A dynamic symmetric searchable encryption method for multi-keyword query

Abstract

The present invention provides a dynamic, symmetric, searchable encryption method for multi-keyword queries, intended for information security. The method comprises the following steps: generating an index table encryption key and a bidirectional index table based on client initialization; the client generating a query trapdoor based on a user-submitted query keyword set and sending it to a cloud server, which returns the query results to the client; and the client generating an update trapdoor based on user-submitted update requests and sending it to the cloud server, which updates the bidirectional index table and encrypted file repository. Based on a bidirectional index structure, a Bloom filter, a KNN secure encryption algorithm, and a B+ tree structure design, the method improves the efficiency of index construction, querying, and dynamic updating compared to existing related solutions, allowing for greater flexibility in cloud storage searchable encryption applications.

Description

Technical Field

[0001] The present invention belongs to the technical field of network and information security, and in particular relates to a dynamic symmetric searchable encryption method for multi-keyword query. Background Art

[0002] The development of the digital economy has made data a critical resource sought after by countries, businesses, and individuals. Due to the shortcomings of traditional storage methods, more and more people are turning to cloud storage systems to store data. While cloud storage offers many advantages, the security of large amounts of sensitive information concentrated in cloud storage systems is vulnerable to security threats.

[0003] To address these issues, existing technologies encrypt data before outsourcing it to cloud servers for storage. However, this significantly limits the flexibility of data use. Therefore, searchable encryption technology has been proposed. This technology not only ensures the security of cloud user data and privacy, but also enables users to perform keyword searches directly on encrypted data, while also leveraging the advantages of cloud servers for efficient computing and convenient storage.

[0004] However, current symmetric searchable encryption methods are primarily based on indexing, with queries primarily implemented by multiplying a request vector and a file index vector. Therefore, the efficiency and dynamism of index construction are key indicators of a solution's usability. Query-related operations involve significant computational effort, and while several approaches have leveraged various index structures to improve efficiency, the results have been unsatisfactory.

[0005] Based on this, how to ensure efficiency while taking into account safety and loss costs has become a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0006] In view of this, the object of the present invention is to provide a dynamic symmetric searchable encryption method for multi-keyword query to solve the technical problems existing in the above-mentioned prior art.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A dynamic symmetric searchable encryption method for multi-keyword query, comprising the following steps:

[0009] Generate index table encryption key and bidirectional index table based on client initialization;

[0010] The client generates a query trap based on the query keyword set submitted by the user and sends it to the cloud server, and the cloud server returns the query result to the client;

[0011] The client generates an update trapdoor according to the update requirement submitted by the user and sends it to the cloud server. The cloud server performs an update operation on the bidirectional index table and the encrypted file library.

[0012] Preferably, the index table encryption key includes:

[0013] A random symmetric key for file encryption, a random binary vector key for index preprocessing, and a random reversible matrix key M1 and a random reversible matrix key M2 for index encryption.

[0014] Preferably, generating a bidirectional index table based on client initialization specifically includes:

[0015] The client generates a forward index table according to the file-keyword pair, and encrypts the forward index table F using the index table encryption key;

[0016] The client generates an inverted index table according to the keyword-file pair, processes the keyword using a Bloom filter, and then processes the processed inverted index table through a B+ tree index to generate an inverted index table B.

[0017] Preferably, the specific generation process of the forward index table F includes:

[0018] The client splits the keyword index I of the data file to be encrypted using the random binary vector key according to the forward index table to obtain an index IU and an index ID;

[0019] Performing secure KNN encryption processing on the index IU using the random reversible matrix key M1 to obtain an index EIU;

[0020] Performing secure KNN encryption processing on the index ID using the random reversible matrix key M2 to obtain an index EID;

[0021] The forward index table F is composed based on the index EIU, the index EID and the file location information.

[0022] Preferably, the specific generation process of the inverted index table B includes:

[0023] Establishing the B+ tree index from bottom to top according to the Bloom filter, wherein each Bloom filter is stored in a leaf node of the B+ tree;

[0024] According to the keyword-file pair, each leaf node is made to point to the file index corresponding to the keyword mapped by the Bloom filter stored thereon, so as to obtain the inverted index table B.

