Encrypted database system based on trusted execution environment

Abstract

The invention provides an encrypted database system based on a trusted execution environment. The encrypted database system comprises an application rear end, a trusted execution environment agent module and a database management system, the application rear end is configured to package the encrypted data sent by the client into corresponding instructions according to categories and then send the instructions to the trusted execution environment agent module; the trusted execution environment agent module is configured to decrypt the instruction, generate a corresponding Bloom index according to a decryption result, re-encrypt the decryption result to obtain a ciphertext if the decryption result is to-be-inserted data, send the ciphertext and the corresponding Bloom index to the database management system, and send the ciphertext and the corresponding Bloom index to the database management system if the decryption result is a query condition; if yes, rewriting the query statement based on the query condition and the corresponding Bloom index, and sending the query statement to a database management system; and the database management system executes corresponding operation according to the data sent by the trusted execution environment agent module. The problems that a traditional database system is low in query efficiency, poor in universality, complex to achieve and the like are solved.

Description

Technical Field

[0001] This invention relates to the field of database technology, and in particular to an encrypted database system based on a trusted execution environment. Background Technology

[0002] With the widespread adoption of cloud computing and web applications, large amounts of user data are stored in database management systems (DBMS) provided by remote third-party service providers, raising serious data privacy concerns. To protect data stored in untrusted environments, academia and industry have proposed various database encryption schemes.

[0003] Early solutions were mainly divided into two categories: software and hardware. For example, CryptDB uses a trusted proxy between the client and the database, but its encryption schemes, such as Order Preservation Encryption (OPE) and deterministic encryption, have been proven to have security vulnerabilities and are susceptible to inference attacks such as approximate database recovery. Order Preservation Encryption preserves the order of plaintext, while deterministic encryption always produces the same ciphertext for the same plaintext, both of which leak data pattern information.

[0004] To provide stronger security, subsequent solutions began to utilize hardware-assisted Trusted Execution Environments (TEEs), such as Intel SGX and AMD SEV. These technologies can provide memory isolation and integrity protection for applications even when the host operating system is not trusted.

[0005] However, existing TEE-based solutions still have many shortcomings: the system is tightly coupled with the database engine, resulting in poor versatility; the encryption granularity is coarse, leading to low query efficiency; and the query capabilities are limited or the implementation is complex.

[0006] To address these shortcomings, a new type of database security system is urgently needed to solve the above problems. Summary of the Invention

[0007] The purpose of this invention is to provide an encrypted database system based on a trusted execution environment to solve the problems of coarse encryption granularity, low query efficiency, poor versatility, limited query capabilities, and complex implementation in existing technical solutions.

[0008] To address the aforementioned technical problems, this invention provides an encrypted database system based on a trusted execution environment, comprising: an application backend, a trusted execution environment proxy module, and a database management system; The application backend is configured to encapsulate the encrypted data sent by the client into corresponding instructions according to the data category and then send them to the trusted execution environment proxy module. The trusted execution environment proxy module is configured to: decrypt the instructions sent by the application backend, and generate a corresponding Bloom index based on the decryption result; if the decryption result is data to be inserted, then re-encrypt the decryption result to obtain ciphertext, and send the ciphertext along with the corresponding Bloom index to the database management system; if the decryption result is a query condition, then rewrite the query statement based on the query condition and the corresponding Bloom index, and send the query statement to the database management system. The database management system performs corresponding operations based on the data sent by the trusted execution environment proxy module.

[0009] Optionally, the database management system performs corresponding operations based on the data sent by the trusted execution environment proxy module, including: If the data is the ciphertext and the corresponding Bloom index, then store the ciphertext and the corresponding Bloom index; If the data is the query statement, then the query statement is executed and the query result is obtained, and the query result is returned to the trusted execution environment agent module.

[0010] Optionally, the trusted execution environment proxy module is further configured to: receive the query result, decrypt and precisely filter the query result to obtain the final query result, encrypt the final query result, and return it to the client via the application backend.

[0011] Optionally, the database management system executes the query statement by including: The database management system uses its native indexing function to filter out data that matches the query statement.

