A multi-keyword query method based on vector inner product encryption

Abstract

The application provides a multi-keyword query method based on vector inner product encryption, and relates to the field of cloud computing security.The core idea of the application is to ensure that each query user has a unique key through re-encryption technology, and to integrate additive secret sharing into a double cloud framework.Based on EIPE, each query user can encrypt the query keyword vector with an independent key, and the file keyword vector can be securely stored through secret sharing.Finally, multi-keyword query is realized through secure inner product calculation.This method can guarantee the privacy of file keywords and query keywords, and ensure that each query user has a different key, making it more suitable for real-world environments.The method ensures that each query user has a different key through re-encryption, and ensures the privacy of the query keyword vector based on additive secret sharing.The method is based on lightweight encryption primitives, which can effectively improve query efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud computing security, and particularly relates to a multi-keyword query method based on vector inner product encryption supporting multiple users. BACKGROUND

[0002] With the deep popularization of technologies such as the Internet of Things and the mobile Internet, the data scale is continuously growing at a high speed. In order to fully release the data value and promote data sharing services, a data processing platform with large-capacity storage capability and high-performance computing capability is urgently needed. Cloud computing, as an elastic and efficient computing mode, provides good technical support for large-scale data storage and sharing technologies. However, with the convergence of massive data in the cloud, data security problems are becoming increasingly serious.

[0003] In order to protect data security, the existing research suggests that the data should be encrypted before being outsourced to the cloud platform for storage. In this way, the original data can be protected, and the demand for data privacy protection can be effectively met. However, data encryption makes it difficult to carry out many services, such as data retrieval. In order to solve this problem, a potential solution is to extract keywords from data files, convert these keywords into vectors, and then use vector inner product encryption technology to achieve multi-keyword retrieval while effectively protecting data.

[0004] Vector inner product encryption allows the vector inner product value to be obtained without decrypting the vector, and has good application prospects. For example, when carrying out multi-keyword retrieval in the medical field, in order to protect patient privacy and medical record data security, the hospital (data owner) first extracts multi-keywords from the original electronic medical record, and marks the keywords contained in the medical record file as 1 and the keywords not contained as 0 according to a unified medical keyword list to generate a 0 / 1 binary vector; then the file keyword vector is encrypted by using the vector inner product function encryption technology and outsourced to the medical cloud platform. When a query user needs to retrieve similar medical records for auxiliary diagnosis and treatment, the user first determines the keywords according to the diagnosis and treatment needs, and then uses the same keyword list and coding method as the hospital to encode the multi-keywords into a 0 / 1 query keyword vector, and then encrypts the query keyword vector to form a query trapdoor by using the vector inner product function encryption technology. In this way, the cloud platform can calculate the inner product of two encrypted vectors by using the vector inner product function encryption technology without knowing the vector plaintext, and return similar medical records.

[0005] The vector inner product encryption scheme IPE is specifically described as follows: the data owner sends the encrypted vector to the cloud server, the query user forms a trapdoor by encrypting the vector , and sends it to the cloud server, and the cloud server obtains and inner product value. The vector inner product function encryption of this scheme can ensure the efficiency of vector inner product calculation, but there are the following problems: (1) it is difficult to apply to a multi-user environment. The IPE scheme requires all users to use the same key for vector encryption in the multi-user vector inner product calculation scenario; (2) the IPE scheme needs to complete the vector inner product calculation under the premise of knowing the vector Therefore, how to provide efficient and secure vector inner product encryption in a multi-user scenario to support secure multi-keyword query is still a problem to be solved. SUMMARY

[0006] To solve the above-mentioned defects in the prior art, the present application uses an enhanced vector inner product encryption scheme (Enhanced Inner Product Encryption, EIPE) to realize secure multi-keyword query, which is suitable for a non-collusion double cloud environment. The core idea of EIPE is to ensure that each query user has a unique key through re-encryption technology, and to integrate additive secret sharing into the double cloud framework. Based on EIPE, each query user can encrypt the query keyword vector with an independent key, and the file keyword vector can be securely stored through secret sharing, and finally the multi-keyword query is realized through secure inner product calculation.

