Searchable encryption method for hiding search patterns and access patterns in e-commerce platforms

Abstract

The present invention relates to the field of cloud computing security technology, and specifically to a searchable encryption method for hiding search modes and access modes in an e-commerce platform, including obtaining a data source, an initialization phase, and ciphertext retrieval. First, data is obtained from a public data set; the initialization phase includes extracting the relationship between keywords and documents, constructing an index matrix and an auxiliary data structure, and generating relevant keys. The ciphertext query phase includes: the user generates a search trap for the query keyword and sends it to the server; the server retrieves the secondary mapping according to the search trap, obtains the search range, and retrieves the corresponding data block sequence; the user constructs a permutation matrix, and encrypts and uploads it to the server, and performs homomorphic calculations with the index matrix on the server side to change the position of the data in the index matrix. The present invention integrates secondary search and homomorphic encryption technology into the field of searchable encryption, ensuring user privacy while achieving efficient and secure search, and has important application value for user privacy protection and information retrieval.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing security technology, and in particular to a searchable encryption method for hiding search modes and access modes in an e-commerce platform. Background Art

[0002] With the rapid development of the Internet era, people's lives have gradually entered the information age, and e-commerce platforms are inseparable from modern life. But at the same time, people are also facing the problem of explosive growth of data. For example, the business data of e-commerce platforms has increased dramatically during special periods (Double Eleven, Double Twelve and other promotional activities). Although these massive data have many hidden values ​​in analyzing user behavior, they also bring security issues such as information leakage.

[0003] The introduction of the cloud concept has provided great benefits to society and the IT industry. Storage as a Service (SaaS) is the most common cloud service, which enables users to store data remotely and access it anytime and anywhere, thereby reducing the storage and computing overhead of the client. However, storing data in plain text on cloud servers can easily lead to information leakage, which is not conducive to the protection of user privacy. Although uploading data with encryption can ensure the confidentiality of data, it is not conducive to some basic operations of users. Searchable encryption technology solves the problem of retrieval in the ciphertext domain. Searchable encryption technology was proposed by Song et al. in 2000, and can be simply described as: users with retrieval capabilities use the generated search trap to retrieve encrypted data on the server.

[0004] In recent years, schemes based on searchable encryption technology have emerged in an endless stream. From the initial static scheme to the dynamic scheme. However, many studies have shown that searchable encryption technology improves search efficiency at the cost of leaking some information, which leads to more serious security issues. In order to improve search efficiency, general searchable encryption algorithms leak some information about files or queries to the server, such as search patterns, access patterns, etc. Search patterns refer to the user's historical queries, and repeated queries are easily identified by the same search token; access patterns refer to the user's access path, and repeated queries are easily identified by the same access path. It is generally believed that searchable encryption schemes do not reveal user data and query information except for the information disclosed by the property file (Leakage Profile), so searchable encryption schemes are considered safe. However, in the real world, attackers can launch statistical attacks through these leaked information to recover user data and query information. For example, Liu et al. used search pattern leakage to launch attacks and obtain user query information. Zhang et al. can completely reveal the client's query through file injection attacks and recover user data and query information. Therefore, existing searchable encryption algorithms have the problem of search pattern and access pattern leakage, but there are few solutions to solve these two problems at the same time.

[0005] In order to solve the above problems, some solutions have emerged, but most of the research focuses on forward security and backward security. For example, although the oblivious random access mechanism (ORAM-based solution) can hide the access mode and search mode to a certain extent, it mainly obfuscates each access process to make it indistinguishable from random access. Therefore, additional operations are required to protect the access mode, which usually brings great overhead and is not suitable for general cloud application environments. In principle, solutions that do not leak any information to the server can be built based on powerful technologies, such as secure multi-party computing (such as PIR) and fully homomorphic encryption. However, although secure multi-party computing (such as PIR) and fully homomorphic encryption can solve the problem of information leakage, they require powerful external devices and such systems are very expensive, so they are not suitable for general cloud application environments. Recent studies have shown that some solutions use multiple servers to achieve hidden search patterns. For example, the patent publication number CN110427771A, entitled "A Searchable Encryption Method and Cloud Server for Hiding Retrieval Patterns", discloses a method of using auxiliary servers to assist cloud servers to perform retrieval, and in the retrieval process, using additive homomorphism to generate result polynomials to ensure that search results will not leak any information other than the information the user wants. This method can not only hide search patterns, but also support multi-keyword queries. Hoang et al. (T. Hoang, AAYavuz, and J. Guajardo, "Practical and secure dynamic searchable encryption via oblivious access on distributed data structure," in Proceedings of the 32nd Annual Conference on Computer Security Applications, 2016, pp. 302–313.) discloses an algorithm for inadvertently accessing encrypted data structures, which is based on distributed data structures. In the above-mentioned method of using multiple servers to achieve hidden search patterns, data exchange between multiple servers will cause information leakage and pose security risks; in addition, new security issues caused by collusion between malicious servers cannot be avoided. Summary of the invention

