Forward and backward secure publicly verifiable multi-level dynamic searchable encryption method

Abstract

The application relates to a forward and backward secure publicly verifiable multi-level dynamic searchable encryption method, wherein the method comprises the following steps: constructing a multi-level symmetric revocable encryption primitive by using a Bloom filter and a multi-point puncturable pseudo-random function, and combining a multi-level linked list and a restricted pseudo-random function to construct a forward and Type-II backward secure multi-level dynamic symmetric searchable encryption scheme; in addition, a multi-level abstract is designed, an intelligent contract is used as a trusted platform, a multi-level verification algorithm is designed to verify a search result, if the verification is passed, a user can obtain the search result verified by the intelligent contract, and service fees are paid to a cloud server, and if the verification fails, the cloud server is fined. Therefore, the problems that the existing technology has low efficiency in ciphertext search, poor security, cannot effectively resist malicious servers and malicious users, and seriously hinders data hierarchical deployment in cloud storage are solved.

Description

Technical Field

[0001] This application relates to the field of dynamic symmetric searchable encryption technology, and in particular to a forward- and backward-secure, publicly verifiable, multi-level dynamic searchable encryption method. Background Technology

[0002] The widespread use of smart devices, mobile applications, and social media has driven a surge in data, leading to widespread concern about data management and security. Currently, to reduce local storage costs and enjoy the convenience of cloud server providers, more and more enterprises are choosing to store massive amounts of IoT data on cloud servers. However, cloud servers are vulnerable to attacks from external adversaries and sabotage by internal administrators; therefore, ensuring the confidentiality, availability, and hierarchical management of data on cloud servers is a pressing issue.

[0003] Implementing multi-level access control policies for dynamic searchable encryption can solve the aforementioned problems. Dynamic Searchable Encryption (DSE) allows data owners to encrypt files before outsourcing them to untrusted servers, enabling the servers to provide efficient ciphertext search and update services. Multi-level Access Policy (MLA) classifies users and files, with different levels of users having different access permissions, while aiming to protect the privacy of user and file access levels. Existing multi-level public-key searchable encryption schemes must perform time-consuming pairing operations during the encryption and search phases, resulting in a heavy computational burden. Multi-level dynamic symmetric searchable encryption schemes are more lightweight and efficient, but there are currently few relevant schemes, and further exploration is needed.

[0004] In recent years, those skilled in the art have been dedicated to improving the security of Dynamic Searchable Symmetric Encryption (DSSE). DSSE's data update operations allow users to add and delete files at will, but it also carries the risk of leaking additional information.

[0005] For example, when adding file f to a cloud server, it might be discovered that f contains previously searched keywords; searching for the keyword w might reveal that files containing w have been deleted. This information leakage can be exploited by file injection attacks, compromising user privacy. Forward security is widely studied because it resists powerful file injection attacks; the aforementioned keyword search and corresponding file deletion corresponds to backward security.

[0006] Backward security includes three types with decreasing security levels, as follows:

[0007] Type-I backward security: Allows disclosure of files that match the keyword w, the insertion timestamps of these files, and the total number of updates to the keyword w;

[0008] Type-II backward security: In addition to the information leaked in Type-I, it also leaks all update timestamps of w;

[0009] Type-III backward security: In addition to the information leaked in Type-II, it also leaks information about which deletion operation precisely canceled which addition operation.

[0010] All three backward security methods mentioned above can be hidden by deleting file identifiers containing "w" before searching for "w," meaning that deleted files will no longer be searched.

[0011] Currently, although some forward and backward secure single-keyword search (DSSE) schemes exist, none can achieve multi-level access control. Type I backward secure DSSE schemes are mainly based on ORAM or heavily rely on trusted hardware. However, ORAM-based schemes have excessive computational burdens, while trusted hardware-based schemes are vulnerable to side-channel attacks. Most Type II backward secure schemes require multiple rounds of interaction to achieve search / update queries, resulting in high communication costs.

[0012] Publicly verifiable search results can guarantee the correctness and integrity of search results, protecting them from malicious servers and preventing malicious users from deliberately rejecting correct results. However, most current forward and backward security DSSE solutions do not address this issue.

[0013] In summary, existing technologies for encrypted search are inefficient and insecure, making it difficult to effectively defend against malicious servers and users. This severely hinders the deployment of hierarchical data in cloud storage and fails to meet the comprehensive application requirements of multi-level access control, efficiency, security, and verifiability for encrypted search solutions in real-world applications, thus requiring urgent solutions. Summary of the Invention

[0014] This application provides a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method to address the problems of low efficiency, poor security, and difficulty in effectively resisting malicious servers and users in existing technologies, which seriously hinder the hierarchical deployment of data in cloud storage.

[0015] The first aspect of this application provides a forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption method, comprising the following steps: constructing a multi-level symmetric reversible encryption primitive based on a Bloom filter and a multi-point puncturable pseudo-random function; and using the multi-level symmetric reversible encryption primitive, combined with a multi-level linked list and a restricted pseudo-random function, generating a forward- and Type-II backward-secure multi-level dynamically symmetric searchable encryption protocol; obtaining the ciphertext index and add digest of the target add file set corresponding to each target add keyword according to the multi-level dynamically symmetric searchable encryption protocol and a preset target add keyword set; and obtaining the target delete keywords based on a preset target delete keyword set and the target delete file set corresponding to the target delete keyword set. The system performs a deletion digest corresponding to each target deletion keyword in the set, and searches for the undeletable files corresponding to each target added keyword based on the added keywords, the ciphertext index, and a preset key revocation policy to obtain encrypted files. It then performs a multiset hash calculation on the added and deleted digests using a preset trusted platform to obtain a digest hash value, and performs a multiset hash calculation on the encrypted files to obtain a search result hash value. The system verifies whether the digest hash value and the search result hash value are the same. If they are different, the verification fails; if they are the same, the verification passes, and the undeletable files corresponding to the encrypted files are sent to the target data user.

