Casual adder storage system and method thereof
Through the oblivious addition machine storage system based on a full binary tree structure, data with the same key value is merged and path coverage encryption is adopted, which solves the storage expansion and leakage problems of traditional oblivious random access machines and realizes secure and efficient data access.
Patent Information
- Application Number
- CN202510858672.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-25
- Publication Date
- 2025-10-03
AI Technical Summary
Traditional oblivious random access machines frequently perform addition and subtraction operations during data interaction, leading to the risk of storage bloat and backtracking leakage of sensitive data.
An oblivious adder storage system based on a full binary tree structure is adopted. By randomly generating leaf codes, merging data with the same key value and using path-covering encryption to update the cloud module, single read and write operations are ensured.
It reduces the problem of data expansion, avoids the backtracking leakage of sensitive data, and improves the security of data reading and storage efficiency.
Smart Images
Figure CN120744948A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security, and in particular to an oblivious adder storage system and method thereof. Background Art
[0002] Oblivious Random Access Machine (ORAM) is a technology that allows clients to outsource memory storage to untrusted servers in order to hide data access patterns. "Oblivious" is a key concept that describes ORAM's core goal: to hide data access patterns so that external observers cannot infer what data a user actually accessed by observing access behavior.
[0003] Assuming the user is trustworthy and the cloud is untrustworthy, the cloud can correctly execute user-specified operations. The user enters the required key, and the oblivious random access machine quickly retrieves the corresponding value. Oblivious random access machines typically fully protect user access patterns and content by constantly changing the storage address of accessed data, shuffling and re-encrypting it. However, traditional oblivious random access machines read and write the same logical key value multiple times. This results in frequent addition and subtraction operations during data exchange, generating a large amount of intermediate data and causing storage bloat. Furthermore, multiple reads pose the risk of sensitive data being leaked retroactively. Summary of the Invention
[0004] The present invention aims to solve the problems existing in the prior art and provides the following technical solutions:
[0005] The oblivious adding machine storage system includes a cloud module and a user-end module.
[0006] Specifically, the cloud module is constructed with a storage unit based on a full binary tree structure and a path mapping unit for establishing a storage path from a leaf to a tree root according to a key value.
[0007] Specifically, the user-end module includes a storage buffer, a write processing unit, and a read processing unit. The write processing unit is used to randomly generate a leaf code, decrypt all encrypted data blocks on the read path according to the leaf code, and store them in the storage buffer. The data with the same key value is merged according to the operator, and the path is recalculated to update the cloud module using path coverage encryption. The read processing unit is used to locate the target path and perform decryption to the storage buffer, merge the data of the target key value and delete the record to ensure the single read constraint, and use the path coverage mechanism to write back the data.
[0008] As an improvement to the above technical solution, the full binary tree is constructed as follows:
[0009] There are N nodes, the tree height is L, each tree node is recorded as a bucket, each tree node stores several data blocks, and each data block stores an encrypted tuple, which stores a key value and a data value respectively.
[0010] As an improvement to the above technical solution, the method for calculating the storage path by the path mapping unit relies on the H function, which includes the following formula:
[0011] leaf=H(key)=f(key)%Y
[0012] Among them, f is a pseudo-random function, Y is the number of leaf nodes, % represents the remainder, and key is the key value.
[0013] As an improvement of the above technical solution, the write processing unit includes: a path random selection module, a data merging module and a data eviction module;
[0014] The path selection module is used to randomly generate leaf codes, read all encrypted data blocks on the path according to the leaf codes, decrypt them, and store them in the storage buffer; the data merging module is used to merge the same key values according to the operator; the data eviction module is used to update the cloud module by recalculating the path and using path coverage encryption.
[0015] As an improvement to the above technical solution, the working steps of the data merging module are as follows:
[0016] The key value, data, the level of the binary tree where the leaf code is located, and the operator of each tuple are combined to obtain a quaternary form, where the operator includes an assignment symbol and an addition and subtraction symbol.
[0017] Sort all the quadruple forms corresponding to all key values according to the level of the binary tree where the leaf codes are located.
[0018] If there is an assignment symbol in the operator, all operations before and after the first assignment symbol are merged. If there is no assignment symbol in the operator, the operations corresponding to all symbols are merged. After the merging, the corresponding tuples merged are deleted until all tuples with the same key value in the storage buffer are merged and the merged tuples are written to the storage buffer.
[0019] As an improvement of the above technical solution, the reading processing unit includes a directional path reading module, a data deletion module, and a post-read eviction module;
[0020] The directional path reading module is used to locate the target path through the H function and decrypt and store it. The data deletion module is used to delete the record after merging the key-value data corresponding to the target path. The post-read eviction module is used to recalculate the path and use path overlay encryption to update the cloud module.
