A Map structure construction method supporting hidden access mode

Abstract

The present invention discloses a method for constructing a Map structure that supports a hidden access mode. The method mainly includes the following steps: (1) Based on the RAM construction method of the hidden access mode proposed by the present invention, the user encrypts and randomly classifies the data, encrypts the classification results using the RAM construction method, and uploads them to the service provider; (2) Based on the search structure of a general hidden access mode, the user organizes each type of classified data and encrypts and uploads them to the service provider; (3) The service provider performs general Map operations, including insertion, deletion, update, and data retrieval, based on the query instructions and auxiliary parameters received from the user. The present invention can be applied to encrypted data storage and encrypted data query based on the Map structure in real life and business, and has the advantages of strong versatility, security and efficiency, privacy protection, ease of use, high efficiency, and low memory and time consumption.

Description

Technical Field

[0001] The present invention relates to a Map structure construction method in the fields of inadvertent random access, Key-Value storage, map structure and encrypted database, and in particular to a Map structure construction method supporting a hidden access mode. Background Art

[0002] Oblivious random access refers to a technique that allows a user to retrieve a specific piece of data from a device stored with a given dataset S, but prevents the device owner from discovering the specific piece of data being retrieved or any sensitive information about the data (this feature is known as hidden access mode). This technique is widely used in databases and data protection. However, to date, it can only be used to quickly access continuous data, meaning that the key values ​​used to access the data must be continuous integers or strings. When the key values ​​follow other distributions, this technique still does not support fast access for users with limited capabilities and storage.

[0003] Key-Value storage is a common storage method in real business activities, that is, data is in the form of a collection. Users typically access data based on key values. For example, they might store customer information by phone number. When searching for a specific customer, they directly use the customer's phone number to determine the location and data they need. The Map structure is a fundamental and important data structure in computer science, used to store key-value data and provide fast access.

[0004] Encrypted databases are a new technology that has rapidly developed over the past two decades. They enable users to store databases in the cloud and quickly access them while ensuring data security and privacy. A key consideration in encrypted databases is how to help users access specific data while preventing cloud servers from knowing which data they are accessing. Typically, encrypted databases utilize a map structure that supports oblivious random access to achieve this security goal. However, existing map structures for oblivious random access do not support efficient access.

[0005] With the rapid development of the Internet, users (including individuals and companies) have an increasing demand for storing large amounts of data (over GB), and their demand for cloud storage and encrypted databases is also increasing. Therefore, constructing a Map structure that supports hidden access modes, such as oblivious random access, for accessing widespread key-value data is crucial and has significant implications for addressing real-world user needs. Summary of the Invention

[0006] The purpose of the present invention is to provide a Map structure construction method that supports hidden access mode in order to address the deficiencies of the existing technology.

[0007] The object of the present invention is achieved through the following technical solutions:

[0008] 1. A Map structure construction method that supports hidden access mode

[0009] After the user encrypts and randomly classifies the data to be stored, the encrypted classification results are obtained. Then, based on the encrypted classification results, a ciphertext data logic tree and a data path logic tree are generated and saved locally. Then, according to the storage constraints, the ciphertext data logic tree is stored in the ciphertext data storage tree, and the data path logic tree is stored in the data path storage tree. The ciphertext data storage tree and the data path storage tree are then uploaded to the service provider to realize the storage of data uploaded by local users.

[0010] Users upload operation instructions on the Map structure according to actual needs. Local users interact with service providers to run the instructions according to the instructions. During the operation, the service provider and the user interact to ensure that the correct instruction processing results are obtained. Until the operation is completed, the data of the user and the service provider are updated according to the operation process and results.

[0011] The service provider selects a storage format of the ciphertext data storage tree and the data path storage tree and performs calculations in the process of interacting with the user based on the storage format.

[0012] The storage forms include database software, devices, electronic devices and storage media.

[0013] After the user encrypts and randomly classifies the data to be stored, the encrypted classification results are obtained, including:

[0014] After the user encrypts the stored data using a symmetric encryption method, the ciphertext is obtained, and then the obtained ciphertext is randomly classified to obtain an encrypted classification result.

