KR101703828B1 - Method of generating index tag for encrypted data. method of searching encrypted data using index tag and database apparatus for the same - Google Patents

Abstract

Disclosed are a method of creating an index tag for an encrypted data, a method of searching the encrypted data using the index tag, and a database apparatus for the same. The method of creating an index tag for an encrypted data according to an embodiment of the present invention comprises: a step of allocating an unique number to all nodes of a B+ tree from a root node of the B+ tree; a step that a leaf node of the B+ tree creates an index tag by sequentially adding a number after the unique number corresponding to the leaf node; and a step of allocating the index tag to a key value corresponding to an encrypted data. Therefore, a sorting function using the index tag is provided.

Description

TECHNICAL FIELD [0001] The present invention relates to an index tag generation method for encrypted data, an encrypted data retrieval method using an index tag, and a database apparatus for the same. METHOD OF SEARCHING ENCRYPTED DATA USING INDEX TAG AND DATABASE APPARATUS FOR THE SAME}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a database storing encrypted data, and more particularly, to a technique for providing sorting and searching functions for encrypted data (columns) through an index tag.

Database encryption is a technique for converting data into ciphertext and storing it in a database for the purpose of protecting information about the data. However, since the encrypted data is stored in the database, it is necessary to decrypt the encrypted column to search for and sort the plaintext before performing the encryption. If there is no sorting information for an encrypted column, full decryption of the corresponding column is inevitable when retrieving the encrypted data, and this total decryption causes degradation of the performance of the database system.

Korean Patent Publication No. 2010-0112298 discloses a system for partially encrypting data according to characteristics of data to be encrypted and performing an index search according to partial encryption. However, Korean Patent Publication No. 2010-0112298 is a technique that can not be applied when all data is encrypted.

Korean Unexamined Patent Publication No. 2006-0007925 discloses a technique for decrypting an encrypted column and then generating a separate bitmap index indicating the order of plain text. However, Korean Unexamined Patent Publication No. 2006-0007925 has a problem that the size of the index increases in proportion to the data size because the index of the data is represented by the bitmap.

Thus, there is a need for indexing techniques for new encrypted data that can be sorted and retrieved more efficiently for encrypted columns.

An object of the present invention is to provide an alignment function through an index tag by assigning an index tag to encrypted data using a B + tree structure.

It is another object of the present invention to minimize unnecessary data decryption through B + tree search when performing a search using a B + tree structure based index tag.

It is also an object of the present invention to provide privacy and confidentiality of the database encryption by performing sorting and retrieval of efficiently encrypted data while preventing exposure or analogy to plain text.

According to another aspect of the present invention, there is provided a method of generating an index tag for encrypted data, the method comprising: assigning a unique number to all nodes of the B + tree from a root node of the B + tree; Generating index tags by connecting leaf nodes of the B + tree to leaf nodes sequentially after a unique number corresponding to the leaf node; And sequentially assigning the index tag to a key value corresponding to the encrypted data.

At this time, the length of the index tag is equal to the height of the B + tree, and the sort order of the encrypted data corresponding to the index tag can be determined according to the size of the index tag.

At this time, the additional number may be a natural number starting from 1. [

In this case, the unique number may be generated by appending an additional number starting from 0 after the number given by each of the nodes, and assigning the unique number corresponding to the child node.

The retrieval method using the index tag for the encrypted data according to an embodiment of the present invention may further include retrieving at least one of the node number of the node of the B + tree to be retrieved, the tree level of the node, Initializing; Generating a search query using the index tag; Extracting a node of the B + tree corresponding to the search statement by searching for the level of the B + tree using the search statement; And generating a search result using the encrypted data corresponding to the node of the B + tree.

At this time, the search statement may be a like search statement including a wildcard for the index tag.

At this time, the search statement may include a duplicate elimination part to avoid duplicate searches.

At this time, the search statement may include a variable part that is determined based on the search result through the search statement corresponding to the previous level with respect to the level excluding the level corresponding to the root node.

At this time, the number of digits of the variable part can be determined according to the level.

