A method, device, medium and equipment for constructing an encrypted database

Abstract

The present invention discloses a method, device, medium and equipment for constructing an encrypted database, including: encrypting data using a symmetric encryption algorithm, encrypting a symmetric key using a public key encryption algorithm, encrypting and retrieving keywords using a searchable encryption algorithm, and constructing data addition operations, data query operations and data deletion operations of an encrypted database based on a blockchain; the use of the embodiments of the present invention can effectively solve the problems of weak security and low credibility of a front-end proxy of an encrypted database.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, medium and equipment for constructing an encrypted database. Background Art

[0002] Data is both a resource and a wealth. In an environment where data is exploding due to the rapid development of social informatization and networking, protecting important data from being leaked has become a major issue of concern to the international community. As an indispensable tool for storing big data, databases have become an indispensable data "file cabinet" for governments, enterprises, and even individuals in various countries, and the security of this "file cabinet" has become a hot issue for countless researchers.

[0003] At present, encrypted databases usually use front-end proxy and encryption gateway technology, that is, a security proxy service is added before the database. Users who access the database must go through the security proxy service, and security policies such as data encryption and decryption, access control, etc. are implemented in this service. Then, the security proxy service implements data storage through the database access interface. The security proxy service exists between the client application and the database storage engine, and is responsible for completing the encryption and decryption of the data. The encrypted data is stored in the security proxy service. Therefore, the security of the security proxy directly affects the data security of the overall encrypted database solution. Once the security proxy is breached or there is malicious use, the encrypted database is useless. Therefore, it is urgent to study a method for building an encrypted database that can effectively solve the problem of weak front-end proxy security. Summary of the invention

[0004] The present invention provides an encrypted database construction method, device, medium and equipment to solve the problem of weak security of the prior art front-end proxy. The present invention makes full use of the excellent characteristics of blockchain, such as distribution, tamper-proof, anti-repudiation, traceability, security and reliability, and acts as a front-end proxy for the encrypted database. It can effectively solve the problem of weak security and low credibility of the front-end proxy of the encrypted database, and improve the security and credibility of the front-end proxy of the encrypted database.

[0005] To achieve the above purpose, an embodiment of the present invention provides a method for constructing an encrypted database, comprising:

[0006] The operation methods for constructing an encrypted database include data adding operation, data query operation, and data deleting operation;

[0007] The data adding operation includes:

[0008] When a user adds data to be added in the encrypted database, the user generates several keywords to be added corresponding to the data to be added; according to the preset corresponding relationship, the relevant data corresponding to the data to be added is found, and the data to be added and the relevant data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added; the symmetric key is encrypted using a public key encryption algorithm to obtain a key ciphertext; each of the keywords to be added is encrypted using a keyword encryption algorithm of a searchable encryption algorithm to obtain a ciphertext of the keyword to be added; a trapdoor to be added corresponding to each of the keywords to be added is generated using a trapdoor algorithm of a searchable encryption algorithm; the ciphertext of the data to be added, the key ciphertext, the ciphertext of the keyword to be added and the trapdoor to be added are sent to the blockchain, and the first smart contract is called;

[0009] When the blockchain receives the data ciphertext to be added, the key ciphertext, the keyword ciphertext to be added, and the trapdoor to be added, the first smart contract sends the data ciphertext to be added and the key ciphertext to the encrypted database, and the encrypted database inserts the data ciphertext to be added and the key ciphertext into the encrypted database, and returns the data {id} corresponding to the data to be added; when the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext, and uses the search algorithm of the searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation; wherein each trapdoor pair ciphertext includes the keyword ciphertext to be added and the trapdoor to be added corresponding to the keyword to be added;

[0010] The data query operation includes:

[0011] When the user searches for a keyword to be queried, a trapdoor algorithm of the searchable encryption algorithm is used to generate a trapdoor to be queried corresponding to the keyword to be queried, and the trapdoor to be queried is sent to the blockchain to call the second smart contract;

[0012] When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried;

[0013] When the user receives the encrypted data, the user uses the private key generated by the user to decrypt the key ciphertext to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted data to obtain the original data;

[0014] The data deletion operation includes:

[0015] When the user deletes the data to be deleted in the encrypted database, the ID corresponding to the data to be deleted is sent to the blockchain, and the third smart contract is called;

[0016] When the blockchain receives the ID corresponding to the data to be deleted, the third smart contract reads the encrypted database and deletes the data to be deleted.

