A spatial data range query method and device based on base tree

Abstract

The present invention discloses a method and device for searching spatial data range based on radix tree. Aiming at the problems of low query and update efficiency, large computational overhead and low security of existing solutions, the present invention first generates a radix-tree index structure based on the file location, which narrows the query range during query, and is conducive to improving query efficiency. In addition, the dual cloud server architecture is used to reduce the number of interactions between the server and the query user in an encrypted environment, thereby alleviating the computational burden of the query user. In addition, the tree structure can be used to achieve efficient spatial data update; the present invention uses an efficient public key homomorphic encryption mechanism to hide the search mode and resist chosen plaintext attacks.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and in particular to a cardinality-based spatial data range query method and device. Background Art

[0002] Location-Based Services (LBS) have a variety of applications, ranging from transportation (such as Uber) to social media (such as "Nearby Friends" on Facebook or "Nearby People" on WeChat). LBS providers mainly deal with large-scale datasets and outsource such datasets to third-party servers (such as cloud servers), which provides excellent benefits to database owners, such as on-demand access to data. In order to ensure the security of data, that is, not to be leaked during storage and retrieval, the data needs to be encrypted before outsourcing. However, the symmetric searchable encryption technology used in traditional location-based range query methods has low security. When a user wants to obtain all ciphertexts within a range, the traditional method needs to compare the locations of all ciphertexts and filter out the ciphertexts that meet the query requirements, which undoubtedly causes a waste of bandwidth and computing resources and low query efficiency. Based on this situation, there are already query technologies that reduce the range, but these technologies have corresponding problems in the range query application of ciphertexts, such as low efficiency in building and updating indexes, and are not suitable for datasets with large location ranges. Some of them also have low security, such as leaking search patterns. Summary of the invention

[0003] In view of the above-mentioned prior art, the technical problem solved by the present invention is at least to provide a method for improving the efficiency and security of spatial data query based on location information comparison.

[0004] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0005] In a first aspect, the present invention proposes a spatial data range query method, comprising the following steps:

[0006] Generate query scope objectives for electronic documents;

[0007] Encrypt the query range target, generate and submit a trapdoor for the query request to the cloud storage server;

[0008] Based on the trapdoor, all ciphertexts are obtained through collaboration between the cloud storage server and the cloud key management server, and the cloud storage server sends the ciphertexts to the querying user;

[0009] Receiving the ciphertext and decrypting it;

[0010] The cloud storage server stores an encrypted index tree and a ciphertext of an encrypted electronic document, wherein the index tree is a base tree generated based on the location of the electronic document;

[0011] The cloud key management server stores a key for index tree decryption.

[0012] In the above technical scheme, the method of the present invention can be used to implement a range query of spatial data ciphertext received by a query user on a server in the context of cloud storage. The present invention generates an index tree structure based on a radix-tree, which can narrow the scope of the query when performing a range search, overcoming the need to compare all location information in the prior art, resulting in low query efficiency, so that the present invention can narrow the query scope and achieve high query efficiency, and realize efficient comparison query of spatial data ciphertext, and has the advantages of low storage and computing overhead and high security. At the same time, the use of this index tree structure can make the data update faster and with low computing overhead. In the above technical scheme, by adopting a dual-server architecture, the interaction between the server and the user is reduced, and the computing burden of the user is also reduced.

[0013] As a further improvement of the present invention, the index tree is constructed based on binary and segmented division, and file division management is performed according to the position. Files with the same prefix in the position are stored in the same node in the tree. Therefore, when performing a range search, the scope of the query can be narrowed, which overcomes the need to compare all location information in the prior art, resulting in low query efficiency. The present invention achieves narrowing the query range and high query efficiency. At the same time, the use of this index tree structure can make the data update faster and with less computational overhead. The index tree establishment includes the following steps:

[0014] The position coordinates of the electronic document are represented by a binary vector, and the binary vector of each coordinate component is divided into segments, and the length of each segment is recorded as l, where l>0;

[0015] For each coordinate component, the segmented binary vector is stored as an index in the blocks of each layer of the index tree in turn, where the block in the root node stores the binary vector segment with the highest l bits, and the block in the leaf node stores the binary vector segment with the lowest l bits. Each node in the tree contains at most 2 l Blocks, except for leaf nodes, each block stored in other nodes may have a child node.

