Blockchain-based dynamic searchable encryption method and device

Abstract

The application relates to the technical field of network information security, in particular to a dynamic searchable encryption method and device based on a block chain. The method comprises the following steps: using a symmetric encryption algorithm to encrypt a data file of a data owner, and obtaining a unique identifier of an encrypted file uploaded to an IPFS network; extracting a keyword from the data file, and performing encryption operation on the keyword by using a preset encryption algorithm to generate a security index; uploading the unique identifier and the security index to a block chain network, performing identity authentication on a data user according to an authentication request, and sending a secret parameter to the data user after the authentication is passed, so that the data user searches on the block chain network by using a query trapdoor generated by encrypting at least one keyword in the secret parameter and a search request. Therefore, the problems of data privacy leakage, untrusted query result, single point failure and low data storage efficiency caused by the third-party server for realizing the storage and retrieval of encrypted data in the related art are solved.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to a dynamic searchable encryption method and device based on blockchain. Background Technology

[0002] With the development of cloud computing technology, searchable encryption technology, as an emerging technology that allows data users to perform keyword searches in encrypted space, is gradually becoming the core of the secure search field. However, in searchable encryption schemes, since the storage and retrieval of encrypted data are both completed by third-party servers, there are problems such as data privacy leakage, unreliable query results, single points of failure, and inefficient data storage, which urgently need to be solved. Summary of the Invention

[0003] This application provides a blockchain-based dynamic searchable encryption method, device, electronic device, and storage medium to solve problems in related technologies, such as data privacy leakage, unreliable query results, single point of failure, and inefficient data storage caused by the storage and retrieval of encrypted data by third-party servers.

[0004] The first aspect of this application provides a blockchain-based dynamic searchable encryption method, comprising the following steps: encrypting a data file of a data owner using a symmetric encryption algorithm, uploading the encrypted data file to an IPFS network, and obtaining a unique identifier for the encrypted data file on the IPFS network; extracting keywords from the data file and performing encryption operations on the keywords using a preset encryption algorithm to generate a secure index; uploading the unique identifier and the secure index to a blockchain network; authenticating the data user's identity according to an authentication request; and sending secret parameters to the data user after successful authentication, enabling the data user to perform a search on the blockchain network using a query trap generated based on the secret parameters and the search request.

[0005] Furthermore, the step of extracting keywords from the data file and encrypting the keywords using a preset encryption algorithm to generate a secure index includes: generating a keyword set based on the keywords extracted from the data file; encrypting all keywords in the keyword set using a randomly generated temporary key; and filling the positions of the hash calculations performed on the concatenated keywords in a Bloom filter to obtain the secure index.

[0006] Furthermore, after generating the security index, the method further includes: generating a new keyword set based on new keywords extracted from the data file; creating a new security index for the new keyword set; and updating the security index of the data file using the new security index.

[0007] Furthermore, before encrypting the data file of the data owner using a symmetric encryption algorithm, the method further includes: authenticating the data owner; and after the data owner is successfully authenticated, generating secret parameters based on the data owner's shared parameters.

[0008] Furthermore, the query trap is:

[0009]

[0010] in, Let represent the set of keywords in the search request, u represent the data user, and T1 represent the key parameters required by the chained nodes in the query trapdoor for matching with the index. This represents the value obtained by performing an encryption operation on all keywords in the query set. h(w) represents the size of the query set, i.e., the number of query keywords. k ) represents the hash value of the k-th key, w k Let T1 represent the k-th key, k∈[1,n], where n is a positive integer. Let T2 represent one parameter required for the matching operation of the chain nodes, and T3 represent another parameter required for the matching operation of the chain nodes. Represents hash values, H1(), H2(), ..., H n () represents a hash function, w1 represents the first query key, and w2 represents the second query key. Indicates the first The query keywords, || represents a cascading operation. q u The inverse of q, q2 represents the secret parameter, q u and r u This represents a temporary key that the user randomly selects from a hash function.