[0021] As an improvement to the above technical solution, the operation method of the data deletion module in merging the key-value data corresponding to the target path is the same as the merging process in the write processing unit.
[0022] As an improvement to the above technical solution, the path-covering encryption update by recalculating the path includes the following steps:
[0023] For any tuple stored in the storage buffer, the path S where the key value is located is calculated, and a layer-by-layer judgment is performed from the level where the tree node is located to the root of the tree. If the tree node is in the path where the path S overlaps with the target path, and the tree node is not full, the tuple is written. If the write fails, the tuple is stored in the storage buffer, encrypted using an encryption algorithm, submitted to the cloud, and the original path is overwritten.
[0024] An oblivious adder storage method, applied to the oblivious adder storage system of any one of the aforementioned technical solutions, comprises the following steps:
[0025] When performing a write operation, a random leaf code is generated by the write processing unit, and all encrypted data blocks on the reading path are decrypted according to the leaf code and stored in the storage buffer. Data with the same key value are merged according to the operator, and the cloud module is updated by recalculating the path and using path overlay encryption.
[0026] When performing a read operation, the target path is located by the read processing unit and decrypted to the storage buffer, data with the same key value is merged, and records are deleted, and data is written back using a path overlay mechanism.
[0027] As an improvement to the above technical solution, the data in the storage buffer is encrypted using a symmetric encryption algorithm.
[0028] Beneficial effects of the present invention:
[0029] By designing a single-read, multiple-write access machine, data is written and read. When writing, the data expansion problem caused by data addition and subtraction is reduced by merging operations. When reading, calculations are also performed through data merging. The difference is that when reading, the target key value data is deleted after merging. This method ensures that the data can be accessed only once during the reading process, avoiding the risk of data backtracking and leakage. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 is a schematic diagram of the oblivious adder storage system of the present invention;
[0031] Figure 2 This is a binary tree structure diagram within the cloud module of the present invention;
[0032] Figure 3 A flowchart of a single data accidentally written for the present invention;
[0033] Figure 4 This is a flow chart of the inadvertent reading of a single data according to the present invention. DETAILED DESCRIPTION
[0034] The following describes the embodiments of the present invention through specific examples. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. The present invention may also be implemented or applied through various other specific embodiments, and the details in this specification may be modified or altered based on different viewpoints and applications without departing from the spirit of the present invention.
[0035] Traditional oblivious random access machines read and write the same logical key value multiple times. This results in frequent addition and subtraction operations during data exchange, generating large amounts of intermediate data and causing storage bloat. Furthermore, multiple reads pose the risk of sensitive data being leaked retroactively.
[0036] In order to solve the above problems, the following embodiments are provided:
[0037] Example 1
[0038] See also Figures 1 to 4 , provides an oblivious adder storage system, including: a cloud module and a user-end module.
[0039] Specifically, the cloud module is constructed with a storage unit based on a full binary tree structure and a path mapping unit for establishing a storage path from a leaf to a tree root according to a key value.
[0040] Specifically, the user-end module includes a storage buffer, a write processing unit, and a read processing unit. The write processing unit is used to randomly generate a leaf code, decrypt all encrypted data blocks on the read path according to the leaf code, and store them in the storage buffer. The data with the same key value is merged according to the operator, and the path is recalculated to update the cloud module using path coverage encryption. The read processing unit is used to locate the target path and perform decryption to the storage buffer, merge the data of the target key value and delete the record to ensure the single read constraint, and use the path coverage mechanism to write back the data.
[0041] When a user wants to write a value with x as the key, it is written as write(x, value). This operation has three results depending on the format of value: when value is in the format of "+a", the value of x is modified to x+a; when value is in the format of "-a", the value of x is modified to xa; when value is in the format of "=a", the value of x is modified to a. For a single data write operation, such as Figure 3 In this embodiment, for any leaf code x, P(x) represents a path from the leaf code x to the root of the tree, which contains all the binary groups on the path.
[0042] When writing, the modules in the write processing unit need to cooperate. Specifically, the write processing unit includes: a path random selection module, a data merging module, and a data eviction module. The process of executing the write operation by this unit is as follows:
[0043] First, select the path through the path selection module. The specific steps are as follows:
[0044] S11: Randomly generate a leaf code m. Decrypt all binary tuples in P(m) (P(m) represents the path from leaf code m to the root of the tree) and store them in a storage buffer (i.e., Stash). At the same time, store the level of the binary tree where each binary tuple resides.
[0045] Then merge the operations through the data merge module. The specific steps are as follows:
[0046] S21: Merge the key value, data, the level of the binary tree where the leaf code is located, and the operator of each binary tuple to obtain a quadruple form, wherein the operator includes an assignment symbol and an addition and subtraction symbol.
