A secure encryption key-value storage method, device and system based on data packaging

Abstract

The present invention discloses a secure encrypted key-value storage method, device and system based on data packaging, which includes a data initialization stage and a user query stage. The key-value pairs are packaged by adopting a descending first fit algorithm, and the access frequency differences and length differences between the key-value pairs are converted into differences between data packets. The length of the packet is then padded to reduce the storage overhead of the data and ensure length security under certain frequency limits. In addition, the frequency difference between packets is reduced by selectively copying high-frequency access data packets, and the overhead of subsequent sending of false queries due to inconsistent frequencies is reduced. Finally, the access frequency of data packets is unified by sending false queries, ensuring that the cloud service provider cannot infer user data through access patterns. Experimental results show that the present invention effectively reduces the storage and bandwidth overhead of the encrypted key-value storage system, while enhancing the system's ability to resist access pattern attacks.

Description

Technical Field

[0001] The present invention relates to the field of data storage security, and in particular to a method, device and system for secure encryption key-value storage based on data packaging. Background Art

[0002] With the explosive growth of data and the efficient indexing capabilities of key-value storage, more and more users are outsourcing their local private data to cloud servers for encrypted key-value storage. However, when using cloud storage services, even if the data is encrypted before being outsourced to the cloud, attackers can still infer sensitive information from the data through frequency analysis, length analysis, or other access pattern attacks, leading to data theft or tampering.

[0003] Although several papers have proposed secure key-value storage schemes to defend against access pattern attacks, these schemes all incur high storage and bandwidth overhead. For example, researchers have proposed a technique for hiding memory access patterns called ORAM. This technique obscures access patterns by shuffling and re-encrypting data during access, preventing attackers from inferring client access patterns from physical storage locations. However, this approach has high storage and bandwidth requirements, making it ineffective for large-scale key-value stores. Other researchers have proposed Pancake, a frequency-smoothing encrypted data storage scheme. This technique introduces the concept of a passive persistent attacker, pads the length of encrypted values ​​to the same value, and then sends fake queries to ensure that each key-value pair has the same access frequency, successfully ensuring data access privacy. However, according to Zipf's law, in real-world key-value stores, a small number of key-value pairs are accessed frequently, while the majority are accessed less frequently. Furthermore, key-value pairs also vary in length. Therefore, Pancake also incurs significant storage and bandwidth overhead. Summary of the Invention

[0004] Based on the above research, the present invention provides a secure encryption key-value storage method, device and system based on data packaging, which is used to solve the frequency analysis attack and length analysis attack problems in the encryption key-value storage system while maintaining low bandwidth overhead and low storage overhead.

[0005] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0006] A first aspect provides a secure encryption key-value storage method based on data packaging, comprising:

[0007] After receiving the data uploaded by the user, the key-value pairs are packaged, selectively copied, and encrypted using a descending first fit algorithm, and the encrypted data is outsourced to a cloud service provider for storage;

[0008] After receiving a query request from a user, the query request for a key-value pair is converted into a query request for a packet, and the query request is sent to the cloud service provider on behalf of the user, so that the cloud service provider returns a query result based on the query request, and then the encrypted data packet in the query result is decrypted, the key-value pair of the user query is extracted therefrom, and finally the decrypted result is returned to the user; wherein, when sending a query request to the cloud service provider on behalf of the user, a fake query is sent to make the access frequency of all data packets uniform.

[0009] In one embodiment, data packaging of key-value pairs is performed using a descending first fit algorithm, including:

[0010] Sort all key-value pairs in descending order according to their access frequency;

[0011] The maximum frequency F and maximum length L of all key-value pairs are used as the upper bounds of frequency and length for the packaging process;

[0012] Fill the length dimension under the maximum frequency limit. Specifically, add the key-value pair to the first data packet whose length can accommodate the key-value pair and whose frequency does not exceed F. If all packets do not meet the above conditions, add the key-value pair to a new data packet.

[0013] Fill all packets to length L.

