Map structure construction method supporting hidden access mode

Abstract

The invention discloses a Map structure construction method supporting a hidden access mode. The method mainly comprises the following steps: (1) based on an RAM (Random Access Memory) construction method of a hidden access mode provided by the invention, a user encrypts and randomly classifies data, encrypts a classification result by using the RAM construction method, and uploads the classification result to a service provider; (2) based on a search structure of a general hidden access mode, a user organizes and encrypts each type of classified data and uploads the data to a service provider; and (3) the service provider executes general operation of Map according to the received query instruction and auxiliary parameters from the user, wherein the general operation comprises insertion, deletion, updating and data retrieval. The method can be applied to data encryption storage and encrypted data query based on the Map structure in actual life and business, and has the advantages of being high in universality, safe, efficient, capable of protecting privacy, easy and convenient to use, high in efficiency, small in memory and time consumption and the like.

Description

Technical Field

[0001] The invention relates to a Map structure construction method in the fields of inadvertent random access, Key-Value storage, map structure and encrypted database, and in particular to a Map structure construction method supporting a hidden access mode. Background Art

[0002] Oblivious random access means that a given user's data set S is stored in a device. This technology allows the user to retrieve a specific piece of data from this device, but does not allow the holder of the device to detect which piece of data is retrieved and any sensitive information of the data (this feature is called hidden access mode). This technology is widely used in the field of databases and data protection. However, as of now, this technology can only be used to quickly access continuous data, that is, the key value used to access the data must be a continuous integer or string. When the key value obeys other distributions, this technology still does not support fast access for users with limited capabilities and storage.

[0003] Key-Value storage is a common storage method in real business activities, that is, data is in the form of a collection. Users usually access data based on key values. For example, users may store customer information based on phone numbers. When users look for a specific customer, they can directly determine the location and data they need based on the phone number of the customer being looked up. The Map structure is a basic and important data structure in the computer field, used to store Key-value data and access it quickly.

[0004] Encrypted database is a new technology that has developed rapidly in the past two decades. It is used to help users store databases in the cloud and access them quickly while ensuring the security and privacy of users' data. An important consideration for encrypted databases is how to help users access a certain piece of data but prevent the cloud server from knowing which piece of data the user is accessing to protect the user's data security. Generally speaking, encrypted databases use a map structure under random access to achieve this security goal, but existing map structures under random access cannot support efficient access by users.

[0005] With the rapid development of the Internet, users (including individuals and companies) have an increasing demand for storing large-scale data (more than GB), and users have an increasing demand for cloud storage and encrypted databases. Therefore, it is very important to construct a Map structure that supports hidden access modes like random access to access the widely existing Key-value data in reality, which is of great significance to solving users' real needs. Summary of the invention

[0006] The purpose of the present invention is to provide a Map structure construction method supporting hidden access mode in view of the deficiencies in the prior art.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] 1. A Map structure construction method that supports hidden access mode

[0009] After the user encrypts and randomly classifies the data to be stored, the encrypted classification result is obtained; then, the ciphertext data logic tree and the data path logic tree are generated according to the encrypted classification result and saved locally in the user; then, according to the storage constraints, the ciphertext data logic tree is stored in the ciphertext data storage tree and the data path logic tree is stored in the data path storage tree; then, the ciphertext data storage tree and the data path storage tree are uploaded to the service provider to realize the storage of data uploaded by local users;

[0010] Users upload operation instructions on the Map structure according to actual needs. Local users interact with service providers to run the instructions. During the operation, the service provider and the user interact to ensure that the correct instruction processing results are obtained until the operation is completed. The data at the user and service provider are updated according to the operation process and results.

[0011] The service provider selects the storage form of the ciphertext data storage tree and the data path storage tree and performs calculations in the process of interacting with the user based on the storage form.

[0012] The storage forms include database software, devices, electronic devices and storage media.

