A data hiding query method and device based on a trusted key-value pair in-memory database

Abstract

The present invention relates to the field of privacy computing technology, and provides a data hiding query method and device based on a trusted key-value pair in-memory database. The method of the present invention includes: the data party encrypts the plaintext data file to obtain an encrypted data file, and registers the encrypted data file; the data party decrypts the registered encrypted data file, generates Key-Value pair data and stores it in the key-value pair database; the query party writes the query condition into the query file, and encrypts the query file to obtain an encrypted query file; the query party queries the Key-Value pair data according to the encrypted query file to obtain a query result. According to the data hiding query method and device based on the trusted key-value pair in-memory database of the exemplary embodiment of the present invention, the privacy of the data party and the hiding property of the query party can be guaranteed, the file IO overhead can be significantly reduced, and the query efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy computing, and particularly to a data hiding query method and device based on a trusted key-value pair in-memory database. Background Art

[0002] Traditional intersection queries of multi-party data are performed on the basis of plaintext. When the data sets involved in the intersection and the query conditions are sensitive information, it is easy to expose information outside the intersection of the data parties and the query conditions of the query party.

[0003] Hidden intersection query is an important way to prevent privacy leakage. As the name implies, in the process of hidden intersection query, the original data of the data party is invisible, and the query party cannot obtain records outside the authorization of the data party; moreover, the query records of the query party are hidden, and the data party does not know which data the query party has queried. The query party sends the id to be queried to the data party, and through intersection, the data party returns the corresponding information of the id to the query party. If not found, an empty value is returned. In the whole process, the query party cannot know the data outside the query id, and the data party also cannot know which id the query party has queried.

[0004] Existing hidden intersection queries are mainly implemented based on cryptography techniques. The Chinese patent with the publication number CN114091054A proposes a two-way hidden data query method, which uses multiple encryptions to ensure the concealment of two-way data; the Chinese patent with the publication number CN113987582A proposes a hidden query method based on the RSA algorithm, which uses asymmetric key encryption and implements it through exclusive OR operations. The Chinese patent with the publication number CN112367170A discloses a data hiding query and secure sharing system based on multi-party secure computing, etc., which ensures the information security sharing that the user identity information cannot be decrypted by other third parties and the core data of the institution does not leave the library through key dynamic double encryption technology and secret sharing algorithm.

[0005] Although the above methods can ensure the concealment of the query, there are still the following defects in practical applications: 1. Every time a query request is initiated, the data party and the query party have to re-negotiate the key; 2. The use of complex cryptography techniques brings a large delay, resulting in a reduction in query efficiency.

[0006] Therefore, how to improve the efficiency and real-time performance of hidden intersection queries while realizing the query of hidden data has become an urgent technical problem to be solved. Summary of the Invention

[0007] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a stealth query method based on a trusted key-value pair in-memory database, implementing a key-value pair in-memory database inside the TEE for persistent storage of data to be queried. This key-value pair database is similar to Redis and LevelDB databases, which can reduce file I / O overhead while improving the efficiency of encrypted queries.

[0008] On the one hand, the present invention provides a data stealth query method based on a trusted key-value pair in-memory database, including:

[0009] Step S1: The data provider encrypts the plaintext data file to obtain an encrypted data file and registers the encrypted data file.

[0010] Step S2: The data provider decrypts the registered encrypted data file, generates Key-Value pair data, and stores it in the key-value pair database.

[0011] Step S3: The querying party writes the query condition into a query file and encrypts the query file to obtain an encrypted query file.

[0012] Step S4: The querying party queries the Key-Value pair data based on the encrypted query file to obtain a query result.

[0013] Furthermore, in the data stealth query method based on a trusted key-value pair in-memory database of the present invention, step S1 includes:

[0014] The data provider exports the plaintext data file from the data provider database through the data preprocessing API.

[0015] Apply to the key management program through the data preprocessing API for an encryption key to encrypt the plaintext data file to obtain an encrypted data file, and send the encrypted data file to the data registration program.

[0016] Furthermore, in the data stealth query method based on a trusted key-value pair in-memory database of the present invention, the encrypted data file in step S1 includes the data provider username, the encrypted data file path, and the key-value field.