[0017] As an improvement of the above solution, the searchable encryption algorithm includes: a keyword encryption algorithm, a trapdoor algorithm, and a search algorithm;

[0018] Among them, three finite cyclic groups G1, G2 and G3 of order q are selected. T , and the bilinear map e:G1×G2→G T G1, any two elements g, h satisfy g∈G1, h∈G2, any two integers x, y satisfy e(g x ,h y ) = e(g, h) xy ∈G T ;

[0019] Randomly select an integer sk se As the private key of the searchable encryption algorithm, randomly select g∈G1, the one-way hash function h→G T , then for any keyword w:

[0020] The keyword encryption algorithm includes:

[0021] Where r is a randomly selected integer;

[0022] The trapdoor algorithm includes:

[0023] Where r' is a randomly selected integer;

[0024] The search algorithm includes:

[0025] e(Tr1', C2')?=e(Tr1', Tr2'), indicating whether e(Tr1', C2') and e(Tr1', Tr2') are equal. If they are equal, the block data matches the trapdoor successfully.

[0026] As an improvement of the above solution, after the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and uses a search algorithm of a searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation, including:

[0027] When the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and retrieves the latest first block data in the blockchain using a search algorithm of a searchable encryption algorithm:

[0028] When the first block data is retrieved and successfully matches the trapdoor to be added, the first block data is read, and the data {id} is inserted into the first block data to obtain new first block data, and the new first block data is re-uploaded to the blockchain, and the search ends;

[0029] When the first block data is retrieved and the trapdoor to be added is not successfully matched, the block data consisting of the newly generated keyword ciphertext to be added and the data {id} is uploaded to the blockchain;

[0030] After the traversal of the ciphertexts for all the trapdoors is completed, the data adding operation is ended.

[0031] As an improvement of the above solution, when the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried, including:

[0032] When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data from the blockchain:

[0033] When the second block data is retrieved and successfully matches the trapdoor to be queried, the second block data is read, the encrypted data corresponding to the id of the second block data is queried from the encrypted database, and the encrypted data is returned to the user; if any encrypted data corresponding to the id of the second block data does not exist, the id is deleted from the second block data, new second block data is obtained, and the new second block data is re-uploaded to the blockchain;

[0034] When the retrieved second block data does not successfully match the trapdoor to be queried, a message indicating that there is no search content is returned to the user.

[0035] As an improvement of the above scheme, the related data corresponding to the data to be added is found according to the preset corresponding relationship, and the data to be added and the related data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added, including:

[0036] According to the preset corresponding relationship, each column of data where the data to be added is located is found, and the data to be added and each column of data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added.

[0037] To achieve the above object, an embodiment of the present invention further provides: a controller;

[0038] The controller is configured to: perform data adding operation, data query operation, and data deleting operation;

[0039] The data adding operation includes:

[0040] When a user adds data to be added in the encrypted database, the user generates several keywords to be added corresponding to the data to be added; according to the preset corresponding relationship, the relevant data corresponding to the data to be added is found, and the data to be added and the relevant data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added; the symmetric key is encrypted using a public key encryption algorithm to obtain a key ciphertext; each of the keywords to be added is encrypted using a keyword encryption algorithm of a searchable encryption algorithm to obtain a ciphertext of the keyword to be added; a trapdoor to be added corresponding to each of the keywords to be added is generated using a trapdoor algorithm of a searchable encryption algorithm; the ciphertext of the data to be added, the key ciphertext, the ciphertext of the keyword to be added and the trapdoor to be added are sent to the blockchain, and the first smart contract is called;

[0041] When the blockchain receives the data ciphertext to be added, the key ciphertext, the keyword ciphertext to be added, and the trapdoor to be added, the first smart contract sends the data ciphertext to be added and the key ciphertext to the encrypted database, and the encrypted database inserts the data ciphertext to be added and the key ciphertext into the encrypted database, and returns the data {id} corresponding to the data to be added; when the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext, and uses the search algorithm of the searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation; wherein each trapdoor pair ciphertext includes the keyword ciphertext to be added and the trapdoor to be added corresponding to the keyword to be added;

[0042] The data query operation includes:

[0043] When the user searches for a keyword to be queried, a trapdoor algorithm of the searchable encryption algorithm is used to generate a trapdoor to be queried corresponding to the keyword to be queried, and the trapdoor to be queried is sent to the blockchain to call the second smart contract;

[0044] When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried;

[0045] When the user receives the encrypted data, the user uses the private key generated by the user to decrypt the key ciphertext to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted data to obtain the original data;

[0046] The data deletion operation includes:

[0047] When the user deletes the data to be deleted in the encrypted database, the ID corresponding to the data to be deleted is sent to the blockchain, and the third smart contract is called;

[0048] When the blockchain receives the ID corresponding to the data to be deleted, the third smart contract reads the encrypted database and deletes the data to be deleted.

[0049] As an improvement of the above solution, the searchable encryption algorithm includes: a keyword encryption algorithm, a trapdoor algorithm, and a search algorithm;

[0050] Among them, three finite cyclic groups G1, G2 and G3 of order q are selected. T , and the bilinear map e:G1×G2→G T G1, any two elements g, h satisfy g∈G1, h∈G2, any two integers x, y satisfy e(g x ,h y ) = e(g, h) xy ∈G T ;

[0051] Randomly select an integer sk se As the private key of the searchable encryption algorithm, randomly select g∈G1, the one-way hash function h→G T , then for any keyword w:

[0052] The keyword encryption algorithm includes:

[0053] Where r is a randomly selected integer;

[0054] The trapdoor algorithm includes:

[0055] Where r' is a randomly selected integer;

[0056] The search algorithm includes:

[0057] e(Tr1', C2')?=e(Tr1', Tr2'), indicating whether e(Tr1', C2') and e(Tr1', Tr2') are equal. If they are equal, the block data matches the trapdoor successfully.

