A secure query method and device for multidimensional data

Abstract

The present invention provides a method and device for secure query of multidimensional data, the method comprising: a user sending a query request to a cloud server, the cloud server receiving the query request, verifying a signature value, and decrypting a ciphertext to obtain an encrypted query parameter; performing a comparison calculation on each dimension of the encrypted data item through the encrypted data item and the encrypted query parameter, generating a query result set, and sending it to the user. During the entire process of the present invention, the specific content of the data item and the specific content of the query request will not be known, and an efficient, secure and accurate multidimensional data query service can be provided, and the data security of the data owner can be protected, and the leakage of the privacy information queried by the user can be avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing and big data, and in particular to a method and device for securely querying multidimensional data. Background Art

[0002] With the rapid development of the Internet, the amount of data generated by people in their lives and work has also greatly increased. Massive amounts of data are centrally stored by data owners in the form of multidimensional data, and then some valuable query services such as travel, consumption, medical services and scientific research are provided to users. However, this query service will bring huge storage and computing costs, and the user's query information will also be clearly known to the data owner, and the user's privacy security cannot be guaranteed.

[0003] With the development of cloud computing technology, it has become a mainstream trend for data owners to store data on cloud servers, and cloud servers provide query services based on user requests. Since these data are sensitive information, data owners do not want their data information to be known by cloud servers, and users do not want their private information to be leaked to cloud servers and data owners. Therefore, data security is a key issue that needs to be solved in multidimensional data query.

[0004] Traditional homomorphic encryption is to complete the operation of encrypted data without decryption. However, since this encryption operation generally requires a large amount of computing resources, it is not suitable for secure query of multi-dimensional data. Summary of the invention

[0005] The present invention provides a multi-dimensional data security query method and device, which are used to solve the problem that the existing multi-dimensional data query method is imperfect.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] A first aspect of the present invention provides a method for securely querying multidimensional data, the method comprising the following steps:

[0008] The user sends a query request to the cloud server, wherein the query request includes a ciphertext of encrypted query parameters based on the request information, a user identity, a timestamp, and a signature value;

[0009] The cloud server receives the query request, verifies the signature value using the user's public key, and decrypts the ciphertext to obtain the encrypted query parameters of the request information;

[0010] The cloud server performs comparative calculations on each dimension of the encrypted data items through the stored encrypted data items and the encrypted query parameters of the request information, encrypts the obtained data set using the current user's public key, and after signing with the cloud server's private key, generates a query result set and sends it to the user.

[0011] Furthermore, before the user sends a query request to the cloud server, the following steps are also included:

[0012] Initialize the server to obtain the security parameter ω, obtain two ω-bit large prime numbers p1 and p2, run Gen(ω), and obtain several system parameters, including the calculation group G and the mapping group G of the calculation group G. T , large prime number p1, large prime number p2, generator g, generator u, symmetric encryption key k and calculation parameters and

[0013] Furthermore, before the user sends a query request to the cloud server, the data owner, the user and the cloud server register with the initialization server, specifically including:

[0014] The data owner or user randomly selects a number when registering As its private key SK, calculate the corresponding public key PK = g SK , and sends the public key to the initialization server, which sends the public key to the initialization server through a secure channel.<B1,B2,k> to registered data owners or users;

[0015] The cloud server generates a public and private key pair when registering And the public key PK CS Sent to the initialization server for signature verification; the initialization server calculates Where 1≤j≤η, η is a large integer less than 256 bits in length, and construct an evaluation data set HPS={HP1,HP2,…,HP η}; The initialization server sorts the data in the collection in order of size, and sends the sorted evaluation data set HPS to the cloud server.

[0016] Furthermore, before the user sends a query request to the cloud server, the following steps are also included:

[0017] The data owner uses an n-dimensional vector to represent each data item. express;

[0018] Encrypted by encryption algorithm and key k Get CX i ;

[0019] Add disturbance to the data item by the following formula (1):

[0020]

[0021] Randomly select n numbers r1, r2, ..., r n, and calculate the encrypted attribute parameters

[0022] The signature is calculated using formula (3), where SK is the private key of the data owner, ID is the identity of the data owner, TS1 is the timestamp of the current moment, and H() is the hash function;

[0023] Sig=H(F i ||CX i ||ID||TS1) SK (3)

[0024] The data owner unit will sign the data item <F i ||CX i ||ID||TS1||Sig> is sent to the cloud server.