[0017] Furthermore, in the data stealth query method based on a trusted key-value pair in-memory database of the present invention, step S2 includes:

[0018] The data provider obtains the decryption key from the key management program through the data registration program, and decrypts the encrypted data file with the obtained decryption key to obtain the plaintext data file.

[0019] Read the plaintext data file through the data registration program, use the first column of each row of data in the plaintext data file as the Key and the other columns as the Value to obtain a set of Key-Value pairs;

[0020] Create an in-memory table through the database engine, insert the Key-Value pairs into the in-memory table, and store the in-memory table in the key-value pair database.

[0021] Further, in the data concealment query method based on the trusted key-value pair in-memory database of the present invention, step S3 includes: The query party writes the query item corresponding to the Key field to be queried into the query file, applies for an encryption key pair to the key management program through the concealment query API to encrypt the query file, obtains the encrypted query file, and sends the encrypted query file to the data query program.

[0022] Further, in the data concealment query method based on the trusted key-value pair in-memory database of the present invention, in step S3, the encrypted query file includes the query party's username and the encrypted query file path.

[0023] Further, in the data concealment query method based on the trusted key-value pair in-memory database of the present invention, step S4 includes:

[0024] The query party obtains the decryption key from the key management program through the data query program, decrypts the encrypted query file with the obtained decryption key to obtain the query item;

[0025] Traverse the data row by row according to the query item through the data query program to obtain the Key field to be matched in each row;

[0026] Read the in-memory table data carrying the Key-Value pairs from the key-value pair database through the database engine, query whether there is a record of the Key field to be matched in the read in-memory table data carrying the Key-Value pairs. If it exists, obtain the Value corresponding to the Key field record;

[0027] After the traversal is completed, return the obtained Value record as the query result to the query party, and delete the query file and the query result through the data query program.

[0028] On the other hand, the present invention provides a data concealment query device based on a trusted key-value pair in-memory database, including:

[0029] The data provider system is set in the area outside the TEE domain and includes a data provider client and a data provider database. Among them, the data provider client includes a data preprocessing API, which is used to export a plaintext data file from the data provider database, apply for an encryption key pair from the key management program to encrypt the plaintext data file, obtain an encrypted data file, and send the encrypted data file to the data registration program; the data provider database is used to store the plaintext data file of the data provider.

[0030] The trusted privacy query system is set in the area within the TEE domain and includes a trusted application module and a trusted storage module, which are used to return a query result to the query party according to the query conditions of the query party.

[0031] The query party system is set in the area outside the TEE domain and includes a query party client, which includes a privacy query API, which is used to apply for an encryption key pair from the key management program to encrypt the query file, obtain an encrypted query file, and send the encrypted query file to the data query program.

[0032] Furthermore, in the data privacy query device based on the trusted key-value pair in-memory database of the present invention, the trusted application module includes a key management program, a data registration program, and a data query program. Among them, the key management program is used to provide an encryption key for encrypting the plaintext data file for the data preprocessing API, provide a decryption key for decrypting the encrypted data file for the data registration program, provide an encryption key for encrypting the query file for the privacy query API, and provide a decryption key for decrypting the encrypted query file for the data query program; the data registration program is used to receive the encrypted data file sent by the data preprocessing API, obtain the decryption key from the key management program, decrypt the encrypted data file with the obtained decryption key, obtain the plaintext data file, read the plaintext data file, use the first column of each row of data in the plaintext data file as the Key, and the other columns as the Value to obtain a set of Key-Value pairs; the data query program is used to receive the encrypted query file sent by the privacy query API, obtain the decryption key from the key management program, decrypt the encrypted query file with the obtained decryption key to obtain the query item, traverse the data row by row according to the query item, obtain the Key field to be matched in each row, query whether there is a record of the Key field to be matched in the in-memory table data read by the database engine carrying the Key-Value pairs. If it exists, obtain the Value corresponding to the Key field record; after the traversal is completed, return the obtained Value record as the query result to the query party, and delete the query file and the query result.

