Casual R tree construction method and retrieval method based on trusted execution environment

Abstract

The invention discloses an oblivious R tree construction method and retrieval method based on a trusted execution environment. The method comprises the following steps: firstly, creating a storage structure in the same machine, wherein the storage structure comprises a trusted memory based on TEE and an untrusted external memory; the trusted memory comprises an ORAM Client region, an R tree node storage region and a data cache region; the external memory comprises an ORAM Server region, and performs data exchange with the Client region according to an ORAM protocol; generating an R tree by using an index initialization algorithm, and initializing the Client region and the Server region according to the generated R tree; then selecting a probability p according to a to-be-stored data volume and a storage space size of the trusted memory, and recording the probability p into the trusted memory; and storing each node of the R tree into a node storage area of the R tree according to a probability p, and storing the rest nodes into a Server area.

Description

Technical Field

[0001] This invention belongs to the field of dense data retrieval and relates to an efficient unintentional R-tree indexing method, particularly an unintentional R-tree construction and retrieval method based on a trusted execution environment. Background Technology

[0002] R-trees are a classic spatial indexing structure, widely used in geographic information systems, databases, and computer vision due to their efficient support for spatial operations such as range queries and KNN queries. However, the spatial data stored in R-trees often contains private information such as users' real behavioral patterns and identity characteristics. Furthermore, the size of the node boundaries in an R-tree reflects the spatial distribution and density of the data; therefore, leakage of node boundaries can lead to privacy breaches for data owners. Thus, protecting sensitive data in R-trees is not only a theoretical research requirement but also a crucial step in achieving secure spatial data sharing and trusted computing. To address this need, an effective technology is the Trusted Execution Environment (TEE). TEE technology deploys an isolated, trusted memory where data, code, and executed computations are not visible to the outside world, thus providing basic security guarantees for the confidentiality and integrity of data and code within the trusted memory.

[0003] However, due to storage space limitations and the existence of numerous existing data storage media, some data needs to be stored in untrusted external storage. In this case, simply encrypting the R-tree node content is insufficient. During R-tree-based storage and retrieval, access patterns such as the accessed nodes, order, and result size can be observed and inferred by adversaries, posing a serious risk of privacy data leakage. Oblivious Random Access Machine (ORAM) technology is an effective way to protect external storage data security. This technology protects data privacy and access patterns in external storage by storing redundant data and performing redundant operations, sacrificing space and time efficiency. Considering that ORAM technology's retrieval efficiency is far lower than TEE-based solutions, when combining the two technologies, data and the retrieval process should be placed in trusted memory as much as possible to improve efficiency.

[0004] One simple approach combining TEE and ORAM technologies is to directly store several index nodes from the root node to the leaf node in a cache of trusted memory. During retrieval, indexes in the cache can be read directly; otherwise, the retrieval is performed in external storage. This scheme maximizes the utilization of trusted memory space but carries the risk of access pattern leakage. This is because the number of accesses to external storage differs depending on whether the data is in the cache or not, thus violating the unintentional nature of the approach. Furthermore, even with non-random scheduling methods such as LRU for the cache, this scheme still has security vulnerabilities. For a specific non-random scheduling method, there must exist a retrieval order that brings the cache to a deterministic state, making the method as secure as no scheduling, thus again violating the unintentional nature. Simply porting other non-R-tree TEE-based schemes to R-trees results in low efficiency due to the inefficient use of trusted memory space in other schemes, leading to frequent data exchange between trusted memory and external storage. Research has shown that the overhead of this data exchange is far greater than the computational overhead in trusted memory, thus simple porting leads to low efficiency. Therefore, how to achieve an efficient index structure while ensuring security is an urgent problem to be solved. Summary of the Invention

[0005] To address the aforementioned technical problems, the purpose of this invention is to provide an unintentional R-tree construction and retrieval method based on a trusted execution environment, achieving efficient and secure data storage, updating, single-item retrieval, and spatial retrieval methods. This scheme manages the R-tree on a node-by-node basis, with some nodes stored in trusted memory and others in external storage. By randomly writing nodes to trusted memory or external storage after each node read, the unintentional nature of node access is ensured, and secure data updating, single-item retrieval, and spatial retrieval methods are achieved based on this unintentional node access. Furthermore, by reasonably adjusting the probability of random writing to trusted memory, the utilization of trusted memory space can be maximized, thereby improving the overall efficiency of the scheme.