[0025] Furthermore, after receiving the data item signed by the data owner, the cloud server performs the following operations:

[0026] Compare the timestamp with the current time to verify its timeliness;

[0027] Verify that formula (4) holds true: e(g,Sig)=e(PK,H(F i ||CX i ||ID||TS1)) (4);

[0028] If true, store the data item F after signature verification i .

[0029] Furthermore, the specific process of the user sending a query request to the cloud server is:

[0030] The user determines an n-dimensional parameter vector (y1, y2, ..., y n );

[0031] According to formula (6), the parameter vector is calculated:

[0032]

[0033] According to formula (7), the encrypted query parameters are calculated:

[0034]

[0035] According to formula (8), the encrypted query parameter is encrypted using the cloud server public key to obtain the ciphertext Q:

[0036]

[0037] According to formula (9), the signature value is calculated, where is the user's own private key, TS2 is the current timestamp, U j Is the user identity:

[0038]

[0039] Encrypted query request <Q||U j ||TS2||Sig j >Send to cloud server.

[0040] Furthermore, after receiving the query request sent by the user, the cloud server calculates the query result set. The specific process is as follows:

[0041] Create temporary windows and temporary files;

[0042] Start traversing from the first data point in the initial set, compare the data point with every data point in the temporary window to determine dominance;

[0043] If the data point is dominated by a data point in the temporary window, the data point is discarded; if the data point dominates one or more data points in the temporary window, the one or more data points dominated in the temporary window are discarded and the data point is stored in the temporary window; if the data point and all data points in the temporary window do not dominate each other, the data point is stored in the temporary window; if the temporary window is full, the data point is stored in the temporary file;

[0044] After traversing the data points in the set, the first data point in the temporary file is inserted into the data point output in the temporary window as the SP point, and the data in the temporary file is returned to the previous step of calculation as a new data set; when all data points in the initial set are discarded or output as SP points, the calculation is terminated, and the set of all SP points is the query result set.

[0045] Furthermore, the specific process of comparing the data point with each data point in the temporary window to determine dominance is:

[0046] Select two encrypted data items stored on cloud servers and And the query request of the user unit <q1,q2,…,q n >

[0047] By formula (12), the comparison parameter D is calculated k ,k=1,2,…,n,

[0048]

[0049] Set parameters a, b and c, and their initial values ​​are all set to 0;

[0050] If D k =1, then the value of a is increased by 1; otherwise, HD is calculated k =H(D k ) and search for HD in the evaluation data set HPS stored in itself k If the parameter HD is found k , then the value of b is increased by 1; if the parameter HD is not found k , the value of c increases by 1;

[0051] After all dimensions are compared, in the case of a = n, that is, F i and F j There is no difference in the user's query conditions. If b>0, c=0, then F j Dominate F i , if c>0, b=0, then F i Dominate F j Otherwise, F i and F j There is no dominance relationship.

[0052] A second aspect of the present invention provides a secure query device for multidimensional data, the device comprising:

[0053] A user unit is used to send a query request to the cloud server, wherein the query request includes a ciphertext of encrypted query parameters based on the request information, a user identity, a timestamp, and a signature value;

[0054] The cloud server unit is used to receive the query request, verify the signature value using the user public key, and decrypt the ciphertext to obtain the encrypted query parameters of the request information; compare and calculate each dimension of the encrypted data item through the stored encrypted data item and the encrypted query parameters of the request information, encrypt the obtained data set using the current user public key, and after signing with the cloud server private key, generate a query result set and send it to the user.

[0055] Furthermore, the device also includes:

[0056] Initialize the control unit to obtain the security parameter ω, obtain two large prime numbers p1 and p2 of ω, run Gen(ω), and obtain several system parameters, including the calculation group G, the mapping group G of the calculation group G T , large prime number p1, large prime number p2, generator g, generator u, symmetric encryption key k and calculation parameters and It is also used to receive and process registration requests from data owner units, user units and cloud server units;

[0057] The data owner unit is used to encrypt the data source and store the signed data items to the cloud server unit.

[0058] The security query device of the second aspect of the present invention can implement the method in the first aspect and the various implementation modes of the first aspect, and achieve the same effect.

