Method for optimizing connection query of encrypted database in hash-based trusted execution environment

Abstract

The application discloses a kind of based on hash-based trusted execution environment under encrypted database connection query optimization method, comprising: data provider selects security level for the encrypted data in each row in data table, determines the hash value of the encrypted data of this row according to security level;From key manager, obtain preset key, and determine the ciphertext of the encrypted data of this row, store ciphertext, security level and hash value to data table after storing data table to database, save the key and the row and data table mapping relationship to key manager;Server agent determines the hash value of the data to be queried according to the security level after querying from database according to query request;According to the hash value, the corresponding data table is inquired, and the query result is obtained;Trusted execution environment component obtains key based on the ciphertext in query result, and obtains target information according to the obtained key, ciphertext and data to be queried;Server agent sends the data corresponding to target information in query result to client.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, specifically relating to an optimization method for encrypted database connection queries in a hash-based trusted execution environment. Background Technology

[0002] With the development of cloud computing, more and more small and medium-sized enterprises are choosing to use cloud databases to reduce equipment and maintenance costs. However, due to the open deployment environment and complex network topology, cloud databases face more severe and complex attack scenarios compared to traditional databases. For security protection during data storage and transmission, many industry-recognized domestic and international security standards and algorithms have been developed, such as AES, Chinese national cryptographic standards, and TLS. The use of these technologies can greatly reduce the risks associated with data during static storage and transmission.

[0003] However, significant limitations remain in protecting data during runtime. Currently, related technologies include cryptography-based solutions and trusted execution environment-based solutions. For encrypted databases implemented using pure cryptography, such as CryptDB, the problems vary depending on the strength of the encryption algorithm. For example, when using deterministic encryption algorithms, plaintext and ciphertext data are in one-to-one correspondence, posing a risk of data access pattern leakage and data frequency information leakage. Random encryption algorithms do not support any computation on the ciphertext and cannot provide ciphertext data retrieval functionality. Attribute protection algorithms and fully homomorphic encryption algorithms can support certain computations on the ciphertext, but they also suffer from limited supported operators and excessive computational overhead. For encrypted databases implemented based on trusted execution environments, the two different implementation methods each have their own drawbacks. For example, the secure database system-based approach, such as EnclaveDB, requires migrating the entire trusted part of the database kernel to the trusted execution environment, which involves a huge amount of engineering work. The trusted computing base is also very large, making it vulnerable to more attacks. At the same time, the Enclave's memory space is limited, making it unusable in big data scenarios. On the other hand, the secure computing approach based on Enclaves, such as AzureDB, has no memory space limitations, and the amount of trusted function code in the Enclave is relatively small. However, it requires multiple interactions with the Enclave when executing SQL queries, resulting in significant context switching and data fan-in / fan-out overhead.

[0004] Clearly, all of the above solutions suffer from poor performance. Furthermore, for more complex queries, trusted execution environments incur data copying overhead, while pure encryption algorithms incur data encryption and decryption overhead. In other words, encrypted database query solutions in related technologies face the dilemma of having to choose between security and query performance. Summary of the Invention

[0005] To address the aforementioned problems in related technologies, this invention provides a hash-based method for optimizing encrypted database connection queries in a trusted execution environment. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] This invention provides a hash-based method for optimizing encrypted database connection queries in a trusted execution environment, comprising:

[0007] The data provider selects a security level from multiple preset security levels for the data to be encrypted in each row of the data table, and determines the hash value of the data to be encrypted in that row based on the security level and the entry information of the data table; the security of the multiple preset security levels increases progressively, and the hash space of the multiple hash values ​​determined based on the multiple preset security levels decreases progressively.

[0008] The data provider obtains a preset key from the key manager and encrypts the data to be encrypted in the row to obtain ciphertext. The ciphertext, the security level, and the hash value are stored in the row to obtain an encrypted data table. The information of the data table, the encrypted data table, the name of the row, the ciphertext, the security level, and the hash value are stored in the database. The mapping relationship between the key, the row, and the data table is saved in the key manager.