[0011] A second aspect of this application provides a blockchain-based dynamically searchable encryption device, comprising: a first encryption module, configured to encrypt a data file of a data owner using a symmetric encryption algorithm, upload the encrypted data file to an IPFS network, and obtain a unique identifier for the encrypted data file on the IPFS network; a second encryption module, configured to extract keywords from the data file and perform encryption operations on the keywords using a preset encryption algorithm to generate a secure index; and a search module, configured to upload the unique identifier and the secure index to the blockchain network, authenticate the data user according to an authentication request, and send secret parameters to the data user after successful authentication, enabling the data user to perform a search on the blockchain network using a query trap generated based on the secret parameters and the search request.

[0012] Furthermore, the second encryption module is used to generate a keyword set based on keywords extracted from the data file, perform encryption operations on all keywords in the keyword set according to a randomly generated temporary key, and fill the positions of the concatenated keywords in the Bloom filter to obtain the security index.

[0013] Furthermore, it also includes: an update module, used to generate a new keyword set based on new keywords extracted from the data file after generating the security index, create a new security index for the new keyword set, and update the security index of the data file using the new security index; and a verification module, used to authenticate the data owner before encrypting the data file of the data owner using a symmetric encryption algorithm, and generate secret parameters based on the shared parameters of the data owner after the data owner is verified.

[0014] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the blockchain-based dynamic searchable encryption method described in the above embodiments.

[0015] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which is executed by a processor to implement the blockchain-based dynamically searchable encryption method described in the above embodiments.

[0016] Therefore, this application has at least the following beneficial effects:

[0017] This technology enables secure and efficient retrieval of encrypted data without the involvement of a trusted third-party institution, effectively protecting the privacy of users' multi-keyword queries. By introducing blockchain and IPFS, the reliability of query results is guaranteed, improving the storage security and efficiency of encrypted documents. This solves the technical problems associated with third-party servers storing and retrieving encrypted data, such as data privacy leaks, unreliable query results, single points of failure, and inefficient data storage.

[0018] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0019] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0020] Figure 1This is a flowchart illustrating a blockchain-based dynamically searchable encryption method provided according to an embodiment of this application.

[0021] Figure 2 This is a model example diagram of a blockchain-based dynamically searchable encryption system provided according to an embodiment of this application;

[0022] Figure 3 This is a flowchart illustrating a blockchain-based dynamically searchable encryption method according to an embodiment of this application.

[0023] Figure 4 This is an example diagram showing the index corresponding to the data document provided in the embodiments of this application;

[0024] Figure 5 An example diagram of a blockchain-based dynamically searchable encryption device provided according to an embodiment of this application;

[0025] Figure 6 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0026] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0027] Blockchain, as an emerging technology incorporating cryptography and consensus algorithms, possesses excellent characteristics such as distributed trust, transparency, and immutability. Therefore, to address the aforementioned issues, blockchain has begun to be applied to searchable encryption technologies to replace the role of third-party cloud servers. However, existing blockchain-based searchable encryption schemes only solve some of the aforementioned problems. This application proposes a dynamic searchable encryption framework based on blockchain, combining distributed technology to achieve data query privacy protection and query result trustworthiness, while also supporting secure and efficient storage of encrypted documents.

[0028] The following description, with reference to the accompanying drawings, describes a blockchain-based dynamically searchable encryption method, apparatus, electronic device, and storage medium according to embodiments of this application. Addressing the problems mentioned in the background art where the storage and retrieval of encrypted data by a third-party server leads to data privacy leaks, unreliable query results, single points of failure, and inefficient data storage, this application provides a blockchain-based dynamically searchable encryption method. This method enables secure and efficient retrieval of encrypted data without the involvement of a trusted third-party institution, effectively protects the privacy of users' multi-keyword queries, and ensures the reliability of query results by introducing blockchain and IPFS, thereby improving the storage security and efficiency of encrypted documents. Thus, it solves the technical problems in related technologies where the storage and retrieval of encrypted data by a third-party server leads to data privacy leaks, unreliable query results, single points of failure, and inefficient data storage.

[0029] Specifically, Figure 1 This is a flowchart illustrating a blockchain-based dynamically searchable encryption method provided in an embodiment of this application.

[0030] It should be noted that the method of this application embodiment can be applied to various fields related to searchable encryption scenarios. In the following embodiments, the entities involved in this application embodiment are as follows: Figure 2 As shown, it can include data owners, data users, blockchain networks, and IPFS networks.