[0059] The effects provided in the content of the invention are only the effects of the embodiments, not all the effects of the invention. One of the above technical solutions has the following advantages or beneficial effects:

[0060] In the present invention, the data owner stores the encrypted data in the cloud server; the user encrypts his request and generates a query request and sends it to the cloud server; after receiving the encrypted query request, the cloud server performs calculations to obtain the optimal point set that satisfies the user's query request, and returns the result to the user. During the whole process, the specific content of the data item and the specific content of the query request will not be known, which can provide efficient, secure and accurate multi-dimensional data query services, protect the data security of the data owner, and avoid the leakage of the privacy information of the user query. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0062] Figure 1 is a flow chart of an embodiment of the query method of the present invention;

[0063] Figure 2 It is a structural diagram of an embodiment of the query device of the present invention. DETAILED DESCRIPTION

[0064] In order to clearly illustrate the technical features of the present solution, the present invention is described in detail below through specific implementation methods and in conjunction with the accompanying drawings. The disclosure below provides many different embodiments or examples for realizing different structures of the present invention. In order to simplify the disclosure of the present invention, the components and settings of specific examples are described below. In addition, the present invention may repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed. It should be noted that the components illustrated in the accompanying drawings are not necessarily drawn to scale. The present invention omits the description of known components and processing techniques and processes to avoid unnecessary limitations on the present invention.

[0065] like Figure 1As shown, an embodiment of the present invention provides a method for securely querying multidimensional data, the query method comprising the following steps:

[0066] S1, the user sends a query request to the cloud server, the query request includes the ciphertext of the encrypted query parameters based on the request information, the user identity, the timestamp and the signature value;

[0067] S2, the cloud server receives the query request, verifies the signature value using the user's public key, and decrypts the ciphertext to obtain the encrypted query parameters of the request information;

[0068] S3, the cloud server compares and calculates each dimension of the encrypted data item through the stored encrypted data item and the encrypted query parameters of the request information, encrypts the obtained data set using the current user's public key, and after signing with the cloud server's private key, generates a query result set and sends it to the user.

[0069] In one implementation of the embodiment of the present invention, before the user sends a query request to the cloud server, the following steps are also included:

[0070] Initialize the server to obtain the security parameter ω, obtain two ω-bit large prime numbers p1 and p2, run Gen(ω), and obtain several system parameters, including the calculation group G and the mapping group G of the calculation group G. T , large prime number p1, large prime number p2, generator g, generator u, symmetric encryption key k and calculation parameters and

[0071] Among them, the n-order bilinear mapping group G with g as the generator, is the group of non-zero integers of order n-1.

[0072] Calculate another generator u of group G, and calculate the mapping group G of group G according to the bilinear mapping function e() T At the same time, according to the generator u of group G and the large prime number p2, the system parameters are calculated The initialization control unit calculates the system parameters based on the generator g and the large prime number p1, as well as the bilinear mapping function e() and

[0073] Select an asymmetric encryption algorithm E() and a hash function H() that meet the requirements. Then, randomly select a 128-bit number as the symmetric encryption key k and randomly select a number As its private key SK TA , and calculate the corresponding public key Then, the system parameters are disclosed by the initialization control unit <m,G,G T,e,g,h,PK TA ,E(),H(),k>, where m=p1*p2.

[0074] In one implementation of the embodiment of the present invention, before the user sends a query request to the cloud server, the data owner, the user and the cloud server register with the initialization server, specifically including:

[0075] The data owner or user randomly selects a number when registering As its private key SK, calculate the corresponding public key PK = g SK , and sends the public key to the initialization server, which sends the public key to the initialization server through a secure channel.<B1,B2,k> To the registered data owner or user; the cloud server generates a public-private key pair when registering And the public key PK CS Sent to the initialization server for signature verification; the initialization server calculates Where 1≤j≤η, η is a large integer less than 256 bits in length, and construct an evaluation data set HPS={HP1,HP2,…,HP η}; The initialization server sorts the data in the collection in order of size and sends the sorted evaluation data set HPS to the cloud server. After the data owner, user and cloud server are registered, the offline or closed service method is used to prevent single point attacks.