[0016] Optionally, in one embodiment of this application, obtaining the ciphertext index and add-over digest of the target file set corresponding to each target added keyword based on the multi-level dynamic symmetric searchable encryption protocol and a preset target added keyword set includes: initializing the multi-level symmetric revocable encryption primitive to obtain a multi-level system key, and incorporating the multi-level system key into the multi-level key set; simultaneously, sorting the target added file sets corresponding to each target added keyword in descending order according to a preset access level set to obtain a descending file set; constructing a target added keyword list corresponding to each target added keyword based on the multi-level key set, the descending file set, and a preset list construction strategy; encrypting the target added keyword list to obtain encrypted list data, and storing the encrypted list data in a preset storage array; constructing a mapping table based on the storage array, and generating the ciphertext index using the mapping table and the storage array; and generating the add-over digest based on the multi-level key set and the target added file set.

[0017] Optionally, in one embodiment of this application, the step of searching for the undeleted file corresponding to each target added keyword based on the added keyword, the ciphertext index, and a preset key revocation policy to obtain the encrypted file includes: generating a restricted key corresponding to each target added keyword based on the multi-point puncturable pseudo-random function, and constructing a first search token based on the restricted key; performing a preset key revocation operation based on the first search token to obtain a revocation key, and constructing a second search token based on the revocation key and the first search token; searching for the encrypted file identifier of the file to be searched corresponding to each target added keyword using the ciphertext index and the second search token; decrypting the encrypted file identifier using the revocation key; if decryption fails, the encrypted file corresponding to the file identifier has been deleted; otherwise, obtaining the plaintext identifier and obtaining the encrypted file based on the plaintext identifier.

[0018] Optionally, in one embodiment of this application, performing the preset key revocation operation includes: classifying the revocation tag set according to the access level set to obtain a multi-level revocation tag set; obtaining a revocation array based on a preset hash function set, the update algorithm of the Bloom filter, and the multi-level revocation tag set; constructing a revocation index set according to the revocation array, and calculating the revocation key corresponding to the access level set using the revocation index set and a preset initial key.

[0019] A second aspect of this application provides a forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption device, comprising: a first generation module, configured to construct a multi-level symmetric reversible encryption primitive based on a Bloom filter and a multi-point puncturable pseudo-random function, and utilize the multi-level symmetric reversible encryption primitive, combined with a multi-level linked list and a restricted pseudo-random function, to generate a forward- and Type-II backward-secure multi-level dynamically symmetric searchable encryption protocol; a second generation module, configured to obtain the ciphertext index and append digest of the target appended file set corresponding to each target appended keyword according to the multi-level dynamically symmetric searchable encryption protocol and a preset target appended keyword set; and a search module, configured to obtain the... The system generates a deletion summary for each target deletion keyword in the target deletion keyword set, and searches for undeleted files corresponding to each target added keyword based on the added keyword, the encrypted index, and a preset key revocation policy to obtain encrypted files. A verification module performs multiset hash calculations on the added and deleted summaries using a preset trusted platform to obtain a summary hash value, and performs multiset hash calculations on the encrypted files to obtain a search result hash value. The module verifies whether the summary hash value and the search result hash value are the same. If they are different, the verification fails; if they are the same, the verification passes, and the undeleted files corresponding to the encrypted files are sent to the target data user.

[0020] Optionally, in one embodiment of this application, the second generation module includes: a sorting unit, configured to initialize the multi-level symmetric revocable encryption primitives to obtain multi-level system keys, and to classify the multi-level system keys into the multi-level key set, while simultaneously sorting the target added file sets corresponding to each target added keyword in descending order according to a preset access level set to obtain a descending file set; a first construction unit, configured to construct a target added keyword list corresponding to each target added keyword based on the multi-level key set, the descending file set, and a preset list construction strategy; an encryption unit, configured to encrypt the target added keyword list to obtain encrypted list data, and to store the encrypted list data in a preset storage array; a first acquisition unit, configured to construct a mapping table based on the storage array, and to generate the ciphertext index using the mapping table and the storage array; and a second acquisition unit, configured to generate the added digest according to the multi-level key set and the target added file set.

[0021] Optionally, in one embodiment of this application, the search module includes: a second construction unit, configured to generate a restricted key corresponding to each target added keyword based on the multi-point puncturable pseudo-random function, and construct a first search token based on the restricted key; a third construction unit, configured to perform a preset key revocation operation based on the first search token to obtain a revocation key, and construct a second search token based on the revocation key and the first search token; a search unit, configured to search for the encrypted file identifier of the file to be searched corresponding to each target added keyword using the ciphertext index and the second search token; and a decryption unit, configured to decrypt the encrypted file identifier using the revocation key. If decryption fails, the encrypted file corresponding to the file identifier has been deleted; otherwise, a plaintext identifier is obtained, and the encrypted file is obtained based on the plaintext identifier.

[0022] Optionally, in one embodiment of this application, the search module further includes: a hierarchical unit, configured to hierarchically classify the revocation tag set according to the access level set to obtain a multi-level revocation tag set; a third acquisition unit, configured to acquire a revocation array based on a preset hash function set, the update algorithm of the Bloom filter, and the multi-level revocation tag set; and a calculation unit, configured to construct a revocation index set according to the revocation array, and calculate the revocation key corresponding to the access level set using the revocation index set and a preset initial key.

[0023] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method as described in the above embodiments.

[0024] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption method.

[0025] Therefore, the embodiments of this application have the following beneficial effects:

[0026] The embodiments of this application can construct multi-level symmetric revocable encryption primitives based on Bloom filters and multi-point puncturable pseudo-random functions, and use these multi-level symmetric revocable encryption primitives, combined with multi-level linked lists and restricted pseudo-random functions, to generate a multi-level dynamic symmetric searchable encryption protocol. Based on the multi-level dynamic symmetric searchable encryption protocol and a preset set of target added keywords, the ciphertext index and added digest of the target added file set corresponding to each target added keyword are obtained. Based on a preset set of target deleted keywords and the target deleted file set corresponding to the target deleted keyword set, the deletion corresponding to each target deleted keyword in the target deleted keyword set is obtained. The process involves summarizing and searching for the corresponding undeletable files for each target based on added keywords, encrypted indexes, and a preset key revocation policy, resulting in encrypted files. A multiset hash calculation is then performed on the added and deleted summaries using a preset trusted platform to obtain a summary hash value. This hash value is then applied to the encrypted files to obtain the search result hash value. The summary hash value and the search result hash value are verified. If they differ, the verification fails; if they match, the verification succeeds, and the corresponding undeletable file is sent to the target data user. This application utilizes blockchain technology as a trusted platform to achieve publicly verifiable functionality, thereby ensuring the correctness and integrity of user search results and effectively resisting malicious servers and users. This solves the problems of low efficiency, poor security, and difficulty in effectively resisting malicious servers and users in existing encrypted search technologies, which seriously hinder the hierarchical deployment of data in cloud storage.