[0006] In order to solve the above problems, the present invention provides a searchable encryption method for hiding search modes and access modes in an e-commerce platform. The searchable encryption method is based on a single server and combines secondary search, 1-out-of-n oblivious transfer protocol and Paillier encryption algorithm to protect the privacy of user information. It can achieve safe and efficient retrieval of data on a cloud server while protecting user privacy to the greatest extent.

[0007] A searchable encryption method for hiding search patterns and access patterns in an e-commerce platform comprises the following steps:

[0008] S1. Obtain the original data, pre-process the original data, use the Porter stemming algorithm to process the data, delete duplicate data and invalid data, structure the unstructured data, obtain the pre-processed data and store it locally;

[0009] S2, initialization phase: the user generates the required symmetric key and asymmetric key; first, based on the preprocessed data, filter out useless data in the file, extract the relationship between keywords and files, build an index matrix based on the relationship between keywords and documents, encrypt the index matrix with the symmetric key, and generate a security index; encrypt the file with the symmetric encryption algorithm to generate an encrypted file; build an auxiliary data structure to meet the user's inadvertent access; upload the generated security index, encrypted file and auxiliary data structure to the server;

[0010] S3, ciphertext retrieval: the user generates a search trap and initiates a search request to the server; after the server receives the user's search request, the server executes the query process according to the search trap and completes the search; after the search is completed, the server's index matrix is ​​shuffled.

[0011] Further, the generation of the symmetric key includes: using a tuple ε (Gen, Enc, Dec) encryption algorithm to generate the symmetric key, and the implementation process of the tuple ε (Gen, Enc, Dec) encryption algorithm includes:

[0012] Key generation: Input security parameter κ and output key k, the expression is: k←ε.Gen(1 κ );

[0013] Encryption based on key k: Input key k and plaintext information m, output encrypted ciphertext c, the expression is: c←ε.Enc k (m);

[0014] Decryption: Input key k and ciphertext c, output plaintext information m, the expression is: m←ε.Dec k (c).

[0015] Furthermore, the generation of asymmetric keys is implemented using the Paillier encryption algorithm, including: randomly selecting two encryption parameters that make the Paillier cryptographic system semantically secure, namely the first encryption parameter p and the second encryption parameter q, p and q ensure that repeated encryption of a given plaintext generates different ciphertexts to prevent plaintext attacks, and p and q satisfy the greatest common divisor gcd(pq,(p-1)(q-1))=1, and setting the public key PK=(n,g) and the private key SK=(λ,,μ) according to the encryption parameters; wherein gcd represents a function for finding the greatest common divisor, n represents the first public key parameter, and n is the product of the two encryption parameters p and q n=pq, λ represents the first private key parameter, and λ is the least common multiple value of p-1 and q-1 λ=lcm(p-1,q-1), lcm represents a function for finding the least common multiple, g represents the second public key parameter, and g is a randomly selected integer And satisfying the order of n dividing g, μ represents the second private key parameter, and μ=((g λ modn 2 -1) / n) -1 modn, mod represents the remainder function.

[0016] Furthermore, the relationship between keywords and documents in the index matrix I is formalized as follows:

[0017]

[0018] Among them, I ij represents the element in the i-th row and j-th column of the index matrix. i and j represent the row and column of the index matrix respectively. 0≤i≤N, 0≤j≤N, N represents the maximum value of the number of keywords and files. w i represents the i-th keyword, f j Represents the jth file.

[0019] Furthermore, the auxiliary data structure is a secondary mapping table Ω(Mw,A), which is composed of an address mapping table Mw(l,i) and an array A[i] and is stored in the server. The address mapping table Mw(l,i) stores key-value pairs, where the key is the block number l to which the keyword belongs and the value is i.