At this time, the wild card may be located immediately after the variable part if the variable part exists.

At this time, the step of generating a search result may perform data decoding only on nodes of the B + tree corresponding to the search statement.

In addition, the database device using the index tag for the encrypted data according to an embodiment of the present invention includes an index tag generated by sequentially connecting additional numbers after a unique number corresponding to a leaf node of a B + tree, An index tag generating unit for sequentially assigning the key value corresponding to the encrypted data to the key value; And an index tag search unit for generating a search query using the index tag and searching for each level of the B + tree using the search query to generate a search result corresponding to the search query.

At this time, the index tag search unit searches the level of the B + tree using the search statement to extract the node of the B + tree corresponding to the search statement, and transmits the encrypted data corresponding to the node of the B + tree To generate the search result.

At this time, the search statement may be a like search statement including a wildcard for the index tag.

At this time, the search statement may include a variable part that is determined based on the search result through the search statement corresponding to the previous level with respect to the level excluding the level corresponding to the root node.

At this time, the number of digits of the variable part can be determined according to the level.

At this time, the wild card may be located immediately after the variable part if the variable part exists.

At this time, the index tag search unit can perform data decoding only on the node of the B + tree corresponding to the search statement.

At this time, the index tag can be generated by sequentially connecting additional numbers after unique numbers corresponding to the leaf nodes of the B + tree.

At this time, the length of the index tag is equal to the height of the B + tree, and the sort order of the encrypted data corresponding to the index tag can be determined according to the size of the index tag.

According to the present invention, an index tag can be allocated to encrypted data using a B + tree structure, thereby providing an alignment function through an index tag.

In addition, the present invention minimizes unnecessary data decoding through B + tree search when a search is performed using a B + tree structure based index tag.

In addition, the present invention can provide sorting and retrieval of encrypted data and confidentiality of database encryption by preventing exposure or analogy to plaintexts.

1 is a diagram showing a B + tree structure.
FIG. 2 is a diagram illustrating a process of assigning an index tag in a width-first search method.
3 is a diagram showing an example in which an index tag is assigned to a key value of a node.
4 is a diagram illustrating a process of assigning an index tag in a depth-first search method.
5 is a flowchart illustrating an index tag generation method for encrypted data according to an exemplary embodiment of the present invention.
6 is a flowchart illustrating a search method using an index tag for encrypted data according to an exemplary embodiment of the present invention.
FIGS. 7 to 12 are diagrams illustrating a search process using an index tag.
13 is a block diagram illustrating a database device using an index tag for encrypted data according to an embodiment of the present invention.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a B + tree structure.

Referring to FIG. 1, a B + tree includes a non-leaf node 120 having child nodes and a leaf node 130 having no child nodes. In particular, at the top of the non-leaf node 120, there is a root node 120.

The B + tree is a data structure for maintaining the alignment of the columns in the DBMS. In the present invention, a method of representing the B + tree structure by an index tag is proposed.

~m개의 자식 노드를 가진다. 또한, 루트 노드는 1~m-1개의 키를 가지며, 루트 노드가 아닌 리프 노드는

~m-1의 키를 가진다. 또한, 논-리프 노드가 가지는 키 개수는 자식 노드의 개수보다 1 작다.In the B + tree, all leaf nodes have the same height (distance from the root), and the maximum number of children each node has is m (m is an integer greater than or equal to 0), the root node has 2 to m child nodes , The non-leaf node excluding the root node

It has ~ m child nodes. In addition, the root node has 1 to m-1 keys, and leaf nodes other than the root node

It has a key of ~ m-1. Also, the number of keys of a non-leaf node is one less than the number of child nodes.

The example shown in FIG. 1 shows a B + tree with m = 5, where non-leaf nodes other than the root node have 3 to 5 child nodes, and leaf nodes have 3 to 4 key values.

According to one embodiment of the present invention, all key values in the B + tree are present at the leaf node.

