Multidimensional data order-preserving encryption method and system based on coding forest

Abstract

The invention discloses a multi-dimensional data order-preserving encryption method and system based on a coding forest, and the method comprises the steps: enabling a client and a cloud server to initialize a state through a safety parameter, enabling the client to generate an initial local table, and enabling the cloud server to generate an initial coding forest and a coding table, the trusted authorization center generates system public parameters and a master key; encrypting plaintext data at a client, generating a ciphertext and an insertion position of each dimension, and updating a coding forest and a coding table of the cloud server; the client maps the query interval into a ciphertext query request, and the cloud server retrieves and returns a ciphertext meeting a condition based on the coding forest and the coding table; and the client decrypts the ciphertext through a private key, when the user attribute meets the access strategy, plaintext data is output, and otherwise, decryption fails.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to a multidimensional data order-preserving encryption method and system based on coding forest. Background Technology

[0002] Currently, research on order-preserving encryption mainly focuses on improving security, efficiency, and functional expansion, while research on order-preserving encryption for multidimensional data remains relatively limited. Therefore, there is still a need to design secure and efficient one-dimensional and multi-dimensional order-preserving encryption schemes suitable for multi-user scenarios.

[0003] In recent years, order-preserving encryption has received widespread attention as an important technique for supporting range queries on encrypted data. However, existing research mainly focuses on range queries for single-dimensional data, with relatively insufficient research on range queries for multi-dimensional data. Although some schemes have been developed to support multi-dimensional range queries, some significant problems still exist.

[0004] First, in terms of security, existing solutions typically use techniques such as prefix encoding and Bloom filters to hide data distribution during the index building process. However, these methods may still expose some structural information, thereby raising the risk of privacy leaks.

[0005] Secondly, in terms of efficiency, since multidimensional data is usually organized using index structures (such as B+ trees, R trees, etc.), the data insertion and query process may involve dynamic updates and maintenance of the index, and frequent interactions between the client and the server are required, which leads to a significant increase in computation and storage overhead and a substantial decrease in algorithm efficiency.

[0006] Third, in terms of accuracy, some solutions have the problem of false positives in query results, which requires further filtering of the results and increases the additional computational burden. Summary of the Invention

[0007] According to the present invention, a multidimensional data order-preserving encryption method and system based on coding forest are provided to achieve the following objectives:

[0008] (1) Enhance security: Ensure that cloud servers and any unauthorized users cannot access or deduce the specific content of electronic medical records. By improving the index structure and encryption mechanism, prevent the index from leaking plaintext information and ensure the confidentiality of data.

[0009] (2) Improve functionality and efficiency: While ensuring data security, design an efficient multi-dimensional range query algorithm to reduce unnecessary computation and storage overhead during the query process. Optimize index building and query processes to reduce the number of interactions between the client and the server, enabling users to quickly and accurately query protected electronic medical record data.

[0010] (3) Improve accuracy: Optimize the query algorithm to ensure the accuracy of the query results, eliminate false positives, and thus avoid the overhead of subsequent filtering operations.

[0011] According to a first aspect of the present invention, a multidimensional data order-preserving encryption method based on a coding forest is provided, characterized in that it includes:

[0012] The client and cloud server initialize their states using security parameters. The client generates an initial local table, and the cloud server generates an initial encoded forest and encoded table. The trusted authorization center generates system public parameters and master key.

[0013] The client encrypts the plaintext data, generates ciphertext and the insertion positions for each dimension, and updates the encoding forest and encoding table on the cloud server.

[0014] The client maps the query range to a ciphertext query request, and the cloud server retrieves the ciphertext that meets the conditions based on the encoding forest and encoding table and returns it.

[0015] The client decrypts the ciphertext using its private key. If the user attributes meet the access policy, the client outputs plaintext data; otherwise, decryption fails.

[0016] Optionally, the client and cloud server initialize their states using security parameters, the client generates an initial local table, and the cloud server generates an initial encoded forest and encoded table. The trusted authorization center generates public parameters and a master key, including:

[0017] Both the client and the cloud server initialize their states using the security parameter λ, and the client generates the initial local table st. cl It is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest SF. ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data;

[0018] The trusted authorization center generates the system's public parameters pk and master key mk, and uses pk, mk, and the attribute set s describing the user as input to generate and distribute the user's private key sk.

