Database security assessment method and system for encrypted SQL queries

Abstract

The application provides a database security evaluation method and system for encrypted SQL queries, and relates to the technical field of databases, comprising: anchor point selection: obtaining statistical leakage information and prior plaintext auxiliary data exposed by an encrypted database in the process of executing an SQL query, reasoning the mapping relationship between plaintext in the prior plaintext auxiliary data and ciphertext in the encrypted database, and obtaining the ciphertext and plaintext mapping with the highest confidence as an anchor point set; cross-column recovery: based on the anchor point set and the joint distribution matrix on both sides of the plaintext and the ciphertext, more ciphertext and plaintext mappings are recovered using local joint distribution information under the condition of each anchor point; iterative incremental recovery: the steps of anchor point selection and cross-column recovery are repeatedly iterated, and mapping conflict resolution and adaptive error correction are performed in each iteration, and finally the plaintext mapping relationship of all ciphertext is recovered. The recovery capability is significantly improved, and an efficient scheme is provided for security evaluation of a relational encrypted database.

Description

Technical Field

[0001] This invention relates to the field of database security and privacy protection technology, and more specifically, to a database security assessment method and system for encrypted SQL queries. Background Technology

[0002] Incremental inference attacks against encrypted SQL queries aim to recover the plaintext content of data without decryption keys by leveraging statistical leaks exposed by encrypted queries in outsourced storage environments. This is a method that can crack encrypted SQL queries and can be used to evaluate the security of encrypted databases.

[0003] Plaintext recovery from relational encrypted databases has wide applications in cryptographic analysis and security auditing, such as data breach attribution or security verification of encryption schemes. Attackers (security assessors) can infer the original distribution of sensitive data by analyzing access patterns, result sizes, and intermediate results exposed during query execution in cloud-based relational encrypted databases. Although existing encrypted query mechanisms (such as structured encryption and searchable encryption) optimize query efficiency through controlled information leakage, in some cases, this leaked information can help attackers recover the plaintext of ciphertext through statistical analysis. Researching how to leverage limited statistical leakage information to launch high-precision incremental inference attacks in encrypted environments is a crucial technical issue in assessing the security of encrypted databases.

[0004] In developing this invention, the applicant discovered that multi-attribute query leakage and the utilization of its joint distribution information are central to encrypted data inference attacks, especially in queries involving cross-column correlations, such as join queries with filtering conditions. These queries typically involve statistical relationships between join columns and filter columns, and may explicitly or implicitly leak joint statistical features between columns during execution. Compared to single-column frequency, cross-column correlation leakage provides richer statistical information, significantly improving the accuracy of plaintext recovery, especially when the data volume is large or single-column features are not obvious. For example, when analyzing encrypted medical data, attackers can infer specific geographical location information by analyzing the co-occurrence patterns of the "area code" and "location" attributes in the query results. However, existing attack methods mainly focus on single-attribute frequency or simple equivalence relationships between columns, making it difficult to effectively utilize the more complex joint distribution leakage between attributes, thus limiting the attack effectiveness under complex query logic.

[0005] Therefore, designing a highly accurate incremental reasoning attack method to crack ciphertext and thus achieve security assessment of encrypted databases has become a technical problem that needs to be solved. Summary of the Invention

[0006] This invention aims to solve at least one of the technical problems existing in the prior art or related technologies, and discloses a database security assessment method and system for encrypted SQL queries. It can recover plaintext mappings based on cross-column joint distribution leakage in relational encrypted databases, significantly improving the recovery capability in scenarios of misaligned value domains and partial leakage, and providing an efficient solution for security assessment of relational encrypted databases.

[0007] The first aspect of this invention discloses a database security assessment method for encrypted SQL queries, comprising: anchor point selection: obtaining statistical leakage information and prior plaintext auxiliary data exposed by the encrypted database during the execution of SQL queries; based on the statistical leakage information and prior plaintext auxiliary data, inferring the mapping relationship between the plaintext in the prior plaintext auxiliary data and the ciphertext in the encrypted database, and obtaining the ciphertext-plaintext mapping with the highest confidence as the anchor point set; wherein, the statistical leakage information includes: the single-column equal-value frequency distribution vector of the target column in the encrypted database and the cross-column joint frequency distribution matrix between the target related columns; cross-column recovery: based on the anchor point set and the joint distribution matrix on both sides of the plaintext and ciphertext, recovering more ciphertext-plaintext mappings using the local joint distribution information under each anchor point condition; wherein, the local joint distribution information is the partial joint distribution information represented by the row vector or column vector corresponding to the anchor point in the joint distribution matrix; iterative incremental recovery: repeatedly iterating the steps of anchor point selection and cross-column recovery, and performing mapping conflict resolution and adaptive error correction in each iteration, and finally recovering the plaintext mapping relationship of all ciphertexts.

[0008] In this technical solution, the present invention provides an incremental reasoning attack method for encrypted SQL queries from the perspective of security assessors (attackers), in order to recover the mapping relationship between all ciphertext and plaintext, so as to assess the security of the database.

[0009] For the "anchor selection" step, this invention designs an anchor acquisition protocol (GetAnchor) based on optimal transport theory. This protocol focuses on transforming the mapping problem between encrypted and plaintext data into an optimization problem (FIOT) that minimizes transmission cost through an optimal transport model (OT). In the protocol, the attacker first needs to construct a frequency distribution vector by analyzing the statistical information exposed by the ciphertext query, including the frequency distribution of the ciphertext data and auxiliary information of the plaintext data. Then, the protocol uses Earth Mover's Distance (EMD) as the cost function to calculate the optimal transport matrix, which describes the confidence level of the mapping between ciphertext and plaintext. Specifically, the attacker calculates the frequency distribution of a single column of ciphertext and plaintext and obtains a transport matrix through the optimal transport model. Each element in the matrix represents the mapping quality between a certain ciphertext value and a certain plaintext value. By filtering out mapping relationships with high transport weights (i.e., high confidence), the protocol finally constructs an initial set of high-confidence anchors. These anchors will serve as the basis for subsequent inference, ensuring the accuracy and stability of the subsequent recovery process by providing high-quality ciphertext-plaintext mapping relationships.

