Dynamic searchable encryption method, decryption method, encryption device and decryption device
By constructing a hash function index structure and homomorphic encryption, the problem of not being able to simultaneously achieve data deduplication and join keyword search in existing technologies is solved. This achieves secure, dynamically searchable encryption, satisfies both forward and backward security, and protects user privacy.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-12-23
- Publication Date
- 2026-03-17
AI Technical Summary
Existing dynamic searchable encryption schemes cannot simultaneously achieve data deduplication and keyword search functionality, and they also have forward and backward security issues.
A bidirectional index structure is constructed using a hash function, combined with homomorphic encryption and keyed pseudo-random functions, to achieve data deduplication and join keyword search while satisfying both forward and backward security.
It achieves data deduplication and keyword search without information leakage during dynamic updates, satisfies forward and backward security, and protects user privacy.
Smart Images
Figure CN116418513B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of information security technology and relates to a dynamic searchable encryption scheme that satisfies both forward and backward security. More specifically, it relates to a dynamic searchable encryption method, decryption method, encryption device, and decryption device that supports data deduplication for connection keywords. Background Technology
[0002] With the increasing prevalence of cloud computing, the demand for cloud storage is growing exponentially. Depending on user needs, cloud services can be developed for various sectors such as industry, healthcare, and transportation. Cloud computing enables users to enjoy high-quality services and ubiquitous network access; however, while enjoying the flexibility and convenience of cloud storage, outsourcing data to cloud servers also leads to data privacy issues. To protect user data privacy, plaintext is usually encrypted before being outsourced to cloud servers; however, the encryption process destroys the natural structure of the data and makes it impossible to query encrypted data.
[0003] Searchable symmetric encryption (SSE) solves the problem of searchable encrypted data. It allows data to be encrypted privately and stored outsourced to a server, while maintaining the ability to selectively search the encrypted data, eliminating the barrier of needing to decrypt the data before processing. Early searchable symmetric encryption was designed for static scenarios, only allowing clients to query the database, not to update the outsourced database, such as adding or deleting data.
[0004] Dynamic Searchable Symmetric Encryption (DSSE) addresses the problem of users querying and updating outsourced databases. DSSE allows one party to add or delete encrypted data stored on another's database. This allows an adversary to observe database behavior during updates, potentially revealing database contents and information about the search queries and keywords involved. To address this leakage, two new security concepts, forward privacy and backward privacy, have been proposed. Simply put, for any attacker who might continuously observe the interaction between the server and client, forward privacy is satisfied if adding a new file does not reveal any information about previously queried keywords; backward privacy is satisfied if previously added and subsequently deleted files do not reveal much information within any timeframe of two search queries for the same keyword.
[0005] Message-based encryption (MLE) can solve the problem of data deduplication and achieve secure deduplication. However, MLE-based deduplication is vulnerable to brute-force attacks and generates a large number of keys during file encryption, leading to key management problems. To address the convergence key management issue, Li et al. proposed a new data deduplication scheme that distributes keys using a multi-server approach. Stanek et al. proposed an encryption scheme that supports data deduplication, dividing all data into popular and non-popular data, and providing different levels of security for each.
[0006] To address the problem of join keyword search, Cash et al. proposed the oblivious crosstags (OXT) protocol to design an efficient SSE scheme, supporting join keyword search in a single-author reading framework. While the OXT protocol provides high performance through many specialized data structures, it exposes "partial" database information to the server, and the scheme requires three rounds of interaction, increasing communication overhead. In 2018, Lai et al. proposed a new SSE protocol called hidden cross tags (HXT), which eliminates the leakage of the "keyword pair result pattern" (KPRP) in join keyword search. In 2019, Wu et al. proposed a scheme to store index elements in a virtual binary tree (VBTree) structure in a top-down manner, without storing any branches or tree nodes. This tree exists only in the logical view, and all elements are actually stored in a hash table; however, the scheme only achieves forward safety. In 2020, Zuo et al. proposed an extended bitmap index structure that implemented join key queries more efficiently than VBTree and proved forward and backward security. In 2021, Patranabis et al. proposed oblivious dynamic cross tags (ODXT). ODXT provides a realistic trade-off between performance and security by effectively supporting fast updates and join key searches on large databases, while only causing a modest exposure of access patterns to the server, based on existing forward and backward privacy concepts.