[0019] Optionally, the plaintext data is encrypted on the client side to generate ciphertext and the insertion positions for each dimension, and the encoding forest and encoding table on the cloud server are updated, including:

[0020] The user inputs plaintext data pt and access policy A into the client. The client then uses system public parameters pk, plaintext pt, access policy A, and local table st. cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The insertion position pos in each coding tree;

[0021] The client sends the encrypted ct and the insertion position pos together to the cloud server;

[0022] Cloud servers use ciphertext (ct), insertion position (pos), and encoded forest (sf) ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

[0023] Optionally, the client maps the query range to a ciphertext query request, and the cloud server retrieves and returns the ciphertext that meets the conditions based on the encoding forest and encoding table, including:

[0024] The client queries interval I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server;

[0025] The cloud server uses the encoding table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

[0026] Optionally, the client decrypts the ciphertext using a private key, outputting plaintext data if the user attributes satisfy the access policy; otherwise, decryption fails, including:

[0027] The client takes the ciphertext ct, the user's private key sk, and the system public parameter pk as input;

[0028] The algorithm outputs plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails.

[0029] The ciphertext ct contains access policy A, and the user private key sk is a private key generated with the user attribute set s as a parameter.

[0030] According to another aspect of the present invention, a multidimensional data order-preserving encryption system based on a coding forest is also provided, comprising:

[0031] The initialization state module is used for the client and cloud server to initialize the state through security parameters respectively. The client generates the initial local table and the cloud server generates the initial encoding forest and encoding table. The trusted authorization center generates system public parameters and master key.

[0032] The ciphertext generation module is used to encrypt plaintext data on the client side, generate ciphertext and insertion positions for each dimension, and update the encoding forest and encoding table on the cloud server.

[0033] The returned ciphertext module is used by the client to map the query range into a ciphertext query request. The cloud server retrieves the ciphertext that meets the conditions based on the encoding forest and encoding table and returns it.

[0034] The ciphertext decryption module is used by the client to decrypt the ciphertext using a private key. If the user attributes meet the access policy, plaintext data is output; otherwise, decryption fails.

[0035] Optionally, the state module is initialized, including:

[0036] The local table and encoding table submodules are initialized. The client and cloud server initialize their states using the security parameter λ, and the client generates the initial local table st. cl It is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest SF. ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data;

[0037] The private key generation submodule generates the system's public parameters pk and master key mk, and uses pk, mk, and the attribute set s describing the user as input to generate and distribute the user's private key sk.

[0038] Optionally, a ciphertext generation module includes:

[0039] The ciphertext generation submodule allows the user to input plaintext data pt and access policy A on the client side. The client then generates the ciphertext using system public parameters pk, plaintext pt, access policy A, and local table st. cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The insertion position pos in each coding tree;

[0040] In the ciphertext sending submodule, the client sends the ciphertext ct and the insertion position pos together to the cloud server;

[0041] The cloud server generates the encoded forest submodule, using the ciphertext ct, insertion position pos, and encoded forest sf. ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

[0042] Optionally, the returned ciphertext module includes:

[0043] The client queries interval I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server;

[0044] The cloud server uses the encoding table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

[0045] Optionally, the ciphertext decryption module includes:

[0046] The input ciphertext submodule is used by the client to take the ciphertext ct, the user's private key sk, and the system public parameter pk as input.

[0047] The decryption submodule is used to output plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails.

[0048] The ciphertext ct contains access policy A, and the user private key sk is a private key generated with the user attribute set s as a parameter.

[0049] Therefore, after encrypting the data, an independent order-preserving code is generated for each dimension of the data through a coding forest structure. This coding method only preserves the order relationship of the data in each dimension, completely hiding sensitive information such as plaintext values ​​and distribution frequencies, ensuring the privacy of the data in each dimension. Furthermore, the coding tree for each dimension is constructed independently, and there is no correlation between the codes of different dimensions. This design effectively prevents attackers from inferring data information through cross-dimensional analysis, providing reliable security for multi-dimensional data. Therefore, the coding structure has high security. This invention reduces query response time. The coding forest and local table mechanism reduce query complexity to O(log n), supporting real-time processing of large-scale data. The cloud server can return a ciphertext set that completely falls within the query range provided by the user, and the user can correctly decrypt the returned ciphertext set to obtain the original plaintext data. These two points together guarantee the correctness of the order-preserving encryption algorithm proposed in this chapter. Attached Figure Description

[0050] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0051] Figure 1 This is a flowchart illustrating a multidimensional data order-preserving encryption method based on a coding forest as described in this embodiment.

