A privacy protection multi-dimensional range query method and device and a storage medium

Abstract

The present application belongs to the field of data encryption, and relates to a privacy protection multi-dimensional range query method and device and a storage medium, wherein the method comprises the following steps: a data owner generates a key required for an entire ciphertext range query; the data owner constructs an HHCB tree by using a layered Hilbert encoded ciphertext; a data user encodes a query range according to a layered Hilbert encoding mode, and generates a query threshold by using a hash function to perform hash mapping on a range encoding set; and a cloud database performs query expansion on the HHCB tree by using the query threshold, and returns a query result obtained to the data user. Compared with the prior art, the present application introduces a layered Hilbert encoding mode, reduces a cumbersome encryption and decryption calculation process during query, improves query efficiency, introduces an approximate encoding division method in index construction, improves traversal efficiency, and is more suitable for an actual cloud ciphertext database scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data encryption, and in particular to a privacy protection multi-dimensional range query method and device based on hierarchical Hilbert coding and a storage medium. BACKGROUND

[0002] In an untrusted cloud service environment, data owners usually upload data to the cloud server after encryption. The current multi-dimensional data encryption method can support privacy protection multi-dimensional query, but the increase of data dimensions and the wide space division interval lead to an increase in redundant data in the cloud server query results and a decrease in query efficiency. Based on this situation, there are already range query technologies for data ciphertext, but these technologies still have corresponding problems in ciphertext data range query and verification. For example, Songyui Wu et al. proposed a verifiable range query method for multi-dimensional ciphertext data in the paper "ServeDB: Secure, Verifiable, and Efficient Range Queries on Outsourced Database" (2019 IEEE 35th International Conference on Data Engineering (ICDE)). The method first encrypts the multi-dimensional data using AES, and then converts the multi-dimensional data into a series of cube codes in order to hide the data information of the multi-dimensional data, and then constructs an index structure with a standard type Bloom filter as a node for storage, so that the cloud database can compare whether the multi-dimensional data meets the query range without decryption. However, this scheme still has deficiencies. In the process of constructing the index tree, the data stored in the left and right child nodes is randomly divided, which makes it impossible to effectively query the adjacent data in the multi-dimensional space when performing deep traversal, and the same node needs to be traversed multiple times, increasing the computational overhead and reducing the query efficiency. SUMMARY

[0003] The present application aims to solve the defects of the prior art verification query method for ciphertext data, which has a large computational overhead and low query efficiency, and provides a privacy protection multi-dimensional range query method and device based on hierarchical Hilbert coding and a storage medium. The method divides the multi-dimensional space in a fine-grained manner through hierarchical Hilbert coding and encodes the multi-dimensional data in layers to avoid data order characteristic leakage, and at the same time, combines a counting Bloom filter (CBF) with the encoded data to construct an index structure for secure retrieval of ciphertext, which can be used for range query of the multi-dimensional data received by the cloud database in a cloud storage environment.

[0004] The object of the application can be achieved by the following technical solutions:

[0005] A privacy protection multi-dimensional range query method based on hierarchical Hilbert coding, comprising the following steps:

[0006] S1: The data owner generates the key required for the entire ciphertext range query;

[0007] S2: The data owner constructs a HHCB tree (Hierarchical Hilbert Counting Bloom Filter Tree, HHCB tree) using the ciphertext after hierarchical Hilbert coding;

[0008] S3: The data user encodes the query range according to the hierarchical Hilbert coding mode in S2, and uses a hash function to hash map the range encoding set to generate the query threshold required for multi-dimensional data query;

[0009] S4: The cloud database uses the query threshold to query the HHCB tree, and returns the query result obtained to the data user.

[0010] In S1, the data owner encrypts the multi-dimensional data by inputting a security parameter λ and outputting a symmetric key sk, outputting an HMAC hash function key key, and a random number r required for a tree node r = {r1,..., r 2n+1}, wherein n is the dimension of the multi-dimensional data.