[0013] After the user encrypts and randomly classifies the data to be stored, the encrypted classification results are obtained, including:

[0014] After the user encrypts the data to be stored using a symmetric encryption method, the ciphertext is obtained, and then the obtained ciphertext is randomly classified to obtain an encrypted classification result.

[0015] The generating of the ciphertext data logic tree and the data path logic tree according to the encrypted classification result includes:

[0016] The user forms an independent search tree for each type of data in the encrypted classification result according to the data label. The search trees formed by different types of data are of the same type. All search trees are recorded as the ciphertext data logic tree T0. Each node of each search tree stores several ciphertexts and a random number r corresponding to the node. The random number r is used to correspond to the node. If a node has n child nodes, then this node will also store n ciphertexts and random numbers. Each random number is used to correspond to a child node. The value range of each random number is n represents the number of data to be stored;

[0017] The user initializes a new height as The complete X-ary tree is a complete X-ary tree, n represents the number of data to be stored. After the complete X-ary tree stores the paths of each node in the search tree, a data path logic tree T2 is generated; wherein each node in the data path logic tree T2 corresponds to a block, and the information stored in each non-leaf node is (level, index, r, IC0, IC1, …, IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node; the i-th leaf node records the random number k corresponding to the root node mapped to position i by the hash function in the search tree and the corresponding random number r of the path to which the record belongs.

[0018] The storing of the ciphertext data logic tree into the ciphertext data storage tree and the storing of the data path logic tree into the data path storage tree according to the storage constraint comprises:

[0019] The user initializes a tree with a height of The first binary complete tree, each node of the first binary complete tree is also called a bucket, each bucket consists of u blocks, each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of user data; according to the storage constraint, after the ciphertext data logic tree T0 is stored in the first binary complete tree, the ciphertext data storage tree T1 and the area stash are obtained;

[0020] The user then initializes a tree with a height of The second binary complete tree, each node of the second binary complete tree is also called a bucket, each bucket consists of u blocks, each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of user data; according to the storage constraint, after the data path logic tree T2 is stored in the second binary complete tree, the data path storage tree T3 is obtained; for the user, the user now locally stores the random number of the record path corresponding to the root node of the data path logic tree T2 and records it as r0, the key sk for encryption and decryption, and the area stash.

[0021] The storage constraints include:

[0022] For each node in the logic tree and its corresponding random number r, the user stores its ciphertext in the path from the root node to the rth leaf node in the binary complete tree.r In an empty block in a bucket on the

[0023] When selecting a bucket, give priority to buckets closer to leaf nodes;

[0024] When the block stores the ciphertext of the data, the corresponding random number r is encrypted at the same time to obtain the ciphertext of the random number r, and the ciphertext of the random number r is stored in the block together;

[0025] The blocks without ciphertext in the first binary complete tree are filled with random strings, and the length of the random string is the same as that of the ciphertext;

[0026] If the user selects the path from the root node to the rth leaf node r If the storage is full, the ciphertext and corresponding random number of the node that cannot be stored are stored in a block and the block is stored in the stash area of ​​the user end; for any data in the stash area, if it can be put back to the path from the root node to the rth leaf node in the calculation of the interactive process r , the user will store it back as the path from the root node to the rth leaf node r .

[0027] The user uploads the operation instructions on the Map structure according to actual needs, including:

[0028] The user uploads operation instructions to the service provider according to their actual business needs. The operation instructions include read, update and insert. The operation instructions are recorded as (op, key, value), where op represents the instruction type, key and value represent the key value and specific value of the data respectively.