[0052] Figure 2 This is a schematic diagram of the system model described in this embodiment;

[0053] Figure 3 This is a schematic diagram of the data structure described in this embodiment;

[0054] Figure 4 This is a schematic diagram of the order-preserving encoding generation process described in this embodiment;

[0055] Figure 5 This is a schematic diagram of the order-preserving encoding update described in this embodiment;

[0056] Figure 6This is a schematic diagram illustrating the specific process of a multidimensional data order-preserving encryption method based on a coding forest as described in this embodiment;

[0057] Figure 7 This is a line graph showing the query response time as a function of the dataset, as described in this embodiment.

[0058] Figure 8 This is a schematic diagram of a multidimensional data order-preserving encryption system based on a coding forest as described in this embodiment. Detailed Implementation

[0059] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0060] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0061] According to a first aspect of the present invention, a multidimensional data order-preserving encryption method 100 based on a coding forest is provided, with reference to... Figure 1 As shown, the method 100 includes:

[0062] S101: The client and cloud server initialize the state through security parameters respectively. The client generates the initial local table and the cloud server generates the initial encoding forest and encoding table. The trusted authorization center generates system public parameters and master key.

[0063] S102: Encrypt plaintext data on the client side, generate ciphertext and insertion positions for each dimension, and update the encoding forest and encoding table on the cloud server.

[0064] S103: The client maps the query range to a ciphertext query request, and the cloud server retrieves the ciphertext that meets the conditions based on the coding forest and coding table and returns it;

[0065] S104: The client decrypts the ciphertext using its private key. If the user attributes meet the access policy, the plaintext data is output; otherwise, decryption fails.

[0066] Specifically, such as Figure 1As shown, the system mainly consists of four entities: a trusted authorization center, a data owner, a user, and a cloud server. The responsibilities of each entity are as follows:

[0067] (1) Trusted Authorization Center: The Trusted Authorization Center is responsible for generating the system's public parameters and master key, and also for creating and distributing private keys to users. As a completely trusted entity in the system, it ensures the security of the entire key management process.

[0068] (2) Data Owner: As the owner of the data, the data owner is responsible for formulating specific access control policies. After encrypting the data, the data owner uploads the ciphertext to the cloud server for storage, ensuring that users without access rights cannot decrypt the data, thereby protecting the privacy and security of the data.

[0069] (3) Users: Users can send multi-dimensional range query requests to the cloud server. After obtaining the query results, users use their private key to decrypt the encrypted data to obtain the required plaintext data. Users are the end users of the data, and their operations rely on the private key distributed by the trusted authorization center.

[0070] (4) Cloud Server: The cloud server is responsible for storing encrypted data and providing users with multi-dimensional query services. The cloud server is assumed to be an "honest but curious" entity: it will correctly execute algorithms and respond to user query requests, but may at the same time attempt to obtain the content of the data. Therefore, the system design needs to ensure that the cloud server cannot deduce plaintext information from the encrypted data.

[0071] This invention aims to achieve multi-dimensional range query functionality for electronic medical record data. By expanding the coding tree into a coding forest, it supports range queries on multi-dimensional encrypted data. Simultaneously, it utilizes a local table on the algorithm client to ensure the accuracy of query results and eliminate false positives. The workflow mainly consists of two stages: encrypted data upload and multi-dimensional range query. Detailed descriptions are as follows:

[0072] (1) Encrypted Data Upload. In this stage, the client calls the initialization algorithm to generate an empty local table, and the cloud server calls the initialization algorithm to generate an empty encoded forest and an empty encoded table. Then, the data owner sets an access policy for the data and calls the encryption algorithm to encrypt the data. Finally, the encrypted data is uploaded to the cloud server, and the cloud server updates the encoded forest and encoded table according to the ciphertext sent by the client and its insertion position.

[0073] (2) Multidimensional Range Query. In this stage, the user submits a multidimensional range query request by calling the range query algorithm. The client maps the plaintext query range sent by the user to an accurate ciphertext query request through a local table and sends it to the cloud server. Then, the cloud server retrieves the ciphertext data that meets the query conditions based on the encoding forest and encoding table and returns it to the user. Finally, the user calls the decryption algorithm to decrypt the returned ciphertext data and obtain the final plaintext result.