[0010] For the "cross-column recovery" step, this invention designs a cross-column recovery protocol (XColRecover) based on local joint statistical features. The main task of this protocol is to further expand the mapping relationship between ciphertext and plaintext, particularly by utilizing joint distribution information across columns to recover more mappings. In this protocol, the joint statistical information corresponding to each anchor point is used to derive more ciphertext-plaintext mappings. Unlike traditional single-column frequency analysis, the XColRecover protocol emphasizes the correlation between multiple columns, effectively improving recovery accuracy by utilizing joint distribution information. Specifically, the protocol expands the set of ciphertext and plaintext mappings by parallel computing the correlation of each anchor point in the joint distribution matrix. In the query, the attacker obtains the joint distribution information from the encrypted database and, combined with the anchor point set from the previous steps, further derives new mapping relationships using the joint frequency distribution of ciphertext and plaintext. In this way, the protocol can accurately recover more mapping relationships while reducing global noise interference, greatly improving the accuracy and recovery rate of the attack.

[0011] For the "iterative incremental recovery" step, this invention designs an iterative incremental recovery protocol (AJattack) with adaptive error correction capabilities. The core design concept of this protocol is to continuously expand and optimize the plaintext-ciphertext mapping through multiple iterations. The AJattack protocol gradually recovers more mapping relationships by repeatedly calling the GetAnchor and XColRecover protocols, and corrects the error propagation in previous steps in each iteration. Unlike traditional static inference methods, this invention's protocol introduces an adaptive error correction mechanism and a conflict resolution mechanism. In each iteration, conflict detection is performed on newly generated mappings, and the most reliable mapping result is selected based on confidence level. Specifically, in each iteration, when the same ciphertext value is detected to be mapped to multiple different plaintext values, the protocol filters according to the confidence weight in the transmission matrix, retaining only the mapping result with the highest confidence. This process effectively corrects error propagation that may occur in early iterations, preventing errors from accumulating in subsequent iterations. The iterative process of the protocol continues until no new high-confidence anchor points are found or the set maximum number of iterations is reached. By introducing this conflict resolution and incremental reasoning strategy, AJattack can obtain high-precision plaintext recovery results in complex query scenarios.

[0012] The database security assessment method for encrypted SQL queries disclosed in this invention preferably further includes: outputting assessment results: determining the security of the database based on the accuracy of the mapping relationship between the ciphertext and the plaintext.

[0013] According to the database security assessment method for encrypted SQL queries disclosed in this invention, preferably, the anchor point selection step specifically includes:

[0014] During multiple rounds of encrypted SQL query execution, statistical leakage information is continuously collected to construct target columns in the encrypted database. Frequency vectors of the upper equal groups Each component represents the number of records in an equal group, and its bottom index is... This represents the index assigned to each equality group; meanwhile, in Encrypted columns related to the target column statistics Collect cross-column joint frequency information and construct index pairs of equal groups. Joint frequency matrix to co-occurrence count ,in Representative target column In this context, an attribute value is the index of the equality group. It is another encrypted column One attribute value is the index of the equal group;

[0015] Extracting from prior plaintext auxiliary data Corresponding auxiliary plaintext column and related columns of auxiliary plaintext columns Calculate the set of plaintext values Frequency vector on ,Right now Represent the auxiliary plaintext frequency vector and construct the joint frequency matrix on the plaintext side. It is used to characterize the joint distribution of plaintext attributes in prior plaintext auxiliary data;

[0016] Frequency vectors of ciphertext pairs and auxiliary plaintext frequency vector Normalization is performed separately to obtain the ciphertext side frequency vector. With plaintext side frequency vector , used to characterize the frequency distribution of equal groups and plaintext values;

[0017] according to and Construct cost matrix The preferred method is based on the absolute difference of each component. As a transportation cost, this characterizes the unit cost required to transport the mass of the ciphertext equal group to the plaintext value;

[0018] Using the Earth's travel distance as the cost function, we solve for the optimal transfer matrix that satisfies the edge constraints, ensuring that the row and column edge distributions are respectively equal to... and Under the premise of minimizing the overall transportation cost, the mapping problem between ciphertext and plaintext is transformed into an optimization problem that minimizes the transmission cost.

[0019] According to the database security assessment method for encrypted SQL queries disclosed in this invention, preferably, the anchor point selection step further includes:

[0020] For the optimal transfer matrix each line Determine the plaintext index corresponding to the maximum transmission weight in that row. And the plaintext index corresponding to the second largest transmission weight. And calculate the confidence score. It is used to measure the reliability of the best candidate plaintext relative to the second-best candidate plaintext;

[0021] When the confidence score of a certain row Not less than the preset threshold At that time, from the joint frequency matrix of the target column and the relevant column and auxiliary plaintext joint frequency matrix Extract the corresponding row vector and Let and represent the conditional distributions of the relevant columns under the conditions of the equal group or plaintext value, respectively. These distributions are normalized and sorted in descending order, and then the Euclidean distance between them is calculated. As a measure of distribution consistency;

[0022] When distribution consistency measure Not greater than the preset threshold At that time, the triplet Adding to the anchor set yields a set of anchor triples consisting of the ciphertext equality group index, the corresponding plaintext value, and the confidence score. .