[0015] The generating of the ciphertext data logic tree and the data path logic tree according to the encrypted classification result includes:

[0016] The user forms an independent search tree for each type of data in the encrypted classification result according to the data label. The search trees formed by different types of data are of the same type. All search trees are recorded as the ciphertext data logic tree T0. Each node of each search tree stores several ciphertexts and a random number r corresponding to the node. The random number r is used to correspond to the node. If a node has n child nodes, then this node will also store n ciphertexts and random numbers. Each random number is used to correspond to a child node. The value range of each random number is n represents the number of data to be stored;

[0017] The user initializes a new height as The complete X-ary tree is a complete X-ary tree, where n represents the number of data to be stored. After the complete X-ary tree stores the paths of each node in the search tree, a data path logic tree T2 is generated. Each node in the data path logic tree T2 corresponds to a block, and the information stored in each non-leaf node is (level, index, r, IC0, IC1, ..., IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i It is a random number that records the path corresponding to the i-th child node of the non-leaf node; the i-th leaf node records the random number k corresponding to the root node mapped to position i by the hash function in the search tree and the random number r of the corresponding record path.

[0018] The step of storing the ciphertext data logic tree into the ciphertext data storage tree and storing the data path logic tree into the data path storage tree according to the storage constraint includes:

[0019] The user initializes a tree with a height of The first binary complete tree. Each node of the first binary complete tree is also called a bucket. Each bucket consists of u blocks. Each block is initialized to a completely random string. Each block is used to store the ciphertext of a user's data. According to the storage constraints, after the ciphertext data logic tree T0 is stored in the first binary complete tree, the ciphertext data storage tree T1 and the area stash are obtained.

[0020] The user then initializes a tree with a height of The second binary complete tree, each node of the second binary complete tree is also called a bucket, each bucket consists of u blocks, each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of user data; according to the storage constraint, after the data path logic tree T2 is stored in the second binary complete tree, the data path storage tree T3 is obtained; for the user, the user now locally stores the random number of the recorded path corresponding to the root node of the data path logic tree T2 and records it as r0, the key sk for encryption and decryption, and the area stash.

[0021] The storage constraints include:

[0022] For each node in the logic tree and its corresponding random number r, the user stores its ciphertext in the path from the root node to the rth leaf node in the binary complete treer In an empty block of a bucket on

[0023] When selecting a bucket, give priority to the bucket closer to the leaf node;

[0024] When a block stores the ciphertext of data, it encrypts the corresponding random number r and obtains the ciphertext of the random number r, and stores the ciphertext of the random number r in the block.

[0025] The blocks in the first binary complete tree that do not store ciphertext are filled with random strings, and the length of the random strings and the ciphertext are the same;

[0026] If the user selects the path from the root node to the rth leaf node r If the storage is full, the ciphertext and corresponding random number of the node that cannot be stored are stored in a block and the block is stored in the stash area on the user side; for any data in the stash area, if it can be put back to the path from the root node to the rth leaf node in the calculation of the interaction process r , the user will store it back to the path from the root node to the rth leaf node r .

[0027] The user uploads operation instructions on the Map structure according to actual needs, including:

[0028] Users upload operation instructions to the service provider based on their actual business needs. The operation instructions include read, update and insert. The operation instructions are recorded as (op, key, value), where op represents the instruction type, key and value represent the key value and specific value of the data respectively.