[0011] S2 comprises the following steps:

[0012] S21: The data owner uses hierarchical Hilbert coding to hide data information while realizing the conversion of n-dimensional data to k-dimensional data, that is, to map the multi-dimensional data to a k-finely-divided multi-dimensional space, and each multi-dimensional data in the corresponding i-layer space generates a corresponding i-layer Hilbert code according to the Hilbert coding mode, and finally each multi-dimensional data is composed of an encoding set containing k Hilbert codes;

[0013] S22: Construct a HHCB index tree according to the Hilbert coding, wherein each node of the HHCB index tree is a counting Bloom filter (Counting Bloom Filter, CBF), and the encoded data is mapped into the Bloom filter;

[0014] S23: The root node of the HHCB index tree stores all the data encodings, and its left and right child nodes store half of the data encodings in the parent node, respectively. The root node data is allocated to its left and right child nodes according to the approximate encoding division algorithm, and the process is repeated until a leaf node containing only one multi-dimensional data encoding is generated.

[0015] The S21 includes the following steps:

[0016] S211: The data owner confirms the maximum and minimum values of each dimension of the multi-dimensional data, sets the edge length of the minimum interval unit, determines the value of k, and divides the multi-dimensional data into k layers of space.

[0017] S212: Hilbert encoding is performed on the multi-dimensional data of each layer, and each Hilbert encoding H c (o) acting on the HMAC function to generate the data encoding of the layer where the difference code diff_num = 0.00001 * L i to avoid the same encoding in different levels, key is the hash key, L i represents the number of levels; each multi-dimensional data has k Hilbert encodings, which together form the hierarchical Hilbert encoding of the multi-dimensional data o, and the minimum interval unit of the kth layer contains at most one multi-dimensional data item during the encoding process.

[0018] The value of k satisfies: |upper bound - lower bound| < 2 k *Step, where Step is the edge length of the minimum interval unit, which is less than the minimum distance between data on the number axis of each dimension of the multi-dimensional data.

[0019] The S3 includes the following steps:

[0020] S31: The data user sends a query request for a multi-dimensional data range query and marks the query range as Q. The hierarchical Hilbert encoding is used to convert the query range Q to obtain a range encoding set {Q}.

[0021] S32: The HMAC function is used to perform r times of operation on each data in the range encoding set {Q} to obtain k*r HMAC addresses, and a query threshold matrix T {Q} is formed based on the addresses.

[0022] The S4 includes the following steps:

[0023] S41: In the cloud data query process, it is judged whether the query threshold matrix T {Q} matches the Bloom filter in the HHCB index tree. If it matches, the left and right child nodes are continued to be queried until the leaf node stops searching. If it does not match, all the child nodes under the current node no longer participate in the query traversal.

[0024] S42: The cloud database stores the query result meeting the query condition into a query result set R;

[0025] S43: The cloud database returns the query result set R to the data user, and the data user decrypts the query result set R to obtain the final result.

[0026] In the S41, it is judged whether the query threshold matrix T {Q} Whether the HMAC address of any i-th row in T

[0027] checks the HMAC address of any i-th row in T {Q} is greater than or equal to 1 at the corresponding address of the Bloom filter in each node,

[0028] If the HMAC address of any i-th row in T {Q} is greater than or equal to 1 at the corresponding address of the Bloom filter in each node, it indicates that the multi-dimensional data corresponding to the i-th row HMAC address has an intersection with the encoded query range, and there is data in the current node that meets the query range, that is, the query threshold matrix T {Q} matches the Bloom filter in the HHCB index tree.

[0029] If the HMAC address of any i-th row in T {Q} is not greater than or equal to 1 at the corresponding address of the Bloom filter in each node, it indicates that the Bloom filter does not contain the multi-dimensional data o i corresponding to the i-th row HMAC address, and the left and right child nodes of the node containing the Bloom filter in the HHCB index tree also do not contain the multi-dimensional data o i , that is, the query threshold matrix T {Q} does not match the Bloom filter in the HHCB index tree.

[0030] A privacy protection multi-dimensional range query device based on hierarchical Hilbert coding, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the method as described above when executing the program.