[0023] According to the database security assessment method for encrypted SQL queries disclosed in this invention, the cross-column recovery step preferably includes:

[0024] For the target column that is a dependency column and its corresponding plaintext list First, based on the anchor selection step, the set of anchor points on the dependent column is obtained. Each anchor point is denoted as ,in for Equality group index, for The corresponding plaintext value above, The confidence score;

[0025] For each anchor point In the joint frequency matrix Extracting row vectors As target column Equal groups are Conditional frequency distribution vector under the given conditions In the auxiliary plaintext joint frequency matrix Extracting row vectors As Value Conditional frequency distribution vector of relevant plaintext columns under given conditions ;

[0026] Will and As input, the anchor point selection step is executed again, and the output is in the form of anchor points under the current anchor point condition. equal groups and Candidate mapping set between values This enables cross-column frequency inference using local joint distribution information.

[0027] According to the database security assessment method for encrypted SQL queries disclosed in this invention, preferably, the mapping conflict resolution and adaptive error correction specifically include:

[0028] For all anchor points Call the candidate mapping set of all anchor points Perform a union operation to obtain a first candidate mapping set containing multiple equal group indices and candidate plaintext value relationships. ;

[0029] For each target column, the index is equal to the group index. ,from Collect all forms like Each of the candidate triples Only retain confidence scores The largest column is used as the final cross-column recovery result and added to the result set. Discard candidate mappings that have low confidence and conflict with them;

[0030] In each iteration of conflict resolution, decisions are made based on the confidence scores output from the optimal transfer matrix or the anchor selection step. When the same ciphertext equal group is assigned to multiple different plaintext values, only the mapping entry with the highest confidence is retained, and the remaining candidate mappings are considered as errors and discarded, thereby achieving adaptive error correction during the iteration process.

[0031] According to the database security assessment method for encrypted SQL queries disclosed in this invention, the iterative incremental recovery step preferably includes:

[0032] First, consider two target columns that are statistically correlated with each other. With encrypted columns Each column independently performs the anchor point selection step, resulting in an initial set of anchor points for both columns. and And denoted as the current anchor point set respectively. and ;

[0033] In the In the round of iteration, with Anchor point set As a dependency, a cross-column recovery step is performed to recover the column. More candidate mapping sets After performing a union operation on these mapping sets and resolving conflicts on the union, an intermediate result is obtained. Similarly, with Anchor point set As a dependency, after performing the cross-column recovery step and union conflict resolution, we obtain Intermediate results ;

[0034] Subsequently, respectively and By performing conflict resolution and the selection of the highest confidence level, we obtain the updated mapping set. and The newly added entries are defined as the anchor set for the new iteration. and ;

[0035] When a round of iteration ends, it is detected that and If all values ​​are empty, it indicates that no new high-confidence anchor points can be generated under the current joint distribution and threshold settings, and the iteration process is terminated.

[0036] For the set of equal group indices that have not yet been mapped, select the set of plaintext values ​​that have not yet been assigned, and execute the mapping reasoning process in the anchor selection step again to complete the mapping relationship of the remaining equal groups and merge them into the final mapping result set. Finally, complete plaintext and ciphertext mapping results are obtained on the two columns.

[0037] A second aspect of the present invention discloses a database security assessment system for encrypted SQL queries, comprising: a memory for storing program instructions; and a processor for calling the program instructions stored in the memory to implement the database security assessment method for encrypted SQL queries as described in any of the above technical solutions.

[0038] The beneficial effects of the present invention include at least the following:

[0039] 1. Improved accuracy. This invention utilizes an anchor point joint mechanism to deeply mine cross-column joint distribution leakage in join queries with filtering conditions, resulting in a significant improvement in accuracy compared to existing methods.

[0040] 2. Enhanced robustness. Thanks to the optimal transmission model based on EMD, there is no need to align the value ranges of plaintext and ciphertext. It can effectively cope with asymmetric scenarios such as missing value ranges, unqueried rows, or uneven sampling, and the recovery rate is significantly improved in these cases.

[0041] 3. Dynamic error correction: Through confidence quantification and conflict resolution mechanisms in the iteration, mapping conflicts can be detected and corrected in real time, avoiding the error propagation problem in traditional static inference methods.

[0042] 4. High-efficiency incremental inference: By adopting an anchor-driven local inference strategy, the computational overhead of high-dimensional fully connected graph models is avoided. While ensuring high accuracy, the execution speed is improved by several orders of magnitude compared with traditional baseline algorithms. Attached Figure Description

[0043] Figure 1 A schematic diagram illustrating the inference attack process of a database security assessment method for encrypted SQL queries according to an embodiment of the present invention is shown.

[0044] Figure 2 A schematic diagram of an optimal transmission frequency inference framework according to an embodiment of the present invention is shown.

[0045] Figure 3 A schematic diagram of the anchor point selection and local joint distribution acquisition process according to an embodiment of the present invention is shown.

[0046] Figure 4 The paper presents a comparison of the plaintext recovery rates of the present invention and existing attack methods in a fully leaked scenario.

[0047] Figure 5 The diagram illustrates the variation in recovery accuracy of the present invention under different parameter settings.

[0048] Figure 6 A schematic block diagram of a database security assessment system for encrypted SQL queries according to an embodiment of the present invention is shown. Detailed Implementation

[0049] To better understand the above-described objects, features, and advantages of the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Many specific details are set forth in the following description to provide a thorough understanding of the invention; however, the invention may be practiced in other ways different from those described herein, and therefore, the invention is not limited to the specific embodiments disclosed below.

[0050] The complete execution flow of a relational encrypted database system includes: the client initiates and executes an encrypted SQL query normally; the cloud database management system completes the query processing on the encrypted data; security assessors do not interfere with the protocol itself or the communication process, but continuously observe the statistical leakage information exposed during query execution (such as single-column equivalence frequency, cross-column joint distribution, and changes in result size), and combine this with externally obtained plaintext auxiliary data to recover the plaintext-ciphertext mapping relationship of the target attributes in the encrypted database, thereby assessing the security boundary of the relational encrypted database under statistical leakage. The plaintext auxiliary data represents prior knowledge possessed by the attacker; it may be early records obtained from historical unencrypted databases, or similarly distributed data obtained from similar domains and scenarios. Attackers can obtain corresponding auxiliary information such as single-column equivalence frequency, cross-column joint distribution, and result size from this data. Based on this information, attackers can calculate the mapping between plaintext and ciphertext data to complete the plaintext recovery process.