[0058] As an improvement of the above scheme, the related data corresponding to the data to be added is found according to the preset corresponding relationship, and the data to be added and the related data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added, including:

[0059] According to the preset corresponding relationship, each column of data where the data to be added is located is found, and the data to be added and each column of data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added.

[0060] To achieve the above objectives, an embodiment of the present invention further provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the encrypted database construction method as described above.

[0061] To achieve the above objectives, an embodiment of the present invention also provides an encrypted database construction device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the encrypted database construction method described above when executing the computer program.

[0062] Compared with the prior art, the embodiments of the present invention provide an encrypted database construction method, device, medium and equipment, which construct an encrypted database based on blockchain, and use blockchain as a front-end proxy for the encrypted database, which can effectively solve the problem of weak security and low credibility of the front-end proxy of the encrypted database, and improve the security and credibility of the front-end proxy of the encrypted database. Furthermore, the embodiments of the present invention make full use of the searchable encryption algorithm to solve the problem of low retrieval efficiency of the encrypted database. It can be seen that the embodiments of the present invention integrate the front-end proxy and application layer transformation technology, which can improve the security of the encrypted database, effectively solve the problem of weak security of the front-end proxy, and improve the retrieval efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 is a flow chart of a method for constructing an encrypted database provided by an embodiment of the present invention;

[0064] Figure 2 It is a structural block diagram of an encrypted database construction device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] See also Figure 1 , Figure 1 : is a flowchart of a method for constructing an encrypted database provided by an embodiment of the present invention, the method for constructing an encrypted database comprising:

[0067] The operation method of constructing the encrypted database includes a data adding operation S1, a data query operation S2, and a data deleting operation S3;

[0068] The data adding operation S1 includes:

[0069] S11. When a user adds data to be added in the encrypted database, the user generates several keywords to be added corresponding to the data to be added; according to the preset corresponding relationship, the relevant data corresponding to the data to be added is found, and the data to be added and the relevant data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added; the symmetric key is encrypted using a public key encryption algorithm to obtain a key ciphertext; each of the keywords to be added is encrypted using a keyword encryption algorithm of a searchable encryption algorithm to obtain a ciphertext of the keywords to be added; a trapdoor to be added corresponding to each of the keywords to be added is generated using a trapdoor algorithm of a searchable encryption algorithm; the ciphertext of the data to be added, the key ciphertext, the ciphertext of the keywords to be added, and the trapdoor to be added are sent to the blockchain, and the first smart contract is called;

[0070] S12. When the blockchain receives the ciphertext of the data to be added, the ciphertext of the key, the ciphertext of the keyword to be added, and the trapdoor to be added, the first smart contract sends the ciphertext of the data to be added and the ciphertext of the key to the encrypted database, and the encrypted database inserts the ciphertext of the data to be added and the ciphertext of the key into the encrypted database, and returns the data {id} corresponding to the data to be added; after the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext, and uses the search algorithm of the searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation; wherein each trapdoor pair ciphertext includes the ciphertext of the keyword to be added and the trapdoor to be added corresponding to the keyword to be added;

[0071] The data query operation S2 includes:

[0072] S21. When a user searches for a keyword to be queried, a trapdoor algorithm of a searchable encryption algorithm is used to generate a trapdoor to be queried corresponding to the keyword to be queried, and the trapdoor to be queried is sent to the blockchain, and a second smart contract is called;

[0073] S22. When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried;

[0074] S23. After receiving the encrypted data, the user uses the private key generated by the user to decrypt the key ciphertext to obtain a symmetric key, and uses the symmetric key to decrypt the encrypted data to obtain the original data;

[0075] The data deletion operation S3 includes:

[0076] S31. When the user deletes the data to be deleted in the encrypted database, the ID corresponding to the data to be deleted is sent to the blockchain, and the third smart contract is called;

[0077] S32. When the blockchain receives the ID corresponding to the data to be deleted, the third smart contract reads the encrypted database and deletes the data to be deleted.

[0078] It should be noted that, in the embodiment of the present invention, the symmetric encryption algorithm (Enc sys , Dec sys ) to encrypt data using a public key encryption algorithm (Enc pub , Dec pub ) to encrypt the symmetric key using a searchable encryption algorithm (Enc se , Trapdoor, Search) to encrypt and retrieve keywords; among them, Enc sys The encryption algorithm represents the symmetric encryption algorithm, Dec sys Indicates the decryption algorithm of the symmetric encryption algorithm, Enc pub Indicates the encryption algorithm of the public key encryption algorithm, Dec pub Indicates the decryption algorithm of the public key encryption algorithm, Enc se Represents the keyword encryption algorithm of the searchable encryption algorithm, Trapdoor represents the trapdoor algorithm of the searchable encryption algorithm, and Search represents the search algorithm of the searchable encryption algorithm.