[0012] Optionally, the precise filtering performed by the trusted execution environment proxy module on the decrypted query results includes: The decrypted query results are compared with the query conditions, and data that does not meet the query conditions is removed.

[0013] Optionally, rewriting the query statement based on the query conditions and the corresponding Bloom index includes: Calculate the query values ​​that satisfy the query conditions and generate the corresponding Bloom index, then rewrite the Bloom index into a query statement that can be recognized by the database management system.

[0014] Optionally, the client and the trusted execution environment proxy module establish a secure encrypted channel through the application backend.

[0015] Optionally, the establishment of the secure encrypted channel includes: The client generates a first temporary key pair and a first random number, which are then encapsulated by the application backend into a custom database function call and forwarded to the trusted execution environment proxy module. The trusted execution environment proxy module generates a second temporary key pair, a second random number, and a session ID. It then performs a hash operation on the second temporary key pair, the second random number, and the session ID to obtain the corresponding hash value, and generates a remote authentication report containing the hash value corresponding to the above parameters. This report is then returned to the client by the application backend. The client and the trusted execution environment proxy module derive a session key based on the first temporary key pair and the second temporary key pair, and the client verifies the remote authentication report.

[0016] Optionally, the encrypted database system based on a trusted execution environment adopts a hierarchical key management system, which includes: Session key: used for encryption and decryption of data transmission between the client and the trusted execution environment proxy module; Long-term key: The key derived from the user's password using a strong hash function is encrypted and stored in the database management system. It is used to generate encryption keys for all data columns. Column key: Derived from the user's long-term key and database column identification information, used for encryption and decryption of data transmission between the trusted execution environment proxy module and the database management system.

[0017] Optionally, the Bloom index is generated by hashing the data to be inserted or the query conditions using the column key and extracting a fixed-length prefix.

[0018] In summary, this invention provides an encrypted database system based on a trusted execution environment (TEA), comprising an application backend, a TEA proxy module, and a database management system. The application backend is configured to encapsulate encrypted data sent by the client into corresponding instructions based on data type and then send these instructions to the TEA proxy module. The TEA proxy module is configured to decrypt the instructions sent by the application backend and generate a corresponding Bloom index based on the decryption result. If the decryption result is data to be inserted, the decryption result is re-encrypted to obtain ciphertext, which is then sent to the database management system along with the corresponding Bloom index. If the decryption result is a query condition, the query statement is rewritten based on the query condition and the corresponding Bloom index, and the query statement is sent to the database management system. The database management system performs corresponding operations based on the data sent by the TEA proxy module.

[0019] Compared with the prior art, the solution provided by the present invention has the following beneficial effects: This invention achieves data decryption and Bloom index generation in a trusted environment through a Trusted Execution Environment (TEE) proxy module, while rewriting query statements to fully utilize the native indexing capabilities of the database management system, thus achieving strong encryption while optimizing query performance. The application backend standardizes and encapsulates client requests, and the TEE proxy module performs instruction parsing and conversion without modifying the database management system kernel. This enables the system to adapt to multiple database management systems, effectively overcoming the dependence of traditional encrypted database systems on specific database engines and enhancing the system's versatility. By integrating encryption / decryption, index generation, and query rewriting functions into the trusted execution environment proxy module, the complexity of system implementation and maintenance is simplified. Attached Figure Description

[0020] Figure 1 A schematic diagram of the structure of an encrypted database system based on a trusted execution environment provided in an embodiment of the present invention; Figure 2 A schematic diagram illustrating the process of establishing a session in an encrypted database system based on a trusted execution environment, as provided in an embodiment of the present invention. Figure 3 A schematic diagram illustrating the data insertion process in an encrypted database system based on a trusted execution environment, as provided in an embodiment of the present invention. Figure 4 A schematic diagram illustrating the process of querying data in an encrypted database system based on a trusted execution environment, as provided in an embodiment of the present invention; Figure 5 A schematic diagram illustrating the comparison of query performance of an encrypted database system based on a trusted execution environment, provided in an embodiment of the present invention. The labels in the accompanying drawings are explained as follows: 1-Client Domain; 2-Public Network; 3-Cloud; 4-Trusted Execution Environment; 10-Client; 20-Application Backend; 30-TEE Proxy Module; 31-TEE Security Processor; 40-Database Management System. Detailed Implementation

