Searchable encryption method and apparatus supporting outsourcing of computation and multi-user sharing

Abstract

The present disclosure provides a searchable encryption method and device supporting outsourcing computing and multi-user sharing, and relates to the technical field of cloud computing and big data. The method gives a novel outsourcing searchable CP-ABE encryption scheme supporting keyword semantic expansion and sorting, improves the security and availability of the existing cloud storage scheme, reduces the data maintenance cost, and guarantees the customer information security. First, the attribute-based encryption concept is introduced into the searchable encryption scheme, realizing efficient and secure multi-user sharing; second, the present disclosure realizes semantic expansion, which can help users obtain data with different expression methods but the same meaning; third, the present disclosure realizes the result sorting function, returning data according to the relevance with the search keyword from large to small, improving the user experience; finally, the present disclosure realizes the indistinguishability under the adaptive chosen ciphertext attack of the ciphertext and the indistinguishability under the chosen keyword attack of the token.

Description

Technical Field

[0001] This disclosure relates to the fields of cloud computing and big data technology, and specifically to a searchable encryption method, apparatus, electronic device, storage medium, and program product that supports outsourced computing and multi-user sharing. Background Technology

[0002] Due to the advantages of cloud servers, such as large storage space and low data management costs, more and more users and enterprises are willing to store their data on cloud servers. According to research data, most enterprises use at least one cloud server, allowing users to manage large amounts of data over the network using mobile devices with limited memory. A key service provided by cloud servers is data storage and management. However, there are threats to the data stored on cloud servers, limiting some users' use of them. Therefore, encrypting data before uploading is the most direct method. For example, financial institutions such as banks want to store customer information on cloud servers. Because they need to ensure the privacy of customer data, this data cannot be uploaded in plaintext; therefore, they can choose to upload encrypted data to the cloud server.

[0003] However, encryption alters the data structure, rendering retrieval methods suitable for plaintext inapplicable to encrypted text. Searchable encryption can address this issue. However, relying solely on a single searchable encryption technique is insufficient for practical needs. For instance, in real-world scenarios, institutions like banks (data owners) may wish to authorize certain branches / sub-branches (authorized data users) to share specific data. In such cases, using only basic searchable encryption risks the leakage of the data owner's keys and the authorized data users' search keywords. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a searchable encryption method, apparatus, electronic device, storage medium and program product that supports outsourced computing and multi-user sharing, which can improve data security and availability.

[0005] According to a first aspect of this disclosure, a searchable encryption method supporting outsourced computation and multi-user sharing is provided, comprising: a data owner generating public parameters and a master key based on specified security parameters; the data owner specifying a set of plaintext documents to be uploaded, generating a security index for the plaintext document set, and encrypting the plaintext document set into a ciphertext document set according to the public parameters and the access structure of a linear secret sharing scheme; the data owner uploading the ciphertext document set and the security index to a cloud server; a data user specifying search keywords for documents to be queried, generating a corresponding search trapdoor, and sending the search trapdoor to the cloud server; the cloud server performing calculations on the search trapdoor and the security index to determine at least one target ciphertext document in the ciphertext document set, and sorting and distributing the at least one target ciphertext document to a fog node; the data user determining a conversion key and a private key based on the master key and its own attribute set, and sending the conversion key to the fog node; the fog node using the conversion key to decrypt the ciphertext document set, generating partially decrypted ciphertext, and sending the partially decrypted ciphertext to the data user; and the data user using the private key to decrypt the partially decrypted ciphertext to obtain a target plaintext document set corresponding to at least one target ciphertext document.

[0006] According to embodiments of this disclosure, the data owner generates public parameters and a master key based on specified security parameters, including: selecting a bilinear group G with a prime number p and generator g based on the specified security parameter λ; and determining two hash functions H1 and H2 based on the bilinear group G, where H1: {0, 1}. * →G,H2:G→{0,1} l l represents the number of digits; from the set Z of the smallest nonnegative complete residues of prime number p. p Choose two random exponents α and β; choose m-order matrices M1 and M2, and an m-bit binary indicator vector S, S = (0, 1). m Determine the common parameter PK, PK = (g, e(g, g)). α g β H1, H2), e is a bilinear mapping; determine the master key MSK, MSK = (g α ,PK).

[0007] According to embodiments of this disclosure, generating a secure index for a plaintext document set includes: from a plaintext document set F = {F1, F2, ..., F...} n Extract the keyword set W = {W1, W2, ..., W} m}, F j For the j-th plaintext document, W i For the i-th keyword, j = 1, 2, ..., n, i = 1, 2, ..., m; calculate W for each keyword. i With each plaintext document F j The correlation score between them (W) i Fj ); Calculate W for each keyword i In each plaintext document F j The positional weight score Z ij According to the relevance score (W) i F j ), Location weight score Z ij and each keyword W i In plain text document F j Based on the attribution results, construct the index vector I. j Using an m-bit binary index vector S, the index vector I... j Split into the first vector I′ j Second vector I″ j Using matrices M1 and M2 respectively on the first vector I′ j Second vector I″ j Encryption is performed to obtain each plaintext document F. j Security Index SI j , T represents transpose; based on each plaintext document F j Security Index SI j This yields the security index SI = (SI1, SI2, ..., SI3) of the plaintext document set. n ).

[0008] According to embodiments of this disclosure, index vector I j Including each keyword W i The corresponding index vector I j [i]; Based on the relevance score (W i F j ), Location weight score Z ij and each keyword W i In plain text document F j Based on the attribution results, construct the index vector I. j This includes: sequentially judging each keyword W i Is it a plaintext document F? j If the keyword is present, then determine I. j [i] = Z ij ·score(W i F j Otherwise, determine I. j [i] = 0.

[0009] According to embodiments of this disclosure, the index vector I is determined according to the following formula. j Split into the first vector I′ j Second vector I″ j :

[0010]

[0011] In the formula, I′ j [i],I″ j [i] represents each keyword W i The corresponding first and second vectors; S[i] is the i-th value of the m-bit binary indicator vector S; u1 is the first random number.