[0033] On the other hand, in the data concealment query device based on the trusted key-value pair in-memory database of the present invention, the trusted storage module includes a database engine and a key-value pair database. Among them, the database engine is used to create an in-memory table, insert Key-Value pairs into the in-memory table, store the in-memory table into the key-value pair database, and read the in-memory table data carrying Key-Value pairs from the key-value pair database; the key-value pair database is used to store Key-Value pair data.

[0034] The data concealment query method and device based on the trusted key-value pair in-memory database of the present invention have the following beneficial effects:

[0035] 1. Store and transmit the data of the data party in ciphertext form, send the query conditions of the query party in ciphertext form, and the entire query process is executed inside an independent TEE, ensuring the privacy of the data party and the concealment of the query party.

[0036] 2. By adding a key-value pair database management system, reusable data can be resident in memory; use the fields to be intersected as the mapping keys in the key-value pairs. For the query conditions of the query party, the intersection of the two parties' data can be quickly found only through key matching, significantly reducing the file IO overhead and improving the query efficiency. Description of the Drawings

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required to be used in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0038] Figure 1 It is a flowchart of a data concealment query method based on a trusted key-value pair in-memory database according to an exemplary first embodiment of the present invention.

[0039] Figure 2 It is a flowchart of a data concealment query method based on a trusted key-value pair in-memory database according to an exemplary second embodiment of the present invention.

[0040] Figure 3 It is a flowchart of a data concealment query method based on a trusted key-value pair in-memory database according to an exemplary third embodiment of the present invention.

[0041] Figure 4 It is an architecture diagram of a data concealment query device based on a trusted key-value pair in-memory database according to an exemplary fourth embodiment of the present invention. Detailed Embodiments

[0042] The embodiments of the present invention will be described in detail below with reference to the drawings.

[0043] It should be noted that, without conflict, the following embodiments and the features in the embodiments may be combined with each other; and, based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present disclosure.

[0044] It should be noted that the following describes various aspects of embodiments within the scope of the appended claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is illustrative only. Based on the present disclosure, those skilled in the art should understand that one aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement an apparatus and / or practice a method. Additionally, this apparatus and / or method may be implemented using other structures and / or functionality in addition to one or more of the aspects described herein.

[0045] The technical principle of the present invention is as follows:

[0046] The present invention is implemented based on a Trusted Execution Environment (TEE). The trusted computing environment provides a trusted environment for privacy-preserving computations by untrusted parties. This trusted environment separately creates a secure area in the computer memory to store the plaintext data of each party and perform intersection query operations. TEE provides a feasible technical solution for data hiding queries. However, when a certain party's data needs to be frequently utilized, the TEE node program needs to repeatedly read the corresponding encrypted data file, resulting in frequent file I / O operations, which in turn affects the efficiency of the TEE program.

[0047] Taking private set intersection as an example, assume that three parties B, C, and D need to perform intersections with party A's data using their own data respectively. In the traditional method, for the intersections between A and B, A and C, and A and D, the data file of party A needs to be decrypted and read three times, seriously affecting the operation efficiency of the intersection. Taking Intel SGX as an example, each party that needs to perform an intersection first selects a certain TEE node and conducts a trusted authentication; then the data provider applies for a data encryption key from the TEE node to encrypt their respective data files and registers the encrypted file paths to this TEE node; at the same time, the task initiator submits the trusted intersection program to the TEE internal executor. The TEE node generates an isolated enclave in the memory, first finds the encrypted data file according to the registered information, then decrypts and reads the file and loads it into the enclave memory, and finally performs relevant operations on the data of each party.

[0048] In view of the deficiency that the existing (Intel SGX-based) TEE multi-party private query has duplicate reads of the same data files by the data parties, the present invention provides a private query method based on a trusted key-value pair in-memory database, that is, implementing a key-value pair in-memory database inside the TEE for persistent storage of the data to be queried (this key-value pair database is similar to Redis and LevelDB databases), which can not only reduce the overhead of file I / O but also improve the query efficiency.

