An efficient and fault-tolerant dynamic phrase search method based on forward and backward privacy

Abstract

The present invention claims protection for an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy, which includes a data owner, a cloud server and a user. The method includes the following steps: a key generation phase, generating keys and public parameters. In the index construction phase, the data owner designs an index structure using piecewise linear chaotic mapping, a minhash function cascaded with an AND‑OR structure, a Bloom filter, an inverted index and a matrix. In the trapdoor generation phase, the user generates a trapdoor using a phrase. In the phrase search phase, the cloud server checks the stored encrypted index and returns an intermediate encryption result. After receiving it, the user decrypts it and returns the obtained file identifier to the cloud server. The cloud server returns the encrypted file in response, and the user decrypts the file. In the update token generation phase, the user generates a token and sends it to the cloud server. In the index update phase, the cloud server updates the index and documents according to the token. The present invention achieves forward privacy, backward privacy, efficient search and dynamic update.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology and cloud-based Internet of Things technology, and is an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy, which can be used in intelligent data processing services in the cloud. Background Art

[0002] In recent years, cloud computing has gained great popularity because it can greatly reduce storage costs, and some stored data needs proper protection because it contains sensitive information, such as corporate financial information, corporate tax information, personal emails, personal health and medical records, etc. However, the data owner and the cloud server are not always in the same trusted domain, which may lead to data leakage risks. Since users cannot control the data, they may suffer from internal attacks from cloud storage server providers or external attacks from hackers. In recent years, many companies have suffered serious data breaches. In order to prevent sensitive data from being leaked when outsourcing storage, a possible solution is to encrypt the data before outsourcing. This will conflict with the availability of data because people cannot perform common operations, such as retrieving encrypted data.

[0003] In order to securely search encrypted data, searchable encryption techniques have been developed in recent years. In addition, when users input, minor spelling errors and format inconsistencies occasionally occur. However, most of the existing searchable encryption methods only support exact search and cannot solve this situation. A direct way to solve this problem is to use a spell checking mechanism. However, this method is not applicable for some reasons. For example, it may require additional interactions, which will increase the computational cost for users. Therefore, in order to meet these requirements, fuzzy search was developed, which not only improves flexibility but also can tolerate minor spelling and format inconsistencies.

[0004] This application proposes an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy. The chaotic encryption algorithm, piecewise linear chaotic mapping and minhash function are used to fuzzy the information, and a Bloom filter-based index is constructed to achieve efficient search and dynamic update. The formal security proof shows that this application has high security and better performance.

[0005] The present invention combines a variant of a Bloom filter, an inverted index and a matrix to design an index structure. A lightweight encryption algorithm is also used to encrypt the position information of each keyword in each document, so that phrase search can be realized. Security analysis and performance analysis show that the present invention has relatively ideal performance. Summary of the invention

[0006] The present invention aims to solve the above problems of the prior art. An efficient and fault-tolerant dynamic phrase search method based on forward and backward privacy is proposed. The technical method of the present invention is as follows:

[0007] An efficient fault-tolerant dynamic phrase search method based on forward and backward privacy includes the following steps:

[0008] In the key generation phase, keys and public parameters are generated;

[0009] During the index construction phase, the data owner designed an index structure using piecewise linear chaotic mapping, a minhash function cascaded with an AND-OR structure, a Bloom filter, an inverted index, and a matrix;

[0010] In the trapdoor generation phase, users use phrases to generate trapdoors;

[0011] In the phrase search phase, the cloud server checks the stored encrypted index and returns the intermediate encrypted result; after receiving it, the user decrypts it and returns the obtained file identifier to the cloud server; the cloud server returns the encrypted file in response, and the user decrypts the file;

[0012] In the update token generation phase, the user generates a token and sends it to the cloud server;

[0013] During the index update phase, the cloud server updates the index and documents based on the token.

[0014] Furthermore, the key generation phase generates keys and public parameters, specifically including:

[0015] (1) Given a security parameter β, randomly select k×λ minhash functions H1 from the same local sensitive hash function family, select the key generation algorithm SKGen(), and select two one-way hash functions H2 and H3;

[0016] (2)sk1←SKGen(1 β ), sk2←SKGen(1 β ), sk3←SKGen(1 β ), after authenticating the user, sk2 is transmitted to the cloud server and the user respectively through a secure channel, and sk1 and sk3 are transmitted to the user through a secure channel; the key is {sk1, sk2, sk3}, and the public parameters are {k, λ, H1, H2, H3}.

