A spatial database encryption method, device and medium

Abstract

The present application discloses a spatial database encryption method, device and medium, and relates to the field of spatial database technology. The method mainly includes: using the ciphertext grouping link mode of the SM4 algorithm to generate a coordinate ciphertext sequence according to the coordinate sequence to be encrypted; using the SM3 algorithm to generate a summary value according to the WKB spatial field binary sequence; according to the encrypted extended WKB structure corresponding to different geometric types, the coordinate ciphertext sequence and the summary value are reorganized to generate a geometric object ciphertext sequence; using the order-preserving encryption algorithm to generate a spatial index according to the minimum circumscribed rectangle object; storing the spatial index in a newly created index field in the spatial database table; storing the geometric object ciphertext sequence in the spatial field of the spatial database table. The present application can ensure the security of spatial data while minimizing the impact on the availability and efficiency of the spatial database.

Description

Technical Field

[0001] The present application relates to the field of spatial database technology, and in particular to a spatial database encryption method, device and medium. Background Art

[0002] As a carrier of information supporting social economy, resources and environment, ecological civilization, etc., geospatial data is an important work achievement of surveying and mapping and geographic information. With the advancement of informatization and the upgrading of surveying and mapping equipment, the accuracy and dimension of geospatial data are constantly increasing, and the forms are constantly enriched. Its data value as a digital asset is also getting higher and higher. However, the popularity and popularization of this trend brings opportunities while also facing a series of data security risks. In this context, how to ensure data security in data processing activities has become one of the important factors restricting the application of geospatial data results and the development of the geographic information industry.

[0003] Commercial cryptographic technology includes symmetric cryptographic algorithms and asymmetric (public key) cryptographic algorithms for data confidentiality protection, as well as hash algorithms for data integrity verification. Common symmetric cryptographic algorithms mainly include block cipher algorithms, such as Advanced Encryption Standard (AES), Commercial Cryptographic Algorithm SM4 (SM4), etc., and stream cipher algorithms, such as Zu Chongzhi's algorithm, etc. Public key cryptographic algorithms mainly include Elliptic Curve Cryptography (ECC), Commercial Cryptographic Algorithm SM2 (SM2), Commercial Cryptographic Algorithm SM9 (SM9), etc. Hash algorithms mainly include Message Digest Algorithm 5 (MD5), Commercial Cryptographic Algorithm SM3 (SM3), etc. Among them, block ciphers are highly efficient and can be used in a variety of data encryption scenarios. They are the most commonly used cryptographic technology for encrypting vector data. However, when using commercial cryptographic technology to protect the confidentiality of vector data, due to the huge amount of geospatial data and complex data structure, the encryption and decryption efficiency problems caused by black-box and coarse-grained encryption methods are one of the reasons that hinder the widespread application of cryptography in the field of surveying and mapping geographic information.

[0004] Unlike important business data in the financial and power industries, geospatial data has the characteristics of large scale, high complexity, and strong timeliness, which makes it difficult to directly apply general cryptographic application strategies to encrypt and control geospatial data. At present, encryption technology methods that take into account the structural characteristics of vector objects tend to be biased towards spatial data files, and there are relatively few studies on fine-grained encryption methods for spatial databases. Although spatial databases are widely used in various scenarios, there are still some urgent problems to be solved in their encryption methods. For example, when commercial cryptographic algorithms are directly applied to vector data encryption, the original data structure will be destroyed, the access control granularity will be coarse, and the efficiency and flexibility will be low; after directly using commercial cryptographic algorithms to encrypt vector fields in spatial databases, the ciphertext fields cannot maintain the original spatial data structure and spatial field encoding specifications, resulting in the inability to store data items; after encrypting the spatial fields in large-volume spatial databases, the database or data table needs to be decrypted as a whole when performing spatial retrieval, and the overall decryption operation will inevitably greatly reduce the retrieval efficiency. In these cases, encryption has a significant impact on the structure and retrieval of the space. The emergence of these problems means that in the process of formulating encryption schemes, it is necessary to focus on the trade-offs between security, availability, and efficiency. Summary of the invention

[0005] The purpose of this application is to provide a spatial database encryption method, device and medium, which can ensure the security of spatial data while minimizing the impact on the availability and efficiency of the spatial database.

[0006] To achieve the above objectives, this application provides the following solutions.

[0007] In the first aspect, the present application provides a spatial database encryption method, including: obtaining spatial data to be processed and extracting a WKB spatial field binary sequence; parsing the WKB spatial field binary sequence and extracting a geometric type, a minimum circumscribed rectangle object and a coordinate sequence to be encrypted; using the ciphertext grouping linking mode of the SM4 algorithm to generate a coordinate ciphertext sequence according to the coordinate sequence to be encrypted; using the SM3 algorithm to generate a summary value according to the WKB spatial field binary sequence; according to the encrypted extended WKB structure corresponding to different geometric types, the coordinate ciphertext sequence and the summary value are reorganized to generate a geometric object ciphertext sequence; using an order-preserving encryption algorithm to generate a spatial index according to the minimum circumscribed rectangle object; storing the spatial index in a newly created index field in a spatial database table; storing the geometric object ciphertext sequence in the spatial field of the spatial database table.

