Verifiable Lightweight Searchable Encryption Method in Cloud-Edge-Terminal Environment

Abstract

The present invention provides a verifiable, lightweight, searchable encryption method in a cloud-edge environment. By introducing edge nodes to replace the client to perform signature calculation and verification tasks, the client verification and storage overhead are lightweight. The edge node solves the problem of insufficient client computing and storage resources. Using a distributed double-trapdoor public key cryptography system, a subset decision mechanism, and a cross-domain secure computing protocol technology, an algorithm for filtering search tasks before searching is designed. The entire process is calculated under ciphertext to protect user privacy and reduce the system's communication overhead when there are many meaningless tasks in the task set. Experimental results show that the present invention is suitable for situations where there are many incomplete matching tasks in the task set. By comparing the differences between several schemes in offline keyword guessing attacks, multiple keywords, multiple users, multiple data holders, verifiability, etc., it is shown that the present invention has certain advantages in overall functionality, security, computing and storage overhead, etc.

Description

Technical Field

[0001] The present invention relates to the field of searchable encryption technology, and specifically to a verifiable lightweight searchable encryption method in a cloud-edge-end environment. Background Art

[0002] Searchable encryption mainly includes two forms: symmetric searchable encryption and public key searchable encryption (asymmetric). Symmetric searchable encryption has fast computational speed, but has serious key management issues. Public key searchable encryption faces the inherent problem of keyword guessing attacks. The main reason is that the keyword space is much smaller than the ciphertext space. In the actual search process, malicious users usually choose some frequently used hot words to search. In 2020, Liu et al. proposed a multi-keyword public key searchable encryption scheme (SE-EPOM) for performing searches in distributed systems. Attackers need to obtain the keys of multiple servers to perform keyword guessing attacks. Therefore, the SE-EPOM scheme successfully resists attacks from internal and external attackers. However, the SE-EPOM scheme performs calculations based on a dual-server environment, and multiple rounds of interactions are required between internal servers. Designing a filtering algorithm to filter meaningless tasks can reduce the system communication overhead to a certain extent.

[0003] Edge computing technology has developed rapidly in recent years, but IoT devices have relatively weak computing capabilities, can only handle lightweight tasks, and need to outsource complex tasks. This has gradually led to the emergence of a cloud-edge-device model. This paper builds a system based on a cloud-edge-device environment, deploys multiple virtual machines on a laptop to simulate the cloud-edge-device environment, and designs a lightweight and searchable encryption algorithm based on this cloud-edge-device environment. Summary of the Invention

[0004] The purpose of the present invention is to provide a verifiable, lightweight, searchable encryption method in a cloud-edge environment to solve the problem of high communication overhead in the prior art when the task set is not fully matched and there are many tasks.

[0005] The present invention is implemented as follows: a verifiable, lightweight, searchable encryption method in a cloud-edge-device environment, comprising the following steps:

[0006] a. The key generation center generates and distributes public parameters to users and data holders, distributes parts of strong private keys to the first and second cloud servers, and generates key pairs for proxy edge nodes;

[0007] b. The user and data holder generate their own key pairs based on public parameters. The data holder generates searchable ciphertext based on their public key and encrypts the document using the symmetric key. The user uses their public key to generate a search trapdoor corresponding to the searchable ciphertext. The user and data holder upload the search trapdoor, searchable ciphertext, and encrypted document to an edge node. Edge nodes include ordinary edge nodes and proxy edge nodes.

[0008] c. The ordinary edge node first calculates at least a threshold number of signatures for the encrypted document, and then the proxy edge node integrates all the signatures;

[0009] d. The ordinary edge node uploads the encrypted document, searchable ciphertext, search trapdoor, and integrated signature to the first cloud server;

[0010] e. The first cloud server first backs up the encrypted document, searchable ciphertext, search trapdoor, and integrated signature to the second cloud server. The first cloud server and the second cloud server then interactively execute a subset decision mechanism and a cross-domain secure computing protocol to calculate an encrypted value.

[0011] f. The second cloud server delivers the encrypted value calculated in step e to the user, who then determines based on the encrypted value whether the corresponding encrypted document is part of the final search results. If so, the user applies to the second cloud server for the encrypted document.

[0012] g. After receiving the user's request to obtain the encrypted document, the second cloud server verifies the relevant encrypted document by interacting with the proxy edge node and deletes the malicious document added by the semi-trusted cloud server;

[0013] h. The second cloud server sends the searched and verified encrypted document to the user;

[0014] i. After receiving the encrypted document, the user uses the symmetric key to decrypt it.