[0017] Furthermore, the Piecewise Linear Chaotic Map specifically includes:

[0018] The Piecewise Linear Chaotic Map (PWLCM) is described as:

[0019]

[0020] Among them, x n ∈(0,1),p∈(0,0.5). n is the function value obtained for the nth time, x n-1 is the function value obtained for the n-1th time, F[x n-1 ] indicates that the input value is x n-1 The function value of p represents a decimal, F(1-x n-1 ) is the input value 1-x n-1 The function value of .

[0021] Furthermore, the minhash function of the AND-OR structure specifically includes:

[0022] Minhash is a family of LSH functions, which is used for Jaccard distance. Minhash uses a random hash function for each element in the set and selects the minimum value of all hash values.

[0023] A hash function is called (d1,d2,p1,p2)-sensitive if it satisfies the following two conditions:

[0024] (1) If d(x,y)≤d1, then the probability that h(x)=h(y) is at least p1;

[0025] (2) If d(x,y)≥d2, then the probability that h(x)=h(y) is at most p2;

[0026] Where d(x,y) represents the distance measure between x and y; d1 represents the distance of case (1), d2 represents the distance of case (2), p1 represents the probability under case (1), and p2 represents the probability under case (2).

[0027] The cascade of AND and OR operations can generate more hash tables, making p1 closer to 1 and p2 closer to 0;

[0028] After using k random functions to implement the AND structure, its structure is expressed as g = (h1, h2, ..., h k ); h1,h2,...,h k They represent the hash values ​​calculated by k different hash functions. At this time, if g(x) = g(y) if and only if g(x) and g(y) represent the k hash values ​​obtained when the input values ​​are x and y respectively. Then, λ different AND structures are used to implement the OR structure, and its structure is expressed as f = (g1∨g2∨...∨g λ); At this time, if f(x)=f(y) if and only if Thus, the (d1, d2, p1, p2)-sensitive function family can be transformed into the (d1, d2, p1', p2')-sensitive function family, where p1', p2' represent different probabilities obtained by cascading AND and OR operations respectively.

[0029] Furthermore, the Bloom filter is composed of an m-bit binary vector and many random mapping functions, and is mainly used to find out whether an element exists in a certain set. It operates by mapping the element into the binary vector through the random mapping function.

[0030] Furthermore, the index building phase specifically includes:

[0031] For each w i ∈W D ,i∈[1,Λ],W D is a keyword set, Λ is the number of keywords in the keyword set; (1) w i Each letter of ψ a The ASCII code value of is mapped into a decimal in [0, 1] using a one-way hash function, a∈[1,Y], where Y is w i The number of letters in the word is then mapped to an integer in the interval [0, s] using a piecewise linear chaotic mapping algorithm, where s is the secret parameter of minhash. The resulting set of integers is the keyword w i The code is used as the input of minhash;

[0032] (2) Use the AND-OR structure and randomly select k×λ minhash functions from the same locality-sensitive hash function family to perform a random operation on w. i Perform the operation and get k×λ values ​​x i,j ∈[1,m],i∈[1,Λ],j∈[1,λ], these k×λ values ​​form k hash tables. Assuming that there is no hash collision, each value x i,j Map to an array γ of size m, m>W D ×k×λ, m represents the size of array γ, W D A collection of keywords.

[0033] (3) γ[x i,j ] becomes 1, and γ[x i,a×λ+1 ](i∈[1,Λ],a∈[0,k]) and random γ[x i,υ ]The corresponding bucket points to an array f of size |D| <f1,...,f i ,...,fD >, i∈[1,Λ],υ∈[1,k×λ]∧υ≠a×λ+1), where each element is a linked list, and the first element of the linked list contains the document identifier id(d k ) and a pointer to the next element. If the identifier is id(d k ) contains the keyword w i , then the linked list

[0034] f i = <id(d k ),f k,1 ,...,f k,j ,...,f k,t >,i∈[1,|D|],k∈[1,|D|],j∈[1,t], where t is the keyword w i In the identifier id(d k ),

[0035] POS kj Indicates keyword w i In the identifier id(d k )'s jth occurrence in the document, if the identifier is id(d k ) does not contain the keyword w i , then in the linked list f i Fill v random invalid characters in, Represents the maximum value that v can take.

[0036] (4) Use sk1 to symmetric encrypt the document set D ζ←EncDoc(sk1,D);

[0037] (5) The data owner sends the index γ and the encrypted document set ζ to the cloud server.