[0008] Optionally, the ciphertext group linking mode of the SM4 algorithm is adopted to generate a coordinate ciphertext sequence according to the coordinate sequence to be encrypted, including: submitting a key generation request to the key management system, and the key management system calls the server cipher machine to generate a 128-bit symmetric key as a master key; dividing the master key into 4 32-bit words, and generating a round key for each round as a subkey by iteratively applying the key expansion algorithm and the round constant; treating the 128-bit binary coded coordinate pair of each point element in the coordinate sequence to be encrypted as an encryption group; performing an XOR operation on the encrypted group corresponding to each point element and the target vector respectively, and based on the subkey, using a 32-round nonlinear iterative structure to perform an iterative round transformation operation to generate a 128-bit ciphertext corresponding to each point element, and the 128-bit ciphertext corresponding to all the point elements constitute a coordinate ciphertext sequence; wherein, the target vector corresponding to the first point element is the initial vector, and the target vectors corresponding to the remaining point elements are the 128-bit ciphertext corresponding to the previous point element.

[0009] Optionally, the SM3 algorithm is used to generate a summary value based on the WKB space field binary sequence, including: grouping the WKB space field binary sequence into groups of 512 bits, and padding the groups less than 512 bits to obtain 512-bit calculation groups; initializing 256-bit parameters, and iteratively compressing the 512-bit calculation groups and the 256-bit parameters to generate a 256-bit hash value as the summary value.

[0010] Optionally, an order-preserving encryption algorithm is used to generate a spatial index based on the minimum enclosing rectangle object, including: converting the minimum enclosing rectangle object into WKT format, and extracting the corner point coordinates of the minimum enclosing rectangle object in WKT format; encrypting the corner point coordinates in an order-preserving manner to obtain the encrypted minimum enclosing rectangle object; and reorganizing the encrypted minimum enclosing rectangle object in WKB format to generate a spatial index.

[0011] Optionally, the geometry types include points, multi-points, lines, multi-lines, polygons and multi-polygons; the multi-polygons include multiple polygons; the polygons include at least one ring; the multi-lines include multiple lines; the rings, the lines and the multi-points are all composed of multiple point coordinate sequences, and the point coordinate sequences of the rings are connected end to end; the geometry types are represented in the WKB structure in the form of object codes, with point objects coded as 1, multi-point objects coded as 4, line objects coded as 2, multi-line objects coded as 5, polygon objects coded as 3, and multi-polygon objects coded as 6.

[0012] The encrypted extended WKB structure of a point includes: 1-byte byte order, 4-byte multi-point object code, 4-byte point quantity, and the ciphertext sequence corresponding to the point object WKB code, block encryption padding, SM3 hash value a, and SM3 hash value b.

[0013] The encrypted extended WKB structure of multiple points includes: 1-byte byte order, 4-byte multi-point object code, 4-byte point quantity + 3, and the ciphertext sequence corresponding to the point object WKB code, group encryption padding, SM3 hash value a and SM3 hash value b; the coordinates in the point object WKB code represent the coordinates of a single point.

[0014] The encrypted extended WKB structure of a line includes: 1-byte byte order, 4-byte line object code, 4-byte point number num+3, 16×num-byte ciphertext sequence, 16-byte block encryption padding and 32-byte SM3 hash value.

[0015] The encrypted extended WKB structure of multiple lines includes, in sequence: 1-byte byte order, 4-byte multi-line object code, 4-byte line quantity+1, ciphertext sequence corresponding to the line object WKB code, 1-byte byte order, 4-byte line object code, 4-byte point quantity, 16-byte group encryption padding and 32-byte SM3 hash value; the coordinate sequence in the line object WKB code represents the coordinates of multiple points constituting the line.

[0016] The encrypted extended WKB structure of the polygon includes: 1-byte byte order, 4-byte polygon object code, 4-byte ring number + 1, several groups of 4-byte point number numi and 16×numi-byte ciphertext sequence, 4-byte point number num0, 16-byte group encryption padding and 32-byte SM3 hash value.

[0017] The encrypted extended WKB structure of multiple polygons includes: 1-byte byte order, 4-byte multiple polygon object code, 4-byte polygon number + 1, and the ciphertext sequence corresponding to the polygon object WKB code, group encryption padding and SM3 hash value; the coordinate sequence in the polygon object WKB code represents the coordinates of multiple points that constitute the polygon.

[0018] The SM3 hash value is the summary value, and the SM3 hash value a and the SM3 hash value b are obtained by decomposing the SM3 hash value.

[0019] Optionally, the round transformation operation is implemented using a round transformation function; the round transformation function is composed of an XOR operation unit, a nonlinear transformation unit and a linear transformation unit; the XOR operation unit performs an XOR operation on the word involved in the operation and the corresponding subkey; the nonlinear transformation unit is composed of 4 parallel S boxes, and the S box replaces the word involved in the operation in units of bytes; the linear transformation unit performs a linear transformation on the word generated after the S box replacement, and the linear transformation includes a shift operation and an XOR operation.

[0020] Optionally, obtaining the spatial data to be processed and extracting the WKB spatial field binary sequence includes: parsing a structured query language statement sent by the client to obtain the spatial data to be processed and extracting the WKB spatial field binary sequence.

[0021] Optionally, storing the geometric object ciphertext sequence in a spatial field of a spatial database table includes: rewriting the structured query language statement according to the geometric object ciphertext sequence to store the geometric object ciphertext sequence in the spatial field of the spatial database table.