[0015] Preferably, in step a, the public parameters generated by the key generation center are PP=(N,s,BP), where N and s are the parameters obtained by the key generation center executing KeyGen, BP is the bilinear pairing parameter, and BP={G,G T ,e,p,g}, G and G T are two large prime p-order cyclic groups, g is the generator of the cyclic group G, e:G×G→G T It is a bilinear map; the key generation center generates a key pair (pk m =g b ,sk m =b);

[0016] In step c, the proxy edge node first outputs a polynomial f(x)=c ξ-1 x ξ-1 +...+c1x+c0, where c0=b,i≤2ξ-1; ξ is the threshold, i is the number of ordinary edge nodes; the proxy edge node selects i pairs of elements {(x1,y1),(x2,y2),...,(x i ,y i )}, and replace y1,...,y i Sent to common edge nodes for signing;

[0017] Ordinary edge nodes calculate signatures for encrypted documents as follows: Among them, H0 and H1 are two collision-resistant hash functions, H0:{0,1} * →Z p , H1:{0,1} * →G;C m To encrypt documents;

[0018] The proxy edge node integrates all signatures as follows: in,

[0019] Preferably, in step e, the first cloud server and the second cloud server interactively execute a subset decision mechanism and a cross-domain secure computing protocol to calculate an encrypted value, as follows:

[0020] e-1. Suppose there are m encrypted documents and corresponding m searchable ciphertexts and m search trapdoors T and t are the decimal forms of searchable ciphertext and search trapdoor respectively;

[0021] e-2. First, interactively operate on the first set of searchable ciphertext and search trapdoor, input pk MDO , pk MDU ,λ1,λ2,where,pk MDO and pk MDU are the public keys of the data holder and the user respectively; λ1 and λ2 are the partial strong private keys generated by the key generation center;

[0022] First cloud server first calculates The inverse code Where sum = 2 μ -1, μ represents the bit length of the binary form of sum; the first and second cloud servers run the interactive SBD protocol and output the first group: T i and t iThey are the binary form of searchable ciphertext and the binary form of search trapdoor respectively;

[0023] e-3. Input TD' m , pk MDO , pk MDU ,λ1,λ2, calculated using the SBD protocol Finally, we get two binary strings with all bits encrypted. In these two sets of binary strings, multiplication using the SMD protocol yields Use SAD protocol to Each bit in is accumulated, and the result is recorded as Will Give the user a weak private key sk MDU Decryption yields f t , if f t =0, the user returns "need to filter", otherwise it returns "no need to filter", and executes step e-4;

[0024] e-4. Input from the first cloud server and the second cloud server pk MDO , pk MDU ,λ1,λ2, perform subset decision mechanism calculation

[0025] e-5, the first cloud server and the second cloud server will Multiply and get right Add random seed r 1 Get the encrypted value in

[0026] e-6. Repeat steps e-2 to e-5 until the calculation of m groups of data is completed.

[0027] Preferably, in step f, the user determines whether the corresponding encrypted document belongs to the final search result based on the encrypted value, specifically: after receiving the encrypted value, the user uses the weak private key sk MDU Decryption: If the output is 0, it means that the search trapdoor does not match the searchable ciphertext, and the corresponding encrypted document is not the final search result; if the output is 1, it means that the search trapdoor does match the searchable ciphertext, and the corresponding encrypted document belongs to the final search result.

[0028] Preferably, in step g, ε is used to represent the search result The number of each result document Will be associated with one γ∈[1,ε]; proxy edge nodes are randomly selected Send {γ,e γ} to the second cloud server, which calculates in The second cloud server sends the certification information (υ * , τ * ) to the proxy edge node; the proxy edge node verifies whether the following formula holds:

[0029]

[0030] If the verification equation is established, it means that the document verification has passed; otherwise, it means that the document verification has failed.

[0031] This paper proposes a verifiable lightweight VSE-EPOMFC solution and designs a filtering algorithm to reduce system overhead. The contributions of this paper are mainly reflected in the following three aspects:

[0032] 1) Introducing edge nodes to perform signature calculation and verification tasks on behalf of the client, reducing client verification and storage overhead. Edge nodes solve the problem of insufficient client computing and storage resources.

[0033] 2) Using three technologies: distributed double-trapdoor public key cryptography system, subset decision mechanism, and cross-domain secure computing protocol, an algorithm for filtering search tasks before searching is designed. The entire process is calculated under ciphertext to protect user privacy and reduce the system's communication overhead when the task set contains a large number of meaningless tasks.

[0034] 3) Simulation experiments evaluated the communication overhead of the proposed scheme (VSE-EPOMFC) and SE-EPOM during search, and compared the client verification overhead with the CP-ABKS scheme. The experimental results show that the proposed scheme (VSE-EPOMFC) improves both search and verification performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of the system model of the present invention.

[0036] Figure 2 It is a flow chart of the filtering algorithm of the present invention.

