A security service method for making sensitive data transparent based on white-box cryptography.
By combining white-box cryptography and trusted execution environments at the SQL proxy layer, the problem of secure and transparent transmission of sensitive database data in cloud computing is solved. This achieves efficient encryption and decryption and confidentiality of data, prevents key leakage and attacks, and ensures data security in untrusted environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SOUTH CHINA NORMAL UNIV
- Filing Date
- 2023-08-31
- Publication Date
- 2026-08-04
AI Technical Summary
In cloud computing scenarios, existing technologies for the secure and transparent transmission of sensitive database data suffer from issues such as software backdoor vulnerabilities, key leakage risks, and insufficient performance. In particular, it is difficult to guarantee data security and privacy in untrusted environments.
A sensitive data transparency security service method based on white-box cryptography is adopted. Transparent access control is performed through the SQL proxy layer. Combined with trusted execution environment and white-box cryptography technology, the query content is encrypted and desensitized using format preservation obfuscation and order preservation encryption methods. It is also protected by an external encoding module to ensure the security of data in untrusted environments.
It enables transparent and secure transmission of sensitive data in a cloud computing environment, improves data confidentiality and trustworthiness, prevents key leakage and white-box attacks, enhances data security and transparency, and supports efficient data encryption and decryption operations.
Smart Images
Figure CN117195258B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the technical field of data transmission and data security, specifically relating to a method for providing transparent security services for sensitive data based on white-box cryptography. Background Technology
[0002] According to the provisions of the Data Security Law and the Personal Information Protection Law, sensitive data generally refers to information requiring special protection, specifically information involving personal privacy stored in databases, including but not limited to names, ID card numbers, dates of birth, and student grades. While traditional database management systems can restrict access to sensitive data through user permission settings and access control mechanisms, they still lack cryptographic protection during data discovery, access, authorization, and distribution, making them vulnerable to sensitive data leaks. With the rapid development of big data and cloud computing, the storage and processing of sensitive data has become a major concern for enterprises and individuals. The security and leakage prevention of sensitive data transmission are receiving increasing attention, and data leakage and data security issues have become significant challenges for various enterprises. Protecting the security and privacy of this data is of paramount importance.
[0003] Existing technical solutions employ two approaches. First, Oracle Transparent Data Encryption (OracleTDE) technology provides a transparent data encryption and decryption method, automatically encrypting data before storage and decrypting it upon retrieval without requiring any modifications to existing applications, thus ensuring data security during storage. Second, white-box cryptography-based data encryption / decryption or format-preserving encryption technologies integrate the cryptographic algorithm and key. Even if an attacker can fully observe the encryption / decryption process, they cannot obtain valid key information, achieving secure data encryption and decryption even without guaranteeing environmental security. However, these existing technical solutions have the following shortcomings:
[0004] 1. While database-based transparent encryption and decryption functions (such as Oracle TDE technology) can meet application requirements in terms of performance and practicality, data encryption and decryption permissions must completely rely on the database software, which poses a risk of software backdoors.
[0005] 2. There may be white-box security issues, such as: if network nodes use cloud servers or other third-party servers, there is a risk of key leakage.
[0006] 3. While traditional white-box cryptography encryption and decryption schemes can solve the key leakage problem, their performance is difficult to meet the actual needs of big data applications.
[0007] Therefore, in cloud computing scenarios, how to achieve secure and transparent transmission of sensitive data in databases, and how to solve the problems of key leakage and data confidentiality in untrusted environments, have become urgent technical challenges. Summary of the Invention
[0008] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a method for transparent and secure sensitive data based on white-box cryptography. This method uses an SQL proxy at the proxy layer to achieve transparent access to the database and access control for users. The trusted execution environment and white-box cryptography are combined because white-box cryptography requires external encoding protection to ensure security in the white-box environment, thus ensuring transparent and secure data transmission.
[0009] To achieve the above objectives, the present invention adopts the following technical solution:
[0010] The method for providing transparent security services for sensitive data based on white-box cryptography includes the following steps:
[0011] A user with the appropriate permissions issues a query request; the query request includes a normal query request and an advanced query request.