[0022] In a second aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the spatial database encryption method.

[0023] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the spatial database encryption method when executed by a processor.

[0024] According to the specific embodiments provided by the present application, the present application discloses the following technical effects: the present application provides a spatial database encryption method, device and medium, adopts the ciphertext group linking mode of the SM4 algorithm, generates a coordinate ciphertext sequence according to the coordinate sequence to be encrypted, adopts the SM3 algorithm, generates a summary value according to the WKB spatial field binary sequence, and reorganizes the coordinate ciphertext sequence and the summary value according to the encrypted extended WKB structure corresponding to different geometric types to generate a geometric object ciphertext sequence. The process extracts the coordinate sequence in the spatial field structure and performs group encryption. On the one hand, the method of increasing the number of geometric object nodes is adopted to enable more byte information to be stored in the spatial structure, solves the impact of ciphertext expansion such as group filling encryption and hash value recording on the spatial structure, improves the availability and applicability while ensuring the security of spatial data, and on the other hand reduces the number of encrypted groups, thereby improving encryption efficiency; in addition, an order-preserving encryption algorithm is adopted to generate a spatial index according to the minimum circumscribed rectangle object and store it in a newly created index field, so that spatial query operations can be performed without decrypting the spatial index or spatial data, thereby improving retrieval efficiency. Therefore, the spatial database encryption method, device and medium provided by the present application can ensure the security of spatial data while minimizing the impact on the availability and efficiency of the spatial database. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 A flowchart of the spatial database encryption method provided in this application.

[0027] Figure 2 A detailed flowchart of the spatial database encryption method provided in this application.

[0028] Figure 3 Schematic diagram of the point object WKB structure provided by this application.

[0029] Figure 4 This is a schematic diagram of the EEWKB structure of the point object provided in this application.

[0030] Figure 5 Schematic diagram of the multi-point object WKB structure provided by this application.

[0031] Figure 6 Schematic diagram of the multi-point object EEWKB structure provided by this application.

[0032] Figure 7 This is a schematic diagram of the line object WKB structure provided by this application.

[0033] Figure 8 This is a schematic diagram of the EEWKB structure of the line object provided in this application.

[0034] Fig. 9 A schematic diagram of the multi-line object WKB structure provided by this application.

[0035] Fig.10 This is a schematic diagram of the multi-line object EEWKB structure provided in this application.

[0036] Fig.11 Schematic diagram of the WKB structure of the polygon object provided in this application.

[0037] Fig.12 Schematic diagram of the EEWKB structure of the polygon object provided in this application.

[0038] Fig.13 Schematic diagram of the WKB structure of the multi-polygon object provided in this application.

[0039] Fig.14 Schematic diagram of the EEWKB structure of the multi-polygon object provided in this application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] In a spatial database, vector geographic spatial data exists in the form of spatial fields for expressing geometric objects, attribute fields, and index fields for improving spatial query efficiency. Among them, the spatial fields of geometric objects describe the geometric features of geographic entities (such as points, lines, polygons, etc.), and are used to represent various spatial elements on the map, such as traffic lights, buildings, roads, rivers, etc. Index fields are usually automatically generated when spatial fields are stored in the database, and are mainly used to improve the query efficiency of massive spatial data; when the spatial fields in the spatial database are modified, the spatial index will usually change as well.

[0042] At present, the geometric objects of spatial databases are stored in the spatial fields of data tables in a standardized encoding form. When the geometric objects are encrypted, their encoding form will change and cannot be stored normally in the spatial fields. However, if the spatial database itself is fully encrypted or a certain data table in the spatial database is fully encrypted, not only will the encryption data be wasted, but the query and retrieval efficiency of the spatial database will also be greatly reduced. To this end, the present application proposes a spatial database encryption method, device and medium, which take into account the structural characteristics of vector objects, realize efficient encryption of spatial databases, and can ensure the security of spatial data while minimizing the impact on the availability and efficiency of spatial databases.

[0043] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0044] In an exemplary embodiment, the present application provides a spatial database encryption method, which is executed by a computer device, specifically, it can be executed by a computer device such as a terminal or a server alone, or it can be executed by a terminal and a server together. In the embodiment of the present application, Figure 1 and Figure 2 As shown, the method includes the following steps 1 to 8.

[0045] Step 1: Obtain the spatial data to be processed and extract the WKB spatial field binary sequence.

[0046] Parse the Structured Query Language (SQL) statements (such as spatial data storage, data update, etc.) sent by the client to obtain the spatial data to be processed and extract the WKB spatial field binary sequence.

[0047] Among them, WKB (Well-Known Binary) is a data specification proposed by the Open Geospatial Consortium (OGC), which standardizes the organization of coordinate sequences corresponding to different geometric objects and is parsed according to the data format required by the specification.

[0048] Step 2: Parse the WKB spatial field binary sequence and extract the geometry type, the minimum bounding rectangle (MBR) object and the coordinate sequence to be encrypted.