[0014] In one embodiment, selectively copying a data packet includes:

[0015] Determine the upper limit μ of the ratio of the number of replicated packets to the original number based on storage overhead and bandwidth overhead;

[0016] according to Calculate the frequency threshold α, where n is the number of packets after data packaging;

[0017] according to Calculate the number of copies of each data packet R(p i ,α),p i is the ith data packet, f(p i ) indicates p i Frequency of visits;

[0018] Packets with a frequency higher than a frequency threshold α are replicated into multiple copies.

[0019] In one embodiment, when sending a query request to a cloud service provider on behalf of a user, a fake query is sent to make the access frequency of all data packets uniform, including:

[0020] Maintain a query queue Q. Whenever a query request is received from a user, it is added to the query queue Q.

[0021] For each query request in Q, the proxy converts the query for key-value pairs into a query for packages, and then generates the actual query sent to the cloud service provider by tossing a δ-biased coin, where δ represents the true query distribution D e ′ in the total query distribution D K the proportion of

[0022] If the coin is heads, the agent sends a query for the packet. Otherwise, the agent distributes the false queries according to D f Randomly generate a fake query and send it;

[0023] A batch processing mechanism is introduced. Let Sbatch represent the batch size set and set Sbatch = {1 / δ, 1 / δ+1, 1 / δ+2}. For the last query in Q, the agent randomly samples a value B in Sbatch and sends B queries to the cloud service provider to prevent attackers from inferring frequency information by analyzing the access pattern of the last query.

[0024] Based on the same inventive concept, the second aspect of the present invention provides a secure encryption key-value storage device based on data packaging, wherein the device is an agent, comprising:

[0025] The data packaging and selective replication module is used to receive data uploaded by users, package, selectively replicate, and encrypt key-value pairs using a descending first-fit algorithm, and outsource the encrypted data to a cloud service provider for storage;

[0026] The query conversion and sending module, upon receiving a query request from a user, converts the query request for a key-value pair into a query request for a packet, and sends the query request to the cloud service provider on behalf of the user, so that the cloud service provider returns a query result based on the query request, then decrypts the encrypted data packet in the query result, extracts the key-value pair of the user query, and finally returns the decrypted result to the user; wherein, when sending a query request to the cloud service provider on behalf of the user, a fake query is sent to make the access frequency of all data packets uniform.

[0027] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the secure encryption key-value storage method based on data packaging described in the first aspect is implemented.

[0028] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the secure encryption key-value storage method based on data packaging described in the first aspect is implemented.

[0029] Based on the same inventive concept, the fifth aspect of the present invention provides a secure encryption key-value storage system based on data packaging, including the secure encryption key-value storage device based on data packaging described in the second aspect, a user and a cloud service provider, wherein the user outsources data storage to the cloud service provider through an agent, and initiates a data query request to the agent to access the data stored in the cloud; the agent and the user are located in the same internal network, and the cloud service provider is used to provide cloud storage and data access services to the user.

[0030] In one embodiment, the proxy is further configured to locally store a package-key-value pair mapping table and a key-value pair-package mapping table.

[0031] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0032] The present invention proposes a secure encrypted key-value storage method based on data packaging, which adopts a data packaging scheme based on the first fit decreasing algorithm (FFD). This scheme packages key-value pairs under a certain frequency limit, thereby ensuring length security with low storage overhead. Then, the present invention selects packets with a higher frequency for replication, thereby reducing the frequency difference between packets, reducing the subsequent false queries sent to unify the frequency, and indirectly reducing the false query overhead. Finally, by sending false queries, the access frequency of all packets is smoothed to a uniform value. By utilizing the FFD-based data packaging scheme, selective replication, and false query sending, the key-value storage system is protected from access pattern attacks while minimizing overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0034] Figure 1 An architectural diagram of a secure encrypted key-value storage system based on data packaging provided by an embodiment of the present invention;

[0035] Figure 2 This is a diagram illustrating the data packaging algorithm based on FFD in an embodiment of the present invention;

[0036] Figure 3 This is a diagram illustrating the selective copy algorithm according to an embodiment of the present invention;

[0037] Figure 4This is a graph showing how storage overhead changes with the number of key-value pairs in an embodiment of the present invention;

[0038] Figure 5 This is a graph showing how storage overhead changes with the replication parameter μ in an embodiment of the present invention.

