Abstract: CryptDB is a typical encrypted data storage technology that uses onion encryption algorithm to rewrite the SQL statement to the different columns of the onion, so that only partial attributes of data are exposed for conducing different operations. To overcome the multiple weaknesses of onion encryption algorithm, this paper proposes a new Crypt-JDBC model: (1) As the existence of too many layers of onion, and poor inheritance of neighbor layers, the new model compresses layers of onion, and divides onion-fields into the main field and auxiliary fields (the main field uses a two-way algorithm for restoring the plain text, and the auxiliary fields use one-way algorithm for operations and security); (2) As the existence of inefficient join function, the new model simplifies one important part (difference transformation) to reduce complexity; (3) As the existence of low corresponding between the names of columns and fields, the new model redesigns the corresponding relationship between columns (plain text) and fields (cipher text), reduces the context information, and enhances the integrity of keys. This paper implements the Crypt-JDBC model, and uses JDBC to replace the middleware MySQL-Proxy. The experimental results show that the model is efficient.

Key words: CryptDB, crypto database, Crypt-JDBC model, onion encryption algorithm, cipher text database

摘要： CryptDB是一种典型的密文存储技术，它根据运算操作语义使用洋葱加密算法将SQL语句改写到不同的洋葱密文列，从而仅暴露数据的部分属性即可执行查询任务。针对洋葱加密算法的不足之处提出了一种名为Crypt-JDBC的改进模型：（1）鉴于洋葱层数多，且相邻层功能差异大，新模型把洋葱列分为主列与辅助列，并压缩洋葱层的改进方法（主列使用双向算法可还原明文，辅助列使用单向算法提供属性，保证安全性）；（2）鉴于等值连接算法复杂低效，新模型通过简化一个关键模块（差异性转换）来降低复杂度；（3）鉴于列名的明文、密文名称对应性弱，新模型重新设计了明密文列名称的对应关系，减少了上下文信息，加强了密钥整体性。实现了Crypt-JDBC模型，用JDBC替换中间件软件MySQL-Proxy。实验结果表明，该模型具有较高的执行效率。

关键词: CryptDB, 加密数据库, Crypt-JDBC模型, 洋葱加密算法, 密文数据库