[0029] The local user interacts with the service provider to execute the instruction according to the instruction. During the execution, the service provider and the user interact to ensure that the correct instruction processing result is obtained. Until the execution is completed, the data of the user and the service provider are updated according to the execution process and the execution results, including:

[0030] The user calculates the dth leaf node in the data path logic tree T2 that needs to be accessed based on the key value of the data in the operation instruction;

[0031] (a) If the dth leaf node is the root node of the data path logic tree T2, the user directly retrieves the path corresponding to r0 in the data path storage tree T3 and finds the root node of the data path logic tree T2 in this path;

[0032] (b) If the d-th leaf node is not the root node of the data path logic tree T2, first find the root node of the data path logic tree T2, then search downward and update the node information in sequence until the d-th leaf node in the data path logic tree T2 is obtained; in the process of searching downward and updating the node information, by downloading a path of the data path storage tree T3, the j-th node of the i-th layer of the data path logic tree T2 has been obtained. The content of this node includes (level, index, r, IC0, IC1, ..., IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node. The user needs to continue to obtain the X·j+e-th node at the i+1-th layer in the data path logic tree T2. The steps are as follows:

[0033] If the jth node of the i-th layer of the data path logic tree T2 is the root node, the user updates its r to a new random number r′ and simultaneously locally records the random tree IC of the parent node of the X·j+e-th node of the i+1-th layer e , update the random tree IC in the block of data path logic tree T2 e As a new random number, store this new random number locally as random tree IC e ′ Next, the user puts all the nodes of this path back into the data path storage tree T3 according to the storage constraints, thus completing the return of this path in the data path storage tree T3; Finally, the user goes to the data path storage tree T3 to get the random tree IC e The corresponding path goes to the data path logic tree T2 to find the required X·j+e-th node in the i+1-th layer;

[0034] If the jth node of the i-th layer of the data path logic tree T2 is not the root node, the user has obtained the random number r and the updated random number r' of the corresponding path of this node from the search process of the upper node. The user updates the random number r of this node in the block to r' and retrieves the required random tree IC e And record it locally, and generate a new random number IC e ′ Used to update IC in block e , and record IC e ′ Locally; users put IC e and IC e ′The random number r and the updated random number r′ of the corresponding path to be searched next time are considered; the user repeats this process until the d-th leaf node of the data path logic tree T2 is obtained;

[0035] (c) After the user obtains the d-th leaf node of the data path logic tree T2, in addition to updating the random number corresponding to the path of this leaf node according to the method in step (b), the user also retrieves the random number k and path random number r corresponding to the root node of the search tree of the hash mapping to d in the ciphertext data storage tree T1 corresponding to this leaf node; the user records the random number k and path random number r locally, and generates a new random number r′ as the new random number corresponding to the path of the root node of the ciphertext data storage tree T1; then the user puts the path of this leaf node back to the data path storage tree T3;

[0036] (d) The user takes the method described in step (b) in the data path storage tree T3 to traverse the search tree hashed to d layer by layer until the node corresponding to the random number k is found and the read, update or insert operation should be performed at the position; different from step (b) which uses sorting to find the child nodes of the tree, here the user will traverse the child nodes by comparing the value of k with the key value of the child node.

[0037] 2. A computer program product

[0038] The product includes a computer program / instruction, which, when executed by a processor, implements the steps of any one of the methods for constructing a Map structure supporting a hidden access mode.

[0039] According to the above technical solution, the beneficial effects of the present invention are as follows:

[0040] 1. This invention, based on a new Map structure with hidden access mode, implements encryption protection for user data and reduces the leakage of user privacy information, thus providing a secure and complete protection solution for cloud storage of user data in actual business activities.

[0041] 2. The Map structure implemented in the present invention supports users to efficiently access key-value data. Compared with existing Map structures of this type, it has better computational complexity and actual performance, bringing greater performance improvement to users' business activities.

[0042] 3. The present invention has the advantages of strong versatility, safety and efficiency, privacy protection, ease of use, high efficiency, and low memory and time consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the framework of the present invention. DETAILED DESCRIPTION

[0044] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0045] Example 1

[0046] Assume that user A stores his key-value data set M in a cloud service provider B and requires that service provider B cannot obtain any information about M. In addition, user A requires that operations (including but not limited to access, delete, insert, and update) on data set M without revealing privacy. In order to solve this problem, a method for constructing a Map structure that supports hidden access mode is used to meet the requirements of user A. Figure 1 As shown, the specific steps include:

[0047] User A encrypts and randomly classifies their data M to be stored, obtaining the encrypted classification results. Based on the encrypted classification results, they generate a ciphertext data logic tree and a data path logic tree and save them locally. Then, according to storage constraints, they store the ciphertext data logic tree in the ciphertext data storage tree and the data path logic tree in the data path storage tree. The ciphertext data storage tree and the data path storage tree are then uploaded to Service Provider B, enabling local storage of the data uploaded by User A.

