WO2018152904A1 - Procédé de traitement de données d'externalisation de sécurité de base de données relationnelle prenant en charge une opération de données de texte chiffré - Google Patents

Procédé de traitement de données d'externalisation de sécurité de base de données relationnelle prenant en charge une opération de données de texte chiffré Download PDF

Info

Publication number
WO2018152904A1
WO2018152904A1 PCT/CN2017/077109 CN2017077109W WO2018152904A1 WO 2018152904 A1 WO2018152904 A1 WO 2018152904A1 CN 2017077109 W CN2017077109 W CN 2017077109W WO 2018152904 A1 WO2018152904 A1 WO 2018152904A1
Authority
WO
WIPO (PCT)
Prior art keywords
ciphertext
value
database
algorithm
att
Prior art date
Application number
PCT/CN2017/077109
Other languages
English (en)
Chinese (zh)
Inventor
王晓菲
张玉清
伍前红
Original Assignee
中国科学院大学
北京航空航天大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国科学院大学, 北京航空航天大学 filed Critical 中国科学院大学
Publication of WO2018152904A1 publication Critical patent/WO2018152904A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/25—Integrating or interfacing systems involving database management systems
    • G06F16/252—Integrating or interfacing systems involving database management systems between a Database Management System and a front-end application
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/28—Databases characterised by their database models, e.g. relational or object models
    • G06F16/284—Relational databases
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • the invention relates to a relational database security outsourcing data processing method for supporting ciphertext data operations, which belongs to the field of cloud computing security and database security.
  • Client encryption mainly faces two problems: first, which encryption algorithm is used to encrypt the relational database; and second, how to perform data operations on the encrypted ciphertext relational database.
  • Related research has achieved a series of important results, including full homomorphic encryption technology, partial homomorphic encryption technology. More work is done around one or more of ciphertext domain equivalent queries, range queries, aggregate queries, and fuzzy queries, but the types of data operations it supports are very limited.
  • Some comprehensive ciphertext database query schemes can support some SQL-based query operations, but there are four shortcomings:
  • an object of the present invention is to provide a relational database security outsourcing data processing method that supports ciphertext data operations. This method protects the data confidentiality and effective data utilization of the relational database in the outsourcing process.
  • the technical solution used by the present invention to solve the technical problem thereof is: a relational database security outsourcing data processing method (including a query request, an insert request, an update request, and a delete request) that supports ciphertext data operations.
  • a relational database security outsourcing data processing method (including a query request, an insert request, an update request, and a delete request) that supports ciphertext data operations.
  • This approach works between end users, database owners, and cloud service providers.
  • the relational database is encrypted by the database owner before outsourcing, and then the cloud service provider directly executes the SQL-based full-type data operation on the outsourced ciphertext database, and the returned query result is decrypted by the database owner instead of the end user.
  • the method flow of the present invention is:
  • the database owner outsources the relational database security to the cloud service provider:
  • the database owner generates a private key
  • the database owner encrypts the outsourced database through the cryptographic module to generate an outsourced ciphertext database and sends it to the cloud service provider;
  • the cloud service provider receives and stores the outsourced ciphertext database in place
  • the database owner creates a user-defined function at the cloud service provider.
  • the database owner determines whether the query request has been authorized according to the access control policy, and if the access is illegal, the operation is rejected;
  • the database owner converts the plaintext SQL statement into a ciphertext SQL statement set by the conversion module and sends it to the cloud service provider;
  • the cloud service provider invokes the user-defined function, executes the ciphertext SQL statement in the ciphertext database, and returns the ciphertext query result to the database owner;
  • the database owner receives and decrypts the query result set and returns a plaintext record to the end user.
  • the security outsourcing data processing method of the present invention includes the following five modules:
  • a cryptographic module for encrypting or decrypting an outsourced database.
  • the encryption function of the OPEA algorithm has order-preserving and additivity, which can maximize the operability of data.
  • the ciphertext domain of the OPEA algorithm is divided into a plurality of ciphertext partitions arranged in order.
  • FIG. 2 is a mapping structure of the cryptographic module, and upper and lower boundaries of the ith ciphertext partition are respectively defined as U i and L i .