[0020] Furthermore, the user-generated search trap includes: when the user searches for the first time, according to the keyword hash table T w Determine the row number of the keyword to be queried, and calculate the block number l to which the keyword belongs, that is, the search trap, and send l to the server for retrieval. If the user is not querying for the first time, query the dictionary D to obtain the row number of the keyword to be queried, that is, x i ←D[w i ], calculate the block number l to which the keyword belongs, that is, search for the trapdoor, and send l to the server for retrieval. The calculation expression for the block number l to which the keyword belongs is: Where V is the size of the data block and x is the row number.

[0021] Furthermore, the server performs a query process according to the search trap, including:

[0022] S321: Execute the first-level search: query the address mapping table Mw(l,i) in the second-level mapping Ω(Mw,A) according to the search trap generated by the block number l to which the keyword belongs. According to i←Mw[l], the starting position of the keyword to be queried in the array A can be obtained. At this time, the array A is searched sequentially according to the starting position to obtain a row number group row=(r i ,...,r i+v );

[0023] S322: Perform secondary search: According to the row number group row obtained by the primary search, retrieve the encrypted index matrix and read a data block B of size v = (b1, .., b v ), the data block is a symmetrically encrypted ciphertext; the server and the user execute a 1-out-of-n oblivious transfer protocol, encrypt the symmetrically encrypted ciphertext once more, obtain the query result, and send the query result to the user;

[0024] S323: User decryption: After the user obtains the query result, the first decryption is performed according to the 1-out-of-n oblivious transfer protocol, that is, Get the result of symmetric encryption Then search the keyword hash table T w Get the initial row number of the keyword to be queried, and decrypt the query result for the second time using the decryption key k of the symmetric encryption algorithm to obtain the file identifier set containing the keyword to be queried, that is, Among them, γ w Represents the set of file identifiers that contain the keyword.

[0025] Furthermore, the 1-out-of-n oblivious transfer protocol process includes: the server generates system parameters (g, h, G(p)), where p is a public large prime number, g and h are The generator of G(·) is a finite field; the user obtains the row number x of the keyword to be searched according to the dictionary D i , that is, x i ←D[w i ], randomly select r (r<p), and calculate the message sent by the user to the server Send y to the server; after receiving y, the server calculates (α1,c1),...,(α v ,c v ), (α1,c1),...,(α v ,c v ) is sent to the user, where

[0026] is an auxiliary parameter, c v is the ciphertext of the message sent by the server to the user, k j Is a random number.

[0027] Further, shuffling the index matrix of the server includes: the user constructing a permutation matrix, the user encrypting the permutation matrix, and the server performing homomorphic calculation, specifically including:

[0028] S331, construct a permutation matrix P,

[0029] S332, using the Paillier encryption algorithm to encrypt the permutation matrix P to obtain an encrypted permutation matrix P', and sending the encrypted permutation matrix P' to the server;

[0030] S333: The server performs homomorphic calculation on the encrypted permutation matrix and the encrypted index matrix to obtain a shuffled index matrix. Right now

[0031] Further, the permutation matrix P is encrypted using the Paillier encryption algorithm to obtain an encrypted permutation matrix P'. The specific implementation method includes: firstly selecting a random number The random number satisfies 0<r<n, the greatest common divisor gcd(r,n)=1, and according to the selected random number r, the confusion matrix M is Paillier encrypted using the public key PK to obtain the encrypted confusion matrix P'=PE.Enc PK (P), n represents the first public key parameter.

[0032] Beneficial effects of the present invention:

[0033] 1. The present invention starts from the perspective of a single server, uses secondary search and 1-out-of-n oblivious transfer protocol to blur search results, constructs a permutation matrix, and uses the Paillier encryption algorithm to shuffle the index matrix, changes the data storage location, and then changes the user's access path, thereby hiding the search mode and access mode, and can effectively protect user privacy data.

[0034] 2. More efficient retrieval: The present invention uses the "keyword-document pair" of the "inverted index" concept to construct an index matrix, and finds all files containing the keyword to be searched through this data structure. The construction of the index makes the retrieval more efficient.

[0035] 3. Low communication overhead: Paillier encryption is used to shuffle the index matrix data. Only the confusion matrix needs to be uploaded, and there is no need to download, decrypt, exchange, and retransmit data blocks, thus reducing communication overhead.

