Encrypted search on encrypted data with reduced total leakage

Abstract

A method includes receiving, from a user device, a search query for a plurality of keywords that appear in one or more encrypted documents stored on an untrusted storage device. The method also includes accessing an encrypted search index to obtain a first list of document identifiers each representing a document that includes a first keyword and a second keyword of the plurality of keywords. The method also includes, for each remaining keyword, determining a corresponding list of document identifiers each representing a document that includes the first keyword, the second keyword, and the respective remaining keyword. The method includes determining, based on the first list of document identifiers and each corresponding list of document identifiers, a second list of document identifiers each representing a document that includes each keyword of the plurality of keywords.

Description

Technical Field

[0001] This disclosure relates to performing cryptographic searches on encrypted data to reduce total leakage. Background Technology

[0002] As storing large amounts of data in the cloud becomes increasingly common, searchable encryption (i.e., encrypted search) is gaining popularity. A growing number of users or clients possess large corpora of encrypted documents stored on servers beyond their control (i.e., untrusted servers). With searchable encryption, clients can store their encrypted documents on untrusted servers while still retaining the ability to search for documents, such as retrieving identifiers of all documents containing specific keywords. However, this searchable encryption often introduces security and privacy vulnerabilities. Summary of the Invention

[0003] One aspect of this disclosure provides a method for performing a cryptographic search on encrypted data to reduce total leakage. The method includes: receiving a search query for multiple keywords from a user device associated with a user at data processing hardware. The multiple keywords appear in one or more encrypted documents within an encrypted document corpus stored on an untrusted storage device. The method further includes: accessing a cryptographic search index by the data processing hardware to obtain a first list of document identifiers. Each document identifier in the first list of document identifiers represents a document including a first keyword and a second keyword among the multiple keywords. For each remaining keyword appearing in the one or more encrypted documents after the first and second keywords, the method includes: determining a corresponding list of document identifiers by the data processing hardware. Each document identifier in the corresponding list of document identifiers represents a document including the first keyword, the second keyword, and the corresponding remaining keyword. The method further includes: determining a second list of document identifiers by the data processing hardware based on the first list of document identifiers and the corresponding list of each document identifier. Each document identifier in the second list of document identifiers represents a document including each keyword among the multiple keywords. The method further includes: returning the second list of document identifiers obtained from the cryptographic search index to the user device by the data processing hardware.

[0004] Implementations of this disclosure may include one or more of the following optional features. In some implementations, for each corresponding keyword pair appearing in one or more encrypted documents, the encrypted search index includes: an encrypted value representing a list of keyword pairs for a document identifier, the list of keyword pairs representing documents that include two keywords from the keywords in the corresponding keyword pair; and an encrypted tag representing the encrypted value and one keyword from the keywords in the corresponding keyword pair. Each encrypted value may be encrypted using a pseudo-random function key based on the keyword pair and a secret master key.

[0005] In some examples, the pseudo-random function key is based on the concatenation of key pairs. Optionally, each encrypted tag is encrypted with a pseudo-random function key based on one of the keys and a secret master key. For each corresponding key pair appearing in one or more encrypted documents, the encrypted search index may also include a list of bi-tags. Each bi-tag in the list of bi-tags may include a cryptographic hash of the corresponding encrypted tag for the corresponding key pair.

[0006] In some implementations, determining the second list of document identifiers may include: for each remaining keyword that appears in one or more encrypted documents after the first and second keywords, determining whether a double tag corresponding to the corresponding remaining keyword exists in a double tag list; and removing each double tag that does not correspond to the corresponding remaining keyword from the double tag list. In some examples, accessing the encrypted search index to obtain the first list of document identifiers includes retrieving a list of keyword pairs of document identifiers corresponding to the first and second keywords.

[0007] Search queries may include tokens representing a first keyword and a second keyword, and tokens representing the first keyword and the corresponding remaining keyword for each remaining keyword appearing in one or more encrypted documents after the first and second keywords. In some implementations, a second list of document identifiers obtained from the encrypted search index is returned to the user equipment, enabling the user equipment to decrypt the second list of document identifiers using a secret master key.

[0008] Another aspect of this disclosure provides a system for performing encrypted searches on encrypted data to reduce total leakage. The system includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations. The operations include receiving a search query for multiple keywords from a user device associated with a user. The multiple keywords appear in one or more encrypted documents within an encrypted document corpus stored on an untrusted storage device. The operations also include accessing an encrypted search index to obtain a first list of document identifiers. Each document identifier in the first list of document identifiers represents a document including a first keyword and a second keyword among the multiple keywords. For each remaining keyword appearing in the one or more encrypted documents after the first and second keywords, the operations include determining a corresponding list of document identifiers. Each document identifier in the corresponding list of document identifiers represents a document including the first keyword, the second keyword, and the corresponding remaining keyword. The operations also include determining a second list of document identifiers based on the first list of document identifiers and the corresponding list of each document identifier. Each document identifier in the second list of document identifiers represents a document including each of the multiple keywords. The operations also include returning the second list of document identifiers obtained from the encrypted search index to the user device.

[0009] This aspect may include one or more of the following optional features. In some implementations, for each corresponding keyword pair appearing in one or more encrypted documents, the encrypted search index includes: an encrypted value representing a list of keyword pairs for a document identifier, the list of keyword pairs representing documents that include two keywords from the keywords in the corresponding keyword pair; and an encrypted tag representing the encrypted value and one keyword from the keywords in the corresponding keyword pair. Each encrypted value may be encrypted using a pseudo-random function key based on the keyword pair and a secret master key.

[0010] In some examples, the pseudo-random function key is based on the concatenation of key pairs. Optionally, each encrypted tag is encrypted with a pseudo-random function key based on one of the keys and a secret master key. For each corresponding key pair appearing in one or more encrypted documents, the encrypted search index may also include a list of bi-tags. Each bi-tag in the list of bi-tags may include a cryptographic hash of the corresponding encrypted tag for the corresponding key pair.

