation As＝gA(s)，Br,s＝gB(r,s)；
Step 6.3.9: judgment equation
Figure BDA00019597327200000510
If true, if false, 0 is output and the result R is rejected3(ii) a If yes, accepting the result R of the connection inquiry3；
Step 6.4: initiating counting inquiry and verification by a user;
step 6.4.1: form equation a (x) Σi∈AxiComputing A (1) as a result R of the count lookup4；
Step 6.4.2: constructing the polynomial p (x) (a (x) -a (1))/(x-1);
step 6.4.3: calculation of evidence P4＝gP(s)；
Step 6.4.4: according to the result R4Calculating
Figure BDA00019597327200000511
Step 6.4.5: computing g from the public key PKs-1；
Step 6.4.6: verification equation
Figure BDA00019597327200000512
If yes, outputting 1, and receiving the result R of the connection inquiry4(ii) a Otherwise 0 is output, the result R is rejected4；
Step 6.5: a user initiates a summation query and verifies;
step 6.5.1: form equation a (x) Σi∈AxiCalculating A' (1) as a result R of the count lookup5；
Step 6.5.2: construction polynomial p (x) (a (x) -a (1) -a' (1) (x-1))/(x-1)2；
Step 6.5.3: calculate gP(s)Outputting a proof P5＝(A(1),gP(s))；
Step 6.5.4: according to the result R5Calculating
Figure BDA00019597327200000513
Step 6.5.5: calculated from the public key PK
Figure BDA00019597327200000514
And
Figure BDA00019597327200000515
step 6.5.6: verification equation
Figure BDA00019597327200000516
If yes, outputting 1, and receiving the result R of the connection inquiry5(ii) a Otherwise 0 is output, the result R is rejected5；
Step 6.6: a user initiates minimum value query and verification;
step 6.6.1: query result R with minimum element in set L or minimum index of polynomial as minimum6；
Step 6.6.2: form equation a (x) Σi∈LxiComputing and outputting evidence
Figure BDA00019597327200000517
Step 6.6.3: computing
Figure BDA00019597327200000518
Step 6.6.4: verification equation
Figure BDA00019597327200000519
Whether or not it is true, i.e. equality
Figure BDA0001959732720000061
If yes, outputting 1, and receiving the result R of the connection inquiry6(ii) a Otherwise 0 is output, the result R is rejected6；
Step 6.7: a user initiates maximum value inquiry and verification;
step 6.7.1: query result R looking at the largest element in set L or having the index with the largest polynomial as the maximum7；
Step 6.7.2: form equation a (x) Σi∈LxiComputing and outputting evidence
Figure BDA0001959732720000062
Wherein A (r, s) ═ Σi∈Lrisq-i；
Step 6.7.3: validating equations based on results and evidence
Figure BDA0001959732720000064
Namely, it is
Figure BDA0001959732720000065
If yes, outputting 1, and receiving the result R of the connection inquiry7(ii) a Otherwise 0 is output, the result R is rejected7。
The step 8 specifically comprises the following steps:
step 8.1: a user initiates an insertion request;
step 8.1.1: when upd ═ (ADD, v), where v represents user-provided data; the operation mainly performed by the user is to calculate the nodes needing to be updated
Figure BDA0001959732720000066
As the digest value of the updated node;
step 8.1.2: traversing each layer of the A-Tree from the root node to find the data to be inserted
Figure BDA0001959732720000067
The position of (a);
step 8.1.3: updating the structure of the A-Tree, constructing a new node, adjusting the Tree structure, and keeping the Tree structure balanced if the authentication Tree is unbalanced and needs to be rotated;
step 8.1.4: updating A-TreeupdThe (key, value) value of the node is updated until the (key, value) value of the root node is updated, and the updating operation is completed;
step 8.2: a user initiates a deletion request;
step 8.2.1: when upd ═ DEL, v, the operation that the user mainly performs is calculation
Figure BDA0001959732720000068
As the digest value of the updated authentication tree;
step 8.2.2: traversing each layer of ALTRee from the root node, and finding data to be deleted
Figure BDA0001959732720000069
The position of (a);
step 8.2.3: updating the structure of the A-Tree, constructing a new node, adjusting the structure of the Tree, and keeping the structure of the Tree balanced if the authentication Tree is unbalanced and needs to be rotated;
step 8.2.4: updating A-TreeupdThe (key, value) value of the upper node until the root node, and the updating operation is completed;
step 8.3: a user initiates a modification request;
step 8.3.1: when upd ═ g (CHANGE, v)1,v2) Wherein v is1Representing data to be inserted by the user, v2Representing data that the user needs to delete; the modification operation is considered as a combination of insertion and deletion algorithms; computing
Figure BDA00019597327200000610
As the digest value of the updated authentication tree;
step 8.3.2: the outsourcing database server needs to update the data table and the A-Tree, adjust the structure of the authentication Tree and update the key value of each node; the updating process is that the database firstly executes the step 8.1 to carry out the v pair1Then step 8.2 is performed to pair v2And (4) deleting.
Adopt the produced beneficial effect of above-mentioned technical scheme to lie in: the outsourcing database full-operation query verification system and method based on the authentication tree can support comprehensive query operation, including multiple set operations such as intersection, union, complement and difference of sets, connection query, range query, multiple ranges, counting, summation, maximum value, minimum value and nested query operation, and are comprehensive in function and full-operation; the evidence size is a constant level, is independent of the data storage size and the intermediate result of the query, and only depends on the number of the query statements decomposed into single query statements; the verification efficiency is constant level, and the method does not depend on the size of an outsourcing database and has high efficiency; the public verification can be realized, and any user with a public key and a summary can finish the integrity verification of the query result; public updatable, any legal user can participate in updating the data of the database, and does not depend on a private key.
Drawings
FIG. 1 is a schematic diagram of a certification tree-based outsourcing database full-operation query validation system according to an embodiment of the present invention;
FIG. 2 is a flowchart of a certification tree-based outsourcing database full-operation query validation method according to an embodiment of the present invention;
FIG. 3 is a flow chart of key generation provided by an embodiment of the present invention;
FIG. 4 is a flowchart of the method for constructing an authentication tree according to an embodiment of the present invention;
FIG. 5 is a flowchart of a range query and verification algorithm provided by an embodiment of the present invention;
FIG. 6 is a flowchart of a connection query and verification algorithm provided by an embodiment of the present invention;
