KR20180031332A - METHOD AND SYSTEM FOR k-NN QUERY PROCESSING BASED ON GARBLED CIRCUIT - Google Patents

Abstract

The present invention relates to a k-NN query processing algorithm on an encryption database outsourced in a cloud. According to an embodiment of the present invention, a method for k-NN query processing based on a garbled circuit comprises the following steps of: building a first cloud and a second cloud which is independent from the first cloud; maintaining an encryption database, in which data stored in an original database is encrypted, and an encryption public key, which is generated in association with the encryption, in the first cloud; maintaining a decryption private key which corresponds to the encryption public key in the second cloud; and performing multiparty computation between the first cloud and the second cloud based on the encryption public key and the decryption private key, if a k-NN query occurs, in a user terminal to which the encryption public key is distributed, and deriving result data for the k-NN query from the encryption database to provide the same to the user terminal.

Description

TECHNICAL FIELD [0001] The present invention relates to a k-NN query processing method and a k-NN query processing system.

The present invention relates to a k-NN query processing algorithm on an outsourced cryptographic database in a cloud, and is intended to support the protection of a data access pattern that may be exposed in the process of processing a user query on an encrypted database.

As research on cloud computing becomes active in recent years, there is a growing interest in database outsourcing which entrusts management and operation of databases to external vendors.

However, the outsourced database in the prior art has a security problem in that meaningful information is extracted from the cloud and the attacker, and personal information such as the user's propensity, preference, etc. can be deduced through the query transmitted by the user to the cloud.

Therefore, a technology for protecting information in an outsourced database environment is required. In order to solve this problem, research on k-NN query processing on encrypted data using homomorphic encryption technique is being activated.

However, most k-NN query processing studies on existing cryptographic databases are vulnerable to security. For example, there may be a problem of exposure of data access pattern and a problem of exposure to selective plaintext attack. In the prior art, a technology that supports both data protection, user query protection, and data access pattern exposure requires a very high processing cost.

Accordingly, there is a need for a system and method that can provide efficient query processing performance while supporting data protection, user query protection, and data access pattern protection in an outsourced database environment in the cloud.

It is an object of the present invention to provide an encryption processing protocol based on a garbage circuit and a data packing technique, thereby reducing the number of operations and providing efficient query processing performance.

In addition, the present invention provides a k-NN query processing algorithm that supports encryption index search based on an improved cryptographic operation protocol and data access pattern protection on an encrypted database, thereby preventing additional information from being exposed, It has a different purpose, which can support both protection as well as data access pattern protection in query processing.

A method for processing a k-NN query based on a GALBLED CIRCUIT according to an embodiment of the present invention includes: constructing a first cloud and a second cloud that is non-colluding with the first cloud; The method comprising the steps of: maintaining in the first cloud an encryption database in which data stored in a database is encrypted; and a cryptographic public key generated in association with the cryptography, the method comprising: storing a decryption secret key corresponding to the encrypted public key in the second cloud (KNN) query is generated in a user terminal to which the encrypted public key has been distributed, the method comprising the steps of: determining, based on the encrypted public key and the decrypted secret key, Performs computation (SMC, Secure Multiparty Computation) to derive result data for the kNN query from the encryption database It may comprise the step of providing a group user terminals.

In addition, the k-NN query processing system based on the garbage circuit according to an embodiment of the present invention includes a first cloud, a second cloud independent of the first cloud, and a second cloud configured to encrypt data stored in the original database Maintaining a decryption secret key corresponding to the encrypted public key in the second cloud, and distributing the encrypted public key to the first cloud, And performing a multiparametric calculation between the first cloud and the second cloud based on the encrypted public key and the decrypted secret key when the kNN query is generated in the received user terminal, Data can be derived and provided to the user terminal.

According to an embodiment of the present invention, an encryption operation protocol of at least one of an ESSED protocol, a GSCMP protocol, and a GSPE protocol based on a garbled circuit and a data packing technique is performed, thereby reducing the number of operations and providing efficient query processing performance .

According to an embodiment of the present invention, a k-NN query processing algorithm that supports encryption index search based on an improved cryptographic operation protocol and data access pattern protection on an encrypted database is provided, thereby preventing exposure of additional information To protect both data protection and user query protection as well as data access pattern protection during query processing.

FIG. 1 is a diagram illustrating a garbled circuit-based k-NN query processing system according to an embodiment of the present invention.
2 is a diagram showing data held in a first cloud according to an embodiment of the present invention.
3 is a diagram illustrating an encryption database according to an embodiment of the present invention.
4A to 4D are diagrams for explaining a kNN query processing algorithm according to an embodiment of the present invention.
5 is a diagram illustrating point-to-area relationships in a one-dimensional space according to an embodiment of the present invention.
FIG. 6 is a flowchart illustrating a procedure of a method for processing a k-NN query based on a garbled circuit according to an embodiment of the present invention.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to or limited by the embodiments. Like reference symbols in the drawings denote like elements.

In the present invention, the "k-NN query" can refer to a query that searches for k pieces of data that are closest to the query. The garbled circuit-based k-NN query processing method and k-NN query processing system described in this specification are based on a two-point Euclidian distance calculation using an efficient cryptographic computation protocol based on a garbage circuit and a data packing technique, It is possible to process the k-NN query on the encryption database by determining whether the comparison operation and the encryption area include the encryption point.

FIG. 1 is a diagram illustrating a garbled circuit-based k-NN query processing system according to an embodiment of the present invention.

The k-NN query processing system 100 (hereinafter referred to as a k-NN query processing system) of the present invention includes a database 110, a kd tree 120, a public key pk 130), decrypting the secret key (secret key; sk) (140), a first cloud (C _A) (150), encrypted database 160, the encrypted kd-tree 170, and a second cloud (C _B) (180) . ≪ / RTI >

The k-NN query processing system 100 divides the data stored in the database 110 into a predetermined number (for example, F), and a kd tree having a plurality of terminal nodes including the divided data 120).

For example, the k-NN query processing system 100 may build a kd tree 120 with a level h and a total of 2 ^h-1 terminal nodes from the database 110, (FanOut) data can be stored.

Each terminal node of the kd tree 120 may store the area information about the node area taken by itself and the data ID for the data included in the node area in a plain text form. Here, the area information may include a lower limit point (lb _{z, m} ) and an upper limit point (ub _{z, m} ) (1? Z? Num _node , 1? have.

