A method for generating a linked list tree

Abstract

This invention discloses a method for generating a linked list tree, wherein: the linked list tree LL-tree is an encrypted full binary tree, and the method includes generating each linked list tree node LL-tree node, wherein the linked list tree node includes a head and a tail, as follows:

Description

[0001] This application is a divisional application of the invention patent application with application number "202110054402.X", application date January 15, 2021, and invention title "A Single-Round Interaction Linked List ORAM Access Method". Technical Field

[0002] This invention belongs to the field of information security, and in particular relates to a single-round interactive linked list ORAM access method, which can be applied to secure cloud storage systems and secure computing. Background Technology

[0003] To access unlimited and inexpensive computing and storage resources, many companies and users outsource their private data to the cloud. If user data is stored directly in plaintext on cloud servers, untrusted cloud service providers or other attackers could easily access this private information. To prevent malicious theft of user privacy data, traditional methods involve encrypting the data content and accessing personal documents by uploading and downloading encrypted data. Data privacy includes both content privacy and query privacy. In big data and cloud computing applications, however, encryption alone only protects content privacy, not query privacy. Query privacy primarily refers to search and access patterns, specifically the frequency of submissions using the same keywords and the frequency of accesses to the same address. Existing solutions typically employ Oblivious Random Access Machine (ORAM) technology, which reshuffles and re-encrypts the data at each access point to achieve unintentional read and write operations on outsourced data.

[0004] ORAM is an important means of protecting access patterns in the field of privacy protection. Its purpose is to hide access to real data blocks, making it impossible for attackers to distinguish whether each access is real or random. Existing ORAM schemes still face many challenges, such as high interaction between users and the cloud, excessively large user-side storage, large communication bandwidth, and high computational overhead. For example, Path ORAM and its successors either have a user-cloud interaction complexity of O(logN) (where N is the total number of elements) or rely on large client address mapping tables. Many ORAM schemes achieve single-round unintentional access at the cost of local storage address mapping tables. When the address space is large, these methods are not scalable for resource-constrained clients, which is inconsistent with the original design intent of ORAM. TWORAM is an ORAM protocol that implements small client storage and single-round interaction, but it relies on a large number of obfuscation circuits, which is a performance bottleneck in reality.

[0005] Therefore, this invention provides a single-round interactive linked list ORAM access method, which has the following advantages and technical effects: 1) It realizes single-round encrypted data read and write access on the public cloud. Users only need to send a request and receive a response to obtain or update data; 2) Local storage is almost zero; 3) It is simple to construct and easy to implement; 4) It can convert a large number of local arrays into cloud storage arrays without sacrificing much efficiency, and provides fast data read and write services with strong privacy protection. Summary of the Invention

[0006] To achieve the objectives of this invention, the following technical solution is adopted:

[0007] A method for generating a linked list tree, wherein: the linked list tree LL-tree is an encrypted full binary tree, and the method includes generating each linked list tree node of the linked list tree, wherein the linked list tree node includes a head and a tail, as follows:

[0008]

[0009] The head section includes `m` and `emaps`, while the tail section includes `M` and `chunks`. `emaps` and `chunks` are composite structures each composed of `z` items. The definitions of `M`, `m`, `emaps`, and `chunks` are as follows: `M` represents the node mask, a user-generated random value that is private and not disclosed to the cloud; `m` represents the ciphertext mask, an encrypted value stored at the head of a linked list node, obtained by XORing the node mask of the node with the node mask of its parent node, and is disclosed to the cloud; `chunks` contains `z` chunks, where a chunk is a data block. Each chunk stores four elements (a, data0, data1, leaf), namely an address `a`, two adjacent data items `data0` and `data1`, and a leaf identifier `leaf`, which indicates which leaf path the node belongs to to the root of the tree; `emaps` contains `z` encrypted mapping tables `emap`, where each `emap` stores two sets of key-value pairs (k1, v1, k2, v2) to store the encrypted values.

[0010] The method described includes read and write operations performed on emap, and the specific read and write operations are as follows:

[0011]

[0012] The write operation EMap.write(K,V) has two steps: First, divide K into K... l and K h Two parts (K) l ,Kh The second step is to assume K. h The result of the XOR operation, which has the same number of bits as V, is represented by EMap[K]. l ] indicates, and K l and EMap[K l The data is written to (K, V) respectively; the read operation V←EMap.read(K) also involves two steps: First, divide K into K... l and K h Two parts (K) l ,K h The second step is to determine the order based on K. l Find EMap[K l ], and K h Perform the XOR operation again to decrypt and obtain the value of V.