FIG. 7 is a flowchart of a multi-range query and verification algorithm provided by an embodiment of the present invention;
FIG. 8 is a flowchart of a count lookup and verification algorithm according to an embodiment of the present invention;
FIG. 9 is a flow chart of a summation query and validation algorithm provided by an embodiment of the present invention;
FIG. 10 is a flowchart of a minimum query and verification algorithm provided by an embodiment of the present invention;
FIG. 11 is a flowchart of a maximum query and verification algorithm provided by an embodiment of the present invention;
FIG. 12 is a flowchart of an update process provided by an embodiment of the present invention;
Detailed Description
The following detailed description of embodiments of the present invention is provided in connection with the accompanying drawings and examples. The following examples are intended to illustrate the invention but are not intended to limit the scope of the invention.
The scheme comprises three entities, a user side, an outsourcing database server side and a data owner;
the data owner: the data owner is the original owner of the data, and the entity initializing the data. Is responsible for key generation and initialization of the system. And the data owner generates the data into an authentication tree, sends the data set and the authentication tree to an outsourcing database server and sends the abstract of the authentication tree to the user. In addition, the data owner can have the functions of inquiring and updating with ordinary users.
Outsourcing the database server: the outsourced database server performs storage, querying and updating operations. And the server receives and stores the authentication tree sent by the data owner, receives a query request of the client to the data, and returns a query result and evidence. In the update phase, the outsourced database server needs to update the structure of the authentication tree.
The user: one or more of the data query and verification of the correctness and integrity of the data are mainly carried out. Any legal user can send a query request to the server and verify whether the returned result is correct, if the result is verified, the query result is correct, and if the result is not verified, the query result is wrong. Any legal user can update the data, and needs to interact with the outsourced database server when updating, and the user can directly update the abstract.
The interaction process of the three-party entity is as follows:
(1) data owner invokes the key generation algorithm keyGen (1)λ) The generated private key SK is kept by the data owner and the public key PK is published.
(2) The data owner calls the initialization algorithm Setup (PK, D) to generate an authentication Tree A-Tree and an authentication Tree digest digtree. Sending the data set D to an SQL query verification module, and sending the authentication Tree A-Tree to a databaseSQL query validation module, authentication tree digest digtreeAnd sending the data to the user side.
(3) And the SQL query verification module calls different query algorithms according to different query types, performs data interaction with the initialization module, and returns a query result and evidence.
If the query is a range query, a range query algorithm RangeQuery (q, A-Tree, PK) is called, if the query is a connection query, a connection query algorithm JoinQuery (q, A-Tree, PK) is called, if the query is a multidimensional range query, a query algorithm MultidimensionalQuery (q, A-Tree, PK) is called, if the query is a counting query, a counting query algorithm CountQuery (q, A-Tree, PK) is called, if the query is a summing query, an algorithm SumQuery (q, A-Tree, PK) is called, if the query is a minimum query, a query algorithm MinQuery (q, A-Tree, PK) is called, and if the query is a maximum query, a query algorithm MaxQuery (q, A-Tree, PK) is called.
(4) And after receiving the query result and the evidence, the user calls different verification algorithms according to the query type.
If the query is a range query, a RangeVerify (R, P, dig) is calledtreePK), if it is a connection query, call JoinVerify (R, P, dig)treePK), if a multidimensional range query calls the algorithm multidimensionalVerify (R, P, dig)treePK), if it is a count query, calls CountVerify (R, P, dig)treePK), if a sum query, call SumVerify (R, P, dig)treePK), if minimum query, call MinVerify (R, P, dig)treePK), if it is a max query, call MaxVerify (R, P, dig)tree,PK)。
When a user or a data owner needs to update, update information is sent to the outsourcing database server, and the user or the data owner calls UpdateDig (upd, dig)treePK) algorithm updates the digest of the authentication Tree, and the outsourcing database server needs to call an UpdateTree (upd, D, a-Tree) algorithm to update the authentication Tree.
The method of this example is as follows.
In one aspect, the present invention provides a certification tree-based outsourcing database full-operation query validation system, as shown in fig. 1, including an initialization module, an SQL query validation module, an update module, and a display module;
the initialization module is used for generating a key and constructing an authentication tree for data provided by a data owner;
the SQL query and verification module is embedded in the outsourced data server and comprises a range query and verification unit, a connection query and verification unit, a multi-dimensional range query and verification unit, a counting query and verification unit, a summing query and verification unit, a minimum query and verification unit and a maximum query and verification unit; the module is used for distributing the content inquired by the user to the inquiry unit matched with the user, extracting data in the initialization module, and sending the data to the display module after verification;
the updating module is embedded in the outsourced data server and used for updating the data in the initialization module according to an updating request of a user, wherein the updating request comprises insertion, deletion and modification;
the display module is used for inputting data which a user wants to inquire and displaying data required by the user.
On the other hand, the invention also provides a certification tree-based outsourcing database full-operation query verification method, which is realized by the certification tree-based outsourcing database full-operation query verification system, as shown in fig. 2, and comprises the following steps:
step 1: the data owner executes a key generation algorithm using the public parameter λ to generate a public key PK and a private key SK, as shown in fig. 3;
step 1.1: the data owner reads the security parameter lambda;
step 1.2: group G construction by executing Bilinergen algorithm1,G2And a generator g;