For example, referring to FIG. 2, the k-NN query processing system 100 may store eight two-dimensional (e.g., x and y dimensional) data. At this time, the k-NN query processing system 100 can divide the data based on the kd tree. The constructed kd tree may include a total of four terminal nodes, and each terminal node is provided with a node lower bound ( lb _x and lb _y ), upper bound ( ub _x and ub _y ) information, and an ID Can be stored. That is, the terminal node 'node 1' of the kd tree 120 receives the lower limit point 'lb _{1 , 0} , lb _{1 , 1} ' and upper limit point 'ub ₁ ' for the node region associated with the terminal node ' _{, 0} , ub _{1 , 1} ) 'and data ID' t ₁ ',' t ₂ 'for data included in the node area.

It is assumed herein that there is no data at each node boundary of the kd tree to clarify the containment relationship between the data and the node, but the present invention is not limited thereto.

The k-NN query processing system 100 encrypts the kd tree 120 constructed from the database 110 to generate an encrypted kd tree 170. [

Specifically, the k-NN query processing system 100 may further encrypt the data IDs of the data included in the node region associated with each terminal node by attribute to generate the encrypted kd tree 170. [

For example, the k-NN query processing system 100 encrypts the data ID 't ₁ ', 't ₂ ' included in the terminal node 'node 1' of the kd tree 120 for each attribute m, The encryption ID tree 170 can be generated by encrypting the data ID included in the node by attribute m. For example, the encryption kd tree 170 includes four terminal nodes (node 1, node 2, node 3, and node 4), and each of the terminal nodes 210, 220, 230, and 240 includes a lower limit point and an upper limit point Node region.

The k-NN query processing system 100 encrypts each terminal node included in the kd tree 120 with the same encryption public key 130 used when the encryption database 160 is created, Lt; / RTI >

For example, the k-NN query processing system 100 can generate an encryption database as shown in Fig. The k-NN query processing system 100 may encrypt the data in units of dimensions and transmit the encrypted data to the first cloud 150. That is, the k-NN query processing system 100 can encrypt domain information of each terminal node included in the kd tree 120 by attribute. As shown in FIG. 3, As shown in Fig.

The k-NN query processing system 100 may provide a first cloud 150 and a second cloud 180 that are non-colluding.

In the present invention, each cloud 150 and 180, when performing an encryption protocol to process a user query, may associate data and information with other clouds in order to acquire additional information based on the information acquired during the query processing You can not send or receive.

The k-NN query processing system 100 stores the encryption kd tree 170 in the first cloud 150 holding the encryption database 160 and the encryption public key 130 (step 101).

The k-NN query processing system 100 also stores the decryption secret key 140 corresponding to the encrypted public key 130 in the second cloud 180 different from the first cloud 150 ).

In other words, the k-NN query processing system 100 stores the encryption kd tree 170 in the first cloud 150 together with the encryption database 160 and the encryption public key 130, The secret key 140 may be stored in another second cloud 180.

In addition, the k-NN query processing system 100 may provide the same encrypted public key 130 used in the encryption of the database 110 to the user terminal (AU) 190 (step 103). When the terminal 190 requests a query to the first cloud 150 to acquire data, the user query can be encrypted using the provided encrypted public key 130 (step 104).

For example, the terminal 190 may request the user query by encrypting the query point with the encrypted public key 130, for example, 'E (q _j ) (1? _J ? M)'.

In this manner, the k-NN query processing system 100 can support data protection and user query protection by providing a service based on an encrypted query.

When the user query is received from the user terminal 190, the k-NN query processing system 100 performs a multiparametric calculation (SMC) between the first cloud 150 and the second cloud 180 based on the selected cryptographic operation protocol, Secure Multiparty Computation) to process the kNN query (step 105).

In addition, the k-NN query processing system 100 may transmit the result of processing the user query together with the first cloud 150 and the second cloud 180 to the terminal 190 (step 106).

Here, the multiparameter calculation can refer to safely performing the protocol and the operation via another entity (the first cloud 150 and the second cloud 180) without exposing the original data held by the data owner have.

To this end, the k-NN query processing system 100 includes a first cloud 150 storing an encryption kd tree 170, an encryption database 160 and an encrypted public key 130, and a second cloud 180, The decryption secret key 140 is stored and the kNN query can be processed between the first cloud 150 and the second cloud 180 based on the multi-party calculation.

In this way, the k-NN query processing system 100 can securely process user queries on the encryption database 160, based on the encryption kd tree 170, while supporting data protection. In addition, the k-NN query processing system 100 may have an advantage that no information related to data privacy, query privacy, and data access pattern is exposed in the process of processing a query through the kNN query processing algorithm on the encryption database. A more detailed description of the kNN query processing algorithm will be described with reference to Figs. 4A to 4D described later. Prior to describing the kNN query processing algorithm, the protocol used herein will be described.

The k-NN query processing system 100 selects at least one of an Enhanced Secure Squared Euclidean Distance (ESSED) protocol, a Garbled Circuit based Secure Secure Compare (GSCMP) protocol, and a GSPE (Garbled Circuit based Secure Point Enclosure) can do.

For example, the k-NN query processing system 100 may calculate the square of the distance E ( X - Y | ² ) between the vector E ( X ) and E ( Y ) using the ESSED protocol. At this time, X and Y may be m- dimensional vectors.

First, the k-NN query processing system 100 may generate a random number in the first cloud 150, and then perform data packing through Equation (1) to calculate R. [

Here,? May be a bit length representing one piece of data. In addition, the k-NN query processing system 100 may encrypt R in the first cloud 150 to generate E ( R ).

Next, the k-NN query processing system 100 calculates the cryptographic distance E ( x _j - y _j ) (1? J? M ) of X and Y in each dimension in the first cloud 150, E ( v ) can be calculated by performing data packing through equation (2).

를 통해 언패킹(unpacking)을 수행하여 x _j -y _j +r _j (1≤j≤m)을 획득한 후, 차원별 (x _j -y _j +r _j )²(1≤j≤m)을 합산하여, d에 저장할 수 있다(단, d의 초기값은 0으로 설정할 수 있으나, 이에 한정된 것은 아니다). Next, k-NN query processing system 100 E (v) = E (v) × E after calculating the (R), the E (v) a second cloud 180 in the first cloud 150 Lt; / RTI > Next, the k-NN query processing system 100 decodes the transmitted E ( v ) in the second cloud 180 to obtain [ x ₁ - y ₁ + r ₁ | | x _m - y _m + r _m ]. Also, k-NN query processing system 100 is in the second cloud (180), v

To perform the unpacking (unpacking) through _{x j - (- y j +} r j x j) 2 (1≤ j ≤ m) y j + r j (1≤ j ≤ m) which, after obtaining a specific dimension Can be summed and stored in d (however, the initial value of d can be set to 0, but is not limited thereto).