[0029] The local user interacts with the service provider to run the instruction according to the instruction. During the running process, the service provider and the user interact to ensure that the correct instruction processing result is obtained. Until the running is completed, the data of the user and the service provider are updated according to the running process and the running result, including:

[0030] The user calculates the dth leaf node in the data path logic tree T2 that needs to be accessed based on the key value of the data in the operation instruction;

[0031] (a) If the dth leaf node is the root node of the data path logic tree T2, the user directly retrieves the path corresponding to r0 in the data path storage tree T3, and finds the root node of the data path logic tree T2 in this path;

[0032] (b) If the d-th leaf node is not the root node of the data path logic tree T2, first find the root node of the data path logic tree T2, then search downward and update the node information in sequence until the d-th leaf node in the data path logic tree T2 is obtained; in the process of searching downward and updating the node information, by downloading a path of the data path storage tree T3, the j-th node of the i-th layer of the data path logic tree T2 has been obtained. The content of this node includes (level, index, r, IC0, IC1, …, IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node. The user needs to continue to get the X·j+e-th node of the i+1-th layer in the data path logic tree T2. The steps are as follows:

[0033] If the jth node of the i-th layer of the data path logic tree T2 is the root node, the user updates its r to a new random number r′, and at the same time locally records the random tree IC of the parent node of the X·j+e-th node of the i+1-th layer e , update the random tree IC in the block of data path logic tree T2 e is a new random number, and this new random number is stored locally as random tree IC e ′ ; Next, the user puts all the nodes of this path back into the data path storage tree T3 according to the storage constraints, thus completing the return of this path in the data path storage tree T3; Finally, the user goes to the data path storage tree T3 to get the random tree IC e The corresponding path goes to the data path logic tree T2 to find the required X·j+eth node at the i+1th layer;

[0034] If the jth node of the i-th layer of the data path logic tree T2 is not the root node, the user has obtained the random number r and the updated random number r' of the corresponding path recorded by this node from the search process of the upper node. The user updates the random number r of this node in the block to r', and retrieves the required random tree IC e And record it locally, and generate a new random number IC e ′ Used to update IC in block e , and record IC e ′ Locally; the user puts IC e and IC e ′The random number r and the updated random number r′ of the corresponding path to be searched next time are regarded as the random number r of the corresponding path to be searched next time; the user repeats this process until the d-th leaf node of the data path logic tree T2 is obtained;

[0035] (c) After the user obtains the d-th leaf node of the data path logic tree T2, in addition to updating the random number corresponding to the path of this leaf node according to the method in step (b), the user also retrieves the random number k and the path random number r corresponding to the root node of the search tree of the hash mapping to d in the ciphertext data storage tree T1 corresponding to this leaf node; the user records the random number k and the path random number r locally, and generates a new random number r′ as the new random number corresponding to the path of the root node of the ciphertext data storage tree T1; then the user puts the path where this leaf node is located back to the data path storage tree T3;

[0036] (d) The user adopts the method described in step (b) to traverse the search tree hashed to d in the data path storage tree T3 layer by layer until the node corresponding to the random number k is found and the read, update or insert operation should be performed at the position; different from step (b) which uses sorting to find the child nodes of the tree, here the user will traverse the child nodes by comparing the value of k with the key value of the child node.

[0037] 2. A computer program product

[0038] The product includes a computer program / instruction, which, when executed by a processor, implements the steps of any one of the methods for constructing a Map structure supporting a hidden access mode.

[0039] According to the above technical solution, the beneficial effects of the present invention are as follows:

[0040] 1. Based on the construction of a new Map structure with hidden access mode, the present invention realizes encryption protection of user data and reduces the leakage of user privacy information, thereby providing a safe and complete protection solution for the cloud storage of user data in actual business activities;

[0041] 2. The Map structure implemented by the present invention supports users to efficiently access Key-value data. Compared with the existing Map structures of this type, it has better computational complexity and actual performance, and brings greater performance improvement to users' business activities.