[0012] The SQL agent deployed on the cloud service uses a transparent protocol to parse and obtain the user's query request, sends the agent statement to the database, and retrieves the corresponding query content from the database;
[0013] For ordinary query requests, the white-box cryptography service system calls the format obfuscation or sequence obfuscation method based on white-box cryptography to encrypt and de-identify the query content, and the de-identified data is fed back to the user who made the ordinary query request.
[0014] For advanced query requests, the white-box cryptography service system calls the white-box cryptography-based sequential or format-based encryption method to encrypt and de-identify the query content. After obtaining the de-identified data, an external encoding module is used to perform external encoding to obtain de-identified data with external encoding. This data is then input into an external decoding module and a white-box cryptography decryption module for decoding and decryption, and the query content is returned to the user who issued the advanced query request.
[0015] As a preferred technical solution, the SQL agent is deployed on a cloud server that is different from the database and has an access control mechanism;
[0016] If the SQL agent obtains a user's ordinary query request, the SQL agent sends an agent statement to the database according to the ordinary query request, and the query content returned by the database is anonymized through the white-box cryptographic service system;
[0017] If the SQL agent obtains a user's advanced query request, it forwards the advanced query request to the sensitive data rule set module to generate the corresponding sensitive data rule set. Then, based on the advanced query request and the sensitive data rule set, it sends an agent statement to the database and desensitizes the query content returned by the database through the white-box cryptography service system.
[0018] As a preferred technical solution, the sensitive data rule set module adopts natural language processing technology. For different databases, it scans the field names and contents in the database and integrates the user's preset sensitive data rules to generate corresponding sensitive data rule sets for database query behavior.
[0019] The databases include relational databases and non-relational databases.
[0020] As a preferred technical solution, for ordinary query requests, the white-box cryptographic service system puts the query content returned by the database into a format-preserving obfuscation operation or a sequence-preserving obfuscation operation based on a cryptographic one-way function for encryption, and then feeds back the de-identified data to the user who issued the ordinary query request.
[0021] As a preferred technical solution, for advanced query requests, the method of using a white-box cryptographic service system to call a format-preserving encryption method based on white-box cryptography to encrypt and de-identify the query content specifically involves:
[0022] Define the size of the plaintext space and the ciphertext space, and map the query content into binary form according to the dictionary to obtain the binary plaintext.
[0023] The binary plaintext is divided into two parts and placed into a Feistel structure that preserves the encryption method based on white-box cryptography. Iterative calculation is performed with a round function based on block cipher to obtain binary ciphertext. Then, it is mapped by a dictionary to ciphertext with the same format as the query content to obtain de-identified data.
[0024] The plaintext space and ciphertext space have the same structure and size, and the encrypted data has the same format as the original data.
[0025] As a preferred technical solution, when the data type of the query content is Chinese characters, when adopting a format preservation encryption method based on white-box cryptography, each Chinese character is mapped to the integer field Z through a mapping space. n Convert to integer data, then perform format-preserving encryption on the integer data to obtain the integer field Z. n The integer result is then mapped back to Chinese characters to obtain an encrypted result with the same format as the original Chinese characters.
[0026] As a preferred technical solution, for advanced query requests, the method of using a white-box cryptographic service system to call a sequence-preserving encryption method based on white-box cryptography to encrypt and de-identify the query content specifically involves:
[0027] Define the sizes of the plaintext space and the ciphertext space, wherein the size of the ciphertext space is greater than the size of the plaintext space;
[0028] The order-preserving encryption method based on white-box cryptography encrypts the query content as plaintext to obtain ciphertext;
[0029] A binary search is used on the ciphertext space, and the intermediate value of the ciphertext obtained by the search is mapped from the ciphertext space to the plaintext space using a hypergeometric distribution based on a block cipher algorithm to obtain the mapped value.
[0030] The plaintext is compared with the mapping value. If the plaintext is less than the mapping value, the left half of the ciphertext space is selected to continue the binary search until the plaintext and the mapping value are equal, thus obtaining the ciphertext space corresponding to the mapping value. If the plaintext is greater than the mapping value, the right half of the ciphertext space is selected to continue the binary search until the plaintext and the mapping value are equal, thus obtaining the ciphertext space corresponding to the mapping value.
[0031] Random sampling is performed on the ciphertext space corresponding to the mapping value to obtain the ciphertext value, resulting in an encrypted result that is consistent with the size order of the plaintext, i.e., desensitized data.