[0009] The client sends a query request to the server proxy containing the name of the data table to be queried, the name of the row to be queried, and the data to be queried;

[0010] The server proxy retrieves the security level and entry information from the database based on the query request, and determines the hash value of the data to be queried based on the retrieved security level and entry information;

[0011] The server proxy performs a query based on the hash value of the data to be queried and the data table to be queried, and sends the query ciphertext and attribute information of the query ciphertext in the obtained query result to the trusted execution environment component.

[0012] The trusted execution environment component obtains a key from the key manager based on the attribute information, and obtains target information and sends it to the server proxy based on the obtained key, the query ciphertext and the data to be queried.

[0013] The server proxy sends the data corresponding to the target information in the query results to the client.

[0014] The present invention has the following beneficial technical effects:

[0015] The query optimization method provided by this invention can dynamically control the system's emphasis on security and performance by adjusting the hash space (length) of the data hash value during database operation. This adapts to the security and retrieval performance requirements of encrypted data with different sensitivity levels. Furthermore, by attaching a corresponding hash value to the encrypted data based on a hash algorithm, and performing a preliminary retrieval of the encrypted data using the hash value, the method achieves the effect of hiding data access patterns by utilizing hash collisions. Subsequently, a precise retrieval is performed through a trusted execution environment, filtering out false positive query results obtained from server proxies. This ensures that the data is secure during decryption processing while simultaneously balancing security and query performance.

[0016] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] Figure 1 An optional flowchart for an optimized method of encrypted database connection query in a hash-based trusted execution environment provided by an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of a framework for an exemplary hash-based trusted execution environment cryptographic database connection query system provided in an embodiment of the present invention;

[0019] Figure 3 This is another schematic diagram of an exemplary cryptographic database connection query system in a hash-based trusted execution environment provided for embodiments of the present invention. Detailed Implementation

[0020] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0021] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0022] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0023] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, disclosure, and appended claims in carrying out the claimed invention. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0024] Figure 1 This is an optional flowchart of an encrypted database connection query optimization method based on hash in a trusted execution environment provided in this embodiment of the invention.

[0025] In some embodiments, the hash-based encrypted database connection query optimization method provided by the present invention can be applied to, for example... Figure 2 The illustrated system is an optimized system for encrypted database connection queries within a hash-based trusted execution environment. Figure 2 As shown, the system may include a server, a key manager, a client, and a data provider. Figure 2 (Not shown in the image); the server side includes a server proxy, a database, and a trusted execution environment (Enclave) component. The key manager can be, for example,... Figure 2 The third-party devices or platforms shown can also be included on the server side. The Trusted Execution Environment component can be Intel SGX. For example... Figure 1 As shown, the above method includes the following steps:

[0026] S101. The data provider selects a security level from multiple preset security levels for the data to be encrypted in each row of the data table, and determines the hash value of the data to be encrypted in that row based on the security level and the entry information of the data table. The security of the multiple preset security levels increases progressively, and the hash space of the multiple hash values ​​determined based on the multiple preset security levels decreases progressively.

[0027] In this embodiment of the invention, the data provided by the data provider can be stored in the form of a data table, which includes multiple rows and multiple columns of data. The entry information of each data table is the number of rows in that data table. For example, when a data table has 3 rows, the entry information of that data table is 3.

[0028] In some embodiments, the hash space of a hash value is inversely proportional to the number of rows in the data table, when

[0029] In some embodiments, each security level corresponds to a calculation method, and different security levels correspond to different calculation methods. For the data to be encrypted in a specific row of a data table, after selecting a security level, a hash algorithm can be used to perform a hash operation on the data to be encrypted in that row to obtain an initial hash value. Based on the selected security level, a calculation method is determined. Using this determined calculation method, the initial hash value and the number of rows in the data table are calculated to obtain the hash value of the data to be encrypted in that row. For example, a CRC checksum algorithm can be used to calculate the initial hash value.

[0030] In some embodiments, when the data to be encrypted in each row of a data table is stored in the same column, a security level can be selected for that column, so that the security level of the data to be encrypted in each row of the data table is the same.

[0031] In some embodiments, the plurality of preset security levels include at least: a first security level, a second security level, a third security level, a fourth security level, and a fifth security level; the security of the first security level to the fifth security level increases progressively, and the hash space of the hash value corresponding to the first security level to the fifth security level decreases progressively; wherein, the hash space of the hash value corresponding to the second security level, the third security level, and the fourth security level is inversely proportional to the number of rows in the data table.