[0013] The method described includes address translation: converting an address 'a' into an encoding scheme of a set of smaller addresses. The formula for address translation is shown below:

[0014]

[0015] Where a i Let b be an integer. i It is a i+1 The remainder after dividing by 2 is a binary number, (a i ,b i This is called a block address; address a is represented as the (L+1)th address a L+1 , through a L+1 Calculate the Lth group a L and b L The value of is calculated sequentially using the formula above to obtain all the values ​​of 'a'. i and b i The value of , after all calculations, is transformed into a set containing L pairs of elements {(a1,b1),(a2,b2),…,(a…b2)}. L ,b L )}, where each (a i ,b i ) represents the address of the i-th block.

[0016] The method includes generating a user mask: assuming that the root node, like its child nodes, still has a parent node, a user mask is used to simulate a mask representing the parent node of the root node, using M... i This represents the user mask for the i-th tree. A global variable `Counter` is stored on the user's end to record the total number of read or write operations performed in the LL-ORAM. Let K be the user's key and G be a pseudo-random function. Then, the user mask M for the i-th tree... i equals GK (i||Counter).

[0017] The method includes generating user tokens: a user token is a set of one-time keys generated after calculation when a user attempts to obtain data A[a]. Assuming a is an array address, the user token for the i-th tree is represented by t. i express,

[0018] The method includes generating a block key: the block key is a key used to encrypt data blocks, assuming i is the i-th tree, (a i ,b i If represents a block address, and the current block is stored in a tree node with node mask M, then the block key is...

[0019] A method for generating a random linked list, wherein the random linked list is generated based on a linked list tree generated by one of the methods described above, the method for generating the random linked list includes generating an encrypted linked list and generating a sibling linked list, the random linked list being all encrypted tree nodes that need to be read and reconstructed during a data access process, including L paths from leaves to the root x1-to-root, x2-to-root, ..., x L -to-root, which refers to the sibling nodes of the tree nodes in the first L-1 paths, is represented as The definitions of EL and SL are as follows: An encrypted linked list refers to a linked list consisting of all nodes on the path from a leaf node to the root node in an LL-tree binary tree, where all tree nodes on the path are encrypted. The i-th tree T... i An encrypted linked list from the leaves x to the root of the tree is used The tree is represented as the set of nodes along the path from leaf node x to the root node; a sibling list is a linked list consisting of sibling nodes that share the same parent node as each node in the encrypted linked list. If x is a leaf value, and i is the i-th tree, then... express The sibling list, i.e. The set of sibling nodes of a node.

[0020] A method for initializing a linked list tree, wherein the linked list tree is generated according to one of the methods described above, characterized in that:

[0021] For a set of data A[.], assume there are N = 2... L N data blocks are randomly stored by the user in a data tree T. L In a tree node, a chunk of the tree node can store two data blocks with adjacent addresses, using another smaller adjacent tree T. L-1 Store the leaf positions corresponding to these random nodes in TL-1 It stores 2 L-1 There are 3 data blocks, and their values ​​are T. L 2 L-1 Each leaf position has a specified number of leaf positions, and all of its leaf positions are stored in T. L-2 This process continues until the last tree T1, which contains only one tree node, T1-T. L-1 It is called a location tree.

[0022] The method described herein includes the following: In the location tree, assuming a chunk is (a′, data0, data1, leaf), then (a′, 0) represents the address of the first block of the current chunk, (a′, 1) represents the address of the second block of the current chunk, data0 stores the leaf positions corresponding to the block addresses (2a′, 0) and (2a′, 1) of the next tree, data1 stores the leaf positions corresponding to the block addresses (2a′+1, 0) and (2a′+1, 1) of the next tree, and leaf is the leaf position corresponding to the current chunk; In the data tree, data0 and data1 store the data that ultimately needs to be returned to the user.