[0049] Extracting the spatial field coordinate sequence and encrypting only it is the key to achieve efficient database encryption. Spatial databases usually use WKB format to store spatial objects. WKB mainly involves two types of numerical values: one is uint32 type, which occupies 4 bytes and is used to store information such as the number of nodes and geometric type; the other is double type, which occupies 8 bytes and is used to store node coordinate values. The encoding composition of WKB expressing spatial objects usually includes byte order, geometric type, number of nodes and coordinate sequence. Among them, byte order refers to the arrangement order of multi-byte data during computer storage or transmission, usually including big endian and little endian; geometric type defines the type of specific geometric object represented, such as point, line, surface, etc.; the number of nodes is used to express the number of nodes required to constitute a spatial object; the coordinate sequence is the binary encoding form of the coordinates of each node position. By parsing the binary sequence of the WKB spatial field, all spatial field coordinate sequences can be extracted, expressed as a binary sequence composed of multiple point feature coordinates.

[0050] Step 3: Using the Cipher Block Chaining (CBC) mode of the SM4 algorithm, a coordinate ciphertext sequence is generated according to the coordinate sequence to be encrypted.

[0051] The coordinate sequence extracted in step 2 consists of multiple point feature coordinates, each of which is represented by an 8-byte X coordinate and an 8-byte Y coordinate, forming a 128-bit (8-bit per byte) binary sequence. This step uses the 128-bit binary coded coordinate pair of each point feature as an encryption group and encrypts it using the SM4-CBC mode. The specific steps are as follows.

[0052] Step 3.1: Symmetric key generation: Submit a key generation request to the key management system, which calls the server cryptographic machine to generate a 128-bit symmetric key as the master key.

[0053] Step 3.2: Key expansion. The master key is divided into four 32-bit words, and the round key of each round is generated as a subkey by iteratively applying the key expansion algorithm and the round constant. The key expansion algorithm of SM4 includes operations such as round constant addition, byte replacement and linear transformation for each 32-bit word.

[0054] Step 3.3: Coordinate sequence group encryption and ciphertext group linking mode. The 128-bit binary coded coordinate pair of each point element in the coordinate sequence to be encrypted is taken as an encryption group; the encryption group corresponding to each point element is XORed with the target vector respectively, and based on the subkey, 32 rounds of nonlinear iterative structure are used to perform iterative round transformation operations to generate 128-bit ciphertext corresponding to each point element. The 128-bit ciphertext corresponding to all point elements constitutes a coordinate ciphertext sequence. Among them, the target vector corresponding to the first point element is the initial vector, and the target vectors corresponding to the remaining point elements are the 128-bit ciphertext corresponding to the previous point element.

[0055] The round transformation operation is implemented by a round transformation function; the round transformation function is composed of an XOR operation unit, a nonlinear transformation unit and a linear transformation unit. The XOR operation unit performs an XOR operation on the word involved in the operation and the corresponding subkey. The nonlinear transformation unit is composed of 4 parallel S boxes (Substitution-boxes), and the S box is a table that replaces in bytes and is used to replace the words involved in the operation. The linear transformation unit performs a linear transformation on the word generated after the S box substitution, and the linear transformation includes a shift operation and an XOR operation.

[0056] In SM4-CBC mode, the plaintext of each group will be XORed with the encrypted ciphertext of the previous group before being encrypted by SM4, and the first group will be XORed with a randomly generated initial vector. For example, for a geometric object composed of 4 point elements, the coordinate sequence is extracted and divided into 4 encrypted groups. The SM4-CBC mode encryption process of the coordinate sequence is as follows: 1) The encrypted group composed of the first point element coordinates will first be XORed with the initial vector, and the generated 128-bit sequence will be input into the SM4 encryption module for encryption and output a 128-bit ciphertext sequence; 2) The second point element coordinates will first be XORed with the 128-bit ciphertext generated by the previous step, and then input into the SM4 encryption module for encryption; 3) For subsequent point element coordinates, the encryption process of each plaintext block is the same as the previous step, and this process is repeated on each plaintext block.

[0057] Step 4: Using the SM3 algorithm, a summary value is generated according to the binary sequence of the WKB space field.

[0058] The summary value is used to implement integrity protection for the spatial field and is generated by the WKB field of the spatial object. The specific process of generating the summary value is as follows.

[0059] Step 4.1: Group the WKB space field binary sequence into groups of 512 bits, and fill the groups that are less than 512 bits to obtain 512-bit calculation groups.

[0060] The padding operation is implemented by adding padding bits, zero bits, and length information, including: 1) adding a "1" bit; 2) adding zero bits until the data length meets the conditions (that is, the length modulo 512 is equal to 448); 3) adding a 64-bit length field to indicate the bit length of the original message.

[0061] Step 4.2: Initialize a 256-bit parameter, and perform an iterative compression operation on the 512-bit calculation group and the 256-bit parameter to generate a 256-bit hash value as a digest value.

[0062] Step 5: According to the encrypted extended WKB (EEWKB) structure corresponding to different geometry types, the coordinate ciphertext sequence and the digest value are reorganized to generate a geometry object ciphertext sequence.

[0063] In order to meet the constraints of the database on the spatial field structure, the encrypted coordinate sequence and summary value need to be reorganized according to the spatial data structure after encryption. For the WKB encoding format of different geometric types, the corresponding encryption extension method, namely EEWKB, is proposed. This encryption extension method allows the spatial field of the database to store more bytes by increasing the number of geometric element nodes. The WKB and EEWKB structures of common geometric types are as follows.