[0027] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0028] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0029] Figure 1 This is a flowchart illustrating a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method according to an embodiment of this application;

[0030] Figure 2 A schematic diagram illustrating a specific implementation of a multi-level symmetric revocable encryption primitive (MSRE) provided for one embodiment of this application;

[0031] Figure 3 A list L provided for one embodiment of this application w,X w N w Example diagram of generation;

[0032] Figure 4 A schematic diagram of the logical architecture of a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method provided for one embodiment of this application;

[0033] Figure 5 A schematic diagram illustrating the execution logic of a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method provided for one embodiment of this application;

[0034] Figure 6 Example diagram of a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption device according to embodiments of this application;

[0035] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0036] Among them, 10-forward and backward secure public verifiable multi-level dynamic searchable encryption device, 100-first generation module, 200-second generation module, 300-search module, 400-verification module, 701-memory, 702-processor, and 703-communication interface. Detailed Implementation

[0037] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0038] The following describes a forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption method according to embodiments of this application, with reference to the accompanying drawings. As mentioned in the background art, in cloud storage systems, data and users need to be tiered, thus requiring fine-grained access control. Furthermore, malicious adversaries, i.e., untrusted cloud servers, may intentionally return incorrect or incomplete search results to save resources or conceal calculation errors; malicious users may deliberately reject correct search results to evade service fees. To address these problems, this application provides a forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption method. In this method, a multi-level symmetric revocable encryption primitive is constructed using a Bloom filter and a multi-point puncturable pseudo-random function. Based on the multi-level symmetric revocable encryption primitive, and combined with a multi-level linked list and a restricted pseudo-random function, a multi-level dynamically symmetric searchable encryption protocol is generated. According to the multi-level dynamically symmetric searchable encryption protocol and a target added keyword set, a ciphertext index and added digest of the target added file set corresponding to each target added keyword are generated. Based on a preset target deletion keyword set and the target deletion file set corresponding to the target deletion keyword set, a target deletion keyword is obtained. The process involves deleting a summary corresponding to each target deletion keyword in the keyword set, and then searching for the undeletable files corresponding to each target added keyword based on the added keywords, encrypted index, and preset key revocation policy, resulting in encrypted files. A multiset hash calculation is performed on the added and deleted summaries using a preset trusted platform to obtain a summary hash value. This is then applied to the encrypted files to obtain a search result hash value. The hash values ​​of the summary and search results are verified; if they differ, the verification fails; if they match, the verification succeeds, and the undeletable files corresponding to the encrypted files are sent to the target data user. This application utilizes blockchain technology as a trusted platform to achieve publicly verifiable functionality, thereby ensuring the correctness and integrity of user search results, effectively resisting malicious servers and users, and preventing malicious users from deliberately rejecting correct search results to evade service fees. This solves the problems of low efficiency, poor security, and difficulty in effectively resisting malicious servers and users in existing encrypted search technologies, which seriously hinder the hierarchical deployment of data in cloud storage.

[0039] Specifically, Figure 1 A flowchart illustrating a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method provided in this application embodiment.

[0040] like Figure 1 As shown, this forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption method includes the following steps:

[0041] In step S101, a multi-level symmetric revocable encryption primitive is constructed based on a Bloom filter and a multi-point puncturable pseudo-random function. Then, using the multi-level symmetric revocable encryption primitive, combined with a multi-level linked list and a restricted pseudo-random function, a multi-level dynamic symmetric searchable encryption protocol is generated.

[0042] Embodiments of this application may utilize [the following]: An array of Bloom filters (BF) and a t-puncturable PRFF. t (Multi-point puncturable pseudo-random function) Construct a multi-level symmetric revocable cryptographic primitive MSRE, which includes initialization, encryption, key revocation, and decryption operations. Figure 2 A specific implementation of MSRE is given. Represents the set of access levels The number of levels in the primitive. This primitive allows data owners to locally delete multi-level file identifiers with minimal storage overhead, and MSRE can protect access-level privacy, satisfying choice security; furthermore, by utilizing MSRE, any forward-secure multi-level DSSE scheme can be constructed as a forward-secure and Type-II backward-secure scheme.

[0043] Based on MSRE, the embodiments of this application use multi-level linked lists and restricted pseudo-random functions to generate a multi-level dynamic symmetric searchable encryption protocol that satisfies forward and Type-II backward security, and name it Peony++. Peony++ not only supports efficient updates and searches within a single round of communication, but also has low communication load.

[0044] Therefore, the embodiments of this application provide reliable support for subsequent operations such as efficient and secure ciphertext search by constructing multi-level symmetric revocable encryption primitives and forward and Type-II backward secure multi-level dynamic symmetric searchable encryption protocols.

[0045] In step S102, the ciphertext index and added digest of the target added file set corresponding to each target added keyword are obtained according to the multi-level dynamic symmetric searchable encryption protocol and the preset target added keyword set.

[0046] After obtaining the multi-level dynamic symmetric searchable encryption protocol, the embodiments of this application further perform an initialization operation on the multi-level dynamic symmetric searchable encryption protocol. Specifically, the embodiments of this application can determine the access level set by formulating a multi-level access control policy through a management center. and for all levels Generate the corresponding symmetric key k l , forming a hierarchical key set The management center generates a key K for the data owner. TIt authorizes data owners to classify files, with the data owner holding a set of hierarchical keys. The management center classifies data users, and each user has a key k corresponding to their access level. l The server initializes the key-value pair data structure EDB. cache Empty, and define a restricted pseudo-random function.

