System and method for secure and efficient distributed high-dimensional data similarity query with tee assistance

Abstract

The application discloses a TEE-assisted safe and efficient distributed high-dimensional data similarity query method, which comprises the following steps: constructing a TEE-assisted safe and efficient distributed high-dimensional data similarity query system and initializing the query system; a data owner constructs the data in a data set into a TPSS form and distributes the data to a first cloud server and a second cloud server; a PB tree is constructed by using the distributed data; when an update data is added or deleted in the data set, the first cloud server, the second cloud server and a trusted execution environment search the PB tree by cooperative operation to add or delete the update data; and according to a similarity query request proposed by a query agent, the first cloud server, the second cloud server and the trusted execution environment provide query services for the query agent. The application can support safe query index construction, efficient similarity query processing and data dynamic updating based on distributed high-dimensional data outsourcing.

Description

Technical Field

[0001] This invention belongs to the field of data similarity query technology, specifically relating to a secure, efficient, distributed, high-dimensional data similarity query system and method assisted by TEE. Background Technology

[0002] With the rapid development of the Internet of Things and information technology, big data is showing a trend of rapid growth and distributed storage. Outsourcing big data to cloud servers with powerful storage and computing capabilities has become an effective means to alleviate the pressure of big data storage and improve the efficiency of big data processing. However, with the increasing awareness of data privacy protection and the promulgation of relevant privacy protection laws and regulations, data is usually stored in encrypted form on cloud servers, allowing cloud servers to provide users with data services such as queries based on encrypted data. Outsourced queries based on encrypted data can effectively protect data privacy, but encryption undermines data availability, leading to a decrease in the efficiency of encrypted data queries. Building a data query index is a common strategy to improve outsourced data queries, and the index is encrypted and sent to the cloud server along with the encrypted data to assist in outsourced queries. When the data is centrally stored by a single data owner, building and encrypting the query index is relatively easy; the query index is built only based on plaintext data and then encrypted. However, the constructed index basically cannot support dynamic data updates and is not suitable for scenarios with distributed data storage. Specifically, when data is vertically or horizontally distributed, the construction of the query index needs to be implemented through secure multi-party computation technology, resulting in significant computational overhead for the data owner and significant communication overhead between data owners.

[0003] To address secure similarity queries for high-dimensional data, scholars have proposed various solutions, but existing methods suffer from one or more limitations, such as linear query efficiency, inaccurate query results, and lack of support for distributed data and dynamic data updates. Specifically, researchers at the University of Texas at Dallas, in their paper "Efficient Similarity Search over Encrypted Data," proposed an approximate similarity query method based on Local-Sensitive Hashing (LSH) technology. This method uses a hash function to map nearby points to the same value, improving the efficiency of similarity queries; and introduces symmetric searchable encryption to protect the privacy of LSH-based similarity queries. This method has high query efficiency but cannot support dynamic data updates. Building on this, researchers at City University of Hong Kong and the City University of Hong Kong Shenzhen Research Institute, in their paper "EncSIM: An Encrypted Similarity Search Service for Distributed High-dimensional Datasets," cleverly combine pairwise LSH with a forward-secure symmetric searchable encryption method to achieve secure and efficient similarity queries while supporting dynamic data addition. In their paper "Towards Secure Approximate k-Nearest Neighbor Query Over Encrypted High-Dimensional Data," researchers from Xi'an University of Electronic Science and Technology proposed a secure greedy partitioning method based on LSH encoding and optimized linear sorting. This method enables secure approximate distance calculation and similarity querying for high-dimensional data. In their paper "Secure k Nearest Neighbors Query for High-Dimensional Vectors in Outsourced Environments," they designed a secure inverted file index using coarse-grained encryption, AES encryption, and Paillier homomorphic encryption, and based on this index, achieved efficient approximate distance calculation for high-dimensional data. While these methods offer sublinear query efficiency, they only achieve approximate similarity queries, cannot guarantee the accuracy of query results, and cannot fully support dynamic updates of distributed data.

[0004] Furthermore, some secure similarity query methods proposed by scholars for low-dimensional data can also be used to achieve secure similarity queries for high-dimensional data. Specifically, scholars from the University of Hong Kong, in their paper "Secure kNN Computation on Encrypted Databases," utilized invertible matrix encryption to effectively determine the distance order between data records and query data based on the encrypted data, thus achieving secure similarity queries. However, this method has weak security and cannot resist known-plaintext attacks. To enhance the security of this method, scholars from the University of New Brunswick, in their paper "Efficient Privacy-preserving Similarity Range Query with Quadsector Tree in eHealthcare," proposed an improved matrix encryption method. By introducing more random values, this method ensures its resistance to known-plaintext attacks; however, the query efficiency of this method is linearly related to the dataset size. In their paper "Secure k-Nearest Neighbor Query over Encrypted Data in Outsourced Environments," researchers at Missouri University of Science and Technology designed a series of privacy-preserving protocols using additive homomorphic encryption, including secure multiplication and secure Euclidean distance calculation. They used these protocols to protect the privacy of similarity queries, but the query efficiency was still linearly related to the size of the dataset.

[0005] Therefore, designing secure and efficient similarity query methods for distributed high-dimensional data remains a significant challenge. Summary of the Invention

[0006] To address the aforementioned problems in the existing technology, this invention provides a secure, efficient, distributed, high-dimensional data similarity query system and method assisted by a Trusted Execution Environment (TEE). The technical problem to be solved by this invention is achieved through the following technical solution:

[0007] This invention provides a secure and efficient distributed high-dimensional data similarity query method assisted by a TEE (Translation Engine), comprising:

[0008] S1: Construct a secure, efficient, distributed, high-dimensional data similarity query system assisted by a TEE. Initialize the secure, efficient, distributed, high-dimensional data similarity query system. The system includes a data owner (DO), a first cloud server (CS1), a second cloud server (CS2), a trusted execution environment (TEE), a neutral party (NP), and a query agent (QA). The first cloud server (CS1) is located on a first cloud server platform, and the second cloud server (CS2) and the trusted execution environment (TEE) are located on a second cloud server platform.

[0009] S2: The data owner DO will transfer the dataset it owns. The data is constructed in TPSS format and distributed and outsourced to the first cloud server CS1 and the second cloud server CS2.