Thus, the k-NN query processing system 100 can reduce the number of encryption-data-based operations compared to the DPSSED protocol of the prior art by performing the summation of distance by dimension on the plain text.

Next, the k-NN query processing system 100 may encrypt d at the second cloud 180 and then send E ( d ) to the first cloud 150. [ Through the process, the k-NN query processing system 100 can reduce m data encryption required by the second cloud 180 of the DPSSED protocol to one time.

Lastly, the k-NN query processing system 100 removes the values added by the random number insertion in the first cloud 150 by each dimension using Equation (3), so that the square of the distance between the two vectors X and Y , E (| X - Y | ² ).

According to an embodiment, the k-NN query processing system 100 may process the kNN query using the GSCMP protocol.

The k-NN query processing system 100 returns E (1) when u < v is satisfied when E ( u ) and E ( v ) are given to the first cloud 150 using the GSCMP protocol , and E (0) if u > v . The k-NN query processing system 100 can perform the GSCMP protocol through a garbage circuit composed of two ADD gates and one CMP gate as in the case of the conventional CMP-S. However, the k-NN query processing system 100 may differ from the CMP-S in that it can exchange data including the random number between the first cloud 150 and the second cloud 180 during the execution of the GSCMP protocol have.

Hereinafter, an overall execution algorithm of the GSCMP protocol will be described. First, the k-NN query processing system 100 may generate two random numbers r _u and r _v in the first cloud 150. Second, the k-NN query processing system 100 encrypts r _u and r _v in the first cloud 150 and then e ( m ₁ ) = E ( u ) x E ( r _u ) ² and E ( m ₂ ) = E ( v ) ² × E (1) × E ( r _v ). Third, the k-NN query processing system 100 may select any one of the two F ( F ₀ : u > v , F ₁ : v > u ) in the first cloud 150. At this time, the k-NN query processing system 100 may not disclose to the second cloud 180 which of F ₀ and F ₁ is selected. In addition, the k-NN query processing system 100 may, in the first cloud 150, do the following according to the selected F :

If the first Cloud F ₀ at 150, if selected the u> v, k-NN query processing system 100 in the first cloud 150, <E (m _2), E (m _1)> To the second cloud 180. In this case,

If the first cloud 150 selects F ₁ : u < v, then the k-NN query processing system 100 determines in the first cloud 150 that the E ( m ₁ ), E ( m ₂ ) To the second cloud 180. In this case,

Fourth, the k-NN query processing system 100 can decode the transmitted data in the second cloud 180. [ The k-NN query processing system 100 may obtain < m ₂ , m ₁ > in the second cloud 180 when F ₀ : u> v is selected in the first cloud 150, The k-NN query processing system 100 may obtain < m ₁ , m ₂ > in the second cloud 180 when F ₁ : u <v is selected in the first cloud 150.

Fifthly, the k-NN query processing system 100 can cause the first cloud 150 to generate a garbage circuit consisting of two ADD gates and one CMP gate. If F ₀ is selected, the k-NN query processing system 100 may pass- r _v and -r _u to the first ADD gate and the second ADD gate, respectively, in the first cloud 150, and F ₁ - r _u and - r _v may be passed to the first ADD gate and the second ADD gate, respectively.

Sixth, the k-NN query processing system 100 may cause the second cloud 180 to transfer the first data among the received data to the first ADD gate and the second data to the second ADD gate As shown in FIG. Thus, k-NN query processing system 100 may be the second cloud 180 is F ₀ is to deliver a selected when m ₂ and m ₁ each of the first to the ADD gate and the second ADD gate, the F ₁ And to transfer m ₁ and m ₂ to the first ADD gate and the second ADD gate, respectively, if selected.

If r _v and m ₂ = v + r _v summed and, F ₁ is selected, the-seven cases in the second, k-NN query processing system 100 includes a first ADD gate, F ₀ is selected, r _u, and m ₁ = u + r _u to transfer the result " result ₁ " to the CMP gate.

If r _u, and m ₁ = sum of u + r _u, and, F ₁ is selected, - the eighth to, k-NN query processing system 100 is in the 2 ADD gate, F ₀ is selected if r _v and m ₂ = v + r _v to transfer the result " result ₂ " to the CMP gate. At this time, since the resultant value of the ADD gate is encoded and transmitted by the characteristic of the gain circuit, information exposure may not occur.

Ninth, the k-NN query processing system 100 may return α = 1 in case of result ₁ < result ₂ , and return α = 0 in case of CMP gate.

Finally, the performance of beuldeu circuit resulting α may be found in the second cloud 180, k-NN query processing system 100 encrypts this in the second cloud 180 to send to the first cloud 150 . However, since the second cloud 180 of the k-NN query processing system 100 does not know the F selected by the first cloud 150, it can not determine the result of u < v . The k-NN query processing system 100 may terminate the GSCMP protocol by changing the value of E ( ? ) through the SBN protocol and returning E ( ? ) when F ₀ is selected in the first cloud 150 have. At this time, if the E (α) = E (1), u <v mean, however, k-NN first cloud 150 and the second cloud 180 of the query processing system 100 E (α) that the Can not be known.

Depending on the embodiment, the k-NN query processing system 100 may utilize the GSPE protocol. When the first cloud 150 is given encrypted area information range expressed by an m- dimensional point E ( p ) and a lower limit point E ( lb _j ) and an upper limit point E ( ub _j ) (1? J ? M ) The k-NN query processing system 100 may use the GSPE protocol to return E (1) if the point p is included in the range range . In addition, the k-NN query processing system 100 may use the GSPE protocol to return E (0) if the point p does not overlap the range range . The overall performance algorithm using the GSPE protocol may be as follows.

First, k-NN query processing system 100 through two random array ra _j, then generate _{rb j (1≤ j ≤2 m)} , (4) and equation (5) in the first cloud 150 Data packing can be performed to calculate RA and RB , respectively.

Here,? Can mean a bit length for expressing one data. In addition, the k-NN query processing system 100 may encrypt RA and RB in the first cloud 150 to generate E ( RA ) and E ( RB ).