[0037] Figure 3 This is a comparison of the search time between the solution of the present invention and other solutions as the matching degree changes.

[0038] Figure 4 It is the verification overhead of the client as the number of keywords uploaded by users changes.

[0039] Figure 5It is the client's storage overhead as the number of keywords uploaded by users changes.

[0040] Figure 6 is the verification overhead of the LGFS scheme as the number of document-keyword pairs changes. DETAILED DESCRIPTION

[0041] The present invention utilizes three technologies: a distributed double-trapdoor public key cryptography system, a subset decision mechanism, and a cross-domain secure computing protocol. These three technologies are described below.

[0042] Distributed Double Trapdoor Public Key Cryptography (DT-PKC): A strong private key SK = λ can be split into two parts, so that the scheme not only supports weak private keys sk i Decryption can also be done by decomposing the strong private key SK i =λ i For distributed decryption, the present invention mainly uses the following algorithms:

[0043] (SK,N,g,sk i ,pk i )←KeyGen(k). Input security parameter k, output strong private key SK=λ,N=pq,g=-a 2N , and the key pair sk corresponding to each entity i ,pk i .

[0044] Input message m and public key pk i , output ciphertext

[0045] The weak private key sk can be used by the decryption algorithm i Decryption.

[0046] (SK1,SK2)←SkeyS(SK). Use the remainder theorem to split the strong private key SK=λ into two parts SK1=λ1,SK2=λ2. The recursive execution algorithm outputs more decomposed keys.

[0047] Enter ciphertext And the partial strong private key SK1, run the partial decryption algorithm to output the partial decrypted ciphertext CT i (1) .

[0048] m←PSDec2(SK2,CT i (1) ). Input partial decrypted ciphertext CT i (1)With a partial strong private key SK2, run a partial decryption algorithm to output the plaintext message m.

[0049] Input ciphertext Output another ciphertext of the plaintext message m.

[0050] Cross-domain secure computing protocol: DT-PKC only supports homomorphic encryption under the same public key. However, in actual distributed search, in order to protect the privacy of users and data holders, partial homomorphic encryption needs to be performed on ciphertexts using different public keys. Given the public key pk MDU , pk MDO , ciphertext Satisfy the following protocol:

[0051] The secure bit multiplication protocol gives the ciphertext Output

[0052] The secure bit addition protocol gives the ciphertext <00003​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​3) Bitwise addition yields

[0062] 4) Subtract c from 2 j Get d j ;

[0063] 5) For d j Perform cumulative multiplication to obtain R;

[0064] 6) The while loop ends;

[0065] 7) If R=0, Otherwise, W2∈W1;

[0066] System Model:

[0067] In the VSE-EPOMFC solution of the present invention, the system consists of six entities: a key generation center (KGC), a data owner (MDO), edge nodes (including standard edge nodes (EN) and proxy edge nodes (ENM), user MDUs, cloud platform 1 (CP1), and cloud platform 2 (CP2). Edge nodes are computing devices located between clients and cloud servers. This embodiment uses two cloud servers as an example. If there are more than two cloud servers, the calculations will be more complex.

[0068] Figure 1 This describes the system model. For example, an enterprise outsources sensitive data to cloud servers CP1 and CP2, allowing authorized employees to access this data anytime, anywhere. Before outsourcing to the cloud servers, the uploaded encrypted data is signed by a standard edge node (EN) and a proxy edge node (ENM). This avoids the limitation of previous solutions that require all data holders to sign online simultaneously.

[0069] right Figure 1 The bid numbers ①-⑧ are described as follows:

[0070] ① The key generation center KGC is responsible for generating and distributing public parameters PP to users MDU and data holders MDO, distributing some strong private keys to CP1 and CP2 (in real life, these can be credible institutions such as the government), and generating key pairs for the agent edge node ENM.

[0071] ② The user MDU and the data holder MDO rely on the public parameters PP generated from KGC to generate their own key pairs, use their respective public keys to generate searchable ciphertext SC and trapdoor TD, use the symmetric key to encrypt the file, and upload the encrypted document, searchable ciphertext and search trapdoor to the edge node respectively.

[0072] ③ The edge node consists of two parts: the proxy edge node (ENM) and the normal edge node (EN). Signatures are completed by the EN and ENM. The normal edge node (EN) first signs, and the ENM then consolidates the signatures generated by multiple normal edge nodes, further shortening the signature length. Verification of the results is completed by CP2 and ENM.

[0073] ④ The edge node uploads encrypted documents, searchable ciphertext, search trapdoors, and signatures to CP1.

[0074] ⑤CP1 backs up the encrypted document, searchable ciphertext, search trapdoor, and signature to CP2. CP1 and CP2 interactively execute the subset decision mechanism and cross-domain secure computation protocol to calculate an encrypted value.