[0031] A storage medium having a program stored thereon, wherein the program is executed to implement the method as described above.

[0032] Compared with the prior art, the present application has the following beneficial effects:

[0033] (1) The present application introduces a hierarchical Hilbert coding method to finely divide the multi-dimensional space and layer-encode the multi-dimensional data to avoid data order characteristic leakage and reduce the cumbersome encryption and decryption calculation process during query, thereby improving the query efficiency.

[0034] (2) The application combines a counting Bloom filter with encoded data to construct an index structure, and introduces an approximate encoding division method to improve traversal efficiency.

[0035] (3) The application overcomes the defects of large calculation overhead and low query efficiency in the prior art, and can be better used in actual cloud ciphertext database scenarios to simultaneously perform range query on received ciphertext multi-dimensional data of the cloud database in a cloud storage background. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 is a method flowchart of the application;

[0037] Figure 2 is a k value determination diagram in layered Hilbert encoding;

[0038] Figure 3 is a layered Hilbert encoding mode schematic diagram;

[0039] Figure 4 is a range encoding schematic diagram in the layered Hilbert encoding mode;

[0040] Figure 5 is a HHCB tree structure and CBF structure schematic diagram. DETAILED DESCRIPTION

[0041] The application will be described in detail below in combination with the drawings and specific embodiments. The present embodiment is implemented on the premise of the technical solution of the application, and gives a detailed implementation mode and specific operation process, but the protection scope of the application is not limited to the following embodiments.

[0042] The present embodiment provides a privacy protection multi-dimensional range query method based on layered Hilbert encoding, as shown in Figure 1 The method comprises the following steps:

[0043] S1: The data owner generates a key required for the entire ciphertext range query.

[0044] S2: The data owner encodes multi-dimensional plaintext data using a layered Hilbert encoding mode, constructs a HHCB tree (Hierarchical Hilbert Counting Bloom Filter Tree, HHCB tree) based on the encoded ciphertext, each node is constructed by a counting Bloom filter, and the data division is divided according to an approximate encoding division algorithm when constructing.

[0045] S21: The data owner uses hierarchical Hilbert coding to realize the conversion of n-dimensional data to k-dimensional data while hiding data information, i.e., mapping multi-dimensional data to k fine-grained partitioned multi-dimensional spaces, each multi-dimensional data in the corresponding i-th layer space generates a corresponding i-th layer Hilbert code according to the Hilbert coding mode, and finally each multi-dimensional data is composed of an encoding set containing k Hilbert codes.

[0046] S211: The data owner confirms the maximum and minimum values of each dimension of the multi-dimensional data, sets the edge length of the minimum interval unit, determines the value of k, and divides the multi-dimensional data into k layers of spaces.

[0047] S212: Hilbert coding is used for multi-dimensional data in each layer, and each Hilbert code H c (o) acting on the HMAC function to generate the layer data code where the difference code diff_num = 0.00001 x L i for avoiding the same encoding in different layers, key is a hash key, L i represents the number of layers; each multi-dimensional data has k Hilbert codes, which together form the hierarchical Hilbert code of the multi-dimensional data o, and the minimum interval unit in the k-th layer contains at most one multi-dimensional data item in the encoding process.

[0048] S22: Constructing an HHCB index tree according to Hilbert coding, wherein each node of the HHCB index tree is a counting Bloom filter (CBF), and the coded data is mapped into the Bloom filter.

[0049] S23: The root node of the HHCB index tree stores the codes of all data, and the left and right child nodes of the root node store half of the data codes in the parent node, respectively. The root node data is allocated to its left and right child nodes according to the approximate coding division algorithm, and the process is repeated until a leaf node containing only one multi-dimensional data code is generated.

[0050] S3: The data user encodes the query range according to the hierarchical Hilbert coding mode in S2, and uses a hash function to hash map the range code set to generate the query threshold required for multi-dimensional data query, and sends it to the cloud database.