Next, the k-NN query processing system 100 multiplies the lower limit value of each point of the point and the area by 2 in the first cloud 150, and then multiplies it by E ( μ _j ) and E ( μ _j ) ( 1? J ? M ). In this case, k-NN query processing system 100 may be performed via the _{E (μ j) ← E (} range 1. Lb j) 2 and _{E (ξ j) ← E (} range 2. Lb j) 2. Further, the k-NN query processing system 100 multiplies the upper limit point value of each point of the point and the area by 2 in the first cloud 150, adds 1 to E ( ? _J ) and E ( ? _J ) (1? J ? M ). In this case, k-NN query processing system 100 _{E (δ j) ← E (} range 1. Ub j) 2 × E (1) and _{E (ρ j) ← E (} range 2. Ub j) 2 × E (1). &Lt; / RTI &gt; Accordingly, the k-NN query processing system 100 can determine whether the two cases to be compared include the same case.

Next, the k-NN query processing system 100 can select any one of the two F ( F ₀ : u > v , F ₁ : v > u ) in the first cloud 150. At this time, the k-NN query processing system 100 may not disclose to the second cloud 180 which of F ₀ and F ₁ has been selected. Also, the k-NN query processing system 100 may cause the first cloud 150 to perform data packing for each dimension for the value of p and the upper limit of range ₂ according to the selected F as follows.

이고,

일 수 있다. F ₁ : v > u 가 선택된 경우,

이고,

일 수 있다. If F ₀ : u > v is selected,

ego,

Lt; / RTI > If F ₁ : v > u is selected,

ego,

Lt; / RTI &gt;

That is, when F ₀ is selected, the k-NN query processing system 100 can pack each dimension value of p into E ( RB ) and pack the upper limit value of each dimension of range into E ( RA ) have. On the other hand, if F ₁ is selected, the k-NN query processing system 100 can pack each dimension value of p with E ( RA ) and pack the upper limit value of each dimension of range into E ( RB ) have. In addition, the k-NN query processing system 100 may cause the first cloud 150 to perform data packing on the lower limit of the value of p and the lower limit of the range according to the selected F as follows.

이고,

일 수 있다. F ₁ : v>u 가 선택된 경우,

이고,

일 수 있다. If F ₀ : u > v is selected,

ego,

Lt; / RTI > If F ₁ : v > u is selected,

ego,

Lt; / RTI &gt;

That is, when F ₀ is selected, the k-NN query processing system 100 packs the lower limit value of each dimension of the range with E ( RB ), packs the upper limit value of each dimension of p into E ( RA ) can do. On the other hand, when F ₁ is selected, the k-NN query processing system 100 packs the lower limit value of each dimension of the range with E ( RA ), packs the upper limit value of each dimension of p into E ( RB ) can do. Next, the k-NN query processing system 100 may cause the first cloud 150 to transmit E ( RA ) and E ( RB ) to the second cloud 180.

를 통해 RA를 언패킹하여 ra _j +u _j (1≤j≤2m)를 획득할 수 있다. 또한, k-NN 질의 처리 시스템(100)은 제2 클라우드(180)에서 RB

를 통해 RA를 언패킹하여 rb _j +v _j (1≤j≤2m)를 획득할 수 있다. 여기서, u _j 및 v _j 는 p의 값 및 range의 하한점 및 상한점 값을 의미할 수 있다. 한편, 해당 값에는 난수가 포함되어 있으며, k-NN 질의 처리 시스템(100)은 제2 클라우드(180)에서는 제1 클라우드(150)에서 선택된 F를 알지 못하기 때문에 추가적인 정보 노출이 발생하지 않을 수 있다. Next, the k-NN query processing system 100 can decode E ( RA ) and E ( RB ) in the second cloud 180 to obtain RA and RB . In addition, the k-NN query processing system 100 may be configured to receive the RA

A can to unpack the RA to obtain a _{ra j + u j (1≤ j} ≤2 m) through. In addition, the k-NN query processing system 100 may be configured to perform RB

To obtain rb _j + v _j (1? J ? 2m ) by unpacking the RA through? Here, u _j and v _j can mean the value of p and the lower limit and upper limit of range , respectively. Meanwhile, the k-NN query processing system 100 does not know the F selected in the first cloud 150 in the second cloud 180, so that no additional information exposure may occur have.

Next, the k-NN query processing system 100 may generate a CMP-S circuit in the first cloud 150. [ After creating the circuit CMP-S, k-NN query processing system 100 based on the first cloud 150 is _j ra, rb _j (1≤ j ≤2 m) which has - ra _j, - after generating the _{rb j (1≤ j ≤2 m)} , it can be use to deliver them as input to the CMP-S in turn in the first cloud 150. On the other hand, k-NN query processing system 100 includes a second cloud 180 in ra _j + u _j and that they hold, rb _j + v _j (1≤ j ≤2 m) in order to input the S-CMP Value. &Lt; / RTI &gt; The k-NN query processing system 100 can confirm the CMP-S performance result α ' _j (1? j ? 2m ) in the second cloud 180 and encrypt it in the second cloud 180, To the cloud (150).

Next, the k-NN query processing system 100 can convert E ( ? ' _J ) (1? J ? 2m ) values through the SBN only when F ₀ is selected in the first cloud 150 . In addition, the k-NN query processing system 100 can perform the multiplication between E ( ? ) And E ( ? ' _J ) using the SM (Secure Multiplication) protocol. At this time, the k-NN query processing system 100 can set the value of the initial E ( ? ) To E (1).

Finally, the k-NN query processing system 100 may terminate the GSPE protocol by returning E ( ? ) In the first cloud 150. In this case, when E ( ? ) = E (1), the point p may be included in the range range . However, since the k-NN query processing system 100 can not know the actual value of E ( ? ) In the first cloud 150 and the second cloud 180, the k-NN query processing system 100 can not know whether or not it is included in the area of the point.

4A to 4D are diagrams for explaining a kNN query processing algorithm according to an embodiment of the present invention.

The k-NN query processing system 100 may process a k-NN query through a cryptographic index search step 410, a kNN step 420 and a query result verification step 430 as a kNN query processing algorithm.

First, the k-NN query processing system 100 can search for an encryption index through the following process (410).

Referring to FIG. 4B, in step 411, the k-NN query processing system 100 determines E ( q ) and E ( node _z ) (1? Z ? Num _node ) in the first cloud 150, , The node including the query point can be searched by performing the GSPE protocol. In this case, the node whose E ( alpha _z ) value E (1) returned from the GSPE execution result may be a node including the query point. However, the first cloud 150 and the second cloud 180 may not know which node overlaps the query area. The k-NN query processing system 100 can encrypt an encryption database based on a Paillier encryption system because the pager encryption system supports semantic security.