[0032] For example, with five preset security levels, as the security level increases, the security protection strength of the ciphertext will increase, while the query efficiency will decrease. Data providers can set appropriate security levels for their data based on their own requirements for ciphertext sensitivity. For instance, for a data table with n entries, the initial hash value and hash value calculation method corresponding to each of the five preset security levels for each row are shown in Table 1:

[0033] Security Level Initial hash value Hash value calculation method 1 c Hash(c) 2 c Hash(c)%(n / 4) 3 c Hash(c)%(n / 16) 4 c Hash(c)%(n / 64) 5 c 0

[0034] Table 1

[0035] As shown in Table 1, at security level 1, the calculated initial hash value c is not modulo n, resulting in the lowest security level. The hash collision rate at this level depends on the hash algorithm. When an attacker steals data from the database, they can use the hash value to calculate the data frequency. This is suitable for encrypted data with insensitive access frequency. At security levels 2, 3, and 4, the hash collision rate is increased by reducing the hash value mapping space (hash space), thus accelerating search efficiency while ensuring that the data frequency is not leaked. This is suitable for encrypted data that requires protection of data access frequency. Users can choose different security levels based on the data sensitivity. Furthermore, at security levels 2, 3, and 4, the hash space size is proportional to n, ensuring the stability of the number of calls to the Enclave function, thereby guaranteeing the stability of data retrieval efficiency. Even if the data in the database is large, it will only lead to a decrease in the efficiency of the database engine's data retrieval, while the performance overhead of the trusted execution environment component remains stable. At security level 5, all hash values ​​are mapped to 0. At this level, the trusted execution environment component will be used entirely for data decryption and retrieval, making it suitable for the most sensitive encrypted data.

[0036] S102. The data provider obtains a preset key from the key manager and encrypts the data to be encrypted in the row to obtain ciphertext. The ciphertext, security level, and hash value are stored in the row to obtain an encrypted data table. The information of the data table, the encrypted data table, the name of the row, the ciphertext, the security level, and the hash value are stored in the database. The mapping relationship between the key and the row and the data table is saved to the key manager.

[0037] In this embodiment of the invention, the information of the data table may include the name of the data table and entry information.

[0038] In this embodiment of the invention, when a certain data in a certain row of a certain data table needs to be encrypted, the data provider can send a command to the key manager to instruct the key manager to generate a preset key. Then, the data provider can use the key to encrypt the data in that row of the data table. After that, the mapping relationship between the preset key and the data table and the row is stored in the key manager.

[0039] In some embodiments, when the data to be encrypted in each row of a data table is stored in the same column, the key manager can generate a preset key for that column, and then the preset key can be used to encrypt the data to be encrypted in each row of the data table.

[0040] In this embodiment of the invention, after generating the ciphertext of the data to be encrypted for a certain row of a certain data table, the configuration information of that row can be stored in the database for easy subsequent querying. The configuration information includes: the name of the data table, the number of rows in the data table, the name of the row, the ciphertext, the security level, and the hash value.

[0041] For example, for data table 2, after generating the ciphertext "c1_cipher" of the data to be encrypted "c1" in rows 2 to 5 of data table 2, the resulting encrypted data table can be shown in Table 3:

[0042] c1 c2 c3 row0col1 row0col2 row0col3 row1col1 row1col2 row1col3 row2col1 row2col2 row2col3 row3col1 row3col2 row3col3 … … …

[0043] Table 2

[0044]

[0045]

[0046] Table 3

[0047] In Table 2, the ciphertext of the data to be encrypted in the second row, "row0col1", is "09d1...147d4". "row0col2" and "row0col3" are the plaintext data in the second row that do not require encryption. The ciphertext of the data to be encrypted in the third row, "row1col1", is "03ac...ae79a". The other rows follow the same principle. In Table 3, "c1_level" represents the security level, and "c1_hash" represents the hash value.

[0048] In some embodiments, when all data in a column of a data table needs to be encrypted, the data provider can determine the security level of the column, generate a key for the column from the key manager, and store the mapping relationship between the column and the key in the key manager.