[0048] After User A encrypts and randomly classifies the data to be stored, he obtains the encrypted classification results, including:

[0049] User A uses a symmetric encryption method (such as AES) to encrypt his data to be stored and obtains the ciphertext. The corresponding key is sk s , and then use the hash function to randomly classify the obtained ciphertext to obtain the encrypted classification result. Specifically, assuming that there are n data to be stored, for the i-th data (k i ,v i ), k i Represents the label of the data, v i Represents the data itself and its ciphertext c i , user A selects a hash function and uses it to perform random classification. The hash function satisfies the mapping: {0,1} * →{0,1,…,n-1}, where {0,1} * Represents a 0 / 1 string of arbitrary length, calculating the ciphertext c i Category d i , satisfying d i=hash(k i ), hash() represents the hash function. User A uses this classification method to classify all ciphertexts.

[0050] Generate the ciphertext data logic tree and data path logic tree based on the encrypted classification results, including:

[0051] User A forms an independent search tree for each type of data in the encrypted classification result according to the data label. The search trees formed by different types of data are of the same type. All search trees are recorded as the ciphertext data logic tree T0. Each node of each search tree stores several ciphertexts and a random number r corresponding to the node. The random number r is used to correspond to the node. If a node has n child nodes, then this node will also store n ciphertexts and random numbers. Each random number is used to correspond to a byte node. The value range of each random number is n represents the number of data to be stored;

[0052] User A initializes a new height as The complete X-ary tree is a complete X-ary tree, where X is the parameter specified by user A and n is the number of data to be stored. After the complete X-ary tree stores the paths of each node in the search tree, it generates a data path logic tree T2; each node in the data path logic tree T2 corresponds to a block, and the information stored in each non-leaf node is (level, index, r, IC0, IC1, ..., IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i It is a random number that records the path corresponding to the i-th child node of the non-leaf node; for a leaf node, it has no child nodes, and the i-th leaf node records the random number k corresponding to the root node mapped to position i by the hash function in the search tree and the random number r of the corresponding path to which the record belongs.

[0053] According to the storage constraints, the ciphertext data logic tree is stored in the ciphertext data storage tree and the data path logic tree is stored in the data path storage tree, including:

[0054] User A initializes a tree with a height of The first binary complete tree. Each node of the first binary complete tree is also called a bucket. Each bucket consists of u blocks, where u is a parameter set in advance by User A. Each block is initialized to a completely random string and is used to store the ciphertext of a piece of data from User A. According to the storage constraints, after the ciphertext data logic tree T0 is stored in the first binary complete tree, the ciphertext data storage tree T1 and the area stash are obtained.

[0055] User A then initializes a tree with a height of The second binary complete tree is constructed. Each node in the second binary complete tree is also called a bucket. Each bucket consists of u blocks, where u is a parameter set in advance by User A. Each block is initialized to a completely random string and is used to store the ciphertext of a piece of data from User A. According to the storage constraints, the data path logic tree T2 is stored in the second binary complete tree to obtain the data path storage tree T3. For User A, User A now locally stores the random number corresponding to the path recorded at the root node of the data path logic tree T2, recorded as r0, the encryption key sk, and the area stash to store overflowed blocks.

[0056] Storage constraints include:

[0057] For each node in the logic tree and its corresponding random number r, user A stores its ciphertext in the path from the root node to the rth leaf node in the binary complete tree. r In an empty block of a bucket on

[0058] When selecting a bucket, give priority to the bucket closer to the leaf node;

[0059] When a block stores the ciphertext of data, it encrypts the corresponding random number r and obtains the ciphertext of the random number r, and stores the ciphertext of the random number r in the block.