[0051] According to an embodiment of the present invention, a database security assessment method for encrypted SQL queries is disclosed, the method comprising:

[0052] Step 1: Execute the GetAnchor protocol, which takes the statistical leakage information (including the single-column equal frequency distribution vector of the target column and the cross-column joint frequency distribution matrix between related columns) exposed by the encrypted database during the execution of SQL queries and the prior data distribution information (prior plaintext auxiliary data) as input, and outputs the ciphertext and plaintext mapping with the highest confidence as the anchor set.

[0053] Step 2: Execute the cross-column recovery protocol XColRecover. This protocol takes the set of anchor points obtained by the GetAnchor protocol and the joint distribution matrix on both sides of the plaintext and plaintext as input, and uses the local joint distribution information under each anchor point condition to recover more ciphertext and plaintext mappings.

[0054] Step 3: Execute the iterative incremental recovery protocol AJattack protocol. This protocol iteratively calls the GetAnchor protocol and the XColRecover protocol, and performs mapping conflict resolution and adaptive error correction in each iteration, ultimately restoring the plaintext mapping relationship of all target ciphertexts.

[0055] Step 4, Output evaluation results: Determine the security of the database based on the accuracy of the mapping relationship between the ciphertext and the plaintext.

[0056] In this embodiment, the security assessor is defined as a passive persistent adversary residing on the encrypted database server side. Without modifying the queries and data, they can observe all leaked information generated during the execution of encrypted SQL queries (including frequency information and the set of columns involved in the client query), and possess prior plaintext distribution information containing approximate distributions of the target column and related columns. Accordingly, the attack process can be formalized as: reasoning from observed leaks and prior knowledge to obtain a mapping set from equal groups (a set of ciphertexts with the same underlying plaintext) in the encrypted database to plaintext values.

[0057] According to the above embodiments, the GetAnchor protocol in step 1 further includes the parsing and modeling of statistical leakage information and prior plaintext auxiliary data, and its specific steps include:

[0058] During multiple rounds of encrypted SQL query execution, column equivalence leakage information is continuously collected. This information refers to the equivalence relationships formed when the server can determine which ciphertexts in the same encrypted column correspond to the same underlying plaintext without decrypting the ciphertext content. Based on this column equivalence leakage information, a target column is constructed. Frequency vectors of the upper equal groups Each component represents the number of records in an equal group; meanwhile, in the target column and the encrypted column related to its statistics... Collect cross-column joint frequency information and construct index pairs of equal groups. Joint frequency matrix to co-occurrence count Among them, equal group index pairs In express Index of equal groups, express Index of equal groups, Each element in express The Middle One equal group and The Middle Co-occurrence count of equal groups.

[0059] Extracting the target column from prior plaintext auxiliary data Corresponding auxiliary plaintext column and Corresponding plaintext related columns Wait, calculate the set of plaintext values. Frequency vector on And construct the joint frequency matrix on the plaintext side. This is used to characterize the joint distribution matrix among the plaintext attributes in the auxiliary data. Among them, Each element in Indicates the first in the auxiliary plaintext column The first plaintext value and its associated column Co-occurrence count of plaintext values.

[0060] According to the above embodiment, the GetAnchor protocol in step 1 further includes the frequency inference subprocess FIOT based on optimal transmission theory, the specific steps of which include:

[0061] Frequency vectors of ciphertext pairs and auxiliary plaintext frequency vector Normalization is performed separately to obtain the ciphertext side frequency vector. With plaintext side frequency vector This is used to characterize the frequency distribution of equal groups and plaintext values. Normalization refers to dividing each element of a vector by the sum of all its elements, thus converting the vector into a probability distribution form.

[0062] according to and Construct cost matrix The preferred method is based on the absolute difference of each component. As a cost of transportation, among which Representative matrix No. OK The elements of the column, specifically the ciphertext-side frequency vector. The element With plaintext side frequency vector The element The absolute value of the difference, thus characterizing the unit cost required to transport the mass of the ciphertext equal group to the plaintext value;

[0063] The optimal transfer matrix satisfying the edge constraints is solved using Earth Movement Distance (EMD). This ensures that the row and column edge distributions are respectively equal to and Under the premise of minimizing overall transportation costs, the specific method is as follows: As input to the cost function, a non-negative transfer matrix is ​​solved. This makes the row edge distribution of the transmission matrix (i.e., the vector formed by adding all the values ​​in each row of the matrix) equal to the ciphertext side frequency vector. The column margin distribution is equal to the plaintext side frequency vector. And minimize the cost function; the non-negative transfer matrix obtained at this point is the optimal transfer matrix that satisfies the edge constraints. .

[0064] According to the above embodiment, the GetAnchor protocol in step 1 further includes an anchor point extraction process based on the optimal transfer matrix, the specific steps of which include:

[0065] For the optimal transfer matrix each line Determine the plaintext index corresponding to the maximum transmission weight in that row. And the plaintext index corresponding to the second largest transmission weight. And calculate the confidence score. It is used to measure the reliability of the best candidate plaintext relative to the second-best candidate plaintext;

[0066] When the confidence score of a certain row Not less than the preset threshold hour( Confidence score in the anchor selection process The threshold is used to determine whether a candidate mapping can serve as an anchor point, derived from the joint frequency matrix of the target column and the relevant columns. and auxiliary plaintext joint frequency matrix Extract the corresponding row vector and , respectively representing the equality group and the corresponding number of . The conditional distributions of the relevant columns under each plaintext value condition are normalized and sorted in descending order. Then, the Euclidean distance between the two columns is calculated. :

[0067]

[0068] As a measure of distribution consistency, The calculation of the L2 norm, and Representing matrices respectively and The OK," "" indicates taking all elements in the corresponding dimension. This part mainly considers the consistency of the conditional distribution of the corresponding related columns under the equality group and the plaintext value; it represents the calculation of the L2 norm.

