A query optimization method for SQL confidential database

Abstract

The present invention discloses a query optimization method for SQL-type confidential databases, including: an offline analysis phase and an online optimization phase. For a query template, the offline analysis phase calculates performance cost functions and privacy loss functions for all candidate query plans based on PRED variables and PRIV variables; when a user requests an SQL query, the online optimization phase updates the performance cost functions of all candidate query plans using a given PRED value, so that only the PRIV variable is considered in the actual optimization calculation, and at the same time, the original performance and privacy protection two-objective optimization problem is equivalently converted into a single-objective problem using the expected privacy loss value. The method greatly reduces the complexity of the optimization calculation.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing, and more specifically to a query optimization method for an SQL-type confidential database. Background Art

[0002] In recent years, driven by the booming cloud computing industry, databases have embarked on a cloud transformation journey from a standalone deployment model to a cloud service model. According to Gartner's forecast, by 2023, 75% of databases in the global database market will be migrated to cloud platforms. Cloud databases rely on the powerful computing resources of the cloud to provide users with ubiquitous, convenient, and on-demand database access services. They have been widely used in Internet industries such as e-commerce, games, and videos, as well as Internet scenarios in traditional industries such as medical care, industry, retail, finance, and government.

[0003] While enjoying the many conveniences brought by cloud databases, their inherent data outsourcing characteristics make cloud databases face increasingly severe data security issues. In general, cloud databases should have the following security properties: data confidentiality and integrity, privacy-protected data processing, query execution integrity, and multi-user access control. However, there are still many challenges in achieving the above security goals in cloud database systems. First, the application of cryptographic methods has problems such as low computational efficiency, poor operational flexibility, poor functional compatibility, and insufficient result verifiability; second, the application of plaintext-oriented privacy computing technologies such as data segmentation, data anonymity, and differential privacy is aimed at protecting the privacy of the query process, and cannot be used as a general technology to achieve other security properties such as data confidentiality and integrity; finally, confidential computing technologies enabled by trusted execution environments, such as Intel Software Guard Extensions (Intel SGX), are potential technologies for realizing secure cloud databases. It provides an isolated computing space (also known as Enclave) implemented by hardware mechanisms, but the relevant system practices have data security and privacy leakage problems caused by side channel and software interface attacks. Among them, the method of using the interaction traces between Enclave and the outside world (i.e., side channel information, such as communication capacity) poses a persistent threat. Differential privacy noise obfuscation is an effective method to combat communication capacity side channel attacks. The communication capacity side channel information obfuscated by noise will lose its usability. However, the application of this method will lead to the optimization problem of performance and privacy protection, which is still an open problem.

[0004] The present invention aims to solve the query optimization problem of performance and privacy protection induced by applying differential privacy noise obfuscation to SQL-type confidential databases to counter communication capacity side channel attacks. Existing technical solutions include:

[0005] Xu et al. conducted a detailed exploration of differential privacy noise obfuscation in SQL-type confidential query application scenarios and were the first to discover the performance and privacy protection optimization issues involved.

[0006] Bater et al. also focused on the dual-objective optimization problem of performance and privacy protection caused by applying differential privacy noise obfuscation to combat side-channel attacks on communication capacity in Shrinkwrap, a confidential query system implemented for the multi-party secure computing paradigm.

[0007] The RRPA algorithm proposed by Trummer et al. is a general method known to solve multi-objective parameterized query optimization problems.

[0008] The solution proposed by Xu et al. to normalize optimization objectives with different dimensions (i.e., privacy loss and performance overhead) by weighting is unreasonable and unexplainable. At the same time, there is a lack of relevant guidelines for reasonably defining the weights of optimization objectives in this solution. The optimization object of Bater et al.'s confidential query system Shrinkwrap is the query plan, which aims to solve the noise obfuscation strategy with the minimum performance overhead, which is a typical single-objective query optimization problem. The optimization performance of the RRPA algorithm proposed by Trummer et al. drops sharply when the number of data tables increases; in addition, not all Pareto optimal query plans associated with the noise obfuscation strategy are executed, so the RRPA algorithm that needs to calculate the complete Pareto optimal solution set has a huge waste of computing resources.