[0007] A multi-keyword query method based on vector inner product encryption, comprising the following steps:

[0008] The key distribution center first executes the EIPE key generation algorithm to generate a key and distributes it to the data owner, the query user and the cloud server;

[0009] The data owner first converts the keyword corresponding to each file into a file keyword vector according to the keyword list; then executes the EIPE file keyword vector encryption algorithm to encrypt the file keyword vector and sends it to the cloud server;

[0010] Each query user executes the EIPE query keyword vector encryption algorithm to generate a trapdoor for its own query keyword vector, including a first trapdoor and a second trapdoor, and sends the first trapdoor to the first cloud server and the second trapdoor to the second cloud server;

[0011] After receiving the trapdoor of the query user, the cloud server executes the EIPE partial vector inner product calculation algorithm to generate a partial vector inner product value, and then executes the EIPE final vector inner product calculation algorithm to obtain the final vector inner product value, and obtains the file that best satisfies the multi-keyword query according to the inner product value.

[0012] The EIPE key generation algorithm is specifically: given a security parameter and a vector dimension , a master public key is generated , master private key , user key and decryption key , wherein n represents the number of query users, and j is the index of the query user.

[0013] The EIPE file keyword vector encryption algorithm is based on the master public key and the file keyword vector to generate a ciphertext vector .

[0014] The EIPE query keyword vector encryption algorithm is based on the query keyword vector and the user key , and the query user generates a query trapdoor ; The keys are the first-1 secret vector of the query vector, the second-1 secret vector of the query vector, the first-2 secret vector of the query vector, and the second-2 secret vector of the query vector, respectively; finally, the query user sends as the first trapdoor to the first cloud server , and sends as the second trapdoor to the second cloud server .

[0015] The EIPE partial vector inner product calculation algorithm is based on the ciphertext vector and the query trapdoor , wherein , the cloud server calculates the partial vector inner product based on the decryption key ;

[0016] Then the EIPE final vector inner product calculation algorithm multiplies the first partial vector inner product value from the first cloud server with the second partial vector inner product value of the second cloud server itself to obtain the final vector inner product value .

[0017] Compared with the prior art, the above technical solution has at least the following beneficial effects:

[0018] (1) This method can ensure the privacy of file keywords and query keywords, and can ensure that each query user has different keys, which is more suitable for real environment;

[0019] (2) This method ensures that each query user has different keys through the re-encryption idea, and ensures the privacy of the query keyword vector based on additive secret sharing;

[0020] ​(3) The method is based on a lightweight encryption primitive, and can effectively improve query efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 A system model diagram of the present application.

[0022] Figure 2 A query process example diagram of the present application. DETAILED DESCRIPTION

[0023] The present application will be described in detail below with specific examples. The following examples will help those skilled in the art to further understand the present application, but do not limit the present application in any form. It should be noted that for those skilled in the art, these embodiments are only used to explain the technical principles of the present application, and are not intended to limit the scope of the present application.

[0024] As shown in Figure 1 The present application provides a multi-keyword query method based on vector inner product encryption. The system model of the method includes four types of entities, namely a key distribution center, a data owner, a query user and a cloud server. The key distribution center is trusted, the data owner and the query user are honest, i.e. they will not intentionally leak their own keys to other entities, and the cloud server is honest and curious, i.e. they will honestly execute the predefined protocol and algorithm, but will speculate the plaintext value of the vector according to the execution process. In addition, the cloud servers are not colluding. The work contents of each entity are as follows:

[0025] Key distribution center: This entity is a trusted entity, which is responsible for generating keys for each entity in the system.

[0026] Data owner: This entity is a trusted entity that owns a large amount of file data. In order to achieve secure sharing and retrieval of data, the data owner first converts the keywords corresponding to each file into a file keyword vector according to the keyword list; then encrypts the file keyword vector according to EIPE, and sends the ciphertext to the cloud server.