[0023] Assuming all data blocks (a i ,b i All values ​​have been stored using the method described above, and the plaintext values ​​have been stored in T1, T2, ..., T. L In each chunk, for an unencrypted linked list node d in the i-th tree, assuming that the chunk in d already stores the data block information, encrypt this tree node in the following way:

[0024] Step 1: Encrypt the header of the tree nodes. The user generates a random value as the node mask for each node in the tree. Then, the node mask M and the parent node mask M are combined. f XORing the ciphertext mask d.head.m of the node yields the corresponding block key for all data blocks in the node. Based on the linked list tree number i, the block address (a i ,b i Given the current node mask M, a pseudo-random function F, and the user key K, through... The block key is obtained through computation using formula (2). Write data0 and data1 into the encryption mapping table;

[0025] Step two: Encrypt the tail of the tree node. The user stores the node mask in the tail of the node and encrypts the tail using a random symmetric encryption algorithm. The user keeps the private key and finally outputs the encrypted node.

[0026] A method for accessing a linked list tree, wherein the linked list tree is generated and initialized using one of the methods described above, the method for accessing the linked list tree includes read operations and write operations:

[0027] 1) Create a one-time token

[0028] The user converts the input address into a set of block addresses using an address encoding method. Let i represent the i-th tree, and M... i Let be the user mask for the i-th tree, and for each block address (a i ,b i ),calculate Get all tokens (t1, t2, ..., t) of L-1 location trees L-1 );

[0029] 2) Search in the linked list tree

[0030] The recursive search on a linked list tree is represented as: x i+1 =Compute(T i ,t i ), where x i+1 Let T be the leaf position of the (i+1)th tree. i For the i-th tree, t i The token for the i-th tree sent to the user, where the Compute algorithm process is described in detail below:

[0031] Step A: Access the first-level tree node. If the current node is d, then the user XORs d.head.m with t. i We get a variable t if the current node contains (a i ,b i If a data block is given, then t is a correct block key, which allows decryption of the data block in emaps and access to the next tree leaf x. i+1 If the algorithm succeeds, it terminates; otherwise, it continues searching for the next level of nodes.

[0032] Step B: Assuming d is a second-level tree node, the user XORs d.head.m with t obtained in the previous step A; if the current node contains (a i ,b i If a data block is given, then t is a correct block key, which allows decryption of the data block in emaps and access to the next tree leaf x. i+1 If the algorithm succeeds, it terminates; otherwise, it continues searching for the next level of nodes.

[0033] Step C: Visit the leaves sequentially until leaf x is obtained. i+1 ;

[0034] 3) Read data

[0035] After receiving an RLL, the user reads and writes data in two steps:

[0036] Step A: The user creates L temporary buffers to store an RLL. The user decrypts all chunks and writes them into the corresponding temporary buffers.

[0037] Step B: The user reassigns L random leaf identifiers to all decrypted chunks. The leaf identifiers of the i-th tree's chunk (a′, data0, data1, leaf) are written into the (i-1)-th tree's chunk (a′ / 2, data*0, data*1, leaf*), into either data*0 or data*1. If a′ is even, it is written into data*0; if a′ is odd, it is written into data*1.

[0038] 4) Reconstruct RLL

[0039] After shuffling the chunk data in the L buffers, the chunk positions are rearranged. Then, for each tree node, the tree node is encrypted using the node initialization encryption algorithm mentioned above, and a new RLL is obtained. The new RLL is packaged into the next read request. In the next new read / write request, the user sends the new query token along with the historical buffered RLL to the cloud server. The cloud server first performs the historical node overwrite update operation, and then performs the new query operation. Attached Figure Description

[0040] Appendix Figure 1 A logical representation diagram for an instance of EL and SL;

[0041] Appendix Figure 2 Flowchart for encrypting tree nodes;

[0042] Appendix Figure 3 Here is the LL-ORAM logic representation diagram;

[0043] Appendix Figure 4 This is a flowchart for a single-round visit;

[0044] Appendix Figure 5 A flowchart for calculating the leaves of the next tree;

[0045] Appendix Figure 6 The graph represents an instance of a search on an LL-tree. Detailed Implementation

[0046] The following is in conjunction with the appendix Figure 1-6 The specific embodiments of the present invention will be described in detail below.

[0047] The single-round interactive linked list ORAM access method includes: 1. generating a linked list tree and generating a random linked list; 2. initializing LL-ORAM; 3. performing read and write operations on LL-ORAM using the single-round access method.

[0048] 1. Generate a linked list tree, and then generate a random linked list based on the linked list tree.

[0049] Generating a linked list tree involves generating the individual linked list tree nodes of a linked list tree (LL-tree). The linked list tree is an encrypted full binary tree: for a linked list tree with more than 1 level, all linked list tree nodes on each level have two child nodes, except for the last level which has no child nodes.