[0039] Figure 6 This is a graph showing how bandwidth overhead changes with the number of user queries in an embodiment of the present invention.

[0040] Figure 7 Graph showing how bandwidth overhead changes with the number of times r the length upper bound increases in an embodiment of the present invention.

[0041] Figure 8 、 9 , 10, and 11 are the throughput result graphs of the four systems under two YCSB workloads: Redis storage backend single thread, Redis storage backend multi-thread, RocksDB storage backend single thread, and RocksDB storage backend multi-thread. DETAILED DESCRIPTION

[0042] Based on the analysis of the prior art, the problem that the present invention needs to solve is how to design a secure key-value storage system that can resist access pattern attacks by attackers with low overhead. A direct solution is to combine key-value pairs with smaller frequencies and key-value pairs with smaller lengths into data packets, so that the frequency and length differences between packets are low, thereby reducing the overhead caused by smoothing the frequency and uniform length. However, how to combine key-value pairs into data packets while taking into account both the frequency and length of the key-value pairs is a difficult problem.

[0043] To address the above-mentioned problems, the present invention discloses a secure encrypted key-value storage method, device, and system based on data packaging, which includes a data initialization phase and a user query phase, and aims to address the frequency analysis attack and length analysis attack problems existing in existing encrypted key-value storage systems. This system uses a descending first fit algorithm (FFD) to package key-value pairs, converts the access frequency differences and length differences between key-value pairs into differences between data packets, and then pads the length of the packet to reduce data storage overhead and ensure length security under certain frequency limits. In addition, the system reduces the frequency difference between packets by selectively copying frequently accessed data packets, reducing the overhead of subsequent false queries caused by inconsistent frequencies. Finally, the access frequency of data packets is unified by sending false queries, ensuring that cloud service providers cannot infer user data through access patterns. The present invention also implements the system on two storage backends, Redis and RocksDB. Experimental results show that the present invention effectively reduces the storage and bandwidth overhead of the encrypted key-value storage system, while enhancing the system's ability to resist access pattern attacks.

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0045] Example 1

[0046] The present invention discloses a secure encryption key-value storage method based on data packaging, comprising:

[0047] After receiving the data uploaded by the user, the key-value pairs are packaged, selectively copied, and encrypted using a descending first fit algorithm, and the encrypted data is outsourced to a cloud service provider for storage;

[0048] After receiving a query request from a user, the query request for a key-value pair is converted into a query request for a packet, and the query request is sent to the cloud service provider on behalf of the user, so that the cloud service provider returns a query result based on the query request, and then the encrypted data packet in the query result is decrypted, the key-value pair of the user query is extracted therefrom, and finally the decrypted result is returned to the user; wherein, when sending a query request to the cloud service provider on behalf of the user, a fake query is sent to make the access frequency of all data packets uniform.

[0049] The specific symbols used and involved in the present invention are described as follows:

[0050] L: The maximum length of all key-value pairs.

[0051] F: The maximum frequency among all key-value pairs.

[0052] m: The number of key-value pairs.

[0053] n: The number of packets after data is packaged.

[0054] n′: The number of packets after selective replication.

[0055] k i : The key of the i-th key-value pair.

[0056] v i : The value of the i-th key-value pair.

[0057] p i : The key of the i-th packet.

[0058] Value(p i ): the value of the i-th data packet.

[0059] q(k i ): Query request for the i-th key-value pair.

[0060] q(P i ): Query request for the i-th data packet.

[0061] q(P f ): According to the false query distribution D f A random fake query request.

[0062] f(p i ): package p i Frequency of visits.