[0011] In some implementations, determining the second list of document identifiers may include, for each remaining keyword appearing in one or more encrypted documents after the first and second keywords, determining whether a double tag corresponding to the corresponding remaining keyword exists in a double tag list, and removing each double tag that does not correspond to the corresponding remaining keyword from the double tag list. In some examples, accessing the encrypted search index to obtain the first list of document identifiers includes retrieving a list of keyword pairs of document identifiers corresponding to the first and second keywords.

[0012] Search queries may include tokens representing a first keyword and a second keyword; and tokens representing the first keyword and the corresponding remaining keyword for each remaining keyword appearing in one or more encrypted documents after the first and second keywords. In some implementations, a second list of document identifiers obtained from the encrypted search index is returned to the user equipment, enabling the user equipment to decrypt the second list of document identifiers using a secret master key.

[0013] Details of one or more embodiments of this disclosure are set forth in the following drawings and description. Other aspects, features, and advantages will become apparent from the description and drawings and from the claims. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of an example system that provides encrypted search on encrypted data to reduce total leakage.

[0015] Figure 2 This is a schematic diagram of an exemplary component of an encrypted search index.

[0016] Figure 3 This is a diagram of an encrypted search manager that filters a list of document identifiers.

[0017] Figure 4 Based on Figure 3 A diagram illustrating an encrypted search manager that uses filtering to determine a second list of document identifiers.

[0018] Figure 5 This is a diagram of an encrypted search index with encrypted tags and values.

[0019] Figure 6A and 6B This is a schematic diagram of a client-side encrypted search system.

[0020] Figures 7A to 7D This is a diagram illustrating the formal description of a system that performs conjunctive queries.

[0021] Figures 8A to 8D This is a diagram illustrating the formal description of a system that performs Conjunction Normal Form (CNF) queries.

[0022] Figure 9 This is a flowchart illustrating an example of the operational setup for providing encrypted searches on encrypted data to reduce total leakage.

[0023] Figure 10 This is a schematic diagram of an example computing device that can be used to implement the systems and methods described herein.

[0024] In the various figures, the same reference numerals indicate the same elements. Detailed Implementation

[0025] Searchable encryption (also known as encrypted search or structured encryption) is gaining popularity. The goal of searchable encryption is to enable clients to outsource the storage of encrypted document corpora to untrusted servers. For example, a client might want to securely store large amounts of documents (or any other items uploaded to the server, such as images, emails, etc.) in a cloud-based storage solution. The term "document" is commonly used and can refer to any kind of digital file (e.g., images, songs, database entries, etc.). Typically, clients want to maintain the ability to efficiently search documents (i.e., search for one or more specific keywords) while preserving the privacy and security of the encrypted documents. To maintain this privacy, information related to the document content or queries from the client must be hidden from the untrusted server. A common way to address this is to create a separate encrypted search index (i.e., encrypted multi-mapping) that indexes the keywords and associated document identifiers of all documents stored on the untrusted server. To achieve efficient construction, encrypted search indexes are often allowed to leak a well-defined and "reasonable" amount of information.

[0026] The search index is encrypted using a key inaccessible to untrusted servers and then stored alongside the documents. Clients can then generate search queries that the server evaluates against the encrypted search index. The evaluation produces encrypted document identifiers associated with the keywords of the search query, which the untrusted server returns to the client. In this way, the client receives a list of document identifiers for documents containing the keywords, while minimizing information leakage (e.g., leakage to untrusted servers).

[0027] A conjunctive query is a query that contains one or more keywords, and the response should consist of a set of documents, each of which includes every keyword in the query. For example, consider a client performing a conjunctive query... k 1∧ k 2∧…∧ k q Submitted to the remote storage system implementing the encrypted search index. The naive method performs the following on the encrypted search index: qThe search yields a set of document identifiers that individually include each corresponding keyword. q Each document identifier in the set of document identifiers can be returned to the client, and the client can perform a conjunction of all sets locally. In this case, the amount of information passed to the client may actually be greater than optimal. That is, this method passes each value in the conjunction set. q This situation is exacerbated by the fact that many (if not most) of the returned document identifiers do not include every keyword in the query, thus unnecessarily leaking information. Ideally, the remote storage system would only return document identifiers that include every query keyword in the query to minimize leakage.

[0028] This document describes an implementation of a system including an encrypted search index that supports Boolean queries (e.g., conjunctive queries and / or conjunctive normal form (CNF) queries) that suppress total leakage without compromising efficiency or usability. The system includes an encrypted search index containing a cryptographic hash of each key pair appearing in an encrypted document corpus stored on an untrusted storage device. Each cryptographic hash represents a list of document identifiers including the key pair. The list of document identifiers including the key pair is used to filter results from the remaining keywords in the query, thereby significantly minimizing the amount of information passed to the client and the amount of information leaked to the untrusted storage device.

[0029] Now refer to Figure 1 In some implementations, example system 100 includes user equipment 10 associated with a corresponding user or client 12 and communicating with an untrusted remote system 111 via network 112. User equipment 10 may correspond to any computing device, such as a desktop computer workstation, a laptop computer workstation, or a mobile device (i.e., a smartphone). User equipment 10 includes computing resources 18 (e.g., data processing hardware) and / or storage resources 16 (e.g., memory hardware).