[0060] The blocks in the first binary complete tree that do not store ciphertext are filled with random strings, and the length of the random strings and the ciphertext are the same;

[0061] If user A selects the path from the root node to the rth leaf node r If the storage is full and some nodes cannot be stored, the ciphertext and corresponding random number of the node that cannot be stored will be stored in a block and the block will be stored in the stash area of ​​user A. For any data in the stash area, if it can be put back to the path from the root node to the rth leaf node in the calculation of the interaction process,r , user A will store it back to the path from the root node to the rth leaf node r That is, the regional stash is used as a local database and is searched in subsequent operations. At the same time, user A will try to put the stash data back into T1 and T3.

[0062] User A uploads the ciphertext data storage tree T1 and the data path storage tree T3 to service provider B for storage. Service provider B selects the storage format for the ciphertext data storage tree and the data path storage tree based on actual conditions and uses this storage format to perform calculations during interaction with user A. Storage formats include database software, devices, electronic devices, and storage media.

[0063] User A uploads operation instructions on the Map structure based on actual needs. Operation instructions include but are not limited to searching data, inserting new data, and deleting existing data. Local user A interacts with service provider B to execute the instructions according to the instructions. During the execution process, service provider B and user A interact to ensure the correct instruction processing results. Until the execution is completed, the data at user A and service provider B are updated based on the execution process and results. That is, user A updates the ciphertext data logical tree and data path logical tree, and service provider B updates the ciphertext data storage tree and data path storage tree.

[0064] User A uploads operation instructions on the Map structure according to actual needs, including:

[0065] User A uploads operation instructions to service provider B based on their actual business needs. Operation instructions include read, update, and insert. Operation instructions are recorded as (op, key, value), where op represents the instruction type, key and value represent the key value and specific value of the data respectively.

[0066] Local user A interacts with service provider B to run the command according to the instruction. During the execution, service provider B and user A interact to ensure the correct instruction processing results. Until the execution is completed, the data of user A and service provider B are updated according to the execution process and results, including:

[0067] User A calculates the dth leaf node in the data path logic tree T2 based on the key value of the data in the operation instruction. Therefore, User A needs to traverse from the root node of data path logic T2 to this leaf node. Because all nodes in data path logic T2 are currently stored in data path storage tree T3, User A needs to find the nodes in data path logic T2 from top to bottom in data path storage tree T3 one by one.

[0068] (a) If the dth leaf node is the root node of the data path logic tree T2, user A directly retrieves the path corresponding to r0 in the data path storage tree T3 and finds the root node of the data path logic tree T2 in this path;

[0069] (b) If the d-th leaf node is not the root node of the data path logic tree T2, then the root node of the data path logic tree T2 is first found in the manner that the d-th leaf node is the root node of the data path logic tree T2, and then the node information is searched downward and updated in sequence until the d-th leaf node in the data path logic tree T2 is obtained; in the process of searching downward and updating the node information, the j-th node of the i-th layer of the data path logic tree T2 is obtained by downloading a certain path of the data path storage tree T3, and the content of this node includes (level, index, r, IC0, IC1, ..., IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of the non-leaf node. User A needs to continue to obtain the X·j+e-th node at the i+1-th layer in the data path logic tree T2. The steps are as follows:

[0070] If the jth node of the i-th layer of the data path logic tree T2 is the root node, user A updates its r to a new random number r′ and simultaneously locally records the random tree IC of the parent node of the X·j+e-th node of the i+1-th layer e , update the random tree IC in the block of data path logic tree T2 e As a new random number, store this new random number locally as random tree IC e ′ Next, user A puts all the nodes of this path back into the data path storage tree T3 according to the storage constraints, thus completing the return of this path in the data path storage tree T3; Finally, user A goes to the data path storage tree T3 to get the random tree IC e The corresponding path goes to the data path logic tree T2 to find the required X·j+e node in the i+1th layer, where IC e and IC e ′ is regarded as the random number r of the corresponding path and the updated random number r′;