[0051] S31: The data user sends a query request for multi-dimensional data range query, marks the query range as Q, and uses hierarchical Hilbert coding to convert the query range Q to obtain a range code set {Q};

[0052] S32: r times operation is performed on each data in the range encoding set {Q} by using the HMAC function, to obtain k*r HMAC addresses, and the query threshold matrix T is formed based on the addresses {Q} .

[0053] S4: the cloud database expands the query on the HHCB tree by using the query threshold, and returns the obtained query result to the data user.

[0054] S41: in the cloud data query process, it is judged whether the query threshold matrix T {Q} matches the Bloom filter in the HHCB index tree, that is, it is checked whether the values stored at the corresponding addresses of the Bloom filter in each node of the HMAC address of any ith row in T {Q} are all greater than or equal to 1. The matching principle is as follows:

[0055] S411: if the values stored at the corresponding addresses of the Bloom filter in each node of the HMAC address of any ith row in T {Q} are all greater than or equal to 1, it indicates that the multi-dimensional data corresponding to the ith row HMAC address has an intersection with the encoded query range, and there is data in the current node that meets the query range data.

[0056] S412: if the values stored at the corresponding addresses of the Bloom filter in each node of the HMAC address of any ith row in T {Q} are not all greater than or equal to 1, it indicates that the Bloom filter does not contain the multi-dimensional data o i corresponding to the ith row HMAC address, and the left and right child nodes of the node containing the Bloom filter in the HHCB index tree also do not contain the multi-dimensional data o i .

[0057] If S411 is met, the left and right child nodes are continuously queried until the leaf node stops searching; if S421 is met, all the child nodes under the current node do not participate in the query traversal.

[0058] S42: the cloud database stores the query results meeting the query condition into the query result set R.

[0059] S43: the cloud database returns the query result set R to the data user, and the data user decrypts the query result set R to obtain the final result.

[0060] If the above functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0061] The following provides a preferred embodiment, in which the experiment is run under Windows 10 system, and the machine configuration is: 2.90GHz AMD Ryzen 7 4800H processor, 16GB memory; the number of hash functions r = 10, the CBF false rejection rate f = 0.00001.

[0062] This embodiment selects a real data set as the experimental data set, which contains 420768 data, and is expanded to 500,000 data by artificial replication. The specific implementation process of the privacy protection multi-dimensional range query method based on hierarchical Hilbert coding is introduced as follows.

[0063] Step 1: The data owner encrypts the multi-dimensional plaintext data using the AES algorithm and generates all the keys required by the scheme.

[0064] Input the security parameter λ, output the symmetric key sk to encrypt the multi-dimensional data, output the HMAC hash function key, and the random number r = {r1,..., r 2n+1}, wherein n is the dimension of the multi-dimensional data.

[0065] Step 2: The data owner uses hierarchical Hilbert coding to encode the data and generates HHCB index tree using the encoded data.

[0066] The data encoding method for constructing the HHCB index tree and the encoding method for the query range are both based on the hierarchical Hilbert coding system (HHCS), and the two encoding methods are similar but slightly different. In the HHCS coding system, in order to reduce the final query error, the value of k is determined by dividing the space into fine granularity. The following will be specifically introduced:

[0067] B1: First, determine the value of k. For example, Figure 2The figure shows the determination of k value in hierarchical Hilbert coding, which is the basis of hierarchical Hilbert coding division. The k value is equal to the order of Hilbert coding, and the determination of k value is to determine the order of Hilbert curve to be divided. In the k-th order division space, each minimum interval unit contains more than one data item. The following is an example to illustrate the determination method of k value.

[0068] Figure 2 The one-dimensional number axis in (a) contains three data x1, x2, x3, and |x3-x2| is the minimum interval Min_step between the data on the axis. Any interval smaller than Min_step is called a minimum interval unit Step. Figure 2 In (b), x1, x2, x3 are independently distributed in the minimum interval unit of one-dimensional number axis. When the calculation condition |upper bound-lower bound|<2 k *Step is met, the k value can be determined. Expanding to N-dimensional space, k i is the k value obtained in the i-th dimension. Figure 2 (c) is a two-dimensional space divided by Step, a, b, and c are the expansion of x1, x2, and x3 to two-dimensional space, and each of them exists independently in the two-dimensional minimum interval space, and each minimum interval space contains at most one data.