[0032] As a preferred technical solution, the external encoding module performs external encoding on the desensitized data through a pre-set nonlinear encoding table to obtain desensitized data with external encoding;
[0033] The external encoding module runs in a trusted execution environment.
[0034] As a preferred technical solution, the external decoding module decodes the desensitized data with external encoding through a pre-set nonlinear decoding table to obtain the desensitized data;
[0035] The desensitized data obtained from decoding is input into the white-box cryptographic decryption module for decryption, and the query content is fed back to the user who issued the advanced query request.
[0036] The decoding table and the encoding table are inverses of each other;
[0037] The external decoding module and the white-box cryptographic decryption module run in a trusted execution environment.
[0038] As a preferred technical solution, the method further includes:
[0039] Before providing anonymized data or query results to the user, determine whether to add a digital watermark. Specifically:
[0040] If the de-identified data or query content needs to be publicly audited or verified, then a digital watermark is embedded in the digital signature generated based on the de-identified data or query content, and digital watermark data is generated and fed back to the user.
[0041] If the anonymized data or query content only requires internal verification, a message verification code is generated using a white-box Galois or counter mode based on the key of the anonymized data or query content. The message verification code is then embedded as a digital watermark in the anonymized data or query content, and the generated digital watermark data is fed back to the user.
[0042] Compared with the prior art, the present invention has the following advantages and beneficial effects:
[0043] 1. Transparent and secure data transmission: The proxy layer is modified to deploy the SQL proxy on a separate server from the database, enabling transparent access to the database and access control for users. A white-box cryptographic service system in a trusted execution environment is used for data encryption and external encoding, ensuring transparent and secure data transmission.
[0044] 2. This invention, based on existing white-box cryptography, proposes cryptographic obfuscation encryption for ordinary queries and format / sequence preservation encryption / decryption for advanced queries. This ensures the security of the white-box cryptographic service system in a trusted execution environment, while employing external encoding to resist existing white-box cryptographic attacks. The combination of trusted execution environment and white-box cryptography is because white-box cryptography requires external encoding for security in a white-box environment, while decrypting the external encoding in a trusted execution environment ensures its confidentiality.
[0045] 3. In this invention, the white-box cryptographic algorithm operation is divided into two parts: round function iteration and external encoding operation. The round function iteration has a large performance consumption, so it needs to be executed in an untrusted environment. The external encoding operation can be executed in a trusted execution environment, which improves the practicality of the system.
[0046] 4. Based on existing auditing technologies based on hash chains and digital signatures, this invention adds digital watermarks to track and audit user access and query records of sensitive data; white-box cryptography combined with digital watermarks can prevent unauthorized access and tampering of watermark data, enhancing data confidentiality and credibility. Attached Figure Description
[0047] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0048] Figure 1 This is a flowchart of a method for providing transparent security services for sensitive data based on white-box cryptography, as described in an embodiment of the present invention.
[0049] Figure 2 This is a schematic diagram of a format-preserving encryption method based on white-box cryptography in an embodiment of the present invention.
[0050] Figure 3 This is a schematic diagram illustrating the format-preserving encryption of Chinese characters in an embodiment of the present invention.
[0051] Figure 4 This is a block cipher structure diagram of the white-box SM4 algorithm in an embodiment of the present invention. Detailed Implementation
[0052] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.
[0053] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.
[0054] White-box cryptography is an encryption algorithm technique that can resist white-box attacks. In 2002, Chow et al. proposed a software-oriented method for protecting cryptographic algorithms against key leakage at the SAC conference. This method transforms key operations into a series of lookup tables, hiding the key within these tables through obfuscation, affine transformations, and other techniques. The client performs encryption and decryption by looking up the white-box tables, and during this process, the client cannot obtain any other information about the key besides the white-box tables. Subsequently, academia and industry have proposed white-box implementation schemes for various standard cryptographic algorithms such as AES, SM2, SM4, and ECDSA. External encoding is a type of encoding in white-box cryptographic systems that uses linear and non-linear encoding to protect round key information. It uses the input and output of the cryptographic algorithm for encoding, protecting the information from the first and last rounds of the cryptographic algorithm.
