A ciphertext range query method and system supporting positive-negative mixed floating point numbers

Abstract

The application discloses a ciphertext range query method and system supporting positive and negative mixed floating point numbers, and the encryption key and the confusion key of the ciphertext to be queried are generated by a data owner, a first algorithm is called to encrypt each plaintext floating point data of a specified column in a ciphertext data table to be queried, and a ciphertext data table is generated; the ciphertext data table is sent to a cloud server, the cloud server receives and stores the ciphertext data table; a second algorithm is called to generate a query trapdoor Trap of the ciphertext to be queried, the query trapdoor Trap is sent to the cloud server, a fourth algorithm is called to generate a judgment result of the range of the ciphertext to be queried, and a set S of all data rows indexes returned True by the fourth algorithm is recorded; the set S sent by the cloud server is received, and a range query result of the ciphertext to be queried is obtained. The application supports the encryption of floating point numbers, the comparison of corresponding ciphertexts and the range query, has high algorithm efficiency, supports the encryption of plaintext data of positive and negative numbers, and can clearly depict the information leakage.

Description

Technical Field

[0001] This application relates to the field of ciphertext range query technology that supports mixed positive and negative floating-point numbers, and in particular to a method and system for ciphertext range query that supports mixed positive and negative floating-point numbers. Background Technology

[0002] With the widespread adoption of Infrastructure as a Service (IaaS) such as cloud computing, many enterprises have moved their databases to the cloud for storage. Range queries are a common query method in databases, returning data that meets a given range condition based on a start and end point. To ensure data security, enterprises almost always encrypt data when uploading it. However, traditional data encryption algorithms randomly transform plaintext, disrupting its sequential information and thus failing to support range queries on encrypted data. Decrypting the encrypted data in the cloud before querying it clearly violates the intended security purpose of data encryption. Therefore, designing a method to support range queries on encrypted data is a research direction with significant practical value.

[0003] The core of range lookup algorithms supporting ciphertext data is that the encryption algorithm must maintain the original plaintext order. Early solutions were based on Oblivious Random Access Memory (ORAM), which aims to access data at a memory location without exposing it, such as the ORAM-based protocol proposed by Stefanov et al. With the advent of fully homomorphic encryption algorithms, plaintext can be fully homomorphically encrypted, and then comparison operations can be performed on the ciphertext to complete the range lookup. Both of these approaches have significant drawbacks: ORAM-based schemes require high network bandwidth and a large number of protocol rounds; fully homomorphic encryption schemes result in large ciphertext expansion and poor computational efficiency, making them unsuitable for large data volumes. In contrast, order-preserving encryption is currently the most efficient encryption scheme supporting range lookups. This type of encryption maintains the original order of the plaintext, allowing direct size comparisons within the ciphertext. Agrawal et al. first proposed the concept of order-preserving encryption in 2004, and Boldyreva et al. first gave the security definition of order-preserving encryption and improved its efficiency in 2009. In 2013, Popa et al. constructed the first order-preserving encryption scheme to achieve ideal security. In 2015, Beneh et al. improved the security of order-preserving encryption by replacing the direct comparison of ciphertext sizes with a comparison function to calculate the size relationship between two ciphertexts; this more secure scheme is called Order Revealing Encryption (ORE). Chenette, Furukawa, Lewis, and others subsequently proposed several more efficient versions of ORE algorithms. Bogatov et al. provided a detailed analysis and comparison of the security and efficiency of existing ORE algorithms.

[0004] Existing order-preserving encryption algorithms struggle to accurately characterize the amount of information leakage after data encryption, thus the security analysis results of these schemes cannot accurately reflect actual security. Currently, the most efficient ciphertext range query solution is the deordering encryption scheme proposed by Chenette et al., but this scheme can only encrypt and compare ciphertexts containing integer values. In real-world scenarios, values ​​often contain floating-point numbers, significantly limiting its application. Current range queries based on deordering encryption only support plaintext data with consistent signs; existing schemes only support positive numbers. Theoretically, if all data is negative, simply inverting the comparison result would suffice, but it cannot support ciphertext comparisons of plaintext data with mixed positive and negative values. Summary of the Invention

[0005] Based on this, and in response to the aforementioned technical problems, a method and system for querying ciphertext ranges that support mixed positive and negative floating-point numbers are provided to solve the problems in existing solutions that do not support ciphertext range queries for floating-point numbers, cannot support ciphertext comparison after encryption of plaintext data with mixed positive and negative numbers, and are difficult to accurately characterize the amount of information leakage after data encryption.

[0006] Firstly, a method for querying ciphertext ranges supporting mixed positive and negative floating-point numbers, the method comprising:

[0007] Generate the encryption key and obfuscation key for the ciphertext to be queried, call the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generate the ciphertext data table;

[0008] The encrypted data table is sent to the cloud server, and the cloud server receives and stores the encrypted data table.