[0006] To achieve the above-mentioned technical objectives, the present invention adopts the following technical solution: An unintentional R-tree construction method based on a trusted execution environment, the method comprising: 1) Create a storage structure on the same machine; such as Figure 1 The diagram shows an index storage structure based on TEE and ORAM, and an algorithm based on this structure. Furthermore, the storage structure is divided into a trusted memory portion based on TEE and an untrusted external storage portion, both of which reside on the same machine.

[0007] Furthermore, the trusted memory portion includes an ORAM Client area, an R tree node storage area, and a data cache area.

[0008] Furthermore, the data cache area is used to temporarily store the temporary storage structure during the algorithm process and the returned results of data retrieval.

[0009] Furthermore, the external storage portion includes an ORAM Server area, which exchanges data with the ORAM Client portion of trusted memory according to the ORAM protocol.

[0010] Furthermore, the algorithm based on this structure includes index initialization, node access, insertion, deletion, and data retrieval algorithms; Furthermore, the ORAM protocol can be any ORAM protocol, including but not limited to Path ORAM, Partition ORAM, etc.

[0011] 2) Unintentionally index the R-tree using the index initialization algorithm; the process of the index initialization algorithm includes three parts: R-tree generation, parameter setting, and R-tree node storage.

[0012] The R-tree generation includes constructing an R-tree based on the data according to a standard R-tree generation algorithm, and initializing the ORAM Client and ORAM Server based on the generated R-tree.

[0013] The parameter settings include selecting an appropriate probability p based on the amount of data to be stored and the storage space size of the trusted memory, and recording it in the trusted memory.

[0014] The R-tree node storage includes storing each R-tree node in the R-tree node storage area with probability p. The remaining nodes are stored in the ORAM Server on external storage according to the ORAM protocol.

[0015] This invention creates a storage structure on the same machine, and then directly uses the existing or externally input dataset to execute the index initialization algorithm to complete the construction of the unintentional R tree.

[0016] This invention also provides insertion, deletion, and retrieval methods as external interfaces, allowing users to perform insertion, deletion, and retrieval operations on data stored in the unintentional R-tree through these interfaces. The node access algorithm is a low-level, secure algorithm, and the insertion, deletion, and retrieval methods are designed based on the node access algorithm.

[0017] A) The node access algorithm process is as follows: Step A1: Search for the ID of this node in the R-tree node storage area of ​​trusted memory. If found, proceed to step A2; otherwise, proceed to step A3.

[0018] Step A2: Retrieve the node from the R tree node storage area and place it into the trusted memory data cache area. Then, proceed to step A4.

[0019] Step A3: Send a request to the ORAM Client to read and delete the node, and place the node in the data cache area of ​​trusted memory. Then, proceed to step A4.

[0020] Step A4: Retrieve the accessed node from the data cache area and determine with probability p whether the node should be placed in trusted memory. If so, place it in the R-tree node storage area; otherwise, send a request to write the node to the ORAM Client.

[0021] B) The insertion algorithm process is as follows: Step B1: Starting from the root node of the R-tree, sequentially select the nodes to be visited next. The selection rule is to choose the node with the smallest increase in the minimum bounding rectangle after expansion from all the child nodes of the currently visited node, and visit the node according to the node visit algorithm excluding step A4 (i.e., execute steps A1~A3). Store the visited nodes in the data cache area. Repeat the above visit until a leaf node is visited and data is inserted. Then determine whether the node needs to be split. If it does not need to be split, execute step B4; otherwise, execute step B2.

[0022] Step B2: Split the node to be split into two new nodes according to the splitting strategy and delete the node to be split. For each split node, determine with probability p whether the node should be placed in trusted memory. If so, place it in the R-tree node storage area; otherwise, send a request to write the node to the ORAM Client.

[0023] Step B3: Retrieve the parent node of the deleted node to be split from the data cache area, update the information of the parent node, and determine whether the parent node needs to be split. If it does not need to be split, update the minimum bounding rectangle (MBR) of the remaining nodes in the data cache area and execute step B4; otherwise, return to step B2.

[0024] Step B4: For each remaining node in the data cache region, execute step A4 of the node access algorithm described above.

[0025] C) The deletion algorithm process is as follows: Step C1: Starting from the root node of the R-tree, from all child nodes of the currently visited node, select the next node to be visited sequentially based on whether the minimum bounding rectangle of the node contains the data to be deleted. Visit the nodes according to the node access algorithm described above, excluding step A4, and store the visited nodes in the data cache area. Repeat the above access until a node containing the data to be deleted is reached, and then delete the data. Then determine whether the node needs to be deleted. If not, proceed to step C4; otherwise, proceed to step C2.