[0050] A linked list tree node is a composite structure consisting of a head and a tail. The detailed components of each part are shown below:

[0051]

[0052] The head is composed of two parts, m and emaps, and the tail is composed of two parts, M and chunks. Emaps and chunks are composite structures composed of z terms (z is generally greater than or equal to 2 and less than 10). The definitions of the components M, m, emaps and chunks are as follows:

[0053] M represents the node mask. The node mask is a user-generated random value, not publicly disclosed to the cloud, and can only be used once in a query. It is regenerated randomly each time a node is accessed. The node mask is stored at the end of the node. If d is a node in a tree, and d.tail represents the end of the tree node, then d.tail.M represents the node mask of tree node d. Because the end of the node, d.tail, is always encrypted using a standard randomized symmetric encryption algorithm, the node mask is private information.

[0054] 'm' represents the encrypted mask (EMask), which is the encrypted value stored at the head of a linked list tree node. It is obtained by XORing the node's own mask with the mask of its parent node. The encrypted mask is stored in the node's head. If 'd' is a tree node, and 'd.head' represents the head of a tree node, then 'd.head.m' represents the encrypted mask of this node. That is, the encrypted mask 'd.head.m' of any node 'd' is obtained by XORing the node's own mask with the parent node's mask. The result is obtained through calculation, where M f This is the parent node mask for this node. The ciphertext mask 'm' is directly exposed in the cloud and is a computational parameter of the cloud server.

[0055] A chunk (data block group) contains z chunks, where a chunk refers to a data block. A chunk stores four elements (a, data0, data1, leaf): an address, two adjacent data items, and a leaf identifier. Address 'a' represents the address of data 'data0'; a+1 represents the address of the adjacent data 'data1'. In an LL-tree, for ease of searching, any chunk is marked with the path from the leaf to the root, where the leaf value is represented by 'leaf' and stored within the chunk. Because the data is stored in randomly shuffled locations, accessing a chunk requires reading the entire path from the leaf to the root in one go to find the current chunk's storage location.

[0056] An `emaps` (mapping table unit group) contains `z` `emaps` (mapping table units), where each `emap` stores two sets of key-value pairs (k1, v1, k2, v2) to store the encrypted values. An `emap` represents an Encrypted Map (EMap), which is a type of hash table that supports two operations: read and write, represented by `EMap.write(K, V)` and `V←EMap.read(K)`, respectively, where K and V are fixed-size values. The specific read and write operations of an `EMap` are as follows:

[0057]

[0058] The write operation EMap.write(K,V) has two steps: First, divide K into K... l and K h Two parts (K) l ,K h The second step is to assume K. h The result of the XOR operation, which has the same number of bits as V, is represented by EMap[K]. l ] indicates, and K l and EMap[K l The data is written to (K, V) respectively. The read operation V←EMap.read(K) also involves two steps: First, divide K into K... l and K h Two parts (K) l ,K h The second step is to determine the order based on K. l Find EMap[K l ], and K h Perform the XOR operation again to decrypt and obtain the value of V.

[0059] Randomized linked list (RLL): A randomized linked list is a tree list that needs to be read and reconstructed during a single data access. It consists of a set of encrypted tree nodes, which are the paths from L leaves to the root: x1-to-root, x2-to-root, ..., x... L -to-root, and the sibling nodes of the tree nodes in the first L-1 paths, are represented as The definitions of EL and SL are as follows:

[0060] An encrypted linked list (EL) is a linked list consisting of all nodes along the path from a leaf node to the root node in an LL-tree binary tree; it is a part of the linked list tree structure described above. All tree nodes along the path are encrypted. The i-th tree T... i An encrypted linked list from the leaves x to the root of the tree is used It represents the set of nodes on the path from leaf node x to the root node.

[0061] Sibling Encrypted Linked List (SL): A sibling linked list is a linked list consisting of sibling nodes that share the same parent node as every node in the encrypted linked list. If x is a leaf value, and i is the i-th tree, then... express The sibling list, i.e. The set of sibling nodes of a node.

[0062] Figure 1 For a logical representation of an instance of EL and SL, T4 represents the 4th LL-tree, and the four nodes from the leaf to the root in the graph {d A ,d B ,d C ,d D} That is, EL that forms the fourth tree, and the remaining three nodes {d} represented by dashed boxes. E ,d F ,d G} SL forms the fourth tree.