[0063] μ: The upper limit of the ratio of the number of copied packets to the original number.

[0064] α: frequency threshold of packets.

[0065] R(p i ,α): package p i The number of replicas at the frequency threshold α.

[0066] F p : Maximum frequency among all packets after selective copy.

[0067] D e ′: the true query distribution of the packet, D e ′(p i ) refers to the package p i How often true queries are sent.

[0068] Df : Distribution of false queries for packets, D f (p i ) refers to the package p i How often fake queries are sent.

[0069] D K : The total query distribution of the packet, also refers to the query distribution of the packet observed by the cloud service provider.

[0070] δ: True query distribution D e ′ in the total query distribution D K The proportion of .

[0071] In one embodiment, the FFD-based data packaging adopted by the present invention includes the following steps:

[0072] Step 1: Sort all key-value pairs in descending order according to their access frequency.

[0073] Step 2: The maximum frequency F and maximum length L of all key-value pairs are used as the upper bounds of frequency and length for the packaging process.

[0074] Step 3: Fill the length dimension under the maximum frequency limit, that is, add the key-value pair to the first packet whose length can accommodate the key-value pair and whose frequency does not exceed F. If all packets do not meet this condition, add them to a new packet.

[0075] Step 4: Fill the length of all data packets to L.

[0076] Since the frequencies of different packets still differ greatly, the system selects the packet with the larger frequency to replicate, thereby reducing the frequency difference between the packets and reducing the subsequent false queries sent to unify the frequencies. The selective replication adopted in this embodiment includes the following steps:

[0077] Step 1: The user chooses μ by balancing storage overhead and bandwidth overhead. The larger the μ is, the more packets will be copied and the lower the frequency difference between packets will be, which will increase storage overhead and reduce bandwidth overhead. Then, Calculate the frequency threshold α by Calculate each packet p i The number of copies R(p i ,α), replicate the packets whose frequency is higher than the frequency threshold α into multiple copies;

[0078] Step 2: Randomly distribute the user's access request to the data packet to its copies to reduce the access frequency of the data packet.

[0079] Since the access frequency difference of the keys stored by the cloud service provider will still lead to data leakage, the present invention makes the access frequency of each package consistent by adding fake queries, where the proportion of the real query distribution in the total query distribution is Fake query distribution D f for The false query sending adopted by the present invention comprises the following steps:

[0080] Step 1: Maintain a query queue Q. Whenever the proxy receives a query request from a user, it adds it to the query queue Q.

[0081] Step 2: For each request in Q, the proxy converts the query for the key-value pair into a query for the package, and then generates the actual query sent to the cloud service provider by tossing a δ-biased coin;

[0082] Step 3: If the coin is heads, the agent sends the query for the packet. Otherwise, the agent distributes the false queries according to D. f Randomly generate a fake query and send it;

[0083] Step 4 introduces a batch processing mechanism. Let Sbatch denote the set of batch sizes and set Sbatch = {1 / δ, 1 / δ+1, 1 / δ+2}. For the last query in Q, the proxy randomly samples a value B in Sbatch and sends B queries to the cloud service provider to prevent attackers from inferring frequency information by analyzing the access pattern of the last query.

[0084] Example 2

[0085] Based on the same inventive concept, this embodiment discloses a secure encryption key-value storage device based on data packaging, wherein the device is an agent and includes:

[0086] The data packaging and selective replication module is used to receive data uploaded by users, package, selectively replicate, and encrypt key-value pairs using a descending first-fit algorithm, and outsource the encrypted data to a cloud service provider for storage;

[0087] The query conversion and sending module, upon receiving a query request from a user, converts the query request for a key-value pair into a query request for a packet, and sends the query request to the cloud service provider on behalf of the user, so that the cloud service provider returns a query result based on the query request, then decrypts the encrypted data packet in the query result, extracts the key-value pair of the user query, and finally returns the decrypted result to the user; wherein, when sending a query request to the cloud service provider on behalf of the user, a fake query is sent to make the access frequency of all data packets uniform.