[0031] like Figure 1 As shown, this blockchain-based dynamically searchable encryption method includes the following steps:

[0032] In step S101, the data file of the data owner is encrypted using a symmetric encryption algorithm, and the encrypted data file is uploaded to the IPFS network. The unique identifier of the encrypted data file in the IPFS network is then obtained.

[0033] Understandably, data owners can use symmetric encryption algorithms to encrypt data files, upload the encrypted documents to the IPFS network, and record the file's unique identifier within the network. IPFS, in turn, is responsible for storing the encrypted documents, thus enabling more secure and efficient storage of encrypted documents.

[0034] In this embodiment, before encrypting the data owner's data file using a symmetric encryption algorithm, the method further includes: authenticating the data owner; and after the data owner is successfully authenticated, generating secret parameters based on the data owner's shared parameters.

[0035] It is understandable that, in cases like Figure 2 Before the system can be put into operation, it needs to be initialized.

[0036] Specifically, such as Figure 3 As shown, at this stage, a safety parameter l needs to be input into the system to generate relevant parameters. G1 and G2 are two multiplicative cyclic groups with the same order q, and g is a generator of G1. Simultaneously, G1×G1→G2 and These represent a bilinear mapping e and a hash function, respectively. The main task of the initialization phase is to generate two prime numbers of length l bits. And it satisfies q = q1·q2.

[0037] All data owners must undergo strict identity verification before entering the system. Verified data owners will secretly share parameters q1 and q2, while data users who have been authenticated by the data owners will obtain parameter q2 through a secure channel for subsequent generation of query trapdoors.

[0038] In step S102, keywords are extracted from the data file and encrypted using a preset encryption algorithm to generate a secure index.

[0039] It is understood that the data owner is the individual responsible for extracting keywords from the data document and building the corresponding index. Specifically, in the embodiments of this application, keywords can be extracted from the data document and corresponding encryption operations can be performed on these keywords to generate the corresponding index.

[0040] In this embodiment, keywords are extracted from a data file and encrypted using a preset encryption algorithm to generate a secure index. This includes: generating a keyword set based on keywords extracted from the data file; encrypting all keywords in the keyword set using a randomly generated temporary key; and filling the positions of the hash calculations performed on the concatenated keywords in a Bloom filter to obtain the secure index.

[0041] Understandably, during the search phase, indexes are used to directly match query trapdoors, so the safe creation and updating of indexes is crucial in this approach.

[0042] Specifically, such as Figure 3 As shown, the creation of a secure index by the data owner includes:

[0043] An index is essentially an attribute Bloom filter, given the i-th data owner DO. i The set of keywords W for the j-th file i,j Data owner DO i First, randomly select a temporary key sk. i,j For the keyword set W i,j All keywords in DO i calculate Next DO i Randomly generate n-1 elements And perform the following operation on the nth element:

[0044]

[0045] Then, DO i Use n independent hash functions H1(), H2(), ..., H n ()right The hash operation yields:

[0046]

[0047] Each of them This represents the address in the attribute Bloom filter. For example... Figure 4 As shown, the index will be in accordance with The k-th random element is stored at the indicated position.

[0048] In the data document F i,j After the index is created, the data owner will upload the index and the storage address of the encrypted document in IPFS to the blockchain as a transaction. At the same time, each node on the blockchain will also record the transaction sequence number of the transaction. Add to the list of valid transaction serial numbers.

[0049] In this embodiment, after generating the security index, the method further includes: generating a new keyword set based on new keywords extracted from the data file; creating a new security index for the new keyword set; and updating the security index of the data file using the new security index.

[0050] Specifically, such as Figure 3 As shown, updating the security index by the data owner includes:

[0051] If you need to make data document F i,j To update the index, the data owner first creates a new index based on the new keyword set of the document, following the method described above. Then, they upload the new index and the storage address of the encrypted document as a transaction, noting that this transaction updates the previous one. Finally, each node on the blockchain records the transaction number. Replace the list of valid transaction serial numbers Update complete.