[0007] To achieve dynamic searchability of join keywords, Du Ruizhong et al. proposed a forward- and backward-secure, efficient encryption scheme for dynamically searchable join keywords. This scheme utilizes a bitmap index to construct a bidirectional index structure to simplify the dynamic update process and achieves both forward and backward security through symmetric encryption with additive homomorphic properties to hide the access mode. Furthermore, the scheme introduces an inner product matching algorithm to achieve efficient join keyword lookup.
[0008] In summary, although existing technologies have proposed many dynamic searchable encryption schemes that can satisfy both forward and backward security, these schemes only consider data deduplication or join keyword search functions and cannot simultaneously achieve both data deduplication and join keyword search. Summary of the Invention
[0009] Purpose of the Invention: The purpose of this invention is to address the shortcomings of dynamically searchable encryption methods that satisfy both forward and backward security as pointed out in the background art, and to propose a dynamically searchable encryption method, decryption method, encryption device, and decryption device that supports data deduplication. This data encryption scheme can simultaneously achieve data deduplication and connection keyword search functions while ensuring dynamic searchability security.
[0010] Technical solution: The first aspect of this invention provides a dynamically searchable encryption method, comprising the following steps:
[0011] (1) Set the system public parameters params and state σ; where,
[0012] params is H1, H2, H3, H4, and H5 are five collision-resistant hash functions;<h1>
[0013] σ is (n w ,n f CT w CT f ,SK=(K,ck),FS),n w =2 l n f =2 μ l represents the maximum number of files, μ represents the maximum number of keywords; CT f CT is an empty mapping used to store the current file search token. w This is an empty mapping used to store the current keyword search token; K is the key, ck is the key for the cryptographic convergence key; FS is the deduplication tag set;
[0014] (2) Generate a deduplication verification tag η based on the file f that needs to be updated. f ;
[0015] (3) Based on the deduplication verification tag η f Retrieve the deduplicated tag set FS, if η f If the file does not exist in FS, return "not found"; otherwise, return "exists". If you want to upload a file, continue the update operation if the result is "not found"; if you want to delete a file, continue the update operation if the result is "exists".
[0016] (4) Based on the publicly available system parameters params, the keyword w to be updated, and the file f to be updated, encrypt the keyword index bsw, the file index bsf, and the file f to obtain the encrypted keyword index ew, the encrypted file index ef, and the encrypted file identifier. and the encrypted file c;
[0017] (5) For state σ, based on the encrypted database EDB, encrypted keyword index ew, encrypted file index ef, and encrypted file identifier... Given the ciphertext c of the file, we obtain the updated state σ′ and the updated encrypted database EDB′;
[0018] (6) For state σ, based on the system's publicly available parameters params, the encrypted database EDB, and the connection key to be searched, q = w1∧w2∧…∧w k The search yields all encrypted keyword indices ew, which are then homomorphically added to obtain the final encrypted keyword index, Sum. ew ;
[0019] (7) For state σ, the final result Sum is indexed according to the encryption key. ew Get all encrypted file identifier keys Current file search token (STF) cf and its counter cf, and for query index bs q Encryption is performed to obtain the encrypted query index eq;
[0020] (8) For state σ, based on the system's publicly available parameter params, all encrypted file identifier keys Current file search token (STF) cf The indexes of all encrypted files, including their counters (cf), are obtained by homomorphically adding them together to obtain the final encrypted file index, Sum. ef This is then matched with the encrypted query index eq to obtain the ciphertext c of all files that match the join keyword query.
[0021] Furthermore, in step (1), the hash function selected is MD-5, SHA-1, SHA-2 or SHA-3.
[0022] Furthermore, in step (2), the deduplication verification tag η of file f f Generated by H2.
[0023] Further, step (4) includes:
[0024] (401) Calculate the file convergence key K f =H1(f), using the key ck of the encryption convergence key to pair K fEncryption is performed to obtain the encrypted file identifier. Use again Encrypt file f to obtain ciphertext file c;
[0025] (402) Through a keyed pseudo-random function F with key K K Generate K′ w and
[0026] (403) Calculate the one-time key private key skw cw+1 =H5(K′) w (cw+1) and one-time file private key skf cf+1 =H5(K′) f ,cf+1);
[0027] (404) Calculate the encrypted key index ew cw+1 =skw cw+1 +bsw cw+1 modn w Encrypted file index ef cf+1 =skf cf+1 +bsf cf+1 modn f bsw cw+1 For the (cw+1)th key index, bsf cf+1 This is the index for the (cf+1)th file.
