【摘要】 基于可信执行环境的加密数据库方案相较于其他技术路径具有显著的性能优势,然而在索引结构设计方面仍面临安全挑战。现有方案存在数据顺序信息泄露与解密接口滥用等风险。针对上述问题,文章提出一种基于可信执行环境的加密数据库索引安全增强方案。该方案采用基于动态对称可搜索加密的索引结构,在加快等值查询与范围查询速度的同时,确保索引结构的信息泄露可控。此外,文章设计了一种嵌入索引的验证机制,以防止恶意攻击者通过任意调用接口获取敏感数据的明文信息。安全性分析表明,文章所提方案在保护数据隐私的同时,能够有效抵御恶意接口调用攻击。在Intel SGX环境下的性能测试结果表明,与无索引方案相比,文章所提方案显著提升了查询效率；与存在信息泄露的索引方案相比,文章所提方案在查询效率上保持相当水平,并在更新效率、验证机制轻量化以及可信区内数据处理量等指标上展现出良好的可行性。更多还原

【Abstract】 The scheme of encrypted database based on trusted execution environment has significant performance advantages compared with other schemes, but it faces security challenges in the design of index structure. The existing schemes will leak data sequence information and there is a threat of abuse of decryption interface. To address the above problems, this paper proposed a security-enhanced index scheme in encrypted database based on trusted execution environment. The scheme accelerated equivalent and range queries by using an index structure based on dynamic searchable symmetric encryption to ensure that the index structure leakage was controllable. In addition, this paper designed a verification mechanism for embedded indexes to prevent malicious attackers from obtaining the plaintext information of sensitive data through arbitrary called to the interface. This paper conducted a security analysis, which proved that the scheme in this paper effectively prevented malicious arbitrary call attacks while protecting data privacy. This paper conducted performance tests in the Intel SGX environment, and the results show that the index in this paper significantly improves the query efficiency compared to the no-index scheme. Compared with the leaked index scheme, the efficiency is flat, and it is also feasible in indicators such as update efficiency, verification mechanism lightweight, and trusted area processing data volume.更多还原