[0052] In step S103, the unique identifier and security index are uploaded to the blockchain network. The data user is authenticated according to the authentication request. After successful authentication, a secret parameter is sent to the data user so that the data user can use a query trap generated by encryption based on the secret parameter and at least one keyword in the search request to search on the blockchain network.

[0053] The blockchain is primarily responsible for performing search operations. After receiving a query trap from a data user, each node on the blockchain will traverse the transactions corresponding to the maintained list of valid transaction numbers, match the trap with the document index, and return the query results to the data user after reaching a consensus.

[0054] It is understood that, in this embodiment of the application, the security index and the unique identifier of IPFS can be uploaded to the blockchain together. Data users, authenticated by the data owner, can construct trapdoors based on their desired search keywords and send them to the blockchain network for searching. Therefore, this embodiment of the application can achieve multi-keyword search with privacy protection for data users, support searchable encryption set by multiple data owners and multiple data users, ensure the credibility of search results, and simultaneously update keywords for encrypted documents.

[0055] Specifically, such as Figure 3 As shown, step S103 may include query trapdoor generation, on-chain search, and IPFS search, wherein,

[0056] 1. Query trapdoor generation

[0057] The verified data allows users to encrypt multiple keywords they want to search for using parameter q2 and two randomly generated keys, thus generating a corresponding query trapdoor. Specifically, given a set of query keywords... Data user u first from Choose a temporary key q u ,for All keywords u calculation At the same time, u also needs to calculate n hash values. Next, u from Choose another temporary key r u Calculate and For a set of query keywords The query trapdoor is represented as follows:

[0058]

[0059] in, This represents the set of keywords in the search request, u represents the data user, and T1 represents the key parameters required by the chained nodes in the query trapdoor to match the index. This represents the value obtained by performing an encryption operation on all keywords in the query set. h(w) represents the size of the query set, i.e., the number of query keywords. k ) represents the hash value of the k-th key, w kLet T1 represent the k-th key, k∈[1,n], where n is a positive integer. Let T2 represent one parameter required for the matching operation of the chain nodes, and T3 represent another parameter required for the matching operation of the chain nodes. Represents hash values, H1(), H2(), ..., H n () represents a hash function, w1 represents the first query key, and w2 represents the second query key. Indicates the first The query keywords, || represents a cascading operation. q u The inverse of q, q2 represents the secret parameter, q u and r u This represents a temporary key that the data user randomly selects from a hash function.

[0060] 2. On-chain search

[0061] A blockchain consists of a series of nodes. Besides storing encrypted document indexes and IPFS addresses, the blockchain is also responsible for performing search operations for data users within the encrypted space. (Example: Document F...) i,j Taking the index as an example, when a query trap is received from data user u... Then, all nodes on the blockchain first use the trapdoor to select from the n hash functions in the index. Extract the corresponding element from the position it represents. Then calculate as follows:

[0062]

[0063] Next, each node checks whether the following equation is true:

[0064]

[0065] If the equation holds true, then the data file F i,j The file that meets the data user's query criteria will be sent to the node. i,j Add a unique identifier from IPFS to the list The correctness of the above equation is proven as follows:

[0066]

[0067]

[0068] If query keyword set With file F i,j Keyword set W i,jIf the same keywords are present, the equation must hold true. After each node completes its search algorithm, the entire blockchain network uses a specific consensus algorithm to reach an agreement on the search results to eliminate the influence of malicious nodes. This is after receiving the lists sent by each node. After that, the master node will communicate with the uploader. The data owner of the Chinese document interacts with the document to obtain the corresponding decryption key and adds it to a new list. In the middle. Finally, the master node will list. and The data is returned to the user together.

[0069] 3. IPFS search

[0070] At this stage, data users will first store a list of unique identifiers for data documents in IPFS that match the query criteria. The data is sent to the local node, which then performs a query and determines the table. The local node checks whether the corresponding encrypted document is stored on its storage device. If it exists, the node will directly return the encrypted document to the data user. If it does not exist, the local node will continue to interact with the node that stores the corresponding encrypted document before returning the document to the data user.