[0012] According to embodiments of this disclosure, encrypting a plaintext document set into a ciphertext document set based on a public parameter PK and an access structure of a linear secret sharing scheme includes: obtaining the public parameter PK and the plaintext document set F = {F1, F2, ..., F...} n Define the access structure (M3, ρ) for the linear secret sharing scheme, where M3 is an l×k access policy matrix, l is the number of attributes included in the access policy, k reflects the computational cost required for secret reconstruction, and ρ is the mapping function that maps each row of matrix M3 to the corresponding attribute ρ(h); define a random vector For set Z p Let s be a k-order subset of y, where y1, ..., y2 are secret values ​​to be shared. k for Random numbers in the data; calculation M 3，h Let λ represent the h-th row of matrix M3. h Let represent the h-th share of the secret value s, corresponding to the attribute ρ(h); based on the bilinear group G, hash functions H1 and H2, generator g, attribute ρ(h), and share λ h This encrypts a plaintext document set into a ciphertext document set.

[0013] According to embodiments of this disclosure, the encrypted document set C = {CF, CT, C′, C1, ..., C} l Encrypt a plaintext document set into a ciphertext document set using the following formula:

[0014] CT = {CT1, CT2, ..., CT} n}

[0015] CT i =r i ·e(g,g) αs r i ∈G

[0016] CF = {CF1, CF2, ..., CF} n}

[0017]

[0018] C′=g s

[0019]

[0020] In the formula, Represents the XOR operation; r i Let CF, CT, C′, C1, ..., Cn be the i-th element of an n-element bilinear group G, where i = 1, 2, ..., n; C1, C2, ..., Cn are the elements of the bilinear group G. l All of these are intermediate ciphertexts of a ciphertext document set.

[0021] According to embodiments of this disclosure, a data user specifies search keywords for a document to be queried, and a corresponding search trapdoor is generated, including: semantically expanding the search keywords w for the document to be queried to obtain an expanded keyword set Γ = {w, w1, ..., w2}. k′ Let k′ be the number of expanded keywords; calculate the similarity between the search keyword w and each expanded keyword in the expanded keyword set Γ to obtain a similarity vector; based on the similarity vector and the matching results between the expanded keyword set Γ and the keyword set W, determine the m-bit search vector. Using an m-bit binary indicator vector S, the m-bit retrieval vector Perform fission to obtain the first sub-vector Second subvector Use matrices M1 and M2 respectively to process the first sub-vector Second subvector Encryption is performed to obtain the search trapdoor T corresponding to the search keyword w. Q ,

[0022] According to embodiments of this disclosure, calculating the similarity between the search keyword w and each extended keyword in the extended keyword set Γ to obtain a similarity vector includes: calculating the similarity between the search keyword w and each extended keyword w in the extended keyword set Γ. r The edit distance between them, r = 1, 2, ..., k′; based on the edit distance, determine the relationship between the search keyword w and each expanded keyword w. r The similarity between sim r To obtain the similarity vector

[0023] According to embodiments of this disclosure, an m-bit retrieval vector is determined based on a similarity vector and the matching results between the extended keyword set Γ and the keyword set W. This includes: sequentially determining whether all keywords in the expanded keyword set Γ match the keywords at the corresponding positions in the keyword set W; if so, determining the retrieval vector. The value at the corresponding position of the keyword in the extended keyword set Γ is sim. r Otherwise, the value is set to 0.

[0024] According to embodiments of this disclosure, the m-bit retrieval vector is processed according to the following formula. Fission occurs:

[0025]

[0026] In the formula, These are the i-th values ​​of the first and second sub-vectors, respectively; m-bit retrieval vector The i-th value; S[i] is the i-th value of the m-bit binary indicator vector S; u2 is the second random number.

[0027] According to embodiments of this disclosure, the cloud server performs calculations on the retrieval trapdoor and security index to determine at least one target ciphertext document in the ciphertext document set, and sorts the at least one target ciphertext document before sending it to the fog node. This includes: the cloud server performing calculations on the retrieval trapdoor and each plaintext document F... j Security Index SI j Perform inner product operation to obtain the result; determine whether each encrypted document contains the search keyword based on the result. If it does, record the encrypted document as the target encrypted document; sort at least one target encrypted document containing the search keyword in descending order according to the result, and return the first t target encrypted documents to the fog node, where t is an integer and 1≤t≤d, and d is the total number of target encrypted documents.

[0028] According to embodiments of this disclosure, determining whether each encrypted document contains search keywords based on the calculation result includes: when the calculation result is a preset threshold, determining that the encrypted document contains search keywords.

[0029] According to embodiments of this disclosure, the attribute set includes multiple attributes describing the identity of a data user; the data user determines a conversion key and a private key based on the master key and their own attribute set, and sends the conversion key to the fog node, including:

[0030] Data users randomly select t′∈Z based on the master key and multiple attributes. p Output

[0031] SK′=(PK,K′=g α g βt′ L′=g t′ , {K′ x =H1(x) t′} x∈A )

[0032] In the formula, A is the attribute set of the data user; x is any attribute in the attribute set;

[0033] Random selection Let t = t′ / z, then we obtain the conversion key TK and the private key SK:

[0034] TK = (PK, K, L, {K}) x} x∈A )

[0035]

[0036] L = g t

[0037] {K x} x∈A ={H1(x)} t} x∈A

[0038] SK = (z, TK)

[0039] in, It is set Z p The non-zero subset of .

[0040] According to embodiments of this disclosure, a fog node uses a transformation key to decrypt a set of encrypted documents, generating partially decrypted ciphertext, and sends the partially decrypted ciphertext to a data user. This includes: the data user sending their attribute set to the fog node; the fog node determining whether the attribute set passes the access structure; and if the attribute set passes the access structure, the fog node, based on the Transform algorithm, uses a transformation key TK to decrypt the encrypted document set C = {CF, CT, C′, C1, ..., C...}. l Decryption yields a partial decrypted ciphertext PDC:

[0041] PDC = (CF, CT, e(g, g)) sα / z )

[0042] Where z is the set Z p Random numbers in the array.

[0043] According to embodiments of this disclosure, the fog node is based on the Transform algorithm and uses a transformation key TK to process the ciphertext document set C = {CF, CT, C′, C1, ..., C}. l Decryption is performed, including: definition And satisfying B={b|ρ(b)∈A}, where ρ(b) corresponds to an attribute in attribute set A, B is an attribute set, and b is an attribute in set B; there exists a constant set {ω b ∈Z p} b∈B , such that if {λ b If} represents the effective sharing of secret value s with matrix M3, then the reconstructed secret value s = ∑ b∈B ω b λb .