[0010] S3: Construct a PB tree using the TPSS data outsourced to the first cloud server CS1 and the second cloud server CS2;

[0011] S4: When in the dataset Add or delete an updated data At that time, the first cloud server CS1, the second cloud server CS2, and the trusted execution environment TEE search the PB tree through collaborative computation to update the data. Add or delete;

[0012] S5: Based on the similarity query request proposed by the query agent QA, the first cloud server CS1, the second cloud server CS2, and the trusted execution environment TEE provide query services to the query agent QA.

[0013] In one embodiment of the present invention, the initialization of the secure, efficient, distributed, high-dimensional data similarity query system includes:

[0014] The data owner DO initializes the first cloud server CS1; the query agent QA initializes the second cloud server CS2; and the neutral party NP creates the trusted execution environment TEE.

[0015] The data owner DO and the neutral party NP negotiate a κ-bit symmetric key k1 and a pseudo-random function. Where κ is a safety parameter. The query agent QA and the neutral party NP negotiate a κ-bit symmetric key k2. The data owner DO sends the symmetric key k1 to the first cloud server CS1 and publishes the pseudo-random function F. The query agent QA sends the symmetric key k2 to the second cloud server CS2. The neutral party NP deploys {k1,k2} on the Trusted Execution Environment (TEE).

[0016] The data owner DO publicly discloses the data value range D. X And publicly disclose the leaf node capacity threshold num of the constructed PB tree.

[0017] In one embodiment of the present invention, S2 includes:

[0018] S201: The j-th data owner DO j Each data x in its dataset i,j The construction is in TPSS form, i.e. Among them, {x i,j,1 ,x i,j,2 ,x i,j,2}yes Three random values ​​in x, and satisfying x i,j,1 +x i,j,2 +x i,j,3 =x i,j ,

[0019] S202: The j-th data owner DO j Data (x) i,j,1 ,x i,j,2 The data (x) is outsourced to the first cloud server CS1. i,j,2 ,x i,j,3 The outsourcing is to the second cloud server CS2.

[0020] In one embodiment of the present invention, S3 includes:

[0021] If dataset If the amount of data in the dataset is less than the leaf node capacity threshold num, then the first cloud server CS1 and the second cloud server CS2 directly construct a structure containing the dataset. The leaf node; otherwise, the first cloud server CS1 and the second cloud server CS2 construct an internal node. in, The reference point vector is in TPSS form. Random labels in TPSS format; simultaneously, based on Dataset Split into two subsets And based on Construct the left and right subtrees of the internal nodes; ultimately, the first cloud server CS1 and the second cloud server CS2 construct a PB tree in TPSS form.

[0022] In one embodiment of the present invention, the first cloud server CS1 and the second cloud server CS2 construct an internal node. include:

[0023] S301: The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) use a random value generation algorithm to generate two reference point vectors in TPSS form through collaborative computation, denoted as...

[0024] S302: The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) generate a random tag in TPSS form through collaborative computing.

[0025] S303: The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) according to... The value of the dataset Divided into and When b = 1, and for:

[0026]

[0027] When b = -1 and for:

[0028]

[0029] Where d(·,·) represents the Euclidean distance between two vectors, and N represents the number of data points in the dataset;

[0030] S304: The first cloud server CS1 and the second cloud server CS2 construct an internal node. And according to Create the left subtree of the internal node, based on By creating the right subtree of the internal nodes, the first cloud server CS1 and the second cloud server CS2 ultimately obtain a PB tree in TPSS form.

[0031] In one embodiment of the present invention, the random value generation algorithm in S301 includes:

[0032] The second cloud server CS2 selects a random value x∈D and constructs its TPSS form. The second cloud server CS2 retains (x2, x3) and sends (x3, x1) to the Trusted Execution Environment (TEE), where D represents the value range of the reference point data;

[0033] The Trusted Execution Environment (TEE) selects a random value y∈D and constructs its TPSS form. The Trusted Execution Environment (TEE) retains (y3, y1) and sends (y2, y3) to the second cloud server CS2;

[0034] The second cloud server CS2 and the Trusted Execution Environment (TEE) calculate (x2+y2, x3+y3) and (x3+y3, x1+y1) respectively. Then, the second cloud server CS2 sends x2+y2 to the first cloud server CS1, and the Trusted Execution Environment (TEE) sends x1+y1 to the first cloud server CS1. The generated random number is r = x + y, and the TPSS format is... Where r1 = x1 + y1, r2 = x2 + y2, r3 = x3 + y3.

[0035] In one embodiment of the present invention, S302 includes:

[0036] The first cloud server CS1 generates a random label x∈{-1,1} and constructs its TPSS form. And send (x2, x3) to the second cloud server CS2;

[0037] The second cloud server CS2 generates a random label y∈{-1,1}, and constructs its TPSS form. And send (y1, y2) to the first cloud server CS1;

[0038] The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the TPSS secure multiplication algorithm to calculate...

[0039] In one embodiment of the present invention, S4 includes:

[0040] The data owner, DO, will update data x. i In the form of TPSS Outsourced to the first cloud server CS1 and the second cloud server CS2, wherein the first cloud server CS1 holds (x i,1 ,x i,2 The second cloud server CS2 holds (x) i,2 ,x i,3);

[0041] The PB tree is searched using cooperative computation, when the internal node... Satisfy b*(d(x) i p1) 2 -d(x i p2) 2 If 0 ≤ 0, search the left subtree; otherwise, search the right subtree, until a leaf node is reached.

[0042] If data is to be updated For the data to be added, directly update the data. Insert into the leaf node found in the search; if inserting, update the data. If the amount of data in a leaf node exceeds the leaf node capacity threshold num, then the current leaf node will be split.

[0043] If data is pending update For each data point in the leaf node, the data to be deleted is... Determine whether d(x) is satisfied. i ,x j ) 2 If x ≤ 0, and the inequality holds, then the data x j delete.

[0044] In one embodiment of the present invention, S5 includes:

[0045] S501: Given a similarity query request (q, τ), the query agent QA encrypts the similarity query request (q, τ) into TPSS format. and And and Send to the first cloud server CS1 and the second cloud server CS2, where q represents the query record, τ represents the distance threshold, and τ′=τ 2 ;

[0046] S502: By searching the PB tree, obtain the data records that meet the query conditions, i.e. When a leaf node of the PB tree is retrieved, each piece of data in the leaf node is examined. Does d(x) satisfy? i If ,q)≤τ, then the data Add to query result set

[0047] When the internal node of the PB tree When retrieved, determine whether (3b-1)*d(p1,q) is satisfied. 2 -(3b+1)*d(p2,q) 2If -16τ′>0, the left subtree of the current internal node is pruned, and it is determined whether (3b+1)*d(p1,q) is satisfied. 2 +(1-3b)*d(p2,q) 2 If +16τ′<0, the right subtree of the current internal node is pruned; otherwise, both the left and right subtrees are searched. Finally, the first cloud server CS1 and the second cloud server CS2 obtain the query result set.