[0025] Preferably, the client generates a query trap based on the query keyword set submitted by the user, specifically including:

[0026] The client generates the Bloom filter corresponding to each query keyword according to the query keyword set submitted by the user, to obtain a query Bloom filter set BFn;

[0027] The client generates a corresponding query index Q for the Bloom filter set BFn according to the query keyword set submitted by the user;

[0028] Splitting the query index Q using the random binary vector key to obtain index QU and index QD;

[0029] Performing secure KNN encryption processing on the index QU using the random reversible matrix key M1 to obtain an index EQU;

[0030] Performing secure KNN encryption processing on the index QD using the random reversible matrix key M2 to obtain an index EQD;

[0031] The query trapdoor is composed based on the index EQU, the index EQD and the query Bloom filter set BFS.

[0032] Preferably, the query results returned by the cloud server are the top K files ranked in terms of relevance to the query keyword set.

[0033] Preferably, the cloud server performs an update operation on the bidirectional index table and the encrypted file library, wherein the update operation includes: file addition and file deletion.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] This solution is based on a bidirectional index structure. The forward index utilizes the KNN algorithm to ensure security, while the inverted index uses a Bloom filter-based index tree. This not only hides keyword information but also significantly reduces the time required to build the index tree. The Bloom filter's high spatial filtering and the B+ tree index structure, which enables efficient queries, also reduce query time overhead. Modular addition-based update operations also minimize dynamic update time overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0037] Figure 1(a)-(b) shows schematic diagrams of the forward index table and the inverted index table.

[0038] Figure 2 This is a schematic diagram of inverted index table B.

[0039] Figure 3 It is a flowchart of the query process. DETAILED DESCRIPTION

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0041] Example 1:

[0042] This embodiment discloses a dynamic symmetric searchable encryption method for multi-keyword query, including the following steps:

[0043] Generate index table encryption key and bidirectional index table based on client initialization;

[0044] The client generates a query trap based on the query keyword set submitted by the user and sends it to the cloud server. The cloud server returns the query results to the client.

[0045] The client generates an update trapdoor based on the update requirements submitted by the user and sends it to the cloud server. The cloud server then updates the bidirectional index table and encrypted file library.

[0046] Specifically:

[0047] In this embodiment, the index table encryption key includes:

[0048] A random symmetric key for file encryption, a random binary vector key for index preprocessing, and a random reversible matrix key M1 and a random reversible matrix key M2 for index encryption. The random binary vector key is the m-dimensional random binary vector key S for index preprocessing generated by the client based on the size m of the keyword dictionary; the reversible matrix key M1 and the random reversible matrix key M2 are the m-dimensional random reversible matrix keys M1 and M2 for index encryption generated by the client based on the size m of the keyword dictionary.

[0049] For the bidirectional index table, in this embodiment, the client generates a forward index table based on the file-keyword pair, and encrypts it using the index table encryption key to generate a forward index table F; the client generates an inverted index table based on the keyword-file pair, uses a Bloom filter to process the keyword, and then processes the processed inverted index table through a B+ tree index to generate an inverted index table B.

[0050] The specific generation process of the forward index table F includes:

[0051] The client splits the keyword index I of the encrypted data file using a random binary vector key according to the forward index table to obtain the index IU and index ID;

[0052] The index IU is encrypted securely using the random reversible matrix key M1 to obtain the index EIU;

[0053] The random reversible matrix key M2 is used to perform secure KNN encryption on the index ID to obtain the index EID; wherein the encryption rule used in the encryption process is EIU=M1 T IU, EID = M2 T ID;

[0054] The index EIU, the index EID, and the file location information together form a forward index table F. It should be noted that, in this embodiment, the splitting process is performed using a random binary vector key to obtain the index IU and the index ID. The splitting rule used in the splitting process is to traverse the m-dimensional random binary vector key S. When and only when the i-th binary number of the random binary vector key S is 1, two random integers are generated and assigned to the i-th digits of the index IU and the index ID, respectively, and the sum of these two random integers is equal to the i-th digit of the index I; when and only when the j-th binary number of the random binary vector key S is 0, the j-th digit of the index I is assigned to the j-th digit of the index IU and the index ID, respectively, so that the j-th digits of the indexes I, IU, and ID are equal;