[0036] 4. Better security: Using secondary search, 1-out-of-n oblivious transfer protocol and Paillier encryption algorithm to obliviously access the index structure makes the query process more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0038] Figure 1 A system model diagram of a searchable encryption method for hiding search modes and access modes in an e-commerce platform according to an embodiment of the present invention;

[0039] Figure 2 A schematic diagram of an inverted index matrix according to an embodiment of the present invention;

[0040] Figure 3 A schematic diagram of a secondary index according to an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of an oblivious transfer protocol according to an embodiment of the present invention;

[0042] Figure 5 A schematic diagram of a shuffling process according to an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] like Figure 1The figure shows a system model diagram of a searchable encryption for hiding search mode and access mode according to an embodiment of the present invention. In the system model, the searchable encryption scheme for hiding search mode and access mode mainly includes two entities: user and server. The overall idea of ​​the present invention includes: first, the initialization stage: the user uses a symmetric encryption algorithm to generate a symmetric key for encrypting the index matrix and the file. The Paillier encryption algorithm is used to generate an asymmetric key for encrypting the permutation matrix. At the same time, the relationship between the keyword-document pair is extracted to construct the index matrix. At this time, a special searchable encryption scheme is used to generate a secure index. Ciphertext retrieval stage: the user uses the searchable encryption scheme to generate a search trapdoor and sends it to the server. The server determines the block position of the search keyword by retrieving the secondary mapping, and uses the 1-out-of-n oblivious transfer protocol to encrypt it again and return the result to the user. Finally, the user sends the Paillier encrypted permutation matrix to the server, and performs homomorphic calculations with the index matrix on the server side to change the position of the data in the index matrix.

[0045] A searchable encryption method for hiding search modes and access modes in an e-commerce platform according to an embodiment of the present invention includes but is not limited to the following implementation process:

[0046] S1: Acquire original data, preprocess the original data, and obtain preprocessed data.

[0047] The original data of the present invention can be directly obtained from existing network public data sets, and the original data to be obtained includes the corresponding relationship between keywords and documents. Specifically, it includes the following implementation process:

[0048] S11: Obtaining original data. The present invention uses existing data sources to obtain the original mail data set Enron.

[0049] S12: Preprocessing: The raw data usually obtained are unstructured and cannot be used directly to build an index, so it is necessary to perform simple data processing based on the raw data obtained. The present invention uses the Porter stemming algorithm to process the data, delete duplicate data and invalid data, etc., so that most of the unstructured data is structured to obtain preprocessed data.

[0050] S13: Store data. The preprocessed data is stored locally for subsequent index building and encryption operations.

[0051] S2, initialization phase. The user calls the symmetric encryption algorithm to generate a symmetric key, which is used to encrypt the index matrix and files in the subsequent steps. The user calls the Paillier encryption algorithm to generate an asymmetric key, which is used to encrypt the permutation matrix in the subsequent steps. Based on the preprocessed data, the useless data in the data set is filtered out, the relationship between the keyword-document pairs is extracted, and the index matrix is ​​constructed. The symmetric encryption algorithm is called to encrypt the index matrix to generate a secure index. The symmetric encryption algorithm is called to encrypt the preprocessed file to generate an encrypted file. An auxiliary data structure is constructed to meet the user's inadvertent access. The secure index, encrypted file, and auxiliary data structure are encrypted and uploaded to the server.

[0052] S21: Generate key: In this embodiment, the user executes a key generation algorithm to generate symmetric keys and asymmetric keys.

[0053] In one embodiment, the generation of the symmetric key can be implemented by using the tuple ε(Gen, Enc, Dec) encryption algorithm, which is an IND-CPA encryption scheme, mainly used to encrypt index matrices and files. Specifically, the implementation process of using the tuple ε(Gen, Enc, Dec) encryption algorithm to generate the symmetric key includes:

[0054] k←ε.Gen(1 κ ): Key generation algorithm. Input security parameter κ and output key k.

[0055] c←ε.Enc k (m): Encryption algorithm. Input key k and plaintext information m, and output encrypted ciphertext c.

[0056] m←ε.Dec k (c): Decryption algorithm. Input key k and ciphertext c, output plaintext information m.

[0057] It should be noted that the generation of symmetric keys may also adopt other achievable encryption methods.