[0049] S103. The client sends a query request to the server agent containing the name of the data table to be queried, the name of the row to be queried, and the data to be queried.

[0050] Here, the data to be queried can be plaintext data.

[0051] S104. The server agent retrieves the security level and entry information from the database based on the query request, and determines the hash value of the data to be queried based on the retrieved security level and entry information.

[0052] In this embodiment of the invention, the server proxy can find the security level and entry information corresponding to the data table name and the row name to be queried from the configuration information stored in the database based on the data table name and the row name to be queried in the query request. Then, it can use the calculation method corresponding to the queried security level to calculate the queried entry information and the data to be queried to obtain the hash value of the data to be queried.

[0053] S105. The server proxy performs a query based on the hash value of the data to be queried and the data table to be queried, and sends the query ciphertext and attribute information of the query ciphertext in the query result to the trusted execution environment component.

[0054] In this embodiment of the invention, the server agent can determine at least one set of data from the data table to be queried based on the hash value of the data to be queried and the hash value in the data table to be queried; obtain a set of intermediate data corresponding to each set of data, and use the obtained intermediate data as the query result; each set of intermediate data includes at least one ciphertext; use the ciphertext included in each set of intermediate data as the query ciphertext, and use the attribute information of each set of intermediate data as the attribute information of the included ciphertext; send the query ciphertext and the attribute information of the query ciphertext to the trusted execution environment component.

[0055] Here, the data table includes at least: a first data table and a second data table; the server agent can filter the rows containing hash values ​​that are the same as the hash values ​​of the data to be queried from the first data table and the second data table, and obtain at least one set of data based on the data of the filtered rows.

[0056] In some embodiments, each set of data can be obtained according to an adapted algorithm of the nested loop join algorithm. This algorithm performs a Cartesian join on the two tables to be joined. For each row in the first table and each row in the second table, their hash values ​​are compared. If the hash values ​​of a row in the first table and a row in the second table are the same, the data in that row are grouped and merged, and the merged data is added to the return value list as a single set. Using this algorithm, the time complexity is O(l*m), where m is the number of rows in the first and second tables.

[0057] In some embodiments, a sort-based join algorithm can also be used to obtain each set of data. This algorithm first re-sorts the rows in the first and second tables based on the hash value of the column to be searched. Then, it compares the i-th row of the first table and the i-th row of the second table in ascending order. If their hash values ​​are the same, the i-th row of table 1 and the j-th row of table 2 are merged. The merged data is then added to the return value list as a single set. Otherwise, the pointer to the row with the smaller hash value is moved one row to the right, and the loop continues. When both tables have n rows of data, the time complexity of the sorting phase is O(nlogn), and the time complexity of the join phase is O(n).

[0058] Specifically, when each set of data is obtained according to the sort-based join algorithm, the process of filtering rows containing hash values ​​that are the same as the hash values ​​of the data to be queried from the first and second data tables, and obtaining at least one set of data based on the data of the filtered rows, can be achieved through steps S1 to S5:

[0059] S1. Sort the rows in the first data table in descending order according to the hash values ​​of different rows to obtain the updated first data table.

[0060] For example, when Table 3 above is the first data table, after sorting it in descending order according to the hash value, the updated first data table is as shown in Table 4:

[0061] c1 c1_cipher c1_level c1_hash c2 c3 row3col1 06ds...dsafw 2 1 row3col2 row3col3 … … … … … … row0col1 09d1...147d4 2 2 row0col2 row0col3 … … … … … … row2col1 05as…awdfw 2 3 row2col2 row2col3 … … … … … … row1col1 03ac...ae79a 2 4 row1col2 row1col3 … … … … … …

[0062] Table 4

[0063] S2. Sort the rows in the second data table in descending order according to the hash values ​​of different rows to obtain the updated second data table.

[0064] S3. Compare the hash values ​​of the i-th row of the updated first data table and the i-th row of the updated second data table; i is an integer greater than 0 and less than or equal to N, and N is the number of rows in the updated first data table and the updated second data table.