[0055] The specific generation process of the inverted index table B includes:

[0056] In this embodiment, the client generates a Bloom filter for each keyword and maps the keywords one by one to the Bloom filter;

[0057] A B+ tree index is built from the bottom up based on the Bloom filter, and each Bloom filter is stored in the leaf node of the B+ tree;

[0058] According to the keyword-file pair, each leaf node is pointed to the file index corresponding to the keyword mapped by the Bloom filter stored thereon, and the inverted index table B is obtained as follows Figure 2 (Take the keyword dictionary size equal to 6 as an example) as shown;

[0059] The client sends the encrypted file and bidirectional index tables F and B to the cloud server for storage.

[0060] In this embodiment, the client generates a query trap based on the query keyword set submitted by the user, specifically including:

[0061] The client generates a Bloom filter corresponding to each query keyword based on the query keyword set submitted by the user, and obtains the query Bloom filter set BFn;

[0062] The client generates a corresponding query index Q for the Bloom filter set BFn based on the query keyword set submitted by the user. The query index generation rule is as follows: initialize an m-dimensional binary sequence with all numbers set to 0; according to the position (id) of the query keyword in the keyword dictionary, set the number of the corresponding position in the binary sequence to 1;

[0063] The query index Q is split using the random binary vector key S to obtain the index QU and the index QD; the splitting rule used in the splitting process is: traverse the m-dimensional random binary vector key S, and when and only when the i-th binary number of the random binary vector key S is 0, generate two random integers and assign them to the i-th digits of the indexes QU and QD respectively, and the sum of these two random integers is equal to the i-th digit of the index Q; when and only when the j-th binary number of the random binary vector key S is 1, assign the j-th digit of the index Q to the j-th digit of the indexes QU and QD respectively, so that the j-th digits of the indexes Q, QU, and QD are equal;

[0064] The index QU is encrypted securely using a random reversible matrix key M1 to obtain the index EQU;

[0065] The index QD is encrypted with a random reversible matrix key M2 to obtain the index EQD; the encryption rule used in the encryption process is: EQU = M1 -1 QU, EQD = M2 -1 QD;

[0066] The query trapdoor is composed of the index EQU, the index EQD and the query Bloom filter set BFS.

[0067] The query trapdoor is sent to the cloud server; the cloud server finds the corresponding file address index information in the inverted index table B according to the query Bloom filter set BFs; in order to improve the query efficiency, the one with the lowest frequency of occurrence is filtered out from the found file address index information to obtain the final file address index information; based on the final file address index information, the filtered file location information is found in the encrypted index table F; according to the forward index table F, the query index Q is matched with the encrypted keyword index corresponding to the file location information in sequence; matching rule: score(I,Q)=(M1 T ·IU)·(M1 -1 ·QU)+(M2 T ·ID)·(M2 -1 ·QD)=EIU·EQU+EID·EQD; Based on the matching results, the cloud server returns the files whose score(I,Q) values ​​are greater than or equal to a certain threshold to the user.

[0068] In this embodiment, the client generates an update trap based on the update request submitted by the user and sends it to the cloud server, which then updates the bidirectional index table and the encrypted file library. Specifically, it includes:

[0069] The client generates the corresponding updated Bloom filter set BFu based on the keywords contained in the file that the user needs to add / delete;

[0070] The client generates and updates indexes Fu and Bu based on the files added / deleted by the user;

[0071] The update index Fu generation rules are as follows;

[0072] If the update operation is add, then the update index Fu is generated according to the file encryption and index F construction rules of S1.4 and S1.5;

[0073] If the update operation is deletion, then generate an update index Fu with all values ​​0 and the same length as the addition;