In the present invention, a rule for assigning a unique index tag value to a key value existing in a leaf node is as follows. The root node assigns each child node a unique number (integer) from 0 in sort order. A non-leaf node having a unique number is assigned a unique number to the child node in the sorting order by appending a number from 0 to the number after the assigned number. For example, when the non-leaf node A receives a unique number 1 from an upper node, the non-leaf node A assigns the child nodes B, C, and D the unique numbers 10, 11, A leaf node assigned a unique number assigns a unique integer index tag value to each key value by adding a number (integer) from 1 after the assigned number.

The number (unique number, additional number, etc.) given in the present invention is a concept including numbers or letters, and may include all symbols capable of representing a pre / post relationship. For example, the number may be an integer, a natural number, or the like, or may be one or more alphabetic characters. In this case, the number may be a hexadecimal number, an octal number, or a binary number as well as a decimal number.

FIG. 2 is a diagram illustrating a process of assigning an index tag in a breadth first search method.

Referring to FIG. 2, the tree is traversed in the order of node 1 -> node 2 -> node 3 -> node 4 -> node 5 -> node 6 -> node 7 -> node 8 -> node 9, It can be seen that an index tag is assigned to the key value.

The root node 210 assigns the unique numbers 0 and 1 to the node 2 (220) and the node 3 (230), which are child nodes, respectively.

node 2 220 assigns its own numbers 00, 01 and 02 to node 4 240, node 5 250 and node 6 260, respectively. In addition, the node 3 230 assigns the unique numbers 10, 11, and 12 to the node 7 270, the node 8 280, and the node 9 290. The leaf node generates an index tag by appending an additional number to the leaf node in accordance with the sequence of key values after the unique number.

For example, if the node 8 (280) having the unique number 11 has key values w, x, y, and z, index tags 111, 112, 113, and 114 may be respectively assigned thereto.

3 is a diagram showing an example in which an index tag is assigned to a key value of a node.

Referring to FIG. 3, when node 8 381 has key values w, x, y, z, it can be seen that the index tag is assigned as table 382. That is, the table 382 shows the index tag assigned to each key value.

2, the height of the B + tree is 3, and node 1 210 belongs to level 1, node 2 220, node 3 230 to level 2, and the remaining leaf nodes 240, 250, 260, 270, 280, 290) belong to level 3. In addition, since the unique number is assigned to each level, the length of the index tag of all the items in the leaf node is 3. Since each level is assigned a unique number in the sort order, the sort order of the index tag is the same as the sort order in the B + tree.

FIG. 4 is a diagram illustrating a process of assigning an index tag using a depth first search method.

Referring to FIG. 4, the tree is traversed in the order of node 1 -> node 2 -> node 4 -> node 5 -> node 6 -> node 3 -> node 7 -> node 8 -> node 9, It can be seen that an index tag is assigned to the key value. The leaf node assigns a unique index tag value to each key value. The result of the index tag assigned to each key value is the same as in Fig.

The features of the index tag proposed in the present invention are as follows.

The length of the index tag is the same as the height of the B + tree. Items with a low index tag have a faster sort order than items with a high index tag.

When the index tag proposed in the present invention is applied to an encrypted column, the sort order for plain text can be indicated using an index tag.

5 is a flowchart illustrating an index tag generation method for encrypted data according to an exemplary embodiment of the present invention.

Referring to FIG. 5, an index tag generation method for encrypted data according to an embodiment of the present invention assigns a unique number to all nodes of the B + tree from a root node of the B + tree ( S510).

At this time, the length of the index tag is equal to the height of the B + tree, and the sort order of the encrypted data corresponding to the index tag can be determined according to the size of the index tag.

Also, an index tag generation method for encrypted data according to an exemplary embodiment of the present invention is a method for generating an index tag for an encrypted data by associating an additional number sequentially with a unique number corresponding to the leaf node of a B + (S520).

At this time, the additional number may be a natural number starting from 1. [

In this case, the unique number may be generated by appending an additional number starting from 0 after the number given by each of the nodes, and assigning the unique number corresponding to the child node.