[0074] In one-dimensional order-preserving encryption algorithms, the coding tree is used to generate order-preserving codes for one-dimensional data. To extend this algorithm to support multi-dimensional range queries, this chapter expands the coding tree into a coding forest. The data structure of this algorithm is as follows: Figure 3 As shown, its main components include a local table on the client side and a storage structure on the cloud server side. On the client side, the local table stores the plaintext data that has been inserted into each dimension and the number of times it appears. On the cloud server side, the storage structure consists of a coding forest and a coding table: the coding forest is composed of multiple coding trees, each corresponding to a dimension, representing the order of data within that dimension. Each node in the coding tree contains the ciphertext data and the number of its left children, while the root node stores the dimension name. The coding table records the ciphertext data and the corresponding order-preserving codes for each dimension, i.e., the node position of the ciphertext in the coding tree.

[0075] The sequence-preserving encoding generation process is as follows: Figure 4 As shown. When new ciphertext data needs to be inserted, the client first calculates the number of ciphertext data smaller than the current ciphertext data in each dimension based on the local table, thereby determining the insertion position of the ciphertext in each encoding tree on the cloud server. Subsequently, the client sends the ciphertext data and the insertion position information for each dimension to the cloud server. After receiving the data, the cloud server traverses each encoding tree, iteratively searches the corresponding encoding tree based on the insertion position provided by the client, completes the data insertion operation, and generates the corresponding order-preserving encoding for each dimension based on the search path. Through this structure, the algorithm not only maintains the order-preserving characteristics of single-dimensional data but also effectively supports range queries of multi-dimensional data. Taking two-dimensional data as an example, assuming the user inserts data 'age:40,gender:1', combined with... Figure 5 The insertion process is as follows:

[0076] (1) Client Operation: The user first queries the local table to obtain the number of plaintext data less than '40' in the age column (4) and the number of plaintext data less than '1' in the gender column (3). Since there is no data for '40' in the age column, and the number of '1' in the gender column is 2, a new data (40, 1) needs to be inserted into the local table, and the value of gender_counter is incremented by 1 to update it to 3. Next, the user encrypts the ciphertext 'age:40, gender:1'. Enc(age:40, gender:1) is sent to the cloud server along with the location information age_pos:4 and gender_pos:3.

[0077] (2) Cloud server operation: The cloud server traverses each coding tree in the coding forest to find the insertion position of the ciphertext data. The specific steps are as follows:

[0078] Insertion in the age dimension: The number of left children of the root node age_root, which represents the age order, is 3, so the position of age_root is 3+1=4. Since 4-4=0, we query the right child node of age_root. The number of left children of this node is 0, so its position is 0+1=1. Since 0-1=-1, we query the left child node of this node. This node is an empty node, indicating that the ciphertext Enc(age:40,gender:1) can be inserted here. After finding the insertion position, we calculate the order-preserving encoding corresponding to age: OPE_encoding=

[10] 10...0.

[0079] Insertion along the gender dimension: The root node of the encoding tree representing the gender order has 3 left children, so the position of gender_root is 3+1=4. Since 4-3=1, we query the left child node of gender_root. This node has 1 left child, so its position is 1+1=2. Since 3-2=1, we query the right child node of this node. This node has 0 left children, so its position is 0+1=1. Since 1-1=0, we query the right child node of this node. This node is empty, indicating that the ciphertext Enc(age:40,gender:1) can be inserted here. After finding the insertion position, we calculate the order-preserving encoding corresponding to gender: OPE_encoding=

[011] 10...0.

[0080] Through the above steps, the data 'age:40, gender:1' was successfully inserted, and the corresponding order-preserving code was generated. In this process, the insertion operations for the age and gender dimensions can be completed synchronously using multiple threads, thereby further improving the algorithm's execution efficiency.

[0081] refer to Figure 6 As shown, the algorithm (Setup, KeyGen, Enc, Query, Dec) consists of the following five parts, described in detail below:

[0082] (1) Setup(1 λ )→st cl ,sf sere: Initialization algorithm. Both the client and the cloud server initialize their states using the security parameter λ. The client generates the initial local table st. cl This is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest (SF). ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data.