[0048] S503: For The first cloud server CS1 will R q,τ,1 ={(x i,1 ,x i,2 )|d(x i ,q)≤τ} is returned to the query agent QA, and the second cloud server CS2 will return R q,τ,2 ={(x i,2 ,x i,3 )|d(x i The query result is returned to the query agent QA, which then recovers the query result based on the received data.

[0049] Another aspect of the present invention provides a secure and efficient distributed high-dimensional data similarity query system assisted by a TEE, including a data owner (DO), a first cloud server (CS1), a second cloud server (CS2), a trusted execution environment (TEE), a neutral party (NP), and a query agent (QA). The first cloud server (CS1) is located on a first cloud server platform, and the second cloud server (CS2) and the trusted execution environment (TEE) are located on a second cloud server platform.

[0050] The data owner DO is used to initialize the first cloud server CS1, negotiate a key with the neutral party NP, send the negotiated key to the first cloud server CS1, and outsource the distributed data; the first cloud server CS1 and the second cloud server CS2 are used to store the outsourced data, build a PB tree index based on the outsourced data, dynamically update the data, and process similarity query requests.

[0051] The Trusted Execution Environment (TEE) is used to assist the first cloud server CS1 and the second cloud server CS2 in establishing a PB tree, dynamically updating data, and processing query requests; the Neutral Party (NP) is used to create the TEE on the second cloud server platform, negotiate keys with the data owner (DO) and the query agent (QA), and deploy the negotiated keys in the TEE.

[0052] The query agent QA is used to negotiate a key with the neutral party NP, send the negotiated key to the second cloud server CS2, and encrypt the query request on behalf of the user, and initiate a query request to the first cloud server CS1 and the second cloud server CS2.

[0053] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0054] To improve the processing efficiency of distributed high-dimensional data similarity queries while ensuring data security, and to reduce the computational and communication overhead for data owners, this invention proposes a secure and efficient distributed high-dimensional data similarity query system and method assisted by a TEE in a cloud computing scenario, which has the following advantages:

[0055] (1) Supports secure similarity queries and dynamic data updates for distributed data. This invention builds a query index based on outsourced distributed data, which can securely and efficiently support similarity queries for horizontally and vertically distributed data, and designs a dynamic data update algorithm to support the dynamic addition and deletion of data.

[0056] (2) Strong data security processing. The security of the process of building a secure similarity query index, processing similarity queries, and dynamically updating data is protected by secret sharing technology. This ensures that the data is stored on two cloud servers in a secret sharing manner, so that the cloud servers cannot infer plaintext data information from the stored data and the intermediate results of the processed data, thus ensuring that the data is strongly protected during processing.

[0057] (3) Efficient data computation. By introducing a tree-structured query index based on reference point data, an efficient high-dimensional data similarity query algorithm is proposed. At the same time, a fast three-party secret sharing technology is designed using a Trusted Execution Environment (TEE), and a series of efficient privacy protection algorithms are designed based on the three-party secret sharing technology to protect data privacy during the construction of the similarity query index, similarity query processing, and dynamic data update.

[0058] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0059] Figure 1 This is a flowchart of a secure and efficient distributed high-dimensional data similarity query method assisted by a TEE, provided in an embodiment of the present invention.

[0060] Figure 2 This is a detailed processing diagram of a secure and efficient distributed high-dimensional data similarity query system provided in an embodiment of the present invention;

[0061] Figure 3This is a schematic diagram of the structure of a secure and efficient distributed high-dimensional data similarity query system provided in an embodiment of the present invention. Detailed Implementation

[0062] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the following describes in detail a TEE-assisted secure and efficient distributed high-dimensional data similarity query method proposed according to the present invention, in conjunction with the accompanying drawings and specific embodiments.

[0063] The foregoing and other technical contents, features, and effects of the present invention will be clearly presented in the following detailed description of specific embodiments in conjunction with the accompanying drawings. Through the description of the specific embodiments, a more in-depth and concrete understanding can be gained of the technical means and effects adopted by the present invention to achieve its intended purpose. However, the accompanying drawings are for reference and illustration only and are not intended to limit the technical solutions of the present invention.

[0064] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or apparatus comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or apparatus that includes said element.

[0065] Example 1

[0066] This invention provides a secure, efficient, distributed, high-dimensional data similarity query method assisted by a TEE (Translation Exchange Equipment). Please refer to [link to TEE documentation]. Figure 1 and Figure 2 The query method includes:

[0067] S1: Construct a secure, efficient, distributed, high-dimensional data similarity query system assisted by TEE, and initialize the secure, efficient, distributed, high-dimensional data similarity query system.

[0068] Specifically, please see Figure 3 , Figure 3This is a schematic diagram of the structure of a secure, efficient, distributed, high-dimensional data similarity query system assisted by a TEE (Trusted Execution Environment) according to an embodiment of the present invention. The query system includes a data owner (DO), a first cloud server (CS1), a second cloud server (CS2), a trusted execution environment (TEE), a neutral party (NP), and a query agent (QA). The first cloud server (CS1) is located on a first cloud server platform, and the second cloud server (CS2) and the trusted execution environment (TEE) are located on a second cloud server platform. The data owner (DO) is responsible for initializing the first cloud server (CS1), negotiating a key with the neutral party (NP), sending the negotiated key to the first cloud server (CS1), and outsourcing distributed data. The first cloud server (CS1) and the second cloud server (CS2) are used to store the outsourced data and establish a pivot-based system based on the outsourced data. The system uses a PB tree index to dynamically update data and handle similarity query requests. The Trusted Execution Environment (TEE) assists the first cloud server (CS1) and the second cloud server (CS2) in establishing the PB tree, dynamically updating data, and processing query requests. The neutral party (NP) is responsible for creating the TEE on the second cloud server platform, negotiating keys with the data owner (DO) and the query agent (QA), and deploying the negotiated keys within the TEE. The query agent (QA) negotiates keys with the neutral party (NP), sends the negotiated keys to the second cloud server (CS2), and encrypts query requests on behalf of the user, initiating query requests to both the first cloud server (CS1) and the second cloud server (CS2).