  • the one-to-many mapping structure used in the figure maps a single plaintext value into multiple ciphertext values in a ciphertext partition, which is used to construct an encryption function of the OPEA algorithm, thereby improving the security of the cryptographic module. Sex to defend against ciphertext attacks, statistical attacks, and weakly selected plaintext attacks.
  • the conversion module (SQL-Translator interpreter) is used to convert the plaintext SQL statement to be requested, and at the same time ensure that the ciphertext SQL statement obtained after the conversion can be executed normally in the ciphertext database.
  • FIG. 3 is a processing flow of the conversion module.
  • the integer data is directly encrypted using the OPEA algorithm; when the floating point data is encrypted, the ciphertext space is divided according to the minimum precision of the plaintext space; the character data is converted to the whole matching unit according to the minimum matching unit selected by the end user. After the type, it is encrypted, filled and spliced.
  • the plaintext space is a finite set of all the data in the database.
  • Access control using different keys to encrypt data tables or data fields with different security levels; terminal users who have obtained legal access authorization can log in to the database system through the shared user password; the database owner is based on the data of the currently logged-in user. Access rights get the corresponding encryption and decryption key.
  • the present invention solves two main problems of client encryption, and ensures data confidentiality and effective utilization of the outsourced relational database.
  • the overall architecture of the present invention is applicable to an unmodified commercial cloud database platform such as Microsoft Windows Azure SQL Database.
  • the present invention only needs to encrypt the database once, so the storage overhead is lower, and the relationship between the data access mode and the cloud database is preserved.
  • the OPEA algorithm of the cryptographic module of the present invention can resist ciphertext attacks, statistical attacks, and weakly selected plaintext attacks.
  • the average time complexity of the simplified boundary generation sub-algorithm, the encryption sub-algorithm and the decryption sub-algorithm reaches O(T), O(1) and O(log T), respectively, and T is the maximum value of the plaintext domain, which is basically superior to the mainstream.
  • Symmetric cryptographic algorithm In addition, the comparison operation time and network communication overhead of the OPEA algorithm are neglected.
  • the noise growth problem in the ciphertext domain can be effectively controlled in a constant time by adjusting the key.
  • the conversion module of the present invention supports the current most types of SQL data operations, and includes data operation statements such as equivalence query, range query, aggregate query, fuzzy query, insert, update, and delete.
  • the conversion time of the SQL-Translator interpreter is in the order of microseconds and satisfies the data conversion requirements of any type and length.
  • the present invention directly executes the ciphertext query without decrypting the outsourced data, and the query result is accurate, without error judgment, and no miss judgment. With the same query precision, the client post-processing overhead is low, and the overall query efficiency is high.
  • FIG. 1 shows the overall architecture of the system.
  • the module design, data flow direction and range of roles of the present invention are given.
  • Figure 2 is a cryptographic module mapping structure diagram. The division of the OPEA algorithm, the division method of the interval, and the plaintext domain are given. The mapping relationship of the ciphertext domain.
  • Figure 3 is a flow chart of the conversion module processing.
  • the workflow of the SQL-Translator interpreter is given, including the core conversion module and the sub-conversion module.
  • Figure 4 is an example of a database to be outsourced
  • Figure 5 is an example of an outsourced ciphertext database
  • Figure 6 is an example of a ciphertext query result
  • FIG. 7 is an example of the result of the plaintext query after decryption.
  • Figure 1 is the overall architecture of the system, mainly related to the three core service modules of the cryptographic module, the conversion module and the user-defined function.
  • the specific method includes the following steps:
  • Figure 2 is a cryptographic module mapping structure diagram.
  • the implementation method of the cryptographic module includes:
  • the algorithm consists of three sub-algorithms:
  • R i is a set of random numbers in the i th element
  • L i and L [i] is the i-th lower boundary ciphertext partitions
  • U i is the U-[i] is the i-th upper boundary ciphertext partition
  • T is the maximum value of the plaintext domain, that is, the maximum possible value of all the data in the plaintext database.
  • the encryption sub-algorithm is based on the ciphertext partition when encrypting the plaintext value m. For the boundary sets L and U, the encryption function E( ⁇ ) will select from the set ⁇ L[m], L[m]+1,...,U[m] ⁇ and return a random number as the ciphertext value c.
