An equivalence connection query method and device for a ciphertext database

Abstract

The application relates to an equivalent connection query method and device for a ciphertext database, which comprises the following steps: constructing indexes corresponding to a plurality of tables; wherein the indexes comprise encrypted inverted index tables, and the inverted index tables are generated from original tables; uploading the encrypted indexes and a multi-set Bloom filter to a server; wherein the multi-set Bloom filter is obtained according to all values of inserted connection attribute columns; sending an equivalent connection query request of a user to the server, so that the server returns corresponding equivalent connection query results to the user. Compared with the prior art, the multi-set Bloom filter has shorter solving time and higher efficiency, and can hide the relationship between sets in a table and a Bloom filter, thereby hiding external memory access modes, significantly improving the throughput of data processing, reducing the number of interactions with a trusted execution environment, and effectively solving the problem of large communication overhead.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to an equi-join query method and apparatus for encrypted databases. Background Technology

[0002] With the rapid development of cloud infrastructure, related cloud services have also rapidly expanded. The expansion of cloud services not only supports the digital transformation of traditional businesses but also promotes the development and application of emerging technologies such as the Internet of Things (IoT), big data analytics, and outsourced computing. In recent years, due to the significant advantages of data outsourcing, such as low cost and high availability, outsourcing databases (especially relational databases) to cloud service providers for remote storage has become a common trend. While outsourcing data has enormous potential and advantages, outsourcing sensitive data inevitably faces some security challenges, such as data confidentiality and integrity issues. To effectively address these problems, a relatively direct approach is to encrypt the database locally, creating a encrypted database, before outsourcing it to the cloud service provider. In the encrypted database, data remains encrypted throughout its entire lifecycle in the cloud service, and all queries and calculations are performed in the cloud. The results of these calculations remain encrypted and are ultimately returned to the client for decryption. Although encrypted databases greatly enhance data confidentiality, the challenge lies in the technical difficulty of performing meaningful computational operations in an encrypted environment. Common operations in databases include arithmetic operations, comparison operations, and logical operations. In relational databases, in addition to the common operations mentioned above, another common and crucial operation is joining two or more tables to accurately extract and merge data, thereby enabling complex information queries and data analysis.

[0003] Research on multi-table pairwise equi-joins in encrypted databases has been extensive, mainly falling into two research directions. First, one branch involves using numerous cryptographic primitives to directly perform equi-join operations on the encrypted database. This method primarily relies on nested loop joins to achieve secure connections between data. While secure, this mechanism suffers from inherently high computational overhead, making it difficult to effectively handle multi-table equi-joins. Therefore, despite its excellent performance in ensuring data security, its efficiency in handling large-scale or complex data structures limits its widespread adoption in practical applications. Due to the challenges of high computational overhead, difficulty in functional expansion, and limited query attributes associated with cryptographic primitive-based schemes, a second research branch has emerged. This branch explores methods using trusted execution environments (TEAs) to solve multi-table pairwise equi-join problems. A TEA is a secure environment whose primary purpose is to securely execute programs and manipulate data within a hardware-supported secure area, ensuring the confidentiality and integrity of the programs and code, thereby effectively enhancing protection against external attacks and internal system security threats. Thanks to the security of the Trusted Execution Environment (TEE), encrypted data can be securely decrypted and processed within the TEE by placing the execution code and operation data under its protection.

[0004] In existing technologies, some methods use numerous cryptographic primitives to directly perform equi-join operations on the encrypted database. Since this method primarily relies on nested loop joins, its time complexity increases quadratically with the table size, resulting in significant overhead and inefficiency. Other methods use trusted execution environments (TEAs) to solve the equi-join problem. However, TEAs suffer from several issues, leading to insecurity and inefficiency: First, because TEAs cannot effectively hide memory access patterns, they are vulnerable to side-channel attacks, potentially causing the leakage of sensitive information. Second, the memory capacity limitations of TEAs can reduce processing power, resulting in low throughput and low computational efficiency. Finally, the high overhead associated with communication with the TEA is a significant technical challenge. Traditional methods for finding the intersection of multiple sets using Bloom filters suffer from the drawback that the number of operations increases with the length of the Bloom filter, making it time-consuming and inefficient; furthermore, it may leak the relationship between the sets and the Bloom filter, leading to the leakage of external memory access patterns. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, this invention provides an equi-join query method and apparatus for dense databases.