[0030] The remote system 111 can be a single computer, multiple computers, or a distributed system (e.g., a cloud environment) with scalable / elastic computing resources 118 (e.g., data processing hardware) and / or storage resources 116 (e.g., memory hardware). An untrusted document data repository 150 (i.e., remote storage device 150) is overlaid on the storage resource 116 to allow one or more clients or computing resources 118 to scalably utilize the storage resource 116. The document data repository 150 is configured to store a corpus of documents 152, 152a-n. Each document 152 includes a document identifier 154 (e.g., document name) that uniquely identifies the associated document 152. Each document 152 also includes a set of keywords 32. This set of keywords 32 includes all keywords appearing in the associated encrypted documents that user 12 can search. As used herein, document 152 can refer to any item uploaded to the remote system 111 to be stored within the document data repository 150, such as, but not limited to, emails, calendar events, comments, database entries, images, audio files, etc. In some implementations, user equipment 10 executes a searchable encryption (SE) manager 120 for managing access to encrypted documents within data storage 150.

[0031] User 12 can interact with SE Manager 120 via a software application (such as a web browser) running on user device 10. A software application (i.e., a software resource) can refer to computer software that causes a computing device to perform tasks. In some examples, a software application may be referred to as an "application," "app," or "program." Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and game applications. As discussed in more detail below, user device 10 can use master key 14 and pseudo-random function 15 to perform a client-side cryptographic search system 600 to encrypt values ​​stored in untrusted data storage device 150.

[0032] SE Manager 120 receives a search query 20 from User Device 10 for a plurality of keywords 32 that appear in one or more encrypted documents stored on an untrusted storage device 150. SE Manager 120 accesses an encrypted search index 160 to obtain a first list of document identifiers 154. Each document identifier 154 in the first list of document identifiers 154 is encrypted and represents a document 152 that includes both a first keyword and a second keyword from the plurality of keywords 32. That is, SE Manager 120 obtains from the search index a list of document identifiers 154 representing documents 152 that each includes two keywords from the plurality of keywords 32. As discussed in more detail below, the search index includes a corresponding list of document identifiers 154 for each pair of keywords 32 appearing in the document 152. For example, when SE Manager 120 receives a search query 20 that includes a search for keywords 32 "cat", "dog", "elephant" and "fox", SE Manager 120 will access the encrypted search index 160 to obtain a list of document identifiers 154 corresponding to documents 152 that include any two of "cat", "dog", "elephant" and "fox" (e.g., both "cat" and "dog", or both "cat" and "fox").

[0033] As discussed in more detail below, in some examples, search query 20 includes tokens 24 representing the first keyword and the second keyword. For each remaining keyword after the first keyword and the second keyword in search query 20, search query 20 may also include tokens 24 representing the first keyword 31 and the remaining keywords.

[0034] For each remaining keyword appearing in one or more encrypted documents after the first and second keywords, the SE manager 120 determines a corresponding list of document identifiers 154 representing documents 152 including the first keyword, the second keyword, and the corresponding remaining keywords. Keywords 32 can be processed in any order, regardless of the order of keywords 32 in search query 20 or document 152. Returning to the previous example of search query 20 including keywords 32 "cat", "dog", "elephant", and "fox", the SE manager 120 can first obtain a list of document identifiers 154 including keywords 32 "cat" and "dog". Then, for each remaining keyword (i.e., "elephant" and "fox"), the SE manager 120 can determine a corresponding list of document identifiers 154 including "cat", "dog", and the remaining keywords. In this example, SE manager 120 determines two corresponding lists of document identifiers: a first list representing document identifiers for each of documents 152 that include the keywords 32 "cat", "dog", and "elephant"; and a second list representing document identifiers 154 for each of documents 152 that include the keywords 32 "cat", "dog", and "fox".

[0035] Based on a first list of document identifiers 154 (i.e., a list of document identifiers 154 representing documents 152 each including a first keyword and a second keyword) and a corresponding list of each document identifier 154 (i.e., a list of document identifiers 154 representing documents 152 each including a first keyword, a second keyword, and the remaining keywords), the SE manager 120 determines a second list of document identifiers 154 with each document identifier 154 representing a document 152 including each of the multiple keywords 32 of the search query 20. Returning to the previous example, the second list of document identifiers 154 represents each document 152, and each document 152 includes each of “dog,” “cat,” “elephant,” and “fox.” The SE manager 120 returns the second list of document identifiers 154 obtained from the encrypted search index 160 to the user device 10. The user device can decrypt the second list of document identifiers 154 using, for example, a secret master key 14.

[0036] Now refer to Figure 2 In some implementations, the encrypted search index 160 includes a first portion 162a, which stores each keyword 32 k 1. k 2. k 3、…、 k nA corresponding list is associated with document identifiers 154, 154a-n. Each document identifier 154 in each list represents a document 152 that includes the corresponding keyword 32. In the example shown, keyword 32 k 1. Associated with a list of document identifiers 154a. Each document identifier 154a represents a list including keyword 32. k Document 152, or related to it. User 12 can include a list of corresponding document identifiers 154 for each keyword 32 included in search query 20. When SE Manager 120 receives search query 20 from user device 10 for only a single keyword 32, SE Manager 120 can simply return a list of corresponding document identifiers 154 associated with the single queried keyword 32.

[0037] In some examples, the encrypted search index 160 also includes a second part 162b that associates each pair of keywords 32 with a corresponding list 154e-n of document identifiers 154. That is, each combination of keyword pairs 32 is associated with a corresponding list of document identifiers 154, each representing a document 152 that includes two of each of the keyword pairs 32. In the example shown, the keywords... k 1 and k 2. Associated with a list of document identifiers 154e. Here, each document identifier 154e includes... k 1 and k 2. Similarly, 32 pairs of keywords k 1 and k 3 is associated with the list of document identifiers 154f, and keyword 32 k 1 and k n Associated with a list of document identifiers 154g.