[0042] 3. The present invention has the advantages of strong versatility, safety and efficiency, privacy protection, ease of use, high efficiency, and low memory and time consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the framework of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0045] Example 1

[0046] Assume that user A stores his Key-Value dataset M in a cloud service provider B and requires that service provider B cannot obtain any information about M. In addition, user A requires that operations (including but not limited to access, delete, insert and update) on dataset M without revealing privacy. In order to solve this problem, a method for constructing a Map structure supporting hidden access mode is used to meet the requirements of user A. Figure 1 As shown, the specific steps include:

[0047] After user A encrypts and randomly classifies his data M to be stored, he obtains the encrypted classification result; then he generates a ciphertext data logic tree and a data path logic tree based on the encrypted classification result and saves them locally in user A; then, according to the storage constraints, he stores the ciphertext data logic tree in the ciphertext data storage tree and the data path logic tree in the data path storage tree; then he uploads the ciphertext data storage tree and the data path storage tree to service provider B, thus realizing the storage of the data uploaded by local user A;

[0048] After user A encrypts and randomly classifies the data to be stored, he obtains the encrypted classification results, including:

[0049] User A uses a symmetric encryption method (such as AES) to encrypt his data to be stored and obtains the ciphertext. The corresponding key is sk s , and then use the hash function to randomly classify the obtained ciphertext to obtain the encrypted classification result. Specifically, assuming that there are n data to be stored, for the i-th data (k i ,v i ), k i Represents the label of the data, v i Represents the data itself and its ciphertext c i , user A selects a hash function and uses it for random classification. The hash function satisfies the mapping: {0,1} * →{0,1,…,n-1}, where {0,1} * Represents a 0 / 1 string of arbitrary length, calculating the ciphertext c i Category d i , satisfying d i= hash(k i ), hash() represents the hash function. User A uses this classification method to classify all ciphertexts.

[0050] Generate the ciphertext data logic tree and data path logic tree based on the encrypted classification results, including:

[0051] User A forms an independent search tree for each type of data in the encrypted classification result according to the data label. The search trees formed by different types of data are of the same type. All search trees are recorded as the ciphertext data logic tree T0. Each node of each search tree stores several ciphertexts and a random number r corresponding to the node. The random number r is used to correspond to the node. If a node has n child nodes, then this node will also store n ciphertexts and random numbers. Each random number is used to correspond to a byte node. The value range of each random number is n represents the number of data to be stored;

[0052] User A initializes a new height as The complete X-ary tree is a complete X-ary tree, where X is the parameter specified by user A, and n represents the number of data to be stored. After the complete X-ary tree stores the paths of each node in the search tree, a data path logic tree T2 is generated; wherein each node in the data path logic tree T2 corresponds to a block, and the information stored in each non-leaf node is (level, index, r, IC0, IC1, …, IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node; for a leaf node, it has no child nodes, and the i-th leaf node records the random number k corresponding to the root node mapped to position i by the hash function in the search tree and the corresponding random number r of the path to which the record belongs.

[0053] According to the storage constraint, the ciphertext data logic tree is stored in the ciphertext data storage tree and the data path logic tree is stored in the data path storage tree, including:

[0054] User A initializes a tree with a height of The first binary complete tree, each node of the first binary complete tree is also called a bucket, each bucket consists of u blocks, u is the parameter set in advance by user A. Each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of data of user A; according to the storage constraints, after the ciphertext data logic tree T0 is stored in the first binary complete tree, the ciphertext data storage tree T1 and the area stash are obtained;

[0055] User A then initializes a tree with a height of The second binary complete tree, each node of the second binary complete tree is also called a bucket, each bucket consists of u blocks, u is the parameter set in advance by user A. Each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of data of user A; according to the storage constraint, after the data path logic tree T2 is stored in the second binary complete tree, the data path storage tree T3 is obtained; for user A, user A now locally stores the random number of the recording path corresponding to the root node of the data path logic tree T2 and records it as r0, the key sk for encryption and decryption, and the area stash, which is used to store overflowed blocks.