[0071] In summary, the embodiments of this application provide a distributed searchable encryption architecture without the participation of a trusted third-party institution. It can use attribute Bloom filters to protect the privacy of multi-keyword queries for data users, while supporting dynamic updates of document indexes under the settings of multiple data owners and multiple data users. Compared with traditional searchable encryption schemes, it ensures the credibility of query results by introducing blockchain and IPFS, and improves the storage security and efficiency of encrypted documents.

[0072] The blockchain-based dynamic searchable encryption method proposed in this application can achieve secure and efficient retrieval of encrypted data without the participation of a third-party trusted institution, effectively protect the privacy of data users' multi-keyword queries, and ensure the credibility of query results by introducing blockchain and IPFS, thereby improving the storage security and efficiency of encrypted documents.

[0073] Next, referring to the accompanying drawings, a blockchain-based dynamically searchable encryption device is described according to an embodiment of this application.

[0074] Figure 5 This is a block diagram of a blockchain-based dynamically searchable encryption device according to an embodiment of this application.

[0075] like Figure 5 As shown, the blockchain-based dynamic searchable encryption device 10 includes: a first encryption module 100, a second encryption module 200, and a search module 300.

[0076] The first encryption module 100 is used to encrypt the data file of the data owner using a symmetric encryption algorithm, upload the encrypted data file to the IPFS network, and obtain the unique identifier of the encrypted data file in the IPFS network; the second encryption module 200 is used to extract keywords from the data file and perform encryption operations on the keywords using a preset encryption algorithm to generate a secure index; the search module 300 is used to upload the unique identifier and the secure index to the blockchain network, authenticate the data user's identity according to the authentication request, and send secret parameters to the data user after successful authentication, so that the data user can use the query trapdoor generated according to the secret parameters and the search request to search on the blockchain network.

[0077] Furthermore, the second encryption module 200 is used to generate a keyword set based on keywords extracted from the data file, perform encryption operations on all keywords in the keyword set according to a randomly generated temporary key, and fill the positions of the hash calculations of the concatenated keywords in the Bloom filter to obtain the security index.

[0078] Furthermore, the apparatus 10 in this embodiment of the application also includes an update module and a verification module.

[0079] The update module is used to generate a new keyword set based on new keywords extracted from the data file after generating the security index, create a new security index for the new keyword set, and update the security index of the data file using the new security index; the verification module is used to authenticate the data owner before encrypting the data file of the data owner using a symmetric encryption algorithm, and generate secret parameters based on the data owner's shared parameters after the data owner is verified.

[0080] It should be noted that the foregoing explanation of the embodiment of the blockchain-based dynamic searchable encryption method also applies to the blockchain-based dynamic searchable encryption device of this embodiment, and will not be repeated here.

[0081] The blockchain-based dynamic searchable encryption device proposed in the embodiments of this application can achieve secure and efficient retrieval of encrypted data without the participation of a third-party trusted institution, effectively protect the privacy of data users' multi-keyword queries, and ensure the credibility of query results by introducing blockchain and IPFS, thereby improving the storage security and efficiency of encrypted documents.

[0082] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0083] The memory 601, the processor 602, and the computer program stored on the memory 601 and capable of running on the processor 602.

[0084] When the processor 602 executes the program, it implements the blockchain-based dynamically searchable encryption method provided in the above embodiments.

[0085] Furthermore, electronic devices also include:

[0086] Communication interface 603 is used for communication between memory 601 and processor 602.

[0087] The memory 601 is used to store computer programs that can run on the processor 602.

[0088] The memory 601 may include high-speed RAM (Random Access Memory) memory, and may also include non-volatile memory, such as at least one disk storage.

[0089] If the memory 601, processor 602, and communication interface 603 are implemented independently, then the communication interface 603, memory 601, and processor 602 can be interconnected via a bus to complete communication between them. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0090] Optionally, in a specific implementation, if the memory 601, processor 602, and communication interface 603 are integrated on a single chip, then the memory 601, processor 602, and communication interface 603 can communicate with each other through an internal interface.

[0091] The processor 602 may be a CPU (Central Processing Unit), an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of this application.

[0092] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described blockchain-based dynamically searchable encryption method.

[0093] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0094] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0095] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0096] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (FPGAs), field-programmable gate arrays (FPGAs), etc.