[0009] The second algorithm is invoked to generate a query trap for the ciphertext to be queried, and the query trap is sent to the cloud server.

[0010] The cloud server receives the query trap, calls the fourth algorithm to generate the determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True;

[0011] The set S sent by the cloud server is received, and the range query result of the ciphertext to be queried is obtained.

[0012] Optionally, in the above scheme, the first algorithm is a floating-point plaintext encryption algorithm, floatEncrypt, which includes: receiving a single-precision floating-point number. Safety parameters The encryption key and obfuscation key of length, the data in the ciphertext data table Line number ;

[0013] Determine the floating-point number The positive and negative values, if ,make , note the sign bit ;like , sign bit ;

[0014] Set magnification Extract The amplified base Sum of Indices ; wherein, the index Add 38 to the true index;

[0015] For an exponent of length 7 bits Encode; set an integer ,make

[0016]

[0017] Let be a pseudo-random function, where, For key space, Represents the set of integers , Modulus The remaining classes; the data to be encoded ,set up yes The binary representation of; for ,calculate

[0018]

[0019] Among them, symbols This indicates data cascading; where n takes the value 7.

[0020] make Make the pseudo-random function For a 24-bit base Encode and output Where n2 takes the value 24; adding the sign bit, we get The encoding is ,data The encoding function is The output of the function is ;

[0021] Let pseudo-random function ,in, Represents the set of natural numbers. This represents a vector containing 32 components, each component taking the value of... Chinese; calculation ;

[0022] Calculate plaintext data ciphertext ,symbol express and The ciphertext is obtained by adding the components modulo 3. ,in, For the sign bit ;

[0023] Output the ciphertext .

[0024] In the above scheme, optionally, the second algorithm is a range query trapdoor generation algorithm floatTrapGen, including:

[0025] Receive the plaintext starting value of the range query. and the endpoint floating-point number And satisfy The encryption key and the obfuscation key;

[0026] The ciphertext of the starting point of the range query Wherein, key1 is the encryption key;

[0027] ciphertext of the endpoint of the range query Wherein, key2 is the obfuscation key;

[0028] Output range query trap .

[0029] In the above scheme, optionally, the invocation of the fourth algorithm is a range query determination algorithm floatRangeQuery, including:

[0030] Trapdoor for receiving the range query ciphertext in the data table The ciphertext Data row number , Mixed key key2;

[0031] For ciphertext Perform deobfuscation and calculation ,calculate ,symbol express and Subtract the components modulo 3;

[0032] Call the third algorithm to calculate

[0033] and ,

[0034] If the above and If the first result is true, then result = True; otherwise, result = False. Output the first result.

[0035] In the above scheme, optionally, if the and If the first result is true, then result = True; otherwise, result = False. Output the first result, specifically: Indicates the corresponding plaintext Indicates the corresponding plaintext The second condition is required; if both the first and second conditions are met, then the ciphertext is considered true. Corresponding plaintext The range of queries If the first result is True, then the first result is False; otherwise, it is not satisfied.

[0036] Optionally, in the above scheme, the third algorithm is a ciphertext data size comparison algorithm, floatCompare, which includes:

[0037] Receive encrypted data and ;

[0038] Algorithm output: Size comparison result.

[0039] make , , of which all ;

[0040] like and If the results are the same, then result=0, and the algorithm ends.

[0041] like and If the result is positive, then result = 1; otherwise, result = -1, and the algorithm ends.

[0042] set up It makes The smallest positive integer is then ;

[0043] like If the result is negative, then result = -1; otherwise, result = 1.

[0044] like Then take the opposite:

[0045] result The algorithm ends when the result is obtained.

[0046] Output the result.

[0047] In the above scheme, optionally, the output result result being -1 indicates that the The corresponding plaintext is smaller than the stated The corresponding plaintext;

[0048] The output result 0 indicates that... The corresponding plaintext is equal to the stated The corresponding plaintext;

[0049] The output result result being 1 indicates that... The corresponding plaintext is greater than the stated The corresponding plaintext.

[0050] Secondly, a ciphertext range query system supporting mixed positive and negative floating-point numbers, the system comprising:

[0051] The generation module is used to generate the encryption key and obfuscation key for the ciphertext to be queried. It calls the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generates the ciphertext data table.

[0052] Sending module: used to send the encrypted data table to the cloud server, and the cloud server receives and stores the encrypted data table;

[0053] Calculation module: used to call the second algorithm to generate a query trap for the ciphertext to be queried, and send the query trap to the cloud server;

[0054] Recording module: When the cloud server receives a query trap, it calls the fourth algorithm to generate a determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True;

[0055] Output module: Used to receive the set S sent by the cloud server and obtain the range query result of the ciphertext to be queried.