[0038] Now refer to Figure 3 In some examples, upon receiving search query 20, SE manager 120 first obtains a list of document identifiers 154 including a first keyword and a second keyword. SE manager 120 can then use tokens 24 corresponding to the first and second keywords of the query (…) Figure 1 To obtain this list. In this example, SE Manager 120 has already received a list including keyword 32. k 1. k 2. k 3. k 4 and k Search query 20 for 5. That is, user device 10 has sent a search query 20 requesting the return of document identifier 154, which indicates that the keyword 32 is included. k 1 to kDocument 152 for each keyword in 5. As discussed in more detail below, the corresponding list of document identifiers 154 is used to filter the results of each keyword (in any order) among the remaining keywords in search query 20. Here, SE Manager 120 retrieves results related to the keywords. k 1 and k 2. A list of associated document identifiers 154e; however, SE manager 120 can retrieve any pair of keywords 32 included in search query 20 (e.g., k 2 and k 5. k 3 and k 4. k 1 and k A list of document identifiers 154 corresponding to (e.g., 5). In some embodiments, user device 10 specifies which keyword pair 32 to select (e.g., via token 24), while in other embodiments, SE manager 120 determines which keyword pair 32 to select. In some examples, it is advantageous for user device 10 or SE manager 120 to select the keyword pair 32 most likely to correspond to a small number of document identifiers 154, because reducing the number of document identifiers 154 in the list may correspondingly reduce the amount of information leaked. For example, user device 10 selects the two least common keywords 32 included in search query 20, because the least common keywords 32 are most likely to correspond to a small number of document identifiers 154. User device 10 and / or SE manager 120 may refer to a database or other data structure to determine the most common or least common keywords 32 in search query 20.

[0039] After obtaining a list of document identifiers 154 corresponding to the first and second keywords of search query 20, SE manager 120 can determine (e.g., based on remaining tokens in search query 20) a corresponding list of document identifiers 154 for each remaining keyword in search query 20. This corresponding list of document identifiers 154 includes remaining keywords from the list of document identifiers 154, which includes the first and second keywords. Figure 3 In the example shown, SE manager 120 determines which document identifiers 154 in the list of document identifiers 154e (i.e., including...) k 1 and k 2. The document identifier lists of both (including keywords) k 3. To obtain a list of document identifiers 154ea. Similarly, SE Manager 120 also obtains a list of identifiers including keywords. k The list of document identifiers 154eb is determined from the list of document identifiers 154e, and from the list including keywords. kThe list of document identifiers 154ec is determined from the list of document identifiers 154e. This produces a list including keyword 32. k 1. k 2 and k The list of document identifiers corresponding to 3, 154ea, including the keyword 32. k 1. k 2 and k The list of document identifiers corresponding to 4 (154eb) and including keywords 32 k 1. k 2 and k A list of document identifiers corresponding to 5, 154ec.

[0040] Now refer to Figure 4 In some implementations, the SE manager 120 determines which document identifiers 154 are included in each of the corresponding lists of document identifiers 154 to obtain a second list of document identifiers 154 representing documents 152 that each includes all keywords 32 in the search query 20. Continuing from... Figure 3 Example, Figure 4 The SE Manager 120 is shown responding to keyword 32. k 1. k 2. k 3. k 4 and k Search query 20 of document identifier 5 is used to obtain a list of corresponding documents 154ea, 154eb, and 154ec. Based on these lists of corresponding documents 154ea, 154eb, and 154ec, SE manager 120 determines a list of documents 154ed. For example, SE manager 120 determines which documents 154 are common in the lists of corresponding documents 154ea, 154eb, and 154ec (i.e., appear in each list). Each document identifier 154ed represents a document including keyword 32. k 1. k 2. k 3. k 4 and k Document 152 for each keyword in 5. In response to search query 20, a second list of document identifiers 154ed is returned to user device 10.

[0041] Now refer to Figure 5In some embodiments, schematic diagram 500 illustrates an encrypted search index 160 for each corresponding keyword 32 pair appearing in an encrypted document stored on an untrusted storage device 150. The encrypted search index 160 includes an encrypted value 510 and an encrypted tag 512. The encrypted value 510 represents a list of keyword 32 pairs for a document identifier 154, which represents a document 152 containing two keywords 32 from the corresponding keyword 32 pair. The encrypted tag 512 represents one of the keywords 32 in the encrypted value 510 and the corresponding keyword 32 pair. In the illustrated example, the keyword 32 pair... k 1 and k 2 has the representation including keyword 32 k 1 and k 2. The corresponding list e of document identifier 154 for both documents 152. The keyword 32 corresponds to... k 1 and k 2 is associated with encryption value 510a and encryption tag 512a.

[0042] The encrypted value 510 may be a representation of a list of document identifiers 154 corresponding to the associated keyword pairs 32. That is, after decrypting the encrypted value 510, the user device 10 can recover the list of associated document identifiers 154 from the decrypted value. The encrypted tag 512 may represent an associated keyword pair 32 corresponding to the associated encrypted value 510. Therefore, when the SE manager 120 accesses the encrypted search index 160 to obtain a list of document identifiers 154 corresponding to the keyword pairs 32, the SE manager 120 can access the encrypted value 510 associated with the encrypted tag 512 corresponding to the keyword pair 32. In some embodiments, the encrypted value 510 is encrypted via a value key 520, while the encrypted tag 512 is encrypted using a tag key 522. Since both the value key 520 and the tag key 522 can depend on one or both keywords 32 associated with the corresponding encrypted value 510 / encrypted tag 512, each value key 520 and each tag key 522 is unique. In the example shown, the keyword pairs 32 k 1 and k 2 is associated with encrypted value 510a and encrypted tag 512a. When SE Manager 120 accesses encrypted search index 160 to obtain a first list of document identifiers 154 representing documents 152 including a first keyword and a second keyword, SE Manager 120 can retrieve a list of keyword pairs 32 (e.g., encrypted value 510) corresponding to the first keyword and the second keyword (e.g., encrypted tag 512) of document identifier 154.