[0075] ⑥CP2 passes the encrypted value to the MDU, which determines whether the corresponding encrypted document belongs to the final search results. The MDU requests CP2 to obtain the encrypted document that meets the conditions.

[0076] ⑦After receiving the request from MDU to obtain the encrypted document, CP2 verifies the relevant encrypted document by interacting with ENM and deletes the malicious document added by the semi-trusted cloud server.

[0077] ⑧CP2 returns the searched and verified encrypted document to MDU.

[0078] Verified Lightweight (VSE-EPOMFC)

[0079] SE-EPOM introduces a universal keyword set W to encrypt multiple keywords in the form of binary strings, ensuring that the size of the searchable ciphertext and trapdoor is independent of the number of keywords. However, considering that malicious data holders MDO, cloud servers CP1, and cloud servers CP2 may upload incorrect ciphertexts or return incorrect search results, it is usually the MDO that signs the ciphertext, and the MDU is responsible for verifying the search results. At this time, the client (including MDO and MDU) will be responsible for calculating the ciphertext, signing, and verifying the signature. This is obviously not advisable for resource-constrained client devices. Therefore, the present invention introduces edge nodes to replace MDO to sign the ciphertext and replace MDU to verify the signature, thereby reducing the verification overhead of the client. A threshold signature mechanism is used, in which some ordinary edge nodes first replace the threshold ξ number of MDOs to sign the ciphertext separately, and an agent edge node ENM is set to generate a unique threshold signature for each document based on multiple signatures, thereby shortening the signature length. Table 1 gives the meaning of each symbol.

[0080] Table 1 Symbol table

[0081]

[0082]

[0083] Task Filtering

[0084] Since a large number of interactive algorithms are required in the actual search process and the communication is relatively complex, in order to solve the problem of unnecessary communication overhead caused by a large number of mismatched tasks during the communication process, a filtering algorithm is designed based on the subset decision mechanism to filter out completely mismatched tasks.

[0085] The present invention uses the subset decision mechanism in SE-EPOM during the search process, using CP1 and CP2 to search based on the ciphertext. However, when there are a large number of completely mismatched encrypted binary strings in the task set, the SE-EPOM scheme will generate unnecessary communication overhead. The present invention's scheme VSE-EPOMFC adds a filtering algorithm to the search process to filter out completely mismatched binary strings, such as Figure 2 After completely mismatched binary strings are found, they are filtered out and no repeated searches or calculations are performed later.

[0086] The filtering algorithm takes effect only when the two binary strings do not match at all. To calculate the ciphertext, only safe bit addition and safe bit multiplication operations can be used. For ease of understanding, the examples demonstrated in the embodiments of the present invention are executed in the plaintext state, such as Figure 2 As shown in the figure, in practice, various complex communication protocols must be run on the encrypted binary strings. The filtering algorithm determines whether two binary strings are completely mismatched. First, when each corresponding encrypted bit is different, a secure bit multiplication protocol is used to generate an encrypted binary string that is guaranteed to be all zeros. Then, a secure bit addition protocol is used to accumulate all bits. Finally, the result is given to the user MDU for decryption. If the result is zero, it indicates that the two binary strings are completely mismatched, and the string is removed from the task set. Algorithm 1 in Table 2 illustrates the filtering process in plaintext.

[0087] Table 2

[0088]

[0089]

[0090] Specific plan structure

[0091] (SK,SK1,SK2,PP,H0,H1)←Setup(k).

[0092] KGC first executes KeyGen to obtain the strong private key SK = λ and parameters N = pq, s = -a 2N (in is randomly selected, p and q are two large prime numbers). Then KGC executes SKeyS to split the strong private key λ, and obtains two partial strong private keys SK1=λ1,SK2=λ2. Select bilinear pairing parameter BP={G,G T ,e,p,g}, select two collision-resistant hash functions H0:{0,1} * →Z p , H1:{0,1} * →G. G and G T are two large prime p-order cyclic groups, g is the generator of the cyclic group G, e:G×G→G T is a bilinear map.

[0093] KGC sends the generated public parameters PP = (N, s, BP) to the user MDU and the data owner MDO. The partial strong private keys SK1 = λ1 and SK2 = λ2 are distributed to CP1 and CP2 respectively, and the strong private key λ is kept secret.

[0094] (pk MDU ,sk MDU ,pk MDO ,sk MDO ,pk m ,sk m )←KeyGen(SK,SK1,SK2,PP,EN i ,ENM).