[0009] In summary, the existing technical solutions have the shortcomings of being unexplainable, inefficient, and wasting optimization resources. Summary of the invention

[0010] The embodiment of the present invention provides a query optimization method for a SQL-type confidential database, comprising:

[0011] Obtain a query template including a predicate variable PRED defined by a confidential database owner;

[0012] In the offline phase, the profile(·) function is introduced and the query template is input into the profile(·) function;

[0013] Recursively split the query template into multiple aggregation queries consisting of subqueries and join operators to obtain multiple candidate aggregation query plans;

[0014] Based on the predicate variable PRED and the privacy variable PRIV, the performance cost function and the privacy loss function of the candidate aggregation query plan are calculated in the profile(·) function, and a set of candidate aggregation query plans of query templates associated with the performance cost function and the privacy loss function are output;

[0015] When a user requests a SQL query, an online optimization function optimize(·) is introduced;

[0016] In the optimize(·) function, the candidate aggregate query plan set of the query template is input, the PRED variable value set given by the end user is used, the performance cost part related to the variable PRED is calculated, and the performance cost function associated with the candidate aggregate query plan is updated;

[0017] The minimum value of the updated performance cost function is used as the final single-objective optimization problem, and the optimal performance cost value of the current candidate aggregation query plan is obtained by solving the problem;

[0018] By comparing with other candidate aggregate query plans one by one, the global optimal performance cost value, the corresponding candidate aggregate query plan and the privacy variable PRIV value vector are obtained. The function optimize(·) outputs the candidate query plan with the global optimal performance cost value as the Pareto optimal query plan.

[0019] Preferably, the query template includes:

[0020] Quintuple T, W, B, S, J;

[0021] Where T is the set of associated data tables;

[0022] W is the set of corresponding data table privacy weights;

[0023] B is the set of corresponding data table privacy budgets;

[0024] S is the set of associated selection predicate conditions;

[0025] J is the set of associated join predicate conditions;

[0026] W and B are defined by the database owner based on interest or empirical knowledge when subscribing to the cloud service.

[0027] Preferably, the query plan includes:

[0028] Quintuple T, W, O s , O ε , A;

[0029] The meanings of T and W are the same as those in the query template;

[0030] O s is the set of associated predicate variables PRED;

[0031] O ε is the set of associated privacy variables PRIV, equivalently represented as a set of query operators;

[0032] A is of size |T|×|O ε |'s privacy mapping matrix;

[0033] The elements in set S and set O s The elements in O correspond to each other one by one, that is, s ={PRED(s)|s∈S}, s represents the predicate condition, where PRED(·) outputs the PRED parameter corresponding to the selected predicate condition;

[0034] The elements of the union of set T and set J and set O ε The elements in O correspond to each other one by one, that is, ε ={PRIV(ε)|ε∈T∪J}, where ε represents a privacy variable, wherein PRIV(·) outputs the PRIV variable corresponding to the query operator associated with the data table and the join predicate condition;

[0035] There are m query plans for query template q. The query plan set of query template q is expressed as P(q)={p k :(T,W,O s , O ε , A k )|k=1,...,m},A k represents the k-th privacy mapping matrix.

[0036] Preferably, the cost function comprises:

[0037] Query plan p k The cost function C(p∈P(q) k ) is a two-tuple <C perf (p k ), C priv (p k )>;

[0038] The first element C perf (p k ) represents the query plan p k The performance cost function of s and PRIV variable O ε is the independent variable;

[0039] The second element C priv (p k ) represents the query plan p k The privacy loss function is represented by PRIV variable O ε is the independent variable;

[0040] Formula (1) is used to express the cost function C(p k ):

[0041]

[0042] Among them, f pk (s 1 , ..., s t ; ε 1 , ..., ε n ) and g pk (ε 1 , ..., ε n ) to represent the performance cost function and privacy loss function respectively, t=|O s | represents the number of PRED variables, n = |O ε |Indicates the number of PRIV variables.

[0043] Preferably, the query template is recursively split into multiple aggregate queries to obtain multiple candidate aggregate query plans, including:

[0044] Recursively split the query template into atomic queries that access a single data table;

[0045] Split the atomic query, i.e. the parent query, into small left and right subqueries;

[0046] Evaluate all candidate join plans based on the two subqueries obtained by splitting;

[0047] According to all candidate join plans, an aggregate(·) function is used to connect a candidate left subquery plan and a candidate right subquery plan through a join operator to obtain multiple candidate aggregate query plans.

[0048] Preferably, before calculating the performance cost function and privacy loss function of the candidate aggregate query plan in the profile(·) function, the independent variable value space is repartitioned, and the performance cost function is linearly added on any partition.