[0056] Thirdly, a computer device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps:

[0057] Generate the encryption key and obfuscation key for the ciphertext to be queried, call the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generate the ciphertext data table;

[0058] The encrypted data table is sent to the cloud server, and the cloud server receives and stores the encrypted data table.

[0059] The second algorithm is invoked to generate a query trap for the ciphertext to be queried, and the query trap is sent to the cloud server.

[0060] The cloud server receives the query trap, calls the fourth algorithm to generate the determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True;

[0061] The set S sent by the cloud server is received, and the range query result of the ciphertext to be queried is obtained.

[0062] Fourthly, a computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0063] Generate the encryption key and obfuscation key for the ciphertext to be queried, call the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generate the ciphertext data table;

[0064] The encrypted data table is sent to the cloud server, and the cloud server receives and stores the encrypted data table.

[0065] The second algorithm is invoked to generate a query trap for the ciphertext to be queried, and the query trap is sent to the cloud server.

[0066] The cloud server receives the query trap, calls the fourth algorithm to generate the determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True;

[0067] The set S sent by the cloud server is received, and the range query result of the ciphertext to be queried is obtained.

[0068] The present invention has at least the following beneficial effects:

[0069] Based on further analysis and research of existing technical problems, this invention recognizes that existing solutions have issues such as not supporting ciphertext range queries for floating-point numbers, not supporting ciphertext comparison after encryption of plaintext data with mixed positive and negative values, and difficulty in accurately characterizing the amount of information leakage after data encryption. This invention addresses these problems by having the data owner generate encryption and obfuscation keys for the ciphertext to be queried; calling a first algorithm to encrypt each plaintext floating-point data in a specified column of the ciphertext data table to generate a ciphertext data table; sending the ciphertext data table to a cloud server, which receives and stores the ciphertext data table; calling a second algorithm to generate a query trap for the ciphertext to be queried, and sending the query trap to the cloud server; receiving the query trap, the cloud server calls a fourth algorithm to generate a determination result for the range of the ciphertext to be queried, and records a set S of all data rows whose indices return True according to the fourth algorithm; receiving the set S sent by the cloud server, the cloud server obtains the range query result for the ciphertext to be queried. The algorithm of this invention supports the encryption of floating-point numbers, as well as the corresponding ciphertext comparison and range query. The algorithm is highly efficient, with efficiency almost the same as the most efficient deserialization encryption scheme based on integers. It supports the encryption of plaintext data with mixed positive and negative numbers, and the encrypted ciphertext data can be easily compared and queried in a unified manner. When the ciphertext data of this invention is compared in size, the amount of information leakage can be clearly characterized, thereby providing accurate analysis results on the security of the algorithm. Attached Figure Description

[0070] Figure 1 This is a flowchart illustrating a method for querying ciphertext ranges supporting mixed positive and negative floating-point numbers according to an embodiment of the present invention.

[0071] Figure 2 This is a data interaction diagram illustrating a ciphertext range query method supporting mixed positive and negative floating-point numbers provided in an embodiment of the present invention.

[0072] Figure 3 A database table diagram in plaintext form for a method for querying encrypted ranges of mixed positive and negative floating-point numbers provided in an embodiment of the present invention;

[0073] Figure 4 A database table diagram in ciphertext form for a ciphertext range query method supporting mixed positive and negative floating-point numbers provided in an embodiment of the present invention;

[0074] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0075] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0076] In one embodiment, such as Figure 1 As shown, a method for ciphertext range lookup that supports mixed positive and negative floating-point numbers is provided, including the following steps:

[0077] Generate the encryption key and obfuscation key for the ciphertext to be queried, call the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generate the ciphertext data table;

[0078] The encrypted data table is sent to the cloud server, and the cloud server receives and stores the encrypted data table.

[0079] The second algorithm is invoked to generate a query trap for the ciphertext to be queried, and the query trap is sent to the cloud server.

[0080] The cloud server receives the query trap, calls the fourth algorithm to generate the determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True;

[0081] The set S sent by the cloud server is received, and the range query result of the ciphertext to be queried is obtained.

[0082] In one embodiment, the first algorithm is a floating-point plaintext encryption algorithm, floatEncrypt, comprising: receiving a single-precision floating-point number. Safety parameters The encryption key and obfuscation key of length, the data in the ciphertext data table Line number ;

[0083] Determine the floating-point number The positive and negative values, if ,make , note the sign bit ;like , sign bit ;

[0084] Set magnification Extract The amplified base Sum of Indices ; wherein, the index Add 38 to the true index;

[0085] For an exponent of length 7 bits Encode; set an integer ,make

[0086]

[0087] Let be a pseudo-random function, where, For key space, Represents the set of integers , Modulus The remaining classes; the data to be encoded ,set up yes The binary representation of; for ,calculate

[0088]

[0089] Among them, symbols This indicates data cascading; where n takes the value 7.