[0095] After MDU and MDO obtain the public parameters PP = (N, s, BP), they execute KeyGen to generate their own key pair pk MDU ,sk MDU ,pk MDO ,sk MDO Set the common edge nodes to EN = {EN1, EN2, ..., EN i}, KGC will generate a key pair (pk m =g b ,sk m =b), ENM will output a polynomial f(x)=c of degree ξ-1 ξ-1 x ξ-1 +...+c1x+c0, here ENM selects i pairs of elements that satisfy the polynomial {(x1,y1),(x2,y2),...,(x i ,y i )},y1,...,y i Sent to ordinary edge node EN for signing.

[0096] (C m ,SCm ,τ)←Searchcp(D id ,W,W T ,pk MDO ).

[0097] Each document D id , corresponding to an id, associated with a keyword set W T . MDO first T Encrypt using the Enc algorithm to generate searchable ciphertext Assuming there are m documents, then m searchable ciphertexts will be generated in the end Simultaneously use the traditional symmetric key K∈G for m documents T Encrypted to get C m In order to verify the correctness of the search results, the data holder MDO will entrust EN to check the ciphertext C m Calculate the signature After calculating at least a threshold number of signatures (the relationship between the threshold ξ and the number of edge nodes i in EN is: i≤2ξ-1, assuming the threshold number is set to 10, the number of edge nodes in EN does not exceed 19, then the signatures are calculated at least 10 and at most 19), ENM combines all signatures into a unique threshold signature in, This shortens the signature length, which is then uploaded to CP1.

[0098] (TD m )←Trapdoor(W,W t ,pk MDU ).

[0099] MDU vs W t Use Enc to generate search traps. For m searchable ciphertexts, generate m corresponding search traps.

[0100] MDU will search for trapdoor TD through common edge nodes m Upload to CP1.

[0101] (0\1)←Filtering(SC m ,TD m ,pk MDU , pk MDO , SK1, SK2).

[0102] CP1 backs up the encrypted document, searchable ciphertext, search trapdoor, and signature to CP2. CP1 and CP2 interactively execute the subset decision mechanism and cross-domain secure computation protocol to calculate an encrypted value. The details are as follows:

[0103] Execute Algorithm 3 in the literature [5] (Wz A, Bqb C, Xd A, et al. Public-key Encryption with Bidirectional Keyword Search and Its Application to Encrypted Emails [J]. Computer Standards & Interfaces, 2021.), and CP1 and CP2 interactively perform operations on m groups of searchable ciphertexts and search trapdoors. The following takes the mth group of searchable ciphertexts and search trapdoors as an example to illustrate:

[0104] enter pk MDU ,pk MDO ,SK1=λ1,SK2=λ2,CP1 is calculated first Here, sum = 2 μ -1, μ represents the bit length of sum in binary form, CP1 and CP2 run the interactive SBD protocol and output the mth group (take the mth group of ciphertext for calculation)

[0105] Table 3

[0106]

[0107]

[0108] Then execute the filtering algorithm 2 in Table 3, input TD' m ,pk MDU , SK1, SK2, pk MDO , calculated using the SBD protocol Finally, we get two binary strings with all bits encrypted. In these two sets of strings, multiplying them using the SMD protocol yields Use SAD protocol to Each bit in is accumulated, and the result is recorded as Give the user a weak private key sk MDU Decryption yields f t , if f t =0, the user returns "need to filter", otherwise it returns "no need to filter".

[0109] (0\1)←Test(SC' m ,TD' m ,pk MDU , pk MDO , SK1, SK2).

[0110] Performing a search requires obtaining the public key pk MDU , pk MDO , CP1 and CP2 provide partial strong private keys λ1 and λ2 and searchable ciphertext SC' after algorithm filtering m and Trapdoor TD' m , CP1 and CP2 continue to execute the following algorithm to complete the remaining search:

[0111] CP1 and CP2 inputs pk MDU ,pk MDO ,SK1=λ1,SK2=λ2, execute subset decision mechanism calculation (SAD operation is performed on every two corresponding bits),

[0112] CP1 and CP2 will Multiply and get right Add random seed r m Get the encrypted value in The purpose of this step is to prevent users from inferring sensitive keyword information after decryption.

[0113] CP2 will encrypt the value Sent to user, user receives Then use the weak private key sk MDU Decryption. If the result output is 0, it means that the trapdoor does not match the searchable ciphertext; if the result output is 1, it means that the trapdoor does match the searchable ciphertext; when the trapdoor matches the searchable ciphertext, it means that the document corresponding to the searchable ciphertext is the desired search result, and the user applies to CP2 to obtain the relevant document.

[0114]

[0115] Use ε to represent search results The number of each result document Will be associated with one First, ENM randomly selects Send {γ,e γ} to CP2, CP2 calculates here CP2 sends the certification information (υ * , τ * ) to ENM. The search result is verified to be correct if the following equation is satisfied:

[0116]

[0117] After receiving the verified result document, the user uses the symmetric key K∈G T Decryption.