bilinear mapping generation algorithm: BilinermapGen (1)λ)→(e,g,G1,G2P) generating a bilinear map e G1×G1→G2Wherein G is1And G2Is a multiplication loop group of order p, G denotes the group G1A generator of (2).
Step 1.3: selecting a random number r, s as a private key SK;
step 1.4: calculated as the public key PK using the security parameters and the private key,
Figure BDA0001959732720000091
wherein q is poly (λ).
Step 2: the data owner sends the public key PK to an outsourcing database server and a user;
and step 3: data owner executes Setup initialization algorithm to generate authentication Tree A-Tree and authentication Tree digest dig by using public key PK and data set DtreeAs shown in fig. 4;
step 3.1: assuming there are n columns in the list, any two columns construct the authentication tree, first the first and other columns construct the authentication tree, then the second column through to the last column. Firstly, judging whether the tree is empty or not, if the tree is empty, executing initTreeNode to initialize a root node, and if the tree is not empty, executing insert functions according to the sequence in a data table to insert leaf nodes;
step 3.2: when inserting, firstly judging whether the tree is empty, if so, setting the tree as a root node, otherwise, judging the sizes of leaf nodes and root nodes to be inserted;
step 3.3: if the number of the nodes is smaller than the root node, inserting the nodes into the left subtree, and if the number of the nodes is larger than the root node, inserting the nodes into the right subtree;
step 3.4: recording the key and value of the node, wherein the key value stores the data key in the ith column as viValue stores the data and digest value of column j, denoted as
Figure BDA0001959732720000101
Wherein C represents a set formed by the j-th column of data corresponding to all leaf child nodes contained in the node,
Figure BDA0001959732720000102
representing the abstract value of the node, and recording the abstract value stored in the root node as the authentication tree abstract digtreeI.e. by
Figure BDA0001959732720000103
Wherein E represents all numbers contained in column jAccordingly, it is denoted as digtree＝(digtree[0],digtree[1])。
Step 3.5: after insertion, whether left and right subtrees of the current node are balanced is checked, if so, single rotation or double rotation is required to be executed to balance the authentication tree, and meanwhile, the abstract value of the node is updated;
step 3.6: and 3.1, after the data is judged to be inserted into the last line, executing the construction of the next authentication tree in the step 3.1 until the construction of all the authentication trees is completed.
And 4, step 4: the data owner sends the authentication Tree A-Tree to the outsourcing database server and the summary dig of the authentication TreetreeSending the data to a user;
and 5: a user initiates a query request to an SQL query verification module of an outsourced database server;
step 6: outsourcing database server executes Query algorithm to generate result RηAnd evidence PηThe outsourcing database can call different query algorithms according to different query requests; the outsourcing database server then sends the result RηAnd evidence PηSending to the user terminal, where η ═ 1,2,3,4,5,6, 7; the user executes a Verify algorithm to Verify whether the result is correct or not according to the received result and the evidence, 1 is output if the verification is passed, and 0 is output if the verification is not passed; wherein the different query requests comprise range query and verification, connection query and verification, multi-dimensional range query and verification, counting query and verification, summation query and verification, minimum query and verification and maximum query and verification;
step 6.1: the user initiates a range query and verification, as shown in FIG. 5;
step 6.1.1: authentication Tree A-Tree constructed by taking ith column and ith column in certain table of databasei×iIs subjected to [ alpha, beta ]]Wherein α, β represent data in the table, and returning the value stored in [ α, β ] in the query result]The set of elements corresponding to the ith column in the range is denoted as R1；
Step 6.1.2: recording abstract value dig stored by value in query resultj[0](j∈R1) And digest of nodes on authentication Path A-PathValue digj[0](j. epsilon. A-Path) as evidence P1；
Step 6.1.3: using authentication tree digest digtree[0]And evidence P1Stored digest value digj[0](j∈R1)、digj[0](j ∈ A-Path) calculate the equation digtree[0]＝digj[0](j∈R1)·digj[0](j belongs to A-Path), if not, 0 is output, and the result R is rejected1(ii) a If yes, 1 is output, and the result R of the connection inquiry is accepted1；
Step 6.2: the user initiates a connection query and verification, as shown in fig. 6;
step 6.2.1: A-Tree constructed in the ith column and the ith column in a certain table of the databasei×iPerform range query of (-infinity, + ∞) and return query result
Figure BDA0001959732720000104
Step 6.2.2: A-Tree constructed in jth column and jth column of certain table in databasej×jPerform range query of (-infinity, + ∞) and return query result
Figure BDA0001959732720000111
Step 6.2.3: perform intersection operation on the instruction
Figure BDA0001959732720000112
(where x, y represent unknowns), calculating
Figure BDA0001959732720000113
Simplified and integrated
Figure BDA0001959732720000114
Step 6.2.4: computing
Figure BDA0001959732720000115
Qs，r＝gq(s，r)；
Step 6.2.5: output result R2Set of indices for x in polynomial I (x), evidence P ═ Ir,Qs,r) Evidence P2Contains two tuples, denoted as P2＝(P2[1],P2[2])；
Step 6.2.6: judgment equation
Figure BDA0001959732720000116
If true, if false, 0 is output, and the result R is rejected2(ii) a If yes, continuing to operate;
step 6.2.7: computing A Using public Key PKs＝gA(s)，Br,s＝gB(r,s)；
Step 6.2.8: judgment equation
Figure BDA0001959732720000117
If true, if false, 0 is output and the result R is rejected2(ii) a If yes, accepting the result R of the connection inquiry2(ii) a Wherein e represents a bilinear map;
step 6.3: the user initiates a multi-range query and verification, as shown in FIG. 7;
step 6.3.1: the tth column in a certain table of the user-defined database is a reference column, wherein each element can be used as a unique identifier of a row;
step 6.3.2: let the range to be queried be the range of the ith and jth columns, where satisfying the ith column as [ alpha, beta ]]Denotes the ith column data v for any row in the databaseiAll have alpha < vi< beta, satisfies the jth column
Figure BDA0001959732720000118
Representing the jth column data v for any row in the databasejAre all provided with
Figure BDA0001959732720000119
Wherein phi,
Figure BDA00019597327200001110
Represents the data in the table;