[0097] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

Claims

1. A blockchain-based dynamically searchable encryption method, characterized in that, Includes the following steps: The data owner's data file is encrypted using a symmetric encryption algorithm, and the encrypted data file is uploaded to the IPFS network. A unique identifier for the encrypted data file is then obtained from the IPFS network. Keywords are extracted from the data file, and the keywords are encrypted using a preset encryption algorithm to generate a secure index; The step of extracting keywords from the data file and encrypting the keywords using a preset encryption algorithm to generate a secure index includes: generating a keyword set based on the keywords extracted from the data file; encrypting all keywords in the keyword set using a randomly generated temporary key, and filling the positions of the concatenated keywords in a Bloom filter with hash calculations to obtain the secure index; after generating the secure index, the step further includes: generating a new keyword set based on new keywords extracted from the data file; creating a new secure index for the new keyword set, and updating the secure index of the data file using the new secure index; the step of creating a new secure index for the new keyword set includes: The data owner randomly selects a temporary key. For all keys in the key set, the data owner calculates... Next, the data owner randomly generates n-1 elements. And perform the following operation on the nth element: Among them, W i,j sk represents a set of keywords. i,j This represents the temporary key, h(.) represents the hash function, and w... i,j,k Let represent the k-th keyword in the j-th file of the i-th data owner, and q1 represent the secret parameter shared by the authenticated data owners. The data owner uses n independent hash functions H1(), H2(), ..., H n ()right The hash operation yields: Each of them The address in the attribute Bloom filter; The unique identifier and the security index are uploaded to the blockchain network. Data users are authenticated according to an authentication request. Upon successful authentication, secret parameters are sent to the data user, enabling the user to perform a search on the blockchain network using a query trap generated by encrypting the secret parameters and at least one keyword in the search request. The search process includes on-chain search and IPFS search, wherein the on-chain search includes: Upon receiving the query trapdoor sent by the data user, all nodes on the blockchain network use the query trapdoor to select from n hash functions in the index. Extract the corresponding element from the position it represents. Then calculate as follows: Each node checks whether the following equation is true: in, h(w) represents the value of the key encryption operation performed by the data owner on the data file. i,j,k ) represents the k-th keyword w i,j,k The hash value, T1 represents the key parameter required by the chain node to match the index in the query trapdoor, T2 represents a parameter required by the chain node to perform the matching operation, and T3 represents another parameter required by the chain node to perform the matching operation. If the equation holds true, the data file is the file that meets the query conditions of the data user, and the node will add the unique identifier of the data file in IPFS to the list. In this context, if the query keyword set and the keyword set of the data file contain the same keywords, then the equation must hold true. After each node completes its search algorithm, the blockchain network uses a specific consensus algorithm to reach an agreement on the search results, upon receiving the lists sent by each node. After that, the master node will communicate with the uploader. The data owner of the Chinese document interacts with the document to obtain the corresponding decryption key and adds it to a new list. In the process, the master node will list and Returned together to the data user; The IPFS search includes: Data users will store a list of unique identifiers for data documents that match the query criteria in IPFS. The data is sent to the local node, which then performs a query and determines the appropriate table. The local node checks whether the corresponding encrypted document is stored on the storage device of this node. If it exists on the storage device, the node will directly return the encrypted document to the data user. If it does not exist on the storage device, the local node will continue to interact with the node that stores the corresponding encrypted document and then return the document to the data user.

2. The method according to claim 1, characterized in that, Before encrypting the data owner's data file using a symmetric encryption algorithm, the following steps are also included: The data owner must be authenticated; After the data owner is verified, secret parameters are generated based on the data owner's shared parameters.

3. The method according to any one of claims 1-2, characterized in that, The query trap is: in, Let represent the set of keywords in the search request, u represent the data user, and T1 represent the key parameters required by the chained nodes in the query trapdoor for matching with the index. This represents the value obtained by performing an encryption operation on all keywords in the query set. h(w) represents the size of the query set, i.e., the number of query keywords. k ) represents the hash value of the k-th key, w k Let T1 represent the k-th key, k∈[1,n], where n is a positive integer. Let T2 represent one parameter required for the matching operation of the chain nodes, and T3 represent another parameter required for the matching operation of the chain nodes. Represents hash values, H1(), H2(), ..., H n () represents a hash function, w1 represents the first query key, and w2 represents the second query key. Indicates the first The query keywords, || represents a cascading operation. q u The inverse of q, q2 represents the secret parameter, q u and r u This represents a temporary key that the user randomly selects from a hash function.