[0090] make Make the pseudo-random function 24-bit base Encode and output Where n2 takes the value 24; adding the sign bit, we get The encoding is ,data The encoding function is The output of the function is ;

[0091] Let pseudo-random function ,in, Represents the set of natural numbers. This represents a vector containing 32 components, each component taking the value of... Chinese; calculation ;

[0092] Calculate plaintext data ciphertext ,symbol express and The ciphertext is obtained by adding the components modulo 3. ,in, For the sign bit ;

[0093] Output the ciphertext .

[0094] In one embodiment, the second algorithm is the range query trapdoor generation algorithm floatTrapGen, which includes:

[0095] Receive the plaintext starting value of the range query. and the endpoint floating-point number And satisfy The encryption key and the obfuscation key;

[0096] ciphertext of the starting point of the range query Wherein, key1 is the encryption key;

[0097] ciphertext of the endpoint of the range query Wherein, key2 is the obfuscation key;

[0098] Output range query trap .

[0099] In one embodiment, the invocation of the fourth algorithm is a range query determination algorithm floatRangeQuery, which includes:

[0100] Trapdoor for receiving the range query ciphertext in the data table The ciphertext Data row number , Mixed key key2;

[0101] For ciphertext Perform deobfuscation and calculation ,calculate ,symbol express and Subtract the components modulo 3;

[0102] Call the third algorithm to calculate

[0103] and ,

[0104] If the above and If the first result is true, then result = True; otherwise, result = False. Output the first result.

[0105] In one embodiment, the if the and If the first result is true, then result = True; otherwise, result = False. Output the first result, specifically: Indicates the corresponding plaintext Indicates the corresponding plaintext The second condition is required; if both the first and second conditions are met, then the ciphertext is considered valid. Corresponding plaintext The range of queries If the first result is True, then the first result is False; otherwise, it is not satisfied.

[0106] In one embodiment, the third algorithm is a ciphertext data size comparison algorithm, floatCompare, which includes:

[0107] Receive encrypted data and ;

[0108] Algorithm output: Size comparison result.

[0109] make , , of which all ;

[0110] like and If the results are the same, then result=0, and the algorithm ends.

[0111] like and If the result is positive, then result = 1; otherwise, result = -1, and the algorithm ends.

[0112] set up It makes The smallest positive integer is then ;

[0113] like If the result is negative, then result = -1; otherwise, result = 1.

[0114] like Then take the opposite:

[0115] result The algorithm ends when the result is obtained.

[0116] Output the result.

[0117] In one embodiment, the output result being -1 indicates that... The corresponding plaintext is smaller than the stated The corresponding plaintext;

[0118] The output result 0 indicates that... The corresponding plaintext is equal to the stated The corresponding plaintext;

[0119] The output result result being 1 indicates that... The corresponding plaintext is greater than the stated The corresponding plaintext.

[0120] like Figure 2 As shown, in the above-described method for ciphertext range queries supporting mixed positive and negative floating-point numbers, the plaintext data owner encrypts the data using the encryption key, and the pseudo-random function ensures that the plaintext cannot be recovered from the ciphertext. The start and end points of the range query are also masked using a query trapdoor, thus providing security for both endpoints during the query. Furthermore, by introducing a confusion key, key2, we prevent the data owner and third-party attackers outside the cloud server from obtaining information about the plaintext (such as whether it is the same plaintext as the ciphertext) by observing the ciphertext in the database, because the confused ciphertext becomes a completely pseudo-random number. The cloud server knows that the confusion key, key2, is used to de-obfuscate the ciphertext stored in the database. When the server runs the ciphertext size comparison algorithm, it can obtain information about which bit position the two numbers differ in. Therefore, the amount of information about the plaintext leaked by the ciphertext data is only 1 bit. This is the same as the amount of information leaked in the de-ordering encryption scheme proposed by Chenette et al., and considering the trade-off between security and efficiency, a 1-bit leak is acceptable.

[0121] The algorithms designed in this embodiment are all based on symmetric cryptographic primitives (mainly pseudo-random functions), resulting in high efficiency. Furthermore, extracting the radix and exponent for floating-point numbers is also relatively fast. Our practical tests show that the efficiency of ciphertext range lookup for floating-point numbers is almost identical to that of the integer range lookup scheme proposed by Chenette et al., ensuring practical usability. Moreover, it can be seen that the trapdoor only needs to be calculated once for each range lookup. The ciphertext size comparison algorithm is only related to the trapdoor and the data position index; therefore, the algorithm can be executed concurrently using multi-threading, significantly improving computational efficiency during queries. As can be seen from the plaintext data encryption algorithm, it supports flexible expansion of plaintext data, meeting the needs of scenarios with dynamic changes such as data addition (or deletion) in practice.