[0026] Step C2: Retrieve all entries contained in the currently visited node and delete that node. Then, re-insert the retrieved entries into the R tree according to the insertion algorithm described above.

[0027] Step C3: Retrieve the parent node of the node to be deleted from the data cache area, update the information of the parent node, and determine whether the parent node needs to be deleted. If it does not need to be deleted, proceed to step C4; otherwise, return to step C2.

[0028] Step C4: For each remaining node in the data cache region, execute step A4 of the node access algorithm described above.

[0029] D) The data retrieval algorithm process is as follows: Step D1: Create an empty result array and an empty queue in the data cache area.

[0030] Step D2: Access the root node of the R-tree according to the node access algorithm described above, and add it to the queue.

[0031] Step D3: Retrieve the head node of the queue and determine its type. If the node is a leaf node, add the data that matches the search criteria to the result array. If the node is not a leaf node, traverse its child nodes and add the child nodes whose minimum bounding rectangle overlaps with the search criteria to the tail of the queue.

[0032] Step D4: Repeat step D3 until the queue is empty.

[0033] Step D5: Return the result array.

[0034] The beneficial effects of this invention are as follows: 1) By randomly placing the accessed R-tree nodes back into trusted memory or external storage, the unintentional nature of node access is guaranteed, and an R-tree scheme that can protect user access patterns is implemented based on secure node access.

[0035] 2) By caching nodes in trusted memory with an appropriate probability p, the utilization rate of trusted memory can be improved, thereby improving retrieval efficiency.

[0036] 3) A secure data retrieval method supporting arbitrary search conditions has been implemented, demonstrating the security and versatility of the invention. Attached Figure Description

[0037] Figure 1 This is the overall architecture diagram of the unintentional R-tree solution based on a trusted execution environment.

[0038] Figure 2 This is a schematic diagram of the structure and initialization of the unintentional R-tree indexing method based on a trusted execution environment.

[0039] Figure 3 This is a schematic diagram of node access and related algorithms for the unintentional R-tree indexing method based on a trusted execution environment. Detailed Implementation

[0040] The following will provide an exemplary explanation of the specific implementation of the key technical modules described in the invention, but this explanation is not intended to limit the scope of the invention.

[0041] Specifically, the present invention includes the following main algorithms.

[0042] Algorithm 1: Index initialization algorithm.

[0043] In one embodiment, the algorithm pre-sets the probability p to 0.8, then constructs an R-tree according to the Path ORAM protocol and initializes the ORAM Client region. Next, each R-tree node is placed in the R-tree node storage region of trusted memory with an 80% probability, and the data is placed in external storage with a 20% probability, and the ORAM Server is initialized.

[0044] Algorithm 2: Node Access Algorithm.

[0045] In one embodiment, if the node to be accessed is located in the cache of trusted memory, the node is placed in the R-tree node storage area with an 80% probability, and the data is written to the ORAM Client with a 20% probability.

[0046] In one embodiment, if the node to be accessed is located in external storage, the node is read and deleted via the ORAM Client. Then, the data is placed in the R-tree node storage area with an 80% probability, and written to the ORAM Client with a 20% probability.

[0047] Algorithm 3: Data retrieval algorithm.

[0048] In one embodiment, the user needs to retrieve given data. Starting from the root node, the system determines the next node to be read according to the MBR and visits the nodes according to Algorithm 2 until the data is retrieved, and then returns the data.

[0049] In one embodiment, a user needs to retrieve data within a given range. First, a result array and an empty queue are created in the data cache area, and the root node is placed in the empty queue. Then, the first node in the queue is recursively retrieved, and data matching the range is added to the result array. Its child nodes that overlap with the retrieval range are placed at the end of the queue. This process is repeated until the queue is empty, then the result array is returned, ending the retrieval.

[0050] In one embodiment, a user needs to retrieve the 10 points closest to given data. First, a result array and a priority queue of nearest neighbor candidate nodes, sorted in ascending order of distance to the given data, are created in the data cache area. The root node of the R-tree is inserted into the queue. Each time, the first object in the queue is retrieved; if it is an index node, all its child nodes or all data contained within them are traversed, the distance is calculated, and it is added to the priority queue; if it is a data object, it is directly added to the result array. Finally, the result array is returned, ending the search.