[0006] According to a first aspect of the present invention, an equi-join query method for a dense database is provided, applied to a client, the method comprising:

[0007] Construct indexes corresponding to multiple original tables; wherein, the indexes include: an encrypted inverted index table, which is generated from the original tables;

[0008] Upload the encrypted multiple indexes and the encrypted multi-set Bloom filter to the server; wherein, the multi-set Bloom filter is obtained based on all the values ​​of the insertion join attribute column;

[0009] The user's equijoin query request is sent to the server, so that the server returns the corresponding equijoin query result to the user based on the query request, the multiple indexes, and the multiset Bloom filter.

[0010] Optionally, constructing the indexes corresponding to the multiple original tables includes:

[0011] Obtain the hash table of the multiple original tables; wherein, the hash table corresponding to each original table includes the number of each key in the original table, the start position and end position of each key in the original table in the corresponding hash table; the key is the value of the connection attribute column of the original table;

[0012] Based on the hash table of the multiple original tables, each key and its corresponding value in the table are placed into the corresponding inverted index table; wherein, the value is the value of the attribute column of the original table excluding the join attribute column;

[0013] The resulting inverted index tables are encrypted to construct an index corresponding to the original tables.

[0014] Optionally, before uploading the encrypted plurality of indexes and the encrypted multi-set Bloom filter to the server, the method further includes:

[0015] Insert each key from the multiple original tables into the multiset Bloom filter;

[0016] The insertion position of each key in the multi-set Bloom filter is calculated based on each key in the multiple original tables.

[0017] Set the value at the insertion position in the multi-set Bloom filter to 1 to indicate that the key is inserted at the insertion position of the multi-set Bloom filter.

[0018] Optionally, the insertion position in the multi-set Bloom filter is obtained according to the following formula:

[0019] ;

[0020] in, Indicates the insertion position. This means when the key is At that time, the first Bloom filter in the multi-set Bloom filter The value obtained by the hash function , The length of a single Bloom filter in the multi-set Bloom filter. Indicates the first In each round, when the table corresponding to the key is The value obtained by the hash function at that time This indicates a modulo operation.

[0021] Optionally, sending the user's equi-join query request to the server includes:

[0022] Receive the user's equi-connection query request;

[0023] The equijoin query request is parsed to obtain the query conditions and join conditions;

[0024] The query conditions and connection conditions are encrypted and then sent to the server.

[0025] According to a second aspect of the present invention, an equi-join query method for a dense database is provided, applied to a server, the method comprising:

[0026] The system receives encrypted indexes and multi-set Bloom filters corresponding to multiple original tables uploaded by the client; wherein the indexes include: an encrypted inverted index table, which is generated from the original tables;

[0027] Receive equi-connection query requests from users sent by clients;

[0028] The indexes and multi-set Bloom filters corresponding to the encrypted original tables are decrypted, and the multiple encrypted inverted index tables are decrypted to obtain multiple inverted index tables and multi-set Bloom filters.

[0029] Based on the multiple inverted index tables, the intersection data of the multiple original tables is obtained using the forgotten data filtering function; wherein, the forgotten data filtering function is implemented based on the multi-set Bloom filter;

[0030] Based on the intersection data, the connection result of the multiple original tables is obtained;

[0031] The connection result is encrypted to obtain the equi-join query result corresponding to the equi-join query request;

[0032] The equijoin query results are sent to the user.

[0033] Optionally, obtaining the intersection data of the multiple original tables using a forgotten data filtering function based on the multiple inverted index tables includes:

[0034] When the key in the first table exists in the second table, the forgotten data filtering function is invoked;

[0035] The detailed information of the key in the first table and the detailed information of the key in the second table are obtained according to the forgotten data filtering function; wherein, the first table and the second table are any two tables among the plurality of inverted index tables; the key represents the value contained in the join attribute column in the inverted index table; the detailed information is the hash value of the key and the index position of the key in the corresponding inverted index table; the index position is obtained according to the actual position of the key in the corresponding inverted index table and the random permutation function;

[0036] The intersection data is obtained based on the detailed information of the key in the first table and the detailed information of the key in the second table.

[0037] Optionally, obtaining the join result of the multiple original tables based on the multiple intersection data includes:

[0038] Create a target hash table based on the hash values ​​in the detailed information of the intersection data in the first table;

[0039] Based on the index position in the detailed information of the intersection data in the first table, the corresponding data in the inverted index table is placed into the corresponding position in the hash table;

[0040] If the hash value of the detailed information of the intersection data in the second table exists in the target hash table, then other information in the inverted index table corresponding to the second table is put into the target hash table according to the index position of the detailed information of the intersection data in the second table;

[0041] The data in the target hash table is returned in pairs to obtain the join result.