  • the database owner encrypts all data items using the OPEA algorithm, and encrypts the data table name, column name, and the like using an anti-collision hash function or a symmetric cryptography technique.
  • User-defined function implementation methods include:
  • step b) If the distance between E(value 1 ) and E(value 2 ) is not greater than x, the plaintext values are equal, and the function outputs 0, otherwise step b) is continued;
  • the cloud service provider calculates SUM(E(Att)) and SUM(E'(Att)) and sends the ciphertext accumulation result to the database owner;
  • Figure 3 is a flow chart of the conversion module processing.
  • the implementation method of the conversion module includes:
  • the data table name and column name are anonymized using an anti-collision hash function or a symmetric encryption technique;
  • Constant values are converted using the OPEA algorithm.
  • the corresponding sub-conversion module is called in turn for the minimum conversion unit.
  • the sub-conversion module i corresponds to the minimum conversion unit i, and the conversion rule of the minimum conversion unit i is provided, and is converted into a corresponding ciphertext SQL clause.
  • Table 1 details the conversion rules of the minimum conversion unit.
  • Table 1 shows the conversion rules for the minimum conversion unit.
  • a comparison operator expression of the form Att 1 ⁇ Att 2 is directly converted to EqualityCom(x, Att 1 C , Att 2 C ) ⁇ 0.
  • the following conversion methods are gradually adopted: add the temporary column Att_Match for Att; escape the wildcard according to the escape character esch and encrypt the ordinary characters with the OPEA algorithm;
  • the layer cursor matches the length of the data item;
  • the search mode string pat is divided into 3 parts by the Split function, and the matching conditions of the start, the middle, and the end part are respectively generated, and each matching condition is spliced using AND or OR;
  • the inner layer cursor is declared to match the current data.
  • the ciphertext string of the item updates the Att_Match column and the query criteria.
  • the conversion result of the LIKE operator consists of all the SQL statements required for the above conversion steps.
  • the cloud service provider first determines the records with the same attribute values in Att 1 C using the EqualityCom function, and then sorts them according to Att 2 C.
  • the following methods are used to convert: the self-join query is performed on the Att column, and the result of satisfying the query condition is stored in the temporary table #TEM; the query is converted into the temporary table query GROUP BY Att C.
  • the result of the conversion of the GROUP BY clause consists of all the SQL statements required for the above conversion steps.
  • insert operation statements of the form INSERT INTO ⁇ tbl>( ⁇ Att 1 ,Att 2 ,...>)VALUES(val 1 ,val 2 ,7) are directly converted to
  • the conversion rule is the same as the query operation statement.
  • the conversion rule is the same as the query condition of the query operation statement.
  • the conversion rule is the same as the query condition in the query operation statement.
  • the database owner's plaintext database consists of a data table named EXAMPLE.
  • the table contains two plaintext fields (or plaintext attribute columns) with column names C_CUSTKEY and C_NATIONKEY.
  • the database owner encrypts the plaintext database by means of the cryptographic module, and sends the encrypted ciphertext database to the cloud service provider.
  • the plaintext data table named EXAMPLE in the plaintext database corresponds to the ciphertext data table named [8e3b72508e05135569ace4ed9b96d137] in the ciphertext database, and there are 5 ciphertext records in the table, as shown in Fig.
  • the ciphertext column name obtained by encrypting the plaintext column names C_CUSTKEY and C_NATIONKEY by the hash function.
  • the ciphertext data items 121 and 4423 of the first line are respectively ciphertext values obtained by encrypting the plaintext data items 1 and 15 of the first line of the plaintext database one by one using the OPEA algorithm.
  • the end user requests to query the data record with a C_NATIONKEY value greater than 10 from the EXAMPLE table.
  • C_NATIONKEY>10 is the query condition, and the query result should return two plaintext records (1, 15) and (2, 13).
  • the database owner converts the plaintext SQL statement by means of the conversion module to obtain the ciphertext SQL statement:
  • EqualityCom [4eed023b3ef2a4fd3b3fae34f828ba5e], 2891) is a user-defined function.
  • the database owner sends the ciphertext SQL statement to the cloud service provider.
  • the query is executed in the library, and the user-defined function EqualityCom needs to be called during execution. After the query is completed, the ciphertext query result that meets the query conditions is obtained, as shown in FIG. 6.
  • the cloud service provider returns the ciphertext query result to the database owner.
  • the database owner decrypts it by means of the cryptographic module, and finally obtains the plaintext query result, as shown in Figure 7:
  • the database owner returns the plaintext query result to the end user.
  • the outsourced database query process ends.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computational Linguistics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