[0028] Further, step (5) includes:
[0029] (501) Through a keyed pseudo-random function F with key K K Generate K w and
[0030] (502) Based on the keyword w and encrypted file identifier that need to be updated in step (4) Retrieve the empty mapping CT of the current keyword search token w The empty mapping CT of the current file search token f Get the current keyword search token STW cw Its counter cw and current file search token STF cf Its counter cf is used to check if it is empty. If it is empty, then cw←-1, STW. cw ←{0,1} λ cf←-1, STF cf ←{0,1} λ After the judgment ends, continue to execute step (503);
[0031] (503) Execute STWcw+1 ←{0,1} λ STF cf+1 ←{0,1} λ , will (STW cw+1 Store to CT (cw+1) w (STF) cf+1 Store (cf+1) to CT f ;
[0032] (504) Calculate the key update token UW cw+1 =H3(K w STW cw+1 ) and file update token Blocking previous keyword search tokens And the previous file search token
[0033] (505) The step (4) The information is sent to the database server; the database server updates the status and encrypts the database based on the received information.
[0034] Further, step (6) includes:
[0035] (601) Search query q=w1∧w2∧…∧w k The keyword with the lowest frequency in the middle;
[0036] (602) Through a keyed pseudo-random function F with key K K Generate K w ;
[0037] (603) Retrieve the current keyword search token mapping CT w Get the current keyword search token STW cw Its counter cw is checked to see if it is empty; if it is empty, return. If not empty, proceed to step (604);
[0038] (604) Send (K) w STW cw (,cw) to the database server;
[0039] (605) The database server executes step (606) repeatedly from counter position cw to position 0;
[0040] (606) Calculate UW i =H3(K w STW i Retrieve all encrypted keyword indexes ew corresponding to keyword w. i ;
[0041] (607) Obtain the final result Sum of the encrypted key index through homomorphic addition. ew .
[0042] Further, step (7) includes:
[0043] (701) Repeat step (702) from counter position cw to position 0;
[0044] (702) Calculate skw i =H5(K′) w (i) Perform modular addition on each calculated skw to obtain the sum of the one-time key private key, Sum. skw , where K′ w It is achieved through a keyed pseudo-random function F with key K. K Generated;
[0045] (703) After the loop ends, calculate bs w =Sum ew -Sum skw modn w , obtain the keyword index bs w ;
[0046] (704) Keyword Index bs w Convert to encrypted file identifier
[0047] (705) Through a keyed pseudo-random function F with key K K For each generate
[0048] (706) for each Retrieve current file search token mapping CT f Obtain the current file search token (STF). cf and its counter cf, Store to Map middle;
[0049] (707) Encrypt the query index eq = K + bs using key K. q modn f ;
[0050] (708) Send (eq,File) to the database server.
[0051] Further, step (8) includes:
[0052] (801) For File, the database server executes steps (802) to (803) repeatedly from the counter position cf to position 0;
[0053] (802) Calculation Based on each calculated UF, retrieve all encrypted file indexes ef, and obtain the final encrypted file index Sum by homomorphic addition. ef ;
[0054] (803) Using Sum ef Perform an XOR operation with the encrypted query index eq. If the result is 0, the match is successful. Then, use the encrypted file identifier of the successful match. Retrieve the corresponding encrypted file c;
[0055] (804) After the loop ends, all matching encrypted file identifiers are obtained. And its corresponding encrypted file c.
[0056] The second aspect of this invention provides a dynamically searchable decryption method, which, based on the state σ and the encrypted file identifier in the dynamically searchable encryption method described in the first aspect, The encrypted file c is decrypted to obtain file f, which includes:
[0057] Based on all matching encrypted file identifiers And its corresponding ciphertext c, using the key ck of the encryption convergence key. Decryption yields the file convergence key K f ; Use K f Decrypt the ciphertext file c to obtain the plaintext file f.
[0058] A third aspect of the present invention provides a dynamically searchable encryption device, including a module for performing the encryption method of the first aspect. The encryption device includes:
[0059] The system parameter setting module is used to return the system's public parameters `params`, status `σ`, and encrypted database `EDB` based on the input security parameter `λ`; `params` is... H1, H2, H3, H4, and H5 are five collision-resistant hash functions; σ is (n<h1> w ,n f CT w CT f ,SK=(K,ck),FS),n w =2l,n f =2 μ l represents the maximum number of files, μ represents the maximum number of keywords; CT f CT is an empty mapping used to store the current file search token. wThis is an empty mapping used to store the current keyword search token; K is the key, ck is the key for the cryptographic convergence key; FS is the deduplication tag set;
[0060] The deduplication verification tag generation module is used to take the file f to be updated as input and generate deduplication verification tags η. f ;
[0061] The deduplication module is used to verify the deduplication of the tag η. f Retrieve the deduplicated tag set FS, if η f If the file does not exist in FS, return "not found"; otherwise, return "exists". If you want to upload a file, continue the update operation if the result is "not found"; if you want to delete a file, continue the update operation if the result is "exists".