[0016] As a further improvement of the present invention, the index tree is updated faster and with less computational overhead, comprising the following steps:

[0017] The position of the new electronic file is represented by a binary vector, and the binary vector of each position component is divided into segments, and the length of each segment is recorded as l, l>0;

[0018] For each segment of each position component, insert it layer by layer on the current index tree until it reaches the block in the leaf node;

[0019] Or traverse the existing index tree, delete the file information layer by layer without deleting the block, until the corresponding block in the leaf node is found and delete the block;

[0020] For the updated paths in the index tree, they are encrypted and sent to the cloud storage server for updating.

[0021] As a further improvement of the present invention, a dual-server architecture is adopted to reduce the interaction between the server and the user in the encrypted environment, and also reduce the computing burden of the user. The cloud storage server cooperates with the cloud key management server to obtain all ciphertexts, including the following steps:

[0022] After receiving the trapdoor, the cloud storage server compares the index with the trapdoor starting from the root node of the index tree, and sends the comparison result to the cloud key management server, which decrypts the index and returns the decrypted value to the cloud storage server, indicating whether the index is within the query range;

[0023] If the index is the query boundary, continue to access the child nodes of the block corresponding to the index; if the index is within the query range, it means that all electronic files stored in the block are within the query range, and the ciphertext is added to the query result set. There is no need to continue to access the child nodes of the block where the index is located, and continue to access the next block; if the index is beyond the query range, ignore the block where the index is located, and continue to access the next block until all blocks stored in the root node are traversed, and the final result ciphertext set is obtained and returned to the query user.

[0024] As a further improvement of the present invention, the ciphertext of the encrypted electronic document is obtained by encrypting the position of the electronic document using a symmetric encryption algorithm.

[0025] As a further improvement of the present invention, the symmetric encryption algorithm includes any one of an advanced encryption algorithm, a data encryption standard algorithm and an international data encryption algorithm.

[0026] As a further improvement of the present invention, the encrypted index tree or the query range target is encrypted using a public key encryption system; the public key encryption system randomly selects two random numbers from the error distribution, one random number is used to calculate and generate a value of 1 modulo 2, which is used as a homomorphic encryption private key, and the other random number is used to form a homomorphic encryption public key with a secret key. The public key encryption system overcomes the low security of spatial data range query based on searchable encryption technology in the prior art, can realize hidden search mode, and has the characteristics of simple algorithm, fast calculation speed, and small storage space.

[0027] As a further improvement of the present invention, the binary vector is divided into d segments, d>0, each binary segment has a corresponding encryption public key and decryption key, and the encryption public key and decryption key corresponding to the same binary segment are the same. Files with the same prefix in position are stored in the same node in the tree, so that when performing range search, the query range is narrowed and the query efficiency is improved.

[0028] In the second aspect, the present invention proposes a spatial data range query device based on a base tree, including a cloud storage server, a cloud key management server, and a client. By adopting a dual-server architecture, the interaction between the server and the user is reduced, and the user's computing burden is also reduced.

[0029] The client: generates a query range target for the electronic document; encrypts the query range target, generates and submits a trapdoor for a query request to a cloud storage server; receives and decrypts the ciphertext corresponding to the query range target returned by the cloud storage server;

[0030] The cloud storage server: calculates and compares the received trapdoors and the indexes in the encrypted index tree stored in the cloud storage server one by one, and cooperates with the cloud key management server to determine whether the index used for comparison is within the query range, thereby obtaining all ciphertexts that meet the query range and sending them to the client;

[0031] The cloud key management server stores a key for decrypting the index tree, is used to decrypt the result of the cloud storage server's calculation and comparison, and returns the decryption result so that the cloud storage server can determine whether the index used for comparison is within the query range;

[0032] The index tree is a base tree, which is generated based on the location of the electronic document, so that the data can be updated faster and with less computational overhead.

[0033] In a third aspect, the present invention proposes a computer-readable storage device, comprising at least one storage medium, wherein the storage medium stores a computer program that can be loaded by a processor and execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0035] Figure 1 This is a schematic diagram of the XRadix index tree in Example 1;

[0036] Figure 2This is a schematic diagram of the XRadix index tree after adding files in Example 1;

[0037] Figure 3 This is a schematic diagram of the XRadix index tree after the file is deleted in Example 1. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] The idea of ​​Example 1 is: based on the decimal position coordinates of the document location, a Radix-based index tree is constructed using a base conversion method and segmentation, the index tree is encrypted using a public key encryption mechanism key to obtain an outsourced electronic document index, the index tree and the ciphertext set are uploaded to a cloud storage server, and the key is uploaded to a cloud key management server; the query request is converted into a target query vector, the target query vector is encrypted using a public key confidentiality system key, a trapdoor of the query request is obtained and sent to the cloud storage server; using the size relationship between the index and the trapdoor, the cloud key management server assists the cloud storage server in screening out ciphertexts that meet the query range, and finally the cloud storage server returns the result to the query user.