L'invention concerne un procédé de traitement de données d'externalisation de sécurité d'une base de données relationnelle prenant en charge une opération de données de texte chiffré. Le procédé comprend : 1) un propriétaire de base de données utilisant une clé privée pour chiffrer une base de données à externaliser et générer ensuite une base de données de texte chiffré externalisé, et envoyer celle-ci à un fournisseur de services en nuage;2) un utilisateur de terminal autorisé soumettant, au propriétaire de la base de données, une demande d'opération de données en clair sous la forme d'une instruction SQL;3) le propriétaire de base de données convertissant une instruction SQL en texte en clair de la demande d'opération de données en un ensemble d'instructions SQL de texte chiffré, et envoyant celle-ci au fournisseur de services en nuage; 4) le fournisseur de services en nuage s'exécutant directement, sur la base de données de texte chiffré externalisé, l'instruction SQL de texte chiffré, et s'il existe une demande d'interrogation, renvoyer un résultat d'interrogation de cryptogramme obtenu au propriétaire de base de données; et 5) le propriétaire de base de données reçoit et décrypte le résultat d'interrogation de texte chiffré, et renvoie un enregistrement de texte en clair à l'utilisateur de terminal. La présente invention garantit la confidentialité des données et l'utilisation efficace d'une base de données relationnelle externalisée.
PCT/CN2017/077109 2017-02-24 2017-03-17 Procédé de traitement de données d'externalisation de sécurité de base de données relationnelle prenant en charge une opération de données de texte chiffré WO2018152904A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710103350.4A CN106934301B (zh) 2017-02-24 2017-02-24 一种支持密文数据操作的关系型数据库安全外包数据处理方法
CN201710103350.4 2017-02-24