[0038] Furthermore, the phrase search phase specifically includes:

[0039] (1) For the cloud server, after receiving the trapdoor T sent by the user,

[0040] ① Generate a list CT to store the user name and counter value ct server , let ct server The initial value of ct is 0. server The value of is increased by 1;

[0041] ② Determine H2(ct server ,sk2)==H2(ct user,sk2) is true, if not, it returns "query failed" to the user, if true, then the position loc of each bucket in the index is calculated loc represents the location of each bucket in the index. Represents the hash value obtained using loc.

[0042] ③For each w i ∈Q, select λ values ​​in the first hash table, according to y and Are the values ​​of equal, map them to the values ​​in the array γ, and judge whether γ[x i,1 ]+…+γ[x i,λ ]==λ is true; if not, check k hash tables in turn, as long as there is one hash table that is true, proceed to step ④;

[0043] ④ If one of the hash tables is established, then for γ[x i,a*λ+1 ], x i,a*λ+1 It means that the a*λ+1th hash value obtained by the hash function for the i-th keyword is the position of the corresponding bucket in the array γ, a∈[0,k-1], and the array f pointed to by it is taken out;

[0044] ⑤Send all retrieved arrays to the user in the order of query;

[0045] (2) After the user receives the array sent by the cloud server, for each element f of each received array kj :

[0046] ① Use formula (1) to calculate the keyword w i The position in the document or a random number,

[0047]

[0048] Get the array before encryption;

[0049] ② The user will calculate all the arrays obtained to determine whether the positions of the keywords to be queried in the same document are connected, and calculate the document identifier set R = {id(d i ),i∈[1,N]}; the user sends R to the cloud server;

[0050] (3) After receiving the response, the cloud server sends the ciphertext of the corresponding document to the user;

[0051] (4) The user uses the key sk1 to decrypt the received ciphertext and obtain the plaintext of the document to be queried.

[0052] Furthermore, the update token generation phase specifically includes:

[0053] (1) Adding documents: The data owner generates a sub-index γ for the document to be added using the same method as the indexing method in step 2. * , γ * and encrypted documents * As an update token Sent to the cloud server; operation type up = "add";

[0054] (2) Deleting a document: The data owner deletes the document d i ,i∈[1,N], document d i The identifier id(d i ) as the update token Sent to the cloud server. Operation type up = "delete";

[0055] (3) Modify the document: Operation type up = "modify";

[0056] ①Add keywords to a document: The data owner adds keywords to the document to be modified. i ,i∈[1,N], extract d i The corresponding one |W D |×k-dimensional row vector, the f corresponding to the keyword to be added i The random number in (i∈[1,N]) is changed to the position of the keyword, and the Encryption; Alternatively, select A corresponding linked list containing random numbers, select A random number replaces the original linked list elements.

[0057] The number of v selected at this time may be different from the number of the original linked list; the newly generated sub-index γ * and encrypted documents * As an update token Send to the cloud server; this operation can add multiple keywords in the same document at one time;

[0058] ② Delete keywords of a document: The data owner deletes the keywords of the document to be modified. i ,i∈[1,N], extract d i The corresponding one |W D |×k-dimensional row vector, in the f corresponding to the keyword to be deleted i In (i∈[1,N]), the encrypted data of the original keyword position is used random number replacement; in addition, select A corresponding linked list containing random numbers, select random numbers to replace the original linked list elements. The selected v may be different from the number of elements in the original linked list. * and d i The identifier id(d i ) as the update token Send to the cloud server; this operation can delete multiple keywords in the same document at one time.

[0059] Furthermore, the index update phase specifically includes:

[0060] (1) Add document: The cloud server receives After that, γ * and * Add to γ ​​and ξ;

[0061] (2) Delete document: The cloud server receives After that, delete the corresponding linked list in γ and find the corresponding linked list according to id(d i ) Encrypt the corresponding document d in the document set ζ i delete;

[0062] (3) Modify the document: The cloud server receives After that, γ * and * Replace the corresponding positions in γ and ξ. The advantages and beneficial effects of the present invention are as follows:

[0063] The present invention proposes an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy. It has forward privacy and backward privacy, and supports fuzzy phrase search and dynamic update. Specifically, the innovations of this article are: using the chaotic encryption algorithm piecewise linear chaotic mapping and the minhash function of the AND structure and the OR structure cascade to realize fuzzy search; also using the variant of the Bloom filter and the matrix to build the index, to realize phrase search and dynamic update. The innovation of this article mainly lies in the construction of the index, the realization of the search phase and the dynamic update phase. In the existing methods, the method of using the chaotic encryption algorithm piecewise linear chaotic mapping to realize fuzzy search rarely appears. At the same time, the method of using the matrix to store position information in the existing phrase search method is uncommon. The cleverness of the technology of 2-9 lies in the combination of the chaotic encryption algorithm piecewise linear chaotic mapping, the minhash function of the AND structure and the OR structure cascade, the Bloom filter and the matrix to realize forward privacy, backward privacy, phrase search and dynamic update. When realizing these functions, it is guaranteed that the efficiency of this method is also higher than that of the general fuzzy search method.