[0049] Preferably, for a single-objective optimization problem, the calculation formula includes:

[0050]

[0051] Among them, C p Indicates the use of PRED parameter value Seek The value of

[0052] A p represents the privacy mapping matrix associated with the query plan p;

[0053] represents the privacy variable PRIV vector;

[0054] B Trepresents the privacy budget vector of the data table;

[0055] represents the privacy loss function associated with the query plan p;

[0056] Cpriv represents the privacy loss preference value chosen by the confidential database owner.

[0057] Preferably, the method further includes pruning candidate query plans, which includes:

[0058] Traverse all candidate query plans;

[0059] Determine the performance cost function target partition where the PRED variable value vector is located for each candidate query plan;

[0060] Update the performance cost function of each candidate query plan using the PRED variable value vector;

[0061] Sort candidate query plans in ascending order according to the constant size of the updated performance cost function;

[0062] Based on the pruning ratio, remove the candidate query plans at the end.

[0063] The embodiment of the present invention provides a query optimization method for SQL-type confidential databases. Compared with the prior art, the method has the following beneficial effects:

[0064] 1. A query optimization method for SQL-type confidential databases uses the expected privacy loss value to convert the target optimization problem into a single-objective problem, thereby greatly reducing the complexity of the optimization calculation. Compared with RRPA, a query optimization method for SQL-type confidential databases significantly improves the query efficiency. In particular, when the parameter space is large, RRPA exhausts the computing resources of the test platform but cannot find the optimal solution, but a query optimization method for SQL-type confidential databases does not have this limitation.

[0065] 2. A query optimization method for SQL-based confidential databases generates a single Pareto optimal query plan for queries initiated by end users. As the system processes more query requests, it will form a necessary Pareto optimal query plan solution set, effectively reducing resource waste.

[0066] 3. The offline analysis overhead has a major impact on the efficiency of a query optimization method for SQL-based confidential databases, but this overhead is reasonable, and compared with RRPA, it does not fall into the so-called "large parameter space death trap", that is, the solution efficiency is very low and the solution is unreachable. At the same time, an acceleration mechanism is introduced into a query optimization method for SQL-based confidential databases to improve the efficiency of the algorithm, thereby minimizing the query response time, so the online optimization overhead is very small (milliseconds).

[0067] 4. A query optimization method for SQL-based confidential databases only outputs a single Pareto optimal query plan. The confidential database owner participates in the optimization process and indirectly makes a choice of the query plan to be output, thereby not undermining the decision-making power of the database owner. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 An algorithm framework diagram of a query optimization method for a SQL-type confidential database provided by an embodiment of the present invention;

[0069] Figure 2 A cloud database SQL query system model for a query optimization method for a SQL-type confidential database provided by an embodiment of the present invention;

[0070] FIG3 is a comparison result of a query optimization method for a SQL-type confidential database provided by an embodiment of the present invention and a comparative solution, wherein FIG3(a) shows a comparison of the execution time of a query optimization method for a SQL-type confidential database and RRPA; FIG3(b) shows a comparison of the number of linear programming problems solved by a query optimization method for a SQL-type confidential database and RRPA;

[0071] Figure 4 A query optimization method for SQL-type confidential database provided by an embodiment of the present invention shows the relationship between pruning rate Rp, error rate Re and speedup ratio Rs under different sensitivity calculation methods. Each matrix is ​​divided into two parts: the upper triangular part represents chain query; the lower triangular part represents star query. The digital label in the square box represents the corresponding speedup ratio Rs (compared with Rp=0). DETAILED DESCRIPTION

[0072] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0073] See also Figure 1 The embodiment of the present invention provides a query optimization method for a SQL-type confidential database, the method comprising:

[0074] Obtain a query template defined by a security database owner and including a predicate variable PRED and a privacy variable PRIV;

[0075] In the offline phase, the profile(·) function is introduced, a query template is input into the profile(·) function, and the query template is recursively split into multiple atomic queries to obtain all candidate query plans of the atomic queries;

[0076] Based on the predicate variable PRED and the privacy variable PRIV, the cost functions of all candidate atomic query plans are calculated in the profile(·) function, query aggregation is achieved through a join operation, and the cost functions of the candidate aggregate query plans are calculated at the same time, until the cost functions of the candidate query plans of the query template are obtained;

[0077] The privacy variable PRIV is defined as a parameter associated with the query operator (such as access, connection and other operations) in the above process, and its value determines the amount of noise injected into the query operator by the differential privacy noise interference method against communication capacity side channel attack. The cost function includes the performance overhead function and the privacy loss function.

