Keyword semantic extension symmetric searchable encryption method based on SGX

Abstract

The invention provides an SGX-based keyword semantic extension symmetric searchable encryption method, and relates to the technical field of searchable encryption. Semantic extension of a query keyword is combined with a searchable encryption technology, a secure channel is established by using an Intel SGX technology, a public key, a master key and keyword semantic extension model parameters are encrypted by using a session key and are sent to a data user through the secure channel, the keyword requested to be queried is loaded into a local trusted execution environment SGX, and the keyword semantic extension model parameters are sent to the data user through the SGX. The method comprises the following steps of: performing semantic extension and encryption on a requested query keyword, generating a semantic extension keyword search token, returning the search token to a data user, accessing a cloud server by the data user by using the search token, acquiring an encrypted document with the highest relevancy as a search result by the cloud server, decrypting the encrypted document by using a symmetric key, and sending the encrypted document to the data user. And outputting the search result plaintext document.

Description

Technical Field

[0001] The present invention relates to the field of searchable encryption technology, and in particular to a keyword semantic extension symmetric searchable encryption method based on SGX. Background Art

[0002] With the development of informatization, more and more sensitive data needs to be stored and processed in the cloud or on third-party platforms. In order to protect this data and ensure that it is not accessed by unauthorized parties during storage and transmission, encryption technology is widely used. However, due to the reduced availability of encrypted data, its retrieval becomes more complicated compared to plain text.

[0003] Most of the existing traditional ciphertext retrieval schemes usually rely on literal matching of keywords for information query without considering context or semantic extension. This will result in multiple ciphertext searches and encryption and decryption operations for the same object due to different query keywords, which greatly consumes the system computing power. This method requires users to provide keywords that accurately match the encrypted index, but often does not work well when processing complex queries and semantic searches. Using semantically extended symmetric searchable encryption technology, only one search is needed for a class of related targets and query results for related targets can be obtained, and they can be sorted according to relevance, saving system computing power. Semantic search can accurately analyze the user's search intention at the semantic level and return semantic information that reflects the user's potential search motivation. However, the existing semantically extended searchable encryption system uses a traditional technical architecture for implementation, and secret state calculations increase the system's computing overhead. Therefore, providing an efficient semantically extended searchable encryption method is an urgent problem to be solved. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a keyword semantic expansion symmetric searchable encryption method based on SGX in response to the above-mentioned deficiencies in the prior art, which ensures the privacy and security of the data, solves the problem that the traditional outsourcing system does not support keyword synonym query, and reduces system overhead, making semantic expansion searchable encryption in a cloud environment possible.

[0005] A keyword semantically extended symmetric searchable encryption method based on SGX includes the following steps:

[0006] Step 1: The data owner performs initialization operations to generate public keys, master keys, keyword semantic extension models and parameters;

[0007] Step 1.1: The data owner executes the initialization algorithm to generate the public key and master key;

[0008] The initialization algorithm is shown in the following formula:

[0009]

[0010] Among them, Genkey(1 λ ) is the initialization algorithm; λ is the safety parameter; is the keyword; is a symmetric key, which is the keyword part of;M a and M b The input security parameter λ is obtained dimensional reversible matrix; S is a random dimensional vector, used to encrypt the index node vector and query vector, m is a random number, Random numbers to prevent statistical attacks;

[0011] The expression of the public key is shown in the following formula:

[0012] pk=(λ,F(·))

[0013] Among them, pk is the public key; F(·) is a pseudo-random function (PRF) set by the data owner DO, F: k is the length of the random keyword, is the length of the security parameter;

[0014] The expression of the master key is shown in the following formula:

[0015]

[0016] Among them, mk is the master key; The function generates a symmetric key based on the security parameter λ The function generates a reversible matrix M based on the security parameter λ a and M b , The function generates a random vector S according to the security parameter λ; k 1 ,k 2 ,k 3 For data owners in the mathematical foundation integer group Z p A random number randomly selected from

[0017]

[0018] Step 1.2: The data owner uses the FastText model to generate a keyword semantic expansion model and parameters;

[0019] Step 2: The data owner constructs an AVL-tree index and an inverted index for the plaintext document set, splits and encrypts the index structure to obtain the split and encrypted AVL-tree index and inverted index and synthesizes the secure encrypted index, encrypts the plaintext document to obtain an encrypted document, and stores the secure encrypted index and encrypted document in the cloud server;

[0020] Step 2.1: Use the FastText model to perform word segmentation preprocessing on the plaintext document collection, convert the segmented text into numerical features, and obtain a large data set of word vectors;

[0021] Step 2.2: The data owner uses the BIRCH clustering algorithm to cluster the word vector data set and constructs an AVL-tree index and inverted index based on the clustering results;

[0022] The BIRCH clustering algorithm is used to construct a clustering feature CF tree to organize word vector data. Through the data information in the CF tree, the word vector data is quickly clustered to obtain the clustering results, and based on <keyword-category>, an AVL-tree index is constructed. 1 , Generate <category-document> vector based on clustering results and construct inverted index I 2 ;

[0023] Step 2.3: Split the AVL-tree index and inverted index in sequence;

[0024] Step 2.4: Use the secure knn algorithm to encrypt the segmented AVL-tree index and inverted index to obtain the segmented encrypted AVL-tree index and inverted index, and synthesize the secure encrypted index;

[0025] Step 2.5: Use the Enc algorithm to encrypt the secret key and plaintext document to obtain an encrypted document;

[0026] Step 2.6: The data owner sends the secure encrypted index and encrypted documents to the cloud server for storage;

[0027] Step 3: The data owner performs Intel SGX remote authentication to generate a session key, establishes a secure channel, and verifies whether the Intel SGX on the data user is running securely. If the verification is successful, the data owner encrypts the public key, master key, and keyword semantic extension model parameters through the session key and sends them to the data user through the secure channel; loads the keyword requested by the data user into the local trusted execution environment SGX, semantically expands and encrypts the query keyword requested, generates a semantic extension keyword search token, and then returns the semantic extension keyword search token to the data user;

[0028] Step 3.1: The data user applies to perform Intel SGX remote authentication and generates a session key, establishes a secure channel, and verifies whether Intel SGX on the data user is running securely; if the verification is successful, the public key, master key, and keyword semantic extension model parameters are encrypted using the session key and sent to the data user through a secure channel;

[0029] Step 3.2: By calling the Intel SGX Ecall instruction, the query keyword requested by the data user is loaded into the local trusted execution environment SGX, and the FastText model is used to perform word+gram results according to the query keyword to predict the context, and the top K semantic expansion keywords are returned according to the cosine distance to form a semantic expansion keyword set;

[0030] Step 3.3: Take the first j query results with the closest cosine distance in the semantic expansion keyword set, sort the returned results in descending order, and construct a The corresponding position of each query keyword in the query vector is the probability of the keyword appearing in the semantic expansion keyword set, and the other positions that do not appear are set to 0;

[0031] Step 3.4: Use the secure knn algorithm to encrypt the query vector, and split the query vector in sequence according to the value of the vector S in the {0,1} space in step 1.1;

[0032] The process of splitting the query vector is as follows:

[0033]

[0034] in, To construct based on j query results dimensional query vector, It indicates that the secure knn algorithm splits the query vector according to the value of the random vector S The value of i indicates the order in the array; and When the value i is taken in the array, the query vector is obtained according to the safe knn algorithm The query vector after segmentation;

[0035] Step 3.5: Generate a semantic extension keyword search token and return the semantic extension keyword search token to the data user through the Intel SGX Ocall instruction;

[0036] The generation process of semantic expansion keyword search token is as follows:

[0037]

[0038] Among them, V kED Search tokens for semantically expanded keywords;

[0039] Step 4: The data user uses the semantic extension keyword search token to access the cloud server. The cloud server matches and searches the segmented encrypted AVL-tree index and the inverted index in the secure encrypted index obtained in step 2 based on the semantic extension keyword search token, obtains the id in the segmented encrypted inverted index, and then obtains the index node vector of the document after the inverted index is established for the plaintext document based on the id. The cloud server uses the secure knn product of the semantic extension keyword search token and the index node vector based on the query to obtain the most relevant encrypted document as the search result and returns it to the data user.

[0040] Step 5: After receiving the most relevant encrypted document from the cloud server, the data user uses the symmetric key to decrypt the encrypted document and output the plaintext document of the search result;

[0041] The beneficial effects of adopting the above technical solution are:

[0042] (1) The problem that traditional outsourcing systems do not support keyword synonym queries is solved. By introducing keyword semantic expansion in encrypted data retrieval, it is possible to accurately analyze the user's search intention at the semantic level and return semantic information that reflects the user's potential search motivation. The semantically expanded keywords are encrypted and search tokens are generated. Only one search is required to retrieve relevant search results at one time. This avoids the system overhead of multiple query calculations and improves query efficiency.

[0043] (2) The SGX technology (one of the TEE paradigms) based on the CPU trusted library is introduced. It can open a trusted computing area in the hardware memory of the data user. After the remote authentication is passed, a secure channel can be established between the data owner and the user. By building a trusted environment on the user side, the semantic extension algorithm model parameters, secret keys and secure KNN algorithm of the data owner are placed in the secure trusted execution environment of the data user for operation. With the hardware-level support provided by the SGX technology, the security of the software is enhanced. The SGX trusted environment will strictly protect the confidentiality of program data and code integrity, protect the safe operation of sensitive data and code, and enable data users to obtain multiple query results with the highest correlation as required with a single request. Even during the enclave tearing, they can be encrypted and protected, avoiding the system overhead of multiple queries caused by exact keyword matching, and reducing the computing overhead of the trusted environment. The overall computing power and security of the system are improved, providing users with more efficient and practical data search services. While protecting query privacy and data security, the efficiency and practicality of system search are improved. While improving system performance, it also ensures that unauthorized access to enclaves or memory snooping will not occur.

[0044] The method of the present invention combines Intel SGX technology and keyword semantic expansion to realize symmetric searchable encryption, which improves query efficiency and the practicality of query results. Compared with the traditional outsourced searchable encryption system, it not only ensures the privacy and security of data, but also solves the problem that the traditional outsourced system does not support keyword synonym query, and also reduces system overhead, making semantic expansion searchable encryption in cloud environment possible. The method of the present invention overcomes the deterministic matching search of the traditional encryptable search mode and saves the system computing power of similar target search. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A flowchart of a keyword semantically extended symmetric searchable encryption method based on SGX provided in an embodiment of the present invention;

[0046] Figure 2 An example diagram of the FastText model architecture provided in an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of a self-balancing binary search tree AVL provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0049] The present invention proposes a keyword semantic expansion symmetric searchable encryption method based on SGX, and uses the FastText model, BIRCH clustering algorithm, self-balancing binary search tree AVL, inverted index, symmetric encryption and other technologies to construct a method for converting a single keyword query into a multi-keyword query, and uses the BIRCH clustering algorithm that is more robust to outliers to cluster the text and construct a double-layer index. In the retrieval process, the query keywords are semantically expanded, query semantic expansion keyword search tokens are constructed, and the secure knn technology is used for similarity analysis, and the search document results obtained after the query keyword semantic expansion are returned. This embodiment describes in detail the architecture and algorithm implementation of the system solution, including initialization, key generation, query keyword semantic expansion, encryption, search tokens, ciphertext search, decryption and other functions; finally, the method of the present invention is tested, and the results show that the method of the present invention can effectively implement access control and process ciphertext retrieval requests, and performs well in terms of running stability and computational efficiency in SGX; it ensures a high query efficiency, reduces the query cost of accurate matching, and verifies the practicality of the method.

[0050] In this embodiment, a keyword semantic extension symmetric searchable encryption method based on SGX is provided, such as Figure 1 As shown, the following steps are included:

[0051] Step 1: The data owner performs initialization operations to generate public keys, master keys, keyword semantic extension models and parameters;

[0052] Step 1.1: The data owner executes the initialization algorithm to generate the public key and master key;

[0053] The initialization algorithm is shown in the following formula:

[0054]

[0055] Among them, Genkey(1 λ ) is the initialization algorithm, λ is the security parameter; For keywords, is a symmetric key, which is the keyword part of;M a and M b The input security parameter λ is obtained dimensional reversible matrix; S is a random dimensional vector, used to encrypt the index node vector and query vector, m is a random number, Random numbers to prevent statistical attacks;

[0056] The expression of the public key is shown in the following formula:

[0057] pk=(λ,F(·))

[0058] Among them, pk is the public key; F(·) is a pseudo-random function (PRF) set by the data owner DO, F: k is the length of the random keyword, is the length of the security parameter;

[0059] The expression of the master key is shown in the following formula:

[0060]

[0061] Among them, mk is the master key; The function generates a symmetric key based on the security parameter λ The function generates a reversible matrix M based on the security parameter λ a and M b , The function generates a random vector S according to the security parameter λ; k 1 ,k 2 ,k 3 For the data owner DO in the mathematical foundation integer group Z p A random number randomly selected from

[0062] Step 1.2: The data owner uses the FastText model developed by Facebook AI Research (FAIR) to simplify text classification and word embedding generation, such as Figure 2 As shown, a keyword semantic expansion model and parameters are generated;

[0063] Step 2: The data owner constructs an AVL-tree index and an inverted index for the plaintext document set, splits and encrypts the index structure to obtain the split and encrypted AVL-tree index and inverted index and synthesizes the secure encrypted index, encrypts the plaintext document to obtain an encrypted document, and stores the secure encrypted index and encrypted document in the cloud server;

[0064] The plaintext documents to be processed are processed through a two-layer indexing mechanism. Based on the frequency of keywords in the plaintext document set, the dimension of the index node is reduced, further improving the search efficiency.

[0065] Step 2.1: For the plaintext document set D = {D 1 ,D 2 ,…,D n}Use the FastText model to perform word segmentation preprocessing, convert the segmented text into numerical features, and obtain a large data set of word vectors;

[0066] Step 2.2: The data owner DO uses the BIRCH clustering algorithm to cluster the word vector data set and constructs an AVL-tree index and inverted index based on the clustering results;

[0067] Use the BIRCH clustering algorithm to build a clustering feature CF tree to organize word vector data, thereby reducing computing and storage requirements. Through the data information in the CF tree, the word vector data is quickly clustered to obtain the clustering results. And based on <keyword-category>, construct AVL-tree (self-balancing binary search tree) index I 1 ,like Figure 3 As shown, based on the clustering results Generate <category-document> vector and construct inverted index I 2 ;

[0068] Step 2.3: Split the AVL-tree index and inverted index in sequence;

[0069] For the plaintext document D, obtain the query keyword set W D ={w 1 ,....,w η}, reversible matrix M a 、M b and random dimensional vector S, according to the value of vector S in the {0,1} space, the AVL-tree index I 1 and inverted index I 2 Expand to dimensional vector, splitting the AVL-tree index I in turn 1 :(I 1 ',I 1 ") and inverted index I 2 :(I' 2 ,I 2 ");

[0070] Step 2.4: Use the secure knn algorithm to encrypt the segmented AVL-tree index and inverted index to obtain the segmented encrypted AVL-tree index and inverted index, and synthesize the secure encrypted index;

[0071] Encrypted AVL-tree index based on <keyword-category> I t 'Expressed as Inverted index I' based on <category-document> d Expressed as Synthetic secure encryption index S index Indicated as S index =(I t ',I' d );

[0072] Step 2.5: Use the Enc algorithm to encrypt the secret key and plaintext document to obtain the encrypted document. The encryption process is shown in the following formula:

[0073]

[0074] Among them, C is the encrypted document;

[0075] Step 2.6: The data owner DO sends the secure encrypted index and encrypted document to the cloud server for storage;

[0076] Step 3: The data owner performs Intel SGX remote authentication to generate a session key, establishes a secure channel, and verifies whether the Intel SGX on the data user is running securely. If the verification is successful, the data owner encrypts the public key, master key, and keyword semantic extension model parameters through the session key and sends them to the data user through the secure channel; by calling the Intel SGX Ecall instruction, the keyword requested by the data user is loaded into the local trusted execution environment SGX, the query keyword requested is semantically extended and encrypted, and a semantic extension keyword search token is generated, and then the semantic extension keyword search token is returned to the data user through the Intel SGX Ocall instruction;

[0077] Step 3.1: The data user applies to perform Intel SGX remote authentication and generates a session key, establishes a secure channel, and verifies whether Intel SGX on the data user is running securely; if the verification is successful, the public key, master key, and keyword semantic extension model parameters are encrypted using the session key and sent to the data user through a secure channel;

[0078] Step 3.2: By calling the Intel SGX Ecall instruction, the data is used with the query keyword w requested by the owner. κ ∈W D Loaded into the local trusted execution environment SGX, according to the query keyword w κ ∈W D , use the FastText model to perform context prediction based on the word+gram result, and return the top K semantic expansion keywords based on the cosine distance to form a semantic expansion keyword set;

[0079] Step 3.3: Select the first j query results with the closest cosine distance in the semantic expansion keyword set. For example, if j=5 is selected, it means that 5 results need to be returned. The returned results are sorted in descending order, and a dimensional query vector To represent the keywords to be queried, each query keyword is in the query vector The corresponding position in is the probability of the keyword appearing in the semantic expansion keyword set, and the other positions that do not appear are set to 0;

[0080] Step 3.4: Use the secure knn algorithm to parse the query vector Encryption: split the query vector in sequence according to the value of vector S in the {0,1} space in step 1.1

[0081] The process of splitting the query vector is as follows:

[0082]

[0083] in, The secure knn algorithm splits the query vector according to the random vector S. The value of i indicates the order in the array; and When the value i is taken in the array, the safe knn algorithm is used to obtain The query vector after segmentation;

[0084] Step 3.5: Generate a semantic extension keyword search token, and return the semantic extension keyword search token to the data user DU through the Intel SGX Ocall instruction;

[0085] The generation process of semantic expansion keyword search token is as follows:

[0086]

[0087] Among them, V kED Search tokens for semantically expanded keywords;

[0088] Step 4: The data user uses the semantic extension keyword search token to access the cloud server. The cloud server matches and searches the encrypted AVL-tree index and inverted index in the secure encrypted index obtained in step 2.4 according to the semantic extension keyword search token, and obtains the encrypted inverted index I after the <category-document> segmentation. d ′, and then according to the segmented encrypted inverted index I d ′ id to obtain the index node vector of document IDs after establishing an inverted index for the plaintext document The cloud server uses the secure knn product of the semantically extended keyword search token and the index node vector according to the query, obtains the most relevant encrypted document as the search result, and returns it to the data user;

[0089] The most relevant encrypted document expression is as follows:

[0090] C KWED =(C 1 ,…,C K )

[0091] Among them, C KWED is the set of the top K encrypted documents with the highest relevance, C 1 ,…,C K is the most relevant encrypted document, and K is the number of most relevant encrypted documents;

[0092] Step 5: After receiving the most relevant encrypted document from the cloud server, the data user uses the symmetric key to decrypt the encrypted document and output the plaintext document of the search result;

[0093] The plain text document expression of the search result is as follows:

[0094] D KWED ={D 1 ,D 2 ,…,D n}

[0095] Among them, D KWED is the plaintext document set of search results, D 1 ,D 2 ,…,D n It is the plain text document of the search result;

[0096] The present invention proposes a keyword semantic expansion symmetric searchable encryption method based on SGX, which uses the FastText model, BIRCH clustering algorithm, self-balancing binary search tree AVL, inverted index, symmetric encryption and other technologies, and secure knn to construct a method for converting single keyword queries into multi-keyword queries. A double-layer secure index is constructed, and SGX is used to semantically expand the query keywords and encrypt them to generate search tokens. Then, the topk search results that meet the conditions are returned to the user for decryption by calculating the cosine distance similarity to obtain plain text.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A keyword semantically extended symmetric searchable encryption method based on SGX, characterized by: Step 1: The data owner performs initialization operations to generate public keys, master keys, keyword semantic extension models and parameters; Step 2: The data owner constructs an AVL-tree index and an inverted index for the plaintext document set, splits and encrypts the index structure to obtain the split and encrypted AVL-tree index and inverted index and synthesizes the secure encrypted index, encrypts the plaintext document to obtain an encrypted document, and stores the secure encrypted index and encrypted document in the cloud server; Step 3: The data owner performs Intel SGX remote authentication to generate a session key, establishes a secure channel, and verifies whether the Intel SGX on the data user is running securely. If the verification is successful, the data owner encrypts the public key, master key, and keyword semantic extension model parameters through the session key and sends them to the data user through the secure channel; loads the keyword requested by the data user into the local trusted execution environment SGX, semantically expands and encrypts the query keyword requested, generates a semantic extension keyword search token, and then returns the semantic extension keyword search token to the data user; Step 4: The data user uses the semantically extended keyword search token to access the cloud server. The cloud server matches and searches the segmented encrypted AVL-tree index and inverted index in the secure encrypted index obtained in step 2 based on the semantically extended keyword search token, obtains the id in the segmented encrypted inverted index, and then obtains the index node vector of the document after the inverted index is established for the plaintext document based on the id. The cloud server uses the secure knn product of the semantically extended keyword search token and the index node vector based on the query to obtain the most relevant encrypted document as the search result and returns it to the data user.

2. The SGX-based keyword semantically extended symmetric searchable encryption method according to claim 1, characterized in that: The specific method of step 1 is: Step 1.1: The data owner executes the initialization algorithm to generate the public key and master key; The initialization algorithm is shown in the following formula: Among them, Genkey(1 λ ) is the initialization algorithm; λ is the safety parameter; is the keyword; is a symmetric key, which is the keyword part of;M a and M b The input security parameter λ is obtained dimensional reversible matrix; S is a random dimensional vector, used to encrypt the index node vector and query vector, m is a random number, Random numbers to prevent statistical attacks; The expression of the public key is shown in the following formula: pk=(λ,F(·)) Among them, pk is the public key; F(·) is a pseudo-random function (PRF) set by the data owner DO, k is the length of the random keyword, is the length of the security parameter; The expression of the master key is shown in the following formula: Among them, mk is the master key; The function generates a symmetric key based on the security parameter λ The function generates a reversible matrix M based on the security parameter λ a and M b , The function generates a random vector S according to the security parameter λ; k1, k2, k3 are the data owner’s mathematical foundation integer group Z p A random number randomly selected from Step 1.2: The data owner uses the FastText model to generate a keyword semantic expansion model and parameters.

3. The SGX-based keyword semantic extension symmetric searchable encryption method according to claim 2, characterized in that: The specific method of step 2 is: Step 2.1: Use the FastText model to perform word segmentation preprocessing on the plaintext document collection, convert the segmented text into numerical features, and obtain a large data set of word vectors; Step 2.2: The data owner uses the BIRCH clustering algorithm to cluster the word vector data set and constructs an AVL-tree index and inverted index based on the clustering results; Step 2.3: Split the AVL-tree index and inverted index in sequence; Step 2.4: Use the secure knn algorithm to encrypt the segmented AVL-tree index and inverted index to obtain the segmented encrypted AVL-tree index and inverted index, and synthesize the secure encrypted index; Step 2.5: Use the Enc algorithm to encrypt the secret key and plaintext document to obtain an encrypted document; Step 2.6: The data owner sends the secure encrypted index and encrypted documents to the cloud server for storage.

4. The SGX-based keyword semantic extension symmetric searchable encryption method according to claim 3, characterized in that: The specific method of step 2.2 is: use the BIRCH clustering algorithm to construct a clustering feature CF tree to organize word vector data, quickly cluster the word vector data through the data information in the CF tree to obtain the clustering results, and based on <keyword-category>, construct an AVL-tree index I1, generate a <category-document> vector based on the clustering results, and construct an inverted index I2.

5. The SGX-based keyword semantic extension symmetric searchable encryption method according to claim 4, characterized in that: The specific method of step 3 is: Step 3.1: The data user applies to perform Intel SGX remote authentication and generates a session key, establishes a secure channel, and verifies whether Intel SGX on the data user is running securely; if the verification is successful, the public key, master key, and keyword semantic extension model parameters are encrypted using the session key and sent to the data user through a secure channel; Step 3.2: By calling the Intel SGX Ecall instruction, the query keyword requested by the data user is loaded into the local trusted execution environment SGX, and the FastText model is used to perform word+gram results according to the query keyword to predict the context, and the top K semantic expansion keywords are returned according to the cosine distance to form a semantic expansion keyword set; Step 3.3: Take the first j query results with the closest cosine distance in the semantic expansion keyword set, sort the returned results in descending order, and construct a The corresponding position of each query keyword in the query vector is the probability of the keyword appearing in the semantic expansion keyword set, and the other positions that do not appear are set to 0; Step 3.4: Use the secure knn algorithm to encrypt the query vector, and split the query vector in sequence according to the value of the vector S in the {0,1} space in step 1.1; Step 3.5: Generate a semantically extended keyword search token and return the semantically extended keyword search token to the data user through the Intel SGX Ocall instruction.

6. The SGX-based keyword semantic extension symmetric searchable encryption method according to claim 5, characterized in that: The process of segmenting the query vector in step 3.4 is as follows: in, To construct based on j query results dimensional query vector, It indicates that the secure knn algorithm splits the query vector according to the value of the random vector S The value of i indicates the order in the array; and When the value i is taken in the array, the query vector is obtained according to the safe knn algorithm The query vector after segmentation.

7. The SGX-based keyword semantically extended symmetric searchable encryption method according to claim 6, characterized in that: The generation process of the semantic expansion keyword search token in step 3.5 is as follows: Among them, V kED Search tokens for semantically expanded keywords.

Images