[0044] The second aspect of this disclosure provides a searchable encryption device supporting outsourced computing and multi-user sharing, comprising: a data owner module, configured to generate public parameters and a master key based on specified security parameters; further configured to specify a plaintext document set to be uploaded, generate a security index for the plaintext document set, and encrypt the plaintext document set into a ciphertext document set according to the public parameters and the access structure of a linear secret sharing scheme; further configured to upload the ciphertext document set and the security index to a cloud server; and a data user module, configured to specify search keywords for the document to be queried, generate a corresponding search trapdoor, and send the search trapdoor to the cloud server; and further configured to... Based on the master key and its own attribute set, the conversion key and private key are determined, and the conversion key is sent to the fog node. The cloud server module is used to perform calculations on the retrieval trapdoor and security index to determine at least one target ciphertext document in the ciphertext document set, and then sorts and sends the at least one target ciphertext document to the fog node. The fog node module is used to decrypt the ciphertext document set using the conversion key, generate partially decrypted ciphertext, and send the partially decrypted ciphertext to the data user. The data user module is also used to decrypt the partially decrypted ciphertext using the private key to obtain the target plaintext document set corresponding to at least one target ciphertext document.

[0045] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the searchable encryption method described above that supports outsourced computing and multi-user sharing.

[0046] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the searchable encryption method described above that supports outsourced computing and multi-user sharing.

[0047] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the searchable encryption method described above that supports outsourced computing and multi-user sharing.

[0048] Compared with existing technologies, the searchable encryption method and apparatus that support outsourced computing and multi-user sharing provided in this disclosure have at least the following advantages:

[0049] This disclosure presents a novel outsourced searchable CP-ABE encryption scheme that supports keyword semantic expansion for sorting, improving the security and availability of existing cloud storage solutions, reducing data maintenance costs, and ensuring customer information security. First, it introduces the concept of attribute-based encryption into the searchable encryption scheme, enabling efficient and secure multi-user sharing. Second, this disclosure implements semantic expansion, helping users obtain data with different expressions but the same meaning. Third, this disclosure implements a result sorting function, returning data sorted from highest to lowest relevance to the search keywords, improving user experience. Finally, this disclosure simultaneously achieves indistinguishability under token-based chosen-keyword attacks and indistinguishability under adaptive chosen-ciphertext attacks. Attached Figure Description

[0050] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0051] Figure 1 This schematically illustrates a system architecture of a searchable encryption method and apparatus suitable for supporting outsourced computing and multi-user sharing, according to embodiments of the present disclosure.

[0052] Figure 2 A flowchart illustrating a searchable encryption method supporting outsourced computing and multi-user sharing according to an embodiment of the present disclosure is shown schematically.

[0053] Figure 3 A schematic diagram illustrates a searchable encryption method supporting outsourced computing and multi-user sharing according to an embodiment of the present disclosure;

[0054] Figure 4 A flowchart illustrating the secure index generation process for a set of plaintext documents according to an embodiment of this disclosure is shown schematically.

[0055] Figure 5 The schematic diagram illustrates the principle of a secure index generation process for a plaintext document set according to an embodiment of the present disclosure;

[0056] Figure 6 A flowchart illustrating the retrieval trapdoor generation process according to an embodiment of the present disclosure is shown schematically;

[0057] Figure 7 A flowchart illustrating the process of determining a target encrypted document according to an embodiment of the present disclosure is shown schematically.

[0058] Figure 8 A flowchart illustrating a portion of the decrypted ciphertext generation process according to an embodiment of the present disclosure is shown schematically.

[0059] Figure 9A block diagram illustrating a searchable encryption device supporting outsourced computing and multi-user sharing according to an embodiment of the present disclosure is shown schematically.

[0060] Figure 10 A block diagram illustrating an electronic device suitable for implementing a searchable encryption method that supports outsourced computing and multi-user sharing, according to embodiments of the present disclosure, is shown. Detailed Implementation

[0061] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0062] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0063] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0064] When using expressions such as "at least one of A, B, and C", the expression should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0065] The accompanying drawings illustrate several block diagrams and / or flowcharts. It should be understood that some blocks, or combinations thereof, in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that, when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts. The technology of this disclosure can be implemented in hardware and / or software (including firmware, microcode, etc.). Alternatively, the technology of this disclosure can take the form of a computer program product stored on a computer-readable storage medium, which is available for use by or in conjunction with an instruction execution system.

[0066] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and there is no violation of public order and good morals.

[0067] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0068] With the development of big data and cloud computing, more and more enterprises and users are willing to store their data on cloud servers due to their low cost and huge storage space. However, due to the special nature of the banking and financial industry, which needs to ensure the security of customer information, it is impossible to directly rent cloud servers, and instead, it requires a huge investment of human and financial resources to maintain its own database. Therefore, embodiments of this disclosure provide a searchable encryption method, apparatus, device, storage medium, and program product that supports outsourced computing and multi-user sharing, relating to the fields of cloud computing and big data technology. This searchable encryption method can outsource encrypted user information to cloud servers without affecting the user experience of the data owner.

[0069] Figure 1 This illustration schematically depicts a system architecture suitable for supporting outsourced computing and multi-user sharing of a searchable encryption method and apparatus according to embodiments of the present disclosure. It should be noted that... Figure 1 The examples shown are merely examples of system architectures that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0070] like Figure 1As shown, the system architecture 100 according to this embodiment may include a data master terminal 101, a cloud server 102, fog nodes 103A, 103B, 103C, 103D, and data user terminals 104A, 104B, 104C, 104D. The network serves as a medium to provide communication links between the data master terminal 101, cloud server 102, fog nodes 103A, 103B, 103C, 103D, and data user terminals 104A, 104B, 104C, 104D, as indicated by the arrows in the figure. This network may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0071] Data owners (such as banks and other institutions) can use data owner terminals 101 to interact with cloud servers via the network to receive or send messages. Data users, such as authorized branches / sub-branches of banks, can have various communication client applications installed on their data user terminals 104A, 104B, 104C, and 104D, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0072] Data user terminals 104A, 104B, 104C, and 104D can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0073] Cloud server 102 can be a server that provides various services, such as a backend management server that supports websites browsed by data owner users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0074] It should be understood that Figure 1 The number of fog nodes and data user terminals in the system corresponds to each other. Furthermore, Figure 1 The number of data master terminals, cloud servers, fog nodes, and data user terminals shown in the diagram is merely illustrative. Depending on implementation needs, any number of data master terminals, cloud servers, fog nodes, and data user terminals can be included.

[0075] The embodiments of this disclosure include four entities: a data owner (DO), a cloud server (CS), a fog node (FN), and a data user (DU). In the embodiments of this disclosure, all channels are common channels. The following will be based on... Figure 1 The described system architecture, through Figures 2-8A searchable encryption method supporting outsourced computing and multi-user sharing, according to embodiments of this disclosure, will be described in detail.