[0079] And the user first generates {pk, sk} as the public key and private key of the public key encryption algorithm; {sk se} as the private key of the searchable encryption algorithm.

[0080] Specifically, the searchable encryption algorithm includes: keyword encryption algorithm, trapdoor algorithm, search algorithm;

[0081] Among them, three finite cyclic groups G1, G2 and G3 of order q are selected. T , and the bilinear map e:G1×G2→G T G1, any two elements g, h satisfy g∈G1, h∈G2, any two integers x, y satisfy e(g x ,h y ) = e(g, h) xy ∈G T ;

[0082] Randomly select an integer sk se As the private key of the searchable encryption algorithm, randomly select g∈G1, the one-way hash function h→G T , then for any keyword w:

[0083] The keyword encryption algorithm includes:

[0084] Where r is a randomly selected integer;

[0085] The trapdoor algorithm includes:

[0086] Where r' is a randomly selected integer;

[0087] The search algorithm includes:

[0088] e(Tr1', C2')?=e(Tr1', Tr2'), indicating whether e(Tr1', C2') and e(Tr1', Tr2') are equal. If they are equal, the block data matches the trapdoor successfully.

[0089] It can be understood that the keyword ciphertext C consists of two parts, C1' and C2', and the trapdoor Tr consists of two parts, Tr1' and Tr2'.

[0090] Specifically, the related data corresponding to the data to be added is found according to the preset corresponding relationship, and the data to be added and the related data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added, including:

[0091] According to the preset corresponding relationship, each column of data where the data to be added is located is found, and the data to be added and each column of data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added.

[0092] Specifically, after the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and uses a search algorithm of a searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation, including:

[0093] When the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and retrieves the latest first block data in the blockchain using a search algorithm of a searchable encryption algorithm:

[0094] When the first block data is retrieved and successfully matches the trapdoor to be added, the first block data is read, and the data {id} is inserted into the first block data to obtain new first block data, and the new first block data is re-uploaded to the blockchain, and the search ends;

[0095] When the first block data is retrieved and the trapdoor to be added is not successfully matched, the block data consisting of the newly generated keyword ciphertext to be added and the data {id} is uploaded to the blockchain;

[0096] After the traversal of the ciphertexts for all the trapdoors is completed, the data adding operation is ended.

[0097] In a specific embodiment, the data adding operation includes:

[0098] When adding a row of data (i.e., data to be added) to the encrypted database, the user first generates several keywords {w1, w2, ..., w n}; Then randomly generate a symmetric key {sk sys} and use the symmetric key to encrypt each column of the row data to obtain the ciphertext of the data to be added {c*}; then use the public key encryption algorithm to encrypt the symmetric key {sk sys} to encrypt and obtain the key ciphertext {C sk}; Then, all the keywords to be added are encrypted using the keyword encryption algorithm of the searchable encryption algorithm to obtain the ciphertext of the keywords to be added {C1, C2, ..., C n}, and then use the trapdoor algorithm of the searchable encryption algorithm to generate the trapdoors to be added corresponding to the keywords to be added {Tr1, Tr2, ..., Tr n}; Finally, the user adds the ciphertext of the data to be added {c*}, the ciphertext of the key {C sk}, the ciphertext of the keywords to be added {C1, C2, ..., Cn} and the trapdoors to be added {Tr1, Tr2, ..., Tr n}Send to the blockchain to call the first smart contract; it can be understood that the first smart contract is a smart contract for data addition operation, which can realize the function of data addition;

[0099] Blockchain: When receiving the ciphertext {c*} of the user data to be added and the ciphertext {C sk}、Keyword ciphertext to be added {C1,C2,...,C n} and the trapdoors to be added {Tr1, Tr2, ..., Tr n}, the first smart contract directly converts the ciphertext {c*, C sk} is sent to the encrypted database, and the encrypted database returns the data {id} corresponding to the row of data; when the first smart contract receives the data {id}, the first smart contract traverses the ciphertext {C1, Tr1} of each trapdoor to be added with the keyword, and uses the searchable encryption search algorithm to retrieve from the latest first block data of the blockchain:

[0100] ① When the first block data and the trap door T to be added are retrieved r1 When the match is successful, the first block data is read, that is, the first block data {C: id1, id2, ..., id m}, and insert the data {id} into the first block data to obtain new first block data {C*: id1, id2, ..., id m , id}, the new first block data {C*: id1, id2, ..., id m , id} re-upload to the blockchain and end the search; it can be understood that the first block data in this step consists of the keyword ciphertext C to be added and id1, id2, ..., id m The new first block data consists of the new keyword ciphertext C* to be added and id1, id2, ..., id m , id composition;

[0101] ② When the first block data and the trap door T to be added are retrieved r1 If the match fails, the newly generated keyword ciphertext to be added and the block data {C*:id} composed of the data {id} are uploaded to the blockchain. It can be understood that the keyword ciphertext to be added C* in this step is not necessarily related to the keyword ciphertext to be added C* in the above step ①. The two only represent the newly generated keyword ciphertext to be added.