[0043] In some implementations, for each corresponding keyword pair 32 appearing in document 152, the encrypted search index 160 further includes a list of double tags 514, each double tag 514 in the list including a cryptographic hash 515 of the corresponding encrypted tag 512 for the corresponding keyword pair 32. That is, the double tag 514 can be a hash of the encrypted tag 512 (e.g., using a tag key 522). Here, the encrypted double tag 514a is generated from the encrypted tag 512a by encrypting the tag 512a using the corresponding tag key 522a. As discussed below, adding double tags 514 improves the efficiency of the encrypted search index 160.

[0044] In some examples, when SE Manager 120 determines a second list of document identifiers 154 (i.e., a list of document identifiers 154 representing each document 152 that includes each of the keywords 32 in the search query 20), for each remaining keyword that appears in one or more encrypted documents after the first and second keywords, SE Manager 120 determines whether a double label 514 corresponding to the corresponding remaining keyword exists in the list of double labels 514. SE Manager can remove each double label 514 from the list of double labels 514 that does not correspond to the corresponding remaining keyword. Therefore, for each remaining keyword in the search query 20, SE Manager 120 removes double labels 514 that do not include at least one keyword 32 in the search query 20. After SE Manager 120 evaluates each remaining keyword, the only remaining double label 514 represents the second list of document identifiers 154. This allows SE Manager 120 to quickly and efficiently filter each first list of document identifiers 154 representing each document 152 that includes both the first and second keywords.

[0045] Now refer to Figure 6A In some examples, the client-side encrypted search system 600 generates each encrypted value 510 by encrypting an encrypted value 510 using a value key 520 (e.g., a pseudo-random function key) based on an associated key pair 32 and a secret master key 14. The key pairs 32 can be concatenated. Optionally, the secret master key 14 is stored on the user device 10 and / or is only accessible to the user 12. The pseudo-random function 15 receives the corresponding concatenated key pairs 32 and the secret master key 14, and generates a corresponding value key 520, which encrypts the corresponding encrypted value 510. That is, each value key 520 is based on the two keys 32 in the key pair. Figure 6BAs shown, the client-side encrypted search system 600 can also generate each encrypted tag 512 by encrypting each encrypted tag 512 using a tag key 522 (i.e., a pseudo-random function key) based on one of the keywords 32 in the keyword pair and the secret master key 14. That is, while the encrypted value 510 can be based on the value key 520 (which is generated based on both keywords 32 in the keyword pair), the encrypted tag can be based on the tag key 522 (which is generated based on one of the keywords 32 in the keyword pair). Figure 6B In the client-side encrypted search system 600, keyword 32 is used. k i Master key 14 pairs with key 32 k i and k j Generate tag key 522. However, the client-side encrypted search system 600 can also use keyword 32. k j To generate tag key 522.

[0046] Now refer to Figures 7A to 7D Schematic diagrams 700a-d provide a formal description of the construction of the client-side encrypted search system 600 and the SE manager 120 to create and respond to conjunctive queries comprising two or more keywords 32. Schematic diagram 700a provides a formal description of the encrypted search index 160 (i.e., encrypted multi-mapping or EMM). At steps 1 and 2, user device 10 randomly selects a key for the pseudo-random function 15 and a secret master key 14. At step 3, the multi-mapping is initialized, and at step 4, user device 10 generates a corresponding encrypted value 510 and encrypted tag 512 for each pair of keywords 32. At step 5, the multi-mapping is encrypted and forms the encrypted search index 160. At step 6, a set of dual tags 514 is initialized, and at step 7, user device 10 generates each dual tag 514 for each pair of keywords 32. At step 8, the user device randomly arranges the set of dual tags 514, and at step 9, the encrypted search index 160 is sent to storage device 150.

[0047] Figure 7B Schematic diagram 700b provides a formal description of the technique for generating search query 20 for user equipment 10. In step 1, user equipment 10 generates a first token based on a first keyword. In step 2, user equipment 10 encrypts the first token based on a concatenation of the first and second keywords. In step 3, user equipment 10 generates remaining tokens for each remaining keyword. In step 4, user equipment 10 transmits search query 20, which includes each generated token 24.

[0048] Figure 7C Schematic diagram 700c provides a formal description of the technique used by SE Manager 120 to determine a list of appropriate document identifiers 154 in response to search query 20. At step 1, SE Manager 120 retrieves an encrypted value 510 and an encrypted tag 512 associated with the token 24 of search query 20. At step 2, SE Manager 120 retrieves all encrypted tags 512 associated with the first keyword and the second keyword. At step 2, SE Manager 120 decrypts the retrieved encrypted tags 512 using an encryption key (e.g., token 24) sent by user device 10 within search query 20. At step 3, the response set is initialized to null, and at step 4, for each remaining keyword after the first and second keywords, SE Manager 120 calculates the corresponding double tag 514 and filters the response set to include only document identifiers 154, which include each of the keywords 32 in search query 20. In step 5, SE Manager 120 returns the response set of document identifiers 154 to user device 10.

[0049] Figure 7D Schematic diagram 700d provides a formal description of the technique for user equipment 10 to retrieve document identifier 154 from a response sent by SE manager 120. At step 1, user equipment 10 can simply decrypt encrypted value 510 using the corresponding key 520.