[0122] This embodiment designs an efficient and secure ciphertext range query method that supports encrypted range queries for floating-point data with mixed positive and negative numbers. It expands upon existing range query schemes that only support positive integers, thus enabling support for more query scenarios. The algorithm boasts high execution efficiency and supports parallel processing of ciphertext data range determination. It also exhibits good scalability, making it highly suitable for range queries in outsourced databases with large-scale data volumes. The introduction of a confusion key further enhances data security, preventing third-party attackers from knowing the size relationship of the ciphertext data and whether the corresponding plaintext is identical—a feature not found in existing order-preserving and order-decrypting encryption methods. This embodiment's algorithm supports floating-point number encryption, corresponding ciphertext comparison, and range queries. The algorithm is highly efficient, almost identical to the most efficient order-decrypting encryption scheme currently available based on integers. It supports encryption of plaintext data with mixed positive and negative numbers, and the encrypted ciphertext data can be easily compared and queried uniformly. When comparing the size of the ciphertext data in this invention's algorithm, the amount of information leakage can be clearly characterized, thus providing accurate analysis results regarding the algorithm's security.

[0123] In one embodiment, such as Figure 2 As shown, this embodiment proposes an efficient and secure method for querying the range of encrypted data that supports floating-point numbers, which can be applied to encrypted query scenarios such as data outsourcing. The designed encrypted range query method is described below, mainly including four algorithms: a floating-point plaintext encryption algorithm (floatEncrypt), a range query trapdoor generation algorithm (floatTrapGen), an encrypted data size comparison algorithm (floatCompare), and a range query determination algorithm (floatRangeQuery).

[0124] Before describing the algorithm, we first design an encoding method for floating-point numbers. Floating-point numbers can be represented using scientific notation. For positive floating-point numbers... We can represent it as ,in The decimal number representing the interval [1, 10) is called the base. This is called the exponent, and it can be negative. When negative, it means Less than 1.

[0125] In order to encode floating-point numbers, for floating-point numbers... First extract cardinality Sum of Indices Then, the base number is multiplied by a certain factor. Rounded down to the nearest integer We are dealing with integers. Sum of Indices Encryption is performed separately using existing methods for integers. If Since it's a negative number, we encode its sign bit separately. It can be seen that the magnification factor... This determines the precision we use when comparing data. Taking the commonly used single-precision floating-point numbers as an example, here we can choose... This achieves a comparison precision of 7 significant digits (the base integer digit plus the amplified 6 integer digits).

[0126] For single-precision floating-point numbers, the exponent The range is between [−38, 38]. To avoid separately encoding the sign bit of the exponent, we add 38 to all extracted exponents to make them non-negative. At this point, the exponent range becomes [0, 76], which can be represented using a maximum of 7 bits.

[0127] In summary, the amplified base The range is [1000000, 9999999], and it can be represented using a maximum of 24 bits. Adding... The sign bit, in the end, can be represented using 7 + 24 + 1 = 32 bits. The 32-bit encoding length is also well-suited for use with integers in computers during programming implementations.

[0128] Below, we will describe the four algorithms for ciphertext range lookup methods in turn.

[0129] Algorithm 1: Floating-point plaintext encryption algorithm floatEncrypt

[0130] Algorithm input: Single-precision floating-point number Safety parameters The encryption key key1 and obfuscation key key2 of length, and the data in the data table. Line number ;

[0131] Algorithm output: floating-point number ciphertext .

[0132] Algorithm description: (1) Judgment The positive and negative values, if ,make , note the sign bit ;like , sign bit .

[0133] (2) Set the magnification factor Extract The amplified base Sum of Indices The index here Add 38 to the true index.

[0134] (3) First, for the exponent of length 7 bits Encode it. Let the integer be... ,make

[0135]

[0136] It is a pseudo-random function, where For key space, Represents the set of integers , Modulus The remaining classes. For data that needs to be encoded. ,set up yes The binary representation of . ,calculate

[0137]

[0138] Among the symbols This indicates data cascading.

[0139] make Similarly, using the pseudo-random function above... 24-bit base Encode to obtain output Note the encoding in these two instances. The values ​​are different, 7 and 24 respectively. Add a sign bit to record the final result. The encoding is We record the data in this way. The encoding function is The output of this function is .

[0140] (4) Let the pseudo-random function ,in Represents the set of natural numbers. This represents a vector containing 32 components, each component taking the value of... In the middle. Calculation .

[0141] (5) Perform ciphertext obfuscation and calculate plaintext data. ciphertext ,symbol express and The ciphertext is obtained by adding the components modulo 3 (excluding the sign bit). ,in For the sign bit .

[0142] (6) Output ciphertext .