[0027] Query user: This entity is a trusted entity. When keyword query is needed, the query keyword vector is converted according to the keyword list, and then the query trapdoor is generated using EIPE, and the trapdoor is sent to the cloud server.

[0028] Cloud server: This entity is an honest but curious entity, which will honestly execute the predefined algorithm and protocol, but will intentionally or unintentionally speculate data privacy. After receiving the trapdoor from the query user, the cloud server performs vector inner product calculation using EIPE, finds the file that best satisfies the query condition according to the inner product result, and returns it to the query user.

[0029] To realize the secure multi-keyword query, the EIPE scheme proposed by the application is introduced in detail as follows. Specifically:

[0030] The key distribution center first executes the EIPE key generation algorithm to generate the keys and distribute them to the data owner, the query user and the cloud server;

[0031] The data owner executes the EIPE file keyword vector encryption algorithm to encrypt the file keyword vector and send it to the cloud server;

[0032] The query user executes the EIPE query keyword vector encryption algorithm to generate the query trapdoor for the query keyword vector and send it to the cloud server;

[0033] After receiving the query trapdoor, the cloud server first executes the EIPE partial vector inner product calculation algorithm to generate the partial vector inner product value, and then executes the EIPE final vector inner product calculation algorithm to obtain the final vector inner product value and obtain the file that best satisfies the multi-keyword query according to the inner product value. The various algorithms mentioned are as follows:

[0034] The EIPE key generation algorithm: given the security parameters and the vector dimension , the algorithm generates the master public key , the master private key , the user key and the decryption key , wherein n represents the number of query users, j is the index of the query user, and the formal representation is ;

[0035] Further, the key distribution center first generates a cyclic group , the order of the cyclic group is a large prime number , and the generator is ; then a set of dimensional vectors are randomly generated from the multiplicative group of order , for , each is an integer value randomly selected from the multiplicative group . The master private key and the master public key are set; is an element generated by the generator and the private key index . Then, for each query user The algorithm originates from the multiplication group A random one is generated in the middle. 3D random vector And set up query users The k-th component of the user key and query user The k-th component of the decryption key , . , Representing the master private key respectively The k-th component and the query user random vectors The k-th component. Finally, the key distribution center broadcasts the master public key. Give the user's private key to all entities Send to the query user , decryption key Send to the first cloud server Second cloud server .

[0036] EIPE file keyword vector encryption algorithm: given the master public key and document keyword vectors The algorithm generates ciphertext vectors. Formal representation as .

[0037] Furthermore, the data owner first randomly selects a random number. Then use generators With random numbers Obtain the randomization term Based on the generator and the master public key And the file keyword vector, the data owner calculates the ciphertext value item. ,in It is the master key number Each component Power of 1 It is the keyword vector of the first Values ​​of each dimension Mapped to group elements. Finally, the data owner is set. .

[0038] EIPE Query Keyword Vector Encryption Algorithm: Given a query keyword vector and user key Query user Generate query traps . The keys are the query vector's (1-1)th secret vector, query vector's (2-1)th secret vector, query vector's (1-2)th secret vector, and query vector's (2-2)th secret vector, formally represented as: .

[0039] Furthermore, for each dimension of the query keyword vector The user first starts from Choose a random number from the list, denoted as . Then calculate ;

[0040] For each dimension of the query keyword vector The user first starts from Choose a random number from the list, denoted as . Then calculate ;

[0041] According to the vector sum vector Query user to calculate vector sum vector That is, for each dimension of the vector. ,calculate and ;

[0042] Finally, query the user's sent As the first trapdoor, it is given to the first cloud server. ,send As a second trapdoor, it is given to the second cloud server. .

[0043] EIPE Partial Vector Inner Product Calculation Algorithm: Given a ciphertext vector and query traps ,in cloud server Based on decryption key Calculate the dot product of partial vectors Formalization .

[0044] Furthermore, cloud servers first from Obtain ;according to and Calculate the first Partial Integrals ;according to , and Calculate the first Partial Integral Denominator ;according to and Calculate the first Partial vector inner product value .