[0063] Based on the structure of the random linked list, the data required by the user is stored in the random linked list. The user can obtain the final queried data by downloading the random linked list. The number of nodes on any leaf-to-root path in each tree of different heights is fixed; therefore, the length of the random linked list for each tree is a fixed value. Since the root node has no sibling nodes, the total number of nodes in the first L-1 trees of the random linked list, including EL and SL, is... The length of the random linked list is fixed, and it contains a total of Tree nodes.

[0064] The concepts of address translation, user mask, block key, user token, and temporary buffer are introduced below.

[0065] Address translation / block addressing: Address translation refers to the encoding method that converts an address 'a' into a group of smaller addresses. The formula for implementing address translation is shown below:

[0066]

[0067] Where a i Let b be an integer. i It is a i+1 The remainder after dividing by 2 is a binary number. (a) i ,b i This is called a block address. Address 'a' is represented as the (L+1)th address 'a'. L+1 , through a L+1 The Lth group a can be calculated L and b L The value of is then used to calculate all the values ​​of 'a' sequentially according to the formula above. i and b i The value of . After all calculations, the address 'a' is transformed into a set containing L pairs of elements {(a1,b1),(a2,b2),…,(a... L ,b L )}, where each (a i ,b i () represents the address of the i-th block. The relationship between block address and logical address is as follows: if a block address is (y, b), then its logical address is 2y + b. For any linked list tree of height l, assuming each tree node has 2z blocks, then the maximum number of blocks is 2z(2... l -1) block addresses (or logical addresses).

[0068] User mask: A user mask is an encrypted random value calculated and generated by the user to represent the parent node mask of the root node in each tree. Since the root node in a tree structure does not have a parent node, it can be assumed that the root node, like its child nodes, still has a parent node. The user mask is used to simulate the mask representing the parent node of the root node, denoted by M. i This represents the user mask for the i-th tree. This invention stores a global variable `Counter` on the user side to record the total number of read or write operations performed in the LL-ORAM. Assuming K is the user's key and G is a pseudo-random function, then the user mask M for the i-th tree... i equals G K(i||Counter). Since Counter is different each time, the user mask is random.

[0069] User Token: Assuming 'a' is an array address, a user token is a one-time key generated by calculation when a user attempts to retrieve data A[a]. A user token can only be used once; it is used to calculate and decrypt a set of leaf positions {x1, x2, ..., x...}. L}, thus calculating and obtaining an RLL. The user token of the i-th tree is t i It means that it is equal to

[0070] Block Key: A block key is a key used to encrypt blocks of data. Assuming i is the i-th tree, (a i ,b i If represents a block address, and the node mask of the current block is M, then the block key is... The calculated block key is used to encrypt data blocks within a chunk. In EL, the node mask is randomly and uniquely regenerated after each access, ensuring that the block key is unique for any linked list tree, any tree node, and any data block. Due to the large number of data blocks, users cannot store all block keys locally; however, they can indirectly calculate the block key using user tokens and the linked list tree.

[0071] Temporary Buffer: A buffer is a storage structure used to store and "shuffle" retrieved data blocks. In this invention, the temporary buffer Stash uses the following hash table data structure.

[0072]

[0073] Where data0 and data1 are arbitrary data, and leaf represents a leaf identifier, indicating that the path from the leaf to the root contains the block. Each sblock in the buffer can be accessed using address a′ and binary number b, and the accessed block is represented by (data b The leaf represents the selection of data. If b is zero, data0 is selected; otherwise, data1 is selected.

[0074] II. Initializing LL-ORAM

[0075] Initializing LL-ORAM consists of two phases: the first phase involves filling each chunk with values; the second phase involves encrypting each node.

[0076] Phase 1: For a set of data A[.], for simplicity, assume that there are N = 2... L N data blocks are randomly stored by the user in a data tree T.L In the tree node. Since a chunk in a tree node can store two adjacent data blocks, and the data storage addresses have been shuffled, a smaller tree T can be used instead. L-1 Store the leaf positions corresponding to these random nodes. In T L-1 It stores 2 L-1 There are 3 data blocks, and their values ​​are T. L 2 L-1 Leaf positions. Due to T L-1 The data block storage addresses have also been broken down, and all its leaf locations can only be stored in T. L-2 In the middle. And so on, until the last tree T1, which contains only one tree node. T1-T L-1 It is called a location tree.