[0143] Algorithm 2: Range query trapdoor generation algorithm floatTrapGen

[0144] To protect the security of the query range, the start and end points of the query also need to be encrypted, generating corresponding range query traps. The cloud server performs ciphertext comparisons based on these query traps, and cannot know the start and end points in plaintext form.

[0145] Algorithm input: Plaintext starting value of the range query and the endpoint floating-point number ,satisfy The keys are key1 and key2;

[0146] Algorithm output: Trapdoors for range queries .

[0147] Algorithm description:

[0148] (1) Calculate the encrypted starting point of the range query ;

[0149] (2) Calculate the ciphertext of the endpoint of the range query. ;

[0150] (3) Output range query trap .

[0151] Algorithm 3: Algorithm for comparing the size of encrypted data: floatCompare

[0152] Algorithm input: Ciphertext data and ;

[0153] Algorithm output: Size comparison result.

[0154] Algorithm description:

[0155] (1) Let , According to the calculations of the previous ciphertext, all of them can be known. .

[0156] (a) If and If they are exactly the same, then the result is 0, and the algorithm ends.

[0157] (b) If and If the result is positive, then result = 1; otherwise, result = -1, and the algorithm ends.

[0158] (c) Let It makes The smallest positive integer, at this time ,like If the result is negative, then set result = -1; otherwise, set result = 1.

[0159] According to our encoding order, we first compare the sign bit, then the exponent, and only if the exponents are the same do we compare the radix. With this encoding order, we no longer need to separately compare the exponent and radix, because the exponent determines the data size first.

[0160] (2) Correct the result based on the sign bit. If Then the result will be inverted:

[0161] result The algorithm ends when the result is displayed.

[0162] (3) Output the result. It can be seen that the results -1, 0, and 1 represent... The corresponding plaintext is less than, equal to, or greater than. The corresponding plaintext.

[0163] Algorithm 4: Range Query Determination Algorithm floatRangeQuery

[0164] Algorithm input: Trapdoor for range queries ciphertext in the data table ciphertext Data row number , Mixed key key2;

[0165] Algorithm output: Ciphertext The result indicates whether the query falls within the specified range.

[0166] Algorithm description:

[0167] (1) For ciphertext Perform deobfuscation and calculation ,calculate ,symbol express and Subtract the components modulo 3 (excluding the sign bit);

[0168] (2) Call the ciphertext data size comparison algorithm floatCompare to calculate

[0169] and ,

[0170] like and If the result is true, then set result=True; otherwise, set result=False.

[0171] It is easy to see that, based on the output of the comparison algorithm floatCompare, Indicates the corresponding plaintext , Indicates the corresponding plaintext Therefore, if both conditions are met simultaneously, it means the ciphertext is encrypted. Corresponding plaintext The range of queries The result is represented by True, otherwise it is represented by False if the condition is not met.

[0172] (3) Output The result indicates whether the query falls within the specified range.

[0173] The ciphertext range lookup method we designed using the above four algorithms (Algorithm 1 to Algorithm 4) that supports mixed positive and negative floating-point numbers executes as follows (e.g.) Figure 2 As shown in the figure, steps 1 and 2 correspond to the generation, sending and storage of encrypted data tables, and steps 3 to 6 correspond to the data range query and result return stages.

[0174] Step 1: The data owner generates an encryption key key1 and a confusion key key2, and calls Algorithm 1 to encrypt each plaintext floating-point data in a specified column of the data table to form the entire ciphertext data table.

[0175] Step 2: The data owner sends the encrypted data table to the cloud server, which receives and stores the encrypted data table.

[0176] Step 3: For the start and end points of the range query, the data owner calls Algorithm 2 to generate a query trap and sends the query trap to the cloud server.

[0177] Step 4: The cloud server receives the query trap, calls Algorithm 4 (which automatically calls Algorithm 3), and records the set S of all data rows whose indices return True.

[0178] Step 5: The cloud server returns set S to the data owner.

[0179] Step 6: The data owner receives set S, the range query ends, and further processing can be performed on the data records represented by set S according to actual needs.

[0180] This embodiment supports encrypted range queries for floating-point data with mixed positive and negative numbers, expanding upon existing range query schemes that only support positive integers, thus enabling support for more query scenarios. The algorithm boasts high execution efficiency and supports parallel processing of ciphertext data range determination. It also exhibits good scalability, making it highly suitable for range queries in outsourced databases with large-scale data volumes. The introduction of a confusion key further enhances data security; third-party attackers cannot determine the size relationship of the ciphertext data or whether the corresponding plaintext is identical—a feature not found in existing order-preserving and order-decrypting encryption. This embodiment's algorithm supports floating-point number encryption, corresponding ciphertext comparison, and range queries. The algorithm is highly efficient, almost identical to the most efficient order-decrypting encryption scheme currently available based on integers. It supports encryption of plaintext data with mixed positive and negative numbers, and the encrypted ciphertext data can be easily compared and queried uniformly. When comparing the size of the ciphertext data in this invention's algorithm, the amount of information leakage can be clearly characterized, thus providing accurate analysis results regarding the algorithm's security.