[0076] Figure 2 A flowchart illustrating a searchable encryption method supporting outsourced computing and multi-user sharing according to an embodiment of this disclosure is shown schematically. Figure 3 A schematic diagram illustrates a searchable encryption method supporting outsourced computing and multi-user sharing according to an embodiment of this disclosure.

[0077] like Figure 2 and Figure 3 As shown, the searchable encryption method supporting outsourced computing and multi-user sharing in this embodiment may include operations S210 to S280.

[0078] In operation S210, the data owner generates public parameters and a master key based on the specified security parameters.

[0079] In operation S220, the data owner specifies the plaintext document set to be uploaded, generates a security index for the plaintext document set, and encrypts the plaintext document set into a ciphertext document set according to the access structure of the public parameters and the linear secret sharing scheme.

[0080] When operating S230, the data owner uploads the encrypted document set and security index to the cloud server.

[0081] In operation S240, the data user specifies the search keywords for the document to be queried, generates the corresponding search trap, and sends the search trap to the cloud server.

[0082] When operating S250, the cloud server performs calculations on the retrieval trapdoor and security index to determine at least one target ciphertext document in the ciphertext document set, and then sorts and sends the at least one target ciphertext document to the fog node.

[0083] In S260 operation, the data user determines the transformation key and private key based on the master key and its own attribute set, and sends the transformation key to the fog node.

[0084] During operation S270, the fog node uses the conversion key to decrypt the ciphertext document set, generates partially decrypted ciphertext, and sends the partially decrypted ciphertext to the data user.

[0085] In operation S280, the data user uses a private key to decrypt a portion of the ciphertext, obtaining at least one target plaintext document set corresponding to the target ciphertext document.

[0086] Through embodiments of this disclosure, the concept of attribute-based encryption is introduced into searchable encryption technology to achieve multi-user sharing functionality, and the security of encryption is improved based on the FO (Fujisaki-Okamoto) transformation. Furthermore, since attribute-based encryption uses bilinear pairing, this disclosure introduces fog nodes and proposes a secure bilinear pairing outsourced computation method, effectively reducing the computational burden on authorized data users.

[0087] Specifically, operation S210 is a system initialization operation performed by the data owner DO. It specifies the security parameter λ and outputs the public parameter PK, the master key MSK, m-order matrices M1 and M2, and an m-bit binary indicator vector S = {0, 1}. m .

[0088] In this embodiment of the disclosure, the data owner in the above-described operation S210 generates public parameters and a master key based on specified security parameters, specifically including:

[0089] (1) Select a bilinear group G with a prime number p and generator g according to the specified security parameter λ;

[0090] (2) Based on the bilinear group G, determine two hash functions H1 and H2, where H1: {0, 1} * →G,H2:G→{0,1} l l represents the number of bits, meaning the hash function H2 can generate an l-bit string of 0s and 1s.

[0091] (3) From the set of smallest nonnegative complete residues Z of prime number p p Choose two random exponents, α and β;

[0092] (4) Select m-order matrices M1 and M2, and an m-bit binary index vector S, where S = (0, 1). m ;

[0093] (5) Determine the common parameter PK, PK = (g, e(g, g)). α g β (H1, H2), e is a bilinear mapping;

[0094] (6) Determine the master key MSK, MSK = (g α ,PK).

[0095] Next, operation S220 generates a secure index and a set of encrypted documents from the data owner DO. The inputs are the plaintext document set F, matrices M1 and M2, and an m-bit binary indicator vector S; the outputs are the secure index SI and the keyword set W.

[0096] Figure 4 A flowchart illustrating the secure index generation process for a set of plaintext documents according to an embodiment of this disclosure is shown. Figure 5 The schematic diagram illustrates the principle of a secure index generation process for a plaintext document set according to an embodiment of the present disclosure.

[0097] like Figure 4 and Figure 5 As shown in this embodiment of the disclosure, the secure index for generating a plaintext document set in operation S220 may include operations S421 to S427.

[0098] In operation S421, from the plaintext document set F = {F1, F2, ..., F...} n Extract the keyword set W = {W1, W2, ..., W} m}, F j For the j-th plaintext document, W i Let be the i-th keyword, j = 1, 2, ..., n, i = 1, 2, ..., m.

[0099] In operation S422, each keyword W is calculated. i With each plaintext document F j The correlation score between them (W) i F j ).

[0100] In operation S423, calculate each keyword W. i In each plaintext document F j The positional weight score Z ij .

[0101] In operation S424, based on the relevance score (W) i F j ), Location weight score Z ij and each keyword W i In plain text document F j Based on the attribution results, construct the index vector I. j .

[0102] like Figure 5 As shown in this embodiment of the disclosure, the index vector I j Including each keyword W i The corresponding index vector I j [i]. Based on the relevance score (W) i F j ), Location weight score Z ij and each keyword W i In plain text document F j Based on the attribution results, construct the index vector I. j This includes: sequentially judging each keyword W i Is it a plaintext document F? jIf the keyword is present, then determine I. j [i] = Z ij ·score(W i F j Otherwise, determine I. j [i] = 0.

[0103] In operation S425, using an m-bit binary indicator vector S, the index vector I... j Split into the first vector I′ j Second vector I″ j .

[0104] This operation uses each bit of the m-bit binary index vector S to index the vector I. j Fission is performed as the fission rule. Specifically, the index vector I is determined according to the following formula. j Split into the first vector I′ j Second vector I″ j :

[0105]

[0106] In the formula, I′ j [i],I″ j [i] represents each keyword W i The corresponding first and second vectors; S[i] is the i-th value of the m-bit binary indicator vector S; u1 is the first random number.

[0107] In operation S426, matrices M1 and M2 are used to manipulate the first vector I′ respectively. j Second vector I″ j Encryption is performed to obtain each plaintext document F. j Security Index SI j

[0108]

[0109] In the formula, T represents transpose.

[0110] In operation S427, based on each plaintext document F j Security Index SI j The security index SI of the plaintext document set is obtained.

[0111] SI = (SI1, SI2, ..., SI) n )

[0112] In this embodiment of the disclosure, the operation S220 described above, which encrypts the plaintext document set into a ciphertext document set based on the access structure of the public parameters and the linear secret sharing scheme, includes:

[0113] (1) Obtain the public parameter PK and the plaintext document set F = {F1, F2, ..., F} n}, define the access structure (M3, ρ) of the linear secret sharing scheme, where M3 is an l×k access policy matrix, l is the number of attributes included in the access policy, k reflects the amount of computation required for secret reconstruction, and ρ is the mapping function that maps each row of matrix M3 to the corresponding attribute ρ(h).