[0077] More specifically, in the location tree T i In this example, assuming a chunk is (a′, data0, data1, leaf), then (a′, 0) represents the address of the first block of the current chunk node, (a′, 1) represents the address of the second block of the current chunk node, and data0 stores the address of the next tree T. i+1 The data structure stores the leaf positions corresponding to block addresses (2a′,0) and (2a′,1) (note: the stored values ​​are not equal to the block addresses). `data1` stores the leaf positions corresponding to the block addresses (2a′+1,0) and (2a′+1,1) of the next tree (note: the stored values ​​are also not block addresses). `leaf` represents the leaf position corresponding to the current block. In the data tree, `data0` and `data1` have different meanings than in the location tree; they store the data that will ultimately be returned to the user.

[0078] For example, for a data A

[10] , its logical address is 10 and its block address is (5, 0). It is randomly assigned a leaf position, let's say the value is 8. This position information 8 is stored in the previous smaller tree, because 5 corresponds to the block address (2, 1), and information 8 is placed in the block address (2, 1), which corresponds to the data1 area. Similarly, the leaf position corresponding to the block address (2, 1) is stored in the previous small tree, and the stored block address is (1, 0), which corresponds to the data0 area. This tree has only one node. Based on the above steps, all array data is stored according to the above rules.

[0079] Second stage: Assuming all chunk values ​​have been filled in as described above, for the unencrypted linked list node d in the i-th tree, this invention encrypts d in the following way: Figure 2 As shown, it includes the following steps.

[0080] Step 1: Encrypt the header of the tree nodes. The user generates a random value as the node mask M for each node in the tree, and then merges the node mask M with the parent node mask M. f XORing yields the ciphertext mask d.head.m of the node. The following BlockKey algorithm is used to generate corresponding block keys for all data blocks in the node, based on the linked list tree number i and the block address (a...). i ,b i Given the current node mask M, a pseudo-random function F, and the user key K, through... The block key is obtained through computation. Since each chunk contains two adjacent data addresses, each chunk generates two corresponding block keys. Using these two block keys as keys, data0 and data1 are written into the encryption mapping table using formula (7). Because data0 and data1 are encrypted with different block keys, the block key and value cannot be inferred from the written hash table address.

[0081] Step two: Encrypt the tail of the tree node. The user stores the node mask in the tail of the node and encrypts the tail using a random symmetric encryption algorithm. The user keeps the private key and finally outputs the encrypted node.

[0082] Important Notes: 1) The cloud cannot decrypt the node tail; the node tail is not publicly available to the cloud and is only provided to users. 2) The cloud can only decrypt the node header containing the corresponding data block after obtaining the corresponding block key. 3) Because the root node has no parent node, it can be assumed that the parent node mask of the root node is the user mask of the corresponding tree. The encrypted linked list tree node head is provided to the cloud for computation. The cloud can use the token sent by the user to decrypt the emaps in the required node head to obtain the value in the emaps. 4) Based on the user's token, if the cloud obtains a value in the emaps, it is used to access the leaf position of the next tree.

[0083] The LL-ORAM logic structure after initialization is as follows: Figure 3 As shown. It consists of a set of linked lists, denoted by (T1, T2, ..., T...). L ) indicates that each T i Represents a tree of height i that contains (2 i A full binary tree with -1) linked list tree nodes. The Lth linked list tree T L This is called a data tree. Data is stored in each tree node in a random order. The first L-1 linked lists form a location tree, used to store data location information. Where x... i It is the leaf identifier of the i-th tree, and the input x of the i-th tree. i This is the output result of the calculation for the (i-1)th tree, {x1,x2,…,x L} represents a set of leaf positions obtained from a single ORAM access. Stash is a temporary buffer.

[0084] III. Single-round data access on LL-ORAM.

[0085] For an array address 'a', in order to read or write logical data A[a], a user performs a single-round read / write operation on the LL-ORAM as follows: Figure 4 As shown, it includes four steps: creating a one-time token, searching for the RLL on LL-ORAM, reading and writing data, and reconstructing the RLL.

[0086] 1) Create a one-time token

[0087] The user inputs an address, which is then converted into a set of block addresses using the address encoding method described above. Let i represent the i-th tree, and M... i Let be the user mask for the i-th tree, and for each block address (a i ,b i ),calculate Get all tokens (t1, t2, ..., t) of L-1 location trees L-1 ).