[0064] The present invention is an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy. The position information of each keyword in each document is encrypted using a lightweight encryption algorithm to achieve phrase search. In addition, FTPS can quickly find the corresponding position during the search, thereby making the search more efficient. At the same time, forward privacy and backward privacy are achieved, and there is good security. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is the keyword code of the preferred embodiment provided by the present invention;

[0066] Figure 2 is an index structure diagram of the present invention;

[0067] Figure 3 is a CT table of the present invention;

[0068] Figure 4 This is a schematic diagram of an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy. DETAILED DESCRIPTION

[0069] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and in detail describe the technical methods in the embodiments of the present invention. The described embodiments are only part of the embodiments of the present invention.

[0070] The technical method of the present invention to solve the above technical problems is:

[0071] The following is combined with Figure 1 , 2 3. Further detailed description of the transaction model of the present invention. Specifically, it includes the following modules and steps:

[0072] 1) Piecewise Linear Chaotic Map:

[0073] Piecewise Linear Chaotic Map (PWLCM): Chaos has many interesting properties, such as good pseudo-randomness and sensitivity to its control parameters, which can be directly related to the properties of confusion and diffusion in cryptography. And these systems are deterministic, that is, their future behavior will not have random elements and is completely determined by their parameters. However, because chaotic signals are pseudo-random, unauthorized users may mistake them for noise.

[0074] Chaotic encryption algorithm makes use of the deterministic, hybrid, and internal randomness characteristics of chaos to achieve simplicity and fast encryption while ensuring security.

[0075] PWLCM, as one of the simplest chaotic encryption algorithms, also has these characteristics. It can be described as:

[0076]

[0077] Among them, x n ∈(0,1),p∈(0,0.5). n is the function value obtained for the nth time, x n-1 is the function value obtained for the n-1th time, F[x n-1 ] indicates that the input value is x n-1 The function value of p represents a decimal, F(1-x n-1 ) is the input value 1-x n-1 The function value of .

[0078] 2) AND-OR structure minhash function:

[0079] minhash is a family of LSH functions that is used for Jaccard distance.

[0080] The element uses a random hash function and selects the minimum value among all hash values.

[0081] Locality sensitive hashing (LSH) is a technology used to solve the problem of finding similar nodes in high-dimensional space. If you perform linear search directly in high-dimensional space, you will face the curse of dimensionality and the efficiency is very low. The role of LSH is to map the original points in the high-dimensional space to different positions in one or more hashtables. This position is technically called a bucket. When it maps two close points in the high-dimensional space, there is a high probability that the two points will be mapped to the same bucket. In other words, the points in the same bucket are likely to be close in the high-dimensional space. Therefore, based on this feature,

[0082] Search, thereby improving the efficiency of search.

[0083] A hash function is called (d1,d2,p1,p2)-sensitive if it satisfies the following two conditions:

[0084] (1) If d(x,y)≤d1, then the probability that h(x)=h(y) is at least p1;

[0085] (2) If d(x,y)≥d2, then the probability that h(x)=h(y) is at most p2.

[0086] Where d(x,y) represents the distance measure between x and y. d1 represents the distance of case (1), d2 represents the distance of case (2), p1 represents the probability of case (1), and p2 represents the probability of case (2).

[0087] The cascade of AND and OR operations can generate more hash tables, making p1 closer to 1 and p2 closer to 0.

[0088] After using k random functions to implement the AND structure, its structure is expressed as g = (h1,h2,...,hk). k They represent the hash values ​​calculated by k different hash functions. At this time, if g(x) = g(y) if and only if g(x) and g(y) represent the k hash values ​​obtained when the input values ​​are x and y respectively. Then, λ different AND structures are used to implement the OR structure, and its structure is expressed as f = (g1∨g2∨...∨g λ ). At this time, if f(x) = f(y) if and only if Thus, the (d1, d2, p1, p2)-sensitive function family can be transformed into the (d1, d2, p1', p2')-sensitive function family, where The p1', p2' tables represent the different probabilities obtained by the cascade of AND and OR operations.