[0065] S4. When the hash value of the i-th row of the updated first data table is the same as that of the i-th row of the updated second data table, the i-th row of the updated first data table and the i-th row of the updated second data table are treated as a set of data.

[0066] S5. When the hash value of the i-th row of the updated first data table is different from that of the i-th row of the updated second data table, compare the hash values ​​of the i-th row of the updated first data table with those of the (i+1)-th row of the updated second data table. When the hash values ​​of the i-th row of the updated first data table and the (i+1)-th row of the updated second data table are the same, combine the data from the i-th row of the updated first data table and the data from the (i+1)-th row of the updated second data table as a set of data.

[0067] S5. When the hash value of the i-th row of the updated first data table is different from that of the (i+1)-th row of the updated second data table, compare the hash values ​​of the i-th row of the updated first data table and the (i+2)-th row of the updated second data table, until all N rows of the updated first data table and the updated second data table have been traversed.

[0068] In some embodiments, each set of data can also be obtained using a hash-based join algorithm. This algorithm first constructs hash buckets for the second data table, each hash bucket containing at least one element, where each element is a row from the second data table. During the join, all rows in the first table are traversed, and based on the hash value of each row, a hash bucket in the second data table is selected for traversal. When a row in the first data table has the same hash value as a hash bucket, that row and each element in that hash bucket are categorized and merged, and the merged data is added as a group to the return value list. When the number of elements in the hash bucket with the most elements in the second data table 2 is n, the time complexity of this algorithm is O(l*M).

[0069] Specifically, when each set of data is obtained according to the hash-based join algorithm, the process of filtering rows containing hash values ​​that are the same as the hash values ​​of the data to be queried from the first and second data tables, and obtaining at least one set of data based on the data of the filtered rows, can be achieved through steps S11 to S14:

[0070] S11. Based on the second data table, determine at least one hash bucket; each hash bucket corresponds to at least one row and one hash value; each hash bucket contains at least one row of data from the second data table, and the hash values ​​in the at least one row of data are the same.

[0071] S12. Compare the hash value of the j-th row of the first data table with the hash value corresponding to the z-th hash bucket; j is an integer greater than 0 and less than or equal to N, N is the number of rows in the first data table, z is an integer greater than 0 and less than or equal to M, and M is the number of hash buckets.

[0072] S13. When the hash value of row j is the same as the hash value corresponding to hash bucket z, take the data of row j and the data of each row corresponding to hash bucket z as a group of data, and compare the hash value of row j with the hash value corresponding to hash bucket z+1; j is an integer greater than 0 and less than or equal to N.

[0073] S14. When the hash value of row j is different from the hash value corresponding to hash bucket z, compare the hash value of row j+1 of the first data table with the hash value corresponding to hash bucket z, until all N rows and M hash buckets of the first data table have been traversed.

[0074] In some embodiments, each set of data includes at least: a first target row of data consisting of x columns and a second target row of data consisting of y columns; where x and y are both integers greater than 0; then the first target row of data and the second target row of data can be merged to obtain a row of data consisting of x+yp columns, and this row of data can be used as a set of intermediate data, where p is an integer greater than 0, representing the number of columns with the same data in the x and y columns.

[0075] For example, when the first data table is Table 3 above, the second data table is Table 5 below, and the first target row data is the second row (6 columns) in Table 3, and the second target row data is the second row (5 columns) in Table 5, then a set of intermediate data (5 + 6 - 3 columns) is generated as shown in Table 6 below:

[0076] c1 c1_cipher c1_level c1_hash extra row0col1 0td1...1gdd4 2 2 extra1 row1col1 01gc...hrnaa 2 4 extra2 row2col1 asbs…aqsbw 2 3 extra3 row3col1 0yds...dwgdw 2 1 extra4 … … … … …

[0077] Table 5

[0078]

[0079] Table 6

[0080] In Table 5, the “extra” column represents the other plaintext data in each row.

[0081] S106. The Trusted Execution Environment component obtains the key from the key manager based on the attribute information, and obtains the target information and sends it to the server agent based on the obtained key, the query ciphertext and the data to be queried.