[0040] Step 1: Generate a Radix-based index tree.

[0041] First, obtain the location coordinate information of all documents. Then, convert the coordinates, that is, convert the decimal to a binary vector b of length n. Divide the binary vector into segments, each segment is a binary vector b′ of length l, and there are d segments in total. Store each segment of the binary vector in different layers of the index tree, and finally generate an index tree of height d.

[0042] In Example 1, it is assumed that n=8, l=4, and d=2. The electronic document set includes electronic documents f 1 , f 2 and f 3 , and outsourcing electronic documents 1 , f 2 and f 3, the positions are (7, 15), (4, 2) and (18, 20) respectively. Taking the X-axis as an example, convert '7', '4', '18' into binary vectors of length 8 "00000111", "00000100", "00010010" respectively. Then segment each binary vector to get {"0000", "0111"}, {"0000", "0100"}, {"0001", "0010"}, and the corresponding decimal numbers are {"0", "7"}, {"0", "4"}, {"1", "2"} respectively.

[0043] Store the data in the Radix index tree in sequence, first storing file f 1 →{"0000","0111"}, apply for a root node Bucket, record it as B 1 , in B 1 Create an empty chunk and call it c 1 , store "0000" (0) in this chunk. Then, generate a child node Bucket B for this chunk 2，1 , in B 2，1 Create an empty chunkc 2，1 Store "0111" (7); then, store file f 2 →{"0000","0100"}, from B 1 The first chunk c in 1 Start searching for "0000" (0). After searching, c 1 The data stored in c is "0000" (0), so we can directly traverse c 1 Child node B 2，1 Store "0100" (4), from B 2，1 The first chunk c in 1，1 Start searching. If no chunk stores "0100" (4), then find the chunk in B. 2，1 Create an empty chunk c in 1，2 and store "0100" (4); finally, store file f 3 →{"0001","0001"}, from B 1 The first chunk c in 1 Start searching for "0001" (1). If it does not exist, then in B 1 Create an empty chunk in the file and call it c 2 and stores "0001" (1), then the created c 2 Child node Bucket B 2，2 , in B 2，2Create an empty chunk in the file and call it c 2，2 Store "0010" (2). Finally, we get a Radix index tree with an X-axis height of 2. Each node in the tree contains at most 2 4 Blocks, except for leaf nodes, each block stored in other nodes may have a child node.

[0044] A Radix index tree for the Y axis can be constructed in the same way as above.

[0045] Step 2: Set up the public key encryption system key and the symmetric key.

[0046] Randomly select two polynomials F from a discrete Gaussian distribution 1 , g, using F 1 The private key sk is calculated. The public key pk is calculated using the polynomial g and sk. The final private key SK = {sk 1 ,…,sk d}, public key PK = {pk 1 , …, pk a}.

[0047] In Example 1, assuming that the binary vector is divided into two segments, that is, d = 2, two pairs of public and private key pairs should be generated, and the private key is SK = {sk 1 ,sk 2}, the public key is PK = {pk 1 , pk 2}.

[0048] Generates a symmetric key for a symmetric encryption algorithm.

[0049] The symmetric encryption algorithm refers to any one of the advanced encryption algorithm, the data encryption standard algorithm and the international data encryption algorithm.

[0050] Step 3: Encrypt the index tree.

[0051] Take the Radix index tree with a height of d corresponding to the X axis as an example for encryption. For the binary vectors stored in the nodes at different levels in the index tree, two random values ​​are selected from the error distribution, and the binary is encrypted bit by bit in combination with the public key corresponding to the layer to generate an index, and finally an encrypted XRadix index tree is obtained. Similarly, an encrypted YRadix index tree can be generated.

[0052] Suppose a node Bucket B in the Radix index tree corresponding to the X axis i A chunk c in j The stored binary vector is b′ = "1010", and the corresponding public key is pk i, select random values ​​s,e in the error distribution, and get index I = pk i s+pe+b′ k , k = 1, 2, 3, 4. Among them, p is a prime number. Similarly, the information stored in all nodes in the tree is encrypted in this way.

[0053] Each outsourced electronic document is encrypted using a symmetric key to obtain a ciphertext.