[0078] Output the candidate query plan set of the query template associated with the performance cost function and the privacy loss function in the profile(·) function;

[0079] When a user requests an SQL query, an online optimization function optimize(·) is introduced, with the input being the candidate query plan set generated by the function profile(·), the variable value set of PRED given by the end user, and the privacy loss preference value selected by the confidential database owner.

[0080] The optimize(·) function calculates the performance cost part related to PRED according to the set of PRED variable values ​​given by the end user, and updates the performance cost function associated with the query plan;

[0081] Solving the minimum value of the updated performance cost function is regarded as the final single-objective optimization problem;

[0082] The privacy loss function assigned with the privacy loss preference value and the combined privacy loss function associated with a single data table during the whole query process are smaller than the privacy budget value preset by the system as the constraint conditions of the single-objective optimization problem;

[0083] Solve the single-objective optimization problem and obtain the optimal performance cost value of the current candidate query plan;

[0084] By comparing two by two, the global optimal performance cost value, the corresponding candidate query plan and the privacy variable PRIV value vector are obtained;

[0085] The function optimize(·) outputs a candidate query plan with the global optimal performance cost as the Pareto optimal query plan.

[0086] Specifically,

[0087] The two-objective parameterized query optimization problem that the TOPA method aims to solve is to find a Pareto optimal query plan for the SQL queries initiated by users, which can strike a balance between performance overhead and privacy loss. It embeds two novel ideas, namely "divide and conquer" and "optimize on demand".

[0088] The algorithm framework of a query optimization method for SQL-based confidential databases includes an offline analysis phase and an online optimization phase, as shown in the following figure.

[0089] Applying the query template-oriented offline optimization framework will introduce additional parameters into the target optimization problem. Such parameters are called predicate variables and are represented using PRED.

[0090] Compared with the original privacy variable PRIV in the target optimization problem, PRED only affects the performance cost target of the query plan. In other words, such parameters will not cause changes in the privacy loss in the differential privacy noise interference mechanism.

[0091] In the target optimization problem, PRED and PRIV together constitute a new and larger parameter space, which becomes the difficulty of the query algorithm.

[0092] A query optimization method for SQL-based confidential databases In the offline analysis phase, the function profile(·) is used to take the query template q defined by the confidential database owner as input and output a set of candidate query plans. The core idea of ​​the algorithm is "dynamic programming".

[0093] Specifically, the function first recursively splits the input query template into subqueries until it reaches an atomic query that accesses a single data table. At this point, it calculates the number of query plans that access each data table and the cost function corresponding to each query plan, including the performance overhead function and the privacy loss function.

[0094] The operation of accessing the data table is equivalent to a selection operator. The PRED parameter is only applied to this type of query operator.

[0095] Subsequently, the function profile(q) splits the larger query (parent query) into smaller left and right subqueries through iterative operations, and evaluates all possible join plans (performed by the join operator) for each set of two subqueries obtained by the split;

[0096] These join plans (parent query plans) use aggregate(·) to join a candidate left subquery plan and a candidate right subquery plan. The essence of this is to sum the cost functions of the left and right subquery plans with the cost function of the join operator to generate the cost function of the parent query plan.

[0097] Specifically, the query template q includes:

[0098] Quintuple T, W, B, S, J;

[0099] Where T is the set of associated data tables;

[0100] W is the set of corresponding data table privacy weights;

[0101] B is the set of corresponding data table privacy budgets;

[0102] S is the set of associated selection predicate conditions

[0103] J is the set of associated join predicate conditions;

[0104] W and B are defined by the database owner based on interest or empirical knowledge when subscribing to the cloud service.

[0105] Specifically, the query plan includes:

[0106] Quintuple T, W, O s , O ε , A;

[0107] The meanings of T and W are the same as those in the query template;

[0108] O s is the set of associated predicate variables PRED;

[0109] O ε is the set of associated privacy variables PRIV, equivalently represented as a set of query operators;

[0110] A is of size |T|×|O ε |'s privacy mapping matrix;

[0111] The elements in set S and set O s The elements in O correspond to each other one by one, that is, s ={PRED(s)|s∈S}, where PRED(·) outputs the PRED parameter corresponding to the selection predicate condition;

[0112] The elements of the union of set T and set J and set O ε The elements in O correspond to each other one by one, that is, ε ={PRIV(ε)|ε∈T∪J}, where PRIV(·) outputs the PRIV variable corresponding to the query operator associated with the data table and the join predicate condition;

[0113] There are m query plans for query template q. The query plan set for query template q is expressed as P(q)={pk :(T,W,O s , O ε , A k )|k=1,...,m}.