[0049] The name explanations involved in the following embodiments are as follows:

[0050] Data query: It includes a query party and at least one data party. It means that the query party gives one or more IDs to be matched and multiple query fields, calculates the intersection of the data party datasets according to the common ID of all parties first, and then obtains the query field information in the matching items.

[0051] Key-value database: A non-relational database that stores data as a collection of key-value pairs, where the key is used as the unique identifier. The key-value pair database has the advantages of simple operation and strong scalability. Commonly used key-value pair in-memory databases are Redis and LevelDB.

[0052] Figure 1 As shown in the flowchart of a data private query method based on a trusted key-value pair in-memory database according to an exemplary first embodiment of the present invention, Figure 1 as shown, the method of this embodiment includes:

[0053] Step S1: The data party encrypts the plaintext data file to obtain an encrypted data file and registers the encrypted data file.

[0054] Step S2: The data party decrypts the registered encrypted data file, generates key-value pair data, and stores it in the key-value pair database.

[0055] Step S3: The query party writes the query conditions into a query file and encrypts the query file to obtain an encrypted query file.

[0056] Step S4: The query party queries the key-value pair data according to the encrypted query file to obtain the query result.

[0057] In practical applications, the method of this embodiment stores and transmits the data of the data party in a ciphertext form, sends the query conditions of the query party in a ciphertext form, and the entire query process is executed inside an independent TEE, thereby ensuring the privacy of the data party and the anonymity of the query party.

[0058] Figure 2Flowchart of a data hiding query method based on a trusted key - value pair in - memory database according to an exemplary second embodiment of the present invention. This embodiment is Figure 1 A preferred embodiment of the method shown.

[0059] As Figure 2 shown, in this embodiment, step S1 includes:

[0060] The data provider exports the plain - text data file from the data provider database through the data pre - processing API;

[0061] Apply to the key management program through the data pre - processing API for an encryption key to encrypt the plain - text data file, obtain the encrypted data file, and send the encrypted data file to the data registration program. Among them, the encrypted data file includes the data provider user name, the encrypted data file path, and the key - value field.

[0062] As Figure 2 shown, in this embodiment, step S2 includes:

[0063] The data provider obtains the decryption key from the key management program through the data registration program, and decrypts the encrypted data file with the obtained decryption key to obtain the plain - text data file;

[0064] Read the plain - text data file through the data registration program, take the first column of each row of the data in the plain - text data file as the Key, and the other columns as the Value, to obtain a set of Key - Value pairs; for example, the plain - text data file A is shown in Table 1 below:

[0065] Table 1

[0066]

[0067] For the plain - text data file A, an example of a set of extracted Key - Value pairs is: {<A11,[A12,A13]>,<A21,[A22,A23]>……}.

[0068] Create an in - memory table through the database engine, insert the Key - Value pairs into the in - memory table, and store the in - memory table in the key - value pair database.

[0069] Figure 3 Flowchart of a data hiding query method based on a trusted key - value pair in - memory database according to an exemplary third embodiment of the present invention. This embodiment is Figure 1 A preferred embodiment of the method shown.

[0070] As Figure 3 shown, step S3 of the method in this embodiment includes:

[0071] The querying party writes the query items corresponding to the Key fields to be queried into a query file, applies for an encryption key pair from the key management program through the stealth query API to encrypt the query file, obtains the encrypted query file, and sends the encrypted query file to the data query program. The encrypted query file includes the querying party's username and the encrypted query file path.

[0072] As Figure 3 shown, step S4 of the method in this embodiment includes:

[0073] The querying party obtains the decryption key from the key management program through the data query program, and decrypts the encrypted query file with the obtained decryption key to obtain the query items;

[0074] The data query program traverses the data row by row according to the query items to obtain the Key fields to be matched in each row;

[0075] The database engine reads the in-memory table data carrying Key-Value pairs from the key-value pair database, and queries whether there is a record of the Key field to be matched in the read in-memory table data carrying Key-Value pairs. If so, it obtains the Value corresponding to the Key field record;

[0076] After the traversal ends, the obtained Value records are returned to the querying party as the query results.

[0077] Step S4 of the method in this embodiment further includes: after the data party obtains the query results, the data query program deletes the query file and the query results.