[0062] The encryption module is used to take into account a one-time keyword private key skw, a one-time file private key skf, and the encryption convergence key ck, and to index the keyword bs respectively. w File index bs f Encrypt the file f to obtain the encryption key index ew, the encrypted file index ef, and the encrypted file identifier. and the encrypted file c;
[0063] The update module is used to update the encrypted database EDB based on the state σ, the keyword w to be updated, and the file f to be updated, so as to obtain the updated state σ′ and the updated encrypted database EDB′.
[0064] The search module is used to search for the connection keyword q = w1∧w2∧…∧w based on the state σ and the connection keyword to be searched. k The encrypted database EDB is searched to obtain the encrypted keyword index ew; and,
[0065] The result matching module retrieves all encrypted file indexes ef based on the encrypted keyword index ew, matches them with the encrypted query index eq, and obtains all encrypted file identifiers. and its encrypted file c.
[0066] A fourth aspect of the present invention provides a dynamically searchable decryption apparatus, including a module for performing the decryption method of the second aspect. The decryption apparatus includes:
[0067] The decryption module is used to decrypt all encrypted file identifiers based on the key ck of the encryption convergence key. The ciphertext c of the file is decrypted to obtain the plaintext file f.
[0068] The fifth aspect of the present invention provides a computer-readable medium storing instructions that, when executed by a processor, implement the encryption method described in the first aspect.
[0069] The sixth aspect of the present invention provides a computer-readable medium storing instructions that, when executed by a processor, implement the decryption method described in the second aspect.
[0070] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:
[0071] The dynamic searchable encryption method provided by this invention, through convergent encryption technology and the introduction of homomorphic comparison, can simultaneously achieve data deduplication and keyword search functions. Furthermore, the dynamic searchable encryption method of this invention possesses forward and backward security; during updates, it does not disclose information about newly inserted files matching previous search queries; and during two queries for the same keyword, it does not disclose information about files that were previously added and subsequently deleted. Attached Figure Description
[0072] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0073] Figure 1 This is a flowchart of the encryption and decryption methods in the embodiments of this application;
[0074] Figure 2 This is a schematic diagram of the encryption and decryption devices in the embodiments of this application;
[0075] Figure 3 This is a schematic diagram of the user status of the encryption / decryption system in this application embodiment;
[0076] Figure 4 This is a schematic diagram illustrating the interaction between the data user and the database server in an embodiment of this application. Detailed Implementation
[0077] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.
[0078] Figure 1 The diagram shown is a flowchart of dynamically searchable encryption and decryption methods.
[0079] Dynamically searchable encryption methods include the following steps:
[0080] (1) Set the system public parameters params and state σ; where,
[0081] params is H1, H2, H3, H4 and H5 are five collision-resistant hash functions; the hash functions selected are MD-5, SHA-1, SHA-2 or SHA-3.<h1>
[0082] σ is (n w ,n f CT w CT f ,SK=(K,ck),FS),n w =2 l n f =2 μ l represents the maximum number of files, μ represents the maximum number of keywords; CT f CT is an empty mapping used to store the current file search token. w K is an empty mapping used to store the current keyword search token; K is the key, ck is the key for the cryptographic convergence key; FS is the deduplication tag set.
[0083] (2) Generate a deduplication verification tag η based on the file f that needs to be updated. f Specifically, the deduplication verification tag η of file f. f Generated using the hash function H2.
[0084] (3) The database server verifies the deduplication tag η f Retrieve the deduplicated tag set FS, if η f If it does not exist in FS, return "not found"; otherwise, return "exists".
[0085] After receiving the judgment result, if the data owner wants to upload a file, the update operation will continue if the judgment result indicates that the file does not exist; if the data owner wants to delete a file, the update operation will continue if the judgment result indicates that the file already exists.