[0050] Therefore, in order to minimize leakage while maintaining efficiency, user equipment 10 constructs an additional set of dual labels 514. X The additional set X Along with the encrypted search index 160, it is stored on an untrusted storage device. For each key pair (a,b), for each value... The double tag 514 was added. X User equipment 10 generates a pseudo-random function (PRF) key from secret master key 14 in a pseudo-random manner. Therefore, it depends only on the key pair (a, b). The dual tag 514 can essentially be a hash of the encrypted tag 512, which is also stored within the encrypted search index 160. Then, the SE manager 120 can utilize the set... X This is used to filter the list of document identifiers 154 corresponding to the first and second keywords. For example, SE Manager 120 filters the list (i.e., the set) of document identifiers 154. T (To retain only keywords 32) k The value of 3 (i.e., the value of the set) The client revealed the PRF key. SE Manager 120 To evaluateT For each label in the code, check if the resulting PRF output appears. X In the middle. Only the obtained PRF output appears. X Only pairs in the set will be retained. T In the middle. Choose carefully. X After that, only when it also appears The value in will make the key The corresponding PRF output appears below X In the middle. By analyzing all remaining keywords (i.e., k 3、…、 k q Repeating this filtering technique, SE Manager 120 successfully calculated... q Conjunction. This technique only leaked 2 conjunction queries. The total amount.

[0051] While the examples in this paper involve responses to conjunctive queries, the techniques described herein can also be applied to more complex search queries, such as conjunctive normal form (CNF) search queries. Figures 8A to 8D Includes schematic diagrams 800a-d, which provide a formal description of the construction, creation, and response to CNF search queries 20 including three or more keywords 32 for the client-side encrypted search system 600 and SE manager 120.

[0052] Figure 8A A formal description of the diagram 800a for the encrypted search index 160 (i.e., encrypted multimapping or EMM) is provided. The settings for the encrypted search index 160 for CNF search query 20 are the same as those for the encrypted search index for conjunctive queries. Figure 7A ). Figure 8B Schematic diagram 800b provides a formal description of the technology for generating CNF search queries 20 for user equipment 10, while Figure 8C The diagram 800c provides a formal description of searching the encrypted search index 160 for CNF search query 20. Finally, Figure 8D The schematic diagram 800d provides a formal description of the decryption of the response from the SE Manager 120 for the user device 10.

[0053] To explain the formal description of diagrams 800a-d, examples are given from CNF formulas with only two clauses. Starting with the simple case, each clause targets all Represented as For all ,gather S i Defined in this article as:

[0054]

[0055] System 100 utilizes the following fact: as long as Any pair of sets S i and S j They are all non-intersecting. Furthermore, all... q The union of sets equals SE Manager 120 can calculate sets. S 1, ... S q1 And return their union as the answer.

[0056] For query The client-side encrypted search system 600 can calculate individual tokens. tok 1, ... tok q1 . The token is just a token for calculation. tok 1, ... tok q1 The cascading of each token in the array. Each token tok i It contains the decryption key for all encrypted tags 512 in each tuple. Therefore, the SE manager 120 can calculate... The hash set. Using the encrypted tag 512, the SE Manager 120 can also calculate all q The union of two sets is represented as the superset of the final response. S i In this example, S i Current equals set .

[0057] However, to ensure that all parts are disjoint, SE Manager 120 filters each... S i And from S i Remove collection Similar to conjunctive queries, this applies to all... SE Manager 120 Collection Iterative filtering is performed on each set in the dataset. To target any... j To achieve this, user equipment 10 will use the PRF key. Send to SE Manager 120. SE Manager 120 can use the received PRF key pair. S i Each encrypted tag 512 in the code is hashed, and the resulting output can be checked to see if it appears in the code. XIn the middle. Hash labels appear X Each pair in can be obtained from S i It can be safely removed from the set because it must appear in the set. In general, user equipment 10 can target all. Send PRF key This enables SE Manager 120 to manage all collections. Duplicate filtering. Therefore, SE Manager 120 calculates all disjoint sets. S 1, ... S q1 Their union is exactly The response set. This technique can be extended to CNF queries with any number of clauses.

[0058] For example, given a new clause SE Manager 120 can calculate the filter set. … The union of these sets corresponds to the search query 20. The response. Due to each set S i All tags are hashed under PRF key 522, which depends only on one of the keywords 32 in the pair, so only the tags need to be removed. S i It did not appear in any set. … All items in the system are acceptable. To achieve this, user device 10 transmits the PRF key to SE manager 120. … .

[0059] SE Manager 120 can be used in all q 3-key pair S i Hash each label in the array and check if the resulting hash appears in the array. X In China. (Targeting) S i Any tag in, making all q 3 hashes will not appear X In the middle, SE Manager 120 can determine that the associated value 510 will not appear in any collection. … In, and from S iRemove the tags. Therefore, by removing all these tags, the SE Manager 120 successfully calculates for all... q 1 set For the form of For any CNF query, SE Manager 120 can target all D 3、…、 D l Repeat the above filtering to calculate the final response of user device 10 to search query 20.

[0060] Figure 9 This is a flowchart illustrating an exemplary arrangement of the operation of method 900, which provides encrypted search on encrypted data to reduce total leakage. At operation 902, method 900 includes receiving a search query 20 for a plurality of keywords 32 from a user device 10 associated with user 12 at data processing hardware 118. The plurality of keywords 31 appear in one or more encrypted documents within an encrypted document corpus stored on an untrusted storage device 150. At operation 904, method 900 includes accessing an encrypted search index 160 by data processing hardware 118 to obtain a first list of document identifiers 154. Each document identifier 154 in the first list of document identifiers 154 represents a document 152, which includes a first keyword and a second keyword among the plurality of keywords 32.

[0061] At operation 906, method 900 further includes, for each remaining keyword appearing in one or more encrypted documents after the first keyword and the second keyword, determining a corresponding list of document identifiers 154 by the data processing hardware 118. Each document identifier 154 in the corresponding list of document identifiers 154 represents a document 152 including the first keyword, the second keyword, and the corresponding remaining keyword. At operation 908, method 900 includes, by the data processing hardware 118, determining a second list of document identifiers 154 based on the first list of document identifiers 154 and the corresponding list of each document identifier 154. Each document identifier 154 in the second list of document identifiers 154 represents a document 152 including each of the plurality of keywords 32. At operation 910, method 900 includes, by the data processing hardware 118, returning the second list of document identifiers 154 obtained from the encrypted search index 160 to the user device 10.