step 6.3.3: constructing an authentication Tree A-Tree by taking the ith column and the tth column in the tablei×tIs subjected to [ alpha, beta ]]Is returned to the query result, value is stored in [ alpha, beta ]]The set of elements corresponding to the t-th column in the range is denoted as
Figure BDA00019597327200001111
Step 6.3.4: constructing an authentication Tree A-Tree by taking the jth column and the tth column in the tablej×tTo proceed with
Figure BDA00019597327200001112
In the range query, values stored in the returned query result
Figure BDA00019597327200001113
The set of elements corresponding to the t-th column in the range is denoted as
Figure BDA00019597327200001114
Step 6.3.5: to pair
Figure BDA00019597327200001115
And
Figure BDA00019597327200001116
performing intersection operation; order to
Figure BDA00019597327200001117
Computing
Figure BDA00019597327200001118
Obtained by simple arrangement
Figure BDA00019597327200001119
Calculation of Ir＝gI(r)，Qs,r＝gq(s,r)；
Step 6.3.6: output result R3Set of indices for x in the polynomial I (x), evidence P3＝(Ir,Qs,r) Evidence P3Contains two tuples, denoted as P3＝(P3[1],P3[2])；
Step 6.3.7: judgment equation
Figure BDA00019597327200001120
If true, if false, 0 is output, and the result R is rejected3(ii) a If yes, continuing to operate;
step 6.3.8: computing A Using public Key PKs＝gA(s)，Br,s＝gB(r,s)；
Step 6.3.9: judgment equation
Figure BDA00019597327200001121
If true, if false, 0 is output and the result R is rejected3(ii) a If yes, accepting the result R of the connection inquiry3；
Step 6.4: the user initiates a count query and validation, as shown in FIG. 8;
step 6.4.1: form equation a (x) Σi∈AxiComputing A (1) as a result R of the count lookup4；
Step 6.4.2: constructing the polynomial p (x) (a (x) -a (1))/(x-1);
step 6.4.3: calculation of evidence P4＝gP(s)；
Step 6.4.4: according to the result R4Calculating
Figure BDA0001959732720000121
Step 6.4.5: computing g from the public key PKs-1；
Step 6.4.6: verification equation
Figure BDA0001959732720000122
If yes, outputting 1, and receiving the result R of the connection inquiry4(ii) a Otherwise 0 is output, the result R is rejected4；
Step 6.5: the user initiates a summation query and verification, as shown in FIG. 9;
step 6.5.1: form equation a (x) Σi∈AxiCalculating A' (1) as a result R of the count lookup5；
Step 6.5.2: construction polynomial p (x) (a (x) -a (1) -a' (1) (x-1))/(x-1)2；
Step 6.5.3: calculate gP(s)Outputting a proof P5＝(A(1),gP(s))；
Step 6.5.4: according to the result R5Calculating
Figure BDA00019597327200001212
Step 6.5.5: calculated from the public key PK
Figure BDA0001959732720000123
And
Figure BDA00019597327200001213
step 6.5.6: verification equation
Figure BDA0001959732720000124
If yes, outputting 1, and receiving the result R of the connection inquiry5(ii) a Otherwise 0 is output, the result R is rejected5；
Step 6.6: the user initiates minimum query and verification, as shown in fig. 10;
step 6.6.1: query result R with minimum element in set L or minimum index of polynomial as minimum6；
Step 6.6.2: form equation a (x) Σi∈LxiComputing and outputting evidence
Figure BDA0001959732720000125
Step 6.6.3: computing
Figure BDA0001959732720000126
Step 6.6.4: verification equation
Figure BDA0001959732720000127
Whether or not it is true, i.e. equality
Figure BDA0001959732720000128
If yes, outputting 1, and receiving the result R of the connection inquiry6(ii) a Otherwise 0 is output, the result R is rejected6；
Step 6.7: the user initiates a maximum query and verification, as shown in fig. 11;
step 6.7.1: query result R looking at the largest element in set L or having the index with the largest polynomial as the maximum7；
Step 6.7.2: form equation a (x) Σi∈LxiComputing and outputting evidence
Figure BDA0001959732720000129
Wherein A (r, s) ═ Sigmai∈Lrisq-i；
Step 6.7.3: validating equations based on results and evidence
Figure BDA00019597327200001210
Namely, it is
Figure BDA00019597327200001211
If yes, outputting 1, and receiving the result R of the connection inquiry7(ii) a Otherwise 0 is output, the result R is rejected7。
And 7: the user sends an update request upd to an update module of the outsourcing database server;
and 8: user executes UpdateDig update abstract algorithm to generate new authentication tree abstract value digtree-updAnd the outsourcing database server executes UpdateTree operation to generate a new data set DupdAnd authentication Tree A-Treetree-updAs shown in fig. 12;
step 8.1: a user initiates an insertion request;
step 8.1.1: when upd ═ (ADD, v), where v represents user-provided data; mainly performed by the userThe operation is to calculate the node needing to be updated
Figure BDA0001959732720000131
As the digest value of the updated node;
step 8.1.2: traversing each layer of the A-Tree from the root node to find the data to be inserted
Figure BDA0001959732720000132
The position of (a);
step 8.1.3: updating the structure of the A-Tree, constructing a new node, adjusting the Tree structure, and keeping the Tree structure balanced if the authentication Tree is unbalanced and needs to be rotated;
step 8.1.4: updating A-TreeupdThe (key, value) value of the node is updated until the (key, value) value of the root node is updated, and the updating operation is completed;
step 8.2: a user initiates a deletion request;
step 8.2.1: when upd ═ DEL, v, the operation that the user mainly performs is calculation
Figure BDA0001959732720000133
As the digest value of the updated authentication tree;
step 8.2.2: traversing each layer of ALTRee from the root node, and finding data to be deleted
Figure BDA0001959732720000134
The position of (a);
step 8.2.3: updating the structure of the A-Tree, constructing a new node, adjusting the structure of the Tree, and keeping the structure of the Tree balanced if the authentication Tree is unbalanced and needs to be rotated;
step 8.2.4: updating A-TreeupdThe (key, value) value of the upper node until the root node, and the updating operation is completed;
step 8.3: a user initiates a modification request;
step 8.3.1: when upd ═ g (CHANGE, v)1,v2) Wherein v is1Representing data to be inserted by the user, v2Representing user needsData to be deleted; the modification operation is considered as a combination of insertion and deletion algorithms; computing
Figure BDA0001959732720000135
As the digest value of the updated authentication tree;
step 8.3.2: the outsourcing database server needs to update the data table and the A-Tree, adjust the structure of the authentication Tree and update the key value of each node; the updating process is that the database firstly executes the step 8.1 to carry out the v pair1Then step 8.2 is performed to pair v2And (4) deleting.
Finally, it should be noted that: the above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some or all of the technical features may be equivalently replaced; such modifications and substitutions do not depart from the spirit of the corresponding technical solutions and scope of the present invention as defined in the appended claims.