[0058] In one embodiment, the generation of asymmetric keys can be implemented using the Paillier encryption algorithm, which is mainly used to encrypt permutation matrices and perform homomorphic calculations. Specifically, the implementation process of using the Paillier encryption algorithm to generate asymmetric keys includes: randomly selecting two encryption parameters that make the Paillier cryptographic system semantically secure, namely the first encryption parameter p and the second encryption parameter q, p and q ensure that repeated encryption of a given plaintext generates different ciphertexts to prevent plaintext attacks, and p and q satisfy the greatest common divisor gcd(pq, (p-1)(q-1)) = 1, and setting the public key PK = (n, g) and the private key SK = (λ,,μ) according to the encryption parameters. Among them, gcd represents the function for finding the greatest common divisor, n represents the first public key parameter, and n is the product of the two encryption parameters p and q n = pq, λ represents the first private key parameter, and λ is the least common multiple value of p-1 and q-1, λ = lcm(p-1,q-1), lcm represents the function for finding the least common multiple, g represents the second public key parameter, and g is a randomly selected integer And satisfying the order of n dividing g, μ represents the second private key parameter, and μ=((g λ mod n 2 -1) / n) -1 mod n, mod represents the remainder function. Therefore, the Paillier encryption algorithm can be formalized as PE = (Gen, Enc, Dec). The entire encryption and decryption process of the Paillier encryption algorithm is as follows:

[0059] (PK,SK)←PE.Gen(p,q): Key generation algorithm. Input two large prime numbers and output public key PK and private key SK.

[0060] c←PE.Enc PK (m): encryption algorithm. Input plaintext message m, output ciphertext c, where c = r n g m mod n 2 .

[0061] m←PE.Dec SK (c): Decryption algorithm. Input ciphertext c, output plaintext message m, where m = D(c) = L(c λ modn 2 )·μmod n.

[0062] It should be noted that the generation of asymmetric keys may also adopt other achievable encryption methods.

[0063] S22: Construct an index matrix. In this embodiment, a "keyword-document" inverted index (such as Figure 2 shown).

[0064] First, construct the index matrix: extract keywords from the processed data set and use two hash tables T f ,T w To determine the row and column numbers of keywords and files in the index matrix, T f is the file hash table, T w is a keyword hash table. Then, an index matrix I is constructed based on the correspondence between keywords and files. In the index matrix, rows represent keywords and columns represent files. If a file contains the keyword, the corresponding position of the index matrix is ​​recorded as 1, otherwise it is recorded as 0. The relationship between keywords and files in the index matrix I is formalized as:

[0065]

[0066] Among them, I ij represents the element in the i-th row and j-th column of the index matrix. i and j represent the row and column of the index matrix respectively. 0≤i≤N, 0≤j≤N, N represents the maximum value of the number of keywords and files. w i represents the i-th keyword, f j Represents the jth file.

[0067] After constructing the index matrix I, the symmetric key is used to encrypt the index matrix to obtain the generated secure index, that is, the encrypted index matrix I'[i,j]. The encryption process includes: using the generated symmetric key k and the row number to encrypt each row of the index matrix in turn, that is, I'[i,j]←ε.Enc k||i (I[i,j]), where I'[i,j] represents the encrypted index matrix.

[0068] When users access data, due to the randomness and uncertainty of access time, in addition to the main index matrix, it is also necessary to build an auxiliary data structure to achieve the user's inadvertent access. The auxiliary data structure can be a secondary mapping table. The purpose of building the secondary mapping table is to determine the user's search scope and blur the search results. Figure 3 As shown in the figure, the secondary mapping table Ω(Mw,A) is mainly composed of an address mapping table Mw(l,i) and an array A[i], which is stored in the server. The address mapping table Mw(l,i) stores key-value pairs, where the key is the block number l to which the keyword belongs and the value is i. The array A[i] stores the row number (1,...,m) of the index matrix. The address mapping table Mw(l,i) is a block-level index, which performs block retrieval on the elements in the array A. Therefore, i is the starting position of each data block in the array A.

[0069] A dictionary D is maintained on the client. After each shuffle, the position of the keyword in the index matrix will change, so the dictionary D is used to store the new position of each keyword. The expression of the dictionary D is: D[w] = x, where w represents the keyword and x represents the row number.

[0070] S23: Upload encrypted information. The user uploads the encrypted file generated in the initialization phase, the encrypted index matrix (security index), and the secondary mapping table to the server for the subsequent ciphertext retrieval phase.

[0071] S3, ciphertext retrieval stage. In this embodiment, ciphertext retrieval mainly includes three stages:

[0072] In the first stage, the user constructs a search trap to initiate a query. When the user searches for the first time, the keyword hash table T w Determine the row number of the keyword to be queried, and calculate the block number l to which the keyword belongs, that is, the search trap, and send l to the server for retrieval. If the user is not querying for the first time, query the dictionary D to obtain the row number of the keyword to be queried, that is, x i ←D[w i ], calculate the block number l to which the keyword belongs, that is, search for the trapdoor, and send l to the server for retrieval. The calculation expression for the block number l to which the keyword belongs is: Where v is the size of the data block and x is the row number.