[0062] Figure 10This is a schematic diagram of an example computing device 1000 that can be used to implement the systems and methods described in this document. The computing device 1000 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the embodiments of the invention described and / or claimed in this document.

[0063] Computing device 1000 includes a processor 1010, a memory 1020, a storage device 1030, a high-speed interface / controller 1040 connected to the memory 1020 and a high-speed expansion port 1050, and a low-speed interface / controller 1060 connected to a low-speed bus 1070 and the storage device 1030. Each of the components 1010, 1020, 1030, 1040, 1050, and 1060 is interconnected using various buses and can be mounted on a common motherboard or otherwise installed as needed. The processor 1010 is capable of processing instructions for execution within computing device 1000, including instructions stored in the memory 1020 or the storage device 1030, to display graphical information of a graphical user interface (GUI) on an external input / output device, such as a display 1080 coupled to the high-speed interface / controller 1040. In other embodiments, multiple processors and / or multiple buses may be used with multiple memories and multiple memory types, if desired. Furthermore, multiple computing devices 1000 can be connected, each providing some of the necessary operations (e.g., as a server group, a set of blade servers, or a multiprocessor system).

[0064] Memory 1020 stores information non-transiently within computing device 1000. Memory 1020 may be a computer-readable medium, volatile memory cells(s), or non-volatile memory cells(s). Non-transient memory 1020 may be a physical device for storing programs (e.g., instruction sequences) or data (e.g., program state information) on a temporary or permanent basis for use by computing device 1000. Examples of non-volatile memory include, but are not limited to, flash memory and read-only memory (ROM) / programmable read-only memory (PROM) / erasable programmable read-only memory (EPROM) / electrically erasable programmable read-only memory (EEPROM) (e.g., commonly used in firmware, such as bootloaders). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase-change memory (PCM), and optical discs or magnetic tapes.

[0065] Storage device 1030 provides a large storage capacity for computing device 1000. In some embodiments, storage device 1030 is a computer-readable medium. In various embodiments, storage device 1030 may be a floppy disk device, hard disk device, optical disk device, magnetic tape device, flash memory, or other similar solid-state storage device or array of devices, including devices configured in or otherwise in a storage area network. In additional embodiments, a computer program product is tangibly implemented in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer-readable or machine-readable medium, such as memory 1020, storage device 1030, or memory on processor 1010.

[0066] High-speed interface / controller 1040 manages bandwidth-intensive operations of computing device 1000, while low-speed interface / controller 1060 manages lower bandwidth-intensive operations. This allocation of responsibility is merely exemplary. In some embodiments, high-speed interface / controller 1040 is coupled to memory 1020, display 1080 (e.g., via a graphics processor or accelerator), and high-speed expansion port 1050, which can accept various expansion cards (not shown). In some embodiments, low-speed interface / controller 1060 is coupled to storage device 1030 and low-speed expansion port 1090. Low-speed expansion port 1090, which may include various communication ports (e.g., USB, Bluetooth, wireless Ethernet), can be coupled to one or more input / output devices, such as keyboards, pointing devices, scanners, or networking devices (such as switches or routers), via a network adapter.

[0067] As shown in the accompanying drawings, the computing device 1000 can be implemented in a variety of different forms. For example, it can be implemented as a standard server 1000a, or implemented multiple times in a group of such servers 1000a, or implemented as a laptop computer 1000b, or implemented as part of a rack-mounted server system 1000c.

[0068] Various implementations of the systems and techniques described herein can be implemented in digital electronic circuit systems and / or optical circuit systems, integrated circuit systems, specially designed ASICs (Application-Specific Integrated Circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can be included in one or more computer programs executable and / or interpretable on a programmable system, which includes at least one programmable processor, which may be dedicated or general-purpose, coupled to receive data and instructions from a storage system, at least one input device, and at least one output device, and to transfer data and instructions to the storage system, at least one input device, and at least one output device.

[0069] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and can be implemented in high-level programming and / or object-oriented programming languages ​​and / or assembly / machine languages. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, non-transitory computer-readable medium, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0070] The processes and logic described in this specification can be executed by one or more programmable processors (also known as data processing hardware) that execute one or more computer programs to perform functions by manipulating input data and generating output. The processes and logic can also be executed by special-purpose logic circuitry (e.g., FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits)). By way of example, processors suitable for executing computer programs include both general-purpose and special-purpose microprocessors, as well as any one or more processors of any kind of digital computer. Typically, the processor will receive instructions and data from read-only memory or random access memory, or both. Essential components of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices (e.g., magnetic disks, magneto-optical disks, or optical disks) for storing data, or the computer will be operatively coupled to receive data from or transfer data to such mass storage devices, or both. However, a computer does not necessarily need to have such devices. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, by example, semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices); magnetic disks (e.g., internal hard disks or removable disks); magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and memory may be supplemented by dedicated logic circuitry or incorporated into that dedicated logic circuitry.

[0071] To provide interaction with a user, one or more aspects of this disclosure can be implemented on a computer having: a display device for displaying information to the user, such as a CRT (cathode ray tube), LCD (liquid crystal display) monitor, or touchscreen; and optionally a keyboard and a pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form (including acoustic input, voice input, or tactile input). Additionally, the computer can interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending web pages to a web browser on the user's client device in response to a request received from a web browser.

[0072] Several embodiments have been described. However, it is to be understood that various modifications can be made without departing from the spirit and scope of this disclosure. Therefore, other embodiments are within the scope of the following claims.