[0069] Furthermore, the secure and efficient distributed high-dimensional data similarity query system is initialized, and the specific processing steps include:

[0070] S101: Data owner DO initializes the first cloud server CS1; query agent QA initializes the second cloud server CS2; and neutral party NP creates a Trusted Execution Environment (TEE) on the same cloud server platform.

[0071] S102: Key negotiation and distribution: The data owner DO and the neutral party NP negotiate a κ-bit symmetric key K1 and a pseudo-random function. Where κ is a safety parameter. The set of query agents (QA) and neutral parties (NP) negotiate a κ-bit symmetric key k2. The data owner (DO) sends the symmetric key k1 to the first cloud server (CS1) and publishes the pseudo-random function F; the query agent (QA) sends the symmetric key k2 to the second cloud server (CS2); and the neutral party (NP) deploys {k1, k2} in a Trusted Execution Environment (TEE).

[0072] S103: Public parameter settings, data owner DO public data value range D X The capacity threshold of the leaf nodes of the constructed PB tree is publicly disclosed, denoted as num.

[0073] S2: The data owner, DO, will transfer the dataset he owns. The data is structured in the form of Three-Party Secret Sharing (TPSS) and distributed and outsourced to the first cloud server CS1 and the second cloud server CS2.

[0074] A dataset The data is distributed vertically or horizontally among multiple data owners (DOs), where N represents the number of data entries in the dataset, and d represents the dimension of the data in the dataset. Each data owner (DO) j Each data value x in its dataset i,j Outsource to the first cloud server CS1 and the second cloud server CS2 in the following manner.

[0075] S201: Data TPSS indicates that the j-th data owner DO j Each data value x in its dataset i,j Constructed in TPSS form

[0076] Specifically, the j-th data owner DO j Data value x i,j The structure is in the form of TPSS, that is Where {x i,j,1 ,x i,j,2 ,x i,j,3}yes Three random values ​​in x, and satisfying x i,j,1 +x i,j,2 +x i,j,3 =x i,j .

[0077] The core idea of ​​the TPSS scheme used in this embodiment is to split a secret value x into 3 parts, that is... Where x1 + x2 + x3 = x. Then, this is shared between the first cloud server CS1 and the second cloud server CS2, where the first cloud server CS1 holds (x1, x2) and the second cloud server CS2 holds (x2, x3). It should be noted that this is a secret shared data in TPSS form. The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) can implement secure addition, secure subtraction, secure scalar multiplication, and secure multiplication in the form of TPSS through the following algorithms.

[0078] (a) Safe addition / subtraction: This can be accomplished through local computation on the first cloud server CS1 and the second cloud server CS2, where the first cloud server CS1 calculates (x1±y1,x2±y2) and the second cloud server CS2 calculates (x2±y2,x3±y3).

[0079] (ii) Secure number multiplication: Given This can be accomplished through local computation on the first cloud server CS1 and the second cloud server CS2, where the first cloud server CS1 calculates (kx1, kx2) and the second cloud server CS2 calculates (kx2, kx3).

[0080] (III) Safe Multiplication: The calculation needs to be completed using the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) according to the following steps:

[0081] (1) The first cloud server CS1 calculates s1 = x1y1 + x1y2 + x2y1 + α1;

[0082] (2) The second cloud server CS2 calculates s2 = x2y2 + x2y3 + x3y2 + α2 and sends s2 to the first cloud server CS1;

[0083] (3) The first cloud server CS1 sends {x1,y1} to the Trusted Execution Environment (TEE), and the second cloud server CS2 sends {x3,y3} to the TEE. After receiving the data, the TEE calculates s3 = x3y3 + x3y1 + x1y3 + α3, and sends s3 to the second cloud server CS2.

[0084] in, These are random values ​​that satisfy α1 + α2 + α3 = 0. Meanwhile, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) can generate {α1, α2, α3} through local computation. The specific steps are as follows:

[0085] (a) Computing on the first cloud server CS1

[0086] (b) Computing on the second cloud server CS2

[0087] (c) Trusted Execution Environment (TEE) Computation and And set α3 = -α1 - α2;

[0088] Where {k1,k2} are the keys set during the initialization phase, F is the pseudo-random function selected during the initialization phase, and id can be considered as the identity of the current computing session. Ultimately, the first cloud server CS1 and the second cloud server CS2 obtain... Among them, the first cloud server CS1 holds (s1,s2), and the second cloud server CS2 holds (s2,s3).

[0089] S202: Data outsourcing, the j-th data owner DO j Data (x) i,j,1 ,x i,j,2 The data (x) was outsourced to the first cloud server CS1. i,j,2 ,x i,j,3 It was outsourced to the second cloud server CS2.

[0090] S3: Construct a PB tree using data in TPSS format that is outsourced to the first cloud server CS1 and the second cloud server CS2.

[0091] After the first cloud server CS1 and the second cloud server CS2 receive the outsourced data, they can obtain a dataset in TPSS format, denoted as: in N represents the number of data entries in the dataset. Subsequently, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) construct an encrypted PB tree based on this dataset. The specific process is as follows: If the dataset... If the amount of data in the dataset is less than the leaf node capacity threshold num, then the first cloud server CS1 and the second cloud server CS2 directly construct a dataset containing the dataset. The leaf node; otherwise, the first cloud server CS1 and the second cloud server CS2 construct an internal node. in, The reference point vector is in TPSS form. Random labels in TPSS format.

[0092] In this embodiment, the first cloud server CS1 and the second cloud server CS2 construct an internal node. Specifically, it includes:

[0093] S301: Random Reference Point Generation. The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) utilize a random value generation algorithm to generate two reference point vectors in TPSS form through collaborative computation, denoted as...

[0094] Specifically, the random value generation algorithm in this step is performed by the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE). The core idea is that the first cloud server CS1, the second cloud server CS2, and the TEE collaboratively generate a random number r∈D within a given range, where r exists in the form of TPSS on both the first cloud server CS1 and the second cloud server CS2, i.e.: The first cloud server CS1 holds (r1, r2), and the second cloud server CS2 holds (r2, r3). ​​D represents the value range of a set reference point data. The detailed random value generation algorithm steps are as follows:

[0095] (1) The second cloud server CS2 selects a random value x∈D and constructs its TPSS form. Then, it retains (x2,x3) and sends (x3,x1) to the Trusted Execution Environment (TEE).