[0047] Assume the root is level 1 and the leaves are level L. Rewrite all binary tuples in the Stash into quadruples (k, v, l, p), where k is the key, v is the numeric portion of the value, i.e., "a" in the three forms of value, l is the tuple's original level in the binary tree, and p is the sign bit in the value, i.e., "+", "-", and "=". Note: For the same value of k, there may be multiple different versions of the quadruple stored in the Stash.
[0048] S31: Sort all quadruple forms corresponding to all key values according to the level of the binary tree where the leaf codes are located.
[0049] For a k value, there may be multiple different quadruple stored in Stash. Assume that for a k value, there are multiple versions: (k, v1, l1, p1)…(k, v r , l r, p r ). First, sort the r quadruple groups according to the level l value from small to large.
[0050] S41: If there is an assignment symbol in the operator, merge all operations before and after the first assignment symbol; if there is no assignment symbol in the operator, merge all operations corresponding to the symbols, and delete the merged corresponding tuples after merging, until all tuples with the same key value in the storage buffer are merged and the merged tuples are written to the storage buffer.
[0051] For quadruple, it can usually be divided into two cases for processing, as follows:
[0052] Case 1: {p1,p2…,p r There is no "=" symbol in}. Let v*=(p1)v1+...+(p r )v r , p i Indicates v i Is a positive or negative number.
[0053] Delete the r pairs corresponding to the r quadruples in the Stash and merge them into a new pair (k, (p*) v*), where (p*) is the sign bit of v*. Write (k, (p*) v*) into the Stash.
[0054] Case 2: {p1,p2…,p r} contains a "=" symbol. Assume that p j is the first "=" symbol. Let s = j-1, let v* = (p1)v1+...+(p s )v s +v j , p i Indicates v i Is a positive or negative number.
[0055] Delete the j pairs corresponding to the j quadruples in the Stash and merge them into a new pair (k, (p*) v*), where (p*) is the sign bit of v*. Write (k, (p*) v*) into the Stash.
[0056] The same method is used until all binary groups with the same key value in Stash are merged and written to the storage buffer.
[0057] After the data merge is completed, the data is updated through the data eviction module, as follows:
[0058] For any tuple (x, v) stored in the storage buffer, calculate the path S where the key value is located. The path is calculated by the H function. After completion, the tree node is judged layer by layer from the level to the root. If the tree node is in the path where the path S overlaps with the target path P(m), and the tree node is not full, the tuple (x, v) is written. If the write fails, the tuple is stored in the storage buffer and encrypted using the encryption algorithm. It is submitted to the cloud and overwrites the original path.
[0059] In one embodiment, see Figure 2 , the full binary tree is constructed as follows:
[0060] There are N nodes, the tree height is L, each tree node is recorded as a bucket, each tree node stores several data blocks, and each data block stores an encrypted tuple, which stores a key value and a data value respectively.
[0061] In one embodiment, any data block (key, value) in a binary tree is stored on a path from a leaf to a root. The path is obtained by a path mapping unit, and the method by which the path mapping unit calculates the storage path relies on an H function, which includes the following formula:
[0062] leaf=H(key)=f(key)%Y
[0063] Among them, f is a pseudo-random function, Y is the number of leaf nodes, % represents the remainder, and key is the key value.
[0064] When reading, the modules in the read processing unit need to cooperate. Specifically, the read processing unit includes a directional path reading module, a data deletion module, and a read-after-eviction module. The process of this unit performing a write operation is as follows:
[0065] First, the directional path reading module is used to locate the target path through the H function and decrypt and store it.
[0066] Suppose a user wants to read the value of a single piece of data (let it be y) in this model. The read operation is read(y). Using the H function H(key) = f(key) % Y, it's easy to determine the path P(s) containing the data block keyed by y. Decrypt all the data in s and store it in the Stash. Also, store the level of the binary tree where each tuple resides. Rewrite all tuples in the Stash into the same four-tuple format (k, v, l, p) as in the previous solution.
[0067] Then the data deletion module is executed. In the data deletion module, the same merging scheme as in the writing step is also executed synchronously. After the merging is completed, after successfully reading the (y, (p*) v*) tuple by executing read(y), (y, (p*) v*) is deleted from Stash.
[0068] Finally, the read-after-eviction module is used to recalculate the path and update the cloud module using path-covering encryption. The steps are the same as those in the write step.
[0069] Example 2
[0070] In order to cooperate with the solution in the first embodiment, an oblivious adder storage method is also provided, which is applied to the oblivious adder storage system as described in the first embodiment, and includes the following steps:
[0071] When performing a write operation, a random leaf code is generated by the write processing unit, and all encrypted data blocks on the reading path are decrypted according to the leaf code and stored in the storage buffer. Data with the same key value are merged according to the operator, and the cloud module is updated by recalculating the path and using path overlay encryption.
[0072] When performing a read operation, the target path is located by the read processing unit and decrypted to the storage buffer, data with the same key value is merged, and records are deleted, and data is written back using a path overlay mechanism.