[0069] When distribution consistency measure Not greater than the preset threshold hour( For distribution consistency measurement The threshold is used to determine the degree of consistency between the ciphertext-side conditional distribution and the plaintext-side conditional distribution, and the triplet is used to determine the degree of consistency between the ciphertext-side conditional distribution and the plaintext-side conditional distribution. Adding to the anchor set yields a set of anchor triples consisting of the ciphertext equality group index, the corresponding plaintext value, and the confidence score. Thus, the anchor point selection process based on the optimal transmission confidence metric and distribution consistency verification is now complete.

[0070] According to the above embodiments, the XColRecover protocol in step 2 further includes local joint distribution construction and frequency matching based on anchor point conditions, and its specific steps include:

[0071] For the target column that is a dependency column and its corresponding auxiliary plaintext list First, the set of anchor points on the dependency column is obtained based on the GetAnchor protocol. Each anchor point is denoted as ,in for Equality group index, for set of plaintext values The corresponding number in A plaintext value, The confidence score;

[0072] For each anchor point In the joint frequency matrix Extracting row vectors As target column Equal groups are Conditional frequency distribution vector under the given conditions In the auxiliary plaintext joint frequency matrix Extracting row vectors As Value Conditional frequency distribution vector of relevant plaintext columns under given conditions ;

[0073] Will and As input, the GetAnchor subroutine, based on optimal transport and anchor point selection, is called again to output the anchor points under the current anchor point condition. equal groups and Candidate mapping set between values This enables cross-column frequency inference using local joint distribution information.

[0074] According to the above embodiments, the XColRecover protocol in step 2 further includes a candidate map aggregation and conflict resolution process, the specific steps of which include:

[0075] For all anchor points The candidate mapping set obtained by calling the GetAnchor subroutine is subjected to a union operation to obtain the first candidate mapping set containing multiple candidate relationships between equal group indices and plaintext values. ;

[0076] For each target column, the index is equal to the group index. ,from Collect all forms like Each of the candidate triples Only retain the confidence score The largest column is used as the final cross-column recovery result and added to the result set. Discarding candidate mappings with low confidence and those that conflict with them, the cross-column recovery process driven by joint distribution is now complete.

[0077] According to the above embodiments, the AJattack protocol in step 3 further employs an alternating incremental recovery mechanism when there is a bidirectional dependency between columns, and its specific steps include:

[0078] First, consider two target columns that are statistically correlated with each other. With encrypted columns The GetAnchor protocol is executed independently on each of the two columns to obtain the initial anchor point sets. and And denoted as the current anchor point set respectively. and ;

[0079] In the In the round of iteration, with Anchor point set As a dependency, the XColRecover protocol is invoked to recover columns. After obtaining a larger set of candidate mappings, we perform a union operation and conflict resolution on the candidate mapping sets to obtain intermediate results. At the same time Anchor point set As a dependency, the XColRecover protocol is invoked for recovery. For candidate mappings, the union operation and conflict resolution are also performed on the candidate mapping set to obtain intermediate results. Subsequently, respectively and By performing conflict resolution and the selection with the highest confidence, we obtain the updated mapping set. and The newly added entries are defined as the anchor set for the new iteration. and ;

[0080] When a round of iteration ends, it is detected that and If all are empty, it indicates that no new high-confidence anchor points can be generated under the current joint distribution and threshold settings, and the iteration process is terminated. For the set of equal group indices that have not yet been mapped, select the set of plaintext values ​​that have not yet been assigned, call the FIOT frequency inference process again to complete the mapping relationship of the remaining equal groups, and merge them into the final mapping result set. Finally, the complete plaintext-ciphertext mapping results are obtained on the two columns.

[0081] According to the above embodiments, the AJattack protocol further makes decisions based on the confidence scores from the optimal transfer matrix or the output of the local GetAnchor subprocess during each round of conflict resolution. In the case where the same ciphertext equal group is assigned to multiple different plaintext values, only the mapping entry with the highest confidence is retained, and the remaining candidate mappings are regarded as errors and discarded. This enables dynamic correction of previous errors during the iteration process and avoids the accumulation and amplification of erroneous mappings in cross-column propagation and multiple rounds of iteration.

[0082] like Figure 1 As shown, according to another embodiment of the present invention, the overall execution flow and attack process of the database security assessment method for encrypted SQL queries provided in the above embodiments are disclosed from the perspective of an attacker (security assessor) in a relational encrypted database system:

[0083] In the system, the client-side driver executes the parsing and encryption of plaintext SQL, while the server performs index calculations, query processing, and result return on the ciphertext. Simultaneously, the attacker continuously monitors the statistical information exposed during the encrypted query process (frequency of single columns in the ciphertext, cross-column joint distribution), and uses the database security assessment method for encrypted SQL queries proposed in this invention to perform plaintext recovery. The entire process includes the following steps:

[0084] like Figure 1 As shown in ①, the attacker passively monitors the execution process of encrypted SQL queries, continuously collects statistical leakage information such as the frequency of single-column equivalence classes and cross-column joint distribution, and combines it with external auxiliary plaintext data to form attack input;

[0085] like Figure 1 As shown in ②, the attacker uses the observed single-column frequency leakage and auxiliary plaintext frequency to execute the GetAnchor anchor selection protocol based on the optimal transmission model (i.e., using the ciphertext side frequency vector and plaintext side frequency vector as edge distribution constraints, and using the elements in the cost matrix as unit transportation cost to solve the non-negative transmission matrix that minimizes the overall transportation cost). The attacker solves the optimal transmission matrix and selects high-confidence ciphertext-plaintext mapping pairs to form the initial anchor set.