In addition, in the method of generating an index tag for encrypted data according to an embodiment of the present invention, the index tag is sequentially allocated to a key value corresponding to the encrypted data (S530).

As described above, according to the present invention, it is possible to arrange the order of plaintexts for encrypted columns in an application of database encryption using an index tag, and perform efficient tree search by performing an index tag search.

6 is a flowchart illustrating a search method using an index tag for encrypted data according to an exemplary embodiment of the present invention.

Referring to FIG. 6, a search method using an index tag for encrypted data according to an exemplary embodiment of the present invention includes a step of determining a node number of a node of a B + tree to be searched, a tree level of the node, And initializes at least one of them (S610).

That is, in step S610, a value to be searched for, a unique number (nodeID) of a node to perform a query, a tree level of a node to be searched, and a length h of an index tag are initialized . At this time, the data to be searched (Key) may be decrypted (unencrypted) data to be searched in the database.

In the present invention, since each inquiry is performed for each level, it is performed a maximum of h times (S620).

The search method using the index tag for the encrypted data according to an embodiment of the present invention generates a search statement using the index tag (S625).

At this time, the search statement may be a like search statement including a wildcard for the index tag.

At this time, the wildcard may be '_'. At this time, the wildcard '_' may be to replace any string. For example, if the search condition of the likesearch query is 'ABC_DFG', a 7-character string starting with ABC and ending with EFG may be searched.

At this time, the search statement may include a duplicate elimination part to avoid duplicate searches.

At this time, the search statement may include a variable part determined based on the search result through the search statement corresponding to the previous level with respect to the level excluding the level corresponding to the root node.

At this time, the number of digits of the variable part can be determined according to the level.

At this time, the wild card may be located immediately after the variable part if the variable part exists.

The retrieval method using the index tag for the encrypted data according to the embodiment of the present invention performs like retrieval using the unique number (nodeID) of the node (S630).

The retrieval method using the index tag for the encrypted data according to the embodiment of the present invention extracts the retrieved records in the order of index tags (S642) for each retrieved record (S640, S641) With a value (key) (S643).

If it is determined in step S643 that the searched record is smaller than the key value to be searched, the search for the next item is performed (S644).

If it is determined in step S643 that the retrieved record is smaller than or equal to the key value to be retrieved, it is determined in step S645 whether the two values are identical to each other. If they are identical, the corresponding index tag is returned in step S650.

As a result of the determination in step S645, if the two values are not the same (an item larger than the key value is found, or there is no value to be compared any more), a unique number (nodeID) (S660).

If it is determined in step S620 that the level is greater than the length of the index tag, data corresponding to the key value is not retrieved. Therefore, the retrieval failure is returned and the unique number is written (S670).

6 is a process of searching for a node corresponding to a unique number and searching for data corresponding to a key value among encrypted data corresponding to the corresponding node and returning it.

That is, a method of searching for encrypted data using an index tag according to an embodiment of the present invention includes searching a level of a B + tree using a search statement and extracting a node of a B + tree corresponding to a search statement S642, S643, S644, S645, S650, and S660) of generating the search result using the encrypted data corresponding to the node of the B + tree.

In particular, the step S642 corresponds to the process of decrypting the encrypted data, but in the case of the present invention, since it is performed only for the node on the B + tree searched in the present invention, fast encrypted data search is possible while unnecessary decryption is minimized.

For example, if the height of the B + tree is 5, the table in which the index tag is stored is index_table, and the column in which the index tag is stored is index_tag, the likelihood search statement executed at each level can be configured as follows.

View 1: select * from index_table where index_tag like '_0001' and index_tag! = '00001'

View 2: select * from index_table where index_tag like 'X ₁ _001' and index_tag! = 'X ₁ 0001'

View 3: select * from index_table where index_tag like 'X ₁ X ₂ _01' and index_tag! = 'X ₁ X ₂ 001'

View 4: select * from index_table where index_tag like 'X ₁ X ₂ X ₃ _1' and index_tag! = 'X ₁ X ₂ X ₃ 01'

View 5: select * from index_table where index_tag like 'X ₁ X ₂ X ₃ X ₄ _'

The search query X _i is determined in the i-th search statement and becomes the unique number of the node to perform the next query. Also, behind the like statement is index_tag! = 'X ₁ ... 1' with conditional statements to avoid duplicate searches.