[0069] B2: According to the determined k value, generate codes for multi-dimensional data and multi-dimensional range using hierarchical Hilbert coding system. Further, the specific steps of B2 are as follows:

[0070] The data owner establishes a basic N-dimensional cube as the hierarchical iteration basis. For a given multi-dimensional data set D={D1,..,D n Determine the maximum and minimum values of each dimension of D. Divide each dimension of the basic N-dimensional cube into two, generating 2 N N-dimensional sub-cubes 1_sub_cubes of the same size, and so on. The i+1-th layer N-dimensional sub-cubes are generated by equally dividing each i-layer N-dimensional sub-cubes 2 N , and so on, until the k-th layer stops. k is the total number of hierarchical layers of the basic N-dimensional cube. After k times of hierarchical division, each sub-cube in the k-th layer has a side length less than a given threshold and contains at most one data. Figure 3 A basic 2-dimensional cube is given, with each dimension range in [0,8]. After one division, it is divided into 4 1_sub_cubes, and after two divisions, each 1_sub_cube is divided into 4 2_sub_cubes, generating a total of 16 2_sub_cubes.

[0071] B3: Obtain the HHCS encoding of multi-dimensional data. The encoding of different levels of sub-cubes is unique, and the encoding of the ith level sub-cube is the encoding of the multi-dimensional data contained therein at the ith level. Assuming that there is an ith level sub-cube g containing multi-dimensional data D j , the spatial coordinates (x b , y b ) of g are represented by b-bit binary, b = i. The ith level sub-cube g generates the corresponding Hilbert encoding H b (x b , y c ) according to the static evolution rule for the spatial coordinates (x b , y b ), and the HHCS encoding C of the ith level sub-cube g is C = HMAC (key, H c (x b , y b )) + diff_num, where the difference code diff_num = 0.00001 x L i is used to avoid the same encoding at different levels, and finally the sum of the ith level Hilbert encoding and the difference code is operated by using the hash function HMAC and the key key. Meanwhile, C i is also the encoding of the multi-dimensional data D j at the ith level.

[0072] B4: The data owner generates the HHCS encoding of the multi-dimensional data. The final HHCS encoding of a multi-dimensional data is a coding set composed of the HHCS encodings of k levels. Taking the multi-dimensional data D1 in Figure 3 as an example, k = 3. First, the spatial coordinates (0, 0) of the sub-cube where D1 is located after one division are obtained, and then the Hilbert encoding Hc (0, 0) = 0 is calculated. The HHCS encoding C1 of one division is C1 = HMAC (key, 0.00001), and key is the key. Finally, the above process is repeated until k levels. The HHCS encodings of D1 at the second and third levels are C2 = HMAC (key, 3.00002) and C3 = HMAC (key, 7.00003), respectively. The final encoding set C D1 of D1 is C D1 = {C1, C2, C3}.

[0073] B5: The data owner generates the HHCS encoding of the query range. In order to avoid the coding set being too large when the range is encoded to k levels, the HHCS encoding system generates the query range coding set from top to bottom according to the level order. From one division, the HHCS encoding system finds a level i sub-cube that satisfies the query range, and if the spatial represented by the ith level sub-cube is completely contained in the query range, the corresponding encoding is added to the query coding set, otherwise the next level sub-cube is accessed, and the above operation is repeated until k levels. If the spatial represented by the k level sub-cube is partially contained in the query range, the corresponding encoding is also added to the query coding set.

