KR101548654B1 - Apparatus and method for database query using ordered bucket with secure encryption - Google Patents

Abstract

The present invention relates to an apparatus and a method for a database query using an ordered bucket with a secure encryption system. The device includes: an encryption processing unit which receives a plain text input to encrypt the plain text input to the corresponding encrypted text, and receives the encrypted text to decode the encrypted text to the corresponding plain text; a database unit which stores a record composed of the encrypted text, and a bucket number of the record; and a query unit which receives a query, searches for the record subjected to the query in the database unit, decodes the record into a plain text, and outputs the decoded text. The present invention uses a sequence bucket to have an encryption scheme secure with respect to the IND-OCPA-P security model. Accordingly, the present invention can improve the security of the encrypted database which can be queried without being decoded.

Description

TECHNICAL FIELD [0001] The present invention relates to a database query device and method using a secure bu er,

The present invention relates to an apparatus and method for querying a database using a security cipher system and using an order bucket, and more particularly, to a database query apparatus and method employing an order cipher with a secure encryption scheme for an IND-OCPA- Apparatus and method.

The encryption database stores the information as a record of the encrypted ciphertext using the encryption algorithm from the plain text. In this case, since the property such as the order relation established in the plaintext space may not hold with respect to the cipher text, it is necessary to decipher the cipher text in order to perform the query on the cipher text.

On the other hand, Symmetric Encryption Algorithm is faster than Public Key Encryption Algorithm in encryption algorithm, so symmetric encryption algorithm is mainly used in encryption database.

In this case, an index method using a bucket has been introduced to solve the problem of decoding all the records stored in the encrypted database. Cryptography using buckets Database systems use buckets to separate records that are stored in the database. At this time, all encrypted ciphertexts are assigned a specific bucket number, and when encrypting the same plaintext, they are assigned the same bucket number. Therefore, it is possible to retrieve records subject to a query by decrypting only records constituted by ciphertexts having a bucket number equal to a bucket number allocated when a plaintext to be a query is encrypted. It is also possible to use an ordered bucket in which the bucket number preserves the order in the plaintext space. In this case, a range query that searches for records belonging to a specific range given by the query can be efficiently performed Is known.

Conventional database query methods using buckets in relation to the security of an encryption database system using such an ordering bucket are based on the INDINIABILITY OF ORDERED CHANNEL INTERPRETATION WITHIN POLYMINAL QUERYING DISTANCE (IND- OCPA-P) security model.

Korean Patent No. 10-0859162 (filed on Sep. 11, 2008, entitled " Apparatus and method for processing a user query through cryptographic modulation of a query in a database including an encrypted column, claim 1) .

It is an object of the present invention to provide a database query device and method using an order bucket having a secure encryption scheme for the IND-OCPA-P security model.

A database query apparatus having a secure encryption scheme according to an aspect of the present invention, which uses a sequence bucket, receives a plain text, encrypts the plain text with a corresponding cipher text, calculates a bucket number corresponding to the plain text, A cryptographic processing unit for receiving the ciphertext and decrypting the ciphertext with the plaintext corresponding to the ciphertext, a database unit for storing a record composed of the ciphertext and the bucket number of the record, and a record receiving the query, The query unit searches the database unit for a record whose bucket number matches a record that is a search object of the query, and decodes the search result into a plain text, The key Selects the values of the keys used for encryption and decryption, selects values of each element of the key vector having the same size as the predetermined number of buckets in the plaintext space, generates the key and key vector by sorting in ascending order, The index value of the first element whose value is equal to or larger than the plain text is calculated as the bucket number of the plain text.

According to another aspect of the present invention, there is provided a database query method having a security encryption scheme and using an order bucket, the method comprising: receiving a query from a query part user; inputting a plaintext, Storing a bucket number corresponding to the query in the database unit, searching the database unit for a record composed of ciphertexts to be searched by the query unit, and decrypting the record into a plaintext based on the key input by the encryption processing unit And outputting.

Preferably, in the searching step, the query unit searches the database unit for a record whose bucket number matches a record that is a search target of the query.

Preferably, in the retrieving step, the query unit records the record in which the bucket number of the record exists within a range determined by the bucket number of the plain text at both ends of the range of the plain text designated by the query, And searching for the search result.