[0086] (4) Based on the publicly available system parameters params, the keyword w to be updated, and the file f to be updated, encrypt the keyword index bsw, the file index bsf, and the file f to obtain the encrypted keyword index ew, the encrypted file index ef, and the encrypted file identifier. and the encrypted file c; step (4) specifically includes:
[0087] (401) The encryptor calculates the file convergence key K. f =H1(f), using the key ck of the encryption convergence key to pair K f Encryption is performed to obtain the encrypted file identifier. Use again Encrypt file f to obtain ciphertext file c;
[0088] (402) Through a keyed pseudo-random function F with key K K Generate K′ w and
[0089] (403) Calculate the one-time key private key skw cw+1 =H5(K′) w (cw+1) and one-time file private key skf cf+1 =H5(K′) f ,cf+1);
[0090] (404) Calculate the encrypted key index ew cw+1 =skw cw+1 +bsw cw+1 modn w Encrypted file index ef cf+1 =skf cf+1 +bsf cf+1 modn f bsw cw+1 For the (cw+1)th key index, bsf cf+1 This is the index for the (cf+1)th file.
[0091] (5) For state σ, based on the encrypted database EDB, encrypted keyword index ew, encrypted file index ef, and encrypted file identifier... From the encrypted file c, we obtain the updated state σ′ and the updated encrypted database EDB′; step (5) specifically includes:
[0092] (501) The data owner uses a keyed pseudo-random function F with key K. K Generate K w and
[0093] (502) Based on the keyword w and encrypted file identifier that need to be updated in step (4) Retrieve the empty mapping CT of the current keyword search token w The empty mapping CT of the current file search token f Get the current keyword search token STW cw Its counter cw and current file search token STF cf Its counter cf is used to check if it is empty. If it is empty, then cw←-1, STW. cw ←{0,1} λ cf←-1, STF cf ←{0,1} λAfter the judgment ends, continue to execute step (503);
[0094] (503) Execute STW cw+1 ←{0,1} λ STF cf+1 ←{0,1} λ ,
[0095] (STW) cw+1 Store to CT (cw+1) w (STF) cf+1 Store (cf+1) to CT f ;
[0096] (504) Calculate the key update token UW cw+1 =H3(K w STW cw+1 ) and file update token Blocking previous keyword search tokens And the previous file search token
[0097] (505) The step (4) The information is sent to the database server; the database server updates the status and encrypts the database based on the received information.
[0098] The database server updates the status and encrypts the database based on information sent by the data owner.
[0099] (6) For state σ, based on the system's publicly available parameters params, the encrypted database EDB, and the connection key to be searched, q = w1∧w2∧…∧w k The search yields all encrypted keyword indices ew, which are then homomorphically added to obtain the final encrypted keyword index, Sum. ew Step (6) specifically includes:
[0100] (601) User search query q=w1∧w2∧…∧w k The keyword with the lowest frequency in the middle;
[0101] (602) Through a keyed pseudo-random function F with key K K Generate K w ;
[0102] (603) Retrieve the current keyword search token mapping CT w Get the current keyword search token STW cw Its counter cw is checked to see if it is empty; if it is empty, return. If not empty, proceed to step (604);
[0103] (604) Send (K) w STW cw (,cw) to the database server;
[0104] (605) The database server executes step (606) repeatedly from counter position cw to position 0;
[0105] (606) Calculate UW i =H3(K w STW i Retrieve all encrypted keyword indexes ew corresponding to keyword w. i ;
[0106] (607) Obtain the final result Sum of the encrypted key index through homomorphic addition. ew The results will then be returned to the user.
[0107] (7) For state σ, the final result Sum is indexed according to the encryption key. ew Get all encrypted file identifier keys Current file search token (STF) cf and its counter cf, and for query index bs q Encryption is performed to obtain the encrypted query index eq; step (7) specifically includes:
[0108] (701) The user executes step (702) repeatedly from counter position cw to position 0;
[0109] (702) Calculate skw i =H5(K′) w (i) Perform modular addition on each calculated skw to obtain the sum of the one-time key private key, Sum. skw , where K′ w It is achieved through a keyed pseudo-random function F with key K. K Generated;
[0110] (703) After the loop ends, the user calculates bs. w =Sum ew -Sum skw modn w , obtain the keyword index bs w ;
[0111] (704) Keyword Index bs w Convert to encrypted file identifier
[0112] (705) Through a keyed pseudo-random function F with key K KFor each generate
[0113] (706) for each Retrieve current file search token mapping CT f Obtain the current file search token (STF). cf and its counter cf, Store to Map middle;
[0114] (707) Encrypt the query index eq = K + bs using key K. q modn f ;
[0115] (708) Send (eq,File) to the database server.