[0114] Specifically, the cost function includes:

[0115] Query plan p k The cost function C(p∈P(q) k ) is a two-tuple <C perf (p k ), C priv (p k )>;

[0116] The first element represents the query plan p k The performance cost function of s and PRIV variable O ε is the independent variable;

[0117] The second element represents the query plan p k The privacy loss function is represented by PRIV variable O ε is the independent variable;

[0118] Formula (1) is used to express the cost function C(p k ):

[0119]

[0120] Among them, f pk (s 1 , ..., s t ; ε 1 , ..., ε n ) and g pk (ε 1 , ..., ε n ) to represent the performance cost function and privacy loss function respectively, t=|O s |,n=|O ε |.

[0121] Specifically, based on the predicate variable PRED and the number of privacy variables PRIV, the cost function of all candidate query plans is calculated in the profile(·) function, including:

[0122] Split the query, i.e. the parent query, into smaller left and right subqueries;

[0123] Evaluate all join plans based on the two subqueries obtained by splitting;

[0124] According to all the join plans, ie, the parent query plan, a candidate left subquery plan and a candidate right subquery plan are joined through a join operator using an aggregate(·) function, and the sum of the cost function of the left and right subquery plans and the cost function of the join operator is calculated.

[0125] A query optimization method for SQL-based confidential databases introduces an online optimization function optimize(·) in the online optimization phase. Typically, the optimize(·) function is a stateful function that associates input and output during execution and records them as a global key-value pair tuple. All key-value pair tuples related to a query template constitute the necessary Pareto optimal query set of the query template.

[0126] For similar SQL queries initiated by end users based on specific query templates, previously recorded tuples are used as cache to accelerate the execution of optimization functions by reducing complex optimization calculation operations to simple table query operations.

[0127] In the optimization calculation operation (code lines 5-13), the function optimize(·) iteratively processes the elements in the corresponding candidate query plan set P using the input PRED parameter value set and privacy loss preference value.

[0128] For solving the single-objective parameterized query optimization problem obtained by transforming each query plan and comparing the optimal objective values ​​corresponding to the candidate query plans pairwise, the function optimize(·) selects the candidate query plan with the minimum optimal objective value as the Pareto optimal query plan and outputs it together with the associated PRIV parameter value.

[0129] Specifically, it also includes:

[0130] Before summing the three performance cost functions in the left and right subquery plans and the join operator cost function, the independent variable space is repartitioned to keep the three performance cost functions linearly additive on a certain partition.

[0131] Specifically, for linear programming problems, the calculation formulas include:

[0132]

[0133] Among them, C p Indicates the use of PRED parameter value Seek The value of

[0134] A p , represents the privacy mapping matrix associated with the query plan p;

[0135] represents the privacy variable PRIV vector;

[0136] B T represents the privacy budget vector of the data table;

[0137] represents the privacy loss function associated with the query plan p;

[0138] C priv represents the privacy loss preference value chosen by the confidential database owner.

[0139] Specifically, it also includes tailoring candidate query plans to speed up and improve query efficiency, including:

[0140] Traverse all candidate execution plans;

[0141] Determine the performance cost function target partition where the PRED variable value vector is located for each candidate query plan;

[0142] Update the performance cost function of each candidate query plan using the PRED variable value vector;

[0143] The candidate query plans are sorted in ascending order according to the constant size of the updated performance cost function; based on the pruning ratio, the candidate query plans at the end are deleted.

[0144]

[0145] Pseudocode representation of the offline analysis function profile(·)

[0146] Pseudocode representation of the query plan aggregation algorithm

[0147]

[0148] Pseudocode of the online optimization function optimize(·)

[0149] The database query system considered by the present invention is as follows Figure 2 As shown:

[0150] Includes, a confidential database owner, a cloud database service, and multiple end users;

[0151] Cloud database services are deployed by cloud providers and run on a distributed platform protected by Enclave, providing database owners and end users with rich data management and query function interfaces;

[0152] In particular, the cloud database service integrates a query optimizer, specifically referring to the query optimization method optimizer for SQL-type confidential database proposed in the present invention, to interpret SQL queries into physical query plans to be executed;

[0153] When subscribing to a cloud database service, the database owner outsources the data ciphertext to the cloud database service for management and delivers the key to the Enclave that has been successfully remotely authenticated. This process will not be described in detail here.