Preferably, the encryption processing unit selects the value of the key in the key space, selects the value of each element of the key vector having the same size as the number of buckets in the plaintext space, arranges the key vector in ascending order, .

Preferably, the encryption processing unit calculates the index value of the first element whose value is equal to or greater than the plain text as the bucket number of the plain text.

According to the present invention, it is possible to query without decrypting an encrypted database using an order bucket, and to provide a secure encryption scheme for the order-bucket, IND-OCPA-P security model, The security of the database can be improved.

1 is a block diagram of a database query device having a secure encryption scheme and using an order bucket according to an embodiment of the present invention.
2 is a flowchart illustrating an operation of a database query method having a secure encryption scheme and using an order bucket according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a database query device and method having a secure encryption scheme and using an order bucket according to the present invention will be described in detail with reference to the accompanying drawings. In this process, the thicknesses of the lines and the sizes of the components shown in the drawings may be exaggerated for clarity and convenience of explanation. In addition, the terms described below are defined in consideration of the functions of the present invention, which may vary depending on the intention or custom of the user, the operator. Therefore, definitions of these terms should be made based on the contents throughout this specification.

1 is a block diagram of a database query device having a secure encryption scheme and using an order bucket according to an embodiment of the present invention.

1, a database query apparatus having a secure encryption scheme and using an order bucket according to an embodiment of the present invention includes an encryption processing unit 100, a query unit 200, and a database unit 300 ).

The encryption processing unit 100 receives the plaintext, encrypts the plaintext with the corresponding cipher text, receives the cipher text, and decrypts the cipher text with the plaintext corresponding thereto.

Generally, the encryption database stores the data to be stored in the form of a record composed of encrypted ciphertexts, and the user must decrypt and query the encrypted record.

For encryption and decryption, a pre-set key is used. A plaintext is encrypted using a specific key to generate a cipher text. The generated cipher text is decrypted using the same key to restore the original plaintext that generated the cipher text. can do. That is, the security of the ciphertext can be maintained by keeping such a key secret. This encryption scheme is called a symmetric encryption scheme.

In this case, the symmetric cryptosystem can be represented by the symbol SE = ( K , E , D ) for plaintext space M and ciphertext space C , and SE is composed of three algorithms. It is also known that the symmetric encryption scheme currently used for the Indistinguishablity Under Chosen Plaintext Attack (IND-CPA) model under the selected plaintext attack is secure.

First, the key generation algorithm K is a randomized algorithm that selects one key in the plaintext space. Encryption Algorithm E receives secret key K and plaintext m, outputs ciphertext c, and can be a randomized algorithm or a deterministic algorithm. Decryption Algorithm D is a deterministic algorithm that receives a secret key K and a cipher text c and outputs a plaintext m or a special symbol ⊥. In this case, ⊥ may mean that the cipher text is not a valid cipher text.

In addition, as described above, in order to process a query without decrypting all the records stored in the database, the records stored in the database are divided into buckets. At this time, all encrypted ciphertexts are assigned a specific bucket number, and when encrypting the same plaintext, they are assigned the same bucket number. Therefore, it is possible to retrieve records subject to a query by decrypting only records constituted by ciphertexts having a bucket number equal to a bucket number allocated when a plaintext to be a query is encrypted.

Here, an encryption method using an order bucket (EOB) can be constructed by an algorithm for determining a bucket number and an algorithm for selecting a key.

First, the ordered bucket scheme is represented by the symbols OB _{p, M} ( K _OB , T _OB ) and is given by the following equation (1).

In Equation (1), K _OB is a randomized algorithm for generating a key vector, and T _OB is a Dterministic Algorithm for calculating a bucket number. That is, according to Equation (1), p represents a natural number representing the number of buckets, and K _OB represents a randomized algorithm that outputs a vector of length p composed of plain texts belonging to the plain text space M, taking a natural number as an input.

Also, T _OB is a deterministic algorithm for calculating a bucket number, and receives a key vector K _OB and a value m belonging to a plain space, and outputs a natural number belonging to the interval between 0 and p-1. At this time T _OB is, the plaintext space is referred to as M, K _OB key and vector generation algorithm K _OB a key that is generated with respect to the number p of the bucket vector, m ₀ and m ₁ is made uniform on the plaintext space M selected at random If it is plaintext, then T _OB (K _OB , m ₀ ) ≥ T _OB (K _OB , m ₁ ) and m ₀ ≥ m ₁ are logically equivalent. A bucket satisfying these conditions is called an ordered bucket. That is, the algorithm T _OB can classify a given plaintext into an ordered bucket.