[0047] As one possible implementation method, embodiments of this application can input a security parameter λ, where λ takes the value 256, and output the corresponding key and the initialized data structure. Specifically, embodiments of this application can formulate a multi-level access control policy through a management center, which includes an access level mapping function α. ​​When the access level α(u) of user u is lower than the access level α(f) of file f, u cannot access f; the administrator generates and updates the status {st1,st2,…,st n}, where n is the upper limit for the number of updates; determine the set of access levels. and for all levels Generate the corresponding hierarchical key k l ←{0,1} λ This constitutes a hierarchical key set. The management center generates a key K for the data owner. T Authorized data owner O assigns a classification to the file, and data owner O obtains the key K. O In addition, the administrator classifies users into different levels, and each user has a key k corresponding to their access level l. l ; It is a restricted pseudo-random function. Includes two algorithms and

[0048] After initializing the multi-level dynamic symmetric searchable encryption protocol, embodiments of this application can also allow the data owner to input D. w And update batch c, to output the target add keyword w corresponding to the target add file set corresponding to the list L w ,X w N w .

[0049] Then, the data owner can execute the process to add the file set to be added (i.e., the target file set). Update count c and hierarchical key set Generate Ciphertext Index And the corresponding verification evidence (i.e., adding a digest) prooflist, and the generated ciphertext index. Upload the evidence (i.e., add a summary) with the corresponding tag-summary structure to the cloud server and send it to the blockchain to provide verification basis for subsequent searches.

[0050] Optionally, in one embodiment of this application, obtaining the ciphertext index and add-over digest of the target add-over file set corresponding to each target add-over keyword according to a multi-level dynamic symmetric searchable encryption protocol and a preset target add-over keyword set includes: initializing multi-level symmetric revocable encryption primitives to obtain multi-level system keys, and classifying the multi-level system keys into a multi-level key set; simultaneously, sorting the target add-over file set corresponding to each target add-over keyword in descending order according to a preset access level set to obtain a descending file set; constructing a target add-over keyword list corresponding to each target add-over keyword based on the multi-level key set, the descending file set, and a preset list construction strategy; encrypting the target add-over keyword list to obtain encrypted list data, and storing the encrypted list data in a preset storage array; constructing a mapping table based on the storage array, and generating a ciphertext index using the mapping table and the storage array; and generating an add-over digest according to the multi-level key set and the target add-over file set.

[0051] In actual implementation, embodiments of this application first require inputting a security parameter λ and an integer. and access level set The multi-level symmetric revocable encryption primitives are initialized to output the multi-level system key lsk. The specific initialization process for the multi-level symmetric revocable encryption primitives is as follows:

[0052] 1. Call t-puncturable PRFF t The initialization algorithm is used to obtain the key sk←F t .Setup(1 λ );

[0053] 2. Use the Bloom filter initialization algorithm BF.Gen to obtain a set of general hash functions. For domain And array B1. That is... In addition, settings A set of arrays, each a copy of B1. h is a set of hash functions The number of hash functions in array B, where b is the number of bits in array B;

[0054] 3. Multi-level system keys

[0055] Furthermore, embodiments of this application can add a set of files by having the data owner O input the target keyword w. The update count c and the multi-level system key set LSK, output list L w ,X w N w ,like Figure 3 As shown, the specific process is as follows:

[0056] 1. lsk←LSK[w], if lsk is empty, then perform the initialization phase of the multi-level symmetric revocable encryption primitive. Generate a multi-level system key lsk for the keyword w;

[0057] 2. Initialization list L w X w N w This is an empty table; initialize L to 1 and loc to 0. All file identifiers are arranged in descending order according to their corresponding access levels;

[0058] 3. To Each file identifier id j Perform the following steps:

[0059] 1) loc = loc + 1, calculate the label Here F is a PRF function, K t For the key;

[0060] 2) Execute the MSRE encryption algorithm to obtain ct←MSRE.Enc(lsk,id) j ,α(id j ),t);

[0061] 3)L w =L w ∪(ct,t);

[0062] 4) If α(id) j If X = l, then let X w =X w ∪loc, l = l + 1;

[0063] 5) Randomly select non-repeating locations.

[0064] 6)N w =N w ∪addr j .

[0065] 4. Return to list L w X w N w .

[0066] It should be noted that, in the embodiments of this application, a multi-level system key lsk and an access level α(id) can be input.j ) file identifier id j File identifier id j The label t is used to output the ciphertext ct, thereby completing the MSRE encryption operation, which specifically includes the following steps:

[0067] 1. Call the hash function H to calculate j i =H i (t)∈[b]. Call the PRF function to calculate... For all i∈[h]; here F is a PRF function, and sk is the key;

[0068] 2. Calculate the file identifier id j ciphertext For all i∈h, output the ciphertext ct=(ct1,ct2,…,ct h ) and the tag t.

[0069] After obtaining list L w X w N w Furthermore, embodiments of this application can also add a set of keywords by having the data owner O input the target. Add corresponding target file sets Update c times to output the encrypted index. in, Contains array and mapping table Specifically, embodiments of this application may add a set of keywords to the target. Add keywords to each target in the w i Perform the following operations:

[0070] 1. For the keyword w i file set Generate list

[0071] 2. List Encrypted and stored in an array In the middle, list Each entry exist The index in is storage address For each Generate a random number Each entry contains The file identifier id, the address of the next node (i.e., and for decrypting arrays The key of the next node (i.e., Finally, use the output value of the hash function. Encrypt this entry; combine the encrypted value with r j Store in array In other words, this step can be achieved by... when When, it indicates For the keyword w i The corresponding last ciphertext-tag pair (ct, t). In this case, let

[0072] 3. Mapping table The entries in the array Each keyword w i The address of the first node for each access level l of the corresponding file identifier; using The output value of the mapping table Each item in the array is encrypted, and the index value of the encrypted item is... Right now If the keyword is w i If there is no file identifier at the level l, then When user u1 with access level l1 queries keyword w1, the query result can be obtained and decrypted. Entries, thus allowing access to the array The decryption keys for all subsequent nodes are contained in the first node corresponding to level l1. Therefore, user u1 can access data at levels l1, l2, and l3. Here, in the embodiments of this application, the levels can be set as l1>l2>l3. Unauthorized users will only obtain ⊥. It should be noted that the update status st of different update batches... c Unlike other users, users who can only access the currently updated c times data only possess {st1, st2, ..., st c If the data is not updated in the (c+1)th iteration, then forward safety is guaranteed;

[0073] 4. The data owner (DO) will update the security index. Send to the server;

[0074] 5. To generate verification evidence for updated data, embodiments of this application may add a set of keywords to the target. Add keywords to each target in the w i The corresponding target file is added and the following calculations are performed:

[0075] For any calculate It is a file encrypted using the AES algorithm;

[0076] 6. Send all prooflists to the blockchain and deploy them on trusted platforms such as smart contracts.

[0077] Therefore, the embodiments of this application generate encrypted indexes and add digests by adding data such as target file sets, thereby providing reliable data support for subsequent file search and other operations.

[0078] In step S103, based on the preset target deletion keyword set and the target deletion file set corresponding to the target deletion keyword set, a deletion summary corresponding to each target deletion keyword in the target deletion keyword set is obtained. Then, according to each target added keyword, the ciphertext index and the preset key revocation policy, the files corresponding to each target added keyword that have not been deleted are searched to obtain the encrypted file.

[0079] Furthermore, embodiments of this application allow the data owner to input the master key (MSK) and the target deletion keyword set locally. and its corresponding target file set to be deleted Output the array corresponding to each target deletion keyword w. And delete summary.

[0080] Furthermore, embodiments of this application also require the generation of a partial search token tk through data user u. w,α(u) The key is sent to data owner O, who then generates a revocation key according to a preset key revocation policy. This constitutes a complete search token. The data is sent to server S, and at the same time, the data owner O sends a verification message to the blockchain. After receiving the search query from the data owner, cloud server S starts the search service. Cloud server S uses the complete search token sent by O to filter out deleted files and sends the files that have not been deleted corresponding to the keyword w to the blockchain, thereby efficiently completing the file search operation.

[0081] Optionally, in one embodiment of this application, searching for the non-deleted file corresponding to each target added keyword based on each target added keyword, a ciphertext index, and a preset key revocation policy to obtain an encrypted file includes: generating a restricted key corresponding to each target added keyword based on a multi-point puncturable pseudo-random function, and constructing a first search token based on the restricted key; performing a preset key revocation operation based on the first search token to obtain a revocation key, and constructing a second search token based on the revocation key and the first search token; searching for the encrypted file identifier of the file to be searched corresponding to each target added keyword using the ciphertext index and the second search token; decrypting the encrypted file identifier using the revocation key; if decryption fails, the encrypted file corresponding to the file identifier has been deleted; otherwise, obtaining the plaintext identifier and obtaining the encrypted file based on the plaintext identifier.

[0082] It should be noted that, in the embodiments of this application, the target deletion keyword set is input by the data owner O. Corresponding target file set to be deleted The corresponding set of undo tags R, and the set of access levels corresponding to R. And a multi-level system key set LSK to output deletion digests. Specifically, the target set of deleted keywords Each target keyword to delete in the w i The following calculations are performed on the target files to be deleted:

[0083] 1) Get lsk←LSK[w i ],here

[0084] 2) Enter lsk, Perform the key revocation operation on MSRE and output the new key. And the new And sk put back into LSK[w i ]middle;

[0085] 3) For any Perform the following calculations:

[0086] if So

[0087] otherwise,

[0088] Furthermore, such as Figure 4 As shown, embodiments of this application can also be based on data users, data owners, and servers, by inputting a key k. α(u) Add target keyword w, multi-level system key lsk, ciphertext index To output search results The specific execution process is as follows:

[0089] Performed by the data user:

[0090] 1. Use a restricted pseudo-random function to generate a restricted key corresponding to the keyword w. Constitutes the search token tk w,α(u) (i.e., the first search token) is sent to the data owner O.

[0091] Performed by the data owner:

[0092] 1. Input sj, executes the key revocation phase of MSRE, and obtains And (i.e., the second search token) is sent to the server;

[0093] 2. If So,

[0094] 3. If So,

[0095] 4. Send to the blockchain.

[0096] Executed by the server:

[0097] 1. Initialize NewId, DelId is empty;

[0098] 2. For each update batch h, 1≤h≤c, perform the following operations:

[0099] 1) Calculate using a restricted pseudo-random function.

[0100] 2) Used for positioning The relevant entries in [the document / section]. If [the document / section] is relevant to the [theme / entity]. Return to ⊥ and end the process;

[0101] 3) Order Here, Used for decryption

[0102] 4) If v2 ≠ 0, then continue the following operations until v2 = 0.

[0103] Analysis Let (z1, z2) be the coordinates; Analysis for

[0104] Input v1 and Use MSRE's decryption algorithm to obtain the ID. j ;

[0105] If id j ≠⊥, then

[0106] If id j =⊥, then DelId←DelId∪{id j ,t j};

[0107] 3. Remove the deleted file ID and its corresponding tag t from EDB. cache [tk w,α(u) Remove, then EDBcache [tk w,α(u) Place it in OldId, that is

[0108] 4. Remove the deleted file ID and its corresponding tag t from NewId. That is,

[0109] 5. Merge Newld and Delld And make

[0110] 6. The corresponding encrypted file is sent to the blockchain.

[0111] Therefore, the embodiments of this application obtain reliable search data by having data users, data owners, and cloud servers perform corresponding operations respectively, thereby effectively ensuring the efficiency of search and updates.

[0112] Optionally, in one embodiment of this application, performing a preset key revocation operation includes: classifying the revocation tag set according to the access level set to obtain a multi-level revocation tag set; obtaining a revocation array based on a preset hash function set, a Bloom filter update algorithm, and the multi-level revocation tag set; constructing a revocation index set based on the revocation array, and calculating the revocation key corresponding to the access level set using the revocation index set and a preset initial key.

[0113] It should be noted that, in the embodiments of this application, the access level can be determined by inputting the multi-level system key lsk, the revocation tag list R, and the access level corresponding to R. The revocation key sk of output R R This completes the key revocation operation for MSRE. The specific steps are as follows:

[0114] 1. Based on access level set Hierarchical classification of the undo tag list R yields {R1, R2, ..., R...} lmax}, l mαx This is the highest level in R;

[0115] 2. Input a set of hash functions l-level array B l Level L Cancel List R l Call the Bloom filter update algorithm BF.Upd for all l∈{1,2,…,l} max},calculate The specific process is as follows: Let it be 1; furthermore, for all levels ξ greater than l, let all =1,

[0116] 3. Find the index set Then calculate make

[0117] Furthermore, embodiments of this application can also utilize a revocation key corresponding to a given access level l. Ciphertext ct = (ct1, ct2, ..., ct h The process involves outputting the plaintext file identifier (id) to complete the MSRE decryption operation. The specific steps are as follows:

[0118] 1. Check if If the value is 1, then decryption failed. Otherwise, proceed to the next step.

[0119] 2. Find index j * ∈b, such that Then generate

[0120] 3. Recovery Dec is the AES decryption algorithm.

[0121] Therefore, the embodiments of this application can introduce the cryptographic primitive MSRE and provide an important basis for constructing a Type-II backward security multi-level DSSE scheme through operation steps such as initialization, encryption, key revocation and decryption.

[0122] In step S104, multiset hash calculation is performed on the add digest and delete digest according to the preset trusted platform to obtain the digest hash value, and multiset hash calculation is performed on the encrypted file to obtain the search result hash value. The digest hash value and the search result hash value are verified to be the same. If the digest hash value and the search result hash value are different, the verification fails. If the digest hash value and the search result hash value are the same, the verification passes, and the file corresponding to the encrypted file that has not been deleted is sent to the target data user.

[0123] Furthermore, embodiments of this application can also receive encrypted files sent by the server and verification messages sent by the data owner O via a smart contract, and invoke a verification algorithm for verification, such as... Figure 5 As shown, if the verification is successful, the user can obtain the verified search results from the smart contract and pay a service fee to the cloud server; if the verification fails, the cloud server will be fined.

[0124] Specifically, embodiments of this application input search results via blockchain. The corresponding file, adding a digest prooflist, and deleting a digest. The system outputs the verified result. If the verification passes, it outputs "Accept," and the data user can retrieve the verified result from the blockchain. If the verification fails, it outputs "Reject." The specific verification process is as follows:

[0125] 1. Perform a multiset hash calculation on the ciphertext sent by the server to obtain... It is an encrypted file;

[0126] 2. Adding and deleting summary prooflists. Perform multiset hash calculation to obtain

[0127] 3. If Output Accept and The corresponding encrypted file is sent to the data user, and the search service fee is sent to the server; otherwise, a "Reject" message is output, and the relevant fees are deducted from the server's account.

[0128] In summary, this application introduces multi-level symmetric revocable encryption primitives and considers the computationally lightweight nature of dynamic symmetric searchable encryption, which is more practical for cloud storage systems. Therefore, based on MSRE, a novel forward- and Type-II backward-secure multi-level DSSE scheme, Peony++, is constructed using multi-level linked lists and restricted pseudo-random functions. Furthermore, by designing multi-level digests and utilizing trusted platforms such as smart contracts as trusted platforms, this application supports public verification of Peony++, protecting user and file access level privacy while satisfying both forward and backward security. This enables Peony++ to simultaneously achieve efficiency and verifiability, realizing a forward- and backward-secure multi-level dynamic DSSE scheme.

[0129] It is understandable that Peony++, the verifiable multi-level dynamic searchable encryption scheme of this application, is currently the most secure multi-level DSSE scheme. It achieves public verifiability by designing multi-level digests and utilizing smart contracts as a trusted platform to support public verifiability, resisting malicious users and servers. Therefore, this application, considering security, fine-grained access control capabilities, and verifiability, effectively guarantees high search efficiency, high update efficiency, and low communication load, and has high practical application value.

[0130] According to the forward- and backward-secure publicly verifiable multi-level dynamic searchable encryption method proposed in this application, a multi-level symmetric revocable encryption primitive is constructed based on a Bloom filter and a multi-point puncturable pseudo-random function. This multi-level symmetric revocable encryption primitive, combined with a multi-level linked list and a restricted pseudo-random function, generates a multi-level dynamic symmetric searchable encryption protocol. Based on the multi-level dynamic symmetric searchable encryption protocol and a preset target keyword set, the ciphertext index and added digest of the target added file set corresponding to each target added keyword are obtained. Based on a preset target deletion keyword set and the target deletion file set corresponding to the target deletion keyword set, a target deletion keyword set is obtained. The process involves deleting a summary corresponding to each target's deleted keyword, and then searching for the undeletable files corresponding to each target's added keywords based on the added keywords, encrypted index, and a preset key revocation policy, resulting in encrypted files. A multiset hash calculation is performed on the added and deleted summaries using a preset trusted platform to obtain a summary hash value. This is then applied to the encrypted files to obtain a search result hash value. The process verifies whether the summary hash value and the search result hash value are the same. If they are different, the verification fails; if they are the same, the verification succeeds, and the undeletable files corresponding to the encrypted files are sent to the target data user. This application utilizes blockchain technology as a trusted platform to achieve publicly verifiable functionality, thereby ensuring the correctness and integrity of user search results and effectively resisting malicious servers and users.

[0131] Secondly, with reference to the accompanying drawings, a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption device according to embodiments of this application is described.

[0132] Figure 6 This is a block diagram of a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption device according to an embodiment of this application.

[0133] like Figure 6 As shown, the forward and backward secure public verifiable multi-level dynamic searchable encryption device 10 includes: a first generation module 100, a second generation module 200, a search module 300, and a verification module 400.

[0134] The first generation module 100 is used to construct a multi-level symmetric revocable encryption primitive based on a Bloom filter and a multi-point puncturable pseudo-random function, and to generate a multi-level dynamic symmetric searchable encryption protocol by using the multi-level symmetric revocable encryption primitive, combined with a multi-level linked list and a restricted pseudo-random function.

[0135] The second generation module 200 is used to obtain the ciphertext index and added summary of the target added file set corresponding to each target added keyword based on the multi-level dynamic symmetric searchable encryption protocol and the preset target added keyword set.

[0136] The search module 300 is used to obtain a deletion summary corresponding to each target deletion keyword in the target deletion keyword set based on a preset target deletion keyword set and a target deletion file set corresponding to the target deletion keyword set. It then searches for the files that have not been deleted corresponding to each target added keyword according to each target added keyword, the encrypted index, and a preset key revocation policy, and obtains the encrypted file.

[0137] The verification module 400 is used to perform multiset hash calculations on the add and delete summaries according to a preset trusted platform to obtain the summary hash value, and to perform multiset hash calculations on the encrypted file to obtain the search result hash value. It also verifies whether the summary hash value and the search result hash value are the same. If the summary hash value and the search result hash value are different, the verification fails. If the summary hash value and the search result hash value are the same, the verification passes, and the file corresponding to the encrypted file that has not been deleted is sent to the target data user.

[0138] Optionally, in one embodiment of this application, the second generation module 200 includes: an arrangement unit, a first construction unit, an encryption unit, a first acquisition unit, and a second acquisition unit.

[0139] The permutation unit is used to initialize multi-level symmetric revocable encryption primitives, obtain multi-level system keys, and classify the multi-level system keys into the multi-level key set. At the same time, it sorts the target file sets corresponding to each target keyword in descending order according to the preset access level set, thus obtaining a descending file set.

[0140] The first construction unit is used to construct a list of target keywords corresponding to each target keyword based on a multi-level key set, a descending file set, and a preset list construction strategy.

[0141] The encryption unit is used to encrypt the target keyword list, obtain the encrypted list data, and store the encrypted list data in a preset storage array.

[0142] The first acquisition unit is used to construct a mapping table based on the storage array, and to generate a ciphertext index using the mapping table and the storage array.

[0143] The second acquisition unit is used to generate an add digest based on the multi-level key set and the target add file set.

[0144] Optionally, in one embodiment of this application, the search module 300 includes: a second construction unit, a third construction unit, a search unit, and a decryption unit.

[0145] The second construction unit is used to generate a restricted key corresponding to the keyword added to each target based on a multi-point puncturable pseudo-random function, and to construct a first search token based on the restricted key.

[0146] The third building unit is used to perform a preset key revocation operation based on the first search token to obtain the revocation key, and to build a second search token based on the revocation key and the first search token.

[0147] The search unit is used to search for the encrypted file identifier of the file to be searched corresponding to the keywords added to each target, using a ciphertext index and a second search token.

[0148] The decryption unit is used to decrypt the encrypted file identifier using the revocation key. If decryption fails, the encrypted file corresponding to the file identifier has been deleted; otherwise, the plaintext identifier is obtained, and the encrypted file is obtained based on the plaintext identifier.

[0149] Optionally, in one embodiment of this application, the search module 300 further includes: a hierarchical unit, a third acquisition unit, and a calculation unit.

[0150] The hierarchical unit is used to classify the revocation label set according to the access level set to obtain a multi-level revocation label set.

[0151] The third acquisition unit is used to acquire the cancellation array based on a preset set of hash functions, a Bloom filter update algorithm, and a multi-level cancellation tag set.

[0152] The calculation unit is used to construct a set of revocation indices based on the revocation array, and to calculate the revocation key corresponding to the set of access levels using the set of revocation indices and the preset initial key.

[0153] It should be noted that the foregoing explanation of the embodiments of the forward and backward secure public verifiable multi-level dynamic searchable encryption method also applies to the forward and backward secure public verifiable multi-level dynamic searchable encryption device of this embodiment, and will not be repeated here.

[0154] The forward- and backward-secure, publicly verifiable, multi-level dynamically searchable encryption device proposed in this application includes a first generation module for constructing a multi-level symmetric reversible encryption primitive based on a Bloom filter and a multi-point puncturable pseudo-random function, and generating a multi-level dynamically symmetric searchable encryption protocol using the multi-level symmetric reversible encryption primitive combined with a multi-level linked list and a restricted pseudo-random function; a second generation module for obtaining the ciphertext index and added digest of the target added file set corresponding to each target added keyword based on the multi-level dynamically symmetric searchable encryption protocol and a preset target added keyword set; and a search module for obtaining the target deleted file set corresponding to the target deleted keyword set based on a preset target deleted keyword set. The system retrieves a deletion summary for each target deletion keyword in the target deletion keyword set. Based on each target added keyword, encrypted index, and a preset key revocation policy, it searches for the undeletable file corresponding to each target added keyword to obtain an encrypted file. A verification module performs multiset hash calculations on the added and deleted summaries using a preset trusted platform to obtain a summary hash value. It then performs a multiset hash calculation on the encrypted file to obtain a search result hash value. The module verifies whether the summary hash value and the search result hash value are the same. If they are different, the verification fails; if they are the same, the verification succeeds, and the undeletable file corresponding to the encrypted file is sent to the target data user. This application utilizes blockchain technology as a trusted platform to achieve publicly verifiable functionality, thereby ensuring the correctness and integrity of user search results and effectively resisting malicious servers and users.

[0155] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0156] The memory 701, the processor 702, and the computer program stored on the memory 701 and executable on the processor 702.

[0157] When the processor 702 executes the program, it implements the forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method provided in the above embodiments.

[0158] Furthermore, electronic devices also include:

[0159] Communication interface 703 is used for communication between memory 701 and processor 702.

[0160] The memory 701 is used to store computer programs that can run on the processor 702.

[0161] The memory 701 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0162] If the memory 701, processor 702, and communication interface 703 are implemented independently, then the communication interface 703, memory 701, and processor 702 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0163] Optionally, in a specific implementation, if the memory 701, processor 702, and communication interface 703 are integrated on a single chip, then the memory 701, processor 702, and communication interface 703 can communicate with each other through an internal interface.

[0164] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0165] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method.

[0166] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0167] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0168] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0169] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0170] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0171] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0172] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0173] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method, characterized in that, Includes the following steps: Based on Bloom filters and multi-point puncturable pseudo-random functions, a multi-level symmetric revocable encryption primitive is constructed. Using the multi-level symmetric revocable encryption primitive, combined with multi-level linked lists and restricted pseudo-random functions, a forward- and Type-II backward-secure multi-level dynamic symmetric searchable encryption protocol is generated. Based on the multi-level dynamic symmetric searchable encryption protocol and the preset target keyword set, obtain the ciphertext index and added digest of the target added file set corresponding to each target added keyword; Based on a preset set of target deletion keywords and a set of target deletion files corresponding to the set of target deletion keywords, a deletion summary corresponding to each target deletion keyword in the set of target deletion keywords is obtained. Then, according to each target added keyword, the ciphertext index and a preset key revocation policy, the files corresponding to each target added keyword that have not been deleted are searched to obtain the encrypted file. The system performs multiset hash calculations on the added and deleted digests using a preset trusted platform to obtain a digest hash value. It then performs a multiset hash calculation on the encrypted file to obtain a search result hash value. The system verifies whether the digest hash value and the search result hash value are the same. If they are different, the verification fails; if they are the same, the verification passes, and the corresponding undeleted file is sent to the target data user.

2. The method according to claim 1, characterized in that, The step of obtaining the ciphertext index and added digest of the target added file set corresponding to each target added keyword based on the multi-level dynamic symmetric searchable encryption protocol and the preset target added keyword set includes: Initialize the multi-level symmetric revocable encryption primitives to obtain multi-level system keys, and include the multi-level system keys in the multi-level key set. At the same time, sort the target file sets corresponding to each target keyword in descending order according to the preset access level set to obtain a descending file set. Based on the multi-level key set, the descending file set, and the preset list construction strategy, a target keyword list corresponding to each target keyword is constructed. Encrypt the target keyword list to obtain encrypted list data, and store the encrypted list data in a preset storage array; A mapping table is constructed based on the storage array, and the ciphertext index is generated using the mapping table and the storage array; The added digest is generated based on the multi-level key set and the target added file set.

3. The method according to claim 2, characterized in that, The process of searching for the non-deleted files corresponding to the added keywords for each target, the ciphertext index, and the preset key revocation policy to obtain encrypted files includes: Based on the multi-point puncturable pseudo-random function, a restricted key corresponding to the keyword added to each target is generated, and a first search token is constructed based on the restricted key; Based on the first search token, a preset key revocation operation is performed to obtain a revocation key, and a second search token is constructed based on the revocation key and the first search token; The encrypted file identifier corresponding to the added keyword for each target is searched using the ciphertext index and the second search token. The encrypted file identifier is decrypted using the revocation key. If decryption fails, the encrypted file corresponding to the file identifier has been deleted. Otherwise, the plaintext identifier is obtained, and the encrypted file is obtained based on the plaintext identifier.

4. The method according to claim 3, characterized in that, The execution of the preset key revocation operation includes: The set of revocation labels is classified according to the set of access levels to obtain a multi-level set of revocation labels; Based on the preset set of hash functions, the update algorithm of the Bloom filter, and the multi-level revocation tag set, the revocation array is obtained; A revocation index set is constructed based on the revocation array, and the revocation key corresponding to the access level set is calculated using the revocation index set and the preset initial key.

5. A forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption device, characterized in that, include: The first generation module is used to construct a multi-level symmetric revocable encryption primitive based on a Bloom filter and a multi-point puncturable pseudo-random function, and use the multi-level symmetric revocable encryption primitive, combined with a multi-level linked list and a restricted pseudo-random function, to generate a forward- and Type-II backward-secure multi-level dynamic symmetric searchable encryption protocol. The second generation module is used to obtain the ciphertext index and added digest of the target added file set corresponding to each target added keyword according to the multi-level dynamic symmetric searchable encryption protocol and the preset target added keyword set; The search module is used to obtain a deletion summary corresponding to each target deletion keyword in the target deletion keyword set based on a preset set of target deletion keywords and a set of target deletion files corresponding to the set of target deletion keywords, and to search for the files that have not been deleted corresponding to each target added keyword according to each target added keyword, the ciphertext index and a preset key revocation policy, so as to obtain the encrypted file. The verification module is used to perform multiset hash calculations on the added digest and the deleted digest according to a preset trusted platform to obtain a digest hash value, and to perform multiset hash calculations on the encrypted file to obtain a search result hash value. It also verifies whether the digest hash value and the search result hash value are the same. If the digest hash value and the search result hash value are different, the verification fails. If the digest hash value and the search result hash value are the same, the verification passes, and the file corresponding to the encrypted file that has not been deleted is sent to the target data user.

6. The apparatus according to claim 5, characterized in that, The second generation module includes: The arrangement unit is used to initialize the multi-level symmetric revocable encryption primitives, obtain the multi-level system key, and classify the multi-level system key into the multi-level key set. At the same time, it sorts the target added file set corresponding to each target added keyword in descending order according to the preset access level set to obtain the descending file set. The first construction unit is used to construct a target keyword list corresponding to each target keyword based on the multi-level key set, the descending file set, and the preset list construction strategy. An encryption unit is used to encrypt the target keyword list, obtain encrypted list data, and store the encrypted list data in a preset storage array; The first acquisition unit is used to construct a mapping table based on the storage array, and to generate the ciphertext index using the mapping table and the storage array; The second acquisition unit is used to generate the addition digest based on the multi-level key set and the target addition file set.

7. The apparatus according to claim 6, characterized in that, The search module includes: The second construction unit is used to generate a restricted key corresponding to each target added keyword based on the multi-point puncturable pseudo-random function, and to construct a first search token based on the restricted key; The third construction unit is used to perform a preset key revocation operation based on the first search token to obtain a revocation key, and to construct a second search token based on the revocation key and the first search token; The search unit is used to search for the encrypted file identifier of the file to be searched corresponding to each target added keyword by means of the ciphertext index and the second search token; The decryption unit is used to decrypt the encrypted file identifier using the revocation key. If decryption fails, the encrypted file corresponding to the file identifier has been deleted; otherwise, the plaintext identifier is obtained, and the encrypted file is obtained based on the plaintext identifier.

8. The apparatus according to claim 7, characterized in that, The search module also includes: A hierarchical unit is used to hierarchically classify the revocation tag set according to the access level set to obtain a multi-level revocation tag set; The third acquisition unit is used to acquire the cancellation array based on a preset set of hash functions, the update algorithm of the Bloom filter, and the multi-level cancellation tag set; The calculation unit is used to construct a revocation index set based on the revocation array, and to calculate the revocation key corresponding to the access level set using the revocation index set and the preset initial key.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable encryption method as described in any one of claims 1-4.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement a forward- and backward-secure, publicly verifiable, multi-level, dynamically searchable cryptographic method as described in any one of claims 1-4.

Images