[0045] EIPE final vector inner product calculation algorithm: given the first partial vector inner product value from the cloud server , the cloud server combines its own second partial vector inner product value to calculate the final vector inner product value , formalized as , the formula is as follows:

[0046]

[0047] EIPE is based on the deterministic Diffie-Hellman (DDH) assumption, and can resist selective chosen plaintext attack (s-IND-CPA, Selective Against Chosen Plaintext Attacks), so it can guarantee the file keyword vector privacy. In addition, according to the security of additive secret sharing, any cloud server cannot deduce the plaintext of the query keyword vector from the query trapdoor from its own perspective, thereby ensuring the query keyword vector privacy.

[0048] The correctness analysis of EIPE is as follows: given the file keyword vector , the data owner runs the EIPE file keyword vector encryption algorithm to obtain the ciphertext vector , and sends to the cloud server and the cloud server and ; given the query keyword vector , the query user runs the EIPE query keyword vector encryption algorithm to obtain the trapdoor , and sends the first trapdoor to the first cloud server , and the second trapdoor to the second cloud server . According to and , the cloud server executes the EIPE partial vector inner product calculation algorithm to obtain the first partial vector inner product value , where the calculation process of is as follows:

[0049]

[0050] Similarly, according to and , the cloud server ​The EIPE partial vector inner product calculation algorithm is executed to obtain a second partial vector inner product value wherein The calculation process is shown as follows:

[0051]

[0052] Given , the cloud server combines its own and calculates the final vector inner product value according to the EIPE final vector inner product calculation algorithm , The calculation process is shown as follows.

[0053]

[0054] Finally, since the maximum value of the vector inner product value is , the cloud server calculates the corresponding vector inner product value according to and completes the calculation.

[0055] Therefore, in combination with the EIPE, the workflow of each entity is as follows:

[0056] The key distribution center first runs to generate the master public key and the master private key and the user key and the decryption key , representing the number of query users. Finally, the key distribution center broadcasts the master public key to all participants, sends the user key to the query users , and sends the decryption key to the cloud server and .

[0057] The data owner is responsible for encrypting the file keyword vector of his own to form a ciphertext vector, and sending the ciphertext vector to the cloud server. Specifically, the data owner has the master public key , which runs the vector encryption algorithm to encrypt the file keyword vector into a ciphertext vector , and sends the ciphertext vector to the cloud server and the cloud server .

[0058] Suppose there are query users in the system, and the set of all query users is represented by the symbol , where Each user is responsible for generating trapdoors for their own vectors, including a first trapdoor and a second trapdoor, and sending the first trapdoor to the cloud server. Send the second trapdoor to the cloud server. Specifically, querying users Possess a unique user key Its trapdoor generation algorithm For your own query keyword vector Generate a trapdoor and the first trap gate Send to cloud server The second trapdoor Send to cloud server .

[0059] The cloud server is responsible for performing calculations on the received vector computation requests and outputting the corresponding vector inner product result. Specifically, when the cloud server... Received information about vectors from the querying user The first trap Then, for the ciphertext vector cloud server Execute partial decryption algorithm The first part of the vector inner product result is obtained. And send to the cloud server Similarly, when cloud servers Received information about vectors from the querying user The second trap Then, for the ciphertext vector cloud server Execute partial decryption algorithm The second part of the vector inner product result is obtained. Finally, cloud servers. based on and Execute the final decryption algorithm Get information about vectors sum vector inner product result And find the file that best meets the query conditions based on the inner product result.

[0060] Next, taking the scenario of multi-keyword retrieval of electronic medical records in the medical field as an example, we will demonstrate the steps of the proposed method in detail.

[0061] Step 1: Assume the vector dimension (These represent keywords: hypertension, diabetes, hyperlipidemia, myocardial infarction, and hyperthyroidism, respectively.) The hospital, as the data owner, possesses three medical records. medical staff The query user has a query keyword vector , medical staff The query user has a query keyword vector , the key distribution center generates corresponding keys for each entity in the system.