It is also possible to construct Symmetric Encryption with Ordered Bucketization EOB [ OB _{M , p} , SE ] ( K _EOB , E _EOB , D _EOB ) by combining this ordering bucket scheme and symmetric encryption scheme.

Symmetric order bucket encryption EOB [ OB _{M , p} , SE ] ( K _EOB , E _EOB , D _EOB ) is given by:

In Equation 2, K _EOB is an algorithm for generating a key, take a natural number p indicates the number of buckets to the input, the key generation algorithm to generate a key K by K and the key to the key vector generation algorithm K _OB vector K _OB And outputs a pair K _EOB of K and K _OB . Encryption algorithm E _EOB is key generation algorithm output of K _EOB K _EOB and the plain text m an input received, the key vector containing the K _EOB ciphertext c and, K _EOB obtained by entering a secret key K and encrypting m algorithm E contained in K _OB and m are input to the bucket number algorithm T _OB to obtain the bucket number bucket # obtained, and the pair C _EOB to which bucket # and c are connected is output. Decryption algorithm D _EOB is obtained by entering the receiving the output K _EOB and outputs C _EOB of the encryption algorithm E _EOB of the key generation algorithm K _EOB are included in K _EOB the secret key K and C _EOB included in the cipher text C to the decryption algorithm D Output the plain m.

Equation (3) below shows an implementation example of the key vector generation algorithm K _OB .

Equation (4) below shows an implementation example of the bucket number calculation algorithm T _OB .

Here, the encryption processing unit 100 includes a key generation unit 130 for generating a key vector used for encryption and decryption based on the number of predetermined buckets, and a key vector used for calculating a bucket number, A decryption unit 120 that receives the key and the ciphertext and decrypts the ciphertext into a plain text, and a bucket processing unit that receives the key vector and the plain text and calculates a bucket number corresponding to the plain text, .

That is, the encryption unit 110 can perform the encryption algorithm E of the symmetric encryption scheme and the encryption algorithm E _EOB included in the equation (2), and the decryption unit 120 decrypts the symmetric encryption scheme decryption algorithm D and the equation 2, the decryption algorithm contained in the can to perform a D _EOB.

Also, the key generation unit 130 may perform the key generation algorithm K of the symmetric encryption scheme, the key vector generation algorithm K _OB included in the equation (1), and the key generation algorithm K _EOB included in the equation (2) (140) may perform the bucket number calculation algorithm T _OB included in Equation (1).

At this time, the key generation unit 130 selects the value of the key in the key space Keys as shown in the key generation algorithm K , and calculates the key vector K as the key vector generation algorithm K _OB and the number of buckets p as shown in equation (3) A key and a key vector can be generated by selecting the value of each element of the size key vector in the plaintext space M and sorting in ascending order.

Also, as shown in Equation (4), the bucket processing unit 140 can calculate the index value ret of the first element whose value is equal to or larger than the given plain-text m, as the bucket number of the plain m.

The IND-OCPA-P security model has been proposed to evaluate the security of symmetric order bucket encryption as described above.

Assuming that A is an adversary, that is, an algorithm and b has a value of 0 or 1, for the symmetric encryption system SE ( K , E , D ), the experiment given by the following equation 5 can be considered.

In Equation (5), the LR oracle LR (·, · b) is an oracle that selects one according to the value of b among the two plaintexts M ₁ and M ₂ . Attacker A is an algorithm that queries LR Oracle and then matches the value of b given to LR Oracle.

At this time it is when the attacker A and then meet the condition given by equation (6) growing the attacker A attacks the q-ind-ocpa-p. Where q is the maximum number of queries allowed for attacker A , and A produces a query {m ₀ ⁱ , m ₁ ⁱ } (1 ≤ i ≤ q) of q plaintext pairs.

For all efficient q-ind-ocpa-p attackers A , if the q-ind-ocpa-p gain defined by Equation (7) is sufficiently small, the symmetric cryptosystem SE is q-ind-ocpa- p Defines security.

이 성립하면 SE는 IND-OCPA-P 모델에서 안전하다고 정의한다.Now, the security of the symmetric order bucket encryption EOB [ OB _{M , p} , SE ] can be defined as follows. For a symmetric encryption scheme SE ( K , E , D ), given a Security Parameter 1 ^l and for all attackers A ,

, SE is defined as safe in the IND-OCPA-P model.