The items extracted from the search represent the items of the node selected at each level when performing the tree search.

The item extracted from the query 1 is the same as the item existing in the root node (located at level 1) in the B + tree, and the item extracted from the query 2 is the item of the node .

Tree search performs a search as much as the tree height, meaning that if the corresponding key value can not be found even after performing the query 5, it means that the corresponding key value does not exist.

When the index tag proposed in the present invention is applied to an encrypted column, a decryption process is required in the index tag extraction process (S642). According to the present invention, unnecessary decoding times can be drastically reduced through tree search.

FIGS. 7 to 12 are diagrams illustrating a search process using an index tag.

The index table (index_table) 511, 521, and 531 stores encrypted data enc_data and an index tag of data index_tag.

First, an item of the root node 510 is inquired as follows.

View 1: select * from index_table where index_tag like '_01' and index_tag! = '001'

As a result of inquiry 1, a record having a value of index_tag of 101 is inquired as shown in FIG. The enc_data of the record is decoded and compared with the value a to be searched. If a is larger than the value of the item having the index tag 101, the inquiry about the node 3 520 shown in FIG. 9 is performed as follows.

View 2: select * from index_table where index_tag like '1_1' and index_tag! = '101'

As a result of inquiry 2, records having index_tag values of 111 and 121 are retrieved as shown in FIG. The enc_data of the retrieved record is decoded in order and compared with the value a. If the value a is larger than the decoding result of the record having the index tag 111 and smaller than the decoding result of the record having the index tag 121, the query for the node 8 (530) shown in FIG. 11 is performed as follows.

View 3: select * from index_table where index_tag like '11_'

As a result of inquiry 3, records having index_tag values of 111, 112, 113, and 114 are retrieved as shown in FIG. The enc_data of the retrieved record is decoded in order and compared with the value a. If the same value is found, the corresponding index tag is returned. If the same value is not found, the key value is returned.

In the process described above, the search method using the index tag of the present invention first finds the node 8 530 shown in FIG. 11 and searches for an encryption (encryption) corresponding to the index tags 111, 112, 113, It can be seen that the search result is generated from the obtained data.

According to the present invention, since the tree search is performed using the index tag, the index tag increases in proportion to the log size (log (n)) with respect to the data size n even in the worst case for performing the search Unnecessary data access can be minimized.

13 is a block diagram illustrating a database device using an index tag for encrypted data according to an embodiment of the present invention.

13, the database apparatus using index tags for encrypted data according to an embodiment of the present invention includes an index tag generation unit 1310, an index tag search unit 1320, and an encrypted data DB 1330 do.

The index tag generating unit 1310 sequentially assigns the index numbers generated by sequentially connecting the additional numbers after the unique numbers corresponding to the leaf nodes of the B + tree to the key values corresponding to the encrypted data.

At this time, the index tag can be generated by sequentially connecting additional numbers after unique numbers corresponding to the leaf nodes of the B + tree.

At this time, the length of the index tag is equal to the height of the B + tree, and the sort order of the encrypted data corresponding to the index tag can be determined according to the size of the index tag.

The index tag searching unit 1320 generates a search query using the index tag, and searches for the level of the B + tree using the search query to generate a search result corresponding to the search query.

At this time, the index tag search unit 1320 searches the level of the B + tree using the search statement to extract the node of the B + tree corresponding to the search statement, The search result can be generated using the encrypted data.

At this time, the search statement may be a like search statement including a wildcard for the index tag. At this time, the retrieval statement may be a structured query language (SQL).

At this time, the search statement may include a variable part that is determined based on the search result through the search statement corresponding to the previous level with respect to the level excluding the level corresponding to the root node.

At this time, the number of digits of the variable part can be determined according to the level.