[0086] like Figure 1 As shown in ③, the attacker uses the anchor set as a condition and the observed cross-column joint distribution information to execute the cross-column recovery protocol XColRecover, and performs incremental inference on the conditional joint distribution to recover more ciphertext and plaintext candidate mappings.

[0087] like Figure 1 As shown in ④, the attacker executes the iterative incremental recovery protocol AJattack, merges and resolves conflicts in the candidate mappings output by XColRecover, updates the anchor set according to the confidence level, and drives the next round of incremental inference.

[0088] like Figure 1 As shown in ⑤, when the number of iterations reaches the preset upper limit or no new high-confidence anchor points are generated, the AJattack protocol terminates, and the attacker obtains all the converged plaintext-ciphertext mapping results, thus achieving plaintext recovery of all target ciphertext values.

[0089] like Figure 2 As shown, Figure 2 This is a schematic diagram of the frequency inference framework based on optimal transmission of the present invention. In this diagram, according to T... *The maximum value of each row in the diagram determines the mapping relationship; for example, the mapping relationship marked by the red circle in the diagram is c1 corresponding to p3. Specifically, this framework receives the frequency distribution of equal groups on the ciphertext side and the frequency distribution on the auxiliary plaintext side as input, and completes the initial plaintext-ciphertext mapping inference on a single column dimension through the optimal transmission model. Specifically, the attacker, on the one hand, counts the equal groups in each target column from the leaked information. On the one hand, the frequency of occurrence of the plaintext attribute is used to construct a ciphertext frequency vector; on the other hand, the frequency of the corresponding plaintext attribute value is statistically analyzed from the prior auxiliary database. First, a plaintext frequency vector is constructed. Then, a cost matrix is ​​built based on the frequency vectors on both sides. Next, a transmission matrix is ​​obtained by solving an optimal transmission problem with the Earth's movement distance as the objective. Each element in the matrix characterizes the "quality" or confidence level of a given ciphertext equality group mapped to a given plaintext value. The attacker selects the plaintext value with the highest quality in each row as a candidate mapping for the current ciphertext equality group, and characterizes the confidence level of the mapping based on the difference between the maximum and second-largest values. Mappings with higher confidence levels are selected as anchor points for subsequent incremental inference processes, while mappings with lower confidence levels or uncertainties are retained for further correction and completion in subsequent joint distribution and iterative processes.

[0090] like Figure 3 As shown, Figure 3 This diagram illustrates the anchor selection and local joint distribution acquisition process in the incremental inference attack method proposed in this invention. In this diagram, the acquired joint distribution information will serve as the input to FIOT in the next iteration. JD represents the probability distribution, C1 and C2 represent two ciphertext columns, P1 and P2 represent the corresponding two plaintext columns, and R... cnt The columns c1, d1, d2, d3, d4, p2, q1, q2, q3, and q4 represent attribute values ​​in each column. Specifically, c1 represents a single attribute value in column C1, i.e., a numerical value in column C1; similarly, d1, d2, d3, and d4 represent four different attribute values ​​in column C2; p2 represents an attribute value in column P1; and q1, q2, q3, and q4 represent four different attribute values ​​in column P2.

[0091] This process primarily illustrates how to determine anchor points based on the obtained candidate plaintext-ciphertext mappings and further extract local joint distribution information based on these anchor points. Specifically, after an attacker performs frequency inference based on optimal transmission on the target column, they obtain a batch of initial plaintext-ciphertext mappings. The anchor point selection process filters out mapping pairs with confidence levels exceeding a preset threshold from these mappings, forming an anchor point set. Then, the attacker uses the anchor points to locate records containing anchor point values ​​in both the encrypted database and the auxiliary plaintext database, constructing a local joint distribution (conditional distribution) "given anchor point conditions" through statistical leakage. This local joint distribution can serve as input for subsequent cross-column recovery or incremental recovery processes, used to further recover other equivalent classes in the target column or related columns, generating more candidate mappings. In subsequent iterations, the attacker merges the newly added mappings with the existing mapping set. For conflicts where the same ciphertext is mapped to multiple different plaintexts, a priority selection is performed based on confidence level, retaining only the mapping with the highest confidence level, and updating the newly generated high-confidence mapping as the anchor point for the next iteration. The entire attack process is executed in this loop until no new anchor points are generated or the set number of iterations is reached, outputting the final stable plaintext-ciphertext mapping result.

[0092] According to another embodiment of the present invention, a comparative analysis is also made on the actual recovery effect of the database security assessment method for encrypted SQL queries provided in the above embodiments and the recovery effect of the most advanced plaintext recovery attack methods currently used for encrypted relational databases and searchable encrypted scenarios:

[0093] Existing representative works targeting encrypted join queries mainly include the attack methods proposed by Hoover et al. in the paper "Leakage-Abuse Attacks Against Structured Encryption for SQLs" (USENIX 2024) for encrypted join query scenarios (including various heuristic variants such as greedy, genetic, and split). These methods mainly utilize equivalence leakage on join attributes, treating the join key as the only "bridge," and then performing combined searches on row-level matches based on this. However, these methods largely ignore the joint distribution leakage between filter attributes and join attributes, as well as the high-dimensional correlation between other non-join columns, resulting in limited recovery rates in complex multi-attribute query scenarios and under incomplete leakage conditions.

[0094] Meanwhile, Nie et al. proposed Jigsaw, a dynamic leakage abuse attack method based on keyword co-occurrence matrix, in their paper "Query Recovery from Easy to Hard: JigsawAttack against SSE" (USENIX 2024). Jigsaw improves the accuracy of keyword recovery by iteratively utilizing co-occurrence statistics in a searchable encrypted environment.