[0116] (8) For state σ, based on the system's publicly available parameter params, all encrypted file identifier keys Current file search token (STF) cf The indexes of all encrypted files, including their counters (cf), are obtained by homomorphically adding them together to obtain the final encrypted file index, Sum. ef This is then matched against the encrypted query index eq to obtain all file ciphertexts c that match the join keyword query. Step (8) specifically includes:
[0117] (801) For File, the database server executes steps (802) to (803) repeatedly from the counter position cf to position 0;
[0118] (802) Calculation Based on each calculated UF, retrieve all encrypted file indexes ef, and obtain the final encrypted file index Sum by homomorphic addition. ef ;
[0119] (803) Using Sum ef Perform an XOR operation with the encrypted query index eq. If the result is 0, the match is successful. Then, use the encrypted file identifier of the successful match. Retrieve the corresponding encrypted file c;
[0120] (804) After the loop ends, all matching encrypted file identifiers are obtained. And its corresponding encrypted file c.
[0121] Dynamically searchable decryption methods, based on the state σ and encrypted file identifier in the dynamically searchable encryption method. The encrypted file c is decrypted to obtain file f, which includes:
[0122] Based on all matching encrypted file identifiers And its corresponding ciphertext c, using the key ck of the encryption convergence key. Decryption yields the file convergence key K f ; Use K f Decrypt the ciphertext file c to obtain the plaintext file f.
[0123] The combination of the aforementioned dynamic searchable encryption and decryption methods constitutes a complete data encryption and decryption protection scheme.
[0124] Figure 2 The diagram shows the structure of a dynamically searchable encryption device and a decryption device. The dynamically searchable encryption device includes a functional module that executes the dynamically searchable encryption method described in the embodiments of this application, and the dynamically searchable decryption device includes a functional module that executes the dynamically searchable decryption method described in the embodiments of this application. Specifically,
[0125] Dynamically searchable encryption devices include:
[0126] The system parameter setting module is used to return the system's public parameters `params`, status `σ`, and encrypted database `EDB` based on the input security parameter `λ`; `params` is... H1, H2, H3, H4, and H5 are five collision-resistant hash functions; σ is (n<h1> w ,n f CT w CT f ,SK=(K,ck),FS),n w =2 l n f =2 μ l represents the maximum number of files, μ represents the maximum number of keywords; CT f CT is an empty mapping used to store the current file search token. w This is an empty mapping used to store the current keyword search token; K is the key, ck is the key for the cryptographic convergence key; FS is the deduplication tag set;
[0127] The deduplication verification tag generation module is used to take the file f to be updated as input and generate deduplication verification tags η. f ;
[0128] The deduplication module is used to verify the deduplication of the tag η. f Retrieve the deduplicated tag set FS, if η f If the file does not exist in FS, return "not found"; otherwise, return "exists". If you want to upload a file, continue the update operation if the result is "not found"; if you want to delete a file, continue the update operation if the result is "exists".
[0129] The encryption module requires the encryptor to input a one-time key private key skw, a one-time file private key skf, and the encryption convergence key ck, which are then used to index the key bs. w File index bs f Encrypt the file f to obtain the encryption key index ew, the encrypted file index ef, and the encrypted file identifier. and the encrypted file c;
[0130] The update module updates the encrypted database EDB based on the state σ, the keyword w to be updated by the data owner, and the file f to be updated, resulting in the updated state σ′ and the updated encrypted database EDB′.
[0131] The search module, based on the state σ and the connection keyword q = w1∧w2∧…∧w, uses the database server to perform the search based on the state σ and the connection keyword q = w1∧w2∧…∧w. k The encrypted database EDB is searched to obtain the encrypted keyword index ew; and,
[0132] The result matching module retrieves all encrypted file indexes ef based on the encrypted keyword index ew, and matches them with the encrypted query index eq to obtain all encrypted file identifiers. and its encrypted file c.
[0133] Dynamically searchable decryption devices include:
[0134] The decryption module allows the decryptor to use the key ck of the encryption convergence key to decrypt all encrypted file identifiers. The ciphertext c of the file is decrypted to obtain the plaintext file f.
[0135] The aforementioned dynamic searchable encryption and decryption devices constitute a complete modular encryption and decryption system. This modular encryption and decryption system is a virtual system, and the following describes the physical encryption and decryption system.
[0136] Combination Figure 3 The encryption and decryption system includes a database server and a key distribution center. The database server is responsible for storing the encrypted database and retrieving the information that users want. The key distribution center is responsible for generating the system's public parameters and keys, and distributing the system's public parameters and keys to data owners and data users.
[0137] Data owners use publicly available system parameters and keys to upload encrypted databases and encrypted indexes to the database server;
[0138] Data users can use publicly available system parameters and keys to query the information they want in the database server.
[0139] The following combination Figure 4The interaction process between data users and database servers is described in detail.