[0088] Since the device described in the second embodiment of the present invention is used to implement the secure encryption key-value storage method based on data packaging in the first embodiment of the present invention, those skilled in the art will be able to understand the specific structure and variations of the device based on the method described in the first embodiment of the present invention, and therefore will not be described in detail here. All devices used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0089] Example 3

[0090] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0091] Since the computer-readable storage medium described in the third embodiment of the present invention is the computer-readable storage medium used to implement the secure encryption key-value storage method based on data packaging in the first embodiment of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer-readable storage medium based on the method described in the first embodiment of the present invention, and therefore will not be described in detail here. All computer-readable storage media used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0092] Example 4

[0093] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first embodiment when executing the program.

[0094] Since the computer device described in Example 4 of the present invention is the computer device used to implement the secure encryption key-value storage method based on data packaging in Example 1 of the present invention, those skilled in the art will be able to understand the specific structure and variations of the computer device based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All computer devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0095] Example 5

[0096] This embodiment discloses a secure encryption key-value storage system based on data packaging, including the secure encryption key-value storage device based on data packaging of embodiment 2, a user, and a cloud service provider, wherein the user outsources data storage to the cloud service provider through an agent, and initiates a data query request to the agent to access the data stored in the cloud; the agent and the user are located in the same internal network, and the cloud service provider is used to provide cloud storage and data access services to the user.

[0097] Specifically, the system consists of three entities: users, proxies, and cloud service providers. The user entity outsources data storage to the cloud service provider through the proxy and initiates data query requests to the proxy to access data stored in the cloud. The proxy entity, located in the same internal network as the user, acts as a bridge between the user and the external cloud service provider. It is responsible for initializing the key-value storage outsourced to the cloud service provider through operations such as data packaging, replication, and encryption, and executing data query requests on behalf of the user. The cloud service provider entity is responsible for providing cloud storage and data access services to the user.

[0098] The system consists of the following stages:

[0099] Step 1, Data Initialization: After receiving the data uploaded by the user, the proxy is responsible for packaging the key-value pairs, selectively copying and encrypting them, and outsourcing the encrypted data to the cloud service provider for storage;

[0100] Data packing: Based on the First Fit Decreasing (FFD) algorithm, key-value pairs with different lengths and access frequencies are packed into data packets to reduce storage overhead caused by padding.

[0101] Selective replication: selectively replicates the packaged data packets, controlling the number of copies of each data packet according to a preset frequency threshold to reduce the frequency difference between data packets;

[0102] Data encryption: The key of the data packet is encrypted by a pseudo-random function, and the value of the data packet is encrypted by a symmetric encryption algorithm;

[0103] Step 2, user query phase: The user initiates a data query request through the proxy. After receiving the user's query request, the proxy converts the query request for key-value pairs into a query request for packets and executes the data query request to the cloud service provider on behalf of the user. After the cloud service provider returns the query result, the proxy decrypts the returned encrypted data packet, extracts the key-value pairs of the user's query, and returns the decrypted result to the user.

[0104] Sending fake queries: By sending fake queries, the access frequency of all data packets is made uniform, further reducing the risk of sensitive data leakage due to differences in access frequency.

[0105] The method of the present invention is described below with reference to specific examples.

[0106] like Figure 1As shown in Figure 1, the system is divided into two phases, namely the data initialization phase and the user query phase. In the data initialization phase, in order to prevent the cloud service provider from inferring the content of the data through the access pattern of the data, for the key-value storage data uploaded by the user, the agent will package the data, selectively copy the data packets, and encrypt them according to the access frequency distribution and length of the key-value pairs, and store the package-key-value pair mapping table and the key-value pair-package mapping table locally. Then, each package is encrypted using the key sk, where the key of the package is encrypted using the pseudo-random function PRF and the value of the package is encrypted using the symmetric encryption algorithm Enc. Finally, it is outsourced to the cloud service provider for key-value storage. In the user query phase, the agent will encode the key-value pair k based on the locally stored key-value pair-package mapping table. i The query q(k i ) is mapped to the packet P j The query q(P j ) and sends the query of the encrypted packet to the cloud service provider. After receiving the query request, the cloud service provider returns the value of the queried data packet to the proxy. The proxy decrypts the value of the returned data packet and extracts the value of the decrypted data packet from the packet-key-value mapping table. j ) to extract the key query result v i , and returns it to the user.