[0054] The XRadix index tree, YRadix index tree and ciphertext are packaged and sent to the cloud storage server, and the private key SK is sent to the cloud key management server. And the symmetric key is sent to the authorized query user through a secure channel.

[0055] Step 4: Generate query range target.

[0056] Using the base conversion method, the query coordinates are converted into a binary vector q of length n, and then segmented. Each segment is a binary vector q′ of length l, and is divided into d segments in total.

[0057] Assume n=8, l=4, d=2. The query range is [3, 8] x , [4, 16] y Taking the X-axis as an example, convert '3' and '8' to "00000011", "00001000" respectively, and then segment them into {"0000", "0011"}, {"0000", "1000"}, and the corresponding decimal numbers are {"0", "3"}, {"0", "8"}.

[0058] Step 5: Encrypt the query range target.

[0059] Encrypt the query range targets generated by the ranges corresponding to the X-axis and Y-axis respectively. First, encrypt the query range target of the X-axis, select two random values ​​from the error distribution, and encrypt the binary bit by bit with the public key corresponding to the segment to generate a partial trapdoor. Similarly, encrypt the query range target of the Y-axis according to this method to generate a partial trapdoor.

[0060] Set the query range target of the X axis to q x ={"0000","0011"},Q x ={"0000","1000"}, where q x Indicates the lower limit of the query range, Q x Indicates the upper limit of the query range. Select four random values ​​s in the error distribution 1 ,s 2 , e 1 , e 2 , and get the partial trapdoor of the X axis:

[0061]

[0062]

[0063]

[0064]

[0065] Similarly, we can get the partial trap door ty of the Y axis 1 ,ty 2 , Ty 1 , Ty 2 ; Finally, query the trapdoor for the user to submit a query range request to the cloud storage server:

[0066] T={tx 1 , tx 2 , Tx 1 , Tx 2 ,ty 1 ,ty 2 , Ty 1 , Ty 2}

[0067] Step 6: Query the ciphertext.

[0068] After receiving the trapdoor T, the cloud storage server cooperates with the cloud key management server to search the index in the XRadix index tree and the YRadix index tree. Starting from the root node, the size relationship between the index and the trapdoor is compared, and finally the ciphertext within the query range is returned.

[0069] In the embodiment of the present invention, the X-axis range trap gate for querying user queries is {tx 1 , tx 2 , Tx 1 , Tx 2}. The specific query steps are as follows:

[0070] Step 1: The index stored in the root node of the XRadix index tree is {I 1 ,…,I m}, the cloud storage server first compares tx 1 , Tx 1 and I 1 (stored in chunk c 1 ) are equal, the comparison method is as follows:

[0071]

[0072] Among them, A j , B j Respectively represent trapdoors, index I 1 The values ​​of each bit in .

[0073] Step 2: The cloud storage server will 1 Sent to the cloud key management server for decryption to obtain the value R = sk 1 M 1 (mod p) and returns it to the cloud storage server. If R = 1, it means tx 1 =I 1 , then continue to visit c 1 Continue judging the child nodes (the second level of the index tree).

[0074] Step 3: If R≠1, it means tx 1 ≠I 1 , then continue to compare tx 1 and I 1 The size relationship is compared as follows:

[0075]

[0076] Step 4: The cloud storage server will 2 Send to the cloud key management server for decryption to obtain the value R′=sk 2 M 2 (mod p) and returns it to the cloud storage server. If R′=1, it means tx 1 <I 1 ; Otherwise, tx 1 >I 1 , then the index is smaller than the minimum query boundary, and the ciphertext of the block corresponding to the index is not within the query range. Ignore the chunk and continue to access the next chunk for comparison.

[0077] Step 5: If tx 1 <I 1 , according to the third and fourth steps to determine Tx 1 and I 1 If Tx 1 >I 1 , that is, tx 1 <I 1 <Tx 1 , indicating that the index is within the query range, directly returns all file information stored in the chunk, without accessing all child nodes of the chunk; if Tx 1 =I 1 , access index I 1 The child node of the chunk; if Tx 1 <I 1 , then the index is greater than the maximum query boundary, the ciphertext of the block corresponding to the index is not within the query range, ignore the chunk, and continue to access the next chunk.