[0021] The encrypted database system based on a trusted execution environment proposed in this invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the drawings are all in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of this invention. Furthermore, the structures shown in the drawings are often part of the actual structure. It should also be understood that, unless specifically stated or indicated, the terms "first," "second," "third," etc., in the specification are only used to distinguish the various components, elements, steps, etc., in the specification, and are not used to indicate the logical or sequential relationships between the various components, elements, steps, etc.

[0022] refer to Figure 1 As shown, this embodiment of the invention provides an encrypted database system based on a trusted execution environment to ensure the privacy of client 10 data during the sending and receiving process. The encrypted database system based on a trusted execution environment includes: an application backend 20, a trusted execution environment (TEE) proxy module 30, and a database management system 40. The application backend 20 is configured to encapsulate the encrypted data sent by the client 10 into corresponding instructions according to the data category and then send them to the TEE proxy module 30. The TEE proxy module 30 is configured to: decrypt the instructions sent by the application backend 20, and generate a corresponding Bloom index based on the decryption result; if the decryption result is data to be inserted, then re-encrypt the decryption result to obtain ciphertext, and send the ciphertext along with the corresponding Bloom index to the database management system 40; if the decryption result is a query condition, then rewrite the query statement based on the query condition and the corresponding Bloom index, and send the query statement to the database management system 40. The database management system 40 performs corresponding operations based on the data sent by the TEE proxy module 30.

[0023] The encrypted database system based on a trusted execution environment proposed in this embodiment of the invention encapsulates the client 10 requests in a standardized manner through the application backend 20, and the trusted execution environment (TEE) proxy module 30 performs instruction parsing and conversion without modifying the kernel of the database management system 40. This enables the system to adapt to multiple database management systems 40, effectively overcomes the dependence of traditional encrypted database systems on specific database engines, and enhances the system's versatility. Data decryption and Bloom index generation are achieved in a trusted environment through the TEE proxy module 30. At the same time, the query statement is rewritten to make full use of the native indexing capabilities of the database management system 40, achieving strong encryption while optimizing query performance. By integrating data encryption / decryption, index generation, and query rewriting functions into the TEE proxy module 30, the complexity of system implementation and maintenance is simplified.

[0024] The following combination Figures 1-5 The encrypted database system provided in the embodiments of the present invention will be further described.

[0025] Continue to refer to Figure 1As shown, client 10 is deployed in client domain 1 and communicates with application backend 20 and database management system 40 deployed in cloud 3 via public network 2. Since public network 2 and cloud 3 are both untrusted environments for client 10, this embodiment of the invention introduces a TEE proxy module 30 deployed in a Trusted Execution Environment 4 (TEE) (e.g., a confidential virtual machine). The hardware characteristics of the Trusted Execution Environment 4 (TEE) ensure the confidentiality and integrity of the memory and CPU state of the TEE proxy module 30 during runtime. The keys and plaintext data in the processing process are protected at the hardware level, which can resist powerful attackers including malicious operating systems and virtual machine monitors. The physical characteristics of the Trusted Execution Environment 4 (TEE) are used to ensure the confidentiality and integrity of the data.

[0026] Preferably, in this embodiment, before communicating with the encrypted database system, the client 10 first establishes a secure encrypted channel with the TEE proxy module 30. The establishment of the secure encrypted channel includes: The client 10 generates a first temporary key pair and a first random number, which are then encapsulated by the application backend 20 into a custom database function call and forwarded to the TEE proxy module 30. The TEE proxy module 30 generates a second temporary key pair, a second random number, and a session ID. It then performs a hash operation on the second temporary key pair, the second random number, and the session ID to obtain the corresponding hash value, and generates a remote authentication report containing the hash value corresponding to the above parameters. The application backend 20 returns the report to the client. The client 10 and the TEE proxy module 30 derive a session key based on the first temporary key pair and the second temporary key pair, and the client 10 verifies the remote authentication report.