[0076] In one implementation of the embodiment of the present invention, before the user sends a query request to the cloud server, the following steps are also included:

[0077] The data owner uses an n-dimensional vector to represent each data item. It means that before data is stored, the data owner unit will perform the following calculation operations on each piece of data:

[0078] Encrypted using the AES encryption algorithm and key k Get CX i ;

[0079] The data item is disturbed by the following formula (1) to prevent malicious attacks, where B1 is only known to the registered user and the data owner:

[0080]

[0081] Randomly select n numbers r1, r2, ..., r n , and calculate the encrypted attribute parameters The specific calculation method is shown in the following formula (2):

[0082]

[0083] The signature is calculated using formula (3), where SK is the private key of the data owner, ID is the identity of the data owner, TS1 is the timestamp of the current moment, and H() is the hash function;

[0084] Sig=H(F i ||CX i ||ID||TS1) SK (3)

[0085] The data owner unit will sign the data item <F i ||CX i ||ID||TS1||Sig> is sent to the cloud server.

[0086] After receiving the data item signed by the data owner, the cloud server performs the following operations:

[0087] Compare timestamp T1 with the current time to verify its timeliness;

[0088] Verify that formula (4) holds true: e(g,Sig)=e(PK,H(F i ||CX i ||ID||TS1))(4), the reason is as shown in formula (5):

[0089] e(g,Sig)=e(g,H(F i ||CX i ||ID||TS1)) SK

[0090] =e(PK,H(F i ||CX i ||ID||TS1) (5);

[0091] If true, store the data item F after signature verification i .

[0092] In the above step S1, in order to ensure the privacy of the user's query information, the registered user will encrypt the query information before sending the query request to the cloud server unit. The specific process of the user sending the query request to the cloud server is:

[0093] The user determines an n-dimensional parameter vector (y1, y2, ..., y n );

[0094] According to formula (6), the parameter vector is calculated:

[0095]

[0096] According to formula (7), the encrypted query parameters (q1, q2, ..., q n ):

[0097]

[0098] According to formula (8), using the cloud server public key PK CS The encrypted query parameter is encrypted to obtain a ciphertext Q:

[0099]

[0100] According to formula (9), the signature value is calculated, where is the user's own private key, TS2 is the current timestamp, U j Is the user identity:

[0101]

[0102] Encrypted query request <Q||U j ||TS2||Sig j >Send to cloud server.

[0103] In step S2, the cloud server first verifies the timeliness of timestamp TS2, and verifies the correctness of the signature by calculating whether formula (10) holds. If the formula holds, the timeliness of the signature is verified, as shown in formula (11):

[0104]

[0105]

[0106] The cloud server uses its own private key SK CS Decrypt the ciphertext Q and get <q1,q2,…,q n >.

[0107] In step S3, the cloud server unit uses the BNL algorithm to traverse all data items stored in itself. Specifically, for the comparison of any two data items in the BNL algorithm, the cloud server unit runs the following dominance judgment algorithm to obtain the corresponding dominance relationship:

[0108] The BNL algorithm first creates a blank temporary window and temporary file in the memory. The temporary window is used to store data that may be SP points, and the temporary file is used to store data points when the temporary window space is insufficient;

[0109] Start traversing from the first data point in the initial set, compare the data point with each data point in the temporary window to determine dominance. When the temporary window is empty, insert the data point directly into the temporary window.

[0110] If the data point is dominated by a data point in the temporary window, the data point is discarded; if the data point dominates one or more data points in the temporary window, the one or more data points dominated in the temporary window are discarded and the data point is stored in the temporary window; if the data point and all data points in the temporary window do not dominate each other, the data point is stored in the temporary window; if the temporary window is full, the data point is stored in the temporary file;

[0111] After traversing the data points in the set, the first data point in the temporary file is inserted into the data point output in the temporary window as the SP point, and the data in the temporary file is returned to the previous step of calculation as a new data set; when all data points in the initial set are discarded or output as SP points, the calculation is terminated, and the set of all SP points is the query result set.

[0112] The specific process of comparing the data point with each data point in the temporary window to determine dominance is as follows:

[0113] Select two encrypted data items stored on cloud servers and And the query request of the user unit <q1,q2,…,q n >

[0114] By formula (12), the comparison parameter D is calculated k ,k=1,2,…,n,

[0115]

[0116] Set parameters a, b and c, and their initial values ​​are all set to 0;

[0117] If D k =1, then the value of a is increased by 1; otherwise, HD is calculated k =H(D k ) and search for HD in the evaluation data set HPS stored in itself k If the parameter HD is found k , then the value of b is increased by 1; if the parameter HD is not found k , the value of c increases by 1;

[0118] After all dimensions are compared, in the case of a = n, that is, F i and F j There is no difference in the user's query conditions. If b>0, c=0, then F j Dominate F i , if c>0, b=0, then F i Dominate F j Otherwise, F i and Fj There is no dominance relationship.