[0042] According to a third aspect of the present invention, an equi-join query apparatus for a dense database is provided, applied to a client, the apparatus comprising:

[0043] An index building module is used to build indexes corresponding to multiple tables; wherein, the index includes: an encrypted inverted index table, which is generated from the original table;

[0044] The upload module is used to upload the encrypted multiple indexes and the encrypted multi-set Bloom filter to the server; wherein, the multi-set Bloom filter is obtained based on all the values ​​of the insertion join attribute column;

[0045] The request sending module is used to send the user's equi-join query request to the server, so that the server returns the corresponding equi-join query result to the user based on the query request, the multiple indexes and the multi-set Bloom filter.

[0046] According to a fourth aspect of the present invention, an equi-join query apparatus for a dense database is provided, applied to a server, the apparatus comprising:

[0047] The first receiving module is used to receive the indexes and multi-set Bloom filters corresponding to multiple encrypted original tables uploaded by the client; wherein, the indexes include: an encrypted inverted index table, which is generated from the original tables;

[0048] The second receiving module is used to receive the user's equi-connection query request sent by the client;

[0049] The decryption module is used to decrypt the indexes and multi-set Bloom filters corresponding to the encrypted original tables, and to decrypt the obtained encrypted inverted index tables to obtain multiple inverted index tables and multi-set Bloom filters.

[0050] The intersection acquisition module is used to obtain the intersection data of the multiple original tables based on the multiple inverted index tables using a forgotten data filtering function; wherein, the forgotten data filtering function is implemented based on the multi-set Bloom filter;

[0051] The result acquisition module is used to obtain the connection result of the multiple original tables based on the multiple intersection data;

[0052] The result encryption module is used to encrypt the connection result to obtain the equi-connection query result corresponding to the equi-connection query request.

[0053] The result sending module is used to send the equi-join query results to the user.

[0054] The technical solution provided by this invention may include the following beneficial effects:

[0055] Through the above technical solutions, the Set Bloom Filter (SBF) proposed in this invention, compared with the traditional intersection solution of Bloom Filter in the prior art, has a shorter solution time and higher efficiency while ensuring the same false positive rate. Furthermore, the Set Bloom Filter proposed in this invention hides the relationship between the sets in the table and the Bloom filter, thereby hiding the external memory access pattern. The equi-join query method for dense databases based on this Set Bloom Filter solves the memory capacity limitation problem of the Trusted Execution Environment by using SBF to exclude joins of irrelevant data, significantly improving the throughput of data processing in the Trusted Execution Environment. Finally, it reduces the number of interactions with the Trusted Execution Environment, effectively solving the problem of high communication overhead. Attached Figure Description

[0056] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the following detailed description to explain the invention, but do not constitute a limitation thereof. In the drawings:

[0057] Figure 1 This is a flowchart illustrating an equi-join query method for a dense database according to an exemplary embodiment.

[0058] Figure 2 This is a schematic diagram illustrating the insertion of tabular information into a multi-set Bloom filter according to an exemplary embodiment.

[0059] Figure 3 This is a flowchart illustrating yet another equi-join query method for a dense database, according to an exemplary embodiment.

[0060] Figure 4 This is a diagram illustrating a process of forgetting and filtering data according to an exemplary embodiment.

[0061] Figure 5 This is a block diagram illustrating an equi-join query apparatus for a dense database according to an exemplary embodiment.

[0062] Figure 6 This is a block diagram illustrating yet another equi-join query apparatus for a dense database, according to an exemplary embodiment. Detailed Implementation

[0063] Figure 1 This is a flowchart illustrating an equi-join query method for a dense database according to an exemplary embodiment, applied to a client, such as... Figure 1 As shown, the method includes the following steps.

[0064] S101. Construct indexes corresponding to multiple original tables; wherein, the index includes: an encrypted inverted index table, which is generated from the original tables.

[0065] S102. Upload the encrypted multiple indexes and the encrypted multi-set Bloom filter to the server; wherein, the multi-set Bloom filter is obtained based on all the values ​​of the inserted join attribute column.

[0066] Understandably, a Set Bloom Filter (SBF) is based on a Bloom filter and can be used to find the intersection of multiple sets. A Bloom filter is a data structure that can quickly determine whether an element belongs to a set. A Bloom filter uses a bit array and multiple hash functions to represent a set, where the hash functions map elements to multiple positions in the bit array. When checking if an element is in the set, the same hash calculation is performed on the element, and the corresponding bit array positions are checked to see if they are all 1. If any position is 0, the element is not in the set; if all positions are 1, the element may be in the set.