[0089] 3) Bloom filter:

[0090] Bloom filter consists of an m-bit binary vector and many random mapping functions. It is mainly used to find whether an element exists in a set. It operates by mapping the element to a binary vector through a random mapping function. It has fast search time and requires small storage space, but it has a certain false recognition rate and it is difficult to perform deletion operations.

[0091] This method consists of six stages: Figure 4 As shown in FIG. 1 , they are respectively the key generation phase, the index establishment phase, the trapdoor generation phase, the phrase search phase, the update token generation phase, and the index update phase. The details are as follows.

[0092] Key generation phase:

[0093] (1) Given a security parameter β, randomly select k×λ minhash functions H1 from the same local sensitive hash function family, select the key generation algorithm SKGen(), and select two one-way hash functions H2 and H3.

[0094] (2)sk1←SKGen(1 β ), sk2←SKGen(1 β), sk3←SKGen(1β). After authenticating the user, sk2 is transmitted to the cloud server and the user through a secure channel, and sk1 and sk3 are transmitted to the user through a secure channel. The key is {sk1, sk2, sk3}, and the public parameters are {k, λ, H1, H2, H3}.

[0095] Index building phase: for each w i ∈W D ,i∈[1,Λ](W D is a keyword set, Λ is the number of keywords in the keyword set),

[0096] (1) w i Each letter of ψ a (a∈[1,Y], Y is w i The ASCII code value of the keyword w is mapped to a decimal in the range [0, 1] using a one-way hash function, and then the value is mapped to an integer in the interval [0, s] (s is the secret parameter of minhash) using the Piecewise Linear Chaotic Map (PWLCM) algorithm. The resulting set of integers is the keyword w i The encoding is used as the input of minhash, such as Figure 1 .

[0097] (2) Use the AND-OR structure and randomly select k×λ minhash functions from the same locality-sensitive hash function family to perform a random operation on w. i Perform the operation and get k×λ values ​​x i,j ∈[1,m],i∈[1,Λ],j∈[1,λ], these k×λ values ​​form k hash tables. i,j Mapped to an array γ of size m (m>|W D |×k×λ, assuming that hashing does not collide). m represents the size of array γ, W D A collection of keywords.

[0098] (3) γ[x i,j ] becomes 1, and γ[x i,a×λ+1 ](i∈[1,Λ],a∈[0,k]) and a random γ[x i,υ ](i∈[1,Λ],υ∈[1,k×λ]∧υ≠a×λ+1) The corresponding bucket points to an array f= of size |D| <f1,...,f i ,...,f D >, where each element is a linked list. The first element of the linked list contains the document identifier id (d k ) and a pointer to the next element. If the identifier is id(dk ) contains the keyword w i , then the linked list f i = <id(d k ),f k,1 ,...,f k,j ,...,f k,t >,i∈[1,|D|],k∈[1,*D|],j∈[1,t], where t is the keyword w i In the identifier id(d k ), POS kj Indicates keyword w i In the identifier id(d k )’s jth occurrence in the document. If the identifier is id(d k ) does not contain the keyword w i , then in the linked list f i Fill v random invalid characters in, Indicates the maximum value that v can take. The index structure is as follows Figure 2 .

[0099] (4) Use sk1 to symmetric encrypt the document set D ζ←EncDoc(sk1,D).

[0100] (5) The data owner sends the index γ and the encrypted document set ζ to the cloud server.

[0101] Trapdoor generation phase: query Q = {w1,...,w b}, b is the number of keywords in query Q.

[0102] (1) Generate a counter table CT, which has two columns: username and ct user , where ct user The initial value of is 0, and each time the same user sends a search query to CS, user Add 1. , set its initial value to 0, and its value increases by 1 each time the same user sends a search query to the cloud server.

[0103] (2) For each w i ∈Q, calculate k hash tables of size λ: y1=H2(x i,1 ,ct user ,sk2),...,y k×λ =H2(x i,k×λ ,ct user ,sk2), where x i,1 =h1(w i ),...,xi,k×λ =h k×λ (w i ).

[0104] (3) Trapdoor T = {y 1,1 ,...,y b,k×λ ,H2(ct user ,sk2)}.

[0105] Phrase search phase:

[0106] (1) For the cloud server, after receiving the trapdoor T sent by the user,

[0107] ① Generate a list CT (such as Figure 3 ), store the user name and counter value ct server , let ct server The initial value of ct is 0. server The value of is increased by 1.