In step 412, the k-NN query processing system 100 generates a reordering function π in the first cloud 150 to change the order of E ( α ) and send it to the second cloud 180 .

In step 413, the k-NN query processing system 100 decodes E ( ? ) In the second cloud 180, checks the number of 1's ( c ), generates c node groups Group can do. In this case, k-NN query processing system 100 includes a second cloud (180), for each group of nodes α value of 1 and one node α value is 0, the node _(node num / c) to allocate the pieces -1 . In addition, the k-NN query processing system 100 may randomly convert the order of nodes assigned to each node group, and then transmit the randomly converted nodes to the first cloud 150.

In step 414, the k-NN query processing system 100 can inversely change the identification number of a node belonging to each node group in the first cloud 150 using an inverse change function ? ^-1 .

In step 415, the k-NN query processing system 100, in the first cloud 150, uses the data stored in each node group node and the E ( ? ) Of each node returned via the GSPE protocol to transmit the SM protocol , And the data existing in the node related to the query can be stored in E ( cand ) using the perturbed encryption property.

In step 416, the k-NN query processing system 100 may terminate the cryptographic index search by returning E ( cand ).

Referring again to FIG. 4A, the k-NN query processing system 100 may perform a k-NN search step (420) through the following procedure. The k-NN query processing system 100 can search k data that are close to the query based on the data extracted in the encryption index search step 410 in the k- NN search step. The k-NN query processing system 100 can perform the partial search using the SkNN _m algorithm. The k-NN query processing system 100 searches the cnt index data 410 based can perform k NN search. In addition, the k-NN query processing system 100 can utilize efficient data packing and garbage-based efficient protocols (i.e., ESSED, SMS _n ) instead of SBD, SMIN, SMIN _n protocols with high computational cost.

Referring to FIG. 4C, in step 421, the k-NN query processing system 100 searches the first cloud 150 for query E ( q ) via the ESSED protocol and cnt of the encrypted data E (cand _i) between the squared Euclidean distance _{E (d i) (1≤ i} ≤ cnt) it can be calculated.

In step 422, the k-NN query processing system 100 determines the minimum value E ( d _min ) of the cryptographic distance E ( d _i ) | 1? I ? Cnt via the SMS _n in the first cloud 150, Can be found. Also, k-NN query processing system 100 in the first cloud (150), E the difference between E (d _min) and E (d _i) (d _min) × E (d _i) ^{N -1} (1 ≤ i ≤ cnt ), and the result can be stored in E ( τ _i ). Also, k-NN query processing system 100 may generate E (τ _i) by multiplying the encrypted random number to the first cloud _{(150), E (τ i} ). In addition, the k-NN query processing system 100 applies E ( τ ) to an arbitrary order change function π in the first cloud 150 to generate E ( β ), and transmits it to the second cloud 180 Lt; / RTI &gt;

In step 423, the k-NN query processing system 100 decodes each element of the transmitted E ( ? ) In the second cloud 180, and when the value of D ( ? _I ) is 0, ( U _i ) = E (1), and when it is not 0, E ( U _i ) = E (0). Thereafter, the k-NN query processing system 100 may send E ( U ) to the first cloud 150 in the second cloud 180.

In step 424, the k-NN query processing system 100 reverses E ( U ) transmitted from the second cloud 180 through π ^-1 in the first cloud 150 to obtain E ( V ) Lt; / RTI &gt; Also, k-NN query processing system 100 E (V _i) (1≤ i ≤ cnt) and the return via the encrypted index search _{E (cand i, j) (} 1≤ i ≤ cnt, 1≤ j ≤ m ), and store the result in E ( V _{i, j} ). Next, the k-NN query processing system 100 can sum the values of E ( V _{i, j} ) for each dimension on the basis of the perceptual cryptographic characteristic in the first cloud 150 through Equation (6) .

In step (425), k-NN query processing system 100 is yet to prevent the user is unable to find the k number of query results requested, selected duplicate on the selected E (t _s) following the course of a k NN results do. To this end, k-NN query processing system 100 may update the value of the angle E (d _i) (1≤ i ≤ cnt) by performing, equation (7) in the first cloud 150.

Here, E ( max ) may mean the maximum value of the data domain. Since the data is selected as k NN result is E (V _i) = E (1) jinigi values, k-NN query processing system 100 may be changed to E (d _i) = E (max) through the equation (7) have. Since k-NN query processing system 100 for the remaining data, E (V _i) = E (0) jinigi values, it is possible to maintain the E (d _i) values as they are. This, k-NN query processing system 100 through can be prevented from being selected as the encryption data is redundant select k NN results.

The k-NN query processing system 100 may repeat the above process until k data are found, and in step 426, the k-NN query processing system 100 determines whether the k- , The algorithm can be terminated by returning the results of the searched k queries.

Referring again to FIG. 4A, the k-NN query processing system 100 may perform a query result verification step through a node extension search through the following process (430).

The result of the query search may be based on the data of some of the nodes divided through the kd tree. Thus, a process may be required to verify that there is a query and closer data to an adjacent kd tree node. To solve this problem, k-NN query processing system 100 includes nodes in a short distance from the distance query point than dist _k of up to k th result of the result E (t) is returned by the k-NN search phase 420 . &Lt; / RTI &gt; That is, the k-NN query processing system 100 can perform a search process for finding a node whose shortest distance from the query point is smaller than dist _k . To this end, the k-NN query processing system 100 may utilize the shortest point of the first definition.

The shortest point sp (shortest point) of the first positive can jeomil having the shortest distance from a point (p) and when turned the area is given, p of all the points existing in the area.

The characteristics of the shortest distance point will be described with reference to FIG. 5 is a diagram illustrating point-to-area relationships in a one-dimensional space according to an embodiment of the present invention.