[0095] This invention extends this type of method to apply it to relational databases, treating each row as a "document" and using it as a baseline in experiments. However, this type of method has two fundamental limitations: First, its iterative process is usually based on a static single-round or simple iterative strategy, lacking confidence modeling for erroneous mappings and a systematic conflict resolution mechanism. This leads to the amplification of errors in subsequent iterations once an early match goes wrong, significantly limiting the overall recovery capability. Second, such methods are mostly based on the assumption of a unified value range and complete overlap, making them poorly adaptable to scenarios with misaligned value ranges, unqueried records, or offsets between the auxiliary data distribution and the real data distribution. In contrast, the attack method proposed in this invention models the frequency inference process as the optimal transmission problem based on Earth's moving distance (FIOT). It can naturally handle scenarios with incomplete overlap of value ranges and partial leakage without aligning plaintext and ciphertext value ranges. It explicitly quantifies the confidence of each mapping through the optimal transmission matrix and uses this confidence to drive anchor selection and conflict resolution during the iteration process, thereby effectively suppressing error propagation.

[0096] Experimental results show that, under conditions of real datasets, aligned value ranges, and complete leakage, the method of this invention improves the value recovery rate and row recovery rate by more than 30% to 60% compared to the attack methods of Hoover et al. and Nie et al., and can improve the attack speed by about 10 times under some configurations. Under conditions with only partial query statistics, value range sampling, and misalignment, the method of this invention improves the value recovery rate and row recovery rate by about 20% to 50%, significantly outperforming existing attack methods, demonstrating the robustness and practicality of this invention in complex multi-attribute query scenarios and under incomplete leakage settings. In summary, this invention outperforms state-of-the-art attack schemes in terms of attack accuracy, adaptability to asymmetric value ranges and incomplete leakage, and computational efficiency, and can more realistically characterize the security threats faced by structured encrypted query schemes in actual deployment environments.

[0097] See Figure 4 As shown, Figure 4This figure compares the recovery performance of the present invention with existing attack methods under a complete leak condition. In the figure, "Targ" represents the target year of the data, i.e., the year of the attacked data, while "Aux" represents the year of the auxiliary data. "Val-rec" represents the value recovery rate of the ciphertext column, and "Row-rec" represents the row recovery rate of the ciphertext column. Gray-shaded cells represent the best recovery rate for each target year. A dash (-) indicates that the same year is not simultaneously considered as auxiliary and target data. This figure reflects the performance difference in value recovery rate and row recovery rate between the present invention's method and several representative baseline methods under an idealized scenario, i.e., when the attacker can observe the complete isovalue frequency and joint distribution leak of the target column and its related columns. Figure 4 As can be seen, in scenarios involving join queries and multi-attribute filtering queries, the present invention utilizes an anchor-driven joint distributed incremental inference mechanism to significantly improve the accuracy of plaintext recovery. Whether in single-column value recovery or whole-row record recovery, it is significantly superior to existing attack methods, demonstrating the present invention's ability to efficiently utilize joint distributed information under conditions of full leakage.

[0098] See Figure 5 As shown, Figure 5 This figure illustrates the variation in recovery accuracy of the attack method of this invention under different parameter settings. It primarily examines the impact of key parameters such as anchor confidence threshold and distribution consistency threshold on the attack effectiveness. Here, Param represents the value of the corresponding parameter. This represents the confidence threshold in the anchor selection process, used to determine whether a candidate mapping can serve as an anchor point; The threshold represents the distribution consistency measure, used to determine the degree of consistency between the ciphertext-side conditional distribution and the plaintext-side conditional distribution; DI stands for District, i.e., the administrative district number attribute; CA stands for Community Area, i.e., the community area number attribute. Figure 5 By measuring the recovery rate on test attributes DI and CA, the fluctuation of attack performance under different parameter values ​​is shown. Figure 5 As can be seen, within a reasonable parameter range, the recovery rate of the method of this invention remains above 50%, and does not decrease drastically due to slight changes in the selected threshold. This indicates that the invention is not sensitive to parameter settings in its design, possesses good engineering adjustability and deployment friendliness, and is conducive to flexible configuration in actual systems according to different data distributions and leakage intensities.

[0099] like Figure 6 As shown, according to another embodiment of the present invention, a database security assessment system 600 for encrypted SQL queries is also disclosed, comprising: a memory 601 for storing program instructions; and a processor 602 for calling the program instructions stored in the memory to implement the database security assessment method for encrypted SQL queries as described in the above embodiments.

[0100] In summary, this specific embodiment demonstrates that the present invention, by introducing a frequency inference framework based on optimal transmission and an anchor-driven cross-column joint distributed incremental recovery mechanism, achieves efficient utilization of leaked information from encrypted SQL queries in relational encrypted databases. Under various typical scenarios, including complete and incomplete leaks, the present invention outperforms existing attack methods in terms of plaintext recovery rate, adaptability to asymmetric value ranges and sampling biases, and computational efficiency. It can more realistically characterize the security threats faced by current encrypted query schemes under statistical leaks, providing an efficient solution for security assessment of relational encrypted databases.

[0101] All or part of the steps in the various methods of the above embodiments can be implemented by a program controlling the relevant hardware. The program can be stored in a readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other readable medium that can be used to carry or store data.