[0119] After traversing all data items using the BNL (Block Nested Loops) algorithm, the cloud server obtains a data set SKY(F), where each item F i The cloud server will treat each data item F in the set as i Corresponding CX i Add to the set SKY(CX) and use the asymmetric encryption algorithm E() and the user's public key Encrypt SKY(CX) and use your own private key SK CS The signature is calculated using formula (13):

[0120]

[0121] The cloud server will set the result Send to user.

[0122] After receiving the query result set from the server After that, the user first checks the validity of the timestamp TS3 and verifies the correctness of the signature by calculating whether formula 14 is valid. Then, the user unit uses its own private key To decrypt Finally, the user decrypts SKY(CX) using the AES decryption algorithm and the symmetric key k to obtain the plaintext of each data item in the result set that meets the conditions:

[0123]

[0124] like Figure 2 As shown, an embodiment of the present invention further provides a device for secure query of multi-dimensional data, the device comprising an initialization control unit, a user unit, a data owner unit and a cloud server unit.

[0125] Initialize the control unit to obtain the security parameter ω, obtain two large prime numbers p1 and p2 of ω, run Gen(ω), and obtain several system parameters, including the calculation group G, the mapping group G of the calculation group G T , large prime number p1, large prime number p2, generator g, generator u, symmetric encryption key k and calculation parameters and It is also used to receive and process registration requests from data owner units, user units and cloud server units.

[0126] The data owner unit includes data providers who have a large amount of data resources. They will integrate and analyze the data resources in order to provide query services to users. Since data owners directly provide query services that require a large amount of storage and computing resources, they hope to use cloud servers to provide query services to users. However, as data is an important asset, data owners want to ensure its confidentiality, so they will encrypt the data before storing it in the cloud server.

[0127] The cloud server unit contains a large number of distributed storage and computing nodes, which can store a large amount of encrypted data information from data owners and provide users with secure query services based on these ciphertexts. The cloud server unit mainly consists of two parts: storing data and completing encrypted data queries, that is, storing the ciphertext data of the data owner, and performing calculations on the ciphertext according to the user's encrypted query request, and returning a result set that meets the conditions. Specifically, it receives the query request, verifies the signature value using the user's public key, and decrypts the ciphertext to obtain the encrypted query parameters of the request information; compares and calculates each dimension of the encrypted data item through the stored encrypted data items and the encrypted query parameters of the request information, encrypts the obtained data set using the current user's public key, and generates a query result set after signing with the cloud server private key and sending it to the user.

[0128] After the user unit completes the registration in the initialization control unit, it can send a query request to the cloud server and obtain the query result set returned by the cloud server. In order to prevent the cloud server from obtaining the content of the user's query request, the user needs to encrypt the query request. At the same time, unregistered users cannot obtain the data of the data owner. The query request sent by the user unit includes the ciphertext of the encrypted query parameters based on the request information, the user identity, the timestamp, and the signature value.

[0129] Confidentiality requirements need to be met between the cloud server unit and the data owner unit. Even if the cloud server stores all the encrypted data items of the data owner, it still cannot obtain the specific value of any data item. At the same time, privacy requirements need to be met between the cloud server unit and the user unit. Even if the cloud server unit can obtain all the user's query requests, it cannot obtain any specific information related to the user's query request. In addition, only legitimate users can receive and decrypt the corresponding response result set returned by the cloud server unit.