[0107] Then, the FFD-based data packaging algorithm is explained according to the diagram:

[0108] like Figure 2 As shown, given eight key-value pairs, the proxy sorts them by frequency from highest to lowest, setting 0.25 and 100 as the upper bounds for frequency and length, respectively, during the packaging process. According to the FFD algorithm, the key-value pairs (k3, v3), (k5, v5), (k2, v2), and (k7, v7) are first added to an empty packet. It can then be determined that (k1, v1) can only be added to the packet containing (k7, v7), (k4, v4) to the packet containing (k2, v2), (k6, v6) to the empty packet, and (k8, v8) to the packet containing (k5, v5). The result obtained after processing all key-value pairs is the final data packet. Finally, the length of each packet is padded to 100.

[0109] Next, the selective copy algorithm is explained according to the diagram:

[0110] like Figure 3As shown in the figure, the packaged results of the eight key-value pairs in the figure are selectively copied. The upper limit μ of the ratio of the number of copied packages to the original number is set to 2, and the frequency threshold α can be calculated to be 1 / 5. Therefore, to make the frequency of all packages lower than α, the number of copies of the package containing (k3,v3) can be calculated to be 2, the number of copies of the packages containing (k5,v5) and (k8,v8) can be calculated to be 2, the number of copies of the packages containing (k2,v2) and (k4,v4) can be calculated to be 2, the number of copies of the packages containing (k7,v7) and (k1,v1) can be calculated to be 2, and the number of copies of the package containing (k6,v6) can be calculated to be 1.

[0111] Next, the fake query sending algorithm is explained according to the diagram:

[0112] The access distribution of the 9 packets obtained after selective replication is (0.125, 0.125, 0.115, 0.115, 0.12, 0.12, 0.125, 0.125, 0.03). First, we can calculate that the proportion of true query distribution in the total query distribution is 8 / 9, and the false query distribution is (0, 0, 0.08, 0.08, 0.04, 0.04, 0, 0, 0.76). Combined with Figure 1 , for the query request q(k i ), the proxy converts the query for the key-value pair into a query for the package q(P j ), and then by tossing a δ-biased coin. If the coin is heads, then send the query q(P j ), otherwise, according to the false query distribution D f Randomly generate a fake query q(P f ), and send the fake query.

[0113] The technical solution is described in detail below with reference to the accompanying drawings and examples.

[0114] We use the Yahoo Cloud Services Benchmark (YCSB) to generate a dataset of key-value pairs. Key-value pairs have a maximum length of 10,000 and follow a uniform distribution. We also use a Zipf distribution in YCSB to generate user queries for key-value pairs. To simulate access patterns in real deployments, we set the skewness parameter in the Zipf distribution to 0.99.

[0115] In order to analyze the performance of the system, three comparison schemes are used for comparison:

[0116] Pancake, an encrypted key-value storage solution based on frequency smoothing: the length of the encrypted value is padded to the same length, the key-value pairs are copied based on a selected frequency threshold, and the access frequency of all key-value pairs is smoothed to a uniform level by sending additional fake queries when users query data. In the example, the value of the frequency threshold is set to

[0117] K-indistinguish: By adding fake queries, the access frequency of all keys is smoothed into multiple levels, where each level has K key-value pairs, making it impossible for an attacker to distinguish the K keys in a level from the same frequency. In this example, the value of K is set to 20.