[0027] The following combination Figure 2 The establishment of the secure encrypted channel will be explained in more detail.

[0028] refer to Figure 2 As shown, in this embodiment, the TEE proxy module 30 includes a TEE security processor 31; First, the client 10 generates a first temporary key pair and a first random number. The first temporary key pair includes a first public key and a first private key. The client 10 encodes the first public key and the first random number to generate a key exchange request and sends it to the application backend 20. The application backend 20 encapsulates the key exchange request into a custom SQL function and sends it to the TEE proxy module 30.

[0029] Next, the TEE proxy module 30 generates a second temporary key pair, a second random number, and a session ID for identifying this specific conversation. The second temporary key pair includes a second public key and a second private key. The TEE proxy module 30 requests authentication through the TEE security processor 31 and passes the hash values ​​of the first public key, the first random number, the second public key, the second random number, and the session ID as custom data to the TEE security processor 31.

[0030] The TEE security processor 31 generates a remote authentication report containing a hash value of a first public key, a second public key, a first random number, a second random number, and a session ID. The remote authentication report is forwarded to the client 10 via the application backend 20.

[0031] Client 10 uses a first private key and a second public key, and TEE proxy module 30 uses the second private key and the first public key to generate the same session key through a key exchange protocol and by using a key derivation function.

[0032] Client 10 verifies the validity of the remote authentication report using the TEE root certificate and, in conjunction with the TEE's remote verification mechanism, confirms the existence of the TEE proxy module 30 and its operation within an untampered TEE environment. Once confirmed, a secure encrypted channel is established between client 10 and the TEE proxy module 30. The TEE root certificate is provided by the TEE hardware distributor.

[0033] Based on the aforementioned secure encryption channel, the encrypted database system based on a trusted execution environment provided by this embodiment of the invention offers stronger security. The entire data chain, from leaving the client 10 to entering the TEE proxy module 30 for processing, is encrypted, which can effectively defend against threats from service providers or malicious insiders and ensure the security and integrity of the data.

[0034] Furthermore, to achieve efficient querying under secure encryption, as a preferred solution, if the database management system 40 receives the ciphertext and the corresponding Bloom index, then the ciphertext and the corresponding Bloom index are stored. That is, the encrypted database system based on a trusted execution environment provided in this embodiment generates and stores the Bloom index when inserting data. See [reference needed] for details. Figure 3 As shown: First, client 10 uses the session key to encrypt the data to be inserted to form ciphertext, and then sends the ciphertext to application backend 20.

[0035] The application backend 20 encapsulates the ciphertext into a standard INSERT statement and sends it to the TEE proxy module 30.

[0036] After receiving the INSERT statement, the TEE agent module 30 decrypts it using the session key to obtain the data to be inserted, calculates the Bloom index of the data to be inserted, and re-encrypts the data to obtain the final stored ciphertext. Furthermore, to address the issues of coarse encryption granularity and low efficiency in traditional encrypted database systems, preferably, in this embodiment of the invention, the encrypted database system based on a trusted execution environment adopts a hierarchical key management system, which includes: Session key: used for encryption and decryption of data transmission between the client 10 and the TEE proxy module 30; Long-term key: The key is encrypted by the user password through a strong hash function and stored in the database management system 40. It is used to generate encryption keys for all data columns. When logging in, the long-term key is decrypted and cached in the TEE proxy module 30. Column key: Generated by the user's long-term key and database column identification information through a key derivation function, used for encryption and decryption of data transmission between the TEE proxy module 30 and the database management system 40.

[0037] When inserting data into the encrypted database system, the TEE agent module 30, upon receiving the INSERT statement, decrypts it using the session key to obtain the data to be inserted. The TEE agent module 30 first distinguishes between sensitive and non-sensitive data columns in the data to be inserted, and finds the corresponding column key based on the column name and other identifying information of the sensitive data column. It then uses the column key to perform semantic security encryption on the sensitive data column, generating the ciphertext to be stored. Additionally, it uses the same column key to perform a hash operation on the data in the sensitive data column, extracting a fixed-length prefix to generate a Bloom index corresponding to that data. This semantic security encryption, as a strong encryption method, ensures that the same data generates different ciphertexts each time it is encrypted, thereby preventing data pattern leakage and enhancing security.