[0130] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A secure query method for multidimensional data, characterized in that: The query method comprises the following steps: The user sends a query request to the cloud server, wherein the query request includes a ciphertext of encrypted query parameters based on the request information, a user identity, a timestamp, and a signature value; The cloud server receives the query request, verifies the signature value using the user's public key, and decrypts the ciphertext to obtain the encrypted query parameters of the request information; The cloud server compares and calculates each dimension of the encrypted data item through the stored encrypted data item and the encrypted query parameters of the request information, encrypts the obtained data set using the current user's public key, and generates a query result set after signing it with the cloud server's private key, and sends it to the user; The cloud server also includes the following steps before sending a query request: Initialize the server to obtain the security parameter ω, obtain two ω-bit large prime numbers p1 and p2, run Gen(ω), and obtain several system parameters, including the calculation group G and the mapping group G of the calculation group G. T , large prime number p1, large prime number p2, generator g, generator u, symmetric encryption key k and calculation parameters and Before the user sends a query request to the cloud server, the data owner, the user and the cloud server register with the initialization server, specifically including: The data owner or user randomly selects a number when registering As its private key SK, calculate the corresponding public key PK = g SK , and sends the public key to the initialization server, which sends the public key to the initialization server through a secure channel.<B1,B2,k> to registered data owners or users; The cloud server generates a public and private key pair when registering And the public key PK CS Sent to the initialization server for signature verification; the initialization server calculates Where 1≤j≤η, η is a large integer less than 256 bits in length, and construct the evaluation data set HPS=HP1,HP2,…,HP η }; The initialization server sorts the data in the collection in order of size, and sends the sorted evaluation data set HPS to the cloud server; Before the user sends a query request to the cloud server, the following steps are also included: The data owner uses an n-dimensional vector to represent each data item. express; Encrypted by encryption algorithm and key k Get CX i ; Add disturbance to the data item by the following formula (1): Randomly select n numbers r1, r2, ..., r n , and calculate the encrypted attribute parameters The signature is calculated using formula (3), where SK is the private key of the data owner, ID is the identity of the data owner, TS1 is the timestamp of the current moment, and H() is the hash function; Sig=H(F i ||CX i ||ID||TS1) SK (3) The data owner unit will sign the data item <F i ||CX i ||ID||TS1||Sig> is sent to the cloud server; After receiving the data item signed by the data owner, the cloud server performs the following operations: Compare the timestamp with the current time to verify its timeliness; Verify that formula (4) holds true: e(g,Sig)=e(PK,H(F i ||CX i ||ID||TS1)) (4); If true, store the data item F after signature verification i ; The specific process of the user sending a query request to the cloud server is: The user determines an n-dimensional parameter vector (y1, y2, ..., y n ); According to formula (6), the parameter vector is calculated: According to formula (7), the encrypted query parameters are calculated: According to formula (8), the encrypted query parameter is encrypted using the cloud server public key to obtain the ciphertext Q: According to formula (9), the signature value is calculated, where is the user's own private key, TS2 is the current timestamp, U j Is the user identity: Encrypted query request <Q||U j ||TS2||Sig j >Send to cloud server; After receiving the query request sent by the user, the cloud server calculates the query result set. The specific process is as follows: Create temporary windows and temporary files; Start traversing from the first data point in the initial set, compare the data point with every data point in the temporary window to determine dominance; If the data point is dominated by a data point in the temporary window, the data point is discarded; if the data point dominates one or more data points in the temporary window, the one or more data points dominated in the temporary window are discarded and the data point is stored in the temporary window; if the data point and all data points in the temporary window do not dominate each other, the data point is stored in the temporary window; if the temporary window is full, the data point is stored in the temporary file; After traversing the data points in the set, insert the first data point in the temporary file into the data point output in the temporary window as the SP point, and return the data in the temporary file as a new data set to the previous step of calculation; when all data points in the initial set are discarded or output as SP points, the calculation is terminated, and the set of all SP points is the query result set; The specific process of comparing the data point with each data point in the temporary window to determine dominance is as follows: Select two encrypted data items stored on cloud servers and And the query request of the user unit <q1,q2,…,q n > By formula (12), the comparison parameter D is calculated k ,k=1,2,…,n, Set parameters a, b and c, and their initial values ​​are all set to 0; If D k =1, then the value of a is increased by 1; otherwise, HD is calculated k =H(D k ) and search for HD in the evaluation data set HPS stored in itself k If the parameter HD is found k , then the value of b is increased by 1; if the parameter HD is not found k , the value of c increases by 1; After all dimensions are compared, in the case of a = n, that is, F i and F j There is no difference in the user's query conditions. If b>0, c=0, then F j Dominate F i , if c>0, b=0, then F i Dominate F j Otherwise, F i and F j There is no dominance relationship.