[0114] (2) Define a random vector For set Z p Let s be a k-order subset of y, where y1, ..., y2 are secret values ​​to be shared. k for Random numbers in the data; calculation h = 1, 2, ..., l, M 3，h Let λ represent the h-th row of matrix M3. h This represents the h-th share of the secret value s, corresponding to attribute ρ(h);

[0115] (3) Based on the bilinear group G, hash functions H1 and H2, generator g, attribute ρ(h), and share λ h This encrypts a plaintext document set into a ciphertext document set.

[0116] Furthermore, in this embodiment of the disclosure, the encrypted document set C = {CF, CT, C′, C1, ..., C} in the above operation S220 is... l Based on this, according to the bilinear group G, hash functions H1 and H2, generator g, attribute ρ(h), and share λ h Encrypting a plaintext document set into a ciphertext document set includes encrypting a plaintext document set into a ciphertext document set according to the following formula:

[0117] CT = {CT1, CT2, ..., CT} n}

[0118] CT i =r i ·e(g,g) αs r i ∈G

[0119] CF = {CF1, CF2, ..., CF} n}

[0120]

[0121] C′=g s

[0122]

[0123] In the formula, Represents the XOR operation; r i Let CF, CT, C′, C1, ..., Cn be the i-th element of an n-element bilinear group G, where i = 1, 2, ..., n; C1, C2, ..., Cn are the elements of the bilinear group G. l All of these are intermediate ciphertexts of a ciphertext document set.

[0124] Data owner DO uploads the secure index SI and the encrypted document set C to the cloud server, D1, ..., D l This will be used in the subsequent decryption process.

[0125] In the embodiments disclosed herein, the data owner (DO) encrypts documents using their own private key to generate a secure index. The data owner then uploads the secure index and the encrypted document set to a cloud server. Therefore, the data owner can directly decrypt the encrypted document set returned by the cloud server using their own private key, without worrying about access structure issues.

[0126] The above operation S240 is a search trapdoor generation operation performed by data user DU, in which data user DU constructs a search trapdoor T corresponding to the search keyword w. O Then, the search trap is sent to the cloud server.

[0127] Figure 6 A flowchart illustrating the trapdoor generation process according to an embodiment of the present disclosure is shown schematically.

[0128] like Figure 6 As shown in this embodiment of the disclosure, the data user specifies the search keywords of the document to be queried in the above-mentioned operation S240 to generate the corresponding search trapdoor, which may include operations S641 to S645.

[0129] In operation S641, the search keyword w of the document to be queried is semantically expanded to obtain the expanded keyword set Γ = {w, w1, ..., w2}. k′}, where k′ is the number of extended keywords.

[0130] For example, data user DU inputs the search keyword w for the desired document, and uses WordNet semantic web to perform semantic expansion of the search keyword w, thereby obtaining an expanded keyword set Γ.

[0131] In operation S642, the similarity between the search keyword w and each extended keyword in the extended keyword set Γ is calculated to obtain a similarity vector.

[0132] Since the extended keyword set Γ contains both the search keyword w and k′ extended keywords, in this embodiment of the disclosure, calculating the similarity between the search keyword w and each extended keyword in the extended keyword set Γ to obtain a similarity vector includes: calculating the similarity between the search keyword w and each extended keyword w′ in the extended keyword set Γ.r The edit distance between them, r = 1, 2, ..., k′; based on the edit distance, determine the relationship between the search keyword w and each expanded keyword w. r The similarity between sim r To obtain the similarity vector

[0133] In operation S643, based on the similarity vector and the matching results between the extended keyword set Γ and the keyword set W, the m-bit retrieval vector is determined.

[0134] In this embodiment of the disclosure, it is sequentially determined whether all keywords in the extended keyword set Γ (including the search keyword w and k′ extended keywords) match the keywords at the corresponding positions in the keyword set W. If they match, the search vector is determined. The value at the corresponding position of the keyword in the extended keyword set Γ is sim. r , sim r ∈(sim1, sim2, ..., sim k′ Otherwise, the value is set to 0.

[0135] Wherein, the keyword set W is obtained from the plaintext document set F = {F1, F2, ..., F...} in the above operation S421. n The extracted W = {W1, W2, ..., W} m}

[0136] In operation S644, using an m-bit binary indicator vector S, an m-bit retrieval vector is used. Perform fission to obtain the first sub-vector Second subvector

[0137] This operation uses each bit of the m-bit binary indicator vector S to search the m-bit retrieval vector. Fission is performed. In this embodiment of the disclosure, the m-bit retrieval vector is processed according to the following formula. Fission occurs:

[0138]

[0139] In the formula, These are the i-th values ​​of the first and second sub-vectors, respectively; m-bit retrieval vector The i-th value; S[i] is the i-th value of the m-bit binary indicator vector S; u2 is the second random number.

[0140] In operation S645, matrices M1 and M2 are used to process the first sub-vector. Second subvector Encryption is performed to obtain the search trapdoor T corresponding to the search keyword w. Q

[0141]

[0142] Through the embodiments of this disclosure, semantic expansion of search keywords is performed by referencing, for example, the WordNet semantic web, to achieve fuzzy retrieval of keywords with the same meaning, which can better help authorized data users search for the documents they need.

[0143] Next, after receiving the search trap, the cloud server performs the search calculation. Figure 7 A flowchart illustrating the process of determining a target encrypted document according to an embodiment of the present disclosure is shown.

[0144] like Figure 7 As shown in this embodiment of the disclosure, the cloud server in the above-mentioned operation S250 performs calculations on the retrieval trapdoor and security index to determine at least one target ciphertext document in the ciphertext document set, and sorts the at least one target ciphertext document and sends it to the fog node, which may include operations S751 to S753.

[0145] When operating the S751, the cloud server retrieves the trapdoor and each plaintext document F. j Security Index SI j Perform the inner product operation to obtain the result.

[0146] Specifically, based on the above calculation formulas for security indexes and retrieval trapdoors, the inner product operation process is as follows:

[0147]

[0148] According to the fission rules of document indexing and retrieval vectors, when S[j] = 0, we have

[0149]

[0150] When S[j] = 1, then we have

[0151]

[0152] In operation S752, based on the calculation result, it is determined whether each ciphertext document contains the search keyword. If so, the ciphertext document is recorded as the target ciphertext document.