[0064] The geometry types include points, multipoints, lines, multilines, polygons and multipolygons. The multipolygons include multiple polygons; the polygons include at least one ring; the multilines include multiple lines; the rings, lines and multipoints are all composed of multiple point coordinate sequences, and the point coordinate sequences of the rings are connected end to end; the geometry types are represented in the form of object codes in the WKB structure, with point objects coded as 1, multipoint objects coded as 4, line objects coded as 2, multiline objects coded as 5, polygon objects coded as 3, and multipolygon objects coded as 6.

[0065] (1) Click POINT.

[0066] The geometry type encoding of POINT in WKB is 1. Its basic structure includes byte order, geometry type (point object encoding) and coordinates (X coordinate and Y coordinate). The spatial field of POINT type represents a single point object, so its coordinates in WKB are only the coordinate pairs of a single point. For the WKB structure of POINT, see Figure 3 .

[0067] Since the block encryption algorithm requires that the length of the input data must be an integer multiple of the block length, when the data does not meet this requirement, additional bytes must be added to meet the length requirement. These additional bytes are called padding. In EEWKB, it is necessary to consider the ciphertext expansion caused by padding and hash fields. The structure of the POINT feature only allows the storage of a single point coordinate. Therefore, in the encrypted extension structure of POINT, the object encoding needs to be modified to MULTIPOINT with a point number of 1+3=4, so that the added nodes can be used to store hash values ​​and block encryption padding. See the EEWKB structure of POINT for details. Figure 4 The ciphertext sequence, block encryption padding, SM3 hash value a and SM3 hash value b are all composed of 16-byte sequences replaced at the coordinate position of the WKB corresponding to the POINT. SM3 hash value a and SM3 hash value b are two 16-byte parts split from the 32-byte SM3 hash value. The 32-byte SM3 hash value is the summary value.

[0068] like Figure 4 As shown, the encrypted extended WKB structure of a point includes: 1-byte byte order, 4-byte multi-point object code, 4-byte point quantity (4), and the ciphertext sequence corresponding to the WKB code of the point object (i.e., point element), block encryption padding, SM3 hash value a, and SM3 hash value b.

[0069] (2) MULTIPOINT.

[0070] The geometry type code of MULTIPOINT in WKB is 4. Its basic structure includes byte order, geometry type (multipoint object code), number of points and coordinate sequence (point sequence). Figure 5 .

[0071] Similar to the encryption extension of POINT, the EEWKB structure of MULTIPOINT can be found in Figure 6 .

[0072] like Figure 6As shown, the encrypted extended WKB structure of multiple points includes: 1-byte byte order, 4-byte multi-point object code, 4-byte point quantity + 3, and the ciphertext sequence corresponding to the point object WKB code, group encryption padding, SM3 hash value a and SM3 hash value b; the coordinates in the point object WKB code represent the coordinates of a single point.

[0073] (3) LINESTRING.

[0074] The geometry type code of LINESTRING in WKB is 2. Its basic structure includes byte order, geometry type (line object code), number of points and coordinate sequence (X1 coordinate, Y1 coordinate, X2 coordinate, Y2 coordinate, etc.). The spatial field of LINESTRING type represents a single line feature (i.e., line object), and the coordinate sequence stored in its WKB is the coordinates of multiple points that make up this line. For the WKB structure of LINESTRING, see Figure 7 .

[0075] For LINESTRING, you only need to increase the number of nodes in the data structure by 3 to store more bytes of information. Figure 8 .

[0076] like Figure 8 As shown, the encrypted extended WKB structure of the line includes: 1-byte byte order, 4-byte line object code, 4-byte point number num+3, 16×num-byte ciphertext sequence, 16-byte block encryption padding and 32-byte SM3 hash value.

[0077] (4) MULTILINESTRING.

[0078] The geometry type code of MULTILINESTRING in WKB is 5. Its basic structure includes byte order, geometry type (multi-line object code), number of lines, and WKB code (line object sequence) of each line organized by LINSTRING. For the WKB structure of MULTILINESTRING, see Fig. 9 .

[0079] In the encrypted extension structure of MULTILINESTRING, an independent LINSTRING object needs to be defined to store the extended field, where the ciphertext sequence is the original LINESTRING_WKB (line object WKB), and only the coordinate sequence is encrypted and replaced to generate the ciphertext. Fig.10MULTILINESTRING is composed of multiple LINESTRING structures. In this data encryption structure, the ciphertext sequence represents the ciphertext generated by encrypting and replacing only the coordinate sequence; the ciphertext expansion is stored by defining a new line element (reflected in the part after LINESTRING_WKB in the structure), so the number of lines is +1, and the ciphertext padding occupies 48 bytes, so the number of points = 3.

[0080] like Fig.10 As shown, the encrypted extended WKB structure of multiple lines includes, in sequence: 1-byte byte order, 4-byte multi-line object code, 4-byte line quantity + 1, a ciphertext sequence corresponding to the line object WKB code, 1-byte byte order, 4-byte line object code, 4-byte point quantity (3), 16-byte group encryption padding and 32-byte SM3 hash value; the coordinate sequence in the line object WKB code represents the coordinates of multiple points constituting the line.

[0081] (5) POLYGON.

[0082] The geometry type code of POLYGON in WKB is 3. Its basic structure includes byte order, geometry type (polygon object code), number of rings, number of points corresponding to each ring, and coordinate sequence. This geometry type only expresses a single polygon geometry object. A polygon object may contain multiple rings, and each ring consists of multiple point coordinate sequences. For the WKB structure of POLYGON, see Fig.11 .