[0102] After all the keywords to be added have been traversed and searched, the data adding operation is completed.

[0103] It can be understood that step ① and step ② are parallel. Step ① refers to retrieving the matching first block data in the blockchain; step ② refers to traversing the blockchain without retrieving the matching first block data.

[0104] Specifically, when the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried, including:

[0105] When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data from the blockchain:

[0106] When the second block data is retrieved and successfully matches the trapdoor to be queried, the second block data is read, the encrypted data corresponding to the id of the second block data is queried from the encrypted database, and the encrypted data is returned to the user; if any encrypted data corresponding to the id of the second block data does not exist, the id is deleted from the second block data, new second block data is obtained, and the new second block data is re-uploaded to the blockchain;

[0107] When the retrieved second block data does not successfully match the trapdoor to be queried, a message indicating that there is no search content is returned to the user.

[0108] In a specific embodiment, the data query operation includes:

[0109] User: When the user needs to retrieve the keyword w to be queried, the trapdoor algorithm of the searchable encryption algorithm is used to generate the trapdoor Tr to be queried corresponding to the keyword w to be queried, and the trapdoor Tr to be queried is sent to the blockchain, the second smart contract; it can be understood that the second smart contract is a smart contract for data query operation, which can realize the function of data query;

[0110] Blockchain: When receiving the trapdoor Tr to be queried, the second smart contract uses a searchable encryption search algorithm to retrieve the latest second block data from the blockchain:

[0111] ① When the second block data is retrieved and successfully matches the trapdoor Tr to be queried, the second block data is read, that is, the second block data is obtained to obtain {C: id1, id2, ..., id m}, query the encrypted database to obtain id1, id2, ..., id m The corresponding row encrypted data (i.e. encrypted data) is returned to the user; if id1, id2, ..., id mIf the row encrypted data corresponding to any id does not exist, the encrypted data of the second block {C: id1, id2, ..., id m} to obtain new second block data, and then re-upload the second block data to the blockchain. It can be understood that in this step, the second block data consists of the keyword ciphertext C to be added and id1, id2, ..., id m The composition of the keyword ciphertext C to be added in this step and id1, id2, ..., id m The same as step ① in the previous specific embodiment, the first block data to be added keyword ciphertext C and id1, id2, ..., id m There is no necessary connection, it just represents the keyword ciphertext to be added and its corresponding ID.

[0112] ② When the retrieved second block data does not successfully match the trapdoor Tr to be queried, it returns to the user that there is no search content.

[0113] User: After receiving the encrypted data, the user first uses the private key sk to decrypt the key ciphertext to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted data to obtain the original data.

[0114] In a specific embodiment, the data deletion operation includes:

[0115] User: When the user needs to delete the row data of a certain ID (i.e., the data to be deleted), the user sends the corresponding ID to the blockchain and calls the third smart contract; it can be understood that the third smart contract is a smart contract for data deletion operation, which can realize the function of data deletion;

[0116] Blockchain: The third smart contract directly reads the encrypted database and deletes the row data corresponding to the ID.

[0117] The method for constructing an encrypted database provided by the embodiment of the present invention can effectively solve the problem of weak security and low credibility of the front-end proxy of the encrypted database by constructing an encrypted database based on the blockchain, and further, the embodiment of the present invention makes full use of the searchable encryption algorithm to solve the problem of low retrieval efficiency of the encrypted database. Moreover, the embodiment of the present invention does not have a high degree of transformation on the application layer, and all data is transmitted after encryption. No matter the node of the blockchain or the encrypted database, the data cannot be decrypted, which can effectively improve the security of the data. It can be seen that the embodiment of the present invention integrates the front-end proxy and the application layer transformation technology, which can improve the security of the encrypted database, effectively solve the problem of weak security of the front-end proxy, and improve the retrieval efficiency at the same time.