[0071] If the jth node of the i-th layer of the data path logic tree T2 is not the root node, then user A has obtained the random number r and the updated random number r' of the corresponding path of this node from the search process of the upper node. User A updates the random number r of this node in the block to r' and retrieves the required random tree ICe And record it locally, and generate a new random number IC e ′ Used to update IC in block e , and record IC e ′ Locally; User A puts IC e and IC e ′ The random number r and the updated random number r′ of the corresponding path to be searched next time are considered; User A repeats this process until he obtains the d-th leaf node of the data path logic tree T2;

[0072] (c) After user A obtains the d-th leaf node of the data path logic tree T2, in addition to updating the random number corresponding to the path of this leaf node according to the method in step (b), user A also retrieves the random number k and path random number r corresponding to the root node of the search tree whose hash is mapped to d in the ciphertext data storage tree T1 corresponding to this leaf node. User A records the random number k and path random number r locally and generates a new random number r′ as the new random number corresponding to the path of the root node of the ciphertext data storage tree T1. User A then puts the path of this leaf node back into the data path storage tree T3.

[0073] (d) User A uses the method in step (b) to traverse the search tree mapped to d in the data path storage tree T3 layer by layer until the node corresponding to the random number k is found and the read, update or insert operation should be performed at the position; different from step (b) which uses sorting to find the child node of the tree, here User A will traverse the child node by comparing the value of k with the key value of the child node.

[0074] Example 2

[0075] The present invention also proposes a Map structure construction system that supports hidden access mode. The cloud database system using this method can execute any of the functions provided by any embodiment of the present invention to securely store user data and support searching, inserting, deleting and updating user data. The Map structure construction system that supports hidden access mode includes a user device module and a service provider module; the user device module encrypts the user data and uploads the encryption result to the service provider module for storage; the user module executes instructions and uploads operation instructions on the Map structure according to actual needs, including but not limited to searching data, inserting new data, and deleting existing data. The user module interacts with the service provider module to run the instructions according to the instructions. During the operation, the user module and the service provider module interact to ensure that the correct instruction processing results are obtained. After the execution is completed, the data of the user module and the service provider module are updated according to the execution process and results.

[0076] In the database field, suppose a company has its own transaction information database, and the transaction information is Key-Value data. Where k is the unique number of each transaction, and v is the specific information of the transaction. To save memory and improve performance, the enterprise encrypts and stores transaction data in the cloud. Based on the needs of real-time transactions, the warehouse continuously issues searches, inserts, deletes, and updates to the encrypted data in the cloud, with search instructions being the most common and widespread instructions. During the simulation test, a server equipped with two 2.5GHz Intel Xeon Gold 6248 processors and 256GB of memory was used to simulate the cloud service provider, and a Macbook Air (M1 chip) simulated the enterprise client device. The search instructions were executed using the method of the present invention. The time taken is shown in Table 1 (where prior refers to the efficiency of the previous Map construction method, ours refers to the efficiency of the method of the present invention, and speedup is the comparison difference between the two methods).

[0077] Table 1

[0078]

[0079] As shown in Table 1 above, the present invention supports the execution of search instructions. 24 When completing a search command in a database with 100 data pairs, the shortest time taken by the present invention was 0.84 seconds, and the longest time was only 0.92 seconds. This shows that in actual commercial activities, even taking into account transmission delays, the present invention can still complete a query command within 1 second, and in this process, it can always ensure the privacy of user data. In addition, the time taken by the present invention remains stable as the number of executions increases, thus maintaining stable performance in actual commercial activities.

[0080] Therefore, using the method of the present invention, the database runs faster, consumes less time, and runs stably. In summary, the present invention is based on AES encryption, realizes the encryption protection of user data, reduces the leakage of user privacy information, and thus provides a safe and complete protection solution for the cloud storage of user data in actual business activities; the present invention realizes the safe and efficient execution of insert, search, update and delete instructions on encrypted data, and meets the needs of users for remote operation and query of cloud storage data in actual business activities; the present invention has the advantages of strong versatility, safety and efficiency, privacy protection, ease of use, high efficiency, and low memory and time consumption.