[0118] Table 4 shows the functional comparison of each scheme from the two aspects of performance and security. Among them, MDU and MDO represent multi-user and multi-data holder, LW represents lightweight, MK represents keyword, IKGA and OKGA represent internal and external keyword guessing attacks respectively. Reference [1] (L. Zhang, F. Jiang and X. Tang, "Verifiable Conjunctive Keyword Search with Certificateless Searchable," 2021IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2021, pp. 9-16, doi: 10.1109 / TrustCom53373.2021.00020.) is the earliest proposed public key searchable encryption scheme, which supports single-user data upload and multi-data holder query. Its searchable ciphertext and trapdoor size must increase with the number of keywords | W id|Linear growth. In terms of security, the literature [2] (Hwang, MS, Lee, CC and Hsu, ST, 2019. An ElGamal-like secure channel free public key encryption with keyword search scheme. International Journal of Foundations of Computer Science, 30 (02), pp. 255-273.) is based on a cryptographic system that satisfies both IKGA and OKGA. The literature [3] (B. Chen, L. Wu, S. Zeadally and D. He, "Dual-Server Public-Key Authenticated Encryption with Keyword Search," in IEEE Transactions on Cloud Computing, vol. 10, no. 1, pp. 322-333, 1 Jan.-March 2022, doi: 10.1109 / TCC.2019.2945714.) uses dual servers to resist IKGA and designs a bilinear pairing-free algorithm, which reduces the client overhead. Reference [5] (Wz A, Bqb C, Xd A, et al. Public-key Encryption with Bidirectional Keyword Search and Its Application to Encrypted Emails [J]. Computer Standards & Interfaces, 2021.) proposes a PEKS scheme that supports bidirectional keyword search, allowing data holders to retrieve uploaded data. Reference [4] (Liu, X., Yang, G., Susilo, W., Tonien, J., Liu, X. and Shen, J., 2020. Privacy-preserving multi-keyword searchable encryption for distributed systems. IEEE Transactions on Parallel and Distributed Systems, 32 (3), pp. 561-574.) meets most of the listed requirements, but the client does not have the function of verifying the search results.Reference [6] (Cao M, Wang L, Qin Z, et al. A Lightweight Fine-Grained Search Scheme over Encrypted Data in Cloud-Assisted Wireless Body Area Networks [J]. Wireless Communications and Mobile Computing, 2019.) supports lightweight and verifiability, but its searchable ciphertext length is limited to the number of attributes |A. i The VSE-EPOMFC of the present invention allows edge nodes to verify search results instead of clients, reducing client storage and computing overhead.

[0119] Table 4

[0120] MDU NDO LW MK OKGA IKGA Ciphertext size Trapdoor size Verifiable [1] × √ × × × × <![CDATA[O(|W id |)]]> O(|Q|) × [2] × × × × √ √ <![CDATA[O(|W id |)]]> O(|Wid|) × [3] × × √ × × √ <![CDATA[O(|W id |)]]> <![CDATA[O(|W id |)]]> × [4] √ √ × √ √ √ O(1) O(1) × [5] × × × × × × <![CDATA[O(|W id |)]]> <![CDATA[O(|W id |)]]> × [6] √ × √ × × × <![CDATA[O(|A i |)]]> <![CDATA[O(|A i |)]]> √ The present invention √ √ √ O(1) O(1) √ O(1) O(1) √

[0121] This paper primarily compares and analyzes the differences between the VSE-EPOMFC solution and other solutions in terms of client storage, computation, and search. The VSE-EPOMFC solution uses Python simulation, and the communication process uses socket programming to establish a reliable TCP connection. Two virtual machines were set up, with the KCG, CP1, and MDO deployed on a 2.90GHz, quad-core processor with 6GB of RAM, while the CP2 and MDU were deployed on a 2.90GHz, dual-core processor with 4GB of RAM. For comparison with the SE-EPOM solution, an 80-bit security level was used, and the parameter N was selected as 1024 bits long.

[0122] The experiment mainly selected two parameters. One is the proportion of tasks that do not match the task set at all (a complete mismatch in the search task means that all bits in the corresponding two binary strings do not match), which is represented by the matching degrees IV, III, II, and I. When the number of tasks that do not match the task set at all is 0, the matching degree is IV, indicating that there are no tasks that do not match the task set at all. When there are tasks in the task set at all, the matching degree is IV, indicating that there are no tasks that do not match the task set at all. The tasks in the task set are completely mismatched, and the matching degree is III; when there are The tasks in the task set are completely mismatched, and the matching degree is II; when there are The task is completely mismatched, and the matching degree is 1. Another parameter selects the number of keywords uploaded by the user, which are 5, 10, 15, and 20 respectively.