[0118] An embodiment of the present invention provides an encrypted database construction device, including: a controller;

[0119] The controller is configured to: perform data adding operation, data query operation, and data deleting operation;

[0120] The data adding operation includes:

[0121] When a user adds data to be added in the encrypted database, the user generates several keywords to be added corresponding to the data to be added; according to the preset corresponding relationship, the relevant data corresponding to the data to be added is found, and the data to be added and the relevant data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added; the symmetric key is encrypted using a public key encryption algorithm to obtain a key ciphertext; each of the keywords to be added is encrypted using a keyword encryption algorithm of a searchable encryption algorithm to obtain a ciphertext of the keyword to be added; a trapdoor to be added corresponding to each of the keywords to be added is generated using a trapdoor algorithm of a searchable encryption algorithm; the ciphertext of the data to be added, the key ciphertext, the ciphertext of the keyword to be added and the trapdoor to be added are sent to the blockchain, and the first smart contract is called;

[0122] When the blockchain receives the data ciphertext to be added, the key ciphertext, the keyword ciphertext to be added, and the trapdoor to be added, the first smart contract sends the data ciphertext to be added and the key ciphertext to the encrypted database, and the encrypted database inserts the data ciphertext to be added and the key ciphertext into the encrypted database, and returns the data {id} corresponding to the data to be added; when the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext, and uses the search algorithm of the searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation; wherein each trapdoor pair ciphertext includes the keyword ciphertext to be added and the trapdoor to be added corresponding to the keyword to be added;

[0123] The data query operation includes:

[0124] When the user searches for a keyword to be queried, a trapdoor algorithm of the searchable encryption algorithm is used to generate a trapdoor to be queried corresponding to the keyword to be queried, and the trapdoor to be queried is sent to the blockchain to call the second smart contract;

[0125] When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried;

[0126] When the user receives the encrypted data, the user uses the private key generated by the user to decrypt the key ciphertext to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted data to obtain the original data;

[0127] The data deletion operation includes:

[0128] When the user deletes the data to be deleted in the encrypted database, the ID corresponding to the data to be deleted is sent to the blockchain, and the third smart contract is called;

[0129] When the blockchain receives the ID corresponding to the data to be deleted, the third smart contract reads the encrypted database and deletes the data to be deleted.

[0130] Preferably, the searchable encryption algorithm includes: a keyword encryption algorithm, a trapdoor algorithm, and a search algorithm;

[0131] Among them, three finite cyclic groups G1, G2 and G3 of order q are selected. T , and the bilinear map e:G1×G2→G T G1, any two elements g, h satisfy g∈G1, h∈G2, any two integers x, y satisfy e(g x ,h y ) = e(g, h) xy ∈G T ;

[0132] Randomly select an integer sk se As the private key of the searchable encryption algorithm, randomly select g∈G1, the one-way hash function h→G T , then for any keyword w:

[0133] The keyword encryption algorithm includes:

[0134] Where r is a randomly selected integer;

[0135] The trapdoor algorithm includes:

[0136] Where r' is a randomly selected integer;

[0137] The search algorithm includes:

[0138] e(Tr1, C2)?=e(Tr1, Tr2), indicating whether e(Tr1, C2) and e(Tr1, Tr2) are equal. If they are equal, the block data matches the trapdoor successfully.

[0139] Preferably, when the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and retrieves back from the latest first block data in the blockchain using a search algorithm of a searchable encryption algorithm to end the data addition operation, including:

[0140] When the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and retrieves the latest first block data in the blockchain using a search algorithm of a searchable encryption algorithm:

[0141] When the first block data is retrieved and successfully matches the trapdoor to be added, the first block data is read, and the data {id} is inserted into the first block data to obtain new first block data, and the new first block data is re-uploaded to the blockchain, and the search ends;

[0142] When the first block data is retrieved and the trapdoor to be added is not successfully matched, the block data consisting of the newly generated keyword ciphertext to be added and the data {id} is uploaded to the blockchain;

[0143] After the traversal of the ciphertexts for all the trapdoors is completed, the data adding operation is ended.

[0144] Preferably, when the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search for encryption algorithms to retrieve from the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried, including:

[0145] When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data from the blockchain:

[0146] When the second block data is retrieved and successfully matches the trapdoor to be queried, the second block data is read, the encrypted data corresponding to the id of the second block data is queried from the encrypted database, and the encrypted data is returned to the user; if any encrypted data corresponding to the id of the second block data does not exist, the id is deleted from the second block data, new second block data is obtained, and the new second block data is re-uploaded to the blockchain;

[0147] When the retrieved second block data does not successfully match the trapdoor to be queried, a message indicating that there is no search content is returned to the user.

[0148] Preferably, the step of finding relevant data corresponding to the data to be added according to a preset corresponding relationship, encrypting the data to be added and the relevant data using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added includes:

[0149] According to the preset corresponding relationship, each column of data where the data to be added is located is found, and the data to be added and each column of data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added.

[0150] It is worth noting that the working process of the encrypted database construction device described in the embodiment of the present invention can refer to the working process of the encrypted database construction method described in the above embodiment, which will not be repeated here.

[0151] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program; wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the encrypted database construction method described in any of the above embodiments.

[0152] See also Figure 2 , Figure 2 : is a structural block diagram of an encrypted database construction device 20 provided in an embodiment of the present invention, and the encrypted database construction device 20 includes: a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, the steps in the above-mentioned encrypted database construction method embodiment are implemented. Alternatively, when the processor 21 executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0153] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the encrypted database construction device 20.