[0140] Data users select the connection keyword q = w1∧w2∧…∧w based on the publicly available system parameters params and status σ. k Find the keyword w with the lowest frequency and obtain its keyword key K. w Current keyword search token STW cw and its counter cw, will (K w STW cw (,cw) is sent to the database server;
[0141] Database server according to (K) w STW cw ,cw) retrieves all encrypted keyword indexes Sum ew Return it to the data user;
[0142] Data users index Sum based on all encrypted keywords ew Decryption yields the keyword index ew, which in turn provides the identifiers for all encrypted files. According to all Obtain its file key Current file search token (STF) cf and its counter cf, to all Stored in the mapped File, the query index is encrypted to obtain the encrypted query index eq, and (eq,File) is sent to the database server;
[0143] After receiving the data, the database server retrieves and matches the results, returning them to the user.
[0144] The following provides an example of the application of the dynamic searchable encryption and decryption method and encryption and decryption system described above in cloud computing.
[0145] When a data owner wants to update public cloud data, the key distribution center sends the system's public parameters params and the key SK to the data owner. The data owner uses a collision-resistant hash function H2 to generate a deduplication verification tag to determine whether the file already exists. The data owner then uses four collision-resistant hash functions to generate an update token, a ciphertext masking the previous token, a one-time private key, and the file ciphertext. The one-time private key is used to encrypt the index, and the update token, the ciphertext masking the previous token, the encrypted index, the encrypted file identifier, and the file ciphertext are updated to the cloud database.
[0146] When a data user wants to query public cloud data, the key distribution center sends the system's public parameters `params` and the key `SK` to the data user. The data user selects the keyword with the lowest frequency among the connection keywords, obtains its keyword key, and sends the current keyword search token and its counter to the cloud server. The cloud server retrieves all encrypted keyword indexes and returns them to the data user. The data user decrypts the keyword index to obtain all encrypted file identifiers, obtains their file keys, stores the current file search token and its counter in the mapped `File`, encrypts the query index, and sends them to the cloud server. After receiving the query, the cloud server retrieves and matches the results and returns them to the data user. The user then decrypts the results to obtain the plaintext file.
[0147] This invention protects user privacy by employing convergent encryption and homomorphic comparison techniques, thus preventing information leakage during data deduplication and keyword search. Furthermore, by using a collision-resistant hash function to generate update tokens, masking the ciphertext of previous tokens and one-time private keys, and hiding access patterns through symmetric encryption with additive homomorphic properties, this invention achieves dynamic searchable forward and backward security.
[0148] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method of dynamically searchable encryption, characterized in that, Comprising the steps of: (1) Set the system disclosure parameters and status ; wherein, are , , , , and are five anti-collision hash functions; For , , , represents the maximum number of files, represents the maximum number of keywords; is an empty map for storing the current file search token, is an empty map for storing the current keyword search token; is a key, is a key that encrypts the convergent key; is a set of deduplication tags; (2) According to the file to be updated , generate a deduplication verification tag ; (3) Verify the deduplication label Retrieve deduplication tag set ,like Does not exist If the result is negative, return "does not exist"; otherwise, return "exists". If you want to upload a file, continue with the update operation if the result is negative. If you want to delete a file, continue with the update operation if the result is negative. (4) according to the system disclosure parameters , the keyword to be updated and the file to be updated , the keyword index to be updated , the file index to be updated and the file , the encrypted keyword index , the encrypted file index , the encrypted file identifier and the file ciphertext ; (5) For the state , according to the encrypted database , the encrypted keyword index , the encrypted file index , the encrypted file identifier and the file ciphertext , get the updated state and the updated encrypted database ; (6) For the state , according to the system disclosure parameters , encryption database and the connection keyword to be searched , search for all encrypted keyword indexes , get the final result of the encrypted keyword index by homomorphic addition ; (7) for the state , according to the encrypted key index final result , get all encrypted file identifier keys , the current file search token And its counter , and encrypt the query index , get the encrypted query index ; (8) For the state , according to the system disclosure parameter , all encrypted file identifier keys , the current file search token And its counter , get all encrypted file indexes , get the encrypted file index final result By homomorphic addition, match it with the encrypted query index , get all file ciphertexts that meet the connection keyword query .
2. The dynamic searchable encryption method of claim 1, wherein, In step (2), the file de-duplication verification tag is generated by .
3. The dynamic searchable encryption method of claim 1, wherein, Step (4) comprises: (401) computing the file convergence key with the key of the encrypted convergence key ; (402) generating by a keyed pseudo-random function , with a key and ; (403) computing a one-time key private key and a one-time file private key ; (404) computing encrypted key index , encrypted file index , for the first key index, for the first file index.