[0096] (2) The Trusted Execution Environment (TEE) selects a random value y∈D and constructs its TPSS form. Then, it retains (y3, y1) and sends (y2, y3) to the second cloud server CS2.

[0097] (3) The second cloud server CS2 and the Trusted Execution Environment (TEE) calculate (x2+y2, x3+y3) and (x3+y3, x1+y1) respectively. Then, the second cloud server CS2 sends x2+y2 to the first cloud server CS1, and the Trusted Execution Environment (TEE) sends x1+y1 to the first cloud server CS1. The generated random number is r = x + y, and the TPSS format is... Where r1 = x1 + y1, r2 = x2 + y2, r3 = x3 + y3.

[0098] S302: Random Tag Generation. The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) collaboratively generate a random tag in TPSS format. b∈{-1,1}.

[0099] Specifically, the random label generation operation is performed by the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE). The core idea is that the first cloud server CS1 generates a random label x∈{-1,1}, constructs its TPSS form, and shares it with the second cloud server CS2; the second cloud server CS2 generates a random label y∈{-1,1}, constructs its TPSS form, and shares it with the first cloud server CS1. Then, the first cloud server CS1 and the second cloud server CS2 calculate using the TPSS secure multiplication algorithm. The detailed steps are as follows:

[0100] (1) The first cloud server CS1 generates a random label x∈{-1,1}, and constructs its TPSS form, i.e. Then send (x2,x3) to the second cloud server CS2.

[0101] (2) The second cloud server CS2 generates a random label y∈{-1,1}, and constructs its TPSS form, i.e. Then send (y1, y2) to the first cloud server CS1.

[0102] (3) The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the TPSS secure multiplication algorithm to calculate. Among them, the Trusted Execution Environment (TEE) is used to assist in computation and helps reduce communication overhead.

[0103] S303: First cloud server CS1, second cloud server CS2, and Trusted Execution Environment (TEE) according to... The value of the dataset Divided into and Where, when b=1, and for:

[0104]

[0105] When b = -1 and for:

[0106]

[0107] Where d(·,·) represents the Euclidean distance between two vectors, and N represents the number of data entries in the dataset.

[0108] It should be noted that, in addition to TPSS's secure addition, secure subtraction, secure scalar multiplication, and secure multiplication, the data partitioning operation also requires a privacy-preserving symbolic computation algorithm, i.e., given a number in TPSS form... Determine if x ≤ 0. Specifically, if x ≥ 0, then x ∈ [0, 2]. β If x < 0, then x ∈ [2]. n-β ,2 n ).

[0109] (1) The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the secure random value generation algorithm to generate two random values ​​r1 and r2, satisfying r1 > r2. To ensure r1 > r2, when calling the secure random value generation algorithm, the random value {x, y} selected for {r1, r2} should belong to {0, 1}. γ And the random value chosen for r1 is greater than the random value chosen for r2, where

[0110] (2) The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the secure multiplication and secure subtraction algorithms to calculate. Then, the first cloud server CS1 sends z1 to the second cloud server CS2, and the second cloud server CS2 sends z3 to the first cloud server CS1. Afterwards, the first cloud server CS1 and the second cloud server CS2 can recover z. If z < 2 n / 2. From the first cloud server CS1 and the second cloud server CS2, we can deduce that x > 0. Otherwise, we can deduce that x ≤ 0.

[0111] S304: Internal node construction. An internal node is constructed using the first cloud server CS1 and the second cloud server CS2. And according to Create the left subtree of the internal node, based on By creating the right subtree of the internal nodes, the first cloud server CS1 and the second cloud server CS2 ultimately obtain a PB tree in TPSS form, denoted as...

[0112] S4: When in the dataset Add or delete an updated data At that time, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) search the PB tree through collaborative computing to update the data. Add or delete.

[0113] In this embodiment, step S4 specifically includes:

[0114] S401: Update Data Outsourcing, Data Owner (DO) will update data x i In the form of TPSS, i.e. Outsourced to the first cloud server CS1 and the second cloud server CS2, where the first cloud server CS1 holds (x i,1 ,x i,2 The second cloud server CS2 holds (x) i,2 ,x i,3 ).

[0115] S402: PB tree retrieval, searching the PB tree on the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE). When internal nodes Satisfy b*(d(x) i p1) 2 -d(x i p2) 2 If )≤0, search the left subtree; otherwise, search the right subtree, until a leaf node is reached.

[0116] Specifically, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) search the PB tree. When searching an internal node... At that time, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the TPSS scheme's addition, subtraction, and multiplication algorithms to calculate z = b*(d(x) i p1) 2 -d(x i p2) 2 The algorithm then calls a privacy-preserving symbolic computation algorithm to determine if z ≤ 0. If the inequality holds, it continues searching the left subtree; otherwise, it continues searching the right subtree. Eventually, it will reach a leaf node.

[0117] S403: Add data, if The data being added, directly the data Insert data into the leaf node. If the amount of data in the leaf node exceeds `num` after insertion, then split the leaf node.

[0118] If data is updated For the data to be added, directly update the data. Insert into the leaf node found in the search; if inserting, update the data. Afterwards, if the amount of data in the leaf node exceeds the leaf node capacity threshold num, the first cloud server CS1 and the second cloud server CS2 will split the leaf node according to step S304.

[0119] If data is updated For each data point in the leaf node, the data to be deleted is... The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) work together to determine whether d(x) is satisfied. i ,x j ) 2 ≤0. If the inequality holds, the data x can be... j delete.

[0120] Specifically, for each data record in the leaf node The addition, subtraction, and multiplication algorithms of the TPSS scheme are calculated using the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE). Then, a privacy-preserving symbolic computation algorithm is used to determine whether d(x) is satisfied. i ,x j ) 2 ≤0. If the inequality holds, according to d(x) i ,x j ) 2 ≥0 implies d(x) i ,x j ) 2 =0, then x j =x i x can be j delete.

[0121] S5: Based on the similarity query request submitted by the query agent, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) provide query services to the query agent.

[0122] Step S5 in this embodiment specifically includes:

[0123] S501: Query Encryption. Given a similarity query request (q, τ), the query agent QA encrypts it as... and Where τ ′ =τ 2 and will and Send to the first cloud server CS1 and the second cloud server CS2.