[0055] Transparent transmission refers to using tunneling technology to complete data encryption, decryption, and anonymization at the transport layer. A customized secure transparent transmission software solution is designed and implemented, with a data gateway as the entry point for client applications. On the server side, data decryption and anonymization are implemented through the API layer to achieve transparent and secure data transmission. This process does not require any modifications to the original system.
[0056] Digital watermarking technology is a technique used to embed and extract hidden information in digital media or data. This technology embeds identification information (i.e., watermark) in an invisible form into the carrier according to a prescribed algorithm without affecting the visual effect. When needed, the identification information can be extracted from the carrier to prove copyright ownership. In this invention, it is mainly used to track and audit sensitive data to ensure the security of the system.
[0057] Please see Figure 1 One embodiment of this application provides a method for providing transparent security services for sensitive data based on white-box cryptography, comprising the following steps:
[0058] 1. Users with the appropriate permissions issue query requests, including regular query requests and advanced query requests;
[0059] 2. The SQL agent deployed on the cloud service uses a transparent protocol to parse and obtain the user's query request, sends the agent statement to the database, and retrieves the corresponding query content from the database;
[0060] 3. For ordinary query requests, the white-box cryptography service system calls the format obfuscation or sequence obfuscation method based on white-box cryptography (random obfuscation and desensitization) to encrypt and desensitize the query content, and the desensitized data is fed back to the user who made the ordinary query request.
[0061] 4. For advanced query requests, the white-box cryptography service system calls the white-box cryptography-based sequential encryption method or format encryption method to encrypt and de-identify the query content. After obtaining the de-identified data, the external encoding module is used to perform external encoding to obtain de-identified data with external encoding. This data is then input into the external decoding module and the white-box cryptography decryption module for decoding and decryption, and the query content is fed back to the user who issued the advanced query request.
[0062] Furthermore, the SQL agent is deployed on a cloud server separate from the database, with strict access control mechanisms to ensure that users with appropriate permissions can access the system and sensitive data. This prevents malicious data manipulation by external users and mitigates the risks of data leakage and misuse. Specifically:
[0063] If the SQL agent obtains a user's ordinary query request, since the ordinary query request does not contain sensitive data, the SQL agent directly sends the agent statement to the database based on the ordinary query request, and the query content returned by the database is anonymized through the white-box cryptographic service system;
[0064] If the SQL agent receives a user's advanced query request containing sensitive data, it first forwards the advanced query request to the sensitive data rule set module to generate the corresponding sensitive data rule set. Then, it sends the proxy statement to the database based on the advanced query request and the sensitive data rule set. Finally, it desensitizes the query content returned by the database through the white-box cryptography service system.
[0065] Furthermore, the sensitive data rule set module in this invention employs natural language processing technology. For different databases, it scans the field names and contents within the database and, in conjunction with user-preset sensitive data rules, generates corresponding sensitive data rule sets for database query behavior. When the SQL agent receives and forwards a user's advanced query request, it uses the sensitive data rule set to determine whether the user's query involves sensitive data fields, thereby achieving transparent identification of sensitive fields and serving the data anonymization process. The databases include relational databases and non-relational databases.
[0066] In this embodiment, the white-box cryptography service system provides two sensitive data protection methods for two different user query requests:
[0067] For ordinary query requests, the white-box cryptographic service system encrypts the complete original data using a format-preserving obfuscation operation or a sequence-preserving obfuscation operation based on a one-way cryptographic function. The resulting de-identified data is then sent back to the user who made the ordinary query request. Using a one-way cryptographic function to select the location of the encrypted query content effectively protects against brute-force attacks during the process of obtaining the de-identified data. Since ordinary queries do not require decryption, this invention uses a one-way cryptographic function instead of the block cipher algorithm used in existing format-preserving encryption solutions, improving efficiency and eliminating the need for a key, thus achieving security in a white-box environment. The de-identified data is then sent to the user who made the ordinary query request, who cannot reverse engineer the data to obtain the original data.