[0081] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for constructing a Map structure that supports hidden access mode, characterized in that: include: After the user encrypts and randomly classifies the data to be stored, he obtains the encrypted classification results; Then, based on the encrypted classification results, a ciphertext data logic tree and a data path logic tree are generated and saved locally on the user. Then, according to the storage constraints, the ciphertext data logic tree is stored in the ciphertext data storage tree, and the data path logic tree is stored in the data path storage tree. The ciphertext data storage tree and the data path storage tree are then uploaded to the service provider to realize the storage of data uploaded by local users. The storage constraints include: For each node in the logic tree and its corresponding random number r, the user stores its ciphertext in the path from the root node to the rth leaf node in the binary complete tree r In an empty block of a bucket on When selecting a bucket, give priority to the bucket closer to the leaf node; When a block stores the ciphertext of data, it encrypts the corresponding random number r and obtains the ciphertext of the random number r, and stores the ciphertext of the random number r in the block. The blocks in the first binary complete tree that do not store ciphertext are filled with random strings, and the length of the random strings and the ciphertext are the same; If the user selects the path from the root node to the rth leaf node r If the storage is full, the ciphertext and corresponding random number of the node that cannot be stored are stored in a block and the block is stored in the stash area on the user side; for any data in the stash area, if it can be put back to the path from the root node to the rth leaf node in the calculation of the interaction process r , the user will store it back to the path from the root node to the rth leaf node r ; Users upload operation instructions on the Map structure according to actual needs. Local users interact with service providers to run the instructions according to the instructions. During the operation, the service provider and the user interact to ensure that the correct instruction processing results are obtained. Until the operation is completed, the data of the user and the service provider are updated according to the operation process and results.

2. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The service provider selects a storage format of the ciphertext data storage tree and the data path storage tree and performs calculations in the process of interacting with the user based on the storage format.

3. A method for constructing a Map structure supporting a hidden access mode according to claim 2, characterized in that: The storage forms include database software, devices, electronic devices and storage media.

4. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: After the user encrypts and randomly classifies the data to be stored, the encrypted classification results are obtained, including: After the user encrypts the stored data using a symmetric encryption method, the ciphertext is obtained, and then the obtained ciphertext is randomly classified to obtain an encrypted classification result.

5. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The generating of the ciphertext data logic tree and the data path logic tree according to the encrypted classification result includes: The user forms an independent search tree for each type of data in the encrypted classification result according to the data label. The search trees formed by different types of data are of the same type. All search trees are recorded as the ciphertext data logic tree T0. Each node of each search tree stores several ciphertexts and a random number r corresponding to the node. The random number r is used to correspond to the node. If a node has n child nodes, then this node will also store n ciphertexts and random numbers. Each random number is used to correspond to a child node. The value range of each random number is n represents the number of data to be stored; The user initializes a new height as The complete X-ary tree is a complete X-ary tree, where n represents the number of data to be stored. After the complete X-ary tree stores the paths of each node in the search tree, a data path logic tree T2 is generated. Each node in the data path logic tree T2 corresponds to a block, and the information stored in each non-leaf node is (level, index, r, IC0, IC1, ..., IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i It is a random number that records the path corresponding to the i-th child node of the non-leaf node; the i-th leaf node records the random number k corresponding to the root node mapped to position i by the hash function in the search tree and the random number r of the corresponding record path.

6. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The step of storing the ciphertext data logic tree into the ciphertext data storage tree and storing the data path logic tree into the data path storage tree according to the storage constraint includes: The user initializes a tree with a height of The first binary complete tree. Each node of the first binary complete tree is also called a bucket. Each bucket consists of u blocks. Each block is initialized to a completely random string. Each block is used to store the ciphertext of a user's data. According to the storage constraints, after the ciphertext data logic tree T0 is stored in the first binary complete tree, the ciphertext data storage tree T1 and the area stash are obtained. The user then initializes a tree with a height of The second binary complete tree, each node of the second binary complete tree is also called a bucket, each bucket consists of u blocks, each block is initialized to a completely random string, and each block is used to store the ciphertext of a piece of user data; according to the storage constraint, after the data path logic tree T2 is stored in the second binary complete tree, the data path storage tree T3 is obtained; for the user, the user now locally stores the random number of the recorded path corresponding to the root node of the data path logic tree T2 and records it as r0, the key sk for encryption and decryption, and the area stash.

7. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The user uploads operation instructions on the Map structure according to actual needs, including: Users upload operation instructions to the service provider based on their actual business needs. The operation instructions include read, update and insert. The operation instructions are recorded as (op, key, value), where op represents the instruction type, key and value represent the key value and specific value of the data respectively.

8. A method for constructing a Map structure supporting a hidden access mode according to claim 1, characterized in that: The local user interacts with the service provider to execute the instruction according to the instruction. During the execution, the service provider and the user interact to ensure that the correct instruction processing result is obtained. Until the execution is completed, the data of the user and the service provider are updated according to the execution process and the execution results, including: The user calculates the dth leaf node in the data path logic tree T2 that needs to be accessed based on the key value of the data in the operation instruction; (a) If the dth leaf node is the root node of the data path logic tree T2, the user directly retrieves the path corresponding to r0 in the data path storage tree T3 and finds the root node of the data path logic tree T2 in this path; (b) If the d-th leaf node is not the root node of the data path logic tree T2, first find the root node of the data path logic tree T2, then search downward and update the node information in sequence until the d-th leaf node in the data path logic tree T2 is obtained; in the process of searching downward and updating the node information, by downloading a path of the data path storage tree T3, the j-th node of the i-th layer of the data path logic tree T2 has been obtained. The content of this node includes (level, index, r, IC0, IC1, ..., IC X-1 ), level indicates the level where the non-leaf node is located; index indicates the sequence number of the non-leaf node in this level; r is a random number that records the path corresponding to the non-leaf node; IC i is a random number that records the path corresponding to the i-th child node of a non-leaf node. The user needs to continue to obtain the X·j+e-th node at the i+1-th layer in the data path logic tree T2. The steps are as follows: If the jth node of the i-th layer of the data path logic tree T2 is the root node, the user updates its r to a new random number r′ and simultaneously locally records the random tree IC of the parent node of the X·j+e-th node of the i+1-th layer e , update the random tree IC in the block of data path logic tree T2 e is a new random number, and this new random number is stored locally as random tree IC′ e Next, the user puts all the nodes of this path back into the data path storage tree T3 according to the storage constraints, thus completing the return of this path in the data path storage tree T3; Finally, the user goes to the data path storage tree T3 to get the random tree IC e The corresponding path goes to the data path logic tree T2 to find the required X·j+e-th node in the i+1-th layer; If the jth node of the i-th layer of the data path logic tree T2 is not the root node, the user has obtained the random number r and the updated random number r' of the corresponding path of this node from the search process of the upper node. The user updates the random number r of this node in the block to r' and retrieves the required random tree IC e And record it locally, and generate a new random number IC' e Used to update IC in block e , and record IC′ e Locally; users put IC e and IC′ e The random number r and the updated random number r′ of the corresponding path to be searched next time are considered; the user repeats this process until the d-th leaf node of the data path logic tree T2 is obtained; (c) After the user obtains the d-th leaf node of the data path logic tree T2, in addition to updating the random number corresponding to the path of this leaf node according to the method in step (b), the user also retrieves the random number k and path random number r corresponding to the root node of the search tree of the hash mapping to d in the ciphertext data storage tree T1 corresponding to this leaf node; the user records the random number k and path random number r locally, and generates a new random number r′ as the new random number corresponding to the path of the root node of the ciphertext data storage tree T1; then the user puts the path of this leaf node back to the data path storage tree T3; (d) The user takes the method described in step (b) in the data path storage tree T3 to traverse the search tree hashed to d layer by layer until the node corresponding to the random number k is found and the read, update or insert operation should be performed at the position; different from step (b) which uses sorting to find the child nodes of the tree, here the user will traverse the child nodes by comparing the value of k with the key value of the child node.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images