[0067] S103. Send the user's equi-join query request to the server so that the server returns the corresponding equi-join query result to the user based on the query request and the multi-set Bloom filter.

[0068] Understandably, a user's connection query request can be an SQL statement. Table 1 shows partial flight information from Chongqing to various destinations (the table name is denoted as...). The original table, Table 2, shows some flight information from various locations to Harbin (the table name is denoted as ). The original tables. Taking Table 1 and Table 2 as examples, SELECT * FROM T1, WHERE .Origin = 'Chongqing' AND .Destination = 'Harbin' AND .Destination = The query `.Origin` can be expressed as finding all travel routes that start from "Chongqing", pass through an intermediate city, and finally arrive at "Harbin". Specifically, it looks up the table... The records starting from "Chongqing" are then in the table. Find those with The destination is the departure point, and the destination is "Harbin".

[0069] Table 1

[0070]

[0071] Table 2

[0072]

[0073] Optionally, prior to S102, the method may further include:

[0074] Insert each key from multiple original tables into a multi-set Bloom filter;

[0075] The insertion position in the multi-set Bloom filter is calculated based on each key in multiple original tables.

[0076] Set the value at the insertion position in the multiset Bloom filter to 1 to indicate that the key is inserted at the insertion position in the multiset Bloom filter.

[0077] Alternatively, the insertion position in a multi-set Bloom filter is obtained according to the following formula:

[0078] It is understandable that, in one implementation, Figure 2 This is a schematic diagram illustrating the insertion of tabular information into a multi-set Bloom filter according to an exemplary embodiment, see reference. Figure 2 Repetition indicates the round number, insertion. ,in, Indicates key, express The set to which it belongs; a table is a form of set. Define a two-dimensional boolean array. ,in, Indicates the number of rounds. This represents the length of a single Bloom filter. The length of each round of Bloom filters is calculated sequentially. One location:

[0079] ;

[0080] in, Indicates the insertion position. This means when the key is At that time, the first Bloom filter in a multi-set Bloom filter The value obtained by the hash function , The length of a single Bloom filter in a multi-set Bloom filter. Indicates the first In each round, when the table corresponding to the key is The value obtained by the hash function at that time This indicates a modulo operation. Then... Set to 1, where the hash function can be MurmurHash. It's worth noting that the process of querying using SBF is similar to the above, checking each round sequentially. If all positions are 1, then the element is likely to be 1. It belongs to this set. The process of finding the intersection in SBF can be referenced as follows: Assume there are elements... , ,insert Solve in SBF. and The intersection can be simplified to traversal The element in the parameter is checked. j Under what conditions is it in SBF, such as checking Whether it is in SBF, if it returns True, it means Conversely, it means Similar to finding the intersection of two tables, this method can be extended to finding the intersection of multiple tables.

[0081] Optionally, S101 may include:

[0082] Obtain hash tables for multiple original tables; where each original table's hash table includes the number of each key in the original table, the start position and end position of each key in the corresponding hash table; where key represents the value of the join attribute column of the original table;

[0083] The hash table of multiple original tables is used to put each key and its corresponding value into the corresponding inverted index table; where the value is the value of the attribute column of the original table excluding the join attribute column;

[0084] The resulting inverted index tables are encrypted to construct indexes corresponding to the original tables.

[0085] In one implementation, taking Tables 1 and 2 as examples, the user first uses Build_Hash_Index ( The functions respectively for and The table is partitioned and stored using a hash table. For example, when... After scanning all the Destination attribute columns, the following information can be obtained:

[0086] ;

[0087] ;

[0088] ;

[0089] ;

[0090] in, Indicating targeting The created hash table, Indicates the current number of keys. This indicates the starting position of the current key in the hash table. This represents the end position of the current key in the hash table; different key values ​​represent a partition, so start and end represent the start and end positions of the partition. Taking Table 1 as an example: Xi'an is partition 1, which stores information about flights from Chongqing to Xi'an; Guangzhou is partition 2, which stores information about flights from Chongqing to Guangzhou.

[0091] Then respectively ( Xi'an), ( ,Shanghai),( ,Guangzhou),( Lhasa), ( Lhasa) Insert a multi-set Bloom filter, refer to Figure 2 Due to the connection and Yes The Destination attribute column and The Origin attribute column, therefore, is used to insert a multi-set Bloom filter. Destination and Origin.