[0073] In the second stage, the server executes the query process according to the search trap, which mainly includes querying the secondary mapping table, retrieving the index matrix after determining the search range, and finally retrieving the data block and returning it to the client.

[0074] The server query process includes:

[0075] S321: Execute the first-level search. The search trap generated by the block number l to which the keyword belongs queries the address mapping table Mw(l,i) in the second-level mapping Ω(Mw,A). According to i←Mw[l], the starting position of the keyword to be queried in the array A can be obtained. At this time, the array A is searched sequentially according to the starting position to obtain a row number group row=(r i ,...,r i+v ).

[0076] S322: Perform secondary search. According to the row number group row obtained by the primary search, retrieve the encrypted index matrix and read a data block B of size v = (b1, .., b v ), note that this data block is a symmetrically encrypted ciphertext.

[0077] S323: Execute 1-out-of-n oblivious transfer protocol: The oblivious transfer protocol refers to the protocol participants transmitting information in an obfuscated manner, thereby effectively protecting the privacy of the participants. Figure 4 As shown, the main property of the 1-out-of-n oblivious transfer protocol is: if the sender has n messages m1, m2, ..., m n ∈G(p), requiring that the receiver can only get the selected message m in the end σ , where (1≤σ≤n), and the other n-1 messages cannot be obtained.

[0078] The 1-out-of-n oblivious transfer protocol process is as follows: the server generates system parameters (g, h, G(p)), p is a public large prime number, g, h are The generator of G(·) is a finite field. The user obtains the row number x of the keyword to be searched according to the dictionary D i , that is, x i ←D[w i ], randomly select r (r<p), and calculate the message sent by the user to the server Send y to the server; after receiving y, the server calculates (α1,c1),...,(α v ,c v ), and (α1,c1),...,(α v ,c v ) is sent to the user. α ν is an auxiliary parameter, c ν is the ciphertext of the message sent by the server to the user, k j is a random number. Note that this encryption process is an additional encryption based on the symmetric encrypted ciphertext.

[0079] S323: User decryption. The user needs to perform decryption twice. The user obtains the query result (i.e., the above-mentioned inadvertently transmitted result (α1, c1), ..., (α ν ,c ν )) After that, we first perform the first decryption according to the 1-out-of-n oblivious transfer protocol. According to the nature of the 1-out-of-n oblivious transfer protocol, we can only decrypt the message we choose, that is, Get the result of symmetric encryption At this time, search the keyword hash table T w Get the initial row number of the keyword to be queried, and decrypt the query result for the second time using the decryption key k of the symmetric encryption algorithm to obtain the file identifier set containing the keyword to be queried, that is, where γ wIndicates the set of file identifiers containing the keyword to be queried. At this time, except for the row where the keyword to be queried is decrypted, the remaining redundant data in the data block will not be decrypted. This not only reduces the computational overhead during decryption, but also protects the relevant information of non-query keywords.

[0080] In the third stage, the server shuffles the index matrix and changes the position of the rows in the index matrix. After the search is completed, in order to hide the search mode and access mode and protect user privacy, the server's index matrix needs to be shuffled. The shuffling process is as follows: Figure 5 As shown, the specific process of shuffling mainly includes: the user constructs a permutation matrix, the user encrypts the permutation matrix, and the server performs homomorphic calculation.

[0081] In this embodiment, a matrix transformation form is given to understand the calculation method of the shuffling process. The shuffling process can be implemented by using a matrix-based data replacement method, which is specifically described as follows:

[0082] The construction phase of the permutation matrix: given a data sequence B = (B1,...,B n ), and an n×n permutation matrix π, the matrix dot multiplication operation B·π can permute the data sequence. For example, given a data sequence and a permutation matrix The position of the data in the data sequence can be changed. The calculation expression is as follows:

[0083]

[0084] In one embodiment, the permutation matrix P is implemented as follows: i =i' represents a random permutation function, where i = 1,...,2n. A permutation π is generated by uniformly selecting randomly from the set {1,...,2n}. Let p i,j Represents the value of the i-th row and j-th column in the permutation matrix P. A permutation matrix P can be expressed as

[0085] Encryption processing stage of permutation matrix: Use Paillier encryption algorithm to encrypt permutation matrix P to obtain encrypted permutation matrix P'. The specific implementation method includes: first select a random number The random number satisfies 0<r<n, the greatest common divisor gcd(r,n)=1, and according to the selected random number r, the permutation matrix P is Paillier encrypted using the public key PK to obtain the encrypted permutation matrix P'=PE.Enc PK (P), send the encrypted permutation matrix P' to the server.