Publications (1)

Publication Number Publication Date
WO2018152904A1 true WO2018152904A1 (fr) 2018-08-30

Family

ID=59424165

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/077109 WO2018152904A1 (fr) 2017-02-24 2017-03-17 Procédé de traitement de données d'externalisation de sécurité de base de données relationnelle prenant en charge une opération de données de texte chiffré

Country Status (2)

Country Link
CN (1) CN106934301B (fr)
WO (1) WO2018152904A1 (fr)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107592298B (zh) * 2017-08-11 2020-07-14 中国科学院大学 一种基于单服务器模型的序列比较算法安全外包方法、用户终端和服务器
US10846423B2 (en) * 2017-08-11 2020-11-24 Palo Alto Research Center Incorporated System and architecture for analytics on encrypted databases
CN108170753B (zh) * 2017-12-22 2021-08-17 北京工业大学 一种共有云中Key-Value数据库加密与安全查询的方法
CN109992986B (zh) * 2017-12-29 2021-05-11 中国移动通信集团上海有限公司 一种敏感数据的脱敏处理方法及装置
CN109522727A (zh) * 2018-10-26 2019-03-26 吴晓军 一种数据处理方法、装置及设备
CN109840423B (zh) * 2018-11-27 2023-12-05 吴晓军 一种数据关系的记录方法、装置及设备
CN116910791B (zh) * 2023-09-12 2023-12-12 闪捷信息科技有限公司 数据库表列加密分析方法、装置、电子设备和存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102968455A (zh) * 2012-10-31 2013-03-13 山东浪潮齐鲁软件产业股份有限公司 一种应用层透明的数据库加密方法
US20130091357A1 (en) * 2011-10-10 2013-04-11 Altibase Corp. Database management system and encryption method performed in database
CN105681280A (zh) * 2015-12-29 2016-06-15 西安电子科技大学 一种云环境中基于中文的可搜索加密方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103281377B (zh) * 2013-05-31 2016-06-08 北京创世泰克科技股份有限公司 一种面向云的密文数据存储与查询方法
CN104022868A (zh) * 2014-02-18 2014-09-03 杭州师范大学 一种基于密文策略的属性基加密的外包解密方法
US9455831B1 (en) * 2014-09-18 2016-09-27 Skyhigh Networks, Inc. Order preserving encryption method
CN105610793B (zh) * 2015-12-18 2018-10-26 江苏大学 一种外包数据加密存储与密文查询系统及其应用方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130091357A1 (en) * 2011-10-10 2013-04-11 Altibase Corp. Database management system and encryption method performed in database
CN102968455A (zh) * 2012-10-31 2013-03-13 山东浪潮齐鲁软件产业股份有限公司 一种应用层透明的数据库加密方法
CN105681280A (zh) * 2015-12-29 2016-06-15 西安电子科技大学 一种云环境中基于中文的可搜索加密方法

Also Published As

Publication number Publication date
CN106934301B (zh) 2019-12-13
CN106934301A (zh) 2017-07-07

Similar Documents

Publication Publication Date Title
WO2018152904A1 (fr) Procédé de traitement de données d'externalisation de sécurité de base de données relationnelle prenant en charge une opération de données de texte chiffré
Popa et al. CryptDB: A practical encrypted relational DBMS
US9087212B2 (en) Methods and apparatus for securing a database
Popa et al. CryptDB: Protecting confidentiality with encrypted query processing
Popa et al. CryptDB: processing queries on an encrypted database
Li et al. Efficiency and security trade-off in supporting range queries on encrypted databases
US20160132692A1 (en) Searchable encryption for infrequent queries in adjustable encrypted databases
US9069987B2 (en) Secure data access using SQL query rewrites
Sarfraz et al. Dbmask: Fine-grained access control on encrypted relational databases
Hang et al. ENKI: access control for encrypted query processing
Pattuk et al. Bigsecret: A secure data management framework for key-value stores
Kamel et al. Dynamic spatial index for efficient query processing on the cloud
Zhan et al. MDOPE: Efficient multi-dimensional data order preserving encryption scheme
CN114254344A (zh) 一种基于区块链的共享数据库的隐私数据范围查询方法
Wang et al. QuickN: Practical and secure nearest neighbor search on encrypted large-scale data
Talha et al. Enhancing confidentiality and privacy of outsourced spatial data
Talha et al. Facilitating secure and efficient spatial query processing on the cloud
Barouti et al. Symmetrically-private database search in cloud computing
Zhang et al. Sorel: Efficient and secure ore-based range query over outsourced data
Watanabe et al. Privacy-preserving queries for a DAS model using encrypted Bloom filter
Talha et al. DISC: Query processing on the cloud service provider for dynamic spatial databases
Wang et al. T-DB: toward fully functional transparent encrypted databases in dbaas framework
Xu et al. Symmetric searchable encryption with supporting search pattern and access pattern protection in multi‐cloud
Hong et al. Secure kNN computation and integrity assurance of data outsourcing in the cloud
Ali et al. Enhancing performance of search over encrypted data in cloud computing

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17897371

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17897371

Country of ref document: EP

Kind code of ref document: A1