[0038] Next, the TEE agent module 30 rewrites the INSERT statement, replacing the data in the sensitive data column with ciphertext encrypted using the column key. At the same time, it adds the Bloom index column corresponding to the sensitive data column and its calculated index value to the INSERT statement, while the non-sensitive data columns remain unchanged.

[0039] The TEE proxy module 30 sends the rewritten INSERT statement to the database management system 40. The database management system 40 executes the INSERT statement, stores the encrypted data in the data column, and stores the Bloom index in the Bloom index column.

[0040] The encrypted database system provided in this embodiment of the invention uses different column keys to encrypt different data columns, performing fine-grained security isolation between data columns, achieving column-level encryption granularity, and limiting the impact of key leakage; the encrypted database system lays the foundation for efficient data query by pre-computing and storing Bloom indexes; the encrypted database system builds a transparent proxy architecture independent of the database management system 40, without requiring modification of the kernel of the database management system 40; the encrypted database system provided in this embodiment communicates with any database that supports SQL through the standard SQL protocol, has strong versatility, and is easy to deploy.

[0041] Traditional encrypted database schemes present an inherent contradiction between strong encryption and efficient querying. Pursuing efficient data filtering necessitates sacrificing security by using weak encryption schemes such as deterministic encryption; conversely, pursuing strong encryption requires sacrificing efficiency by downloading all data to a trusted endpoint for decryption and filtering. As a preferred solution, the encrypted database scheme provided by this invention employs a Bloom index pre-computation and two-stage filtering mechanism, significantly improving query efficiency while ensuring strong data encryption.

[0042] The following combination Figure 4 The data query scheme used in the encrypted database system in this embodiment of the invention will be further explained as follows: refer to Figure 4 As shown, client 10 uses the session key to encrypt the original query conditions to obtain ciphertext, and constructs the ciphertext into a query request and sends it to application backend 20. Application backend 20 encapsulates the ciphertext into a standard SQL query statement (for example, converting the client's custom format into SQL syntax) and forwards the query statement to TEE proxy module 30. During this process, the original query conditions are still in an encrypted state.

[0043] The TEE proxy module 30 receives the query statement, decrypts it using the session key according to the hierarchical key management system to obtain the original query conditions, then finds the corresponding column key based on the table name and column name identification information of the original query conditions, performs a hash operation on the original query conditions using the column key, and generates a Bloom index that satisfies the original query conditions by extracting a fixed-length prefix; the TEE proxy module 30 rewrites the SQL query statement based on the original query conditions and the corresponding Bloom index, including replacing the query statement based on the original query conditions with a query statement based on the Bloom index, adding the fields involved in the original query conditions to the query list, and sending the rewritten SQL query statement to the database management system 40 for execution.

[0044] The database management system 40 receives and executes the rewritten SQL query statement. The database management system 40 uses its native index function to efficiently filter out all the Bloom index rows that satisfy the query statement from the large amount of stored data. These rows contain the results required by the original query and the encrypted data of the fields involved in the original query conditions. The Bloom index rows are then returned to the TEE proxy module 30 as preliminary query results.

[0045] Since different data may generate the same Bloom index due to hash collisions, the initial query results may contain some Bloom indexes that do not meet the query conditions due to hash collisions (for ease of description, these are referred to as pseudo-positive examples below). After efficient filtering by the database management system 40, the TEE proxy module 30 only needs to process the initial query results that may contain some pseudo-positive examples. The amount of data to be processed is greatly reduced, the query performance requirements of the TEE proxy module 30 are also greatly reduced, and the system response speed is greatly improved when querying data.

[0046] To retain perfectly matching Bloom indexes and eliminate mismatched spurious positives, as a preferred embodiment, the TEE proxy module 30 is configured to perform precise filtering on the preliminary query results returned by the database management system 40. This precise filtering includes: According to the hierarchical key management system, the TEE proxy module 30 decrypts all Bloom index rows in the preliminary query result one by one using the corresponding column key. The decrypted query result is then precisely compared with the query conditions required by the client 10. Data that matches exactly is retained, and false positives that do not match are removed. Finally, the data that matches exactly is restored according to the query statement of the application backend 20 to obtain the final query result.