[0086] Since the random number r used in Paillier encryption is a randomly generated number, for the same plaintext, if the random number r changes, the ciphertext will also change accordingly. Therefore, Paillier encryption meets semantic security.

[0087] Perform homomorphic computation: In this embodiment, the server performs homomorphic computation on the encrypted permutation matrix P' and the encrypted index matrix I'[i,j] to obtain the shuffled index matrix Right now After performing homomorphic computation, the result obtained is the result of homomorphic encryption, which is not conducive to the next data shuffle. Therefore, before the next search, the result needs to be homomorphically decrypted using the private key SK, that is, Wherein, I” represents the decrypted result. After the homomorphic encryption result is homomorphically decrypted, the next index matrix shuffling process is performed, and the number of index matrix shuffling is determined by the user.

[0088] The present invention starts from the perspective of a single server, uses secondary search to fuzzy search results, uses the Paillier encryption algorithm to shuffle the index matrix, changes the data storage location, and then changes the user's access path, thereby hiding the search mode and access mode. The present invention comprehensively considers the huge threat of unstable factors to user privacy in the network, so the invention has application value for user privacy data protection and can be applied to the protection of medical data, financial security and other privacy data.

[0089] It should be noted that a person skilled in the art can understand that all or part of the processes in the above method embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above method embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0090] The above description is only a specific implementation mode of the present application. It should be pointed out that for ordinary technicians in this field, it can be understood that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the attached claims and their equivalents.

Claims

1. A searchable encryption method for hiding search mode and access mode in an e-commerce platform, characterized in that: The following steps are involved: S1. Obtain the original data, pre-process the original data, use the Porter stemming algorithm to process the data, delete duplicate data and invalid data, structure the unstructured data, obtain the pre-processed data and store it locally; S2, initialization phase: the user generates the required symmetric key and asymmetric key; first, based on the preprocessed data, filter out useless data in the file, extract the relationship between keywords and files, build an index matrix based on the relationship between keywords and documents, encrypt the index matrix with the symmetric key, and generate a secure index; encrypt the file with the symmetric encryption algorithm to generate an encrypted file; Build auxiliary data structures to satisfy users' casual access; The generated security index, encrypted file and auxiliary data structure are uploaded to the server; the auxiliary data structure is a secondary mapping table Ω(Mw,A), which consists of an address mapping table Mw(l,i) and an array A[i] and is stored in the server. The address mapping table Mw(l,i) stores key-value pairs, where the key is the block number l to which the keyword belongs and the value is i; S3, ciphertext retrieval: the user generates a search trap and initiates a search request to the server; after the server receives the user's search request, the server executes the query process according to the search trap and completes the search; After the search is completed, the server's index matrix is ​​shuffled; The server performs the query process according to the search trap, including: S321: Execute the first-level search: query the address mapping table Mw(l,i) in the second-level mapping Ω(Mw,A) according to the search trap generated by the block number l to which the keyword belongs. According to i←Mw[l], the starting position of the keyword to be queried in the array A can be obtained. At this time, the array A is searched sequentially according to the starting position to obtain a row number group row=(r i ,...,r i+v ); S322: Perform secondary search: According to the row number group row obtained by the primary search, retrieve the encrypted index matrix and read a data block B of size v = (b1, .., b v ), the data block is a symmetrically encrypted ciphertext; the server and the user execute a 1-out-of-n oblivious transfer protocol, encrypt the symmetrically encrypted ciphertext once more, obtain the query result, and send the query result to the user; S323: User decryption: After the user obtains the query result, the first decryption is performed according to the 1-out-of-n oblivious transfer protocol, that is, Get the result of symmetric encryption Then search the keyword hash table T w Get the initial row number of the keyword to be queried, and decrypt the query result for the second time using the decryption key k of the symmetric encryption algorithm to obtain the file identifier set containing the keyword to be queried, that is, Among them, w Represents the set of file identifiers containing the keyword; Shuffling the index matrix of the server includes: the user constructs a permutation matrix, the user encrypts the permutation matrix, and the server performs homomorphic calculations, specifically including: S331, construct a permutation matrix P, S332, using the Paillier encryption algorithm to encrypt the permutation matrix P to obtain an encrypted permutation matrix P', and sending the encrypted permutation matrix P' to the server; S333: The server performs homomorphic calculation on the encrypted permutation matrix and the encrypted index matrix to obtain a shuffled index matrix. Right now 2. According to claim 1, a searchable encryption method for hiding search mode and access mode in an e-commerce platform is characterized in that: The generation of the symmetric key includes: using the tuple ε (Gen, Enc, Dec) encryption algorithm to generate the symmetric key, and the implementation process of the tuple ε (Gen, Enc, Dec) encryption algorithm includes: Key generation: Input security parameter κ and output key k, the expression is: k←ε.Gen(1 κ ); Encryption according to key k: Input key k and plaintext information m, output encrypted ciphertext c, the expression is: cε.Enc k (m); Decryption: Input key k and ciphertext c, output plaintext information m, the expression is: m←.Dec k (c).