[0108] ② Determine H2(ct server ,sk2)==H2(ct user ,sk2) is true, if not, it returns "query failed" to the user, if true, then the position loc of each bucket in the index is calculated loc represents the location of each bucket in the index. Represents the hash value obtained using loc.

[0109] ③For each w i ∈Q, select λ values ​​in the first hash table, according to y and Are the values ​​of equal, map them to the values ​​in the array γ, and judge whether γ[x i,1 ]+…+γ[x i,λ ]==λ. If not, check k hash tables one by one. As long as one hash table is valid, proceed to step ④.

[0110] ④ If one of the hash tables is established, then for γ[x i,a*λ+1 ], x i,a*λ+1 It means that the a*λ+1th hash value obtained by the hash function for the i-th keyword is the position of the corresponding bucket in the array γ, a∈[0,k-1], and the array f pointed to by it is taken out.

[0111] ⑤Send all retrieved arrays to the user in the order of query.

[0112] (2) After the user receives the array sent by the cloud server, for each element f of each received array kj :

[0113] ① Use formula (1) to calculate the keyword w i The position in the document or a random number,

[0114] Get the array before encryption.

[0115] ② The user will calculate all the arrays obtained to determine whether the positions of the keywords to be queried in the same document are connected. The document identifier set R = {id(d i ),i∈[1,N]}. The user sends R to the cloud server.

[0116] (3) After receiving the response, the cloud server sends the ciphertext of the corresponding document to the user.

[0117] (4) The user uses the key sk1 to decrypt the received ciphertext and obtain the plaintext of the document to be queried. Update token generation phase:

[0118] (1) Adding documents: The data owner generates a sub-index γ for the document to be added using the same method as the indexing method in step 2. * , γ * and encrypted documents * As an update token Sent to the cloud server. Operation type up = "add".

[0119] (2) Deleting a document: The data owner deletes the document d i ,i∈[1,N], document d i The identifier id(d i ) as the update token Sent to the cloud server. Operation type up = "delete".

[0120] (3) Modify the document: Operation type up = "modify".

[0121] ①Add keywords to a document: The data owner adds keywords to the document to be modified. i ,i∈[1,N], extract d i The corresponding one |W D |×k-dimensional row vector, the f corresponding to the keyword to be added i The random number in (i∈[1,N]) is changed to the position of the keyword, and the Encrypt. In addition, select A corresponding linked list containing random numbers, select A random number is used to replace the original linked list elements. The number of v selected at this time may be different from the number of elements in the original linked list.* and encrypted documents * As an update token Send to the cloud server. This operation can add multiple keywords in the same document at one time.

[0122] ② Delete keywords of a document: The data owner deletes the keywords of the document to be modified. i ,i∈[1,N], extract d i The corresponding one |W D |×k-dimensional row vector, in the f corresponding to the keyword to be deleted i In (i∈[1,N]), the encrypted data of the original keyword position is used In addition, select A corresponding linked list containing random numbers, select A random number is used to replace the original linked list elements. The number of v selected at this time may be different from the number of elements in the original linked list. * and d i The identifier id(d i ) as the update token Send to the cloud server. This operation can delete multiple keywords in the same document at one time.

[0123] Index update phase:

[0124] (1) Add document: The cloud server receives After that, γ * and * Added to γ ​​and ξ.

[0125] (2) Delete document: The cloud server receives After that, delete the corresponding linked list in γ and find the corresponding linked list according to id(d i ) Encrypt the corresponding document d in the document set ζ i delete.

[0126] (3) Modify the document: The cloud server receives After that, γ * and * Replace the corresponding positions in γ and ξ.

[0127] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0128] The above embodiments should be understood to be only used to illustrate the present invention and not to limit the protection scope of the present invention. After reading the contents of the present invention, technicians can make various changes or modifications to the present invention, and these equivalent changes and modifications also fall within the scope defined by the claims of the present invention.