[0102] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A database security assessment method for encrypted SQL queries, characterized in that, include: Anchor point selection: Obtain statistical leakage information and prior plaintext auxiliary data exposed by the encrypted database during SQL query execution. Based on the statistical leakage information and the prior plaintext auxiliary data, infer the mapping relationship between the plaintext in the prior plaintext auxiliary data and the ciphertext in the encrypted database, and obtain the ciphertext-plaintext mapping with the highest confidence as the anchor point set. The statistical leakage information includes: the single-column equal-value frequency distribution vector of the target column in the encrypted database and the cross-column joint frequency distribution matrix between the target related columns. Cross-column recovery: Based on the set of anchor points and the joint distribution matrix on both sides of the plaintext and ciphertext, more ciphertext and plaintext mappings are recovered using the local joint distribution information under each anchor point condition. The local joint distribution information is the partial joint distribution information represented by the row vector or column vector corresponding to the anchor point in the joint distribution matrix. Iterative incremental recovery: The anchor point selection and cross-column recovery steps are executed iteratively, and mapping conflict resolution and adaptive error correction are performed in each round of iteration, so as to finally restore the plaintext mapping relationship of all ciphertexts; The anchor point selection steps specifically include: continuously collecting and statistically analyzing leakage information during multiple rounds of encrypted SQL query execution, and constructing target columns in the encrypted database. Frequency vectors of the upper equal groups Each component represents the number of records in an equal group; meanwhile, in and with Statistical related encrypted columns Collect cross-column joint frequency information and construct index pairs of equal groups. Joint frequency matrix to co-occurrence count Extracting data from prior plaintext auxiliary data Corresponding auxiliary plaintext column and its corresponding columns Calculate the set of plaintext values Frequency vector on ,Right now Represents the auxiliary plaintext frequency vector and the joint frequency matrix of the plaintext side. It is used to characterize the joint distribution of plaintext attributes in prior plaintext auxiliary data; Frequency vectors of ciphertext pairs and auxiliary plaintext frequency vector Normalization is performed separately to obtain the ciphertext side frequency vector. With plaintext side frequency vector , used to characterize the frequency distribution of equal groups and plaintext values; according to and Construct cost matrix The absolute difference of each component As a transportation cost, this characterizes the unit cost required to transport the mass of the ciphertext equal group to the plaintext value; Using the Earth's travel distance as the cost function, we solve for the optimal transfer matrix that satisfies the edge constraints, ensuring that the row and column edge distributions are respectively equal to... and Under the premise of minimizing the overall transportation cost, the mapping problem between ciphertext and plaintext is transformed into an optimization problem that minimizes the transmission cost. For the optimal transfer matrix each line Determine the plaintext index corresponding to the maximum transmission weight in that row. And the plaintext index corresponding to the second largest transmission weight. And calculate the confidence score. It is used to measure the reliability of the best candidate plaintext relative to the second-best candidate plaintext; When the confidence score of a certain row Not less than the preset threshold At that time, from the joint frequency matrix of the target column and the relevant column and auxiliary plaintext joint frequency matrix Extract the corresponding row vector and Let and represent the conditional distributions of the relevant columns under the conditions of the equal group or plaintext value, respectively. These distributions are normalized and sorted in descending order, and then the Euclidean distance between them is calculated. As a measure of distribution consistency; When distribution consistency measure Not greater than the preset threshold At that time, the triplet Adding to the anchor set yields a set of anchor triples consisting of the ciphertext equality group index, the corresponding plaintext value, and the confidence score. .

2. The database security assessment method for encrypted SQL queries according to claim 1, characterized in that, Also includes: Output evaluation results: Determine the security of the database based on the accuracy of the plaintext mapping relationship of the ciphertext.

3. The database security assessment method for encrypted SQL queries according to claim 1, characterized in that, The steps for cross-column recovery specifically include: For the target column and its corresponding auxiliary plaintext list First, based on the anchor selection step, the set of anchor points on the dependent column is obtained. Each anchor point is denoted as ,in for Equality group index, for The corresponding plaintext value above, The confidence score; For each anchor point In the joint frequency matrix Extracting row vectors As Equal groups are Conditional frequency distribution vector under the given conditions In the auxiliary plaintext joint frequency matrix Extracting row vectors As Value Conditional frequency distribution vector of relevant plaintext columns under given conditions ; Will and As input, the anchor point selection step is executed again, and the target column under the current anchor point condition is output in the form of anchor points. Equal groups and auxiliary plaintext columns Candidate mapping set between values This enables cross-column frequency inference using local joint distribution information.

4. The database security assessment method for encrypted SQL queries according to claim 3, characterized in that, The mapping conflict resolution and adaptive error correction specifically include: For all anchor points Call the corresponding set of all candidate maps Perform a union operation to obtain a first candidate mapping set containing multiple equal group indices and candidate plaintext value relationships. ; For each target column, the index is equal to the group index. ,from Collect all forms like Each of the candidate triples Only retain the confidence score The largest column is used as the final cross-column recovery result and added to the result set. Discard candidate mappings that have low confidence and conflict with them; In each iteration of conflict resolution, decisions are made based on the confidence scores output from the optimal transfer matrix or the anchor selection step. When the same ciphertext equal group is assigned to multiple different plaintext values, only the mapping entry with the highest confidence is retained, and the remaining candidate mappings are considered as errors and discarded, thereby achieving adaptive error correction during the iteration process.

5. The database security assessment method for encrypted SQL queries according to claim 4, characterized in that, The iterative incremental recovery steps specifically include: First, consider two target columns that are statistically correlated with each other. With encrypted columns Each column independently performs the anchor point selection step, resulting in an initial set of anchor points for both columns. and And denoted as the current anchor point set respectively. and ; In the In the round of iteration, with Anchor point set As a dependency, a cross-column recovery step is performed to restore... More candidate mapping sets After performing a union operation on these mapping sets and resolving conflicts on the union, an intermediate result is obtained. Similarly, with Anchor point set As a dependency, after performing the cross-column recovery step and union conflict resolution, we obtain Intermediate results ; Subsequently, respectively and By performing conflict resolution and the selection of the highest confidence level, we obtain the updated mapping set. and The newly added entries are defined as the anchor set for the new iteration. and ; When a round of iteration ends, it is detected that and If all values ​​are empty, it indicates that no new high-confidence anchor points can be generated under the current joint distribution and threshold settings, and the iteration process is terminated. For the set of equal group indices that have not yet been mapped, select the set of plaintext values ​​that have not yet been assigned, and execute the mapping reasoning process in the anchor selection step again to complete the mapping relationship of the remaining equal groups and merge them into the final mapping result set. Finally, complete plaintext and ciphertext mapping results are obtained on the two columns.

6. A database security assessment system for encrypted SQL queries, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke the program instructions stored in the memory to implement the database security assessment method for encrypted SQL queries as described in any one of claims 1 to 5.

Images