[0153] In this embodiment of the disclosure, determining whether each encrypted document contains search keywords based on the calculation result includes: determining that the encrypted document contains search keywords when the calculation result is a preset threshold. The preset threshold can, for example, be 0. That is, when the result of the inner product is 0, the encrypted document is determined to contain search keywords; when the result of the inner product is non-zero, the encrypted document is determined not to contain search keywords.

[0154] In operation S753, at least one target encrypted document containing the search keyword is sorted from largest to smallest according to the operation result, and the first t target encrypted documents are returned to the fog node, where t is an integer and 1≤t≤d, and d is the total number of target encrypted documents.

[0155] The cloud server sorts all target encrypted documents containing the search keywords from largest to smallest according to the result of the inner product operation, and returns the top-t most relevant encrypted documents to the fog node.

[0156] Through the embodiments of this disclosure, the relevance between search keywords and documents is calculated using the TF-IDF (Term Frequency-Inverse Document Frequency) method and the positional weight scoring method, and the documents are arranged in descending order of relevance, so that data users can obtain the documents they need most.

[0157] Next is the process of the data user generating a conversion key and a private key. In this embodiment of the disclosure, the attribute set in the above-mentioned operation S260 includes multiple attributes used to describe the identity of the data user. Based on this, in the above-mentioned operation S260, the data user determines the conversion key and private key according to the master key and its own attribute set, and sends the conversion key to the fog node, including:

[0158] Data users randomly select t′∈Z based on the master key and multiple attributes. p Output

[0159] SK′=(PK,K′=g α g βt′ L′=g t′ , {K′ x =H1(x) t′} x∈A )

[0160] In the formula, A is the attribute set of the data user; x is any attribute in the attribute set;

[0161] Random selection Let t = t′ / z, then we obtain the conversion key TK and the private key SK:

[0162] TK = (PK, K, L, {K}) x}x∈A )

[0163]

[0164] L = g t

[0165] {K x} x∈A ={H1(x)} t} x∈A

[0166] SK = (z, TK)

[0167] in, It is set Z p The non-zero subset of .

[0168] The data user sets the private key SK to (z, TK), and then sends the conversion key TK to the fog node.

[0169] Then, the fog node FN inputs the transformation key TK = (PK, K, L, {K}). x} x∈A and the encrypted document set C = {CF, CT, C′, C1, ..., C} l}, generating partially decrypted ciphertext.

[0170] Figure 8 A flowchart illustrating a portion of the decryption ciphertext generation process according to an embodiment of the present disclosure is shown schematically.

[0171] like Figure 8 As shown in this embodiment of the disclosure, the fog node in the above-mentioned operation S270 uses the conversion key to decrypt the ciphertext document set, generates a partially decrypted ciphertext, and sends the partially decrypted ciphertext to the data user, which may include operations S871 to S872.

[0172] In operation S871, the data user sends its own attribute set A to the fog node, and the fog node determines whether the attribute set has been accessed through the structure (M3, ρ).

[0173] If A does not satisfy the access structure, output ⊥, the system stops running, and the subsequent partial decryption ciphertext generation process is not performed. If A satisfies the access structure, proceed to the next operation S872.

[0174] In operation S872, given that the attribute set is accessed through the structure, the fog node, based on the Transform algorithm, uses the transformation key TK to process the ciphertext document set C = {CF, CT, C′, C1, ..., C}. l Decryption yields a partial decrypted ciphertext PDC:

[0175] PDC = (CF, CT, e(g, g)) sα / z )

[0176] Where z is the set Z p Random numbers in the array.

[0177] Specifically, in this embodiment of the disclosure, the fog node is based on the Transform algorithm and uses a transformation key TK to process the ciphertext document set C = {CF, CT, C′, C1, ..., C}. l Decryption is performed, including:

[0178] definition And satisfy B={b|ρ(b)∈A}, where ρ(b) corresponds to an attribute in attribute set A, B is an attribute set, and b is an attribute in set B;

[0179] There exists a set of constants {ω} b ∈Z p} b∈B , such that if {λ b If} represents the effective sharing of secret value s with matrix M3, then the reconstructed secret value s = ∑ b∈B ω b λ b .

[0180] The calculation process for partially decrypted ciphertext PDC is as follows:

[0181]

[0182] Therefore, the decrypted ciphertext PDC in the output part is (CF, CT, e(g, g)). sα / z Fog nodes send a portion of the decrypted ciphertext to the data user.

[0183] This disclosure introduces the CP-ABE (Ciphertext Policy Attribute Based Encryption) scheme into searchable encryption schemes to solve the problem of sharing ciphertext documents. Authorized data users can obtain partially decrypted ciphertext if they can access the structure, and then decrypt the partially decrypted ciphertext to obtain the plaintext; otherwise, they cannot obtain it. Furthermore, by using fog nodes and computing bilinear pairings on fog nodes, the computational burden on data users can be greatly reduced, improving efficiency.

[0184] Finally, the data user uses the private key to decrypt part of the decrypted ciphertext, obtaining at least one target plaintext document set corresponding to the target ciphertext document.

[0185] In other words, after receiving a portion of the decrypted ciphertext PDC, the data user DU decrypts it using their private key SK to obtain the target plaintext document set.

[0186] The calculation process for decrypting a portion of the ciphertext is as follows:

[0187]

[0188]

[0189] In summary, in order to improve the security and availability of existing cloud storage solutions, reduce data maintenance costs, and ensure customer information security, this disclosure provides a searchable encryption method that supports outsourced computing and multi-user sharing, and presents a novel outsourced searchable CP-ABE encryption scheme that supports keyword semantic expansion and sorting.

[0190] First, this disclosure introduces the concept of attribute-based encryption into searchable encryption schemes, achieving efficient and secure multi-user sharing. Second, this disclosure implements semantic extension, helping users obtain data with different expressions but the same meaning. Third, this disclosure implements a result sorting function, returning data in descending order of relevance to the search keywords, improving user experience. Finally, this disclosure simultaneously achieves indistinguishability under token-selective keyword attacks and indistinguishability under adaptive ciphertext selection attacks.

[0191] Based on the methods of the above embodiments, this disclosure also provides a searchable encryption device that supports outsourced computing and multi-user sharing, which will be described below in conjunction with... Figure 9 The device is described in detail.

[0192] Figure 9 A block diagram illustrating a searchable encryption device supporting outsourced computing and multi-user sharing according to an embodiment of the present disclosure is shown.