At this time, the following equation (8) holds for the symmetric order bucket encryption EOB [ OB _{M , p} , SE ] using the embodiment given in the above Equations (3) and (4).

However, the condition of Equation (8) means that the symmetric key cryptosystem SE used by the symmetric order bucket cipher EOB [ OB _{M , p} , SE ] is secure in the IND-CPA model and the currently used symmetric key cryptosystem is INC Safety is known in the CPA model. Therefore, the symmetric order bucket encryption EOB [ OB _{M , p} , SE ] is safe in the IND-OCPA-P model.

The database unit 300 stores a record composed of ciphertexts and a bucket number of a record. That is, the record stored in the encryption database is encrypted and stored, and the original text corresponding to the record is received, and the bucket number calculated by the bucket processing unit 140 can be stored in a pair with the encrypted record.

The query unit 200 receives the query, searches the database unit 300 for a record that is the object of the query, decodes it into a plain text, and outputs the plain text.

At this time, the query unit 200 can decode only a part of the records stored in the database unit 300 into a plain text. That is, the query unit 200 can perform the query without decoding all the records using the bucket number stored together with the encrypted record in the database unit 300. [

Here, the query unit 200 can search the database unit 300 for a record whose bucket number matches the record to be searched for in the query, and decode it into plain text.

That is, since the bucket number generation algorithm is deterministic, if the plaintext matches, the bucket number is matched. Therefore, the record to be queried can exist only in the record whose bucket number matches the query target record. Therefore, only the records matching the query target and the bucket number are searched and decoded by the database unit 300, so that queries can be performed without decoding all the databases.

In addition, the query specifies the range of the plain text, and the query unit 200 records a record in which the bucket number of the record exists within the range determined by the bucket number of the plain text at both ends of the range of the plain text, Can be searched and decoded.

That is, when the query is a range query specifying the range of the plain text, since the bucket number calculated as described above with respect to Equation 1 is the bucket number of the order bucket, the bucket number of the plain text included in the range specified by the query, Is included in the range of the bucket number given by the bucket number calculated for the two plain texts corresponding to both ends of the range of. Thus, the range query can be performed by retrieving only the records in which the bucket number exists within the range of the bucket number determined by the bucket number of the plaintext at both ends of the range, so that the query can be performed without decrypting all the databases .

2 is a flowchart illustrating an operation of a database query method having a secure encryption scheme and using an order bucket according to an embodiment of the present invention. A database query method having a secure encryption scheme according to an embodiment of the present invention and using an order bucket will be described.

First, the encryption processing unit 100 selects a value of a key in a key space, selects a value of each element of the key vector having the same size as the number of buckets in the plaintext space, and arranges it in ascending order to generate a key and a key vector (S110 ). At this time, the key generation unit 130 included in the encryption processing unit 100 may generate a key and a key vector by performing a key generation algorithm KEOB included in Equation (2). The number of buckets may also be a predetermined natural number. That is, the key generation unit 130 may generate the key vector according to the embodiment of Equation (3).

Then, the encryption processing unit 100 receives the plain text and encrypts the plain text (S120). At this time, the encryption unit 110 included in the encryption processing unit 100 can encrypt the plain text by performing the encryption algorithm E.

Thereafter, the encryption processing unit 100 calculates the bucket number corresponding to the plain text (S130). At this time, the bucket processing unit 140 included in the encryption processing unit 100 can calculate the bucket number by performing the bucket number calculation algorithm T _OB included in the equation (1).

That is, the encryption processing unit 100 may perform the encryption algorithm E _EOB included in Equation (2) and E _EOB may encrypt the plaintext and calculate the bucket number by calling the encryption algorithm E and the bucket number calculation algorithm T _OB . Also, the bucket processing unit 140 may calculate the bucket number according to the embodiment of Equation (4).

Subsequently, the encryption processing unit 100 stores the bucket numbers corresponding to the ciphertext and the plaintext in the database unit 300 (S140). That is, the database unit 300 may store the encrypted record and the bucket number of the record as a pair.

Thereafter, the query unit 200 receives a query from the user (S140).

Subsequently, the query unit 200 searches the database unit 300 for a record composed of ciphertexts to be searched for in a query (S150).