[0078] By adding a key-value pair database management system in this embodiment, reusable data can be resident in memory; the fields to be intersected are used as the mapping keys in the key-value pairs. For the query conditions of the querying party, the intersection of the two parties' data can be quickly found only through key matching, significantly reducing the file I / O overhead and improving the query efficiency.

[0079] Figure 4 As the architecture diagram of a data stealth query device based on a trusted key-value pair in-memory database according to the exemplary fourth embodiment of the present invention, as Figure 4 shown, the device in this embodiment includes:

[0080] The data party system, which is set in the area outside the TEE, includes a data party client and a data party database. The data party client includes a data preprocessing API, which is used to export the plaintext data file from the data party database, apply for an encryption key pair from the key management program to encrypt the plaintext data file, obtain the encrypted data file, and send the encrypted data file to the data registration program; the data party database is used to store the plaintext data file of the data party;

[0081] A trusted concealment query system, which is set in the TEE domain area and includes a trusted application module and a trusted storage module, is used to return a query result to the querying party according to the query conditions of the querying party.

[0082] The querying party system, which is set in the area outside the TEE domain and includes a querying party client, includes a concealment query API, is used to apply for an encryption key pair from the key management program to encrypt the query file, obtain the encrypted query file, and send the encrypted query file to the data query program.

[0083] In the device of this embodiment, the trusted application module includes a key management program, a data registration program, and a data query program. Among them, the key management program is used to provide an encryption key for encrypting the plaintext data file to the data preprocessing API, provide a decryption key for decrypting the encrypted data file to the data registration program, provide an encryption key for encrypting the query file to the concealment query API, and provide a decryption key for decrypting the encrypted query file to the data query program; the data registration program is used to receive the encrypted data file sent by the data preprocessing API, obtain the decryption key from the key management program, decrypt the encrypted data file using the obtained decryption key to obtain the plaintext data file, read the plaintext data file, use the first column of each row of data in the plaintext data file as the Key and the other columns as the Value to obtain a set of Key-Value pairs; the data query program is used to receive the encrypted query file sent by the concealment query API, obtain the decryption key from the key management program, decrypt the encrypted query file using the obtained decryption key to obtain the query item, traverse the data row by row according to the query item, obtain the Key field to be matched in each row, query whether there is a record of the Key field to be matched in the in-memory table data read by the database engine that carries the Key-Value pairs. If it exists, obtain the Value corresponding to the Key field record; after the traversal is completed, return the obtained Value record as the query result to the querying party; after the data party obtains the query result, delete the query file and the query result.

[0084] In the device of this embodiment, the trusted storage module includes a database engine and a key-value pair database. Among them, the database engine is used to create an in-memory table, insert the Key-Value pairs into the in-memory table, store the in-memory table in the key-value pair database, and read the in-memory table data carrying the Key-Value pairs from the key-value pair database; the key-value pair database is used to store the Key-Value pair data.

[0085] In this embodiment, the file data and query conditions in the area outside the TEE are encrypted before leaving the client, and the communication between the two areas is implemented based on the TLS protocol to ensure the security of the data itself and the transmission. In addition, the same data of the data provider only needs to be registered once and is permanently stored in the trusted key-value pair in-memory database, reducing the encryption calculation overhead; and the data query program is also executed in memory, greatly improving the efficiency.