[0118] Insecure solution: only pads and encrypts the key-value pairs, and does not provide any protection for the access frequency information. The performance evaluation results of this system can be regarded as the performance upper limit of the present invention.

[0119] Figure 4 The figure shows the change of storage overhead with the number of key-value pairs. It can be seen from the figure that as the number of key-value pairs increases, the storage overhead also gradually increases. It can be seen that when the number of key-value pairs is 10 6 The storage overhead of the Pancake solution is approximately 3.74GB, while the storage overhead of the present invention is 1.68GB, less than half of the Pancake solution. This is because the present invention first performs a data packing operation on the key-value pairs, while the Pancake solution directly copies the key-value pairs and then pads the length. In addition, as can be seen from the figure, the storage overhead of the present invention is slightly lower than that of the K-indistinguish solution and the insecure solution. This is also because the data packing operation greatly reduces the storage overhead.

[0120] Figure 5 The following graph shows the storage overhead of the present invention as the replication parameter μ changes. It can be seen that as the replication parameter μ increases, the storage overhead increases. However, increasing the replication parameter can increase the number of packet replications, thereby reducing the frequency variance between packets and reducing the number of false queries caused by subsequent frequency smoothing. Therefore, the selection of the replication parameter μ requires a balance between storage overhead and bandwidth overhead.

[0121] Figure 6 The graph shows how bandwidth overhead changes with the number of user queries. Bandwidth overhead here refers to the sum of the lengths of responses from the cloud service provider to user queries. As can be seen from the graph, the bandwidth overhead of the present invention for responding to user queries is lower than both the Pancake and K-indistinguish schemes, significantly reducing bandwidth overhead. Furthermore, experiments also evaluated the bandwidth overhead of the present invention under different parameters, r, which is the number of times the upper bound of the length increases by 5% during the data packaging process. Figure 7As shown in the figure, bandwidth overhead increases as r increases. This is because, for larger r, while the number of packets after data packaging decreases and the frequency variance of packets decreases, the corresponding packet length increases, resulting in greater bandwidth overhead. Therefore, there is a trade-off in selecting the upper length bound during the packaging process. Data owners can set an appropriate value for the upper length bound based on their needs.

[0122] The experiment uses two YCSB workloads to evaluate the system throughput, i.e., the number of operations that the agent can perform per second: Workload A (95% read operations, 5% write operations) and Workload C (100% read operations). Furthermore, the throughput of the four solutions is compared with different storage backends and different numbers of threads. The two storage backends are: (1) Redis, an in-memory key-value store; and (2) RocksDB, an SSD-based key-value store.

[0123] like Figure 8 As shown in Figures 9, 10, and 11, the throughput of the scheme designed by the present invention is higher than that of the Pancake scheme and the K-indistinguish scheme in both workloads. At the same time, it can be observed that the throughput of all schemes under single thread is lower than the throughput of multi-thread (8 threads). In addition, the throughput of all schemes under workload A is slightly higher than that under workload C. This is because under workload A, the agent needs to download the package first for each write operation and then send the updated package back to the cloud service provider, resulting in the package being transmitted twice.

[0124] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0125] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, the present invention is intended to include such changes and modifications to the embodiments of the present invention if they fall within the scope of the claims and their equivalents.

Claims

1. A secure encryption key-value storage method based on data packaging, characterized in that: include: After receiving the data uploaded by the user, the key-value pairs are packaged, selectively copied and encrypted based on the descending first fit algorithm, and the encrypted data is outsourced to the cloud service provider for storage. The key-value pairs are packaged based on the descending first fit algorithm, including: sorting all key-value pairs in descending order according to their access frequency; sorting by the maximum frequency of all key-value pairs F and maximum length L The frequency and length upper bounds of the packaging process; fill the length dimension under the maximum frequency limit, specifically: add the key-value pairs to the current length that can accommodate the key-value pairs and the frequency does not exceed F In the first data packet of , if all packets do not meet the above restrictions, the key-value pair is added to a new data packet; fill the length of all data packets to L ; After receiving a query request from a user, the query request for a key-value pair is converted into a query request for a packet, and the query request is sent to the cloud service provider on behalf of the user, so that the cloud service provider returns a query result based on the query request, and then the encrypted data packet in the query result is decrypted, the key-value pair of the user query is extracted therefrom, and finally the decrypted result is returned to the user; wherein, when sending a query request to the cloud service provider on behalf of the user, a fake query is sent to make the access frequency of all data packets uniform.