4. A blockchain-based dynamically searchable encryption device, characterized in that, include: The first encryption module is used to encrypt the data file of the data owner using a symmetric encryption algorithm, upload the encrypted data file to the IPFS network, and obtain the unique identifier of the encrypted data file in the IPFS network. The second encryption module is used to extract keywords from the data file and perform encryption operations on the keywords using a preset encryption algorithm to generate a secure index. The second encryption module is used to generate a keyword set based on keywords extracted from the data file, and to perform encryption operations on all keywords in the keyword set based on a randomly generated temporary key, and to fill the positions of the hash calculation of the concatenated keywords in the Bloom filter to obtain the security index; The search module is used to upload the unique identifier and the security index to the blockchain network, authenticate the data user's identity according to the authentication request, and send secret parameters to the data user after successful authentication, so that the data user can use the query trap generated by encryption based on the secret parameters and at least one keyword in the search request to search on the blockchain network. The search process includes on-chain search and IPFS search, wherein the on-chain search includes: Upon receiving the query trapdoor sent by the data user, all nodes on the blockchain network use the query trapdoor to select from n hash functions in the index. Extract the corresponding element from the position it represents. Then calculate k = 1 / Wi,jghwi,j,k + q1·ski,j as follows: Each node checks whether the following equation is true: in, h(w) represents the value of the key encryption operation performed by the data owner on the data file. i,j,k ) represents the k-th keyword w i,j,k The hash value, T1 represents the key parameter required by the chain node to match the index in the query trapdoor, T2 represents a parameter required by the chain node to perform the matching operation, and T3 represents another parameter required by the chain node to perform the matching operation. If the equation holds true, the data file is the file that meets the query conditions of the data user, and the node will add the unique identifier of the data file in IPFS to the list. In this context, if the query keyword set and the keyword set of the data file contain the same keywords, then the equation must hold true. After each node completes its search algorithm, the blockchain network uses a specific consensus algorithm to reach an agreement on the search results, upon receiving the lists sent by each node. After that, the master node will communicate with the uploader. The data owner of the Chinese document interacts with the document to obtain the corresponding decryption key and adds it to a new list. In the process, the master node will list and Returned together to the data user; The IPFS search includes: Data users will store a list of unique identifiers for data documents that match the query criteria in IPFS. The data is sent to the local node, which then performs a query and determines the appropriate table. The local node will check whether the corresponding encrypted document is stored in the storage device of the node. If it exists in the storage device, the node will directly return the encrypted document to the data user. If it does not exist in the storage device, the local node will continue to interact with the node that stores the corresponding encrypted document and then return the document to the data user. The update module is configured to, after generating a security index, generate a new keyword set based on new keywords extracted from the data file, create a new security index for the new keyword set, and update the security index of the data file using the new security index; the step of creating a new security index for the new keyword set includes: The data owner randomly selects a temporary key. For all keys in the key set, the data owner calculates... Next, the data owner randomly generates n-1 elements. And perform the following operation on the nth element: Among them, W i,j sk represents a set of keywords. i,j This represents the temporary key, h(.) represents the hash function, and w... i,j,k Let represent the k-th keyword in the j-th file of the i-th data owner, and q1 represent the secret parameter shared by the authenticated data owners. The data owner uses n independent hash functions H1(), H2(), ..., H n ()right The hash operation yields: Each of them The address in the attribute Bloom filter.

5. The apparatus according to claim 4, characterized in that, Also includes: The verification module is used to authenticate the data owner before encrypting the data file using a symmetric encryption algorithm, and to generate secret parameters based on the data owner's shared parameters after the data owner is successfully verified.

6. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the blockchain-based dynamically searchable encryption method as described in any one of claims 1-3.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the blockchain-based dynamically searchable encryption method as described in any one of claims 1-3.

Images