At this time, the query unit 200 can search the database unit 300 for a record whose bucket number matches the record of the query target. That is, since the bucket number generation algorithm is deterministic, if the plaintext matches, the bucket number is matched. Therefore, the record to be queried can exist only in the record whose bucket number matches the query target record. Therefore, only the records matching the query target and the bucket number are searched and decoded by the database unit 300, so that queries can be performed without decoding all the databases.

In addition, the query unit 200 may search the database unit 300 for a record in which the bucket number of the record exists within a range determined by the bucket number of the plain text at both ends of the range of the plain text specified by the query. That is, when the query is a range query specifying the range of the plain text, since the bucket number calculated as described above with respect to Equation 1 is the bucket number of the order bucket, the bucket number of the plain text included in the range specified by the query, Is included in the range of the bucket number given by the bucket number calculated for the two plain texts corresponding to both ends of the range of. Thus, the range query can be performed by retrieving only the records in which the bucket number exists within the range of the bucket number determined by the bucket number of the plaintext at both ends of the range, so that the query can be performed without decrypting all the databases .

Thereafter, the encryption processing unit 100 decrypts the record into a plain text based on the received key (S170). At this time, the decryption unit 120 included in the encryption processing unit 100 can perform the decryption algorithm D _EOB included in Equation (2) to decrypt the encrypted record into a plain text.

Subsequently, the encryption processing unit 100 outputs the decrypted plain text and terminates the process (S180).

Here, it is described that a procedure for receiving and encrypting a plaintext and storing it in the database unit 300 and a procedure for searching and decrypting encrypted records stored in the database unit 300 are all performed. However, Therefore, either the encryption procedure or the decryption procedure can be performed, and the order of the encryption procedure and the decryption procedure can be changed.

Equation (8) holds for the symmetric order bucket encryption given by Equation (2) and using the implementation of Equations (3) and (4) as described above, It is safe in the OCPA-P model.

As described above, according to the present invention, it is possible to query without decrypting an encrypted database using an order bucket, and to provide a secure encryption scheme for the IND-OCPA-P security model in order buckets, The security of the encrypted database can be improved.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. I will understand. Accordingly, the technical scope of the present invention should be defined by the following claims.

100: encryption processing unit 110:
120: Decryption unit 130:
140: Bucket processing unit 200: Query unit
300:

Claims (6)

A cryptographic processor for receiving the plaintext, encrypting the plaintext with the corresponding ciphertext, calculating a bucket number corresponding to the plaintext, receiving the ciphertext, and decrypting the ciphertext with the plaintext corresponding thereto;
A database unit storing a record composed of the cipher text and the bucket number of the record; And
And a query unit which receives a query and searches the database unit for a record, which is the subject of the query, using the bucket number, decodes the query into a plain text,
Wherein the query unit searches the database unit for a record whose bucket number matches a record to be searched for in the query, decodes it into a plain text,
The encryption processing unit selects a value of a key used for encryption and decryption in a key space, selects a value of each element of the key vector having a size equal to the number of predetermined buckets in a clear space, arranges the key in ascending order, And generates an index value of the first element whose value is equal to or greater than the plain text as the bucket number of the plain text.
Receiving a query from a query part user;
Storing a cipher text in which the encryption processing unit receives the plaintext and encrypts the plaintext and a bucket number corresponding to the plaintext in the database unit;
Searching the database unit for a record including the ciphertexts to be searched by the query unit; And
And decrypting the record into a plain text based on the key received by the encryption processing unit and outputting the encrypted record.
3. The method of claim 2,
In the retrieving step,
Wherein the query unit searches the database unit for a record whose bucket number matches a record to be searched for in the query, in the database unit.
3. The method of claim 2,
In the retrieving step,
Wherein the query unit searches the database unit for the record in which the bucket number of the record exists within a range determined by the bucket number of the plain text at both ends of the range of the plain text designated by the query How to query the database.
3. The method of claim 2,
The encryption processing unit selects the value of the key in the key space, and selects the value of each element of the key vector having the same size as the number of buckets in the clear space and arranges it in ascending order to generate the key and the key vector A database query method using an order bucket.
6. The method of claim 5,
And the encryption processing unit calculates the index value of the first element whose value is equal to or greater than the plain text as the bucket number of the plain text.

Images