[0078] Step 6: The index of the second layer storage is Repeat the above steps to compare tx 2 , Tx 2 and I 2，i Relationship:

[0079] If the access index is I i (tx 1 =I i ) is located in the block, only tx 2 and I 2，i If tx 2 =I 2，i , indicating that all indexes are equal to the minimum query boundary, satisfying the query condition, and adding the files stored in this chunk to the query result set; if tx 2 <I 2，i , indicating that the index is greater than the minimum query boundary, and also less than the maximum query boundary, then the query condition is met and the file stored in this chunk is added to the query result set; if tx 2 >I 2，i , indicating that the index is smaller than the minimum query boundary, does not meet the query conditions, and ignores the chunk.

[0080] If the access index is I i (Tx 1 =I i ) is located in the block, only Tx 2 and I 2，i If Tx 2 =I 2，i , indicating that the index is equal to the maximum query boundary, and the query condition is met, and the files stored in this chunk are added to the query result set; if Tx 2 >I 2，i , indicating that the index is smaller than the maximum query boundary, and also greater than the minimum query boundary, the query condition is met and the file stored in the chunk is added to the query result set; if Tx 2 <I 2，i , indicating that the index is larger than the maximum query boundary, does not meet the query conditions, and ignores the chunk.

[0081] Step 7: Traverse all chunks in the root node until all ciphertexts within the search query range are obtained.

[0082] Step 8: Repeat the above steps to query all ciphertexts that meet the Y-axis range.

[0083] Step 9: The cloud storage server takes the intersection and sends all ciphertexts that meet the range to the querying user.

[0084] In the above query process, if p = 2, is equivalent to an addition operation; otherwise:

[0085] Step 7: Decrypt the returned ciphertext.

[0086] Using the symmetric key, the ciphertext received by the querying user is decrypted to obtain the plaintext corresponding to each ciphertext.

[0087] Step 8: Update data.

[0088] The file location that needs to be updated is processed using base-based conversion and segmentation techniques, and the plaintext index tree is traversed to perform add or delete operations and re-encrypted. When s and e are selected for encryption, the root nodes, s and e are the same as the previous root node encryption, and other layers re-select s and e for encryption, and finally the updated path is uploaded to the cloud storage server to replace the previous path.

[0089] Assume that the existing XRadix index tree is as follows Figure 1 As shown. Assume that the file to be added is f 4 , the corresponding X coordinate is 49, convert the binary string to "000000110001", and then insert it into Figure 1 In the example, the updated path is Figure 2 Marking shown.

[0090] Upload this path to the cloud storage server and replace it with the previous path. Updating the YRadix index tree is similar.

[0091] If the file to be deleted is f 1 , first in Figure 1 The XRadix index tree shown in the figure is deleted, starting from the root node and traversing to the leaf node. The update path is as follows Figure 3 Marking shown.

[0092] Upload this path to the cloud storage server and replace it with the previous path. Updating the YRadix index tree is similar.

[0093] When the update process is performed on the cloud storage server, no decryption is required. The cloud storage server only needs to traverse the chunks stored in the root node, find the path to be updated, and directly replace it.

[0094] In Example 2, the location coordinates of the document are replaced with a binary tree, and an experimental comparison is conducted with the method of the present invention. The comparison results show that the size of the constructed binary tree is proportional to the coverage range of all document locations, that is, the larger the document location coverage range, the greater the storage overhead of the constructed index. The index structure is not scalable and has poor expansibility. When updating data, the overhead is large, the update efficiency is low, and the search mode cannot be hidden.

[0095] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method of the present disclosure can be implemented by means of software plus necessary general hardware, and of course can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions performed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structures used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits, etc. However, for the present disclosure, software program implementation is a better implementation method in most cases.

[0096] Although the embodiments of the present invention are described above in conjunction with the accompanying drawings, the present invention is not limited to the above specific embodiments and application fields, and the above specific embodiments are only illustrative and instructive, rather than restrictive. A person of ordinary skill in the art can also make many forms under the guidance of this specification and without departing from the scope of protection of the claims of the present invention, all of which belong to the protection of the present invention.