[0088] 2) Search on LL-ORAM

[0089] A search on an LL-tree can be recursively represented as: x i+1 =Compute(T i ,t i ), where x i+1 Let T be the leaf position of the (i+1)th tree. i For the i-th tree, t i The token for the i-th tree sent to the user, where the Compute algorithm flow is as follows: Figure 5 As shown, the specific description is as follows: in the worst case, it iterates through x. i Reach the i tree nodes from the root of the tree.

[0090] Step A: Access the first-level tree node. If the current node is d, then the user XORs d.head.m with t. i We get a variable t if the current node contains (a i ,b i If a data block is given, then t is a correct block key, which allows decryption of the data block in emaps and access to the next tree leaf x. i+1 If the algorithm succeeds, it terminates; otherwise, it continues searching for the next level of nodes.

[0091] Step B: Assuming d is a second-level tree node, the user XORs d.head.m with t obtained in the previous step A; if the current node contains (ai ,b i If a data block is given, then t is a correct block key, which allows decryption of the data block in emaps and access to the next tree leaf x. i+1 If the algorithm succeeds, it terminates; otherwise, it continues searching for the next level of nodes.

[0092] Step C: Visit the leaves sequentially until leaf x is obtained. i+1 .

[0093] Note: A) After the above steps, the algorithm will eventually traverse all the linked list trees to obtain an RLL containing user data. Although each sibling list SL is not accessed or decrypted, reconstructing each EL depends on the mask data in SL, so the corresponding SL needs to be downloaded as well. B) Because the data blocks are stored in advance in the corresponding root-to-leaf path, the cloud can always get the correct calculation results.

[0094] Figure 6 This describes an example of a search on an LL-tree. T4 is the 4th LL-tree, M4 represents the user mask, and the linked list contains four nodes {d}. A ,d B ,d C ,d D}, and its corresponding node mask is {M A M B M C M D The ciphertext mask of each node is obtained by XORing the node mask with its parent node mask. The ciphertext mask of the root node is obtained by XORing the root node mask with the user mask M4. User token t4 is passed through... Calculations show that the user sends the token to the cloud, and the cloud receives it from the root node d. A Begin performing the following calculation, linking token t4 with node d. A ciphertext mask d A The .head.m file performs an XOR operation because node d... A ciphertext mask Therefore, the calculation is simplified to... ,

[0095] The final calculation result is This is actually node d. A A block key can be used to search for block addresses (a i ,b i The data at position ) indicates that i = 4. A The cloud did not find the address of the block to be accessed, so it continued searching for d. B ,calculate Because of dB There is no corresponding address in it, nor is there any from d. B Get any results. Then search for d. C ,calculate ,

[0096] The final calculation result is NodeKey C In fact, it is node d C A block key, using node d C block key reading d C The encrypted mapping value is actually used to access the leaf position of the next tree, and its value is equal to the data stored in the chunk at the end of the node beforehand.

[0097] 3) Reading and writing data

[0098] After receiving an RLL, the user uses two steps to read and write data.

[0099] Step A: The user creates L temporary buffers to store an RLL, with each node of the tree placed into its corresponding buffer. Since the tail portion can be decrypted, the user decrypts all chunks and writes them to their respective temporary buffers. If the user needs to read data A[a], they only need to read A[a] from the temporary buffer of the data tree. Because all block addresses corresponding to address a are already in the temporary buffers, the user can retrieve A[a] based on the block address (a... L ,b L Read data. If the user needs to write data data* to A[a], then it will write the data data* to the corresponding temporary buffer chunk.

[0100] Step B: The user reassigns L random leaf identifiers to all decrypted chunks. The leaf identifiers of the i-th tree's chunk (a′, data0, data1, leaf) are written into either data*0 or data*1 of the (i-1)-th tree's chunk (a′ / 2, data*0, data*1, leaf*). If a′ is even, it is written into data*0; if a′ is odd, it is written into data*1.

[0101] 4) Reconstruct RLL

[0102] This section employs the publicly available Path ORAM shuffling algorithm to shuffle the chunk data in the L buffers and then rearrange the chunk positions. Then, for each tree node, the aforementioned node initialization encryption algorithm is used to encrypt the tree node, resulting in a new RLL.