2. A secure query device for multidimensional data, characterized in that: The device comprises: A user unit is used to send a query request to the cloud server, wherein the query request includes a ciphertext of encrypted query parameters based on the request information, a user identity, a timestamp, and a signature value; The cloud server unit is used to receive the query request, verify the signature value using the user public key, and decrypt the ciphertext to obtain the encrypted query parameters of the request information; compare and calculate each dimension of the encrypted data item through the stored encrypted data item and the encrypted query parameters of the request information, encrypt the obtained data set using the current user public key, and generate a query result set after signing it with the cloud server private key, and send it to the user; The device also includes: Initialize the control unit to obtain the security parameter ω, obtain two large prime numbers p1 and p2 of ω, run Gen(ω), and obtain several system parameters, including the calculation group G, the mapping group G of the calculation group G T , large prime number p1, large prime number p2, generator g, generator u, symmetric encryption key k and calculation parameters and It is also used to receive and process registration requests from data owner units, user units and cloud server units; The data owner unit is used to encrypt the data source and store the signed data item to the server unit of the cloud; Before the user sends a query request to the cloud server, the data owner, the user and the cloud server register with the initialization server, specifically including: The data owner or user randomly selects a number when registering As its private key SK, calculate the corresponding public key PK = g SK , and sends the public key to the initialization server, which sends the public key to the initialization server through a secure channel.<B1,B2,k> to registered data owners or users; The cloud server generates a public and private key pair when registering And the public key PK CS Sent to the initialization server for signature verification; the initialization server calculates Where 1≤j≤η, η is a large integer less than 256 bits in length, and construct the evaluation data set HPS=HP1,HP2,…,HP η }; The initialization server sorts the data in the collection in order of size, and sends the sorted evaluation data set HPS to the cloud server; Before the user sends a query request to the cloud server, the following steps are also included: The data owner uses an n-dimensional vector to represent each data item. express; Encrypted by encryption algorithm and key k Get CX i ; Add disturbance to the data item by the following formula (1): Randomly select n numbers r1, r2, ..., r n , and calculate the encrypted attribute parameters The signature is calculated using formula (3), where SK is the private key of the data owner, ID is the identity of the data owner, TS1 is the timestamp of the current moment, and H() is the hash function; Sig=H(F i ||CX i ||ID||TS1) SK (3) The data owner unit will sign the data item <F i ||CX i ||ID||TS1||Sig> is sent to the cloud server; After receiving the data item signed by the data owner, the cloud server performs the following operations: Compare the timestamp with the current time to verify its timeliness; Verify that formula (4) holds true: e(g,Sig)=e(PK,H(F i ||CX i ||ID||TS1)) (4); If true, store the data item F after signature verification i ; The specific process of the user sending a query request to the cloud server is: The user determines an n-dimensional parameter vector (y1, y2, ..., y n ); According to formula (6), the parameter vector is calculated: According to formula (7), the encrypted query parameters are calculated: According to formula (8), the encrypted query parameter is encrypted using the cloud server public key to obtain the ciphertext Q: According to formula (9), the signature value is calculated, where is the user's own private key, TS2 is the current timestamp, U j Is the user identity: Encrypted query request <Q||U j ||TS2||Sig j >Send to cloud server; After receiving the query request sent by the user, the cloud server calculates the query result set. The specific process is as follows: Create temporary windows and temporary files; Start traversing from the first data point in the initial set, compare the data point with every data point in the temporary window to determine dominance; If the data point is dominated by a data point in the temporary window, the data point is discarded; if the data point dominates one or more data points in the temporary window, the one or more data points dominated in the temporary window are discarded and the data point is stored in the temporary window; if the data point and all data points in the temporary window do not dominate each other, the data point is stored in the temporary window; if the temporary window is full, the data point is stored in the temporary file; After traversing the data points in the set, insert the first data point in the temporary file into the data point output in the temporary window as the SP point, and return the data in the temporary file as a new data set to the previous step of calculation; when all data points in the initial set are discarded or output as SP points, the calculation is terminated, and the set of all SP points is the query result set; The specific process of comparing the data point with each data point in the temporary window to determine dominance is as follows: Select two encrypted data items stored on cloud servers and And the query request of the user unit <q1,q2,…,q n > By formula (12), the comparison parameter D is calculated k ,k=1,2,…,n, Set parameters a, b and c, and their initial values ​​are all set to 0; If D k =1, then the value of a is increased by 1; otherwise, HD is calculated k =H(D k ) and search for HD in the evaluation data set HPS stored in itself k If the parameter HD is found k , then the value of b is increased by 1; if the parameter HD is not found k , the value of c increases by 1; After all dimensions are compared, in the case of a = n, that is, F i and F j There is no difference in the user's query conditions. If b>0, c=0, then F j Dominate F i , if c>0, b=0, then F i Dominate F j Otherwise, F i and F j There is no dominance relationship.

Images