[0123] Figure 3The time overhead of performing searches for the three schemes under different matching conditions was compared. The PEBKS scheme performs searches in a single-server scenario, so its search time overhead is much smaller than that of schemes performing searches in a multi-server environment. SE-EPOM does not use a filtering algorithm and directly searches the task set. It can be seen that its time overhead fluctuates around 11 seconds and is not affected by changes in matching. However, the VSE-EPOMFC scheme of the present invention uses a filtering algorithm. Under matching conditions of IV and III, the filtering algorithm incurs more time overhead. When the matching degree is below II, the filtering algorithm can significantly reduce the time overhead of SE-EPOM.

[0124] Figure 4 and Figure 5 The verification time and storage overheads of the two schemes on the client side are compared. The VSE-EPOMFC scheme of the present invention delegates the signing and verification tasks of the client side to the edge node, so the overhead on the client side is independent of the number of keywords. The verification uses a threshold signature mechanism. Since the proxy edge node integrates all signatures, the signature length is shortened, and the verification time and storage overhead are also shortened. CP-ABKS (reference [6]) also supports search result verification, but requires the user to perform partial decryption and verification, which brings additional overhead to the client device. The LFGS scheme (reference [7], Y.Miao, et al., "Lightweight Fine-Grained Search Over Encrypted Data in FogComputing" in IEEE Transactions on Services Computing, vol. 12, no. 05, pp. 772-785, 2019. doi: 10.1109 / TSC.2018.2823309) can accurately verify search results, but it requires interaction between the user and the data holder, and when a large number of search results are returned, more communication overhead will be generated. In addition, the LFGS scheme can only support single keyword search and cannot be deployed in an MDU setting to perform search result verification. The search result verification mechanism used by the LGFS scheme mainly relies on the locally stored file-keyword hash table, such as Figure 6 As shown, when the locally stored file-keyword hash table is large, it will generate high computational overhead, and its computational complexity is O(|F||W|). However, the search result verification mechanism adopted by the VSE-EPOMFC of the present invention is related to the number of files, and its computational complexity is O(|F|).

[0125] The filtering algorithm saves time and requires that more than half of the tasks in the task set are not completely matched. It is more suitable for special scenarios. For example, in a certain medical system, the patient's privacy needs to be highly confidential. The doctor can only know his physical condition and the rest of the information is unknown. He can only use a small number of keywords to query the patient to obtain case information. In the current scenario, the patient, as the data holder, uploads encrypted case information and searchable ciphertext to the cloud center. The doctor, as the user, can use the edge device to sign and verify the correctness of the search results. The higher the confidentiality of the patient's privacy information, the greater the possibility that the doctor will search for completely unmatched tasks, and ultimately a large number of unmatched tasks will be generated. The VSE-EPOMFC solution of the present invention saves time for doctors and patients, so that they do not have to perform complex verification.

[0126] The present invention designs a lightweight searchable encryption method that is verifiable in a cloud-edge environment, explains its definition of the ideal reality model and the keyword privacy model and provides proof. Compared with previous work, the lightweight client has complex signature and verification overhead. By introducing edge nodes and using the cache of edge nodes, the traffic load on the backbone network is reduced. A filtering algorithm is designed to reduce the communication overhead caused by the search. Experiments show that the VSE-EPOMFC scheme of the present invention is suitable for situations where there are many tasks with incomplete matching of the task set. By comparing the differences between several schemes in offline keyword guessing attacks, multiple keywords, multiple users, multiple data holders, verifiability, etc., it is shown that VSE-EPOMFC has certain advantages in overall functionality, security, computing and storage overhead, etc.

Claims

1. A verifiable, lightweight, searchable encryption method in a cloud-edge-device environment, characterized by: The steps include: a. The key generation center generates and distributes public parameters to users and data holders, distributes parts of strong private keys to the first and second cloud servers, and generates key pairs for proxy edge nodes; b. The user and data holder generate their own key pairs based on public parameters. The data holder generates searchable ciphertext based on their public key and encrypts the document using the symmetric key. The user uses their public key to generate a search trapdoor corresponding to the searchable ciphertext. The user and data holder upload the search trapdoor, searchable ciphertext, and encrypted document to an edge node. Edge nodes include ordinary edge nodes and proxy edge nodes. c. The ordinary edge node first calculates at least a threshold number of signatures for the encrypted document, and then the proxy edge node integrates all the signatures; d. The ordinary edge node uploads the encrypted document, searchable ciphertext, search trapdoor, and integrated signature to the first cloud server; e. The first cloud server first backs up the encrypted document, searchable ciphertext, search trapdoor, and integrated signature to the second cloud server; Then, the first cloud server and the second cloud server interactively execute the subset decision mechanism and the cross-domain secure computing protocol to calculate an encrypted value; f. The second cloud server delivers the encrypted value calculated in step e to the user, who then determines based on the encrypted value whether the corresponding encrypted document is part of the final search results. If so, the user applies to the second cloud server for the encrypted document. g. After receiving the user's request to obtain the encrypted document, the second cloud server verifies the relevant encrypted document by interacting with the proxy edge node and deletes the malicious document added by the semi-trusted cloud server; h. The second cloud server sends the searched and verified encrypted document to the user; i. After receiving the encrypted document, the user uses the symmetric key to decrypt it.