[0092] Will The data is correctly placed into the inverted index table based on the information in the hash table. middle, As shown in Table 3:

[0093] Table 3

[0094]

[0095] Similarly, listed here Corresponding inverted index table This is just an example; in actual applications, the order of these cities may not be as shown.

[0096] Table 4

[0097]

[0098] P.S.: The inverted index table contains more than just these items. For example, it may also contain flight schedules, arrival times, aircraft types, etc. For the sake of clarity, other information has been omitted.

[0099] Based on the information of each key in the FirstTierIndex table stored in Tables 3 and 4, including the key's hash value and index position, where the key value is... h(key) || Π(l) is obtained , where l is the actual position of the key in the inverted index table.

[0100] Therefore, what is uploaded to the server here is an inverted index table. The result after SBF encryption.

[0101] It's worth noting that when encrypting multiple inverted index tables to construct indexes corresponding to multiple original tables, the index positions are obtained based on the actual positions of each key in the inverted index table and a random permutation function; this can be expressed as follows: This represents the index position of each key in the original table within the inverted index table. This represents the actual position of each key in the inverted index table. It is a set of mapping indices {1, 2, ..., ...} The random permutation function of itself has a domain and range of 1 to n, for example... =3, when the real location of the key When =5, the output index position is 3.

[0102] Figure 3 This is a flowchart illustrating yet another equi-join query method for a dense database according to an exemplary embodiment, applied to a server, such as... Figure 3 As shown, the method includes the following steps.

[0103] S301. Receive the encrypted indexes and multi-set Bloom filters corresponding to multiple original tables uploaded by the client; wherein, the indexes include: an encrypted inverted index table, which is generated from the original tables.

[0104] S302, Receive the user's equi-connection query request sent by the client.

[0105] Understandably, S301 and S302 correspond to the client's steps, where the server receives multiple raw table indexes, multi-set Bloom filters, and equi-join query requests sent by the client. In one implementation, the client parses the equi-join query request to obtain the query and join conditions, then encrypts and sends it to the server. For example, the client calls the Plain_To_Cipher function to parse the user's SQL statement to obtain the query and join conditions: Q=[Chongqing, Harbin, .Destination = .Origin).

[0106] S303. Decrypt the indexes and multi-set Bloom filters corresponding to the encrypted original tables, and decrypt the obtained encrypted inverted index tables to obtain multiple inverted index tables and multi-set Bloom filters.

[0107] Understandably, after the server loads the index, it will decrypt the encrypted data. For example, let's assume the encrypted index is... Then, by decrypting it, we can obtain the inverted index table. The resulting inverted index table FirstTierIndex is divided into and ,in, What is stored is key, What is stored is In ; For the original table The hash value of the key. This is the index position of the key in the inverted index table.

[0108] S304. Based on multiple inverted index tables, use the forgotten data filtering function to obtain the intersection data of multiple original tables; wherein, the forgotten data filtering function is implemented based on a multi-set Bloom filter.

[0109] It is understandable that the process of obtaining the intersection of multiple original tables using the forgetting data filtering function is, for each element in a given inverted index table... Call the forgotten data filtering function to detect this Does it also exist in another inverted index table? If it returns true, for example, take Tables 3 and 4 as examples. Taking the existence of FirstIndex as an example, we sequentially check whether "Xi'an", "Beijing", and "Guangzhou" exist in SBF. After the checks are completed, we can know whether Xi'an and Guangzhou exist. ; will satisfy of Corresponding Write it down. Using the example above, we can obtain the following information: (because What is stored is Therefore, the first 2 represents h (Xi'an). This refers to the key in The actual position in the text, 1 refers to... ), Then scan sequentially. FirstTierIndex, denoted as Determine the current h( Is it in If it exists, then it means that the current situation exists. Then record this moment. corresponding .by For example, it is necessary to determine h(Shanghai), h(Lhasa), h(Guangzhou), and h(Xi'an) in sequence, according to... Ultimately, we find that Guangzhou and Xi'an are within the intersection, so we can obtain the following information: , Then you can proceed to the next step of the connection.

[0110] S305. Based on multiple intersecting data, obtain the connection results of multiple original tables.