4. The dynamic searchable encryption method of claim 3, wherein, Step (5) comprises: (501) generating by a keyed pseudo-random function with key and ; (502) According to the keyword to be updated in step (4) and the encrypted file identifier , retrieve the empty map of the current keyword search token and the empty map of the current file search token , get the current keyword search token and its counter and the current file search token and its counter , determine whether it is empty, if it is empty, then , , , ; after the end of the judgment, continue to execute step (503); (503) perform , , store to store to , store to ; (504) computing a key update token and a file update token , masking a previous key search token and a previous file search token ; (505) sending the information received in step (4) to a database server; the database server updating the status and encryption database according to the received information. , server; the database server updating the status and encryption database according to the received information.
5. The dynamic searchable encryption method of claim 4, wherein, Step (6) comprises: (601) search query mid-frequency lowest keyword ; (602) generating by a keyed pseudo-random function with a key ; (603) retrieve current keyword search token mapping , get current keyword search token and its counter , determine if empty, if empty, return ; if not empty, perform step (604) (604) sending to the database server; (605) The database server sends a message to the counter location Step (606) is performed in a loop until position 0. (606) computing , retrieving all encrypted keyword indices corresponding to the keyword ; and ; (607) The encrypted key index final result is obtained by homomorphic addition .
6. The dynamic searchable encryption method of claim 5, wherein, Step (7) comprises: (701) from the counter position Step (702) is executed in a loop until position 0; (702) computing Each of the computed Is subjected to a modulo addition operation to obtain a sum of the one-time key private keys Wherein Is generated by a keyed pseudo-random function With a key K (703) After the loop is finished, the calculation , resulting in the keyword index ; (704) keyword index conversion to encrypted file identifier ; (705) by a keyed pseudo-random function with key for each generation ; (706) for each retrieving the current file search token mapping , obtaining the current file search token and its counter storing to the mapping ; (707) with a key encrypted query index ; (708) sending to the database server.
7. The dynamic searchable encryption method of claim 6, wherein, Step (8) comprises: (801) For , the database server performs steps (802) to (803) in a loop from the counter position until position 0. (802) computing , according to the calculation of each retrieve all encrypted file index , by homomorphism addition, get encrypted file index final result ; (803) with and the encrypted query index is performed, and if the result is 0, the match is successful, and the encrypted file identifier corresponding to the encrypted file is retrieved ; (804) After the loop ends, all matching encrypted file identifiers are obtained and their corresponding file ciphertexts .
8. The dynamic searchable encryption method of any of claims 1-7, wherein, Also comprising: According to all matching encrypted file identifiers and their corresponding file ciphertexts , using the key of the encrypted convergence key to decrypt to obtain the file convergence key ; using to decrypt the file ciphertexts to obtain the plaintext files .
9. A dynamic searchable encryption system characterized by, Comprising: a system parameter setting module, configured to return system public parameters, state and encrypted database according to input security parameters are five anti-collision hash functions; represents the maximum number of files, represents the maximum number of keywords; is an empty map for storing the current file search token, is an empty map for storing the current keyword search token; is a key, is a key for encrypting the convergence key; is a deduplication tag set; A deduplication verification tag generation module is configured to input a file to be updated and generate a deduplication verification tag ; a deduplication module for verifying a deduplication tag retrieving a set of deduplication tags , if does not exist in the , return does not exist; otherwise, return already exists; if the file is to be uploaded, continue to perform an update operation when the result is does not exist; If the file is to be deleted, the result of the judgment is that it already exists, and the update operation is continued; an encryption module for inputting a one-time key private key , a one-time file private key and a key of an encryption convergence key , respectively, to encrypt a key index , a file index and a file to obtain an encrypted key index , an encrypted file index , an encrypted file identifier and file ciphertext ; an update module for updating the encrypted database according to the state , the keywords to be updated , and the files to be updated , to obtain an updated state and an updated encrypted database and an updated encrypted database ; The search module is configured to search the encrypted database according to the state and the connection keyword to be searched, and obtain an encrypted keyword index. ; And, The result matching module is used to index encrypted keywords. Retrieve all encrypted file indexes Combine it with the encrypted query index Match to obtain all encrypted file identifiers. and its encrypted documents .
10. The dynamic searchable encryption system of claim 9, wherein, Also comprising: a decryption module for decrypting the encrypted file identifiers and their file ciphertexts according to the key converged key to obtain plaintext files