Claims

1. An efficient and fault-tolerant dynamic phrase search method based on forward and backward privacy, characterized in that: The following steps are involved: In the key generation phase, keys and public parameters are generated; In the index construction phase, the data owner designed an index structure using piecewise linear chaotic mapping, minhash function cascaded with AND-OR structure, Bloom filter, inverted index and matrix; In the trapdoor generation phase, users use phrases to generate trapdoors; During the phrase search phase, the cloud server checks the stored encrypted index and returns the intermediate encrypted result; After receiving it, the user decrypts it and returns the obtained file identifier to the cloud server; The cloud server returns the encrypted file in response, and the user decrypts the file; In the update token generation phase, the user generates a token and sends it to the cloud server; In the index update phase, the cloud server updates the index and documents based on the token; The index building phase specifically includes: For each w i ∈W D ,i∈[1,Λ],W D is a keyword set, Λ is the number of keywords in the keyword set; (1) w i Each letter of ψ a The ASCII code value of is mapped into a decimal in [0, 1] using a one-way hash function, a∈[1,Y], where Y is w i The number of letters in the hash function is then mapped to an integer in the interval [0, s] using a piecewise chaotic linear mapping algorithm. s is the secret parameter of minhash. The resulting set of integers is the keyword w i The code is used as the input of minhash; (2) Use the AND-OR structure and randomly select k×λ minhash functions from the same locality-sensitive hash function family to perform a random operation on w. i Perform the operation and get k×λ values ​​x i,j ∈[1,m],i∈[1,Λ],j∈[1,λ], these k×λ values ​​form k hash tables. Assuming that there is no hash collision, each value x i,j Map to an array γ of size m, m>|W D |×k×λ, m represents the size of array γ, W D is a collection of keywords; (3) becomes 1, in array γ and random γ[x i,υ ]The corresponding bucket points to an array f of size |D| <f1,...,f i ,...,f D >, i∈[1,Λ],υ∈[1,k×λ]∧υ≠a×λ+1), where each element is a linked list, and the first element of the linked list contains the document identifier id(d k ) and a pointer to the next element. If the identifier is id(d k ) contains the keyword w i , then the linked list f i = <id(d k ),f k,1 ,...,f k,j ,...,f k,t >,i∈[1,|D|],k∈[1,|D|],j∈[1,t], where t is the keyword w i In the identifier id(d k ), POS kj Indicates keyword w i In the identifier id(d k )'s jth occurrence in the document, if the identifier is id(d k ) does not contain the keyword w i , then in the linked list f i Fill v random invalid characters in, v∈[1,θ]; θ represents the maximum value of v; (4) Use sk1 to symmetric encrypt the document set D ζ←EncDoc(sk1,D); (5) The data owner sends the index γ and the encrypted document set ζ to the cloud server; The phrase search stage specifically includes: (1) For the cloud server, after receiving the trapdoor T sent by the user, ① Generate a list CT to store the user name and counter value ct server , let ct server The initial value is 0. Each time a search query is received from the user, ct server The value of is increased by 1; ② Determine H2(ct server ,sk2)==H2(ct user ,sk2) is true, if not, it returns "query failed" to the user, if true, then the position loc of each bucket in the index is calculated loc represents the location of each bucket in the index. Indicates the hash value obtained using loc; ③For each w i ∈Q, select λ values ​​in the first hash table, according to y and Are the values ​​of equal, map them to the values ​​in the array γ, and judge Is it true? If not, check k hashtables one by one. As long as one hashtable is true, proceed to step ④. ④If one of the hash tables is established, then for x i,a*λ+1 It means that the a*λ+1th hash value obtained by the hash function for the i-th keyword is the position of the corresponding bucket in the array γ, a∈[0,k-1], and the array f pointed to by it is taken out; ⑤Send all retrieved arrays to the user in the order of query; (2) After the user receives the array sent by the cloud server, for each element f of each received array kj : ① Use formula (1) to calculate the keyword w i The position in the document or a random number, Get the array before encryption; ② The user will calculate all the arrays obtained to determine whether the positions of the keywords to be queried in the same document are connected, and calculate the document identifier set R = {id(d i ),i∈[1,N]}; the user sends R to the cloud server; (3) After receiving the response, the cloud server sends the ciphertext of the corresponding document to the user; (4) The user uses the key sk1 to decrypt the received ciphertext and obtain the plaintext of the document to be queried; The update token generation phase specifically includes: (1) Adding documents: The data owner generates a sub-index γ for the document to be added using the same method as the indexing method in step 2. * , γ * and encrypted documents * As an update token Sent to the cloud server; operation type up = "add"; (2) Deleting a document: The data owner deletes the document d i ,i∈[1,N], document d i The identifier id(d i ) as the update token Sent to the cloud server; operation type up = "delete"; (3) Modify the document: Operation type up = "modify"; ①Add keywords to a document: The data owner adds keywords to the document to be modified. i ,i∈[1,N], extract d i The corresponding one |W D |×k-dimensional row vector, the f corresponding to the keyword to be added i The random number in (i∈[1,N]) is changed to the position of the keyword, and the Encryption; Alternatively, select The corresponding linked lists containing random numbers, select v random numbers, v∈[1,θ], and replace the elements of the original linked list. The number of v selected at this time may be different from the number of the original linked list; the newly generated sub-index γ * and encrypted documents * As an update token Send to the cloud server; this operation can add multiple keywords in the same document at one time; ② Delete keywords of a document: The data owner deletes the keywords of the document to be modified. i ,i∈[1,N], extract d i The corresponding one |W D |×k-dimensional row vector, in the f corresponding to the keyword to be deleted i In the above example, the encrypted data at the original keyword position is replaced by v random numbers; i∈[1, N], and in addition, The corresponding linked lists containing random numbers, select v random numbers, replace the original linked list elements, the selected v may be different from the number of the original linked list; the newly generated sub-index γ * and d i The identifier id(d i ) as the update token Send to the cloud server; this operation can delete multiple keywords in the same document at one time.