[0062] Step 1.1: Given and , the key distribution center runs algorithm to generate ;

[0063] Step 1.2: The key distribution center sends the master public key to the hospital;

[0064] Step 1.3: The key distribution center sends the user key to the medical staff , and the user key to the medical staff ;

[0065] Step 1.4: The key distribution center sends the decryption key and to the server and cloud server .

[0066] Step 2: The hospital encodes three electronic medical records: medical record (containing "hypertension", "heart attack") into file keyword vector , medical record (containing "diabetes", "high blood lipids", "hyperthyroidism") into file keyword vector ; medical record (containing "hyperthyroidism") into file keyword vector , and encrypts each vector to form a ciphertext vector, and sends the ciphertext vector to the cloud server and cloud server .

[0067] Step 2.1: The hospital executes algorithm according to its own master public key to encrypt , , into ciphertext vectors , , respectively;

[0068] Step 2.2: The hospital sends the ciphertext , and to the cloud server and the cloud server .

[0069] Step 3: The medical staff encrypts the query keyword vector to form a query trapdoor, and sends the first trapdoor to the cloud server , and sends the second trapdoor to the cloud server .

[0070] Step 3.1: The medical staff determines the target keywords as "hypertension", "heart attack" and "high blood fat" according to the diagnosis and treatment needs, and generates a query keyword vector according to the unified coding rule ;

[0071] Step 3.2: Then, according to the user key , the algorithm is executed to encrypt the query keyword vector into a trapdoor ;

[0072] Step 3.3: The medical staff sends the first trapdoor to the cloud server , and sends the second trapdoor to the cloud server ;

[0073] Step 3.2: The medical staff determines the target keywords as "diabetes", "hyperthyroidism" and "hypertension" according to the diagnosis and treatment needs, and generates a query keyword vector according to the unified coding rule ;

[0074] Step 3.4: Then, according to the user key , the algorithm is executed to encrypt the query keyword vector into a trapdoor ;

[0075] Step 3.5: The medical staff sends the first trapdoor to the cloud server , and sends the second trapdoor to the cloud server .

[0076] Step 4: When receiving the query request from the medical staff, the cloud server and the cloud server jointly calculate the vector inner product result, and the specific process is shown in Figure 2 .

[0077] Step 4.1: For the query request ​​, cloud server perform and store the result in ; perform and store the result in ; perform and store the result in ; cloud server send the first part of inner product vectors to the cloud server ;

[0078] Step 4.2: for the query request , the cloud server perform and store the result in ; perform and store the result in ; perform and store the result in ;

[0079] Step 4.3: according to the first part of inner product vectors and the second part of inner product vectors , the cloud server get the inner product value 2 according to ; get the inner product value 1 according to ; get the inner product value 0 according to ; finally, return the most similar medical record file to the medical staff ;

[0080] Step 4.4: for the query request , the cloud server perform and store the result in ; perform and store the result in ; perform and store the result in ; cloud server send the first part of inner product vectors to the cloud server ;

[0081] Step 4.5: for the query request , the cloud server perform and store the result in ; perform and store the result in ; perform and store the result in ;

[0082] Step 4.6: According to the first part inner product vector and the second part inner product vector , the cloud server According to get inner product value 1; according to get inner product value 2; according to get inner product value 1; finally, according to the inner product value, return the most similar medical record file to the medical staff .

[0083] It can be understood that the present application is described by some embodiments, and those skilled in the art know that various changes or equivalent replacements can be made to these features and embodiments without departing from the spirit and scope of the present application. In addition, under the guidance of the present application, modifications can be made to these features and embodiments to adapt to specific conditions and materials without departing from the spirit and scope of the present application. Therefore, the present application is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of the present application are within the scope of the present application.