2. The verifiable, lightweight, searchable encryption method in a cloud-edge-device environment according to claim 1 is characterized in that: In step a, the public parameters generated by the key generation center are PP = (N, s, BP), where N and s are the parameters obtained by the key generation center through the KeyGen operation, BP is the bilinear pairing parameter, and BP = {G, G T ,e,p,g}, G and G T are two large prime p-order cyclic groups, g is the generator of the cyclic group G, e:G×G→G T is a bilinear map; The key generation center generates a key pair (pk m =g b ,sk m =b); In step c, the proxy edge node first outputs a polynomial f(x)=c ξ-1 x ξ-1 +...+c1x+c0, where c0=b,i≤2ξ-1; ξ is the threshold, i is the number of ordinary edge nodes; the proxy edge node selects i pairs of elements {(x1,y1),(x2,y2),...,(x i ,y i )}, and replace y1,...,y i Sent to common edge nodes for signing; Ordinary edge nodes calculate signatures for encrypted documents as follows: Among them, H0 and H1 are two collision-resistant hash functions, H0:{0,1} * →Z p , H1:{0,1} * →G;C m To encrypt documents; The proxy edge node integrates all signatures as follows: in, 3. The verifiable, lightweight, searchable encryption method in a cloud-edge-device environment according to claim 2 is characterized in that: In step e, the first cloud server and the second cloud server interactively execute the subset decision mechanism and the cross-domain secure computing protocol to calculate an encrypted value, as follows: e-1. There are m encrypted documents and corresponding m searchable ciphertexts. and m search trapdoors T and t are the decimal forms of searchable ciphertext and search trapdoor respectively; e-2. First, interactively operate on the first set of searchable ciphertext and search trapdoor, input pk MDO , pk MDU ,λ1,λ2,where,pk MDO and pk MDU are the public keys of the data holder and the user respectively; λ1 and λ2 are the partial strong private keys generated by the key generation center; First cloud server first calculates The inverse code Where sum = 2 μ -1, μ represents the bit length of the binary form of sum; the first and second cloud servers run the interactive SBD protocol and output the first group: T i and t i They are the binary form of searchable ciphertext and the binary form of search trapdoor respectively; e-3. Input TD' m , pk MDO , pk MDU ,λ1,λ2, calculated using the SBD protocol Finally, we get two binary strings with all bits encrypted. In these two sets of binary strings, multiplication using the SMD protocol yields Use SAD protocol to Each bit in is accumulated, and the result is recorded as Will Give the user a weak private key sk MDU Decryption yields f t , if f t =0, the user returns "need to filter", otherwise it returns "no need to filter", and executes step e-4; e-4. Input from the first cloud server and the second cloud server pk MDO , pk MDU ,λ1,λ2, perform subset decision mechanism calculation e-5, the first cloud server and the second cloud server will Multiply and get right Add random seed r 1 Get the encrypted value in e-6. Repeat steps e-2 to e-5 until the calculation of m groups of data is completed.

4. The verifiable, lightweight, searchable encryption method in a cloud-edge-device environment according to claim 3 is characterized in that: In step f, the user determines whether the corresponding encrypted document belongs to the final search result based on the encrypted value. Specifically, after receiving the encrypted value, the user uses the weak private key sk MDU Decryption: If the output is 0, it means that the search trapdoor does not match the searchable ciphertext, and the corresponding encrypted document is not the final search result; if the output is 1, it means that the search trapdoor does match the searchable ciphertext, and the corresponding encrypted document belongs to the final search result.

5. The verifiable lightweight searchable encryption method in a cloud-edge-device environment according to claim 4 is characterized in that: In step g, ε is used to represent the search results The number of each result document Will be associated with one Random selection of proxy edge nodes Send {γ,e γ } to the second cloud server, which calculates in The second cloud server sends the certification information (υ * , τ * ) to the proxy edge node; the proxy edge node verifies whether the following formula holds: If the verification equation is established, it means that the document verification has passed; otherwise, it means that the document verification has failed.

Images