[0111] The steps to obtain the join result of multiple original tables using the forget hash join function are as follows:

[0112] a) :use Stored Create a hash table;

[0113] The main idea of ​​Build is: based on In Place the correct record into the hash table HTable. For example, Then the record in the third row of the first inverted index table can be placed in the first position of the hash table; The record in the 4th row of the first inverted index table is placed in the 2nd position of the hash table; the extraction of the corresponding record based on the index position occurs in the private memory of the trusted execution environment;

[0114] b) Scan sequentially Detection Does it exist in ;

[0115] The main idea of ​​Probe is to check sequentially. Does it exist in HTable? If it exists, then based on the current... Place the records from the second inverted index table into the hash table. For example, determine... and Whether or not both can ultimately be found in HTable. Then we can determine based on... And h(Xi'an)=2, put the first row of the second inverted index table into the second position of the hash table and according to... With h(Guangzhou)=1, the third row of the second index table is placed into the first position of the hash table, resulting in the pair shown below.

[0116] c): Fill in the results returned from step b). If the probe returns True, then add the corresponding information to... middle;

[0117] d) According to step c) table Connect the grids to form a grid. and For example, the following results can be obtained:

[0118] Table 3

[0119]

[0120] Table 3 shows the result of an equi-join of Tables 1 and 2 (the table name is denoted as...). Note: For ease of presentation, the following information has been omitted from Table 3. Destination and The Origin should be uniformly written as the Layover attribute column.

[0121] S306. Encrypt the join result to obtain the equijoin query result corresponding to the equijoin query request.

[0122] S307. The equi-join query result is sent to the user, who can then decrypt the equi-join query result.

[0123] Optionally, S304 may include:

[0124] If the key in the first table exists in the second table, call the forgotten data filtering function;

[0125] The detailed information of the key in the first table and the detailed information of the key in the second table are obtained based on the forgotten data filtering function. The first table and the second table are any two tables from multiple inverted index tables. The key represents the value contained in the join attribute column of the inverted index table. The detailed information is the hash value of the key and the index position of the key in the corresponding inverted index table. The index position is obtained based on the actual position of the key in the corresponding inverted index table and a random permutation function.

[0126] The intersection data is obtained by combining the details of the key in the first table and the details of the key in the second table.

[0127] Understandable, Figure 4 This is a process diagram illustrating a forgetting-based data filtering method according to an exemplary embodiment, such as... Figure 4 As shown, the forgotten data filtering is implemented based on a multi-set Bloom filter. The specific process is as follows: A two-dimensional boolean array is present within the trusted execution environment. And it has already been assigned a value, check Is it in SBF? Taking round 1 as an example, first, according to... Calculate the first round A position, such as Figure 4 In Variables, initialization The variables were all assigned the value 0, and then... The variable is reassigned a new value: = ,in, represent The first variable One location, represent The variable's first One position. Finally, and By performing an AND operation to obtain the final result, we can determine the outcome in round 1. Whether each position is set to 1. The process for other rounds is similar to the first round, so it will not be described in detail here. Through the above method, since for They all performed the same operation, so the adversary could not distinguish which one was being accessed. , ...thus protecting the memory access patterns within the trusted execution environment.

[0128] Specifically, calculation The value can be calculated with reference to SBF. It's the same; you can get k positions. Figure 4 In the example, we set k=2 and assume that the calculated k positions are {2, 5}; then we initialize... All values ​​are 0, where m represents the length of a Bloom filter; then according to Reassign the value The assignment process is as follows: Taking the first value 2 as an example, according to 0⊕(2==1)=0, The first position is set to 0. In the expression 0⊕(2==1), 0 represents the value before it is assigned. The value at the current position, ⊕ represents the XOR operation, (2==1) returns 1 if the two numbers are equal, otherwise it returns 0, 2 represents The current value being compared, 1 represents The current position that needs to be reassigned. Based on 0⊕(2==2)=1, Setting the second position to 1, 0⊕(2==3)=0 The third position is set to 0... until... All positions were reassigned. Then, using... The second number, the third number... the kth number will All positions are reassigned. Then the obtained... and Performing an AND operation yields the final result. Then, counting the number of 1s allows us to determine if the k positions of the current Bloom filter are set to 1. If all positions are set to 1, the count of 1s should equal k. The above describes the process for... The process will continue, and the next step will be to... , ... To perform the above operations, first calculate the value of each round. Then initialize All zeros, then recalculate. Assign values, and finally count the number of 1s. Because for... They all performed the same operation, making it impossible for the adversary to distinguish which one was accessing. , ...thus protecting the memory access patterns within the trusted execution environment.