[0154] The encrypted database construction device 20 may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The encrypted database construction device 20 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art may understand that the schematic diagram is merely an example of the encrypted database construction device 20 and does not constitute a limitation on the encrypted database construction device 20. The encrypted database construction device 20 may include more or fewer components than shown in the figure, or may combine certain components, or different components. For example, the encrypted database construction device 20 may also include input and output devices, network access devices, buses, etc.

[0155] The processor 21 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 21 is the control center of the encrypted database construction device 20, and uses various interfaces and lines to connect various parts of the entire encrypted database construction device 20.

[0156] The memory 22 can be used to store the computer program and / or module. The processor 21 realizes various functions of the encrypted database construction device 20 by running or executing the computer program and / or module stored in the memory 22 and calling the data stored in the memory 22. The memory 22 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 22 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0157] Wherein, if the module / unit integrated in the encrypted database construction device 20 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor 21. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0158] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0159] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for constructing an encrypted database, characterized in that: include: The operation methods for constructing an encrypted database include data adding operation, data query operation, and data deleting operation; The data adding operation includes: When a user adds data to be added in the encrypted database, the user generates several keywords to be added corresponding to the data to be added; according to the preset corresponding relationship, the relevant data corresponding to the data to be added is found, and the data to be added and the relevant data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added; the symmetric key is encrypted using a public key encryption algorithm to obtain a key ciphertext; each of the keywords to be added is encrypted using a keyword encryption algorithm of a searchable encryption algorithm to obtain a ciphertext of the keyword to be added; a trapdoor to be added corresponding to each of the keywords to be added is generated using a trapdoor algorithm of a searchable encryption algorithm; the ciphertext of the data to be added, the key ciphertext, the ciphertext of the keyword to be added and the trapdoor to be added are sent to the blockchain, and the first smart contract is called; When the blockchain receives the data ciphertext to be added, the key ciphertext, the keyword ciphertext to be added, and the trapdoor to be added, the first smart contract sends the data ciphertext to be added and the key ciphertext to the encrypted database, and the encrypted database inserts the data ciphertext to be added and the key ciphertext into the encrypted database, and returns the data {id} corresponding to the data to be added; when the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext, and uses the search algorithm of the searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation; wherein each trapdoor pair ciphertext includes the keyword ciphertext to be added and the trapdoor to be added corresponding to the keyword to be added; The data query operation includes: When the user searches for a keyword to be queried, a trapdoor algorithm of the searchable encryption algorithm is used to generate a trapdoor to be queried corresponding to the keyword to be queried, and the trapdoor to be queried is sent to the blockchain to call the second smart contract; When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried; When the user receives the encrypted data, the user uses the private key generated by the user to decrypt the key ciphertext to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted data to obtain the original data; The data deletion operation includes: When the user deletes the data to be deleted in the encrypted database, the ID corresponding to the data to be deleted is sent to the blockchain, and the third smart contract is called; When the blockchain receives the ID corresponding to the data to be deleted, the third smart contract reads the encrypted database and deletes the data to be deleted.

2. The method for constructing an encrypted database according to claim 1, characterized in that: The searchable encryption algorithms include: keyword encryption algorithm, trapdoor algorithm, and search algorithm; Among them, three finite cyclic groups G1, G2 and G3 of order q are selected. T , and the bilinear map e:G1×G2→G T G1, any two elements g, h satisfy g∈G1, h∈G2, any two integers x, y satisfy e(g x ,h y ) = e(g, h) xy ∈G T ; Randomly select an integer sk se As the private key of the searchable encryption algorithm, randomly select g∈G1, the one-way hash function h→G T , then for any keyword w: The keyword encryption algorithm includes: Where r is a randomly selected integer; The trapdoor algorithm includes: Where r' is a randomly selected integer; The search algorithm includes: e(Tr1', C2')?=e(Tr1', Tr2'), indicating whether e(Tr1', C2') and e(Tr1', Tr2') are equal. If they are equal, the block data matches the trapdoor successfully.

3. The method for constructing an encrypted database according to claim 1, wherein: When the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and uses a search algorithm of a searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation, including: When the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext and retrieves the latest first block data in the blockchain using a search algorithm of a searchable encryption algorithm: When the first block data is retrieved and successfully matches the trapdoor to be added, the first block data is read, and the data {id} is inserted into the first block data to obtain new first block data, and the new first block data is re-uploaded to the blockchain, and the search ends; When the first block data is retrieved and the trapdoor to be added is not matched successfully, the block data consisting of the newly generated keyword ciphertext to be added and the data {id} is uploaded to the blockchain; After the traversal of the ciphertext for all the trapdoors is completed, the data adding operation is ended.