2. The secure encryption key-value storage method based on data packaging according to claim 1, characterized in that: Selective copying of data packets, including: Determine the upper limit of the ratio of the number of replicated packets to the original number based on storage overhead and bandwidth overhead μ ; according to Calculate the frequency threshold α , The number of packets after data is packaged; according to Calculate the number of copies of each packet , For the i data packets, express Frequency of visits; The frequency is higher than the frequency threshold α The data packet is copied into multiple copies.

3. The secure encryption key-value storage method based on data packaging according to claim 1, characterized in that: When sending query requests to the cloud service provider on behalf of the user, the access frequency of all data packets is made uniform by sending fake queries, including: Maintain a query queue Q Whenever a query request is received from a user, it is added to the query queue Q middle; for Q For each query request in , the proxy converts the query for key-value pairs into a query for packages, and then δ The biased coins are used to generate the actual queries sent to the cloud service provider, δ Represents the true query distribution Distribution of total queries the proportion of If the coin is heads, the proxy sends a query for the packet. Otherwise, the proxy distributes the packets according to the false query. D f Randomly generate a fake query and send it; Introduce batch processing mechanism and set Sbatch ={1 / δ ,1 / δ+ 1,1 / δ+ 2}, Sbatch Represents the batch size set, for Q The last query in Sbatch Randomly sample a value from B , and send it to the cloud service provider B queries to prevent attackers from inferring frequency information by analyzing the access pattern of the last query.

4. A secure encryption key-value storage device based on data packaging, characterized in that: The device is an agent, comprising: The data packaging and selective replication module is used to receive the data uploaded by the user, perform data packaging, selective replication and encryption on the key-value pairs based on the descending first fit algorithm, and outsource the encrypted data to the cloud service provider for storage. The data packaging based on the descending first fit algorithm includes: sorting all key-value pairs in descending order according to the access frequency of the key-value pairs; sorting the key-value pairs by the maximum frequency of all key-value pairs; F and maximum length L The frequency and length upper bounds of the packaging process; fill the length dimension under the maximum frequency limit, specifically: add the key-value pairs to the current length that can accommodate the key-value pairs and the frequency does not exceed F In the first data packet of , if all packets do not meet the above restrictions, the key-value pair is added to a new data packet; fill the length of all data packets to L ; The query conversion and sending module, upon receiving a query request from a user, converts the query request for a key-value pair into a query request for a packet, and sends the query request to the cloud service provider on behalf of the user, so that the cloud service provider returns a query result based on the query request, then decrypts the encrypted data packet in the query result, extracts the key-value pair of the user query, and finally returns the decrypted result to the user; wherein, when sending a query request to the cloud service provider on behalf of the user, a fake query is sent to make the access frequency of all data packets uniform.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the secure encryption key-value storage method based on data packaging as described in any one of claims 1 to 3 is implemented.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the secure encryption key-value storage method based on data packaging is implemented as described in any one of claims 1 to 3.

7. A secure encryption key-value storage system based on data packaging, characterized in that: It includes a secure encryption key-value storage device based on data packaging as described in claim 4, a user and a cloud service provider, wherein the user outsources data storage to the cloud service provider through an agent, and initiates a data query request to the agent to access the data stored in the cloud; the agent and the user are located in the same internal network, and the cloud service provider is used to provide cloud storage and data access services to the user.

8. The secure encryption key-value storage system based on data packaging according to claim 7, characterized in that: The proxy is also used to store the package-key-value pair mapping table and the key-value pair-package mapping table locally.

Images