[0129] Through the above technical solutions, the Set Bloom Filter (SBF) proposed in this invention, compared with the traditional intersection solution of Bloom Filter in the prior art, has a shorter solution time and higher efficiency while ensuring the same false positive rate. Furthermore, the Set Bloom Filter proposed in this invention hides the relationship between the sets in the table and the Bloom filter, thereby hiding the external memory access pattern. The equi-join query method for dense databases based on this Set Bloom Filter solves the memory capacity limitation problem of the Trusted Execution Environment by using SBF to exclude joins of irrelevant data, significantly improving the throughput of data processing in the Trusted Execution Environment. Finally, it reduces the number of interactions with the Trusted Execution Environment, effectively solving the problem of high communication overhead.

[0130] Figure 5 This is a block diagram illustrating an equi-join query apparatus for a dense database according to an exemplary embodiment, applied to a client, with reference to... Figure 5 The equi-join query device 500 for dense databases may include:

[0131] The index building module 501 is used to build indexes corresponding to multiple tables; wherein, the index includes: an encrypted inverted index table, which is generated from the original table;

[0132] Upload module 502 is used to upload multiple encrypted indexes and an encrypted multi-set Bloom filter to the server; the multi-set Bloom filter is obtained based on all the values ​​of the insertion join attribute column.

[0133] The request sending module 503 is used to send the user's equi-join query request to the server, so that the server returns the corresponding equi-join query result to the user based on the query request, multiple indexes and multi-set Bloom filters.

[0134] Figure 6 This is a block diagram illustrating yet another equi-join query apparatus for a dense database, applied to a server, according to an exemplary embodiment. Figure 6 The equi-join query device 600 for dense databases may include:

[0135] The first receiving module 601 is used to receive the indexes and multi-set Bloom filters corresponding to multiple encrypted original tables uploaded by the client; wherein, the indexes include: an encrypted inverted index table, which is generated from the original tables;

[0136] The second receiving module 602 is used to receive the user's equi-connection query request sent by the client;

[0137] The decryption module 603 is used to decrypt the indexes and multi-set Bloom filters corresponding to the encrypted original tables, and to decrypt the obtained multiple encrypted inverted index tables to obtain multiple inverted index tables and multi-set Bloom filters.

[0138] The intersection acquisition module 604 is used to obtain the intersection data of multiple original tables based on multiple inverted index tables using a forgotten data filtering function; wherein, the forgotten data filtering function is implemented based on a multi-set Bloom filter;

[0139] The result acquisition module 605 is used to obtain the connection result of multiple original tables based on multiple intersection data;

[0140] The result encryption module 606 is used to encrypt the connection result and obtain the equi-join query result corresponding to the equi-join query request.

[0141] The result sending module 607 is used to send the equijoin query results to the user.

[0142] The preferred embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present invention, various simple modifications can be made to the technical solution of the present invention, and these simple modifications all fall within the protection scope of the present invention.

[0143] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable way without contradiction. In order to avoid unnecessary repetition, the present invention will not describe the various possible combinations separately.

[0144] Furthermore, various different embodiments of the present invention can be combined in any way, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed by the present invention.

Claims

1. An equi-join query method for dense-state databases, characterized in that, Applied to a client, the method includes: Construct indexes corresponding to multiple original tables; wherein, the indexes include: an encrypted inverted index table, which is generated from the original tables; Upload the encrypted multiple indexes and the encrypted multi-set Bloom filter to the server; wherein, the multi-set Bloom filter is obtained based on all the values ​​of the insertion join attribute column; The user's equijoin query request is sent to the server, so that the server returns the corresponding equijoin query result to the user based on the query request, the multiple indexes and the multiset Bloom filter; The method further includes, prior to uploading the encrypted multiple indexes and the encrypted multi-set Bloom filter to the server: Insert each key from the multiple original tables into the multiset Bloom filter; The insertion position of each key in the multi-set Bloom filter is calculated based on each key in the multiple original tables. Set the value at the insertion position in the multi-set Bloom filter to 1 to indicate that the key is inserted at the insertion position of the multi-set Bloom filter; The insertion position in the multi-set Bloom filter is obtained according to the following formula: ； in, Indicates the insertion position. This means when the key is At that time, the first Bloom filter in the multi-set Bloom filter The value obtained by the hash function , The length of a single Bloom filter in the multi-set Bloom filter. Indicates the first In each round, when the table corresponding to the key is The value obtained by the hash function at that time This indicates a modulo operation.