As shown in FIG. 5, the k-NN query processing system 100 has a point p = 3 on one dimension and three regions ( range ₁ , range ₂ , range ₃ ) Can be divided into three major.

i) If the lower bound (e.g., 0) and the upper bound (e.g., 2) of the region are less than the value of the point p (e.g., 3) as in range ₁ , then the k-NN query processing system 100 returns p The shortest distance point of range ₁ can be set as the upper limit point of the corresponding region. ii) If the lower bound of the region (e.g., 4) and the upper bound of the region (e.g., 6) are both greater than the value of the point p (e.g., 3) as in range ₂ , then the k-NN query processing system 100 returns p The shortest distance point of range ₂ can be set as the lower limit point of the corresponding region. iii) a lower limit point value of the range, such as range ₃ (e.g., 2) and the upper limit value (for example, 4) the value of the point p between (e. g., 3) the presence, k-NN query processing system 100, It can be the minimum distance point of the range ₃ to p with a value of p. In the present application, such a characteristic can be expanded and utilized in a multidimensional space.

Based on this characteristic, the k-NN query processing system 100 can perform the search of the shortest distance of the node and the query result verification for the query on the encrypted data based on the payer encryption system by the following process have.

In step 431, the k-NN query processing system 100 calculates the distance E ( dist _k ) from query E ( q ) and E ( t _k ) in the first cloud 150 using the ESSED protocol .

In step (432), k-NN query processing system 100 includes a lower limit of the point E and the node in the first cloud _{(150), (q j)} E (node z. Lb j) (1≤ z ≤ num node, 1 ≤ j ≤ m ), and store the result in E ( ψ ₁ ). Also, k-NN query processing system 100 may perform GSCMP protocol between the E (q _j), and the upper limit _{E (node z. Ub j)} (1≤ z ≤ num node, 1≤ j ≤ m) of the node, and , And store the result in E ( ? ₂ ). In addition, the k-NN query processing system 100 can make the corresponding E ( ? ) Equal to E (1) when E ( q _j ) is less than or equal to the lower or upper limit of the node.

In step 433, the k-NN query processing system 100 E (ψ ₁₎ and E (ψ ₂₎ SBXOR (Secure Bit-XOR) performing the protocol, the result E (ψ ₃₎ using Can be stored.

In step 434, the k-NN query processing system 100 may calculate the shortest point E ( sp _{z, j} ) in each dimension by performing equations (8) and (9).

After the search for the shortest distance E ( sp _z ) (1? Z ? Num _node ) of each node to E ( q ) is completed at step 435, the k-NN query processing system 100 searches the first cloud 150), the Euclidean distance between E ( q ) and E ( sp _z ) can be calculated and stored in E ( spdist _z ) (1 ≤ z ≤ num _node ) via the ESSED protocol. The k-NN query processing system 100 can securely change the distance from the first cloud 150 to the shortest distance point of the node that has been found through Equation 10 to the maximum value E ( max ) in the domain .

Here, E (α _z) is the value returned by the GSPE protocol in step 431, the node already search is complete, E (α _z) = E (1), otherwise, the node E (α _z) = E (0) &lt; / RTI &gt; value.

Thereafter, the k-NN query processing system 100 performs GSCMP protocol based on E ( spdist _z ) and E ( dist _k ) in the first cloud 150 and outputs the result to E ( ? _Z ) Can be stored. If the E ( spdist _z ) is a node that is smaller than E ( dist _k ), the node may be a node requiring further searching. The k-NN query processing system 100 may perform the GSCMP protocol execution E ( α _z ) = E (1) can be returned. At this time, the k-NN query processing system 100 may not select an extension node for query result verification because E ( spdist _z ) has a maximum value in a domain for a node that has already been searched.

In step 436, the k-NN query processing system 100 extracts all data belonging to the nodes within the dist _k distance from E ( q ) by re-executing the cryptographic index search step 410 to obtain E ( t ). In addition, k-NN query processing system 100 to acquire the E _(i result) (1≤ i ≤ k), the final query result by performing a re-E (t) k-NN search step 420 based on the .

In step 437, the k-NN query processing system 100 generates a random number r _{i, j} in the first cloud 150 and then calculates E (γ _{i, j} ) = E ( result _{i, j} ) E ( r _{i, j} ) (1 ≤ i ≤ k , 1 ≤ j ≤ m ). The k-NN query processing system 100 then sends E ( ? _{I, j} ) to the second cloud 180 in the first cloud 150 and sends r _{i, j} to the user terminal 190 Lt; / RTI &gt;

In step 438, the k-NN query processing system 100 decodes the received E ( ? _{I, j} ) in the second cloud 180 to obtain ? _{I, j} and transmits it to the user terminal 190 ).

In step 439, the k-NN query processing system 100 uses the γ _{i, j} and r _{i, j} received from the second cloud 180 and the first cloud 150 at the user terminal 190 by γ _{i, j} - by carrying out _{r i, j (1≤ i ≤} k, 1≤ j ≤ m), may be to obtain the actual query result.

Hereinafter, the work flow of the k-NN query processing system 100 according to the embodiments of the present invention will be described in detail with reference to FIG.

FIG. 6 is a flowchart illustrating a procedure of a method for processing a k-NN query based on a garbled circuit according to an embodiment of the present invention.

The method for processing a k-NN query based on the embedded circuit according to the present embodiment can be performed by the k-NN query processing system 100 described above.

First, the k-NN query processing system 100 constructs a first cloud and a second cloud that is non-colluding with the first cloud (610). In other words, in step 610, the k-NN query processing system 100 determines whether each cloud is to acquire additional information based on the information acquired during the query processing process when performing the encryption protocol to process the user query You can work with other clouds to avoid sending and receiving data and information.

Next, the k-NN query processing system 100 maintains (620) the encryption database in which the data stored in the original database is encrypted and the encrypted public key generated in association with the encryption in the first cloud. That is, in step 620, the k-NN query processing system 100 may maintain a cryptographic database in the first cloud and a cryptographic public key associated with the cryptographic database.

Next, the k-NN query processing system 100 maintains a decryption secret key corresponding to the encrypted public key in the second cloud (630). That is, in step 630, the k-NN query processing system 100 may maintain a decryption private key corresponding to the encrypted public key in the second cloud.

Next, the k-NN query processing system 100 determines whether kNN (k Nearest Neighbor) query is generated in the user terminal that has distributed the encrypted public key (640). That is, in step 640, the k-NN query processing system 100 can determine from the user terminal whether the encrypted kNN query is received using the encrypted public key used in the encryption of the database. For example, the terminal may request the user query by encrypting the query point with the encryption public key 130, for example, 'E (q _j ) (1? _J ? M)'.