Claims (3)

1. An outsourcing database full-operation query verification method based on a certification tree is realized by an outsourcing database full-operation query verification system based on the certification tree, and the outsourcing database full-operation query verification system based on the certification tree comprises the following steps: the system comprises an initialization module, an SQL query verification module, an update module and a display module; the initialization module is used for generating a key and constructing an authentication tree for data provided by a data owner; the SQL query and verification module is embedded in the outsourced database server and comprises a range query and verification unit, a connection query and verification unit, a multi-dimensional range query and verification unit, a counting query and verification unit, a summing query and verification unit, a minimum query and verification unit and a maximum query and verification unit; the module is used for distributing the content inquired by the user to the inquiry unit matched with the user, extracting data in the initialization module, and sending the data to the display module after verification; the updating module is embedded in the outsourced database server and used for updating the data in the initialization module according to an updating request of a user, wherein the updating request comprises insertion, deletion and modification; the display module is used for inputting data which a user wants to inquire and displaying data required by the user; the method is characterized in that: the method comprises the following steps:
step 1: a data owner executes a key generation algorithm by using a public parameter lambda to generate a public key PK and a private key SK;
step 2: the data owner sends the public key PK to an outsourcing database server and a user;
and step 3: data owner executes Setup initialization algorithm to generate authentication Tree A-Tree and authentication Tree digest dig by using public key PK and data set DtreeThe method comprises the following steps:
step 3.1: setting n columns in the list, constructing an authentication tree by any two columns, constructing the authentication tree by a first column and other columns, and then constructing an authentication tree by a second column until a last column; firstly, judging whether the tree is empty or not, if the tree is empty, executing initTreeNode to initialize a root node, and if the tree is not empty, executing insert functions according to the sequence in a data table to insert leaf nodes;
step 3.2: when inserting, firstly judging whether the tree is empty, if so, setting the tree as a root node, otherwise, judging the sizes of leaf nodes and root nodes to be inserted;
step 3.3: if the number of the nodes is smaller than the root node, inserting the nodes into the left subtree, and if the number of the nodes is larger than the root node, inserting the nodes into the right subtree;
step 3.4: recording the key and value of the node, wherein the key value stores the data key in the ith column as viValue stores the data and digest value of column j, denoted as
Figure FDA0003034956300000011
Wherein C represents a set formed by the j-th column of data corresponding to all leaf child nodes contained in the node,
Figure FDA0003034956300000012
representing the abstract value of the node, and recording the abstract value stored in the root node as the authentication tree abstract digtreeI.e. by
Figure FDA0003034956300000013
Where E represents all the data contained in the j-th column and is denoted as digtree＝(digtree[0],digtree[1]) G denotes a generator, r, s denotes a random number, q ═ poly (λ), λ denotes a security parameter;
step 3.5: after insertion, whether left and right subtrees of the current node are balanced is checked, if so, single rotation or double rotation is required to be executed to balance the authentication tree, and meanwhile, the abstract value of the node is updated;
step 3.6: after the data is judged to be inserted into the last line, executing the step 3.1 to construct the next authentication tree until all the authentication trees are constructed;
and 4, step 4: the data owner sends the authentication Tree A-Tree to the outsourcing database server and the summary dig of the authentication TreetreeSending the data to a user;
and 5: a user initiates a query request to an SQL query verification module of an outsourced database server;
step 6: outsourcing database server executes Query algorithm to generate result RηAnd evidence PηThe outsourcing database can call different query algorithms according to different query requests; the outsourcing database server then sends the result RηAnd evidence PηSending to the user terminal, where η ═ 1,2,3,4,5,6, 7; the user executes a Verify algorithm to Verify whether the result is correct or not according to the received result and the evidence, 1 is output if the verification is passed, and 0 is output if the verification is not passed; wherein, different inquiry requests comprise range inquiry and verification, connection inquiry and verification, multi-dimensional range inquiry and verification, counting inquiry and verification, summation inquiry and verification, minimum inquiry and verification and maximum inquiry and verification, and the method comprises the following steps:
step 6.1: a user initiates a range query and verification;
step 6.1.1: authentication Tree A-Tree constructed by taking ith column and ith column in certain table of databasei×iIs subjected to [ alpha, beta ]]Wherein alpha and beta represent data in the table, and returning a value stored in the query resultIs stored in [ alpha, beta ]]The set of elements corresponding to the ith column in the range is denoted as R1；
Step 6.1.2: recording abstract value dig stored by value in query resultj[0](j∈R1) And authenticating the digest value dig of the nodes on the Path A-Pathj[0](j. epsilon. A-Path) as evidence P1；
Step 6.1.3: using authentication tree digest digtree[0]And evidence P1Stored digest value digj[0](j∈R1)、digj[0](j ∈ A-Path) calculate the equation digtree[0]＝digj[0](j∈R1)·digj[0](j belongs to A-Path), if not, 0 is output, and the result R is rejected1(ii) a If yes, 1 is output, and the result R of the connection inquiry is accepted1；
Step 6.2: a user initiates connection inquiry and verification;
step 6.2.1: A-Tree constructed in the ith column and the ith column in a certain table of the databasei×iPerform range query of (-infinity, + ∞) and return query result
Figure FDA0003034956300000021
Step 6.2.2: A-Tree constructed in jth column and jth column of certain table in databasej×jPerform range query of (-infinity, + ∞) and return query result
Figure FDA0003034956300000022
Step 6.2.3: perform intersection operation on the instruction
Figure FDA0003034956300000023
Wherein x and y represent unknowns, calculating
Figure FDA0003034956300000024
Simplified and integrated
Figure FDA0003034956300000026
Step 6.2.4: computing
Figure FDA0003034956300000027
Qs,r=gq(s,r);
Step 6.2.5: output result R2Set of indices for x in polynomial I (x), evidence P ═ Ir,Qs,r) Evidence P2Contains two tuples, denoted as P2＝(P2[1],P2[2])；
Step 6.2.6: judgment equation
Figure FDA0003034956300000028
If true, if false, 0 is output, and the result R is rejected2(ii) a If yes, continuing to operate;
step 6.2.7: computing A Using public Key PKs＝gA(s)，Br,s＝gB(r,s)；
Step 6.2.8: judgment equation
Figure FDA0003034956300000031
If true, if false, 0 is output and the result R is rejected2(ii) a If yes, accepting the result R of the connection inquiry2(ii) a Wherein e represents a bilinear map;
step 6.3: a user initiates multi-range query and verification;
step 6.3.1: the tth column in a certain table of the user-defined database is a reference column, wherein each element can be used as a unique identifier of a row;
step 6.3.2: let the range to be queried be the range of the ith and jth columns, where satisfying the ith column as [ alpha, beta ]]Denotes the ith column data v for any row in the databaseiAll have alpha<vi<Beta, satisfies the j column
Figure FDA0003034956300000032
Representing the jth column data v for any row in the databasejAre all provided with
Figure FDA0003034956300000033
Wherein phi,
Figure FDA0003034956300000034
Represents the data in the table;
step 6.3.3: constructing an authentication Tree A-Tree by taking the ith column and the tth column in the tablei×tIs subjected to [ alpha, beta ]]Is returned to the query result, value is stored in [ alpha, beta ]]The set of elements corresponding to the t-th column in the range is denoted as
Figure FDA0003034956300000035
Step 6.3.4: constructing an authentication Tree A-Tree by taking the jth column and the tth column in the tablej×tTo proceed with
Figure FDA0003034956300000036
In the range query, values stored in the returned query result
Figure FDA0003034956300000037
The set of elements corresponding to the t-th column in the range is denoted as
Figure FDA0003034956300000038
Step 6.3.5: to pair
Figure FDA0003034956300000039
And
Figure FDA00030349563000000310
performing intersection operation; order to
Figure FDA00030349563000000311
Computing
Figure FDA00030349563000000312
Obtained by simple arrangement
Figure FDA00030349563000000313
Calculation of Ir＝gI(r)，Qs,r＝gq(s,r)；
Step 6.3.6: output result R3Set of indices for x in the polynomial I (x), evidence P3＝(Ir,Qs,r) Evidence P3Contains two tuples, denoted as P3＝(P3[1],P3[2])；
Step 6.3.7: judgment equation
Figure FDA00030349563000000314
If true, if false, 0 is output, and the result R is rejected3(ii) a If yes, continuing to operate;
step 6.3.8: computing A Using public Key PKs＝gA(s)，Br,s＝gB(r,s)；
Step 6.3.9: judgment equation
Figure FDA00030349563000000315
If true, if false, 0 is output and the result R is rejected3(ii) a If yes, accepting the result R of the connection inquiry3；
Step 6.4: initiating counting inquiry and verification by a user;
step 6.4.1: form equation a (x) Σi∈AxiComputing A (1) as a result R of the count lookup4；
Step 6.4.2: constructing the polynomial p (x) (a (x) -a (1))/(x-1);
step 6.4.3: calculation of evidence P4＝gP(s)；
Step 6.4.4: according to the result R4Calculate gR4；
Step 6.4.5: computing g from the public key PKs-1；
Step 6.4.6: verification equation
Figure FDA00030349563000000316
If yes, outputting 1, and receiving the result R of the connection inquiry4(ii) a Otherwise 0 is output, the result R is rejected4；
Step 6.5: a user initiates a summation query and verifies;
step 6.5.1: form equation a (x) Σi∈AxiCalculating A' (1) as a result R of the count lookup5；
Step 6.5.2: construction polynomial p (x) (a (x) -a (1) -a' (1) (x-1))/(x-1)2；