Claims

1. A method for encrypted search, comprising: At the data processing hardware, a search query for multiple keywords is received from a user device associated with the user, the multiple keywords appearing in one or more encrypted documents within a corpus of encrypted documents stored on an untrusted storage device; The data processing hardware accesses an encrypted search index to obtain a first list of document identifiers, each document identifier in the first list representing a document that includes a first keyword among the plurality of keywords and a second keyword among the plurality of keywords; For each remaining keyword that appears in the one or more encrypted documents after the first keyword and the second keyword, the data processing hardware determines a corresponding list of document identifiers, where each document identifier in the corresponding list represents a document that includes the first keyword, the second keyword, and the corresponding remaining keyword. The data processing hardware determines a second list of document identifiers based on a first list of document identifiers and each corresponding list of document identifiers, wherein each document identifier in the second list of document identifiers represents a document that includes each of the plurality of keywords; as well as The data processing hardware returns a second list of document identifiers obtained from the encrypted search index to the user device.

2. The method according to claim 1, wherein, For each corresponding keyword pair appearing in the one or more encrypted documents, the encrypted search index includes: An encrypted value, wherein the encrypted value represents a list of key pairs of a document identifier, the document identifier representing a document that includes two keywords from the keywords in the corresponding key pair; and An encryption tag, wherein the encryption tag represents one of the keywords in the encryption value and the corresponding keyword pair.

3. The method according to claim 2, wherein, Each encrypted value is encrypted using a pseudo-random function key, which is based on the key pair and the secret master key.

4. The method according to claim 3, wherein, The pseudo-random function key is based on the concatenation of the key pairs.

5. The method according to claim 2, wherein, Each encrypted tag is encrypted using a pseudo-random function key, which is based on one of the keywords and a secret master key.

6. The method according to claim 2, wherein, For each corresponding keyword pair appearing in the one or more encrypted documents, the encrypted search index also includes a list of double tags, each double tag in the list including a cryptographic hash of the corresponding encrypted tag for the corresponding keyword pair.

7. The method according to claim 6, wherein, The second list for determining the document identifiers includes: for each remaining keyword that appears in the one or more encrypted documents after the first keyword and the second keyword: Determine whether the double tag corresponding to the remaining keyword exists in the list of double tags; and Remove each double tag from the list of double tags that does not correspond to the corresponding remaining keyword.

8. The method according to claim 2, wherein, Accessing the encrypted search index to obtain the first list of document identifiers includes: retrieving a list of keyword pairs of document identifiers corresponding to the first keyword and the second keyword.

9. The method according to claim 1, wherein, The search query includes: Tokens representing the first key and the second key; and For each remaining keyword that appears in the one or more encrypted documents after the first keyword and the second keyword, a token representing the first keyword and the corresponding remaining keyword is provided.

10. The method according to any one of claims 1 to 9, wherein, The second list of document identifiers obtained from the encrypted search index is returned to the user equipment, enabling the user equipment to decrypt the second list of document identifiers using a secret master key.

11. A system for encrypted search, comprising: Data processing hardware; as well as Memory hardware communicating with the data processing hardware, the memory hardware storing instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations, the operations including: Receive search queries for multiple keywords from a user device associated with the user, the multiple keywords appearing in one or more encrypted documents within a corpus of encrypted documents stored on an untrusted storage device; Access the encrypted search index to obtain a first list of document identifiers, each document identifier in the first list of document identifiers representing a document including a first keyword among the plurality of keywords and a second keyword among the plurality of keywords; For each remaining keyword that appears in the one or more encrypted documents after the first keyword and the second keyword, a corresponding list of document identifiers is determined, wherein each document identifier in the corresponding list of document identifiers represents a document including the first keyword, the second keyword and the corresponding remaining keyword; A second list of document identifiers is determined based on the first list of document identifiers and each corresponding list of document identifiers, wherein each document identifier in the second list represents a document including each of the plurality of keywords; and A second list of document identifiers obtained from the encrypted search index is returned to the user device.

12. The system according to claim 11, wherein, For each corresponding keyword pair appearing in the one or more encrypted documents, the encrypted search index includes: An encrypted value, wherein the encrypted value represents a list of key pairs of a document identifier, the document identifier representing a document that includes two keywords from the keywords in the corresponding key pair; and An encryption tag, wherein the encryption tag represents one of the keywords in the encryption value and the corresponding keyword pair.

13. The system according to claim 12, wherein, Each encrypted value is encrypted using a pseudo-random function key, which is based on the key pair and the secret master key.

14. The system according to claim 13, wherein, The pseudo-random function key is based on the concatenation of the key pairs.

15. The system according to claim 12, wherein, Each encrypted tag is encrypted using a pseudo-random function key, which is based on one of the keywords and a secret master key.

16. The system according to claim 12, wherein, For each corresponding keyword pair appearing in the one or more encrypted documents, the encrypted search index also includes a list of double tags, each double tag in the list including a cryptographic hash of the corresponding encrypted tag for the corresponding keyword pair.

17. The system according to claim 16, wherein, The second list for determining the document identifiers includes: for each remaining keyword that appears in the one or more encrypted documents after the first keyword and the second keyword: Determine whether the double tag corresponding to the remaining keyword exists in the double tag list; and Remove each double tag from the double tag list that does not correspond to the corresponding remaining keyword.

18. The system according to claim 12, wherein, Accessing the encrypted search index to obtain the first list of document identifiers includes: retrieving a list of keyword pairs of document identifiers corresponding to the first keyword and the second keyword.

19. The system according to claim 11, wherein, The search query includes: Tokens representing the first key and the second key; and For each remaining keyword that appears in the one or more encrypted documents after the first keyword and the second keyword, a token representing the first keyword and the corresponding remaining keyword is provided.

20. The system according to any one of claims 11 to 19, wherein, The second list of document identifiers obtained from the encrypted search index is returned to the user equipment, enabling the user equipment to decrypt the second list of document identifiers using a secret master key.

Images