[0047] Next, the TEE proxy module 30 uses the session key to perform precise filtering on the final query result, encrypts it to obtain the final ciphertext result, and sends the final ciphertext result to the application backend 20. The application backend 20 then converts the format of the final ciphertext result to meet the format requirements of the client 10, and forwards it to the client 10. The client 10 uses the session key to decrypt the final ciphertext result to obtain the data that meets the query conditions.

[0048] The encrypted database system based on a trusted execution environment provided in this invention adopts a mechanism of Bloom index pre-computation and two-stage filtering. First, efficient pre-screening is achieved through the native index function of the database management system 40, and then precise filtering is performed through the TEE proxy module 30. This significantly improves the query performance of a large amount of encrypted data, avoids the query performance bottleneck of the TEE proxy module 30, and the semantic security encryption and Bloom index combination scheme of this application does not leak deterministic information such as the size relationship of data or whether the plaintext is equal, thus providing higher security and resolving the contradiction between strong encryption and efficient querying in traditional database systems.

[0049] In database systems, data insertion is typically batch-based with acceptable latency, while data querying requires extremely low latency. Preferably, in this embodiment of the invention, the TEE proxy module 30 simultaneously calculates the Bloom index when inserting data. This operation shifts the computational overhead of the encrypted database system from data querying to data insertion. By completing the work required for data querying in advance, the data latency during data querying is greatly reduced. In this embodiment of the invention, the query load is rationally allocated to the most suitable component: The database management system 40 has highly optimized native indexes and query engines, which are responsible for fast coarse-grained filtering on Bloom index columns, rapidly reducing the scale of massive data to a very small scale containing a few pseudo-positive examples. The TEE proxy module 30 performs precise filtering on small-scale preliminary query results, avoiding the network transmission of massive amounts of data and the large amount of decryption calculations performed within the TEE module, thus significantly optimizing query efficiency.

[0050] refer to Figure 5 As shown, this embodiment tested the query latency (in seconds) under different modes and data sizes (total number of rows in the database). Analysis of the test results shows that if the Bloom index pre-computation and two-stage filtering scheme is not used, but instead a comparison scheme using data decryption in the TEE proxy module 30 is employed, the query time increases linearly with the total number of rows in the database. However, in this embodiment, the Bloom index pre-computation and two-stage filtering scheme maintains a essentially constant query response time, largely unaffected by the total number of rows in the database. The results of the above comparative tests demonstrate that the Bloom index pre-computation and two-stage filtering scheme adopted in this invention successfully utilizes the indexing function of the database management system, preventing the query response time from deteriorating with the increase in data volume, making the querying of massive amounts of encrypted data performance-wise feasible.

[0051] In summary, this invention provides an encrypted database system based on a trusted execution environment (TEA), comprising an application backend, a TEA proxy module, and a database management system. The application backend is configured to encapsulate encrypted data sent by client 10 into corresponding instructions based on data type and then send them to the TEA proxy module. The TEA proxy module is configured to decrypt the instructions sent by the application backend and generate a corresponding Bloom index based on the decryption result. If the decryption result is data to be inserted, the decryption result is re-encrypted to obtain ciphertext, which is then sent to the database management system along with the corresponding Bloom index. If the decryption result is a query condition, the query statement is rewritten based on the query condition and the corresponding Bloom index, and the query statement is sent to the database management system. The database management system performs corresponding operations based on the data sent by the TEA proxy module. Compared with the prior art, this invention has the following advantages: By combining Bloom index pre-computation with coarse screening in the database management system and fine filtering in the TEE proxy module, the contradiction between strong encryption and efficient querying in the existing encrypted database system is resolved, greatly improving query efficiency. By integrating encryption / decryption, index generation, and query rewriting functions into the TEE proxy module, the complexity of system implementation and maintenance is simplified. By standardizing and encapsulating client requests through the application backend, and having the TEE proxy module handle instruction parsing and conversion without modifying the database management system kernel, the system can adapt to various database management systems. This effectively overcomes the dependence of traditional encrypted database systems on specific database engines and enhances the system's versatility.

[0052] The above description is merely a description of preferred embodiments of the present invention and is not intended to limit the scope of the present invention in any way. Any changes or modifications made by those skilled in the art based on the above disclosure shall fall within the protection scope of the claims.

Claims

1. An encrypted database system based on a trusted execution environment, characterized in that, include: Application backend, trusted execution environment proxy module, and database management system; The application backend is configured to encapsulate the encrypted data sent by the client into corresponding instructions according to the data category and then send them to the trusted execution environment proxy module. The trusted execution environment proxy module is configured to: decrypt the instructions sent by the application backend, and generate a corresponding Bloom index based on the decryption result; if the decryption result is data to be inserted, then re-encrypt the decryption result to obtain ciphertext, and send the ciphertext along with the corresponding Bloom index to the database management system; if the decryption result is a query condition, then rewrite the query statement based on the query condition and the corresponding Bloom index, and send the query statement to the database management system. The database management system performs corresponding operations based on the data sent by the trusted execution environment proxy module.

2. The encrypted database system based on a trusted execution environment according to claim 1, characterized in that, The database management system performs corresponding operations based on the data sent by the trusted execution environment proxy module, including: If the data is the ciphertext and the corresponding Bloom index, then store the ciphertext and the corresponding Bloom index; If the data is the query statement, then the query statement is executed and the query result is obtained, and the query result is returned to the trusted execution environment agent module.

3. The encrypted database system based on a trusted execution environment according to claim 2, characterized in that, The trusted execution environment proxy module is further configured to: receive the query result, decrypt and precisely filter the query result to obtain the final query result, encrypt the final query result, and return it to the client via the application backend.

4. The encrypted database system based on a trusted execution environment according to claim 2, characterized in that, The database management system executes the query statement including: The database management system uses its native indexing function to filter out data that matches the query statement.

5. The encrypted database system based on a trusted execution environment according to claim 3, characterized in that, The trusted execution environment proxy module performs precise filtering on the decrypted query results, including: The decrypted query results are compared with the query conditions, and data that does not meet the query conditions is removed.

6. The encrypted database system based on a trusted execution environment according to claim 1, characterized in that, Rewriting the query statement based on the query conditions and the corresponding Bloom index includes: Calculate the query values ​​that satisfy the query conditions and generate the corresponding Bloom index, then rewrite the Bloom index into a query statement that can be recognized by the database management system.

7. The encrypted database system based on a trusted execution environment according to claim 1, characterized in that, The client and the trusted execution environment proxy module establish a secure encrypted channel through the application backend.

8. The encrypted database system based on a trusted execution environment according to claim 7, characterized in that, The establishment of the secure encrypted channel includes: The client generates a first temporary key pair and a first random number, which are then encapsulated by the application backend into a custom database function call and forwarded to the trusted execution environment proxy module. The trusted execution environment proxy module generates a second temporary key pair, a second random number, and a session ID, as well as a remote authentication report containing the hash values ​​of the aforementioned parameters, which is returned to the client by the application backend. The client and the trusted execution environment proxy module derive a session key based on the first and second temporary key pairs, and the client verifies the remote authentication report.

9. The encrypted database system based on a trusted execution environment according to claim 1, characterized in that, The encrypted database system based on a trusted execution environment adopts a hierarchical key management system, which includes: Session key: used for encryption and decryption of data transmission between the client and the trusted execution environment proxy module; Long-term key: The key derived from the user's password using a strong hash function is encrypted and stored in the database management system. It is used to generate encryption keys for all data columns. Column key: Derived from the user's long-term key and database column identification information, used for encryption and decryption of data transmission between the trusted execution environment proxy module and the database management system.

10. The encrypted database system based on a trusted execution environment according to claim 9, characterized in that, The Bloom index is generated by hashing the data to be inserted or the query conditions using the column key and extracting a fixed-length prefix.

Images