2. The equi-join query method for dense-state databases according to claim 1, characterized in that, The construction of indexes corresponding to multiple original tables includes: Obtain the hash table of the multiple original tables; wherein, the hash table corresponding to each original table includes the number of each key in the original table, the start position and end position of each key in the original table in the corresponding hash table; the key is the value of the connection attribute column of the original table; Based on the hash table of the multiple original tables, each key and its corresponding value in the table are placed into the corresponding inverted index table; wherein, the value is the value of the attribute column of the original table excluding the join attribute column; The resulting inverted index tables are encrypted to construct an index corresponding to the original tables.

3. The equi-join query method for dense databases according to claim 1, characterized in that, Sending the user's equi-join query request to the server includes: Receive the user's equi-connection query request; The equijoin query request is parsed to obtain the query conditions and join conditions; The query conditions and connection conditions are encrypted and then sent to the server.

4. An equi-join query method for dense-state databases, characterized in that, Applied to a server, the method includes: The system receives encrypted indexes and multi-set Bloom filters corresponding to multiple original tables uploaded by the client; wherein the indexes include: an encrypted inverted index table, which is generated from the original tables; Receive equi-connection query requests from users sent by clients; The indexes and multi-set Bloom filters corresponding to the encrypted original tables are decrypted, and the multiple encrypted inverted index tables are decrypted to obtain multiple inverted index tables and multi-set Bloom filters. Based on the multiple inverted index tables, the intersection data of the multiple original tables is obtained using the forgotten data filtering function; wherein, the forgotten data filtering function is implemented based on the multi-set Bloom filter; Based on the intersection data, the connection result of the multiple original tables is obtained; The connection result is encrypted to obtain the equi-join query result corresponding to the equi-join query request; Send the equijoin query results to the user; The step of obtaining the intersection data of the multiple original tables using a forgotten data filtering function based on the multiple inverted index tables includes: When the key in the first table exists in the second table, the forgotten data filtering function is invoked; The detailed information of the key in the first table and the detailed information of the key in the second table are obtained according to the forgotten data filtering function; wherein, the first table and the second table are any two tables among the plurality of inverted index tables; the key represents the value contained in the join attribute column in the inverted index table; the detailed information is the hash value of the key and the index position of the key in the corresponding inverted index table; the index position is obtained according to the actual position of the key in the corresponding inverted index table and the random permutation function; The intersection data is obtained based on the detailed information of the key in the first table and the detailed information of the key in the second table.

5. The equi-join query method for dense-state databases according to claim 4, characterized in that, The step of obtaining the connection result of the multiple original tables based on the multiple intersection data includes: Create a target hash table based on the hash values ​​in the detailed information of the intersection data in the first table; Based on the index position in the detailed information of the intersection data in the first table, the corresponding data in the inverted index table is placed into the corresponding position in the hash table; If the hash value of the detailed information of the intersection data in the second table exists in the target hash table, then other information in the inverted index table corresponding to the second table is put into the target hash table according to the index position of the detailed information of the intersection data in the second table; The data in the target hash table is returned in pairs to obtain the join result.

6. An equi-join query device for dense databases, characterized in that, The apparatus used in the equi-join query method for dense databases as described in claim 1 includes: An index building module is used to build indexes corresponding to multiple tables; wherein, the index includes: an encrypted inverted index table, which is generated from the original table; The upload module is used to upload the encrypted multiple indexes and the encrypted multi-set Bloom filter to the server; wherein, the multi-set Bloom filter is obtained based on all the values ​​of the insertion join attribute column; The request sending module is used to send the user's equi-join query request to the server, so that the server returns the corresponding equi-join query result to the user based on the query request, the multiple indexes and the multi-set Bloom filter.

7. An equi-join query device for dense databases, characterized in that, The apparatus used in the equi-join query method for dense databases as described in claim 4 includes: The first receiving module is used to receive the indexes and multi-set Bloom filters corresponding to multiple encrypted original tables uploaded by the client; wherein, the indexes include: an encrypted inverted index table, which is generated from the original tables; The second receiving module is used to receive the user's equi-connection query request sent by the client; The decryption module is used to decrypt the indexes and multi-set Bloom filters corresponding to the encrypted original tables, and to decrypt the obtained encrypted inverted index tables to obtain multiple inverted index tables and multi-set Bloom filters. The intersection acquisition module is used to obtain the intersection data of the multiple original tables based on the multiple inverted index tables using a forgotten data filtering function; wherein, the forgotten data filtering function is implemented based on the multi-set Bloom filter; The result acquisition module is used to obtain the connection result of the multiple original tables based on the multiple intersection data; The result encryption module is used to encrypt the connection result to obtain the equi-connection query result corresponding to the equi-connection query request. The result sending module is used to send the equi-join query results to the user.

Images