[0056] Storage constraints include:

[0057] For each node in the logic tree and its corresponding random number r, user A stores its ciphertext in the path from the root node to the rth leaf node in the binary complete tree. r In an empty block in a bucket on the

[0058] When selecting a bucket, give priority to buckets closer to leaf nodes;

[0059] When the block stores the ciphertext of the data, the corresponding random number r is encrypted at the same time to obtain the ciphertext of the random number r, and the ciphertext of the random number r is stored in the block together;

[0060] The blocks without ciphertext in the first binary complete tree are filled with random strings, and the length of the random string is the same as that of the ciphertext;

[0061] If user A selects the path from the root node to the rth leaf node r If the storage is full and some nodes cannot be stored, the ciphertext and corresponding random number of the nodes that cannot be stored are stored in a block and the block is stored in the stash area of ​​user A. For any data in the stash area, if it can be put back to the path from the root node to the rth leaf node in the calculation of the interaction processr , user A will store it back as the path from the root node to the rth leaf node r That is, the regional stash is used as a local database and is searched in subsequent operations. At the same time, user A will try to put the stash data back to T1 and T3.

[0062] User A uploads the ciphertext data storage tree T1 and the data path storage tree T3 to service provider B for storage. Service provider B selects the storage form of the ciphertext data storage tree and the data path storage tree according to the actual situation and performs calculations in the process of interaction with user A based on the storage form. The storage form includes database software, devices, electronic devices and storage media.

[0063] User A uploads operation instructions on the Map structure according to actual needs. The operation instructions include but are not limited to searching data, inserting new data, and deleting existing data. Local user A interacts with service provider B to run the instructions according to the instructions. During the operation, service provider B and user A interact to ensure that the correct instruction processing results are obtained until the operation is completed. The data at user A and service provider B are updated according to the operation process and operation results, that is, user A updates the ciphertext data logic tree and data path logic tree, and service provider B updates the ciphertext data storage tree and data path storage tree.

[0064] User A uploads the operation instructions on the Map structure according to actual needs, including:

[0065] User A uploads operation instructions to service provider B according to its actual business needs. The operation instructions include read, update and insert. The operation instructions are recorded as (op, key, value), where op represents the instruction type, key and value represent the key value and specific value of the data respectively.

[0066] Local user A interacts with service provider B to run the command according to the command. During the running process, service provider B interacts with user A to ensure that the correct command processing result is obtained until the running is completed. The data at user A and service provider B are updated according to the running process and running results, including:

[0067] User A calculates the dth leaf node in the data path logic tree T2 that needs to be accessed based on the key value of the data in the operation instruction; therefore, User A needs to traverse from the root node of the data path logic T2 to this leaf node from top to bottom. Because all nodes in all data path logics T2 are stored in the data path storage tree T3 at this time, User A needs to find the nodes of the data path logic T2 from top to bottom one by one in the data path storage tree T3.

[0068] (a) If the dth leaf node is the root node of the data path logic tree T2, user A directly retrieves the path corresponding to r0 in the data path storage tree T3, and finds the root node of the data path logic tree T2 in this path;

[0069] (b) If the d-th leaf node is not the root node of the data path logic tree T2, then the root node of the data path logic tree T2 is first found in the manner that the d-th leaf node is the root node of the data path logic tree T2, and then the node information is searched downward and updated in sequence until the d-th leaf node in the data path logic tree T2 is obtained; in the process of searching downward and updating the node information, the j-th node of the i-th layer of the data path logic tree T2 is obtained by downloading a certain path of the data path storage tree T3, and the content of this node includes (level, index, r, IC0, IC1, …, IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node. User A needs to continue to get the X·j+e-th node at the i+1-th layer in the data path logic tree T2. The steps are as follows:

[0070] If the jth node of the i-th layer of the data path logic tree T2 is the root node, user A updates its r to a new random number r′, and at the same time locally records the random tree IC of the parent node of the X·j+e-th node of the i+1-th layer e , update the random tree IC in the block of data path logic tree T2 e is a new random number, and this new random number is stored locally as random tree IC e ′ ; Next, user A puts all the nodes of this path back into the data path storage tree T3 according to the storage constraints, thus completing the return of this path in the data path storage tree T3; finally, user A takes the random tree IC from the data path storage tree T3 e The corresponding path goes to the data path logic tree T2 to find the required X·j+eth node of the i+1th layer, where IC e and IC e ′ is regarded as the random number r of the corresponding path and the updated random number r′;