[0073] The single-read, multiple-write approach ensures data writes while reducing the possibility of data leakage caused by data reads. This ensures that data can be accessed only once at the logical and physical levels, enhancing data read security. Furthermore, the operator merging mechanism reduces the generation of intermediate data, reducing storage usage and computational redundancy. During data transmission, data in the storage buffer is typically encrypted using a symmetric encryption algorithm to further ensure data security.
[0074] The above embodiments are intended only to illustrate the technical solutions of the present invention and are not intended to limit the same. Anyone skilled in the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by one of ordinary skill in the art without departing from the spirit and technical concepts disclosed herein are intended to be covered by the claims of the present invention.
Claims
1. An oblivious adding machine storage system, characterized in that include: Cloud module and user-end module; The cloud module is constructed with a storage unit based on a full binary tree structure and a path mapping unit for establishing a storage path from a leaf to a tree root according to a key value; The user-end module includes a storage buffer, a write processing unit and a read processing unit; The write processing unit is used to randomly generate a leaf code, read all encrypted data blocks on the path according to the leaf code, decrypt them and store them in the storage buffer, merge the data with the same key value according to the operator, and update the cloud module by recalculating the path and using path overlay encryption; The read processing unit is used to locate the target path and perform decryption to the storage buffer, merge the data of the target key value and then delete the record to ensure the single read constraint, and use a path coverage mechanism to write back the data.
2. The oblivious adder storage system according to claim 1, wherein: The full binary tree is constructed as follows: There are N nodes, the tree height is L, each tree node is recorded as a bucket, each tree node stores several data blocks, and each data block stores an encrypted tuple, which stores a key value and a data value respectively.
3. The oblivious adder storage system according to claim 1, wherein: The method for calculating the storage path by the path mapping unit depends on the H function, which includes the following formula: leaf=H(key)=f(key)%Y Among them, f is a pseudo-random function, Y is the number of leaf nodes, % represents the remainder, and key is the key value.
4. The oblivious adder storage system according to claim 1, wherein: The write processing unit includes: a path random selection module, a data merging module and a data eviction module; The path selection module is used to randomly generate leaf codes, read all encrypted data blocks on the path according to the leaf codes, decrypt them, and store them in the storage buffer; the data merging module is used to merge the same key values according to the operator; the data eviction module is used to update the cloud module by recalculating the path and using path coverage encryption.
5. The oblivious adder storage system according to claim 4, wherein: The working steps of the data merging module are as follows: The key value, data, the level of the binary tree where the leaf code is located, and the operator of each binary tuple are combined to obtain a quadruple form, where the operator includes an assignment symbol and an addition and subtraction symbol; Sort all the four-tuple forms corresponding to all key values according to the level of the binary tree where the leaf code is located; If there is an assignment symbol in the operator, all operations before and after the first assignment symbol are merged. If there is no assignment symbol in the operator, the operations corresponding to all symbols are merged. After the merging, the corresponding tuples merged are deleted until all tuples with the same key value in the storage buffer are merged and the merged tuples are written to the storage buffer.
6. The oblivious adder storage system according to claim 1, wherein: The read processing unit includes a directional path reading module, a data deletion module, and a post-read eviction module; The directional path reading module is used to locate the target path through the H function and decrypt and store it. The data deletion module is used to delete the record after merging the key-value data corresponding to the target path. The post-read eviction module is used to recalculate the path and use path overlay encryption to update the cloud module.
7. The oblivious adder storage system according to claim 6, wherein: The operation method of the data deletion module in merging the key-value data corresponding to the target path is the same as the merging process in the write processing unit.
8. The oblivious adder storage system according to any one of claim 6, wherein: The path-covering encryption update by recalculating the path includes the following steps: For any tuple stored in the storage buffer, the path S where the key value is located is calculated, and a layer-by-layer judgment is performed from the level where the tree node is located to the root of the tree. If the tree node is in the path where the path S overlaps with the target path, and the tree node is not full, the tuple is written. If the write fails, the tuple is stored in the storage buffer, encrypted using an encryption algorithm, submitted to the cloud, and the original path is overwritten.
9. An oblivious adder storage method, applied to the oblivious adder storage system according to any one of claims 1 to 8, characterized in that: The steps include: When performing a write operation, a random leaf code is generated by the write processing unit, and all encrypted data blocks on the read path are decrypted according to the leaf code and stored in the storage buffer. Data with the same key value are merged according to the operator, and the path is recalculated and the cloud module is updated using path overlay encryption. When performing a read operation, the target path is located by the read processing unit and decrypted to the storage buffer, data with the same key value is merged, and records are deleted, and data is written back using a path overlay mechanism.
10. The oblivious adder storage method according to claim 9, wherein: The data in the storage buffer is encrypted using a symmetric encryption algorithm.