[0074] In Figure 4 For example, in the two-dimensional query range Q, in the first layer of sub-cubes 1_sub_cubes, the coding area 2 is larger than the query range, and no sub-cube is completely contained in the range Q, so the next layer of sub-cubes is accessed. In the second layer of sub-cubes 2_sub_cubes, the coding area 8 is completely covered by the query range, so the hierarchical coding C a is added to the query range coding set. In 3_sub_cubes, the coding area 45 and the coding area 46 satisfy Q except C a The remaining query range is the area C b ,C c is added to the query range coding set. The final query range coding set of Q is C Q ={C a ,C b ,C c}. C b ,C c represents the area of the k-layer sub-cube that does not completely satisfy the query range. Although the k-layer sub-cube contains at most one data, there are still very few range edge data in the query result. In this case, the data user is required to decrypt the query result and filter out the very few range edge data that do not meet the requirements.

[0075] B6: The multi-dimensional data and the query range use the HHCS coding set to determine whether the two sets intersect, avoiding the disclosure of the data order characteristics in the query process. Figure 4 In the example, the coding set C M ={g1 = HMAC(key, 2.00001), g2 = HMAC(key, 8.00002), g3 = HMAC(key, 33.00003)} of the multi-dimensional data M. The HHCS coding set C Q ={C a = HMAC(key, 8.00002), C b = HMAC(key,

[0076] 46.00003), C c = HMAC(key, 45.00003)}. C T ∩ C Q ={g2 = C a}, then M satisfies the Q range.

[0077] Step three: create an index HHCBtree based on HHCS coding. HHCBtree is a highly balanced binary tree created on the HHCS coded data, created from top to bottom. It is composed of n-1 non-leaf nodes and n leaf nodes, and the nodes are composed of CBF, and the leaf nodes are connected to encrypted multi-dimensional data.

[0078] C1: The CBF size of a node in an HHCBtree varies with the amount of data stored within it. Given a dataset D = {D1, ..., D...} n}, D's HHCS encoding set C D ={C D1 ,…,C Dn},C Di ={c1,…,c k Given a fixed CBF error rate f and a fixed number of hash functions r, formula (1) can determine the size p of the node's CBF, where n is the number of data inserted into the CBF and e is the natural logarithm.

[0079]

[0080] Multidimensional data D i HHCS encoding C Di Storing in CBF involves three steps:

[0081] C11: One-way mapping. For encoding. j∈[1,k], given r keys key1,…,key r And HMAC, we can calculate r corresponding hash addresses HMAC(key1, c) j ),…,HMAC(key r ,c j ).

[0082] C12: Decorrelation. Connect r hash addresses with a random number α. i(i＝1,…,2n-1) The second hash mapping generates r new hash addresses HMAC(α) i HMAC(key1,c j ))%p,..,HMAC(α i HMAC(key) r ,c j ))%p, random number α i This prevents identical data from generating the same address value, making it impossible to statistically count the number of identical data items across different nodes.

[19] .

[0083] C13: Mapped storage. Increment the counters at the new r hash addresses in CBF by 1. Di If all k codes in D complete the steps of single-item mapping, decorrelation, and mapping storage, then D i Storage complete. Figure 5 (b) demonstrated D i In CBF's stored procedures.

[0084] The specific creation process for C2: HHCBtree is as follows:

[0085] C21: Root node CBF stores C D and all data, left and right nodes of root store C D and C Dleft after random bipartition Dright and E D is encrypted multidimensional data set, consistent with C D partition, E D is divided into two subsets E Dleft and E Dright , E D is C D encoded corresponding encrypted data.

[0086] C22: If the total amount of data of parent node n is even, left and right nodes store data using approximate encoding partition |C Dleft | = |C Dright |, if n is odd, approximate encoding partition |C Dleft | = |C Dright | + 1, that is, the left node has one more data than the right node. In this way, until the size of the set is 1. When the encoding set C D contains only one data item, the encoding set, at this time, reaches the creation condition of leaf node, generates the corresponding CBF, and the leaf node is connected with the corresponding encrypted multidimensional data. When C D is empty set, no longer create CBF, that is, recursive termination, convergence. Figure 5 (a) is HHCBtree containing 10 data. The approximate encoding partition pseudo code is as follows:

[0087] Algorithm 1: Approximate encoding partition (ApproximateCodePartition)

[0088]

[0089] Step four: data user generates query threshold.