[0082] In this embodiment of the invention, the server proxy uses the ciphertext included in each set of intermediate data as query ciphertext and sends at least one set of query ciphertext to the trusted execution environment component. Each set of query ciphertext contains at least two query ciphertexts, and the attribute information of each set of query ciphertexts includes: the row name and the data table name corresponding to each query ciphertext. For any set of query ciphertexts, the trusted execution environment component obtains the key corresponding to the data table name and the row name from the key manager based on the data table name and row name corresponding to each query ciphertext in that set of query ciphertexts. The obtained key is used to decrypt the query ciphertext, thereby obtaining at least two decryption results for that set of query ciphertexts. When the obtained at least two decryption results are consistent with the data to be queried, the attribute information corresponding to that set of query ciphertexts is sent to the server proxy as target information.

[0083] For example, when the data to be queried is "row0col1", and the server agent sends a set of query ciphertext to the Trusted Execution Environment (TEE) component as "09d1...147d4" and "0td1...1gdd4" from Table 6 above, and the attribute information of "09d1...147d4" is in the second row of Table 3, and the attribute information of "0td1...1gdd4" is in the second row of Table 5, the TEE component, based on the attribute information of "09d1...147d4", obtains the key corresponding to "09d1...147d4" from the key manager, and uses the obtained key. Decrypt “09d1...147d4” to obtain “row0col1”. Also, based on the attribute information of “0td1...1gdd4”, obtain the key corresponding to “0td1...1gdd4” from the key manager, and use the obtained key to decrypt “0td1...1gdd4” to obtain “row0col1”. Since both decryption results are completely consistent with the data to be queried, the attribute information of “09d1...147d4” and “0td1...1gdd4” are both sent to the server proxy as target information.

[0084] S107. The server proxy sends the data corresponding to the target information in the query results to the client.

[0085] In this embodiment of the invention, the server proxy sends the plaintext data in the row indicated by the target information in the query results to the client.

[0086] For example, when the target information is attribute information of “09d1...147d4” and attribute information of “0td1...1gdd4”, it indicates that the query result in Table 6 above is a true result, and the server agent sends “row0col1”, “row0col2”, “row0col3” and “extra1” from Table 6 above to the client.

[0087] Based on the above description of the method for optimizing encrypted database connection queries in a hash-based trusted execution environment, it can be seen that the method provided by this invention can also be applied to... Figure 3 The system shown, such as Figure 3 As shown, the system includes a data provider ( Figure 3 The system comprises a database administrator, client, server, and key manager. The server can include a database, a proxy, and an enclave. The data provider and client are trusted components, while the server is untrusted. The data provider can obtain a preset key from the key manager through the key management module, encrypt data in the database tables through the initial data module, determine the security level of the data through the security level management module, calculate the hash value of the data to be encrypted through the hash component, and store the encrypted data in the database. The client can send query requests to the proxy through the query initiation module and receive the data returned by the proxy through the response receiving module. The proxy can process the received query requests through the IO processing module, interact with the database through the database interaction module to obtain data tables, calculate the hash value of the data to be queried in the query request through the hash component, and interact with the enclave through the enclave interaction module. The enclave can obtain a key from the key manager through the key management module, filter the query results through the comparison function module, and return the filtered results to the proxy.

[0088] The following simulation data further illustrates the actual performance of the hash-based trusted execution environment for optimizing encrypted database connection queries.

[0089] When Table 3 above is Table A, Table 5 above is Table B, and the query request sent by the client includes the name of Table A, the name of the second row of Table A, the name of Table B, the name of the second row of Table B, and the plaintext data "row0col1", the query results obtained by the server proxy can be shown in Table 7 below:

[0090]

[0091] Table 7

[0092] As shown in Table 7, the second row represents the true results, while the results following the second row represent false results. This is used to protect data access patterns and frequency, preventing attackers from stealing data access patterns through memory and network data. Subsequently, by calling the trusted function of the trusted execution environment, the encrypted data in each row of Table 7 is decrypted and compared with the data to be queried, "row0col1," filtering out the true results. The final true result is the data in the second row of Table 7. Because the results have already been filtered once using hash values ​​during the query, the number of calls to the trusted function during subsequent filtering is greatly reduced, improving the database query performance.