2. According to claim 1, an efficient fault-tolerant dynamic phrase search method based on forward and backward privacy is characterized in that: The key generation phase generates keys and public parameters, specifically including: (1) Given a security parameter β, randomly select k×λ minhash functions H1 from the same local sensitive hash function family, select the key generation algorithm SKGen(), and select two one-way hash functions H2 and H3; (2)sk1←SKGen(1 β ), sk2←SKGen(1 β ), sk3←SKGen(1 β ), after authenticating the user, sk2 is transmitted to the cloud server and the user respectively through a secure channel, and sk1 and sk3 are transmitted to the user through a secure channel; the key is {sk1, sk2, sk3}, and the public parameters are {k, λ, H1, H2, H3}.

3. The efficient fault-tolerant dynamic phrase search method based on forward and backward privacy according to claim 2, characterized in that: The piecewise linear chaotic mapping specifically includes: The piecewise chaotic linear map is described as: Among them, x n ∈(0,1),p∈(0,0.5);x n is the function value obtained for the nth time, x n-1 is the function value obtained for the n-1th time, F[x n-1 ] indicates that the input value is x n-1 The function value of p represents a decimal, F(1-x n-1 ) is the input value 1-x n-1 The function value of .

4. The method of efficient fault-tolerant dynamic phrase search based on forward and backward privacy according to claim 3, characterized in that: The minhash function of the AND-OR structure specifically includes: Minhash is a family of LSH functions, which is used for Jaccard distance. Minhash uses a random hash function for each element in the set and selects the minimum value of all hash values. A hash function is called (d1,d2,p1,p2)-sensitive if it satisfies the following two conditions: (1) If d(x,y)≤d1, then the probability that h(x)=h(y) is at least p1; (2) If d(x,y)≥d2, then the probability that h(x)=h(y) is at most p2; Where d(x,y) represents the distance measure between x and y; d1 represents the distance of case (1), d2 represents the distance of case (2), p1 represents the probability of case (1), and p2 represents the probability of case (2); The cascade of AND and OR operations can generate more hash tables, making p1 closer to 1 and p2 closer to 0; After using k random functions to implement the AND structure, its structure is expressed as g = (h1, h2, ..., h k ); h1,h2,...,h k They represent the hash values ​​calculated by k different hash functions respectively; at this time, if g(x) = g(y) if and only if g(x) and g(y) represent the k hash values ​​obtained when the input values ​​are x and y respectively; then λ different AND structures are used to implement the OR structure, and its structure is expressed as f = (g1∨g2∨...∨g λ ); At this time, if f(x)=f(y) if and only if Thus, the (d1, d2, p1, p2)-sensitive function family can be transformed into the (d1, d2, p1', p2')-sensitive function family, where The p1', p2' tables represent the different probabilities obtained by the cascade of AND and OR operations.

5. The efficient fault-tolerant dynamic phrase search method based on forward and backward privacy according to claim 4, characterized in that: The Bloom filter consists of an m-bit binary vector and many random mapping functions. It is mainly used to find out whether an element exists in a certain set. It operates by mapping the element into the binary vector through the random mapping function.

6. The efficient fault-tolerant dynamic phrase search method based on forward and backward privacy according to claim 1, characterized in that: The index update phase specifically includes: (1) Add document: The cloud server receives After that, γ * and * Add to γ ​​and ξ; (2) Delete document: The cloud server receives After that, delete the corresponding linked list in γ and find the corresponding linked list according to id(d i ) Encrypt the corresponding document d in the document set ζ i delete; (3) Modify the document: The cloud server receives After that, γ * and * Replace the corresponding positions in γ and ξ.

Images