At this time, the wild card may be located immediately after the variable part if the variable part exists.

At this time, the index tag searching unit 1320 can perform data decoding only on the nodes of the B + tree corresponding to the search query.

The encrypted data DB 1330 stores the encrypted data. At this time, the encrypted data DB 1330 can map the index tags generated by the index tag generation unit 1310 to the encrypted data and store them together.

As described above, the index tag generation method for the encrypted data, the encrypted data retrieval method using the index tag, and the database apparatus for the encrypted data according to the present invention can be applied to a limited configuration and method of the embodiments described above The above embodiments may be constructed by selectively combining all or some of the embodiments so that various modifications may be made.

1310: Index tag generation unit
1320: Index tag search unit
1330: Encrypted data DB

Claims (20)

A method of generating an index tag in which a database device storing encrypted data generates an index tag,
Assigning a unique number to all nodes of the B + tree from a root node of the B + tree;
Generating index tags by connecting leaf nodes of the B + tree to leaf nodes sequentially after a unique number corresponding to the leaf node; And
And sequentially assigning the index tag to a key value corresponding to the encrypted data,
Wherein the length of the index tag is equal to the height of the B + tree, and the sorting order of the encrypted data corresponding to the index tag is determined according to the size of the index tag. . delete The method according to claim 1,
Wherein the additional number is a natural number starting from 1. < RTI ID = 0.0 > 8. < / RTI > The method of claim 3,
The unique number
Wherein each of the nodes is generated by appending an additional number starting from 0 after the assigned number to the unique number corresponding to the child node. A retrieval method for a database apparatus storing encrypted data to retrieve encrypted data using an index tag,
Initializing at least one of a node number of a node of a B + tree to be searched, a tree level of the node, and a length of an index tag;
Generating a search query using the index tag;
Extracting a node of the B + tree corresponding to the search statement by searching for the level of the B + tree using the search statement; And
Generating a search result using the encrypted data corresponding to the node of the B + tree
The method of claim 1, further comprising: The method of claim 5,
The search statement
Wherein the query is a like search query including a wildcard for the index tag. The method of claim 6,
The search statement
And a duplicate elimination part for avoiding duplicate search. The method of claim 7,
The search statement
And a variable part determined based on a search result through a search statement corresponding to a previous level with respect to a level excluding a level corresponding to a root node. The method of claim 8,
The variable part
And the number of digits is determined according to the level. The method of claim 9,
Wherein the wildcard is located immediately after the variable part if the variable part is present. The method of claim 10,
The step of generating the search result
Wherein the data decoding is performed only on the node of the B + tree corresponding to the search statement. An index tag generating unit sequentially assigning index numbers generated by sequentially connecting additional numbers after a unique number corresponding to a leaf node of the B + tree to a key value corresponding to the encrypted data; And
And an index tag search unit for generating a search query using the index tag and searching for each level of the B + tree using the search query to generate a search result corresponding to the search query,
Wherein a length of the index tag is equal to a height of the B + tree, and an arrangement order of encrypted data corresponding to the index tag is determined according to the size of the index tag. Database device. The method of claim 12,
The index tag search unit
Extracting a node of the B + tree corresponding to the search statement by searching for the level of the B + tree using the search statement,
And the search result is generated using the encrypted data corresponding to the node of the B + tree. 14. The method of claim 13,
The search statement
Wherein the index tag is a like search query including a wild card for the index tag. 15. The method of claim 14,
The search statement
And a variable part which is determined based on a search result through a search statement corresponding to a previous level with respect to a level excluding a level corresponding to a root node. 16. The method of claim 15,
The variable part
And the number of digits is determined according to the level. 18. The method of claim 16,
Wherein the wildcard is located immediately after the variable part if the variable part is present. 18. The method of claim 17,
The index tag search unit
And decrypts only the node of the B + tree corresponding to the retrieval statement using the index tag for the encrypted data. 19. The method of claim 18,
The index tag
Wherein the index number is generated by concatenating additional numbers sequentially after a unique number corresponding to a leaf node of the B + tree. delete

Images