[0103] Important Notes: A) Even if an unaccessed chunk is moved, it still needs to satisfy the condition that the path from a leaf to the root must contain the current chunk after shuffling. B) Write data to the bottom of the tree as much as possible to avoid root storage space overflow. C) Except for the root, each node stores Z chunks, generally Z is greater than or equal to 2 and less than 6. The size of the root node is fixed, generally Z is greater than or equal to 6 and less than 10. D) All data in the buffers will be re-encrypted and uploaded to the original path, forming a re-encrypted RLL. E) The user will eventually clear all buffers. F) Because the SL mask is not used, the SL mask is not regenerated, but the SL node header and tail have been re-encrypted by the tree node encryption algorithm.

[0104] To enable access to be completed in a single request and response round, the new RLL is packaged into the next read / write request. In the next new read / write request, the user sends the new query token along with the historical, buffered RLL to the cloud. The cloud then first performs the historical node overwrite update operation, and then executes the new query operation. Any data read / write access repeats these steps. Thus, LL-ORAM enables fast read / write of privacy-preserving data in a single round.

Claims

1. A method for generating a linked list tree, characterized in that: The LL-tree is an encrypted full binary tree, and the method includes generating LL-tree nodes, each of which includes a head. and tail ,as follows: The head include and Tail include and , and They are respectively by A composite structure composed of items; , , and The definitions are as follows: This represents the node mask, which is a random value generated by the user and is private information that is not disclosed to the cloud. The ciphertext mask is an encrypted value stored at the head of a linked list tree node. It is obtained by performing an XOR operation between the node's node mask and the node mask of its parent node. The ciphertext mask is publicly available to the cloud. Include indivual ,in It refers to a data block. Four elements were stored That is, an address 'a', two adjacent data 'data0' and 'data1', and a leaf identifier 'leaf'. The leaf identifier 'leaf' is used to indicate which leaf the node belongs to on the path from the tree root. Include One encrypted mapping table Each of them Store two sets of key-value pairs. , used to store the encrypted value; The method includes: The read and write operations performed are detailed below: （2） Write operation It includes two steps: the first step is to... Divided into and Two parts The second step is to assume... and When the number of bits is the same, the result of the XOR operation is used... It indicates, and will and Write to respectively Read operation It also involves two steps: the first step is to... Divided into and Two parts The second step, according to turn up , and Perform the XOR operation again to decrypt and obtain the result. The value of .

2. The method according to claim 1, characterized in that: Includes address translation: converting an address The encoding method for converting addresses into a smaller set of addresses is shown in the following formula: （3） in It is an integer. yes The remainder after dividing by 2 is a binary number. This is called a block address; address Represented as the first Address ,pass Calculate the first Group and The value of is calculated sequentially according to the above formula to obtain all the values. and The value, after all calculations, is the address. Convert into a containing A set of elements Each of them Indicates the first Block address.

3. The method according to claim 1, characterized in that: This includes generating a user mask: assuming the root node, like its child nodes, still has a parent node, a user mask is used to simulate the mask representing the parent node of the root node. Indicates the first The user mask of the tree is stored in a global variable on the user side. This is used to record the total number of read or write operations performed in LL-ORAM. For the user's key, Let be a pseudo-random function, then the first... Tree's user mask equal .

4. The method according to claim 1, characterized in that: This includes generating user tokens: a user token is a token that a user attempts to obtain. Data, a set of one-time keys generated through calculation, assuming Given an array address, the first Tree user tokens express, .

5. The method according to claim 1, characterized in that: This includes generating block keys: block keys are keys used to encrypt data blocks, assuming... For the first A tree, This represents a block address, where the current block is stored in a node with a mask of . In the tree node, the block key is .

6. A method for generating a random linked list, characterized in that the random linked list is generated from a linked list tree generated by the method according to any one of claims 1-5, the method for generating the random linked list includes generating an encrypted linked list and generating a sibling linked list, the random linked list being all encrypted tree nodes that need to be read and reconstructed during a data access process, including... The path from a leaf to the root of a tree. , , ..., , and before The sibling nodes of a tree node in a path are represented as The definitions of EL and SL are as follows: An encrypted linked list is a linked list consisting of all nodes along the path from a leaf node to the root node in an LL-tree binary tree. All tree nodes along the path are encrypted. tree Leaves Encrypted linked list to the root of the tree This indicates that the leaf node is... The set of nodes on the path to the root node; a sibling list is a linked list consisting of sibling nodes that share the same parent node as each node in the encrypted linked list, if... It is a leaf value. For the first A tree, with express The sibling list, i.e. The set of sibling nodes of a node.

Images