[0154] For outsourced data, the database owner defines query templates and formulates access control policies to authorize SQL queries by end users;

[0155] Among them, a query template is a parameterized query expression (such query template parameters are represented by PRED), whose query semantics are determined but the parameter values ​​are given when the end user initiates the query;

[0156] The end user initiates a query to the cloud database service in the system, that is, a query template instantiated with parameters, to realize the utilization of outsourced data. Here, multi-user access control is not the focus of the present invention, and can be realized by using a key sharing mechanism.

[0157] Next, we briefly describe the execution workflow of the query optimizer in this system:

[0158] In the database owner subscription phase, the query optimizer generates a query template summary for each query template, which defines the corresponding performance cost function and privacy loss function with PRED and PRIV variables as independent variables;

[0159] When receiving a valid SQL query initiated by an end user, the cloud database service first optimizes the SQL query into a query plan and then submits the query plan to the Enclave node for calculation;

[0160] In particular, during the query optimization interpretation process, a query optimization method for SQL-type confidential database optimizer calculates the query plan and its associated PRIV variable value that achieves Pareto optimality between performance overhead and privacy loss based on the specific PRED parameter value and the corresponding query template summary.

[0161] Example:

[0162] Experimental Evaluation

[0163] A query optimization method for SQL-based confidential databases and RRPA efficiency comparison experiment setup

[0164] The evaluation experiment is based on Java 1.8, using Gurobi 9.1.2 as the linear programming solver. A query optimization method for SQL-based confidential databases is tested on a platform with an Intel Core i9-10900 CPU running at 3.60GHz, 32GiB of running memory, and Ubuntu 20.04. The maximum Java Virtual Machine (JVM) heap memory is set to 16GiB. The specific RRPA algorithm, namely PWL-RRPA, is used as a comparative experiment, and the performance cost function is approximated by a piecewise linear function, just like a query optimization method for SQL-based confidential databases. In addition, a naive optimization algorithm is implemented in the comparative experiment, which is similar to the optimizer in Hermetic and Shrinkwrap, and is run as another comparative experiment of query optimization methods for SQL-based confidential databases. All experimental tests are repeated 5 times to eliminate systematic errors.

[0165] A query optimization method for SQL-based confidential databases and RRPA efficiency comparison experimental results

[0166] Figure 3(a) and Figure 3(b) show the overall comparison of a query optimization method for SQL-based confidential databases and RRPA in terms of execution time and number of linear programming problems solved (ILP), respectively. The two evaluation targets described by the 3D surface are functions of the number of different PREDs (denoted by #PREDs) and the number of data tables (denoted by #Tables) in the tested query templates (q1-q12). The colored lines in the YZ plane and XZ plane are the projections of the 3D surface contours and are highlighted on the right accordingly.

[0167] It can be observed intuitively that: (1) All RRPA performance surfaces are located above the surface of a query optimization method for SQL-type confidential databases. More importantly, as the number of tables increases, the RRPA performance surface reaches its upper limit, that is, the solution is unreachable. (2) The projection lines of the surface contour of a query optimization method for SQL-type confidential databases in the XZ plane (perpendicular to the Y axis) are clearly layered, and each projection line is approximately horizontal; the projection lines of the surface contour of a query optimization method for SQL-type confidential databases in the YZ plane (perpendicular to the X axis) overlap, and each projection line is an inclined line with almost equal slope. (3) The projection lines of the RRPA surface contour (perpendicular to the Y axis) in the XZ plane are well layered, each projection line is approximately horizontal, but usually higher than the corresponding projection line of the surface of a query optimization method for SQL-type confidential databases; the projection lines of the RRPA surface contour (perpendicular to the X axis) in the YZ plane overlap, each projection line is an inclined line with almost equal slope, but usually has a larger slope than the corresponding projection line of the surface of a query optimization method for SQL-type confidential databases. (4) All graphs of star query have similar functions as chain query.