[0090] Given the query range Q = [a, b], the range encoding set C Q = {c1, …, c q}, c i(i＝1,..,q) , the data user will use r keys to perform r times HMAC operation on each encoding in C Q to generate query door T [Q] : { { HMAC (key1, c1), …, HMAC (key r , c1)}, …, { HMAC (key1, c i ), …, HMAC (key r , c i )}, …, { HMAC (key1, cq ),…,HMAC(key r ,c q )}}.

[0091] Step 5: The cloud database performs a range query based on the query threshold and the HHCBtree.

[0092] E1: CBF matching. Utilizing the random number node.α in the node. i For T qr Chinese encoding T ij(i∈[1,q]；j∈[1,r]) The final hash address value is obtained by performing a second hash operation [T]. qr If the query threshold [T] is... qr There exists a row i (1≤i≤q) where any column j (1≤j≤r) satisfies node.CBF[[T ij If ]mod node.p]≥1, then If at least one data point in CBF satisfies the query conditions, then CBF is considered a successful match.

[0093] E2: If the query threshold [T] qr For any row i (1≤i≤q), for any column j (1≤j≤r), there exists node.CBF[[T ij If [mod node.p] = 0, then This indicates that there is no data in CBF that meets the query conditions, and CBF matching failed.

[0094] E3: Traverse the HHCB tree using a query threshold. The root node of HHCBtree T is denoted by `root`. During tree traversal, if a CBF match is successfully achieved when visiting a node, continue traversing the left and right subtrees until the leaf node is reached, and then add the result to the query ciphertext result set R. If... If the data stored in the node does not meet the query conditions, the traversal ends. During the traversal, if there exists a node in the j-th column of the i-th (1≤i≤q) row that satisfies node.CBF[[T], then the traversal ends. ij If `modnode.p` = 0, then the i-th row will be removed from the query threshold to avoid repeated CBF matching in invalid ranges, because the data set stored in the child node CBF is... When the parent node's data set does not intersect with the query threshold The child node data set and the query threshold are also disjoint.

[0095] The preferred embodiments of the present application have been described above in detail. It should be understood that modifications and variations to the preferred embodiments could be made by those skilled in the art in light of the teachings above without departing from the spirit of the present application. It is therefore to be understood that what is desired to be protected by letters patent is defined by the scope of the claims below and that on the basis of the teachings of the present application, obvious modifications and equivalents can be adopted by those skilled in the art in their possession of the teachings of the present application without departing from the spirit and scope of the application.

Claims

1. A privacy-preserving multidimensional range query method based on hierarchical Hilbert coding, characterized in that, Includes the following steps: S1: The data owner generates the key required for querying the entire encrypted range; S2: The data owner constructs an HHCB tree using the ciphertext encoded by the layered Hilbert; S3: Data users encode the multidimensional range query conditions according to the hierarchical Hilbert encoding method in S2, and use a hash function to perform hash mapping on the range encoding set to generate the query threshold required for multidimensional data query. S4: The cloud database uses the query threshold to perform a query on the HHCB tree and returns the query results to the data user. S2 includes the following steps: S21: The data owner utilizes hierarchical Hilbert coding to achieve... n Dimensional Data k The transformation of multidimensional data while hiding data information, that is, mapping multidimensional data to... k A finely divided multidimensional space, where each multidimensional data point is in the corresponding... i In each layer space, the corresponding first layer is generated according to the Hilbert encoding method. i Layered Hilbert encoding, ultimately each multidimensional data point is represented by a single Hilbert layer. k It consists of a set of Hilbert codes; S22: Construct an HHCB index tree based on Hilbert encoding, where each node of the HHCB index tree is a counting Bloom filter, mapping the encoded data into the Bloom filter; S23: The root node of the HHCB index tree stores the encoding of all data, and its left and right child nodes each store half of the data encoding of its parent node. The root node data is distributed to its left and right child nodes according to the approximate encoding partitioning algorithm, and so on until a leaf node containing only one multidimensional data encoding is generated. S21 includes the following steps: S211: The data owner confirms the maximum and minimum values ​​of each dimension of the multidimensional data, sets the side length of the minimum interval unit, and determines... k Values, for dividing multidimensional data k Layer space; S212: Apply Hilbert encoding to the multidimensional data at each layer, and then convert each Hilbert encoding... H c ( o The HMAC function is used to generate the data encoding for this layer. The distinguishing code diff_num =0.00001 L i Used to avoid the same encoding at different levels key For hash keys, L i Indicates the number of levels; each multidimensional data has k Each Hilbert code together constitutes a multidimensional data. o The hierarchical Hilbert encoding, and the first step in the encoding process k The smallest interval unit of a layer contains at most one multidimensional data item.