[0124] Specifically, when the query agent QA wants to initiate a similarity query request (q, τ), it represents the similarity query request in TPSS form, that is: and Where q is the query record, τ is the distance threshold, and τ ′ =τ 2 Subsequently, the query agent QA will use {(q1,q2),(τ1)} to query the proxy QA. ′ ,τ ′ 2)} is sent to the first cloud server CS1, and {(q2,q3),(τ ′ 2,τ ′ 3)} Send to the second cloud server CS2.

[0125] S502: PB tree retrieval. When a leaf node is retrieved, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) determine whether the conditions are met. If so, Add to query result set R q,τ .

[0126] Specifically, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) retrieve data records that meet the query conditions by searching the PB tree. When a leaf node is retrieved, for each data record of the leaf node... The addition, subtraction, and multiplication algorithms of the TPSS scheme are calculated using the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE). And call a privacy-preserving symbolic computation algorithm to determine whether z ′ ≤0. If the inequality holds, then d(x) can be deduced. i ,q)≤τ,can be Add to query result set R q,τ .

[0127] When the internal node of the PB tree When being retrieved, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) determine whether (3b-1)*d(p1,q) is satisfied. 2 -(3b+1)*d(p2,q) 2 If -16τ′>0, the left subtree of this node can be pruned, and it is determined whether (3b+1)*d(p1,q) is satisfied. 2 +(1-3b)*d(p2,q) 2 If +16τ′<0, the right subtree of this node can be pruned. Otherwise, both the left and right subtrees need to be searched. Finally, the first cloud server CS1 and the second cloud server CS2 obtain the query result set.

[0128] Specifically, when an internal node When retrieved, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the addition, subtraction, scalar multiplication, and multiplication algorithms of the TPSS scheme to calculate:

[0129]

[0130] It then calls a privacy-preserving symbolic computation algorithm to determine whether z1 > 0 and z2 < 0. If z1 > 0, the left subtree of the current node can be pruned; if z2 < 0, the right subtree of the current node can be pruned. Otherwise, both the left and right subtrees need to be searched.

[0131] S503: Query result return and recovery, for The first cloud server CS1 will R q,τ,1 ={(x i,1 ,xi,2 )|d(x i ,q)≤τ} is returned to the query agent QA, and the second cloud server CS2 will return R q,τ,2 ={(x i,2 ,x i,3 )|d(x i The query result (q) ≤ τ is returned to the query agent (QA). The query agent (QA) can then reconstruct the query result based on the received data.

[0132] After completing the above steps on the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE), the query results can be obtained. And for a data record Its TPSS share (x i,1 ,x i,2 (x) is held by the first cloud server CS1. i,2 ,x i,3 The data is held by the second cloud server CS2. Subsequently, the first cloud server CS1 will hold R... q,τ,1 ={(x i,1 ,x i,2 )|d(x i ,q)≤τ} is returned to the query agent QA, and the second cloud server CS2 will return R q,τ,2 ={(x i,2 ,x i,3 )|d(x i The query result (x, q) ≤ τ is returned to the query agent (QA). The QA can then reconstruct the query result based on the received data. Specifically, x i =x i,1 +x i,2 +x i,3 .

[0133] Example 2

[0134] Building upon Embodiment 1, this embodiment provides a secure and efficient distributed high-dimensional data similarity query system assisted by a TEE. This system includes a data owner (DO), a first cloud server (CS1), a second cloud server (CS2), a trusted execution environment (TEE), a neutral party (NP), and a query agent (QA). The first cloud server (CS1) resides on a first cloud server platform, while the second cloud server (CS2) and the trusted execution environment (TEE) reside on a second cloud server platform. The data owner (DO) is responsible for initializing the first cloud server (CS1), negotiating a key with the neutral party (NP), sending the negotiated key to the first cloud server (CS1), and outsourcing the distributed data. The first cloud server (CS1) and the second cloud server (CS2) are used for storage... The system stores outsourced data, builds a PB tree index based on the outsourced data, dynamically updates the data, and handles similarity query requests. The Trusted Execution Environment (TEE) is responsible for assisting the first cloud server (CS1) and the second cloud server (CS2) in building the PB tree, dynamically updating the data, and handling query requests. The neutral party (NP) is responsible for creating the TEE on the second cloud server platform, negotiating keys with the data owner (DO) and the query agent (QA), and deploying the negotiated keys in the TEE. The query agent (QA) is responsible for negotiating keys with the neutral party (NP), sending the negotiated keys to the second cloud server (CS2), encrypting query requests on behalf of the user, and initiating query requests to the first cloud server (CS1) and the second cloud server (CS2).

[0135] Furthermore, the specific functions of the data owner (DO) include:

[0136] Cloud server initialization: Initialize the first cloud server CS1 on the first cloud server platform.

[0137] Key negotiation and distribution: Negotiate a key with the neutral party NP to obtain a shared key k1, and send the shared key k1 to the first cloud server CS1.

[0138] Data outsourcing: For each random value x in the dataset... i,j Represented in TPSS format and (x) i,j,1 ,x i,j,2 Outsourced to the first cloud server CS1, and (x i,j,2 ,x i,j,3 It was outsourced to the second cloud server CS2.

[0139] Furthermore, the specific functions of the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) include:

[0140] PB tree construction: First cloud server CS1, second cloud server CS2, and Trusted Execution Environment (TEE) based on outsourced data Construct an encrypted PB tree If outsourced data If the amount of data in the database is less than the threshold num, then the first cloud server CS1 and the second cloud server CS2 will directly construct a database containing that data. The leaf node; otherwise, the first cloud server CS1 and the second cloud server CS2 will construct an internal node. First, a reference point vector is generated by running a random value generation algorithm. Secondly, a random label in TPSS format is generated by running a random label generation algorithm. Where b∈{-1,1}; again, according to The value will be outsourced data Divided into and When b = 1, and for:

[0141]

[0142] Where d(·,·) represents the Euclidean distance between the two vectors.

[0143] When b = -1 and for:

[0144]

[0145] Subsequently, the first cloud server CS1 and the second cloud server CS2 construct an internal node. And the left subtree of this node is based on Create, right subtree based on Creation. Ultimately, the first cloud server CS1 and the second cloud server CS2 obtain a PB tree in TPSS form, denoted as...