[0168] A query optimization method for SQL-based confidential databases and RRPA efficiency comparison experiment conclusions

[0169] Accordingly, the following comments can be made: (1) Compared with RRPA, a query optimization method for SQL-type confidential databases has a significant improvement in query efficiency (about 2 orders of magnitude). When the number of tables exceeds 3, RRPA exhausts the computing resources of the test platform but cannot obtain the optimal solution, but a query optimization method for SQL-type confidential databases has no such limitation; in other words, RRPA is susceptible to the number of tables, while a query optimization method for SQL-type confidential databases is not. (2) It is the number of tables, not the number of PREDs, that affects the efficiency of a query optimization method for SQL-type confidential databases; specifically, as the number of tables increases, the query efficiency decreases. This conclusion applies to RRPA, but the number of tables has a greater impact on RRPA than on a query optimization method for SQL-type confidential databases. (3) A query optimization method for SQL-type confidential databases is effective for both star queries and chain queries.

[0170] Experimental setup for evaluation of acceleration mechanisms

[0171] Through further research on the online optimization algorithm of a query optimization method for SQL-based confidential databases, the main overhead is to solve the related ILP problem by iterating all candidate plans in P and solving the related ILP problem according to the candidate plans. We make a big assumption that the candidate plan with smaller performance cost generated by PREDs is likely to be the best plan. The reason for our assumption is that the noise corresponding to the additional performance cost generated by PRIVs is related to its target I / O cardinality (relative to the performance cost generated by PREDs). Therefore, we introduce a speedup mechanism, in which the performance costs of the plans (in each partition area) in the candidate plan set P output by profile(·) are sorted, and the last Rp part of the plan in P is pruned before executing optimize(·), where Rp becomes the pruning rate. At the same time, we use the error rate (denoted as Re) and the speedup ratio (denoted as Rs) to model the online optimization accuracy and online optimization efficiency respectively. To this end, we generate 80 random test cases in this experiment, and we randomly divide these test cases into 8 groups, setting the number of candidate plans to be retained to 20, 21, 22, 24, 26, 28, 210, and 212 respectively.

[0172] Acceleration mechanism evaluation experimental results

[0173] Figure 4 The relationship between the pruning rate Rp, error rate Re, and speedup ratio Rs in the acceleration mechanism using different sensitivity calculation methods is shown. We observe that (1) as Rp shrinks, the overall error rate of all benchmark query templates converges monotonically to zero. (2) The critical value of Rp is different for query templates with different numbers of tables and PRED. (3) In addition, by comparing the upper and lower triangular parts of the matrix, we conclude that the acceleration mechanism is generally effective for both star queries and chain queries (more precisely, it is more effective for star queries). In addition, the total number of candidate plans for a query template depends only on #Tables, specifically

[0174]

[0175] This shows that the pruning rate is inversely proportional to the speedup ratio, and also shows that the cost of solving the linear programming to optimize the candidate plan in the online optimization phase is roughly fixed. (4) Finally, we note that the speedup mechanism is susceptible to the sensitivity calculation.

[0176] Conclusions of the acceleration mechanism evaluation experiment

[0177] Based on the experimental results, it is expected that a query optimization method for SQL-type confidential databases will significantly benefit from the acceleration mechanism. The experiments show that, although equipped with advanced features, i.e., a trade-off between performance and privacy, a query optimization method for SQL-type confidential databases has a significant improvement in query efficiency due to the proposed acceleration mechanism, and is about 2 orders of magnitude higher than the naive optimizer (adopted by Hermestic and Shrinkwrap) without such features.

[0178] Disclosed above are only a few specific embodiments of the present invention. Those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the present invention. However, the embodiments of the present invention are not limited thereto. Any changes that can be conceived by those skilled in the art should fall within the scope of protection of the present invention.

Claims

1. A query optimization method for SQL-type confidential database, characterized in that: include: Obtain a query template including a predicate variable PRED defined by a confidential database owner; In the offline phase, the profile(·) function is introduced and the query template is input into the profile(·) function; Recursively split the query template into multiple aggregation queries consisting of subqueries and join operators, and obtain multiple candidate aggregation query plans according to the aggregation queries; Based on the predicate variable PRED and the privacy variable PRIV, the performance cost function and the privacy loss function of the candidate aggregation query plan are calculated in the profile(·) function, and a set of candidate aggregation query plans of query templates associated with the performance cost function and the privacy loss function are output; When a user requests a SQL query, an online optimization function optimize(·) is introduced; Input the candidate aggregate query plan set into the optimize(·) function, use the PRED variable value set given by the end user, calculate the performance cost part related to the PRED variable, and complete the update of the performance cost function associated with the candidate aggregate query plan; The minimum value of the updated performance cost function is used as the final single-objective optimization problem, and the optimal performance cost value of the current candidate aggregation query plan is obtained by solving the problem; By comparing with other candidate aggregate query plans one by one, the global optimal performance cost value, the corresponding candidate aggregate query plan and the privacy variable PRIV value vector are obtained; The function optimize(·) outputs a candidate query plan with a globally optimal performance cost value as a Pareto optimal query plan.