4. The method for constructing an encrypted database according to claim 1, wherein: When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried, including: When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm of a searchable encryption algorithm to retrieve the latest second block data in the blockchain: When the second block data is retrieved and successfully matches the trapdoor to be queried, the second block data is read, the encrypted data corresponding to the id of the second block data is queried from the encrypted database, and the encrypted data is returned to the user; if any encrypted data corresponding to the id of the second block data does not exist, the id is deleted from the second block data, new second block data is obtained, and the new second block data is re-uploaded to the blockchain; When the retrieved second block data does not successfully match the trapdoor to be queried, a message indicating that there is no search content is returned to the user.

5. The method for constructing an encrypted database according to claim 1, wherein: The method of searching for relevant data corresponding to the data to be added according to the preset corresponding relationship, encrypting the data to be added and the relevant data by using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added includes: According to the preset corresponding relationship, each column of data where the data to be added is located is found, and the data to be added and each column of data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added.

6. An encrypted database construction device, characterized in that: include: Controller; The controller is configured to: perform data adding operation, data query operation, and data deleting operation; The data adding operation includes: When a user adds data to be added in the encrypted database, the user generates several keywords to be added corresponding to the data to be added; according to the preset corresponding relationship, the relevant data corresponding to the data to be added is found, and the data to be added and the relevant data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added; the symmetric key is encrypted using a public key encryption algorithm to obtain a key ciphertext; each of the keywords to be added is encrypted using a keyword encryption algorithm of a searchable encryption algorithm to obtain a ciphertext of the keyword to be added; a trapdoor to be added corresponding to each of the keywords to be added is generated using a trapdoor algorithm of a searchable encryption algorithm; the ciphertext of the data to be added, the key ciphertext, the ciphertext of the keyword to be added and the trapdoor to be added are sent to the blockchain, and the first smart contract is called; When the blockchain receives the data ciphertext to be added, the key ciphertext, the keyword ciphertext to be added, and the trapdoor to be added, the first smart contract sends the data ciphertext to be added and the key ciphertext to the encrypted database, and the encrypted database inserts the data ciphertext to be added and the key ciphertext into the encrypted database, and returns the data {id} corresponding to the data to be added; when the first smart contract receives the data {id}, the first smart contract traverses each trapdoor pair ciphertext, and uses the search algorithm of the searchable encryption algorithm to retrieve back from the latest first block data in the blockchain to end the data addition operation; wherein each trapdoor pair ciphertext includes the keyword ciphertext to be added and the trapdoor to be added corresponding to the keyword to be added; The data query operation includes: When the user searches for a keyword to be queried, a trapdoor algorithm of the searchable encryption algorithm is used to generate a trapdoor to be queried corresponding to the keyword to be queried, and the trapdoor to be queried is sent to the blockchain to call the second smart contract; When the blockchain receives the trapdoor to be queried, the second smart contract uses a search algorithm that can search the encryption algorithm to retrieve the latest second block data in the blockchain to obtain encrypted data corresponding to the keyword to be queried; When the user receives the encrypted data, the user uses the private key generated by the user to decrypt the key ciphertext to obtain the symmetric key, and then uses the symmetric key to decrypt the encrypted data to obtain the original data; The data deletion operation includes: When the user deletes the data to be deleted in the encrypted database, the ID corresponding to the data to be deleted is sent to the blockchain, and the third smart contract is called; When the blockchain receives the ID corresponding to the data to be deleted, the third smart contract reads the encrypted database and deletes the data to be deleted.

7. The encrypted database construction device according to claim 6, characterized in that: The searchable encryption algorithms include: keyword encryption algorithm, trapdoor algorithm, and search algorithm; Among them, three finite cyclic groups G1, G2 and G3 of order q are selected. T , and the bilinear map e:G1×G2→G T G1, any two elements g, h satisfy g∈G1, h∈G2, any two integers x, y satisfy e(g x ,h y ) = e(g, h) xy ∈G T : Randomly select an integer sk se As the private key of the searchable encryption algorithm, randomly select g∈G1, the one-way hash function h→G T , then for any keyword w: The keyword encryption algorithm includes: Where r is a randomly selected integer; The trapdoor algorithm includes: Where r' is a randomly selected integer; The search algorithm includes: e(Tr1', C2')?=e(Tr1', Tr2'), indicating whether e(Tr1', C2') and e(Tr1', Tr2') are equal. If they are equal, the block data matches the trapdoor successfully.

8. The encrypted database construction device according to claim 6, characterized in that: The method of searching for relevant data corresponding to the data to be added according to the preset corresponding relationship, encrypting the data to be added and the relevant data by using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added includes: According to the preset corresponding relationship, each column of data where the data to be added is located is found, and the data to be added and each column of data are encrypted using a randomly generated symmetric key and a symmetric encryption algorithm to obtain a ciphertext of the data to be added.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program; wherein, when the computer program is run, it controls the device where the computer-readable storage medium is located to execute the encrypted database construction method according to any one of claims 1 to 5.

10. An encrypted database construction device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the encrypted database construction method according to any one of claims 1 to 5 when executing the computer program.

Images