[0083] (2)KeyGen(pk,mk,s)→sk: Key generation algorithm. The trusted authorization center generates the public parameters pk and master key mk of the system, and uses pk, mk and the attribute set s describing the user as input to generate and distribute the user's private key sk.

[0084] (3)Enc(pk,pt,A,st cl ,sf ser ,e)→ct,st' cl ,sf' ser ,e': Data encryption algorithm, which requires interaction between the client and the cloud server. First, the user inputs plaintext data pt and access policy A on the client. The client then uses system public parameters pk, plaintext pt, access policy A, and local table st... cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The client then sends the ciphertext `ct` and the insertion position `pos` to the cloud server. Finally, the cloud server sends the ciphertext `ct`, the insertion position `pos`, and the encoded forest `sf`. ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

[0085] (4)Query(I cl ,st cl ,e)→I ct This is a data query algorithm that requires interaction between the client and the cloud server. The client queries the range I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server. The cloud server uses the encoded table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

[0086] (5) Dec(ct,sk,pk)→pt: Data decryption algorithm. The client takes the ciphertext ct (containing access policy A), the user's private key sk (a private key generated with the user attribute set s as a parameter), and the system public parameter pk as input. The algorithm outputs the plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails.

[0087] This algorithm is best applied to electronic medical record privacy protection systems. The following describes the implementation method using a hospital scenario as an example:

[0088] System architecture: such as Figure 2 As shown, the system includes a trusted authorization center, data owners (patients), users (doctors), and a cloud server. When a patient visits a doctor, the data is uploaded to the cloud server after being encrypted using attribute-based encryption.

[0089] Implementation steps:

[0090] 1. Initialization: The client generates a local table, and the server builds an empty encoding forest and encoding table.

[0091] 2. Data Encryption: Patient electronic medical records (such as age, blood pressure, and other multi-dimensional data) are encrypted by the doctor. Taking age and gender as an example, the encryption process is as follows: Figure 3 As shown: The client calculates the insertion position for each dimension, and the server generates the order-preserving code.

[0092] Multidimensional query: When a doctor queries for patients who are "20-30 years old and male", the client converts the plaintext range into an encoded range [age_pos:1-3, gender_pos:2-4], the server returns the ciphertext, and the doctor decrypts it to obtain the result.

[0093] Performance verification: When the dataset size reaches 5000 records, the query response time is reduced by approximately 92.96% compared to the ASPE solution. (Reference) Figure 7 As shown.

[0094] This invention is not only applicable to electronic medical record systems, but can also be extended to privacy-sensitive fields such as finance and government, enabling secure and efficient data retrieval.

[0095] Optionally, the client and cloud server initialize their states using security parameters, the client generates an initial local table, and the cloud server generates an initial encoded forest and encoded table. The trusted authorization center generates public parameters and a master key, including:

[0096] Both the client and the cloud server initialize their states using the security parameter λ, and the client generates the initial local table st. cl It is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest SF. ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data;

[0097] The trusted authorization center generates the system's public parameters pk and master key mk, and uses pk, mk, and the attribute set s describing the user as input to generate and distribute the user's private key sk.

[0098] Optionally, the plaintext data is encrypted on the client side to generate ciphertext and the insertion positions for each dimension, and the encoding forest and encoding table on the cloud server are updated, including:

[0099] The user inputs plaintext data pt and access policy A into the client. The client then uses system public parameters pk, plaintext pt, access policy A, and local table st. cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The insertion position pos in each coding tree;

[0100] The client sends the encrypted ct and the insertion position pos together to the cloud server;

[0101] Cloud servers use ciphertext (ct), insertion position (pos), and encoded forest (sf) ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

[0102] Optionally, the client maps the query range to a ciphertext query request, and the cloud server retrieves and returns the ciphertext that meets the conditions based on the encoding forest and encoding table, including:

[0103] The client queries interval I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server;

[0104] The cloud server uses the encoding table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

[0105] Optionally, the client decrypts the ciphertext using a private key, outputting plaintext data if the user attributes satisfy the access policy; otherwise, decryption fails, including:

[0106] The client takes the ciphertext ct, the user's private key sk, and the system public parameter pk as input;

[0107] The algorithm outputs plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails.

[0108] The ciphertext ct contains access policy A, and the user private key sk is a private key generated with the user attribute set s as a parameter.

[0109] Therefore, after encrypting the data, an independent order-preserving code is generated for each dimension of the data through a coding forest structure. This coding method only preserves the order relationship of the data in each dimension, completely hiding sensitive information such as plaintext values ​​and distribution frequencies, ensuring the privacy of the data in each dimension. Furthermore, the coding tree for each dimension is constructed independently, and there is no correlation between the codes of different dimensions. This design effectively prevents attackers from inferring data information through cross-dimensional analysis, providing reliable security for multi-dimensional data. Therefore, the coding structure has high security. This invention reduces query response time. The coding forest and local table mechanism reduce query complexity to O(log n), supporting real-time processing of large-scale data. The cloud server can return a ciphertext set that completely falls within the query range provided by the user, and the user can correctly decrypt the returned ciphertext set to obtain the original plaintext data. These two points together guarantee the correctness of the order-preserving encryption algorithm proposed in this chapter.

[0110] According to another aspect of the present invention, a multidimensional data order-preserving encryption system 800 based on a coding forest is also provided, with reference to... Figure 8 As shown, the system 800 includes:

[0111] The initialization state module 810 is used for the client and cloud server to initialize the state through security parameters respectively. The client generates an initial local table and the cloud server generates an initial encoded forest and encoded table. The trusted authorization center generates system public parameters and master key.

[0112] The ciphertext generation module 820 is used to encrypt plaintext data on the client side, generate ciphertext and the insertion positions of each dimension, and update the encoding forest and encoding table of the cloud server.

[0113] Returning to ciphertext module 830, it is used by the client to map the query range to a ciphertext query request. The cloud server retrieves the ciphertext that meets the conditions based on the encoding forest and encoding table and returns it.

[0114] The ciphertext decryption module 840 is used by the client to decrypt the ciphertext using a private key. When the user attributes meet the access policy, plaintext data is output; otherwise, decryption fails.

[0115] Optionally, the state module is initialized, including:

[0116] The local table and encoding table submodules are initialized. The client and cloud server initialize their states using the security parameter λ, and the client generates the initial local table st. cl It is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest SF. ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data;

[0117] The private key generation submodule generates the system's public parameters pk and master key mk, and uses pk, mk, and the attribute set s describing the user as input to generate and distribute the user's private key sk.

[0118] Optionally, a ciphertext generation module includes:

[0119] The ciphertext generation submodule allows the user to input plaintext data pt and access policy A on the client side. The client then generates the ciphertext using system public parameters pk, plaintext pt, access policy A, and local table st. cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The insertion position pos in each coding tree;

[0120] In the ciphertext sending submodule, the client sends the ciphertext ct and the insertion position pos together to the cloud server;

[0121] The cloud server generates the encoded forest submodule, using the ciphertext ct, insertion position pos, and encoded forest sf. ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

[0122] Optionally, the returned ciphertext module includes:

[0123] The client queries interval I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server;

[0124] The cloud server uses the encoding table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

[0125] Optionally, the ciphertext decryption module includes:

[0126] The input ciphertext submodule is used by the client to take the ciphertext ct, the user's private key sk, and the system public parameter pk as input.

[0127] The decryption submodule is used to output plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails.

[0128] The ciphertext ct contains access policy A, and the user private key sk is a private key generated with the user attribute set s as a parameter.

[0129] The multidimensional data order-preserving encryption system 800 based on coding forest in one embodiment of the present invention corresponds to the multidimensional data order-preserving encryption method 100 based on coding forest in another embodiment of the present invention, and will not be described again here.

[0130] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0131] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0132] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0133] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0134] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0135] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A multidimensional data order-preserving encryption method based on coding forest, characterized in that, include: The client and cloud server initialize their states using security parameters. The client generates an initial local table, and the cloud server generates an initial encoded forest and encoded table. The trusted authorization center generates system public parameters and master key. The client encrypts the plaintext data, generates ciphertext and the insertion positions for each dimension, and updates the encoding forest and encoding table on the cloud server. The client maps the query range to a ciphertext query request, and the cloud server retrieves the ciphertext that meets the conditions based on the encoding forest and encoding table and returns it. The client decrypts the ciphertext using its private key. If the user attributes meet the access policy, the client outputs plaintext data; otherwise, decryption fails.

2. The method according to claim 1, characterized in that, The client and cloud server initialize their states using security parameters. The client generates an initial local table, and the cloud server generates an initial encoded forest and encoded table. The trusted authorization center generates public parameters and a master key, including: Both the client and the cloud server initialize their states using the security parameter λ, and the client generates the initial local table st. cl It is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest SF. ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data; The trusted authorization center generates the system's public parameters pk and master key mk, and uses pk, mk, and the attribute set s describing the user as input to generate and distribute the user's private key sk.

3. The method according to claim 2, characterized in that, On the client side, plaintext data is encrypted to generate ciphertext and insertion positions for each dimension. The encoded forest and encoding table on the cloud server are then updated, including: The user inputs plaintext data pt and access policy A into the client. The client then uses system public parameters pk, plaintext pt, access policy A, and local table st. cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The insertion position pos in each coding tree; The client sends the encrypted ct and the insertion position pos together to the cloud server; Cloud servers use ciphertext (ct), insertion position (pos), and encoded forest (sf) ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

4. The method according to claim 3, characterized in that, The client maps the query range to a ciphertext query request. The cloud server retrieves and returns the ciphertext that meets the conditions based on the encoding forest and encoding table, including: The client queries interval I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server; The cloud server uses the encoding table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

5. The method according to claim 4, characterized in that, The client decrypts the ciphertext using its private key. If the user attributes meet the access policy, it outputs plaintext data; otherwise, decryption fails, including: The client takes the ciphertext ct, the user's private key sk, and the system public parameter pk as input; The algorithm outputs plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails. The ciphertext ct contains access policy A, and the user private key sk is a private key generated with the user attribute set s as a parameter.

6. A multidimensional data order-preserving encryption system based on coding forest, characterized in that, include: The initialization state module is used for the client and cloud server to initialize the state through security parameters respectively. The client generates the initial local table and the cloud server generates the initial encoding forest and encoding table. The trusted authorization center generates system public parameters and master key. The ciphertext generation module is used to encrypt plaintext data on the client side, generate ciphertext and insertion positions for each dimension, and update the encoding forest and encoding table on the cloud server. The returned ciphertext module is used by the client to map the query range into a ciphertext query request. The cloud server retrieves the ciphertext that meets the conditions based on the encoding forest and encoding table and returns it. The ciphertext decryption module is used by the client to decrypt the ciphertext using a private key. If the user attributes meet the access policy, plaintext data is output; otherwise, decryption fails.

7. The system according to claim 6, characterized in that, The initialization state module includes: The local table and encoding table submodules are initialized. The client and cloud server initialize their states using the security parameter λ, and the client generates the initial local table st. cl It is used to store different plaintext data and their quantities. The cloud server generates the initial encoded forest SF. ser And the initial encoding table e, used to manage the storage and retrieval of ciphertext data; The private key generation submodule generates the system's public parameters pk and master key mk, and uses pk, mk, and the attribute set s describing the user as input to generate and distribute the user's private key sk.

8. The system according to claim 7, characterized in that, The ciphertext generation module includes: The ciphertext generation submodule allows the user to input plaintext data pt and access policy A on the client side. The client then generates the ciphertext using system public parameters pk, plaintext pt, access policy A, and local table st. cl As input, the updated local table st' is generated. cl ciphertext ct and ciphertext in the coded forest sf ser The insertion position pos in each coding tree; In the ciphertext sending submodule, the client sends the ciphertext ct and the insertion position pos together to the cloud server; The cloud server generates the encoded forest submodule, using the ciphertext ct, insertion position pos, and encoded forest sf. ser Using the encoding table e as input, generate the updated encoded forest sf' ser And the encoding table e'.

9. The system according to claim 6, characterized in that, The returned ciphertext module includes: The client queries interval I. cl With local table st cl As input, generate query interval I ser And send it to the cloud server; The cloud server uses the encoding table e and the query range I. ser As input, the encrypted dataset I that returns the query results ct .

10. The system according to claim 6, characterized in that, The ciphertext decryption module includes: The input ciphertext submodule is used by the client to take the ciphertext ct, the user's private key sk, and the system public parameter pk as input. The decryption submodule is used to output plaintext pt if and only if the attribute set s satisfies access policy A; otherwise, decryption fails. The ciphertext ct contains access policy A, and the user private key sk is a private key generated with the user attribute set s as a parameter.

Images