3. According to claim 1, a searchable encryption method for hiding search mode and access mode in an e-commerce platform is characterized in that: The generation of asymmetric keys is implemented using the Paillier encryption algorithm, including: randomly selecting two encryption parameters that make the Paillier cryptographic system semantically secure, namely the first encryption parameter p and the second encryption parameter q, p and q ensure that repeated encryption of a given plaintext generates different ciphertexts to prevent plaintext attacks, and p and q satisfy the greatest common divisor gcd(pq,(p-1)(q-1))=1, and setting the public key PK=(n,g) and the private key SK=(λ,μ) according to the encryption parameters; wherein gcd represents a function for finding the greatest common divisor, n represents the first public key parameter, and n is the product of the two encryption parameters p and q n=pq, λ represents the first private key parameter, and λ is the least common multiple value of p-1 and q-1, λ=lcm(p-1,q-1), lcm represents a function for finding the least common multiple, g represents the second public key parameter, and g is a randomly selected integer And satisfying the order of n dividing g, μ represents the second private key parameter, and μ=((g λ mod n 2 -1) / n) -1 mod n, mod means the remainder function.

4. According to claim 1, a searchable encryption method for hiding search mode and access mode in an e-commerce platform is characterized in that: The relationship between keywords and documents in the index matrix I is formalized as: Among them, I ij represents the element in the i-th row and j-th column of the index matrix. i and j represent the row and column of the index matrix respectively. 0≤i≤N, 0≤j≤N, N represents the maximum value of the number of keywords and files. w i represents the i-th keyword, f j Represents the jth file.

5. According to claim 1, a searchable encryption method for hiding search mode and access mode in an e-commerce platform is characterized in that: User-generated search traps include: when a user searches for the first time, based on the keyword hash table T w Determine the row number of the keyword to be queried, and calculate the block number l to which the keyword belongs, that is, the search trap, and send l to the server for retrieval; if the user is not querying for the first time, query the dictionary D to obtain the row number of the keyword to be queried, that is, x i ←D[w i ], calculate the block number l to which the keyword belongs, that is, search for the trapdoor, and send l to the server for retrieval. The calculation expression for the block number l to which the keyword belongs is: Where ν represents the size of the data block and x represents the row number.

6. A searchable encryption method for hiding search mode and access mode in an e-commerce platform according to claim 1, characterized in that: The 1-out-of-n oblivious transfer protocol process includes: the server generates system parameters (g, h, G(p)), p is a public large prime number, g, h are The generator of G(·) is a finite field; the user obtains the row number x of the keyword to be searched according to the dictionary D i , that is, x i ←D[w i ], randomly select r (r<p), and calculate the message sent by the user to the server Send y to the server; after receiving y, the server calculates (α1,c1),...,(α ν ,c ν ), (α1,c1),...,(α v ,c ν ) is sent to the user, where α ν is an auxiliary parameter, c ν is the ciphertext of the message sent by the server to the user, k j Is a random number.

7. A searchable encryption method for hiding search mode and access mode in an e-commerce platform according to claim 1, characterized in that: The permutation matrix P is encrypted using the Paillier encryption algorithm to obtain an encrypted permutation matrix P'. The specific implementation method includes: first selecting a random number The random number satisfies 0<r<n, the greatest common divisor gcd(r,n)=1, and according to the selected random number r, the confusion matrix M is Paillier encrypted using the public key PK to obtain the encrypted confusion matrix P'=PE.Enc PK (P), n represents the first public key parameter.

Images