[0071] If the jth node of the i-th layer of the data path logic tree T2 is not the root node, user A has obtained the random number r and the updated random number r' of the corresponding path recorded by this node from the search process of the upper node. User A updates the random number r of this node in the block to r', and retrieves the required random tree ICe And record it locally, and generate a new random number IC e ′ Used to update IC in block e , and record IC e ′ Locally; User A puts IC e and IC e ′ The random number r and the updated random number r′ of the corresponding path to be searched next time are regarded as the random number r of the corresponding path to be searched next time; User A repeats this process until he gets the d-th leaf node of the data path logic tree T2;

[0072] (c) After user A obtains the d-th leaf node of the data path logic tree T2, in addition to updating the random number corresponding to the path of this leaf node according to the method in step (b), he also retrieves the random number k and the path random number r corresponding to the root node of the search tree of the hash mapping to d in the ciphertext data storage tree T1 corresponding to this leaf node; user A records the random number k and the path random number r locally, and generates a new random number r′ as the new random number corresponding to the path of the root node of the ciphertext data storage tree T1; then user A puts the path of this leaf node back to the data path storage tree T3;

[0073] (d) User A uses the method in step (b) to traverse the search tree mapped to d layer by layer in the data path storage tree T3 until the node corresponding to the random number k is found and the read, update or insert operation should be performed at the position; different from step (b) which uses sorting to find the child nodes of the tree, here User A will traverse the child nodes by comparing the value of k with the key value of the child node.

[0074] Example 2

[0075] The present invention also proposes a Map structure construction system that supports hidden access mode. The cloud database system using this method can execute any of the functions provided by any embodiment of the present invention to securely store user data and support searching, inserting, deleting and updating user data. The Map structure construction system that supports hidden access mode includes a user device module and a service provider module; the user device module encrypts the user data and uploads the encryption result to the service provider module for storage; the user module executes instructions and uploads operation instructions on the Map structure according to actual needs, including but not limited to searching data, inserting new data, and deleting existing data. The user module interacts with the service provider module to run the instructions according to the instructions. During the operation, the user module interacts with the service provider module to ensure that the correct instruction processing results are obtained. After the execution is completed, the data of the user module and the service provider module are updated according to the execution process and results.

[0076] In the database field, suppose a company has its own transaction information database, where transaction information is Key-Value data. Where k is the unique number of each transaction, and v is the specific information of the transaction. In order to save memory and improve performance, the enterprise encrypts and stores the transaction data in the cloud. According to the needs of real-time transactions, the warehouse continuously issues searches, inserts, deletes, and updates to the encrypted data in the cloud, among which search instructions are the most common and widely used instructions. During the simulation test, a server equipped with two 2.5GHz Intel Xeon Gold 6248 processors and 256GB of memory was used to simulate the cloud service provider, and a Macbook Air (M1 chip) simulated the enterprise client device. The method of the present invention was used to execute the search instructions. The time taken is shown in Table 1 (where prior refers to the efficiency of the previous Map construction method, ours refers to the efficiency of the method of the present invention, and speedup is the comparison difference between the two methods).

[0077] Table 1

[0078]

[0079] As shown in Table 1 above, the present invention supports the execution of search instructions. 24 When the present invention completes a search instruction in a database with 100 data pairs, the shortest time used by the present invention is 0.84 seconds, and the longest time is only 0.92 seconds. It can be seen that in actual business activities, even if the transmission delay is taken into account, the present invention can still complete a query instruction within 1 second, and in this process, the user's data privacy can always be guaranteed. In addition, as the number of executions increases, the time used by the present invention remains stable, so it can maintain stable performance in actual business activities.

[0080] Therefore, using the method of the present invention, the database runs faster, consumes less time, and runs stably. In summary, the present invention is based on AES encryption, realizes encryption protection of user data, reduces the leakage of user privacy information, and thus provides a safe and complete protection solution for the cloud storage of user data in actual business activities; the present invention realizes the safe and efficient execution of insert, search, update and delete instructions on encrypted data, and meets the needs of users in actual business activities for remote operation and query of cloud storage data; the present invention has the advantages of strong versatility, safety and efficiency, privacy protection, ease of use, high efficiency, and low memory and time consumption.