[0193] like Figure 9 As shown, the searchable encryption device 900 supporting outsourced computing and multi-user sharing in this embodiment includes a data owner module 910, a data user module 920, a cloud server module 930, and a fog node module 940.

[0194] The data owner module 910 is used to generate public parameters and a master key based on specified security parameters; it is also used to specify the plaintext document set to be uploaded, generate a security index for the plaintext document set, encrypt the plaintext document set into a ciphertext document set according to the public parameters and the access structure of the linear secret sharing scheme; and it is also used to upload the ciphertext document set and the security index to the cloud server. In one embodiment, the data owner module 910 can be used to perform the operations S210 to S230 described above, which will not be repeated here.

[0195] The data user module 920 is used to specify the search keywords for the document to be queried, generate the corresponding search trapdoor, and send the search trapdoor to the cloud server; it is also used to determine the conversion key and private key based on the master key and its own attribute set, and send the conversion key to the fog node. The data user module 920 is also used to decrypt a portion of the decrypted ciphertext using the private key to obtain at least one target plaintext document set corresponding to the target ciphertext document. In one embodiment, the data user module 920 can be used to execute the operations S240, S260, and S280 described above, which will not be repeated here.

[0196] The cloud server module 930 is used to perform calculations on the retrieval trapdoor and security index to determine at least one target ciphertext document in the ciphertext document set, and then sort and distribute the at least one target ciphertext document to the fog node. In one embodiment, the cloud server module 930 can be used to perform the operation S250 described above, which will not be repeated here.

[0197] Fog node module 940 is used to decrypt the ciphertext document set using the conversion key, generate partially decrypted ciphertext, and send the partially decrypted ciphertext to the data user. In one embodiment, fog node module 940 can be used to perform the operation S270 described above, which will not be repeated here.

[0198] This disclosure presents a novel outsourced searchable CP-ABE encryption scheme that supports outsourced computation and multi-user sharing, utilizing a searchable encryption device that supports keyword semantic expansion and ranking. First, the concept of attribute-based encryption is introduced into the searchable encryption scheme, enabling efficient and secure multi-user sharing. Second, semantic expansion helps users obtain data with different expressions but the same meaning. Third, result ranking is implemented, sorting returned data from highest to lowest relevance to the search keywords, improving user experience. Finally, this disclosure simultaneously achieves indistinguishability under token selection keyword attacks and indistinguishability under adaptive ciphertext selection attacks.

[0199] According to embodiments of this disclosure, any plurality of modules among the data owner module 910, data user module 920, cloud server module 930, and fog node module 940 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the data owner module 910, data user module 920, cloud server module 930, and fog node module 940 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the data owner module 910, data user module 920, cloud server module 930, and fog node module 940 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0200] Figure 10 A block diagram illustrating an electronic device suitable for implementing a searchable encryption method that supports outsourced computing and multi-user sharing, according to embodiments of the present disclosure, is shown.

[0201] like Figure 10 As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0202] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that the programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0203] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0204] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement a searchable encryption method supporting outsourced computing and multi-user sharing according to embodiments of this disclosure.

[0205] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0206] Embodiments of this disclosure also provide a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the searchable encryption method supporting outsourced computing and multi-user sharing provided in embodiments of this disclosure.

[0207] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0208] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0209] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0210] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0211] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0212] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0213] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A searchable encryption method supporting outsourced computing and multi-user sharing, comprising: The data owner generates public parameters and a master key based on the specified security parameters; The data owner specifies the plaintext document set to be uploaded, generates a security index for the plaintext document set, and encrypts the plaintext document set into a ciphertext document set according to the public parameters and the access structure of the linear secret sharing scheme. The data owner uploads the encrypted document set and the security index to the cloud server; Data users specify search keywords for the documents to be queried, generate corresponding search traps, and send the search traps to the cloud server; The cloud server performs calculations on the retrieval trapdoor and the security index to determine at least one target ciphertext document in the ciphertext document set, and then sorts the at least one target ciphertext document and sends it to the fog node; The data user determines the conversion key and private key based on the master key and its own attribute set, and sends the conversion key to the fog node; The fog node uses the conversion key to decrypt the ciphertext document set, generates partially decrypted ciphertext, and sends the partially decrypted ciphertext to the data user; The data user uses the private key to decrypt the partially decrypted ciphertext to obtain a set of target plaintext documents corresponding to the at least one target ciphertext document; The fog node uses the conversion key to decrypt the ciphertext document set, generating partially decrypted ciphertext, and sends the partially decrypted ciphertext to the data user, including: Data users send their own attribute sets to the fog nodes, and the fog nodes determine whether the attribute sets have passed the access structure. In case the set of attributes is determined to pass the access structure, the fog node decrypts the set of ciphertext documents using the transformation key based on a Transform algorithm to obtain the partially decrypted ciphertext :​ in, All of these are intermediate ciphertexts of the ciphertext document set, and For digits, prime number The set of minimal nonnegative complete residue systems Random numbers in the data, For the set The stochastic index, Let be the generator, and s be the secret value to be shared. It is a bilinear mapping.

2. The method according to claim 1, wherein, The data owner generates public parameters and a master key based on specified security parameters, including: According to the specified security parameters , select a bilinear group of order , generator , and ​ based on the bilinear group , determining two hash functions , , , is a bit number; from the set of prime numbers of minimal non-negative complete residue system selecting two random exponents ; selecting step matrix , bit binary indication vector , ; Determining public parameters , , is a bilinear map; Determining a master key , .

3. The method of claim 2, wherein, The generation of the secure index for the plaintext document set includes: From plaintext document collection Extracting keyword set , For the first A plaintext document. For the first One keyword, , ; Compute a relevance score for each keyword with each plaintext document between the keywords ; Compute position weight score for each keyword in each plaintext document Compute position weight score for each keyword in each plaintext document Compute position weight score for each keyword in each plaintext document Compute position weight score for each keyword in each plaintext document According to the correlation score , position weight score and each keyword in the plaintext document , the attribution result is constructed, and the index vector is constructed ; using the bit binary indicator vector the index vector into a first vector and a second vector ; using said matrix encrypting said first vector and second vector respectively, obtaining a secure index for each plaintext document , T denotes the transpose; According to the security index of each plaintext document , the security index of the set of plaintext documents is obtained .​ 4. The method of claim 3, wherein, The index vector Including each keyword Corresponding index vector ; The relevance score , position weight score and each keyword in the plaintext document , the attribution result, construct an index vector , comprising: Judge each keyword in turn Is it a plaintext document? If the keyword is present, then confirm. Otherwise, confirm. .