[0068] For advanced query requests, the white-box cryptography service system first uses a sequence or format preservation encryption method based on white-box cryptography to encrypt and de-identify the query content;
[0069] On the one hand, the specific steps for maintaining the encryption method are as follows:
[0070] The sizes of the plaintext and ciphertext spaces are defined. The query content returned by the database (such as Chinese characters, numbers, etc.) is mapped to binary form according to a dictionary to obtain the binary plaintext. This ensures that the encryption process maps a certain element in the plaintext space to another element in the ciphertext space, and the decryption process can remap that element from the ciphertext space back to the plaintext space. In this embodiment, the dictionary consists of the format of the query content and its corresponding binary string. For example, the query content format consisting of Chinese characters and their corresponding binary strings forms the dictionary.
[0071] The binary plaintext is divided into two parts and placed into a Feistel structure that preserves the encryption method based on white-box cryptography. Iterative calculation is performed with a round function based on block cipher to obtain binary ciphertext, which is then mapped by a dictionary into ciphertext with the same format as the query content.
[0072] In this embodiment, the input and output fields, namely the plaintext space and ciphertext space, in the encryption method are kept in the same format and have the same structure and size. The encrypted data (i.e., de-identified data) has the same format as the original data (i.e., query content).
[0073] like Figure 2 As shown, in the structure of the format-preserving encryption method, the input data length is len, and the input data will be divided into... Data blocks of length and data blocks of length v = len - u; F K This refers to the block cipher algorithm used at the underlying level; the standard recommends using the AES algorithm. During the first round of encryption, the B0 data block, data length `len`, adjustment factor `tweak`, and round number "0" are concatenated to form F. K Plaintext input, encryption result modulo addition with data block A0 to obtain B1, and A1 = B0; after several rounds of similar iterative processing, ciphertext is obtained.
[0074] Furthermore, during the operation of the format-preserving encryption method, when the data type of the query content is Chinese characters, such as... Figure 3 As shown, each Chinese character is mapped to the integer field Z through a mapping space. n Convert to integer data, then perform format-preserving encryption on the integer data to obtain the integer field Z. n The integer result is then mapped back to Chinese characters to obtain an encrypted result with the same format as the original Chinese characters.
[0075] On the other hand, the specific working steps of the sequential encryption method are as follows:
[0076] Define the sizes of the plaintext space and the ciphertext space, with the ciphertext space being larger than the plaintext space.
[0077] A binary search is used on the ciphertext space, and the intermediate value of the ciphertext obtained by the search is mapped from the ciphertext space to the plaintext space using a hypergeometric distribution based on a block cipher algorithm to obtain the mapped value.
[0078] The plaintext is compared with the mapping value. If the plaintext is less than the mapping value, the left half of the ciphertext space is selected to continue the binary search until the plaintext and the mapping value are equal, thus obtaining the ciphertext space corresponding to the mapping value. If the plaintext is greater than the mapping value, the right half of the ciphertext space is selected to continue the binary search until the plaintext and the mapping value are equal, thus obtaining the ciphertext space corresponding to the mapping value.
[0079] The ciphertext value is obtained by randomly sampling the ciphertext space corresponding to the mapped value, resulting in an encrypted result that maintains the same order as the plaintext, i.e., desensitized data. Since each plaintext corresponds to a random sample of ciphertext, and the order of the values in the ciphertext space is consistent with the order of the plaintext values, the encrypted ciphertext also maintains its order.
[0080] In this invention, the white-box cryptography service system employs white-box cryptography technology to encrypt and decrypt data, completing the encryption and decryption operations at the proxy layer, thus ensuring data security. In this embodiment, the white-box SM4 block cipher algorithm is used for data encryption and decryption. Figure 4 The structure diagram of the SM4 block cipher is shown, and its encryption operation process is described.
[0081] Specifically, the white-box SM4 block cipher algorithm employs a 32-round nonlinear iterative mechanism during encryption and decryption, performing encryption operations in units of 32-bit vectors. Let the algorithm input be (X0, X1, X2, x3) and the round key be rk0, then the round function F is:
[0082]
[0083] The nonlinear transformation τ consists of four parallel S-boxes. Let the input of the nonlinear transformation τ be... The output is but
[0084] (b0,b1,b2,b3)=τ(A)=(Sbox(a0),Sbox(a1),Sbox(a2),Sbox(a3))
[0085] The output of the nonlinear transformation τ is the input of the linear transformation L, let its input be... The output is but
[0086]
[0087] Let the plaintext input to the SM4 algorithm be (X0, X1, X2, X3), the ciphertext output be (Y0, Y1, Y2, Y3), and the round key be rk. i (i = 0, 1, ..., 31), then the encryption transformation of the SM4 algorithm is:
[0088]
[0089] (Y0,Y1,Y2,Y3)=R(X 32 ,X 33 ,X 34 ,X 35 )=(X 35 ,X 34 ,X 33 ,X 32 )
[0090] Where i = 0, 1, ..., 31; T is composed of nonlinear transformation τ and linear transformation L, and R is the reverse transformation operation.