[0083] POLYGON expresses a planar geographic entity through rings, the number of points corresponding to each ring, and the coordinate sequence of the points. When encrypting it, the encryption expansion method increases the number of rings by one so that the WKB can store more bytes. Fig.12 .

[0084] Different from the coordinate sequence of LINESTRING, POLYGON requires the closure of geometric objects, so the starting coordinates of the coordinate sequence should be the same as the end coordinates, and the corresponding ciphertext processing also needs to be the same. In the CBC block encryption mode, the encrypted ciphertext results of the same plaintext block encrypted at the same time are different, and the ciphertext sequence of the point elements constituting the surface cannot be guaranteed to be closed. Therefore, it is necessary to ensure that the starting ciphertext sequence is the same as the end point in the coordinate extraction and reorganization data format. The processing process is: 1) Let the number of points in the i-th ring be numi, and extract the (numi-1)×16 byte sequence for the i-th ring; 2) Encrypt the extracted coordinate sequence and output the ciphertext sequence C0, and separate the coordinate sequence C and the last group sequence P containing padding from C0; 3) When reorganizing the coordinates, append the (numi-1)×16 byte sequence intercepted from C after the number of points numi in sequence, and add the first 16 bytes intercepted to the end of the sequence; 4) Repeat step 3) until the sequence C is completely extracted, and append the sequence P and the SM3 hash value to the end of the sequence.

[0085] like Fig.12 As shown, the encrypted extended WKB structure of the polygon includes: 1-byte byte order, 4-byte polygon object code, 4-byte ring number rings+1, several groups of 4-byte point number numi and 16×numi-byte ciphertext sequence, 4-byte point number num0, 16-byte group encryption padding and 32-byte SM3 hash value.

[0086] (6) MULTIPOLYGON.

[0087] The geometry type code of MULTIPOLYGON in WKB is 6. Its basic structure includes byte order, geometry type (multi-polygon object code), number of polygons and WKB code (polygon sequence) of each polygon organized by POLYGON. Fig.13 .

[0088] Similar to the encrypted extension structure of MULTILINESTRING, in the encrypted extension structure of MULTIPOLYGON, an independent POLYGON object needs to be defined to store the extended fields. The difference is that the POLYGON_WKB (polygon object WKB) storing the extended fields needs to ensure the closure of the POLYGON object, so the group encryption padding part needs to be appended to the end of the sequence; the ciphertext sequence is the original POLYGON_WKB, which only encrypts the coordinate sequence and replaces the generated ciphertext. For the EEWKB structure of MULTIPOLYGON, see Fig.14 .

[0089] like Fig.14As shown, the encrypted extended WKB structure of multiple polygons includes: 1-byte byte order, 4-byte multiple polygon object code, 4-byte polygon number + 1, and the ciphertext sequence corresponding to the polygon object WKB code, group encryption padding and SM3 hash value; the coordinate sequence in the polygon object WKB code represents the coordinates of multiple points that constitute the polygon.

[0090] Step 6: Use an order-preserving encryption algorithm to generate a spatial index based on the minimum bounding rectangle object.

[0091] The encryption method proposed in steps 3-5 is to encrypt the spatial data itself. When the spatial data is encrypted, its index field is usually automatically updated according to the encrypted ciphertext content, and the spatial database usually uses the spatial index when performing range queries, but the index at this time has been destroyed due to encryption. Commonly used spatial indexes in databases, such as R-trees and their variants, usually have leaf nodes that contain the circumscribed rectangles of geometric objects. This application maintains the normal use of the database spatial retrieval function by creating a new index field before encrypting the database. The order-preserving encryption process based on the vector object spatial index is as follows.

[0092] Step 6.1: Convert the minimum bounding rectangle object into the WKT format, and extract the corner point coordinates of the minimum bounding rectangle object in the WKT format.

[0093] Step 6.2: Encrypt the corner point coordinates in an order-preserving manner to obtain an encrypted minimum circumscribed rectangle object.

[0094] Step 6.3: Reorganize the encrypted minimum bounding rectangle object in WKB format to generate a spatial index.

[0095] Among them, WKT (Well-Known Text) is a text markup language developed by OGC, which is used to represent vector geometric objects, spatial reference systems, and conversions between spatial reference systems. WKB is the binary representation of WKT, which solves the problem of redundant WKT expressions and facilitates the transmission and storage of the same information in the database.

[0096] Step 7: Store the spatial index in a newly created index field in the spatial database table.

[0097] Specifically, the encryption process includes: 1) creating a new mbr index field in the spatial database table; 2) reading the WKB sequence A_wkb of the geometric object A, calculating its circumscribed rectangle A_mbr, and forming a series of polygon coordinate pairs; 3) converting A_mbr into WKT format, extracting the corner point coordinates and encrypting them using the Order-Preserving Symmetric Encryption (OPE) algorithm, reorganizing the encrypted coordinate points into WKB format and storing them in the mbr index field, and storing the encryption key in the encryption key table key_table.

[0098] Correspondingly, the spatial query and decryption process includes: 1) intercepting the retrieval SQL statement and extracting the retrieval rectangle M, which is usually expressed as the coordinates of the two diagonal points of the rectangle (such as the upper left and lower right); 2) calling the encryption key table key_table of the OPE algorithm, encrypting the coordinates of the corner points of M in order, and reorganizing the encrypted coordinates into a spatial rectangle M'; 3) using M' as the retrieval rectangle and the mbr field as the retrieved field, rewriting the retrieval SQL statement; 4) by retrieving the unique value id of the record, corresponding to the ciphertext space field, and restoring the original ciphertext sequence according to the inverse process of the encryption process in steps 1-5, performing integrity verification and calling the symmetric key decryption.