Next, the k-NN query processing system 100 performs a multiparametric calculation between the first cloud and the second cloud based on the encrypted public key and the decrypted secret key, thereby calculating, for the kNN query, The result data is derived and provided to the user terminal (650). That is, when the user query is received from the user terminal, the k-NN query processing system 100 performs a multi-point calculation between the first cloud and the second cloud based on the selected cryptographic operation protocol, kNN queries can be processed.

Here, the multiparameter calculation may refer to the secure execution of protocols and operations through other entities (the first cloud and the second cloud) without exposing the original data held by the data owner.

According to an embodiment, the k-NN query processing system 100 divides data stored in the original database into a plurality of attributes and dimensions to construct a kd tree, encrypts the kd tree, 0.0 &gt; kd &lt; / RTI &gt; tree in the first cloud. That is, the k-NN query processing system 100 divides the data stored in the database in units of a predetermined number (for example, F) and constructs a kd tree having a plurality of terminal nodes including the divided data can do. In addition, the k-NN query processing system 100 may maintain an encrypted kd tree in the first cloud.

For example, the k-NN query processing system 100 can construct a kd tree having a level h and a total of 2 ^h-1 terminal nodes from the database, and each terminal node stores up to F (FanOut) Can be stored.

Each terminal node of the kd tree can store the area information about the node area it is responsible for and the data ID for the data contained in the node area in a plain text form. Here, the area information may include a lower limit point (lb _{z, m} ) and an upper limit point (ub _{z, m} ) (1? Z? Num _node , 1? have.

At this time, in step 650, the k-NN query processing system 100 derives the result data and provides it to the user terminal. Based on the selected encryption operation protocol, the k- Lt; RTI ID = 0.0 &gt; kNN &lt; / RTI &gt; That is, the k-NN query processing system 100 can search the cryptographic index based on the encryption kd tree and search for the adjacent kd tree node to process the kNN query.

In addition, in step 650, the k-NN query processing system 100 may use the ESSED (Enhanced Secure Squared Euclidean Distance) protocol, the GSCMP (Garbled Circuit based Secure Secure Compare) protocol, and the GSPE (Garbled Circuit based Secure Point Enclosure Any one of them can be selected by the encryption operation protocol. For example, the k-NN query processing system 100 may calculate the square of the distance E ( X - Y | ² ) between the vector E ( X ) and E ( Y ) using the ESSED protocol. In addition, the E (1) if they meet a k-NN query processing system 100 when turned is E (u) and E (v) of claim 1 cloud 150 is given by the GSCMP protocol, u <v And return E (0) if u > v . In addition, the k-NN query processing system 100 uses the GSPE protocol to map the first cloud 150 to the m- dimensional point E ( p ), the lower point E ( lb _j ) and the upper point E ( ub _j ) 1≤ j ≤ m), given an encrypted area information 'range' is represented by a, in the case where p points included in the area range may be returned to E (1).

According to an embodiment, if the ESSED protocol is selected as the cryptographic computation protocol, then in step 650, the k-NN query processing system 100 calculates the summation of the dimensional distances for any data pair in the encryption kd tree , Thereby reducing the number of operations based on the encrypted data for deriving the resultant data. That is, the k-NN query processing system 100 calculates the Euclidian distance squared E ( d _i ) between the query E ( q ) through the ESSED protocol and the cnt encrypted data E ( cand _i ) 1? I ? Cnt ) can be calculated. The k-NN query processing system 100 may use the ESSED protocol to verify the kNN search and query results.

According to an embodiment, if the GSCMP protocol is selected as the cryptographic computation protocol, the k-NN query processing system 100 in step 650 exchanges a random number between the first cloud and the second cloud, The value of the returned data may be determined according to size comparison for any data pair in the kd tree. For example, k-NN between the query processing system 100 includes a query result from the verification process, E (q _j), and the lower limit point E _(z .lb node _j), and the upper limit point E (node _z. Ub _j) of the node Respectively, and store the results in E ( ? ₁ ) and E ( ? ₂ ), respectively. At this time, the k-NN query processing system 100 may return E (1) if ψ ₁ < ψ ₂ and E (0) if ψ ₁ > ψ ₂ . At this time, the k-NN query processing system 100 can exchange data including a random number.

According to an embodiment, if the GSPE protocol is selected as the cryptographic computation protocol, the k-NN query processing system 100 determines in step 650 that the m-dimensional data E (p) in the encrypted kd tree satisfies kNN query (1) 'as a result of the GSPE protocol and if the data E (p) is not included in the query area, It can return 'E (0)'. For example, the k-NN query processing system 100 performs a GSPE protocol based on E ( q ) and E ( node _z ) (1? Z ? Num _node ) It is possible to search for a node including a point. In this case, the node whose E ( alpha _z ) value E (1) returned from the GSPE execution result may be a node including the query point. At this time, the k-NN query processing system 100 can prevent the first cloud and the second cloud from knowing which node overlaps the query region.

According to an embodiment, in step 650, the k-NN query processing system 100, in the first cloud, transmits a plurality of data E (a) about the point of the kNN query, based on the GSPE protocol, Decrypts each of the plurality of data E (a) into a plurality of data E '(a) through the decryption secret key in the second cloud, and transmits the decrypted secret key to the second cloud, (A), and in the first cloud, receives a node group from the second cloud according to a predetermined order, and stores data E '(a) stored in the node group, And multiplying between the first cloud and the second cloud based on the SM protocol using the data E (a).

That is, the k-NN query processing system 100 can search the node E (a) including the query point by performing the GSPE protocol in the first cloud for the cryptographic index search. Also, the k-NN query processing system 100 may change the order of E ( ? ) And transmit it to the second cloud 180, and decode it in the second cloud, and then create c node groups Group . In addition, the k-NN query processing system 100 may randomly convert the order of nodes assigned to each node group, and then transmit the randomly converted nodes to the first cloud 150. The k-NN query processing system 100 reverses the identification numbers of the nodes belonging to each node group in the first cloud, and performs the SM protocol using the data stored in each node group and E ( α ) of each node can do. In addition, the k-NN query processing system 100 may terminate the encryption index search by returning E ( cand ).

According to an embodiment, if the result data is derived in a plurality, the k-NN query processing system 100 in step 650 determines, within the kd tree, that the result of the plurality of result data is close to the kNN query A predetermined number of result data may be selected and provided to the user terminal in order. That is, the k-NN query processing system 100 can search k data that are close to the query based on the data extracted in the encryption index search step, and provide the k data to the user terminal through the kNN search process.