[0091] In the SM4 key generation algorithm, the master key is initialized first:
[0092]
[0093] Where MK = (MK0, MK1, MK2, MK3) is the master key, and FK = (FK0, FK1, FK2, FK3) are system parameters.
[0094] The formula for generating the 32-round key is:
[0095]
[0096] Where i = 0, 1, ..., 31; T′ is composed of a nonlinear transformation τ and a linear transformation L′, where
[0097] Furthermore, to ensure data security in untrusted environments, the external encoding module of this invention adopts a white-box cryptographic external encoding method. It further encodes the de-identified data through a pre-set non-linear encoding table to obtain ciphertext data with external encoding, so that even in untrusted environments, the data ciphertext cannot be cracked, thereby ensuring data security. The external encoding module runs in a trusted execution environment.
[0098] Furthermore, to prevent the decoding table from being leaked, the decoding and white-box cryptographic decryption must also be performed in a trusted execution environment. This prevents attackers from performing code extraction attacks in a white-box environment, further enhancing the reliability and transparency of sensitive data security services. The external decoding module and the white-box cryptographic decryption module run in the trusted execution environment. The external decoding module decodes the de-identified data with external encoding using a pre-set non-linear decoding table to obtain the de-identified data. The decoding table and the encoding table are inverses of each other. The de-identified data obtained from the decoding is input into the white-box cryptographic decryption module for decryption, and the query content is fed back to the user who issued the advanced query request.
[0099] Furthermore, before feeding back the de-identified data or query content to the user, the method of the present invention also determines whether to add a digital watermark, thereby optimizing the tracking and auditing process of sensitive data, specifically as follows:
[0100] If the de-identified data or query content needs to be publicly audited or verified, then a digital watermark is embedded in the digital signature generated based on the de-identified data or query content, and digital watermark data is generated and fed back to the user.
[0101] If the anonymized data or query content only requires internal verification, a message verification code (MAC) is generated using a white-box Galois or counter mode based on the key of the anonymized data or query content. The MAC is then embedded as a digital watermark in the anonymized data or query content, and the generated digital watermark data is fed back to the user.
[0102] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.
[0103] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0104] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.
Claims
1. A method for providing transparent security services for sensitive data based on white-box cryptography, characterized in that: Includes the following steps: A user with the appropriate permissions issues a query request; the query request includes a normal query request and an advanced query request. The SQL agent deployed on the cloud service uses a transparent protocol to parse and obtain the user's query request, sends the agent statement to the database, and retrieves the corresponding query content from the database; For ordinary query requests, the white-box cryptography service system calls the format obfuscation or sequence obfuscation method based on white-box cryptography to encrypt and de-identify the query content, and the de-identified data is fed back to the user who made the ordinary query request. For ordinary query requests, the white-box cryptographic service system puts the query content returned by the database into a format-preserving obfuscation operation or a sequence-preserving obfuscation operation based on cryptographic one-way functions for encryption, and then feeds back the de-identified data to the user who made the ordinary query request. For advanced query requests, the white-box cryptography service system calls the white-box cryptography-based sequence-preserving encryption method or format-preserving encryption method to encrypt and de-identify the query content. After obtaining the de-identified data, an external encoding module is used to perform external encoding to obtain de-identified data with external encoding. The data is then input into an external decoding module and a white-box password decryption module for decoding and decryption, and the query content is fed back to the user who issued the advanced query request. For advanced query requests, the system calls a white-box cryptography service to perform encryption and desensitization processing on the query content using a format-preserving encryption method based on white-box cryptography. Specifically: Define the size of the plaintext space and the ciphertext space, and map the query content into binary form according to the dictionary to obtain the binary plaintext. The binary plaintext is divided into two parts and placed into a Feistel structure that preserves the encryption method based on white-box cryptography. Iterative calculation is performed with a round function based on block cipher to obtain binary ciphertext. Then, it is mapped by a dictionary to ciphertext with the same format as the query content to obtain de-identified data. The plaintext space and ciphertext space have the same structure and size, and the encrypted data has the same format as the original data. For advanced query requests, the system uses a white-box