[0099] Step 8: Store the geometric object ciphertext sequence into the spatial field of the spatial database table.

[0100] The SQL statement is rewritten according to the geometric object ciphertext sequence to store the geometric object ciphertext sequence, that is, the EEWKB encrypted data, into the spatial field of the spatial database table.

[0101] Based on an in-depth analysis of the structural features of vector objects, this application deeply integrates commercial cryptographic algorithms with spatial field structural features, and proposes an encryption method based on the SM4-CBC mode that can take into account the data structural features of the spatial field of vector objects, thereby reducing the encryption calculation process of other unnecessary data except geometric features, thereby improving encryption efficiency and solving the problem of low encryption efficiency and destruction of spatial field data structure in the traditional mode. In addition, in order to address the problem of low efficiency of range queries in ciphertext spatial databases, an order-preserving encryption scheme based on spatial indexes is proposed to achieve secure and efficient range queries of spatial fields. Compared with the prior art, this application has the following advantages.

[0102] (1) Ensure the confidentiality and integrity of database space fields, which is more available and applicable than traditional methods.

[0103] Traditionally, the encryption method for spatial databases is to encrypt the database body and data tables as a whole, which results in low encryption and decryption efficiency and inconvenient database operation. In order to improve the efficiency of encryption and decryption, the geometric object data in the spatial field is directly converted into a binary sequence for encryption. However, in the process of encrypting the spatial field as a whole, the encryption operation will destroy its data structure. Due to the strict data structure constraints of the spatial database on the spatial field, the ciphertext field that does not have a standardized structure will not be able to store data items. Therefore, current commercial cryptographic technology products are either inefficient and inconvenient to operate due to overall encryption, or do not support encryption of database spatial fields.

[0104] In order to solve the problem of data structure destruction and inability to store data items caused by traditional encryption methods, this application proposes an encryption extension structure of WKB - EEWKB. By extracting the coordinate sequence in the spatial field structure and grouping it, the method of increasing the number of geometric object nodes allows more byte information to be stored in the spatial structure to solve the impact of ciphertext expansion such as group filling encryption and hash value recording on the spatial structure. Compared with traditional commercial cryptographic encryption methods, it is more usable and applicable.

[0105] (2) Compared with traditional encryption schemes, it has higher efficiency in geometric object encryption and spatial retrieval.

[0106] In terms of data encryption efficiency, when traditional commercial encryption methods encrypt the entire database or the entire table, there is a lot of unnecessary redundancy in the encryption operation. In contrast, the encryption method proposed in this application reduces the number of encryption groups by extracting the coordinate sequence in the spatial field and encrypting only the sequence, so it is more superior in encryption efficiency.

[0107] In terms of data retrieval efficiency, in a database environment with spatial expansion capabilities, when a spatial field is modified and re-stored, its spatial index will also change accordingly. Therefore, the spatial index when using traditional encryption methods to protect data will lose its availability. The traditional database retrieval solution is to decrypt the data table fields as a whole into memory, and then retrieve the data content. Due to the large volume of vector data and the long time it takes to decrypt the entire table, the efficiency will be very low when only a small number of local geometric objects are queried. The order-preserving encryption method based on spatial index proposed in this application can perform spatial query operations without decrypting the spatial index or spatial data, and only performs decryption operations on spatial data records retrieved based on spatial position retrieval, so the retrieval efficiency is significantly improved.

[0108] In an exemplary embodiment, the present application further provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0109] In an exemplary embodiment, the present application further provides a computer-readable storage medium storing a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0110] In an exemplary embodiment, the present application further provides a computer program product, including a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0111] In this application, all actions to obtain signals, information or data are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization of the corresponding device owner. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant legal provisions.