[0146] Dynamic data updates: When the data owner wants to add or delete data... The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) first reach the data by retrieving the PB tree. It should be inserted into or reside in the leaf node. During the retrieval process, when an internal node... When retrieved, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the addition, subtraction, and multiplication algorithms of the TPSS scheme to calculate z = b*(d(x) i p1) 2 -d(x i p2) 2The algorithm then calls a privacy-preserving symbolic computation algorithm to determine if z ≤ 0. If the inequality holds, it continues searching the left subtree; otherwise, it continues searching the right subtree. Eventually, a leaf node is reached. The added data is directly inserted into the leaf node. If the data size of the leaf node exceeds `num` after insertion, the first cloud server CS1 and the second cloud server CS2 will split the data in the leaf node. These are the deleted data, for each data in the leaf node. The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) perform calculations by calling the addition, subtraction, and multiplication algorithms of the TPSS scheme. Then, a privacy-preserving symbolic computation algorithm is used to determine whether d(x) is satisfied. i ,x j ) 2 ≤0. If the inequality holds, according to d(x) o ,x j ) 2 ≥0 implies d(x) i ,x j ) 2 =0, then x j =x i x can be j delete.

[0147] Similarity query processing: Cloud server CS1, cloud server CS2, and the Trusted Execution Environment (TEE) are responsible for processing user query requests. Given a query request... and When QA wants to initiate a similarity query request (q,τ), it represents the query request in TPSS form, that is: and Where q is the query record, τ is the distance threshold, and τ′=τ 2 The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) retrieved the PB tree. To obtain query results, when a leaf node is retrieved, for each data record in the leaf node... The addition, subtraction, and multiplication algorithms of the TPSS scheme are calculated using the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE). It then calls a privacy-preserving symbolic computation algorithm to determine whether z′≤0 is satisfied. If the inequality holds, d(x) can be derived. i ,q)≤τ,can be Add to query result set R q,τ When an internal node When retrieved, the first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the addition, subtraction, scalar multiplication, and multiplication algorithms of the TPSS scheme to calculate...

[0148]

[0149] The system then uses a privacy-preserving symbolic computation algorithm to determine if z1 > 0 and z2 < 0. If z1 > 0, the left subtree of the current node can be pruned; if z2 < 0, the right subtree of the current node can be pruned. Otherwise, both the left and right subtrees must be searched. Finally, the first cloud server CS1 and the second cloud server CS2 obtain the query results. Subsequently, the first cloud server CS1 will send the query result R q,τ,1 ={(x i,1 ,x i,2 )|d(x i ,q)≤τ} returns to the query agent QA, and the second cloud server CS2 will R q,τ,2 ={(x i,2 ,x i,3 )|d(x i The query result (x, q) ≤ τ is returned to the query agent (QA). The QA can then reconstruct the query result based on the received data. Specifically, x i =x i,1 +x i,2 +x i,3 .

[0150] Furthermore, the specific functions of the neutral party NP include:

[0151] Creating a Trusted Execution Environment (TEE): Neutral NP creates a Trusted Execution Environment (TEE) on the second cloud server platform.

[0152] Key negotiation and deployment: The neutral party NP negotiates key k1 with the data owner DO, negotiates key k2 with the query agent QA, and deploys {k1,k2} in the Trusted Execution Environment (TEE).

[0153] Furthermore, the specific functions for querying agent QA include:

[0154] Cloud server initialization: Initialize the second cloud server CS2 on the second cloud server platform.

[0155] Key negotiation and distribution: Negotiate a key with the neutral party NP to obtain a shared key k2, and then send the shared key k2 to the second cloud server CS2.

[0156] Query Encryption: Given a similarity query request (q, τ), the query agent QA represents the query request in TPSS form, i.e.: and Subsequently, the query agent QA sends {(q1,q2),(τ′1,τ′2)} to the first cloud server CS1 and {(q2,q3),(τ′2,τ′3)} to the second cloud server CS2.

[0157] To improve the processing efficiency of distributed high-dimensional data similarity queries while ensuring data security, and to reduce the computational and communication overhead for data owners, this invention proposes a secure and efficient distributed high-dimensional data similarity query system and method assisted by a TEE (Transmission Equipment) in a cloud computing scenario. This method has the following advantages:

[0158] (1) Supports secure similarity queries and dynamic data updates for distributed data. This invention builds a query index based on outsourced distributed data, which can securely and efficiently support similarity queries for horizontally and vertically distributed data, and designs a dynamic data update algorithm to support the dynamic addition and deletion of data.

[0159] (2) Strong data security processing. The security of the process of building a secure similarity query index, processing similarity queries, and dynamically updating data is protected by secret sharing technology. This ensures that the data is stored on two cloud servers in a secret sharing manner, so that the cloud servers cannot infer plaintext data information from the stored data and the intermediate results of the processed data, thus ensuring that the data is strongly protected during the processing.

[0160] (3) Efficient data computation. By introducing a tree-structured query index based on reference point data, an efficient high-dimensional data similarity query algorithm is proposed. At the same time, a fast three-party secret sharing technology is designed using a Trusted Execution Environment (TEE), and a series of efficient privacy protection algorithms are designed based on the three-party secret sharing technology to protect data privacy during the construction of the similarity query index, similarity query processing, and dynamic data update.

[0161] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A secure and efficient distributed high-dimensional data similarity query method assisted by a TEE, characterized in that, include: S1: Construct a secure, efficient, distributed, high-dimensional data similarity query system assisted by a TEE. Initialize the secure, efficient, distributed, high-dimensional data similarity query system. The system includes a data owner (DO), a first cloud server (CS1), a second cloud server (CS2), a trusted execution environment (TEE), a neutral party (NP), and a query agent (QA). The first cloud server (CS1) is located on a first cloud server platform, and the second cloud server (CS2) and the trusted execution environment (TEE) are located on a second cloud server platform. S2: The data owner DO transfers the data it owns. The data is constructed in TPSS format and distributed and outsourced to the first cloud server CS1 and the second cloud server CS2. S3: Construct a PB tree using the TPSS data outsourced to the first cloud server CS1 and the second cloud server CS2; S4: When in the dataset Add or delete an updated data At that time, the first cloud server CS1, the second cloud server CS2, and the trusted execution environment TEE search the PB tree through collaborative computation to update the data. Add or delete; S5: Based on the similarity query request proposed by the query agent QA, the first cloud server CS1, the second cloud server CS2, and the trusted execution environment TEE provide query services to the query agent QA.

2. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 1, characterized in that, Initializing the secure, efficient, distributed, high-dimensional data similarity query system includes: The data owner DO initializes the first cloud server CS1; the query agent QA initializes the second cloud server CS2; and the neutral party NP creates the trusted execution environment TEE. The data owner DO and the neutral party NP negotiate a... Symmetric key of bits and a pseudo-random function ,in, For safety parameters, The query agent QA and the neutral party NP negotiate a Symmetric key of bits The data owner DO sends the symmetric key. To the first cloud server CS1, Public; the query agent QA sends the symmetric key. To the second cloud server CS2; the neutral party NP will Deployed on the Trusted Execution Environment (TEE); The data owner DO publicly discloses the data value range. And publicly disclose the leaf node capacity threshold of the constructed PB tree. num .

3. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 1, characterized in that, S2 includes: S201: No. j indivual Each data in its own dataset The construction is in TPSS form, i.e. ,in yes Three random values ​​in the form, and satisfying S202: The first j indivual Will The data was outsourced to the first cloud server CS1. It is outsourced to the second cloud server CS2.

4. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 1, characterized in that, S3 includes: If dataset X The amount of data in the middle is less than the leaf node capacity threshold. num Then the first cloud server CS1 and the second cloud server CS2 directly construct a dataset containing the dataset. X The leaf node; otherwise, the first cloud server CS1 and the second cloud server CS2 construct an internal node. ,in, The reference point vector is in TPSS form. At the same time, based on , the dataset X Split into two subsets and and based on and Construct the left and right subtrees of the internal nodes; ultimately, the first cloud server CS1 and the second cloud server CS2 construct a PB tree in TPSS form. .

5. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 4, characterized in that, The first cloud server CS1 and the second cloud server CS2 construct an internal node. ,include: S301: The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) use a random value generation algorithm to generate two reference point vectors in TPSS form through collaborative computation, denoted as... ; S302: The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) generate a random tag in TPSS form through collaborative computing. , ; S303: The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) according to... The value of the dataset Divided into and , among which when hour, and for: when hour, and for: in, This represents the Euclidean distance between two vectors. Indicates the number of data entries in the dataset; S304: The first cloud server CS1 and the second cloud server CS2 construct an internal node. And according to Create the left subtree of the internal node, based on By creating the right subtree of the internal nodes, the first cloud server CS1 and the second cloud server CS2 ultimately obtain a PB tree in TPSS form. .

6. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 5, characterized in that, The random value generation algorithm in S301 includes: The second cloud server CS2 selects a random value. And construct its TPSS form. The second cloud server CS2 is reserved and will Send to the Trusted Execution Environment (TEE) D Indicates the range of values ​​for the reference point data; The Trusted Execution Environment (TEE) selects a random value. And construct its TPSS form. The Trusted Execution Environment (TEE) is reserved. and will Send to the second cloud server CS2; The second cloud server CS2 and the Trusted Execution Environment (TEE) respectively calculate and Then the second cloud server CS2 will The Trusted Execution Environment (TEE) will send the data to the first cloud server CS1. The random number generated and sent to the first cloud server CS1 is TPSS in form ,in, , , .

7. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 5, characterized in that, S302 includes: The first cloud server CS1 generates a random tag Construct its TPSS form and will Send to the second cloud server CS2; The second cloud server CS2 generates a random tag Construct its TPSS form and will Send to the first cloud server CS1; The first cloud server CS1, the second cloud server CS2, and the Trusted Execution Environment (TEE) call the TPSS secure multiplication algorithm to calculate... .

8. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 5, characterized in that, S4 includes: The data owner, DO, will update the data. In the form of TPSS The outsourcing is to the first cloud server CS1 and the second cloud server CS2, wherein the first cloud server CS1 holds The second cloud server CS2 holds ; The PB tree is searched using cooperative computation, when the internal node... satisfy If the left subtree is not found, search the right subtree; otherwise, search the right subtree until a leaf node is reached. If data is updated For the data to be added, directly... Insert into the leaf node found in the search; if inserting, update the data. Afterwards, the data size of the leaf nodes is greater than If so, then the current leaf node will be split; If data is updated For each data point in the leaf node, the data to be deleted is... Determine whether the condition is met. If the inequality holds, then the data delete.

9. The TEE-assisted secure and efficient distributed high-dimensional data similarity query method according to claim 5, characterized in that, S5 includes: S501: Given a similarity query request At that time, the query agent QA will send the similarity query request. Encryption and and will and Send to the first cloud server CS1 and the second cloud server CS2, wherein, , Indicates the distance threshold. ; S502: By searching the PB tree, obtain the data records that meet the query conditions, i.e. When a leaf node of the PB tree is retrieved, each piece of data in the leaf node is evaluated. Does it meet the requirements? If so, the data Add to query result set When the internal nodes of the PB tree When being searched, determine whether If so, the left subtree of the current internal node is pruned, and it is determined whether the condition is met. If yes, the right subtree of the current internal node is pruned; otherwise, both the left and right subtrees are searched. Finally, the first cloud server CS1 and the second cloud server CS2 obtain the query result set. ; S503: For The first cloud server CS1 will The query is returned to the QA agent, and the second cloud server CS2 will... The results are returned to the query agent QA, which then reconstructs the query results based on the received data.

10. A secure and efficient distributed high-dimensional data similarity query system assisted by a TEE, characterized in that, This includes the data owner (DO), the first cloud server (CS1), the second cloud server (CS2), the trusted execution environment (TEE), the neutral party (NP), and the query agent (QA). The first cloud server (CS1) is located on the first cloud server platform, and the second cloud server (CS2) and the trusted execution environment (TEE) are located on the second cloud server platform. The data owner DO initializes the first cloud server CS1, performs key negotiation with the neutral party NP, sends the negotiated key to the first cloud server CS1, and transfers its owned dataset. X The data is constructed in TPSS format and distributed data is outsourced; the first cloud server CS1 and the second cloud server CS2 are used to store the outsourced data, build a PB tree index based on the outsourced data, dynamically update the data, and process similarity query requests. The Trusted Execution Environment (TEE) is used to assist the first cloud server CS1 and the second cloud server CS2 in establishing a PB tree, dynamically updating data, and processing query requests; the Neutral Party (NP) is used to create the TEE on the second cloud server platform, negotiate keys with the data owner (DO) and the query agent (QA), and deploy the negotiated keys in the TEE. The query agent QA is used to negotiate a key with the neutral party NP, send the negotiated key to the second cloud server CS2, and encrypt the query request on behalf of the user, and initiate a query request to the first cloud server CS1 and the second cloud server CS2.

Images