5. The method of claim 4, wherein, The index vector is transformed according to the following equation Fission into first vector and second vector : wherein are each a keyword corresponding first and second vectors; are the bit binary indication vector the first bit value; is a first random number.

6. The method of claim 3, wherein, The step of encrypting the plaintext document set into a ciphertext document set based on the access structure of the public parameters and the linear secret sharing scheme includes: Obtain the common parameters and the plaintext document set Define the access structure of the linear secret sharing scheme. , for Access strategy matrix, The number of attributes included in the access strategy. The computational load required to reconstruct the secret is reflected in the amount of data required. It is a matrix Each row is mapped to the corresponding attribute The mapping function; Define a random vector , For set a k-order subset It is a secret value to be shared. for Random numbers in the data; calculation , , Representation matrix The OK, Represents secret value The Each share corresponds to the aforementioned attribute. ; According to the bilinear group , a hash function , a generator , an attribute , and a share , the plaintext document set is encrypted into a ciphertext document set.

7. The method of claim 6, wherein, The set of ciphertext documents ; Encrypt the plaintext document set into a ciphertext document set according to the following formula: wherein denotes an XOR operation; is a bilinear group is taken over the first the first .

8. The method of claim 3, wherein, The data user specifies the search keywords for the document to be queried, generating corresponding search trapdoors, including: retrieval keywords of the document to be queried performing semantic expansion to obtain an expanded keyword set , the number of expanded keywords computing the search keyword a similarity between each expansion keyword in the set of expansion keywords and the search keyword, resulting in a similarity vector According to the similarity vector, and the matching result of the keyword set With the keyword set Determine Bit retrieval vector ; using the bit binary indication vector , the bit search vector , the first sub-vector and the second sub-vector ; Using the matrix Encrypt the first sub-vector and the second sub-vector respectively to obtain the corresponding search trapdoor of the search keyword , .

9. The method of claim 8, wherein, calculating the search keyword a similarity between each extended keyword in the set of extended keywords and the search keyword, resulting in a similarity vector, comprising: calculating the search keyword with each expansion keyword in the set of expansion keywords between the search keyword and each expansion keyword, ; determining the search keyword according to the edit distance a similarity between each of the extended keywords , obtaining the similarity vector .​ 10. The method of claim 9, wherein, According to the similarity vector, and the matching result of the keyword set with the keyword set , determine bit retrieval vector , comprising: The extended keyword set is judged sequentially. Are all the keywords in the keyword set compatible with the keyword set? If the keywords in the corresponding positions match, then the retrieval vector is determined. The extended keyword set The value at the corresponding position of the keyword in the text is Otherwise, the value is set to 0.

11. The method of claim 8, wherein, According to the following formula on the bit search vector Fission: In the formula, The first sub-vector and the second sub-vector are respectively the first sub-vector and the second sub-vector. Bit value; For the Bit retrieval vector The Bit value; For the Bit-binary indicator vector The Bit value; This is the second random number.

12. The method according to claim 1, wherein, The cloud server performs calculations on the retrieval trapdoor and the security index to determine at least one target ciphertext document in the ciphertext document set, and then sorts and distributes the at least one target ciphertext document to the fog node, including: The cloud server addresses the retrieval trap and each plaintext document. Security Index Perform the inner product operation to obtain the result; Based on the calculation results, determine whether each encrypted document contains the search keyword. If it does, record the encrypted document as the target encrypted document. The at least one target ciphertext document containing the search keyword is sorted according to the operation result from large to small, and the first target ciphertext document is returned to the fog node , is an integer and 1≤ ≤ , is the total number of target ciphertext documents.

13. The method of claim 12, wherein, Based on the calculation results, determine whether each encrypted document contains the search keywords, including: When the calculation result is equal to a preset threshold, it is determined that the encrypted document contains the search keywords.

14. The method of claim 6, wherein, The attribute set includes multiple attributes describing the identity of the data user; the data user determines a conversion key and a private key based on the master key and their own attribute set, and sends the conversion key to the fog node, including: The data user randomly selects, based on the master key and the plurality of attributes , outputs wherein is a set of attributes of the data user itself; is any attribute in the set of attributes; Randomly select Let , get the conversion key and the private key : wherein is a non-zero subset of the set of non-zero subsets of the set 15. The method of claim 1, wherein, The fog node is based on the Transform algorithm and uses the transformation key. For the encrypted document set Decryption includes: Definitions , and satisfies , corresponds to a set of attributes attributes in the set is a set of attributes, is an attribute in the set . There is a set of constants such that if is a secret value then the secret value is reconstructed from the valid shares of the matrix .

16. A searchable encryption device supporting outsourced computing and multi-user sharing, comprising: The data owner module is used to generate public parameters and a master key based on specified security parameters; It is also used to specify a plaintext document set to be uploaded, generate a security index for the plaintext document set, encrypt the plaintext document set into a ciphertext document set according to the public parameters and the access structure of the linear secret sharing scheme; and is also used to upload the ciphertext document set and the security index to the cloud server. The data user module is used to specify the search keywords of the document to be queried, generate the corresponding search trap, and send the search trap to the cloud server; it is also used to determine the conversion key and private key based on the master key and its own attribute set, and send the conversion key to the fog node; The cloud server module is used to perform calculations on the retrieval trapdoor and the security index to determine at least one target ciphertext document in the ciphertext document set, and to sort the at least one target ciphertext document and send it to the fog node; The fog node module is used to decrypt the encrypted document set using the conversion key, generate partially decrypted ciphertext, and send the partially decrypted ciphertext to the data user; The fog node uses the conversion key to decrypt the ciphertext document set, generating partially decrypted ciphertext, and sends the partially decrypted ciphertext to the data user, including: Data users send their own attribute sets to the fog nodes, and the fog nodes determine whether the attribute sets have passed the access structure. If it is determined that the attribute set passes through the access structure, the fog node uses the transformation key based on the Transform algorithm. For the encrypted document set Decryption is performed to obtain the aforementioned partially decrypted ciphertext. : wherein, are intermediate ciphertexts of the set of ciphertext documents, and is a prime number, is a prime number is a random number in the set of minimal non-negative complete residue systems g is a generator, and s is a secret value to be shared, and e is a bilinear mapping. The data user module is further configured to use the private key to decrypt the partially decrypted ciphertext to obtain a set of target plaintext documents corresponding to the at least one target ciphertext document.

17. An electronic device comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 15.

18. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 15.

19. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 15.

Images