[0112] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0113] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0114] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0115] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A spatial database encryption method, characterized in that: include: Get the spatial data to be processed and extract the binary sequence of the WKB spatial field; Parsing the WKB spatial field binary sequence, and extracting the geometry type, the minimum bounding rectangle object, and the coordinate sequence to be encrypted; The ciphertext grouping linking mode of the SM4 algorithm is adopted to generate a coordinate ciphertext sequence according to the coordinate sequence to be encrypted; Using the SM3 algorithm, a summary value is generated according to the binary sequence of the WKB space field; According to the encrypted extended WKB structure corresponding to different geometric types, the coordinate ciphertext sequence and the digest value are reorganized to generate a geometric object ciphertext sequence; Using an order-preserving encryption algorithm, a spatial index is generated according to the minimum circumscribed rectangle object; Storing the spatial index in a newly created index field in a spatial database table; Storing the geometric object ciphertext sequence in a spatial field of a spatial database table; The geometry types include points, multi-points, lines, multi-lines, polygons and multi-polygons; the multi-polygons include multiple polygons; the polygons include at least one ring; the multi-lines include multiple lines; the rings, the lines and the multi-points are all composed of multiple point coordinate sequences, and the point coordinate sequences of the rings are connected end to end; the geometry types are represented in the form of object codes in the WKB structure, the point object code is 1, the multi-point object code is 4, the line object code is 2, the multi-line object code is 5, the polygon object code is 3, and the multi-polygon object code is 6; The encrypted extended WKB structure of a point includes: 1-byte byte order, 4-byte multi-point object code, 4-byte point quantity, ciphertext sequence corresponding to the point object WKB code, block encryption padding, SM3 hash value a and SM3 hash value b; The encrypted extended WKB structure of multiple points includes: 1-byte byte order, 4-byte multi-point object code, 4-byte point quantity + 3, and the ciphertext sequence corresponding to the point object WKB code, block encryption padding, SM3 hash value a and SM3 hash value b; the coordinates in the point object WKB code represent the coordinates of a single point; The encrypted extended WKB structure of the line includes: 1-byte byte order, 4-byte line object code, 4-byte point number num+3, 16×num-byte ciphertext sequence, 16-byte block encryption padding, and 32-byte SM3 hash value; The encrypted extended WKB structure of the multi-line includes: 1-byte byte order, 4-byte multi-line object code, 4-byte line number + 1, ciphertext sequence corresponding to the line object WKB code, 1-byte byte order, 4-byte line object code, 4-byte point number, 16-byte group encryption padding and 32-byte SM3 hash value; the coordinate sequence in the line object WKB code represents the coordinates of multiple points constituting the line; The encrypted extended WKB structure of polygons includes: 1-byte byte order, 4-byte polygon object code, 4-byte ring number + 1, several groups of 4-byte point number numi and 16×numi-byte ciphertext sequence, 4-byte point number num0, 16-byte group encryption padding and 32-byte SM3 hash value; The encrypted extended WKB structure of the multi-polygon includes: a 1-byte byte sequence, a 4-byte multi-polygon object code, a 4-byte polygon number + 1, and a ciphertext sequence corresponding to the polygon object WKB code, a block encryption padding, and an SM3 hash value; the coordinate sequence in the polygon object WKB code represents the coordinates of multiple points constituting the polygon; The SM3 hash value is the summary value, and the SM3 hash value a and the SM3 hash value b are obtained by decomposing the SM3 hash value.

2. The spatial database encryption method according to claim 1, characterized in that: The ciphertext grouping linking mode of the SM4 algorithm is adopted to generate a coordinate ciphertext sequence according to the coordinate sequence to be encrypted, including: Submit a key generation request to the key management system, which calls the server cryptographic machine to generate a 128-bit symmetric key as the master key; Divide the master key into four 32-bit words, and generate a round key for each round as a subkey by iteratively applying a key expansion algorithm and a round constant; The 128-bit binary coded coordinate pair of each point element in the coordinate sequence to be encrypted is regarded as an encryption group; The encrypted groups corresponding to each point element are respectively XOR-operated with the target vector, and based on the subkey, 32 rounds of iterative round transformation operations are performed using a nonlinear iterative structure to generate a 128-bit ciphertext corresponding to each point element. The 128-bit ciphertexts corresponding to all point elements constitute a coordinate ciphertext sequence; among which, the target vector corresponding to the first point element is the initial vector, and the target vectors corresponding to the remaining point elements are the 128-bit ciphertexts corresponding to the previous point element.

3. The spatial database encryption method according to claim 1, characterized in that: The SM3 algorithm is used to generate a digest value according to the binary sequence of the WKB space field, including: The WKB space field binary sequence is grouped into groups of 512 bits, and groups less than 512 bits are filled to obtain 512-bit calculation groups; Initialize a 256-bit parameter, and perform an iterative compression operation on the 512-bit calculation group and the 256-bit parameter to generate a 256-bit hash value as a digest value.

4. The spatial database encryption method according to claim 1, characterized in that: Using an order-preserving encryption algorithm, a spatial index is generated according to the minimum circumscribed rectangle object, including: Convert the minimum bounding rectangle object into WKT format, and extract the corner point coordinates of the minimum bounding rectangle object in WKT format; Encrypting the corner point coordinates in an order-preserving manner to obtain an encrypted minimum circumscribed rectangle object; The encrypted minimum circumscribed rectangle object is reorganized in WKB format to generate a spatial index.

5. The spatial database encryption method according to claim 2, characterized in that: The round transformation operation is implemented by a round transformation function; the round transformation function is composed of an XOR operation unit, a nonlinear transformation unit and a linear transformation unit; the XOR operation unit performs an XOR operation on the word involved in the operation and the corresponding subkey; the nonlinear transformation unit is composed of 4 parallel S boxes, and the S box replaces the word involved in the operation in units of bytes; the linear transformation unit performs a linear transformation on the word generated after the S box replacement, and the linear transformation includes a shift operation and an XOR operation.

6. The spatial database encryption method according to claim 1, characterized in that: Get the spatial data to be processed and extract the WKB spatial field binary sequence, including: Parse the structured query language statement sent by the client to obtain the spatial data to be processed and extract the WKB spatial field binary sequence.

7. The spatial database encryption method according to claim 6, characterized in that: Storing the geometric object ciphertext sequence in a spatial field of a spatial database table includes: The structured query language statement is rewritten according to the geometric object ciphertext sequence to store the geometric object ciphertext sequence in a spatial field of a spatial database table.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the spatial database encryption method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the spatial database encryption method described in any one of claims 1 to 7 is implemented.

Images