[0086] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A data hiding query method based on a trusted key-value pair in-memory database, characterized in that, the method includes: Step S1: The data party encrypts the plaintext data file to obtain an encrypted data file, and registers the encrypted data file; Step S2: The data party decrypts the registered encrypted data file, generates Key-Value pair data, and stores it in the key-value pair database; Step S3: The query party writes the query condition into the query file, and encrypts the query file to obtain an encrypted query file; Step S4: The query party queries the Key-Value pair data according to the encrypted query file to obtain a query result; Step S1 includes: The data party exports the plaintext data file from the data party database through the data preprocessing API; Apply for an encryption key pair from the key management program through the data preprocessing API to encrypt the plaintext data file to obtain an encrypted data file, and send the encrypted data file to the data registration program; Step S2 includes: The data party obtains the decryption key from the key management program through the data registration program, and decrypts the encrypted data file with the obtained decryption key to obtain the plaintext data file; Read the plaintext data file through the data registration program, use the first column of each row of the data in the plaintext data file as the Key, and the other columns as the Value to obtain a set of Key-Value pairs; Create an in-memory table through the database engine, insert the Key-Value pairs into the in-memory table, and store the in-memory table in the key-value pair database; Step S4 includes: The query party obtains the decryption key from the key management program through the data query program, and decrypts the encrypted query file with the obtained decryption key to obtain the query item; Traverse the data row by row according to the query item through the data query program to obtain the Key field to be matched in each row; Read the in-memory table data carrying the Key-Value pairs from the key-value pair database through the database engine, query whether there is a record of the Key field to be matched in the read in-memory table data carrying the Key-Value pairs. If it exists, obtain the Value corresponding to the record of the Key field to be matched; After the traversal is completed, return the obtained Value record as the query result to the query party, and delete the query file and the query result through the data query program.

2. The data hiding query method based on a trusted key-value pair in-memory database according to claim 1, characterized in that, The encrypted data file in Step S1 includes the data party user name, the encrypted data file path, and the key value field.

3. The data hiding query method based on a trusted key-value pair in-memory database according to claim 1, characterized in that, Step S3 includes: The query party writes the query item corresponding to the Key field to be queried into the query file, applies for an encryption key from the key management program through the hidden query API to encrypt the query file to obtain an encrypted query file, and sends the encrypted query file to the data query program.

4. The data hiding query method based on a trusted key-value pair in-memory database according to claim 1, characterized in that, In step S3, the encrypted query file includes the querying party's user name and the encrypted query file path.

5. A data hiding query device based on a trusted key-value pair in-memory database, characterized in that the device includes: The data provider system, which is set in the area outside the TEE domain, includes a data provider client and a data provider database. Among them, the data provider client includes a data preprocessing API, which is used to export the plaintext data file from the data provider database, apply for an encryption key pair from the key management program to encrypt the plaintext data file to obtain an encrypted data file, and send the encrypted data file to the data registration program; the data provider database is used to store the plaintext data file of the data provider. The trusted hiding query system, which is set in the area inside the TEE domain, includes a trusted application module and a trusted storage module, and is used to return a query result to the querying party according to the query conditions of the querying party. The querying party system, which is set in the area outside the TEE domain, includes a querying party client, which includes a hiding query API, which is used to apply for an encryption key pair from the key management program to encrypt the query file to obtain an encrypted query file, and send the encrypted query file to the data query program. The trusted application module includes a key management program, a data registration program, and a data query program. Among them, the key management program is used to provide an encryption key for encrypting the plaintext data file for the data preprocessing API, provide a decryption key for decrypting the encrypted data file for the data registration program, provide an encryption key for encrypting the query file for the hiding query API, and provide a decryption key for decrypting the encrypted query file for the data query program; the data registration program is used to receive the encrypted data file sent by the data preprocessing API, obtain the decryption key from the key management program, decrypt the encrypted data file with the obtained decryption key to obtain the plaintext data file, read the plaintext data file, use the first column of each row of data in the plaintext data file as the Key, and the other columns as the Value to obtain a set of Key-Value pairs; the data query program is used to receive the encrypted query file sent by the hiding query API, obtain the decryption key from the key management program, decrypt the encrypted query file with the obtained decryption key to obtain the query item, traverse the data row by row according to the query item, obtain the Key field to be matched in each row, query whether there is a record of the Key field to be matched in the in-memory table data read by the database engine that carries the Key-Value pair. If it exists, obtain the Value corresponding to the record of the Key field to be matched; after the traversal is completed, return the obtained Value record as the query result to the querying party, and delete the query file and the query result. The trusted storage module includes a database engine and a key-value pair database. Among them, the database engine is used to create an in-memory table, insert the Key-Value pair into the in-memory table, store the in-memory table in the key-value pair database, and read the in-memory table data carrying the Key-Value pair from the key-value pair database; the key-value pair database is used to store the Key-Value pair data.

Images