Claims

1. A spatial data range query method based on a base tree, characterized in that: The method comprises the following steps: Generate query scope objectives for electronic documents; Encrypt the query range target, generate and submit a trapdoor for the query request to the cloud storage server; Based on the trapdoor, all ciphertexts are obtained through collaboration between a cloud storage server and a cloud key management server, and the cloud storage server sends the ciphertexts to the querying user, wherein: the cloud storage server stores the encrypted index tree and the ciphertexts of the encrypted electronic document, and the cloud key management server stores the key for decrypting the index tree; Receiving the ciphertext and decrypting it; The index tree is a base tree, which is generated based on the location of the electronic document, and the steps include: The position coordinates of the electronic document are represented by a binary vector, and the binary vector of each coordinate component is segmented, and the length of each segment is recorded as l, where l>0; For each coordinate component, the segmented binary vector is stored as an index in the blocks of each layer of the index tree in turn, where the block in the root node stores the highest l bits of the binary vector segment, and the block in the leaf node stores the lowest l bits of the binary vector segment. Each node in the tree contains at most 2 l Blocks, except for leaf nodes, each block stored in other nodes may have a child node; The index tree is updated by the following steps: The position of the new electronic file is represented by a binary vector, and the binary vector of each position component is divided into segments, and the length of each segment is recorded as l, l>0; For each segment of each position component, insert it layer by layer on the current index tree until it reaches the block in the leaf node; Or traverse the existing index tree, delete the file information layer by layer without deleting the block, until the corresponding block in the leaf node is found and delete the block; For the paths updated in the index tree, they are encrypted and sent to the cloud storage server for updating.

2. The method according to claim 1, characterized in that The cloud storage server cooperates with the cloud key management server to obtain all ciphertexts, including the following steps: After receiving the trapdoor, the cloud storage server compares the index with the trapdoor starting from the root node of the index tree, and sends the comparison result to the cloud key management server, which decrypts the index and returns the decrypted value to the cloud storage server, indicating whether the index is within the query range; If the index is the query boundary, continue to access the child nodes of the block corresponding to the index; if the index is within the query range, add the ciphertext on the block corresponding to the index to the query result set and access the next block; if the index is beyond the query range, continue to access the next block until all blocks stored in the root node are traversed, and the obtained ciphertext set is returned to the query user.

3. The method according to claim 1, characterized in that The ciphertext of the encrypted electronic document is obtained by encrypting the position of the electronic document using a symmetric encryption algorithm.

4. The method according to claim 3, characterized in that The symmetric encryption algorithm includes any one of an advanced encryption algorithm, a data encryption standard algorithm and an international data encryption algorithm.

5. The method according to claim 1, characterized in that The encrypted index tree or the query range target is encrypted using a public key encryption system key; The public key encryption system key is to randomly select two random numbers from the error distribution, one random number is used to calculate and generate a value of 1 modulo 2, which is used as the homomorphic encryption private key, and the other random number is used to form a homomorphic encryption public key with the secret key.

6. The method according to claim 5, characterized in that The binary vector is divided into d segments, d>0, each binary segment has a corresponding encryption public key and decryption key, and the encryption public key and decryption key corresponding to the same binary segment are the same.

7. A spatial data range query device based on a base tree, comprising a cloud storage server, a cloud key management server, and a client, characterized in that: The client: generates a query range target for the electronic document; encrypts the query range target, generates and submits a trapdoor for a query request to a cloud storage server; receives and decrypts the ciphertext corresponding to the query range target returned by the cloud storage server; The cloud storage server: calculates and compares the received trapdoors and the indexes in the encrypted index tree stored in the cloud storage server one by one, and cooperates with the cloud key management server to determine whether the index used for comparison is within the query range, thereby obtaining all ciphertexts that meet the query range and sending them to the client; The cloud key management server stores a key for decrypting the index tree, is used to decrypt the result of the cloud storage server's calculation and comparison, and returns the decryption result so that the cloud storage server can determine whether the index used for comparison is within the query range; The index tree is a base tree, which is generated based on the location of the electronic document, and the steps include: The position coordinates of the electronic document are represented by a binary vector, and the binary vector of each coordinate component is segmented, and the length of each segment is recorded as l, where l>0; For each coordinate component, the segmented binary vector is stored as an index in the blocks of each layer of the index tree in turn, where the block in the root node stores the highest l bits of the binary vector segment, and the block in the leaf node stores the lowest l bits of the binary vector segment. Each node in the tree contains at most 2 l Blocks, except for leaf nodes, each block stored in other nodes may have a child node; The index tree is updated by the following steps: The position of the new electronic file is represented by a binary vector, and the binary vector of each position component is divided into segments, and the length of each segment is recorded as l, l>0; For each segment of each position component, insert it layer by layer on the current index tree until it reaches the block in the leaf node; Or traverse the existing index tree, delete the file information layer by layer without deleting the block, until the corresponding block in the leaf node is found and delete the block; For the paths updated in the index tree, they are encrypted and sent to the cloud storage server for updating.

8. A computer readable storage device, characterized in that: The method comprises at least one storage medium storing a computer program capable of being loaded by a processor and executing the method according to any one of claims 1 to 6.

Images