2. A query optimization method for SQL-type confidential database according to claim 1, characterized in that: The query template includes: Quintuple T, W, B, S, J; Where T is the set of associated data tables; W is the set of corresponding data table privacy weights; B is the set of corresponding data table privacy budgets; S is the set of associated selection predicate conditions; J is the set of associated join predicate conditions; W and B are defined by the database owner based on interest or empirical knowledge when subscribing to the cloud service.

3. A query optimization method for SQL-type confidential database as claimed in claim 2, characterized in that: The query plan includes: Quintuple T, W, O s , O ε , A; The meanings of T and W are the same as those in the query template; O s is the set of associated predicate variables PRED; O ε is the set of associated privacy variables PRIV, equivalently represented as a set of query operators; A is of size |T|×|O ε |'s privacy mapping matrix; The elements in set S and set O s The elements in O correspond to each other one by one, that is, s ={PRED(s)|s∈S}, s represents the predicate condition, where PRED(·) outputs the PRED parameter corresponding to the selected predicate condition; The elements of the union of set T and set J and set O ε The elements in O correspond to each other one by one, that is, ε ={PRIV(ε)|ε∈T∪J}, where ε represents a privacy variable, wherein PRIV(·) outputs the PRIV variable corresponding to the query operator associated with the data table and the join predicate condition; There are m query plans for query template q. The query plan set of query template q is expressed as P(q)={p k :(T,W,O s , O ε , A k )|k=1,…,m},A k represents the k-th privacy mapping matrix.

4. A query optimization method for SQL type confidential database as claimed in claim 3, characterized in that: The cost function includes: Query plan p k The cost function C(p∈P(q) k ) is a binary group <C perf (p k ), C priv (p k )>; The first element represents the query plan p k The performance cost function of s and PRIV variable O ε is the independent variable; The second element represents the query plan p k The privacy loss function is represented by PRIV variable O ε is the independent variable; Formula (1) is used to express the cost function C(p k ): Among them, f pk (s 1 ,…,s t ; ε 1 , …, ε n ) and g pk (ε 1 , …, ε n ) to represent the performance cost function and privacy loss function respectively, t=|O s | represents the number of PRED variables, n = |O ε |Indicates the number of PRIV variables.

5. A query optimization method for SQL type confidential database as claimed in claim 3, characterized in that: The step of recursively splitting the query template into multiple aggregate queries to obtain multiple candidate aggregate query plans includes: Recursively split the query template into atomic queries that access a single data table; Split the atomic query, i.e. the parent query, into small left and right subqueries; Evaluate all candidate join plans based on the two subqueries obtained by splitting; According to all candidate join plans, an aggregate(·) function is used to connect a candidate left subquery plan and a candidate right subquery plan through a join operator to obtain multiple candidate aggregate query plans.

6. A query optimization method for SQL-type confidential database as claimed in claim 5, characterized in that: Before calculating the performance cost function and privacy loss function of the candidate aggregation query plan in the profile(·) function, the independent variable value space is repartitioned. On any partition, the performance cost function is linearly added.

7. A query optimization method for SQL type confidential database as claimed in claim 3, characterized in that: The calculation formula for the single-objective optimization problem includes: Among them, C p Indicates the use of PRED parameter value Seek The value of A p represents the privacy mapping matrix associated with the query plan p; represents the privacy variable PRIV vector; B T represents the privacy budget vector of the data table; represents the privacy loss function associated with the query plan p; C priv represents the privacy loss preference value chosen by the confidential database owner.

8. A query optimization method for SQL-type confidential database as claimed in claim 4, characterized in that: It also includes pruning candidate query plans, which include: Traverse all candidate query plans; Determine the performance cost function target partition where the PRED variable value vector is located for each candidate query plan; Update the performance cost function of each candidate query plan using the PRED variable value vector; Sort candidate query plans in ascending order according to the constant size of the updated performance cost function; Based on the pruning ratio, remove the candidate query plans at the end.

Images