[0051] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of this disclosure. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. An unintentional R-tree construction method based on a trusted execution environment, comprising the following steps: Create a storage structure on the same machine, the storage structure comprising trusted memory based on TEE and untrusted external storage; The trusted memory includes an ORAM Client area, an R tree node storage area, and a data cache area; the data cache area is used to temporarily store the temporary storage structure and the return results of data retrieval during the algorithm execution process. The external storage includes an ORAM Server area, which exchanges data with the ORAM Client area according to the ORAM protocol; An R-tree is generated using an index initialization algorithm, and the ORAM Client region and the ORAM Server region are initialized based on the generated R-tree. Then, based on the amount of data to be stored and the storage space size of the trusted memory, a probability p is selected and recorded in the trusted memory; then, for each node of the R-tree, it is stored in the R-tree node storage area with probability p, and the remaining nodes are stored in the ORAM Server area according to the ORAM protocol.

2. The method according to claim 1, characterized in that, The set algorithms include index initialization algorithm, node access algorithm, insertion algorithm, deletion algorithm, and data retrieval algorithm.

3. The method according to claim 2, characterized in that, The steps of the node access algorithm include: Step A1: Search for the ID of the current node in the R-tree node storage area. If found, proceed to step A2; otherwise, proceed to step A3. Step A2: Retrieve the current node from the R-tree node storage area and place it into the data cache area; then proceed to step A4; Step A3: Send a request to read and delete the current node to the ORAM Client area, and place the current node into the data cache area; then execute step A4; Step A4: Retrieve the current node from the data cache area and determine with probability p whether the current node should be placed in trusted memory. If so, place it in the R-tree node storage area; otherwise, send a request to write the node to the ORAM Client area.

4. The method according to claim 3, characterized in that, The steps of the insertion algorithm include: Step B1: Starting from the root node of the R-tree, from all child nodes of the currently visited node, sequentially select the node with the smallest increase in the minimum bounding rectangle after expansion as the node to be visited. Search for the ID of the node to be visited in the R-tree node storage area of ​​trusted memory. If the ID of the node to be visited is found, retrieve the node to be visited from the R-tree node storage area and put it into the data cache area of ​​trusted memory; otherwise, send a request to read and delete the node to be visited to the ORAM Client area, put the node to be visited into the data cache area, then insert the data to be stored into the node to be visited and determine whether the node to be visited needs to be split. If it does not need to be split, proceed to step B4; otherwise, proceed to step B2. Step B2: Split the node to be split into two new nodes according to the splitting strategy and delete the node to be split; then for each split node, determine with probability p whether the node should be placed in trusted memory. If so, place it in the R-tree node storage area; otherwise, send a request to write the node to the ORAM Client area. Step B3: Take out the parent node of the deleted node to be split from the data cache area, update the information of the parent node, and determine whether the parent node needs to be split. If it does not need to be split, update the minimum boundary rectangle of the remaining nodes in the data cache area and execute step B4; otherwise, return to execute step B2. Step B4: For each remaining node in the data cache area, determine with probability p whether the node should be placed in trusted memory. If so, place it in the R-tree node storage area; otherwise, send a request to write the node to the ORAM Client area.

5. The method according to claim 4, characterized in that, The deletion algorithm includes the following steps: Step C1: Starting from the root node of the R-tree, select the next node to be visited in sequence according to whether the minimum bounding rectangle of the node contains the data to be deleted, and execute the node access algorithm excluding step A4. Store the visited nodes in the data cache area; repeat the above access until a node containing the data to be deleted is visited, and delete the data; then determine whether the node needs to be deleted. If not, execute step C4; otherwise, execute step C2. Step C2: Extract all entries contained in the node to be deleted and delete the node; then execute the insertion algorithm including steps B1~B4 to re-insert the extracted entries into the R-tree; Step C3: Retrieve the parent node of the deleted node from the data cache area, update the information of the parent node of the deleted node, and determine whether the parent node of the deleted node needs to be deleted. If it does not need to be deleted, proceed to step C4; otherwise, return to step C2. Step C4: For each remaining node in the data cache region, execute step A4 of the node access algorithm.

6. The method according to claim 1, characterized in that, The ORAM protocol includes, but is not limited to, the Path ORAM protocol and the Partition ORAM protocol.

7. A retrieval method based on the unintentional R-tree of claim 1, characterized in that, Step D1: Create an empty result array and an empty queue in the data cache area; Step D2: Visit the root node of the R-tree and add it to the queue; Step D3: Take out the node at the head of the queue and determine the node type; if the node is a leaf node, add the data that meets the search conditions to the result array; if the node is not a leaf node, traverse its child nodes and add the child nodes whose minimum boundary rectangle overlaps with the search conditions to the tail of the queue. Step D4: Repeat step D3 until the queue is empty; Step D5: Return the result array.

Images