2. The privacy-preserving multidimensional range query method based on hierarchical Hilbert coding according to claim 1, characterized in that, In step S1, the data owner encrypts multidimensional data by inputting security parameters and outputting a symmetric key, and outputs an HMAC hash function key and the random number required for the tree node.

3. The privacy-preserving multidimensional range query method based on hierarchical Hilbert coding according to claim 1, characterized in that, The k The value satisfies: |upper bound - lower bound| < 2 k * Step ,in, Step It is the side length of the smallest interval unit, which is smaller than the minimum spacing between data on the number axis of each dimension of the multidimensional data.

4. The privacy-preserving multidimensional range query method based on hierarchical Hilbert coding according to claim 1, characterized in that, S3 includes the following steps: S31: The data user sends a query request for a multidimensional data range query and marks its query range as Q. The query range Q is transformed using hierarchical Hilbert coding to obtain the range coding set {Q}. S32: Use the HMAC function to process each data in the range encoding set {Q} r After one operation, we obtain k * r A set of HMAC addresses, forming a query threshold matrix T based on the addresses. {Q} .

5. The privacy-preserving multidimensional range query method based on hierarchical Hilbert coding according to claim 4, characterized in that, S4 includes the following steps: S41: During cloud data querying, determine the query threshold matrix T. {Q} If the current node matches the Bloom filter in the HHCB index tree, the query continues to search the left and right child nodes until the leaf node is reached. If the current node does not match, all child nodes under the current node will no longer participate in the query traversal. S42: The cloud database stores the query results that meet the query conditions into the query result set; S43: The cloud database returns the query result set to the data user, who then decrypts the query result set to obtain the final result.

6. The privacy-preserving multidimensional range query method based on hierarchical Hilbert coding according to claim 5, characterized in that, In step S41, the query threshold matrix T is determined. {Q} Specifically, the match with the Bloom filter in the HHCB index tree is as follows: Check T {Q} Any of the following i Does the value stored at the corresponding address of the HMAC address in each node's Bloom filter always equal to or greater than 1? If T {Q} Any of the following i Whether the value stored at the corresponding address of the HMAC address in each node's Bloom filter is greater than or equal to 1 indicates that the HMAC address of the row is... i If the multidimensional data corresponding to the row HMAC address intersects with the query range of the encoding, then there is data in the current node that matches the query range, i.e., the query threshold matrix T. {Q} Matches the Bloom filter in the HHCB index tree; If T {Q} Any of the following i The HMAC address of a row is not uniformly greater than or equal to 1 at the corresponding address of the Bloom filter in each node, indicating that the Bloom filter does not contain the first row. i Multidimensional data corresponding to row HMAC address o i Furthermore, the left and right child nodes of the node containing the Bloom filter in the HHCB index tree do not contain multidimensional data. o i That is, query threshold matrix T {Q} It does not match the Bloom filter in the HHCB index tree.

7. A privacy-preserving multidimensional range query device based on hierarchical Hilbert coding, comprising a memory, a processor, and a program stored in the memory, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-6.

8. A storage medium having a program stored thereon, characterized in that, When the program is executed, it implements the method as described in any one of claims 1-6.

Images