[0074] The update index Bu is generated according to the following rules: initialize an n-dimensional binary sequence with all numbers set to 0; set the number at the corresponding position in the binary sequence to 1 according to the position (id) of the updated file; if the update operation is deletion, add a minus sign before the binary sequence; in order to hide the update mode, convert the deletion index according to the following rules: remove the minus sign of the deletion index; change the number with a value of 0 in the deletion index to 1, and the number with a value of 1 to 0; add 1 to the deletion index to obtain the converted deletion index;

[0075] The client sends the updated Bloom filter set BFu, the updated trapdoor consisting of the updated index Fu and Bu to the cloud server;

[0076] The cloud server updates the encrypted file library according to the updated index Fu and rewrites the corresponding encrypted file index in the encrypted index table F;

[0077] Find the corresponding file address index information in the encrypted index table B according to the updated Bloom filter set BFu;

[0078] Perform a modular addition operation on the file address index information according to the update index Bu, and take the last m bits as the updated file address index information.

[0079] It should be noted that, in this embodiment, the inverted index table B and the forward index table F are index tables that have been encrypted, while the inverted index table and the forward index table are index tables that have not been encrypted.

[0080] The above description of the disclosed embodiments will enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is to be construed in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. A dynamic symmetric searchable encryption method for multi-keyword query, characterized in that: The following steps are involved: Generate index table encryption key and bidirectional index table based on client initialization; The client generates a query trap based on the query keyword set submitted by the user and sends it to the cloud server, and the cloud server returns the query result to the client; The client generates an update trapdoor according to the update requirement submitted by the user and sends it to the cloud server, and the cloud server performs an update operation on the bidirectional index table and the encrypted file library; The index table encryption key includes: A random symmetric key for file encryption, a random binary vector key for index preprocessing, and a random reversible matrix key M1 and a random reversible matrix key M2 for index encryption; Generate a bidirectional index table based on client initialization, including: The client generates a forward index table according to the file-keyword pair, and encrypts the forward index table F using the index table encryption key; The client generates an inverted index table based on the keyword-file pair, processes the keyword using a Bloom filter, and then processes the processed inverted index table using a B+ tree index to generate an inverted index table B; The client generates a query trap based on the query keyword set submitted by the user, specifically including: The client generates the Bloom filter corresponding to each query keyword according to the query keyword set submitted by the user, to obtain a query Bloom filter set BFn; The client generates a corresponding query index Q for the Bloom filter set BFn according to the query keyword set submitted by the user; Splitting the query index Q using the random binary vector key to obtain index QU and index QD; Performing secure KNN encryption processing on the index QU using the random reversible matrix key M1 to obtain an index EQU; Performing secure KNN encryption processing on the index QD using the random reversible matrix key M2 to obtain an index EQD; The query trapdoor is composed based on the index EQU, the index EQD and the query Bloom filter set BFS.

2. A dynamic symmetric searchable encryption method for multi-keyword query according to claim 1, characterized in that: The specific generation process of the forward index table F includes: The client splits the keyword index I of the data file to be encrypted using the random binary vector key according to the forward index table to obtain an index IU and an index ID; Performing secure KNN encryption processing on the index IU using the random reversible matrix key M1 to obtain an index EIU; Performing secure KNN encryption processing on the index ID using the random reversible matrix key M2 to obtain an index EID; The forward index table F is composed based on the index EIU, the index EID and the file location information.

3. The dynamic symmetric searchable encryption method for multi-keyword query according to claim 1, characterized in that: The specific generation process of the inverted index table B includes: Establishing the B+ tree index from bottom to top according to the Bloom filter, wherein each Bloom filter is stored in a leaf node of the B+ tree; According to the keyword-file pair, each leaf node is made to point to the file index corresponding to the keyword mapped by the Bloom filter stored thereon, so as to obtain the inverted index table B.

4. The dynamic symmetric searchable encryption method for multi-keyword query according to claim 1, characterized in that: The cloud server returns the query results, which are the top K files ranked by relevance to the query keyword set.

5. The dynamic symmetric searchable encryption method for multi-keyword query according to claim 1, characterized in that: The cloud server performs an update operation on the bidirectional index table and the encrypted file library, wherein the update operation includes: file addition and file deletion.

Images