According to an embodiment, the k-NN query processing system 100 divides the data stored in the source database into a plurality of attributes and dimensions to construct a kd tree, and in the kd tree, based on the kNN query , It is possible to verify whether or not there is data having a shorter distance than the distance from the result data to verify the result data.

That is, the k-NN query processing system 100 can perform a query result verification through a node extension search. The result of the query search may be based on the data of some of the nodes divided through the kd tree. Thus, a process may be required to verify that there is a query and closer data to an adjacent kd tree node. To solve this problem, k-NN query processing system 100 to navigate the nodes existing in the short distance from the distance query point than dist _k to the k th result of the result E (t) is returned by the k-NN search step . That is, the k-NN query processing system 100 can perform a search process for finding a node whose shortest distance from the query point is smaller than dist _k . For this, the k-NN query processing system 100 can utilize the shortest distance point of the first definition having the shortest distance to p out of all the points in the region given a point ( p ) and a region have.

According to an embodiment, in step 650, the k-NN query processing system 100 performs a cryptographic operation protocol in the first cloud to forward the discovered node to the second cloud (step 1) In the second cloud, a result obtained by performing an encryption operation protocol on data acquired from the node using the decryption secret key may be transmitted to the first cloud (step 2). Also, the k-NN query processing system 100 may process the kNN query by repeating the first and second steps until the results for the kNN query are derived. That is, the k-NN query processing system 100 searches for a node using an encryption operation protocol, performs an encryption operation protocol on data included in the node, and verifies whether there is more data closer to the kd tree node By repeating the process, the above steps can be repeated until a meaningful result for the kNN query is derived.

The method for processing a k-NN query based on a gain-based circuit performs an encryption operation protocol of at least one of an ESSED protocol, a GSCMP protocol, and a GSPE protocol based on a garbled circuit and a data packing technique, Performance can be provided.

In addition, the k-NN query processing method based on the garbled circuit provides the k-NN query processing algorithm that supports the encryption index search based on the improved cryptographic operation protocol and the data access pattern protection on the encrypted database, To support both data protection and user query protection as well as data access pattern protection during query processing.

The method according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI &gt; or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: Garbled Circuit-based k-NN Query Processing System
110: database 120: kd tree
130: Encryption public key 140: Decryption secret key
150: First cloud 160: Encryption database
170: Encryption kd tree 180: Second cloud
190: User terminal

Claims (10)

Constructing a first cloud and a second cloud that is non-colluding with the first cloud;
Maintaining an encryption database in which data stored in an original database is encrypted and an encrypted public key generated in association with the encryption in the first cloud;
Maintaining a decryption private key corresponding to the encrypted public key in the second cloud; And
(SMC) between the first cloud and the second cloud based on the encrypted public key and the decrypted secret key when a kNN (k Nearest Neighbor) query is generated in the user terminal that has distributed the encrypted public key, Secure Multiparty Computation) to derive result data for the kNN query from the encryption database and provide the resulting data to the user terminal
(K-NN) query processing based on a GALLBLED CIRCUIT. The method according to claim 1,
Constructing a kd tree by dividing the data stored in the original database into a plurality of attributes and a plurality of columns; And
Maintaining an encrypted kd tree encrypted with the kd tree in the first cloud;
Further comprising:
Deriving the result data and providing the result data to the user terminal,
Processing the kNN query on the encryption database based on the encryption kd tree based on a predetermined encryption algorithm protocol
(K-NN). 3. The method of claim 2,
Deriving the result data and providing the result data to the user terminal,
Selecting either the ESSED (Enhanced Secure Squared Euclidean Distance) protocol, the GSCMP (Garbled Circuit based Secure Secure Compare) protocol, or the GSPE (Garbled Circuit based Secure Point Enclosure)
Wherein the k-NN query processing method further comprises: 3. The method of claim 2,
When the ESSED protocol is selected as the encryption operation protocol,
Deriving the result data and providing the result data to the user terminal,
Performing a two-dimensional summation of the distance by dimension for any data pair in the encryption kd tree to reduce the number of encryption data-based operations for deriving the result data
Wherein the k-NN query processing method further comprises: 3. The method of claim 2,
When the GSCMP protocol is selected as the encryption operation protocol,
Deriving the result data and providing the result data to the user terminal,
Exchanging a random number between the first cloud and the second cloud to determine a value of data to be returned according to size comparison for any data pair in the encryption kd tree
Wherein the k-NN query processing method further comprises: 3. The method of claim 2,
When the GSPE protocol is selected as the encryption operation protocol,
Deriving the result data and providing the result data to the user terminal,
If the m-dimensional data E (p) in the encrypted kd tree is included in the query area associated with the kNN query, returning 'E (1)' as a result of performing the GSPE protocol; And
If the data E (p) is not contained in the query area, returning 'E (0)' as a result of performing the GSPE protocol
Wherein the k-NN query processing method further comprises: The method according to claim 1,
Deriving the result data and providing the result data to the user terminal,
Searching, in the first cloud, a plurality of data E (a) related to a point of the kNN query, based on a GSPE protocol, in the encryption database and transmitting the data E (a) to the second cloud;
Decrypts each of the plurality of data E (a) into a plurality of data E '(a) through the decryption secret key in the second cloud, and decrypts each of the plurality of data E' (a) Creating a group; And
Receiving a node group from the second cloud in a predetermined order in the first cloud, and based on the SM protocol using the data E '(a) and the data E (a) stored in the node group, Performing multiparallel calculations between the cloud and the second cloud
(K-NN). The method according to claim 1,
Dividing data stored in the original database into a plurality of attributes and dimensions, and constructing a kd tree
Further comprising:
When a plurality of result data are derived,
Deriving the result data and providing the result data to the user terminal,
Selecting and providing to the user terminal a predetermined number of result data in the kd tree in order of closeness to the kNN query among the plurality of result data;
(K-NN). The method according to claim 1,
Dividing data stored in the original database into a plurality of attributes and dimensions to construct a kd tree; And
Verifying whether or not there is data having a distance shorter than the distance from the result data on the basis of the kNN query in the kd tree and verifying the result data
Wherein the k-NN query processing method further comprises: The method according to claim 1,
Deriving the result data and providing the result data to the user terminal,
The method comprising: a first step of performing an encryption operation protocol in the first cloud and transferring the discovered node to the second cloud;
A second step of transmitting, in the second cloud, a result of performing an encryption operation protocol on data acquired from the node with the decryption secret key to the first cloud; And
Repeating the first and second steps until results for the kNN query are derived, and processing the kNN query
(K-NN).

Images