[0093] This invention introduces the Trusted Execution Environment (TEA) Intel SGX to protect sensitive data and code in a hardware-isolated memory region, addressing the issue of untrustworthiness at the system software level. Secondly, to address the high performance overhead introduced by data decryption and the TEA, this invention uses a hash algorithm to append a corresponding hash value to the encrypted data. Preliminary retrieval of the encrypted data is performed using this hash value, and hash collisions are used to hide data access patterns. Subsequently, a precise retrieval is performed through the TEA, filtering out false positive query results. Furthermore, this invention can dynamically adjust the length of the hash bits to adapt to the security and retrieval performance requirements of encrypted data with different levels of sensitivity, improving database query efficiency while ensuring data security. This invention's hash-based query optimization algorithm, by introducing hash values ​​and combining them with the TEA, can dynamically adjust between security and performance based on data sensitivity, solving the problem of having to choose between security and performance in encrypted database scenarios.

[0094] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for query optimization of encrypted database connections in a trusted execution environment based on hashing, characterized in that, The method comprises the following steps: The data provider selects a security level from a plurality of preset security levels for the data to be encrypted in each row of a data table, and determines a hash value of the data to be encrypted in the row according to the security level and entry information of the data table; The security of the plurality of preset security levels increases gradually, and the hash space of the plurality of hash values determined according to the plurality of preset security levels decreases gradually; The data provider obtains a preset key from a key manager, encrypts the data to be encrypted in the row to obtain ciphertext, stores the ciphertext, the security level and the hash value into the row to obtain an encrypted data table, stores information of the data table, the encrypted data table, the name of the row, the ciphertext, the security level and the hash value into a database, and saves the key and the mapping relationship between the row and the data table in the key manager; A client sends a query request containing the name of a data table to be queried, the name of a row to be queried and data to be queried to a server agent; The server agent queries the security level and entry information from the database according to the query request, and determines a hash value of the data to be queried according to the queried security level and entry information; The server agent queries according to the hash value of the data to be queried and the data table to be queried, and sends the query ciphertext in the obtained query result and attribute information of the query ciphertext to a trusted execution environment component; The trusted execution environment component obtains a key from the key manager based on the attribute information, obtains target information according to the obtained key, the query ciphertext and the data to be queried, and sends the target information to the server agent; The server agent sends the data corresponding to the target information in the query result to the client.

2. The method of claim 1, wherein the method is based on a hash-based trusted execution environment, and The entry information of the data table is the number of rows contained in the data table; each security level corresponds to a calculation method, and the calculation methods corresponding to different security levels are different; the determination of the hash value of the data to be encrypted in the row according to the security level and the entry information of the data table comprises the following steps: Hashing the data to be encrypted in the row to obtain an initial hash value; Determining the calculation method according to the security level; Calculating the initial hash value and the number of rows by using the determined calculation method to obtain the hash value of the data to be encrypted in the row.

3. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 1, characterized in that, The server agent queries according to the hash value of the data to be queried and the hash value in the data table to be queried, and sends the query ciphertext in the obtained query result and the attribute information of the query ciphertext to the trusted execution environment component, which comprises the following steps: The server agent determines at least one group of data from the data table to be queried according to the hash value of the data to be queried and the hash value in the data table to be queried; Each group of intermediate data is obtained according to each group of data, and the obtained intermediate data is taken as a query result; each group of intermediate data comprises at least one ciphertext; The ciphertext included in each group of intermediate data is taken as the query ciphertext, and the attribute information of each group of intermediate data is taken as the attribute information of the included ciphertext. Send the query ciphertext and attribute information of the query ciphertext to a trusted execution environment component.

4. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 3, characterized in that, The data table at least includes a first data table and a second data table; the server agent determines at least one group of data from the data table to be queried according to a hash value of the data to be queried and hash values in the data table to be queried. The server agent filters rows in which hash values are the same as the hash value of the data to be queried from the first data table and the second data table, and obtains the at least one group of data according to data of the filtered rows.

5. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 4, characterized in that, The server agent filters rows in which hash values are the same as the hash value of the data to be queried from the first data table and the second data table, and obtains the at least one group of data according to data of the filtered rows. The row data in the first data table is sorted in descending order according to the size of the hash values between different rows to obtain an updated first data table. The row data in the second data table is sorted in descending order according to the size of the hash values between different rows to obtain an updated second data table. The hash values of the i-th row of the updated first data table and the i-th row of the updated second data table are compared; i is an integer greater than 0 and less than or equal to N, and N is the number of rows of the updated first data table and the updated second data table. When the hash values of the i-th row of the updated first data table and the i-th row of the updated second data table are the same, the i-th row of the updated first data table and the i-th row of the updated second data table are taken as a group of data. When the hash values of the i-th row of the updated first data table and the i-th row of the updated second data table are different, the hash values of the i-th row of the updated first data table and the i+1-th row of the updated second data table are compared; when the hash values of the i-th row of the updated first data table and the i+1-th row of the updated second data table are the same, the data of the i-th row of the updated first data table and the data of the i+1-th row of the updated second data table are taken as a group of data. When the hash values of the i-th row of the updated first data table and the i+1-th row of the updated second data table are different, the hash values of the i-th row of the updated first data table and the i+2-th row of the updated second data table are compared until all the N rows of the updated first data table and the N rows of the updated second data table are traversed.

6. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 4, characterized in that, The server agent filters rows in which hash values are the same as the hash value of the data to be queried from the first data table and the second data table, and obtains the at least one group of data according to data of the filtered rows. At least one hash bucket is determined according to the second data table; each hash bucket corresponds to at least one row and one hash value; the at least one row in each hash bucket contains data of the at least one row in the second data table, and the hash values in the at least one row are the same. comparing the hash value of the jth row of the first data table with a hash value corresponding to a zth hash bucket; j is an integer greater than 0 and less than or equal to N, N is the number of rows of the first data table, z is an integer greater than 0 and less than or equal to M, M is the number of hash buckets; when the hash value of the jth row is the same as the hash value corresponding to the zth hash bucket, the data of the jth row and the data of each row corresponding to the zth hash bucket are taken as a group of data, and the hash value of the jth row is compared with a hash value corresponding to a z+1th hash bucket; j is an integer greater than 0 and less than or equal to N; when the hash value of the jth row is not the same as the hash value corresponding to the zth hash bucket, the hash value of the j+1th row of the first data table is compared with the hash value corresponding to the zth hash bucket until the N rows of the first data table and the M hash buckets are traversed.

7. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 3, characterized in that, Each group of data at least includes: first target row data composed of x column data and second target row data composed of y column data; x and y are integers greater than 0; the group of intermediate data corresponding to each group of data includes: The first target row data and the second target row data are merged to obtain a row of data composed of x+y-p column data, and the row of data is taken as the group of intermediate data; p is an integer greater than 0, representing the number of columns with the same data in x column data and y column data.

8. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 1, characterized in that, The server agent sends at least one group of query ciphertexts; Each group of query ciphertexts contains at least two query ciphertexts, and the attribute information of each group of query ciphertexts includes: the row name and the data table name corresponding to each query ciphertext; the trusted execution environment component obtains a key from the key manager based on the attribute information, obtains target information according to the obtained key, the query ciphertext and the data to be queried, and sends the target information to the server agent, including: For any one group of query ciphertexts, the trusted execution environment component obtains a key corresponding to the data table name and the row name from the key manager; The obtained key is used to decrypt the query ciphertext, so as to obtain at least two decryption results of the any one group of query ciphertexts; When the at least two decryption results are consistent with the data to be queried, the attribute information corresponding to the any one group of query ciphertexts is taken as the target information and sent to the server agent.

9. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 8, characterized in that, The server agent sends the data corresponding to the target information in the query result to the client, including: The server agent sends the plaintext data in the row indicated by the target information in the query result to the client.

10. The hash-based encrypted database connection query optimization method in a trusted execution environment according to claim 1, characterized in that, The plurality of preset security levels at least include: a first security level, a second security level, a third security level, a fourth security level and a fifth security level; the security of the first security level to the fifth security level increases step by step, and the hash space of the hash value corresponding to the first security level to the fifth security level decreases step by step; wherein the hash space of the hash value corresponding to the second security level, the third security level and the fourth security level is inversely proportional to the number of rows of the data table.

Images