Step 6.5.3: calculate gP(s)Outputting a proof P5＝(A(1),gP(s))；
Step 6.5.4: according to the result R5Calculating
Figure FDA0003034956300000041
Step 6.5.5: calculated from the public key PK
Figure FDA0003034956300000042
And
Figure FDA0003034956300000043
step 6.5.6: verification equation
Figure FDA0003034956300000044
If yes, outputting 1, and receiving the result R of the connection inquiry5(ii) a Otherwise 0 is output, the result R is rejected5；
Step 6.6: a user initiates minimum value query and verification;
step 6.6.1: query result R with minimum element in set L or minimum index of polynomial as minimum6；
Step 6.6.2: form equation a (x) Σi∈LxiComputing and outputting evidence
Figure FDA0003034956300000045
Step 6.6.3: computing
Figure FDA0003034956300000046
Step 6.6.4: verification equation
Figure FDA0003034956300000047
Whether or not it is true, i.e. equality
Figure FDA0003034956300000048
If yes, outputting 1, and receiving the result R of the connection inquiry6(ii) a Otherwise 0 is output, the result R is rejected6；
Step 6.7: a user initiates maximum value inquiry and verification;
step 6.7.1: query result R looking at the largest element in set L or having the index with the largest polynomial as the maximum7；
Step 6.7.2: form equation a (x) Σi∈LxiComputing and outputting evidence
Figure FDA0003034956300000049
Wherein A (r, s) ═ Sigmai∈Lrisq-i；
Step 6.7.3: validating equations based on results and evidence
Figure FDA00030349563000000410
Namely, it is
Figure FDA00030349563000000411
If yes, outputting 1, and receiving the result R of the connection inquiry7(ii) a Otherwise 0 is output, the result R is rejected7；
And 7: the user sends an update request upd to an update module of the outsourcing database server;
and 8: user executes UpdateDig update abstract algorithm to generate new authentication tree abstract value digtree-updAnd outsourcing the database serverThe server executes the UpdateTree operation to generate a new data set DupdAnd authentication Tree A-Treetree-upd。
2. The certification tree-based outsourcing database full-operation query validation method according to claim 1, wherein: the step 1 specifically comprises the following steps:
step 1.1: the data owner reads the security parameter lambda;
step 1.2: group G construction by executing Bilinergen algorithm1,G2And a generator g;
step 1.3: selecting a random number r, s as a private key SK;
step 1.4: calculated as the public key PK using the security parameters and the private key,
Figure FDA00030349563000000412
wherein q is poly (λ).
3. The certification tree-based outsourcing database full-operation query validation method according to claim 1, wherein: the step 8 specifically comprises the following steps:
step 8.1: a user initiates an insertion request;
step 8.1.1: when upd ═ (ADD, v), where v represents user-provided data; the operation mainly performed by the user is to calculate the nodes needing to be updated
Figure FDA0003034956300000051
As the digest value of the updated node;
step 8.1.2: traversing each layer of the A-Tree from the root node to find the data to be inserted
Figure FDA0003034956300000052
The position of (a);
step 8.1.3: updating the structure of the A-Tree, constructing a new node, adjusting the Tree structure, and keeping the Tree structure balanced if the authentication Tree is unbalanced and needs to be rotated;
step 8.1.4: updating A-TreeupdThe (key, value) value of the node is updated until the (key, value) value of the root node is updated, and the updating operation is completed;
step 8.2: a user initiates a deletion request;
step 8.2.1: when upd ═ DEL, v, the operation that the user mainly performs is calculation
Figure FDA0003034956300000053
As the digest value of the updated authentication tree;
step 8.2.2: traversing each layer of ALTRee from the root node, and finding data to be deleted
Figure FDA0003034956300000054
The position of (a);
step 8.2.3: updating the structure of the A-Tree, constructing a new node, adjusting the structure of the Tree, and keeping the structure of the Tree balanced if the authentication Tree is unbalanced and needs to be rotated;
step 8.2.4: updating A-TreeupdThe (key, value) value of the upper node until the root node, and the updating operation is completed;
step 8.3: a user initiates a modification request;
step 8.3.1: when upd ═ g (CHANGE, v)1,v2) Wherein v is1Representing data to be inserted by the user, v2Representing data that the user needs to delete; the modification operation is considered as a combination of insertion and deletion algorithms; computing
Figure FDA0003034956300000055
As the digest value of the updated authentication tree;
step 8.3.2: the outsourcing database server needs to update the data table and the A-Tree, adjust the structure of the authentication Tree and update the key value of each node; the updating process is that the database firstly executes the step 8.1 to carry out the v pair1Then step 8.2 is performed to pair v2And (4) deleting.
CN201910078738.2A 2019-01-28 2019-01-28 Outsourcing database full-operation query verification system and method based on authentication tree Active CN109800235B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910078738.2A CN109800235B (en) 2019-01-28 2019-01-28 Outsourcing database full-operation query verification system and method based on authentication tree