Claims

1. A multi-keyword query method based on vector inner product encryption, characterized in that, The method comprises the following steps: The key distribution center first executes the EIPE key generation algorithm to generate a key and distribute it to the data owner, the query user and the cloud server; The data owner first converts the keyword corresponding to each file into a file keyword vector according to a keyword list; then executes the EIPE file keyword vector encryption algorithm to encrypt the file keyword vector and sends it to the cloud server; Each query user executes the EIPE query keyword vector encryption algorithm to generate a trapdoor for the query keyword vector thereof, including a first trapdoor and a second trapdoor, and sends the first trapdoor to the first cloud server and the second trapdoor to the second cloud server; After receiving the trapdoor of the query user, the cloud server executes the EIPE partial vector inner product calculation algorithm to generate a partial vector inner product value, then executes the EIPE final vector inner product calculation algorithm to obtain a final vector inner product value, and obtains a file that most satisfies the multi-keyword query according to the inner product value. The EIPE query keyword vector encryption algorithm is based on a query keyword vector and a user key , a query user generates a query trapdoor ; The keys are query vector 1-1 secret vector, query vector 2-1 secret vector, query vector 1-2 secret vector and query vector 2-2 secret vector respectively; finally, the query user sends to the first cloud server as the first trapdoor , and sends to the second cloud server as the second trapdoor ; The EIPE key generation algorithm is specifically calculated as follows: The key distribution center first generates a circular group. The order of this cyclic group is a large prime number. The generator is Then from the steps multiplication group A set of random elements is generated. dimensional vector ,for Each From the multiplication group A uniformly randomly selected integer value is used to set the master private key. and the master key , Using generators and private key index To generate elements; then, for each query user... ,from A random one is generated in the middle. 3D random vector And set up query users The k-th component of the user's private key and query user The k-th component of the decryption key , ; , Representing the master private key respectively The k-th component and the query user random vectors The k-th component. 2.The multi-keyword query method based on vector inner product encryption of claim 1, wherein, The EIPE key generation algorithm is specifically: given security parameters and vector dimensions , generate a master public key, a master private key, a user key, and a decryption key; The key distribution center broadcasts a master public key to all entities, sends a user private key to the query user, and sends a decryption key to the first cloud server and the second cloud server.

3. The method of claim 2, wherein, The EIPE file keyword vector encryption algorithm generates a ciphertext vector based on the master public key and the file keyword vector.

4. The multi-keyword query method based on vector inner product encryption according to claim 3, characterized in that, The EIPE partial vector inner product computation algorithm is based on ciphertext vectors and query trapdoors wherein , a cloud server based on a decryption key computes partial vector inner products ; Then the EIPE final vector inner product calculation algorithm multiplies the first partial vector inner product value from the first cloud server with the second partial vector inner product value from the second cloud server itself to obtain the final vector inner product value .

5. The multi-keyword search method based on vector inner product encryption according to claim 4, characterized in that, The EIPE file keyword vector encryption algorithm is specifically calculated as follows: The data owner first randomly selects a random number. Then use generators With random numbers Obtain the randomization term Based on the generator and the master public key And the file keyword vector, the data owner calculates the ciphertext value item. ,in It is the master key number Each component Power of 1 It is the keyword vector of the first Values ​​of each dimension Mapped onto group elements; finally, the data owner sets the ciphertext vector. .

6. The multi-keyword search method based on vector inner product encryption according to claim 5, wherein, The EIPE query keyword vector encryption algorithm is specifically calculated as follows: For each dimension of the query keyword vector , the query user first selects a random number from , denoted as , and then calculates ; For each dimension of the query keyword vector , the query user first selects a random number from , denoted as , and then calculates ; According to the vector and the vector , the user calculates the vector and the vector ; that is, for each dimension k of the vector and ; Finally, the query user sends to the first cloud server as a first trapdoor , and sends to the second cloud server as a second trapdoor .

7. The method of claim 6, wherein, The EIPE partial vector inner product calculation algorithm is specifically calculated as follows: The EIPE partial vector inner product calculation algorithm is specifically calculated as follows: The cloud server first obtains ; calculates the first partial integral numerator according to and ; calculates the first partial integral denominator according to , and ; and calculates the first partial vector inner product value according to and .​

Images