[0181] In one embodiment, for simplicity, assume the data owner has a data table containing experimental data (floating-point data type) for 10 people. Data fields include index, name, and experimental data. The data table in plaintext format is as follows: Figure 3 As shown.

[0182] Step 1: The data owner encrypts the experimental data fields, creating a ciphertext data table, such as... Figure 4 As shown.

[0183] Choose a pseudo-random function based on SHA-256, and a function from the plaintext encryption algorithm floatEncrypt. and Both are implemented based on SHA-256, with the encryption key key1 and obfuscation key key2 both being 16 bytes, representing the security parameters. It is 128 bits. Specifically,

[0184] key1

[16] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10};

[0185] key2

[16] = {0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x01,0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08}.

[0186] The plaintext encryption algorithm floatEncrypt is called to encrypt each piece of plaintext data sequentially, resulting in a ciphertext data table as follows: Figure 4 As shown, the data owner sends the encrypted data table and obfuscation key2 to the cloud server in a secure manner (such as via the TLS protocol), thus implementing data encryption outsourcing.

[0187] Step 2: Generate query trapdoors based on the start and end points of the query range.

[0188] Assuming the current query range has a start point of -200.26 and an end point of 1.2, the data owner uses the range query trapdoor generation algorithm floatTrapGen to generate the query trapdoor Trap for this query range as follows:

[0189] (12111021200022001021212111212102, 02110001200012200000111022012101).

[0190] The data owner then sends the query trap to the cloud server.

[0191] Step 3: The cloud server performs a range query based on the encrypted data table and the query trap.

[0192] The cloud server reads the encrypted data table, compares the received query traps with the data, and determines whether the encrypted value of each row of experimental data in the table is within the query range. If it is, the row number (index) is output. Specifically, for each row of encrypted data, the range query algorithm `floatRangeQuery` is called. If the algorithm outputs `True`, the row number (index) is saved. After traversing the entire data table, a set of row numbers that satisfy the query range, `S={2, 5, 6, 7, 10}`, is obtained, which is consistent with the query result in plaintext mode. The cloud server sends the query result back to the data owner, and the query ends.

[0193] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0194] In one embodiment, a ciphertext range query system supporting mixed positive and negative floating-point numbers is provided, comprising the following program modules:

[0195] The generation module is used to generate the encryption key and obfuscation key for the ciphertext to be queried. It calls the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generates the ciphertext data table.

[0196] Sending module: used to send the encrypted data table to the cloud server, and the cloud server receives and stores the encrypted data table;

[0197] Calculation module: used to call the second algorithm to generate a query trap for the ciphertext to be queried, and send the query trap to the cloud server;

[0198] Recording module: When the cloud server receives a query trap, it calls the fourth algorithm to generate a determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True;

[0199] Output module: Used to receive the set S sent by the cloud server and obtain the range query result of the ciphertext to be queried.

[0200] Specific limitations regarding the ciphertext range lookup system supporting mixed positive and negative floating-point numbers can be found in the limitations of the ciphertext range lookup method supporting mixed positive and negative floating-point numbers mentioned above, and will not be repeated here. Each module in the aforementioned ciphertext range lookup system supporting mixed positive and negative floating-point numbers can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0201] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, communication interface, display screen, and input system connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a method for querying encrypted ranges supporting mixed positive and negative floating-point numbers. The display screen can be an LCD screen or an e-ink screen. The input system can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0202] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0203] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program relating to all or part of the processes in the methods of the above embodiments.

[0204] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon relating to all or part of the processes in the methods of the above embodiments.

[0205] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0206] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0207] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for querying ciphertext ranges supporting mixed positive and negative floating-point numbers, characterized in that, The method includes: Generate the encryption key and obfuscation key for the ciphertext to be queried, call the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generate the ciphertext data table; The encrypted data table is sent to the cloud server, and the cloud server receives and stores the encrypted data table. The second algorithm is invoked to generate a query trap for the ciphertext to be queried, and the query trap is sent to the cloud server. The cloud server receives the query trap, calls the fourth algorithm to generate the determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True; Receive the set S sent by the cloud server to obtain the range query result of the ciphertext to be queried; The first algorithm is a floating-point plaintext encryption algorithm called floatEncrypt, which includes: receiving single-precision floating-point numbers. Safety parameters The encryption key and obfuscation key of length, the data in the ciphertext data table Line number ; Determine the floating-point number The positive and negative values, if ,make , note the sign bit ;like , sign bit ; Set magnification Extract The amplified base Sum of Indices ; wherein, the index Add 38 to the true index; For an exponent of length 7 bits Encode; set an integer ,make , Let be a pseudo-random function, where, For key space, Represents the set of integers , Modulus The remaining classes; the data to be encoded ,set up yes The binary representation of; for ,calculate Among them, symbols This indicates data cascading; where n takes the value 7. make Make the pseudo-random function 24-bit base Encode and output Where n2 takes the value 24; adding the sign bit, we get The encoding is ,data The encoding function is The output of the function is ; Let pseudo-random function ,in, Represents the set of natural numbers. This represents a vector containing 32 components, each component taking the value of... Chinese; calculation ; Calculate plaintext data ciphertext ,symbol express and The ciphertext is obtained by adding the components modulo 3. ,in, For the sign bit ; Output the ciphertext .