[0081] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for constructing a Map structure supporting a hidden access mode, characterized in that: include: After the user encrypts and randomly classifies the data to be stored, the encrypted classification result is obtained; Then, according to the encrypted classification results, a ciphertext data logic tree and a data path logic tree are generated and saved locally by the user. Then, according to the storage constraints, the ciphertext data logic tree is stored in the ciphertext data storage tree and the data path logic tree is stored in the data path storage tree. Then, the ciphertext data storage tree and the data path storage tree are uploaded to the service provider to realize the storage of data uploaded by local users. Users upload operation instructions on the Map structure according to actual needs. Local users interact with service providers to run the instructions. During the operation, the service provider and the user interact to ensure that the correct instruction processing results are obtained until the operation is completed. The data at the user and service provider are updated according to the operation process and results.

2. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The service provider selects the storage form of the ciphertext data storage tree and the data path storage tree and performs calculations in the process of interacting with the user based on the storage form.

3. A method for constructing a Map structure supporting a hidden access mode according to claim 2, characterized in that: The storage forms include database software, devices, electronic devices and storage media.

4. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: After the user encrypts and randomly classifies the data to be stored, the encrypted classification results are obtained, including: After the user encrypts the data to be stored using a symmetric encryption method, the ciphertext is obtained, and then the obtained ciphertext is randomly classified to obtain an encrypted classification result.

5. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The generating of the ciphertext data logic tree and the data path logic tree according to the encrypted classification result includes: The user forms an independent search tree for each type of data in the encrypted classification result according to the data label. The search trees formed by different types of data are of the same type. All search trees are recorded as the ciphertext data logic tree T0. Each node of each search tree stores several ciphertexts and a random number r corresponding to the node. The random number r is used to correspond to the node. If a node has n child nodes, then this node will also store n ciphertexts and random numbers. Each random number is used to correspond to a child node. The value range of each random number is n represents the number of data to be stored; The user initializes a new height as The complete X-ary tree is a complete X-ary tree, n represents the number of data to be stored. After the complete X-ary tree stores the paths of each node in the search tree, a data path logic tree T2 is generated; wherein each node in the data path logic tree T2 corresponds to a block, and the information stored in each non-leaf node is (level, index, r, IC0, IC1, …, IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node; the i-th leaf node records the random number k corresponding to the root node mapped to position i by the hash function in the search tree and the corresponding random number r of the path to which the record belongs.

6. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The storing of the ciphertext data logic tree into the ciphertext data storage tree and the storing of the data path logic tree into the data path storage tree according to the storage constraint comprises: The user initializes a tree with a height of The first binary complete tree, each node of the first binary complete tree is also called a bucket, each bucket consists of u blocks, each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of user data; according to the storage constraint, after the ciphertext data logic tree T0 is stored in the first binary complete tree, the ciphertext data storage tree T1 and the area stash are obtained; The user then initializes a tree with a height of The second binary complete tree, each node of the second binary complete tree is also called a bucket, each bucket consists of u blocks, each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of user data; according to the storage constraint, after the data path logic tree T2 is stored in the second binary complete tree, the data path storage tree T3 is obtained; for the user, the user now locally stores the random number of the record path corresponding to the root node of the data path logic tree T2 and records it as r0, the key sk for encryption and decryption, and the area stash.

7. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The storage constraints include: For each node in the logic tree and its corresponding random number r, the user stores its ciphertext in the path from the root node to the rth leaf node in the binary complete tree. r In an empty block in a bucket on the When selecting a bucket, give priority to buckets closer to leaf nodes; When the block stores the ciphertext of the data, the corresponding random number r is encrypted at the same time to obtain the ciphertext of the random number r, and the ciphertext of the random number r is stored in the block together; The blocks without ciphertext in the first binary complete tree are filled with random strings, and the length of the random string is the same as that of the ciphertext; If the user selects the path from the root node to the rth leaf node r If the storage is full, the ciphertext and corresponding random number of the node that cannot be stored are stored in a block and the block is stored in the stash area of ​​the user end; for any data in the stash area, if it can be put back to the path from the root node to the rth leaf node in the calculation of the interactive process r , the user will store it back as the path from the root node to the rth leaf node r .

8. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The user uploads the operation instructions on the Map structure according to actual needs, including: The user uploads operation instructions to the service provider according to their actual business needs. The operation instructions include read, update and insert. The operation instructions are recorded as (op, key, value), where op represents the instruction type, key and value represent the key value and specific value of the data respectively.

9. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The local user interacts with the service provider to run the instruction according to the instruction. During the running process, the service provider and the user interact to ensure that the correct instruction processing result is obtained. Until the running is completed, the data of the user and the service provider are updated according to the running process and the running result, including: The user calculates the dth leaf node in the data path logic tree T2 that needs to be accessed based on the key value of the data in the operation instruction; (a) If the dth leaf node is the root node of the data path logic tree T2, the user directly retrieves the path corresponding to r0 in the data path storage tree T3, and finds the root node of the data path logic tree T2 in this path; (b) If the d-th leaf node is not the root node of the data path logic tree T2, first find the root node of the data path logic tree T2, then search downward and update the node information in sequence until the d-th leaf node in the data path logic tree T2 is obtained; in the process of searching downward and updating the node information, by downloading a path of the data path storage tree T3, the j-th node of the i-th layer of the data path logic tree T2 has been obtained. The content of this node includes (level, index, r, IC0, IC1, …, IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node. The user needs to continue to get the X·j+e-th node of the i+1-th layer in the data path logic tree T2. The steps are as follows: If the jth node of the i-th layer of the data path logic tree T2 is the root node, the user updates its r to a new random number r′, and at the same time locally records the random tree IC of the parent node of the X·j+e-th node of the i+1-th layer e , update the random tree IC in the block of data path logic tree T2 e is a new random number, and this new random number is stored locally as random tree IC e ′ ; Next, the user puts all the nodes of this path back into the data path storage tree T3 according to the storage constraints, thus completing the return of this path in the data path storage tree T3; Finally, the user goes to the data path storage tree T3 to get the random tree IC e The corresponding path goes to the data path logic tree T2 to find the required X·j+eth node at the i+1th layer; If the jth node of the i-th layer of the data path logic tree T2 is not the root node, the user has obtained the random number r and the updated random number r' of the corresponding path recorded by this node from the search process of the upper node. The user updates the random number r of this node in the block to r', and retrieves the required random tree IC e And record it locally, and generate a new random number IC e ′ Used to update IC in block e , and record IC e ′ Locally; the user puts IC e and IC e ′ The random number r and the updated random number r′ of the corresponding path to be searched next time are regarded as the random number r of the corresponding path to be searched next time; the user repeats this process until the d-th leaf node of the data path logic tree T2 is obtained; (c) After the user obtains the d-th leaf node of the data path logic tree T2, in addition to updating the random number corresponding to the path of this leaf node according to the method in step (b), the user also retrieves the random number k and the path random number r corresponding to the root node of the search tree of the hash mapping to d in the ciphertext data storage tree T1 corresponding to this leaf node; the user records the random number k and the path random number r locally, and generates a new random number r′ as the new random number corresponding to the path of the root node of the ciphertext data storage tree T1; then the user puts the path of this leaf node back to the data path storage tree T3; (d) The user adopts the method described in step (b) to traverse the search tree hashed to d in the data path storage tree T3 layer by layer until the node corresponding to the random number k is found and the read, update or insert operation should be performed at the position; different from step (b) which uses sorting to find the child nodes of the tree, here the user will traverse the child nodes by comparing the value of k with the key value of the child node.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images