cryptography service to call a sequence-preserving encryption method based on white-box cryptography to encrypt and de-identify the query content, specifically as follows: Define the sizes of the plaintext space and the ciphertext space, wherein the size of the ciphertext space is greater than the size of the plaintext space; The order-preserving encryption method based on white-box cryptography encrypts the query content as plaintext to obtain ciphertext; A binary search is used on the ciphertext space, and the intermediate value of the ciphertext obtained by the search is mapped from the ciphertext space to the plaintext space using a hypergeometric distribution based on a block cipher algorithm to obtain the mapped value. The plaintext is compared with the mapping value. If the plaintext is less than the mapping value, the left half of the ciphertext space is selected to continue the binary search until the plaintext and the mapping value are equal, and the ciphertext space corresponding to the mapping value is obtained. If the plaintext is greater than the mapping value, the right half of the ciphertext space is selected to continue the binary search until the plaintext and the mapping value are equal, and the ciphertext space corresponding to the mapping value is obtained. Random sampling is performed on the ciphertext space corresponding to the mapping value to obtain the ciphertext value, resulting in an encrypted result that is consistent with the size order of the plaintext, i.e., desensitized data.
2. The method for providing transparent security services for sensitive data based on white-box cryptography according to claim 1, characterized in that, The SQL agent is deployed on a cloud server that is different from the database and has an access control mechanism; If the SQL agent obtains a user's ordinary query request, the SQL agent sends an agent statement to the database according to the ordinary query request, and the query content returned by the database is anonymized through the white-box cryptographic service system; If the SQL agent obtains a user's advanced query request, it forwards the advanced query request to the sensitive data rule set module to generate the corresponding sensitive data rule set. Then, based on the advanced query request and the sensitive data rule set, it sends an agent statement to the database and desensitizes the query content returned by the database through the white-box cryptography service system.
3. The method for providing transparent security services for sensitive data based on white-box cryptography according to claim 2, characterized in that, The sensitive data rule set module uses natural language processing technology to generate corresponding sensitive data rule sets for database query behavior by scanning the field names and contents in different databases and combining them with the user's preset sensitive data rules. The databases include relational databases and non-relational databases.
4. The method for providing transparent security services for sensitive data based on white-box cryptography according to claim 1, characterized in that, When the data type of the query content is Chinese characters, and a white-box cryptography-based encryption method is used, each Chinese character is mapped to an integer field through a mapping space. Z n Convert to integer data, then perform format-preserving encryption on the integer data to obtain the integer field. Z n The integer result is then mapped back to Chinese characters to obtain an encrypted result with the same format as the original Chinese characters.
5. The method for providing transparent security services for sensitive data based on white-box cryptography according to claim 1, characterized in that, The external encoding module performs external encoding on the de-identified data using a pre-set non-linear encoding table to obtain de-identified data with external encoding. The external encoding module runs in a trusted execution environment.
6. The method for providing transparent security services for sensitive data based on white-box cryptography according to claim 5, characterized in that, The external decoding module decodes the de-identified data with external encoding through a pre-set non-linear decoding table to obtain the de-identified data. The desensitized data obtained from decoding is input into the white-box cryptographic decryption module for decryption, and the query content is fed back to the user who issued the advanced query request. The decoding table and the encoding table are inverses of each other; The external decoding module and the white-box cryptographic decryption module run in a trusted execution environment.
7. The method for providing transparent security services for sensitive data based on white-box cryptography according to claim 1, characterized in that, The method further includes: Before providing anonymized data or query results to the user, determine whether to add a digital watermark. Specifically: If the de-identified data or query content needs to be publicly audited or verified, then a digital watermark is embedded in the digital signature generated based on the de-identified data or query content, and digital watermark data is generated and fed back to the user. If the anonymized data or query content only requires internal verification, a message verification code is generated using a white-box Galois or counter mode based on the key of the anonymized data or query content. The message verification code is then embedded as a digital watermark in the anonymized data or query content, and the generated digital watermark data is fed back to the user.