2. The method according to claim 1, characterized in that, The second algorithm is the range query trapdoor generation algorithm floatTrapGen, which includes: Receive the plaintext starting value of the range query. and the endpoint floating-point number And satisfy The encryption key and the obfuscation key; ciphertext of the starting point of the range query ;where key1 is the encryption key; ciphertext of the endpoint of the range query ;where key2 is the obfuscation key; Output range query trap .

3. The method according to claim 2, characterized in that, The fourth algorithm called is the range query determination algorithm floatRangeQuery, which includes: Trapdoor for receiving the range query ciphertext in the data table The ciphertext Data row number , Mixed key key2; For ciphertext Perform deobfuscation and calculation ,calculate ,symbol express and Subtract the components modulo 3; Call the third algorithm to calculate and , If the above and If the first result is true, then result = True; otherwise, result = False. Output the first result.

4. The method according to claim 3, characterized in that, If the and If the first result is true, then result = True; otherwise, result = False. Output the first result, specifically: Indicates the corresponding plaintext Indicates the corresponding plaintext The second condition is required; if both the first and second conditions are met, then the ciphertext is considered valid. Corresponding plaintext The range of queries If the first result is True, then the first result is False; otherwise, it is not satisfied.

5. The method according to claim 3, characterized in that, The third algorithm is the ciphertext data size comparison algorithm floatCompare, which includes: Receive encrypted data and ; Algorithm output: Size comparison result; make , , of which all ; like and If the results are the same, then result=0, and the algorithm ends. like and If the result is positive, then result = 1; otherwise, result = -1, and the algorithm ends. set up It makes The smallest positive integer is then ; like If the result is negative, then result = -1; otherwise, result = 1. like Then take the opposite: result The algorithm ends when the result is obtained. Output the result.

6. The method according to claim 5, characterized in that, The output result result being -1 indicates that... The corresponding plaintext is smaller than the stated The corresponding plaintext; The output result 0 indicates that... The corresponding plaintext is equal to the stated The corresponding plaintext; The output result result being 1 indicates that... The corresponding plaintext is greater than the stated The corresponding plaintext.

7. A ciphertext range query system supporting mixed positive and negative floating-point numbers, characterized in that, The system includes: The generation module is used to generate the encryption key and obfuscation key for the ciphertext to be queried. It calls the first algorithm to encrypt each plaintext floating-point data in the specified column of the ciphertext data table to be queried, and generates the ciphertext data table. Sending module: used to send the encrypted data table to the cloud server, and the cloud server receives and stores the encrypted data table; Calculation module: used to call the second algorithm to generate a query trap for the ciphertext to be queried, and send the query trap to the cloud server; Recording module: When the cloud server receives a query trap, it calls the fourth algorithm to generate a determination result of the range of the ciphertext to be queried, and records the set S of all data row indices that the fourth algorithm returns True; Output module: Used to receive the set S sent by the cloud server and obtain the range query result of the ciphertext to be queried; The first algorithm is a floating-point plaintext encryption algorithm called floatEncrypt, which includes: receiving single-precision floating-point numbers. Safety parameters The encryption key and obfuscation key of length, the data in the ciphertext data table Line number ; Determine the floating-point number The positive and negative values, if ,make , note the sign bit ;like , sign bit ; Set magnification Extract The amplified base Sum of Indices ; wherein, the index Add 38 to the true index; For an exponent of length 7 bits Encode; set an integer ,make ， Let be a pseudo-random function, where, For key space, Represents the set of integers , Modulus The remaining classes; the data to be encoded ,set up yes The binary representation of; for ,calculate ， Among them, symbols This indicates data cascading; where n takes the value 7. make Make the pseudo-random function 24-bit base Encode and output Where n2 takes the value 24; adding the sign bit, we get The encoding is ,data The encoding function is The output of the function is ; Let pseudo-random function ,in, Represents the set of natural numbers. This represents a vector containing 32 components, each component taking the value of... Chinese; calculation ; Calculate plaintext data ciphertext ,symbol express and The ciphertext is obtained by adding the components modulo 3. ,in, For the sign bit ; Output the ciphertext .

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images