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910078738.2A CN109800235B (en) 2019-01-28 2019-01-28 Outsourcing database full-operation query verification system and method based on authentication tree

Publications (2)

Publication Number Publication Date
CN109800235A CN109800235A (en) 2019-05-24
CN109800235B true CN109800235B (en) 2021-06-15

Family

ID=66560399

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910078738.2A Active CN109800235B (en) 2019-01-28 2019-01-28 Outsourcing database full-operation query verification system and method based on authentication tree

Country Status (1)

Country Link
CN (1) CN109800235B (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304423A (en) * 2008-07-08 2008-11-12 北京邮电大学 Method and system for authenticating user identification
CN101867929A (en) * 2010-05-25 2010-10-20 北京星网锐捷网络技术有限公司 Authentication method, system, authentication server and terminal equipment
WO2017023388A3 (en) * 2015-07-07 2017-03-09 Private Machines Inc. Secure data management system and method
CN107451281A (en) * 2017-08-08 2017-12-08 东北大学 Outsourced database SQL query integrity verification system and method based on ADS
CN109274655A (en) * 2018-09-04 2019-01-25 东北大学 A kind of inquiry integrity verification system and method facing out packet stream data

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304423A (en) * 2008-07-08 2008-11-12 北京邮电大学 Method and system for authenticating user identification
CN101867929A (en) * 2010-05-25 2010-10-20 北京星网锐捷网络技术有限公司 Authentication method, system, authentication server and terminal equipment
WO2017023388A3 (en) * 2015-07-07 2017-03-09 Private Machines Inc. Secure data management system and method
CN107451281A (en) * 2017-08-08 2017-12-08 东北大学 Outsourced database SQL query integrity verification system and method based on ADS
CN109274655A (en) * 2018-09-04 2019-01-25 东北大学 A kind of inquiry integrity verification system and method facing out packet stream data

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
一种具有访问控制的云平台下外包数据流动态可验证方法;孙奕等;《计算机学报》;20170228;第40卷(第2期);全文 *

Also Published As

Publication number Publication date
CN109800235A (en) 2019-05-24

Similar Documents

Publication Publication Date Title
JP6955026B2 (en) Systems and methods for parallel processing blockchain transactions
Do et al. Blockchain-based system for secure data storage with private keyword search
US11811769B2 (en) Systems, methods, and apparatuses for implementing a declarative, metadata driven, cryptographically verifiable multi-network (multi-tenant) shared ledger
US11743137B2 (en) Systems, methods, and apparatuses for implementing a metadata driven rules engine on blockchain using distributed ledger technology (DLT)
US11824864B2 (en) Systems, methods, and apparatuses for implementing a declarative and metadata driven blockchain platform using distributed ledger technology (DLT)
Wu et al. VQL: Efficient and verifiable cloud query services for blockchain systems
CN110622488B (en) System and method for managing user interaction with blockchains
CN106897368B (en) Merkle Hash summation tree and verifiable database updating operation method thereof
CN106991148B (en) Database verification system and method supporting full-update operation
CN107451281B (en) Outsourcing database SQL query integrity verification system and method based on ADS
Miao et al. Efficient verifiable databases with insertion/deletion operations from delegating polynomial functions
CN111488396A (en) Data synchronization method and device for service data block chain
CN111488608A (en) Data verification method and device for service data block chain
JP2023547716A (en) merkle proof entity
Xu et al. Efficient public blockchain client for lightweight users
CN109800235B (en) Outsourcing database full-operation query verification system and method based on authentication tree
Miao et al. Verifiable data streaming protocol supporting update history queries
US11750392B1 (en) Authenticated index data structure with back-pointers
CN113535803A (en) Block chain efficient retrieval and reliability verification method based on keyword index
CN111488611B (en) Relation data storage method and device of business data block chain
CN111488352A (en) Point exchange method and device based on business data block chain
CN111695136A (en) Method and system for realizing service data block chain
Loporchio et al. A survey of set accumulators for blockchain systems
CN111488606B (en) Data sharing method and device based on service data block chain
US20240106670A1 (en) Headers client for determining the best chain

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant