Method and apparatus for ciphertext data search, computer
By constructing keyword ciphertext and range search trapdoors, and using the administrator's key and the sender's key to search for ciphertext data, the problem of insufficient security in existing technologies is solved, and the security of searchable encryption technology is improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUILIN UNIV OF ELECTRONIC TECH
- Filing Date
- 2023-11-15
- Publication Date
- 2026-06-09
Smart Images
Figure CN117668896B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of encrypted search technology, such as a method, apparatus, and computer for searching encrypted data. Background Technology
[0002] Searchable encryption is an emerging method for ciphertext retrieval. It encrypts data and stores it in the cloud without exposing the plaintext, then allows for retrieval of the encrypted data. From a cryptographic perspective, it can be mainly divided into two categories: symmetric searchable encryption and public-key searchable encryption. Public-key searchable encryption primarily utilizes intractable problems in its design.
[0003] Public-key searchable encryption technology involves basic operations including initialization, encrypting data with the public key, generating a trapdoor with the private key, and searching. In public-key searchable encryption, the encryption and decryption process uses the public key to encrypt plaintext information and retrieve the target ciphertext, and uses the private key to decrypt the ciphertext information and generate a keyword trapdoor.
[0004] In existing public-key searchable encryption technologies, the security is insufficient because only the public key is used to encrypt data and only the private key is used to generate trapdoors. This makes it easy for unauthorized users to generate trapdoors and obtain encrypted data from cloud servers.
[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention
[0006] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.
[0007] This disclosure provides a method, apparatus, and computer for searching encrypted data, which can improve the security of searchable encryption technologies.
[0008] In some embodiments, the method for searching encrypted data includes: a method for searching encrypted data, comprising: upon receiving search information, obtaining system parameters, an administrator key, and a sender key; constructing keyword ciphertext based on numerical keywords of the document to be searched, the system parameters, the administrator key, and the sender key; constructing a range search trapdoor based on the search information, the system parameters, the administrator key, and the sender key; and performing a data search on the document to be searched based on the keyword ciphertext and the range search trapdoor to obtain target encrypted data matching the search information.
[0009] Optionally, the administrator key includes the administrator public key, the sender key includes the sender private key, and the system parameters include relevant parameters of the group G, where G is a group of order p and p is a large prime number;
[0010] Construct the key ciphertext using the following expression:
[0011] and
[0012] Among them, CT w The key is encrypted. Let g be the lower limit of the ciphertext for the key, w0 be the numeric key, W0 be the set of zero codes for w0, and C1 be the upper limit of the ciphertext for the key, where C1 = g. r , g is a generator of group G, PK A For the administrator's public key and SK S For the sender's private key and SK S =y, r and y are from Z p A number randomly selected from Z p It is a p-order finite field.
[0013] Optionally, the administrator key includes the administrator's private key, the sender key includes the sender's public key, the search information includes the search range, and the system parameters include the relevant parameters of the group G, where G is a p-order group and p is a large prime number;
[0014] Construct a range search trapdoor using the following expression:
[0015]
[0016] Where TR stands for range search trapdoor.
[0017] SK A For the administrator's private key and PK S The sender's public key and PK S =g y Let g be a generator of group G, and r1, r2, r3, r4 and y be generators of group Z. p A number randomly selected from Z p It is a p-order finite field.
[0018] Optionally, a data search is performed on the document to be searched based on the keyword ciphertext and the range search trapdoor to obtain target ciphertext data that matches the search information. This includes: determining the matching numerical keyword corresponding to the keyword ciphertext, and the data search range corresponding to the matching numerical keyword; determining a first target search range within the data search range that is greater than the lower limit of the range search trapdoor threshold and less than the upper limit of the range search trapdoor threshold; using the numerical keyword corresponding to the first target search range as the target keyword; and using the data in the document to be searched that satisfies the target keyword as the target ciphertext data.
[0019] Optionally, a data search is performed on the document to be searched based on the keyword ciphertext and the range search trapdoor to obtain target ciphertext data that matches the search information, including: obtaining a target historical search trapdoor that matches the range search trapdoor; determining the target ciphertext index in the historical ciphertext index set that corresponds to the target historical search trapdoor; selecting a first target search range from the data search range corresponding to the keyword ciphertext based on the target ciphertext index, and taking the numerical keyword that matches the range search trapdoor within the first target search range as the target keyword; and taking the data in the document to be searched that satisfies the target keyword as the target ciphertext data.
[0020] Optionally, obtaining a target historical search trap that matches the range search trap includes: determining a second target search range corresponding to the range search trap; obtaining a set of historical search traps; determining the smallest search range in the set of historical search traps that contains the second target search range, and using the historical search trap corresponding to the smallest search range as the target historical search trap; or, determining the largest search range in the set of historical search traps that contains the second target search range, and using the historical trap corresponding to the largest search range as the target historical search trap.
[0021] Optionally, after using the numerical keyword matched by the range search trapdoor within the first target search range as the target keyword, the method further includes: associating and saving the target keyword with the range search trapdoor, generating a ciphertext index corresponding to the range search trapdoor; adding the range search trapdoor to the historical search trapdoor set, and adding the ciphertext index corresponding to the range search trapdoor to the historical ciphertext index set.
[0022] Optionally, obtaining system parameters, the administrator key, and the sender key includes: obtaining security parameters; constructing system parameters based on the security parameters using a first setting algorithm; constructing the administrator key based on the system parameters using a second setting algorithm; and constructing the sender key based on the system parameters using a third setting algorithm.
[0023] In some embodiments, the apparatus for ciphertext search includes a processor and a memory storing program instructions, the processor being configured to perform the method for ciphertext data search as described above when the program instructions are executed.
[0024] In some embodiments, the computer includes: a computer body; and the means for searching encrypted data as described above, which is installed in the computer body.
[0025] The method, apparatus, and computer for searching encrypted data provided in this disclosure can achieve the following technical effects:
[0026] In this embodiment, the administrator is a trusted data transmission structure. The sender is the owner of the data. When a user sends search information to the server to search for encrypted data, the construction of the keyword ciphertext and the range search trapdoor used in the search both reference the administrator's key and the sender's key. Because the administrator's key is constructed by a trusted data transmission structure for legitimate users, the technical solution of this embodiment can reduce the risk of illegitimate users generating search trapdoors and obtaining encrypted data from the cloud server, thus improving the security of searchable encryption technology.
[0027] The above general description and the description below are exemplary and illustrative only and are not intended to limit this application. Attached Figure Description
[0028] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein:
[0029] Figure 1 This is a schematic diagram of a computer provided in an embodiment of this disclosure;
[0030] Figure 2 This is a schematic diagram of a method for searching encrypted data provided in an embodiment of this disclosure;
[0031] Figure 3 This is a schematic diagram of another method for searching encrypted data provided in an embodiment of this disclosure;
[0032] Figure 4 This is a schematic diagram of another method for searching encrypted data provided in an embodiment of this disclosure;
[0033] Figure 5 This is a schematic diagram of another method for searching encrypted data provided in an embodiment of this disclosure;
[0034] Figure 6 This is a schematic diagram of an apparatus for searching encrypted data provided in an embodiment of this disclosure. Detailed Implementation
[0035] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.
[0036] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.
[0037] Unless otherwise stated, the term "multiple" means two or more.
[0038] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.
[0039] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.
[0040] It should be noted that, unless otherwise specified, the embodiments and features described in the present disclosure can be combined with each other.
[0041] Combination Figure 1 As shown, this disclosure provides a computer 10. The computer 10 includes a computer body 100 and a device 600 for searching encrypted data. Specifically, the device 600 for searching encrypted data is installed in the computer body 100.
[0042] Optionally, the apparatus 600 for searching encrypted data includes a processor. Upon receiving search information, the processor can construct keyword ciphertext and a range search trapdoor based on the numerical keywords of the document to be searched, the search information, system parameters, the administrator's key, and the sender's key. It can then perform a data search on the document to be searched based on the keyword ciphertext and the range search trapdoor to obtain target encrypted data matching the search information.
[0043] Combination Figure 1 The computer shown in this disclosure provides a method for searching encrypted data, such as... Figure 2 As shown, the method includes:
[0044] S201, upon receiving the search information, the processor obtains the system parameters, the administrator key, and the sender key.
[0045] Specifically, the administrator is a trusted data transmission structure. The sender is the data owner. The search information is the message sent by the user who needs to obtain the encrypted data; this information can include the search scope. System parameters PP = {p, g, G, G...} T Let p be a large prime number, g be a generator of the group G, and G be a group of elements G and G. T For a group of order p, e: G×G→G T For a bilinear mapping, H:G×{0,1} * →Z p . is a hash function, where "*" represents an unknown natural number.
[0046] Specifically, when the processor receives search information, it indicates that a user wants to search for encrypted data. Therefore, in this case, it is necessary to obtain system parameters, the administrator's key, and the sender's key in order to find the target encrypted data that matches the search information while ensuring security.
[0047] S202, the processor constructs keyword ciphertext based on the numerical keywords of the document to be searched, system parameters, administrator key, and sender key.
[0048] Specifically, the numeric keywords of the document being searched correspond to the document itself. For example, if the document being searched is a traditional text document, the numeric keywords could be the word count or page number. As another example, if the document being searched is a medical record, the numeric keywords could be the patient's age or height.
[0049] Optionally, the administrator key includes the administrator public key, the sender key includes the sender private key, and the system parameters include relevant parameters of the group G, where G is a group of order p and p is a large prime number;
[0050] Construct the key ciphertext using the following expression:
[0051] and
[0052] Among them, CT w The key is encrypted. Let g be the lower limit of the ciphertext for the key, w0 be the numeric key, W0 be the set of zero codes for w0, and C1 be the upper limit of the ciphertext for the key, where C1 = g. r , g is a generator of group G, PK A For the administrator's public key and SK S For the sender's private key and SK S=y, r and y are from Z p A number randomly selected from Z p It is a p-order finite field.
[0053] Specifically, the processor first performs 0-1 encoding on the numeric key w0, obtaining the 0-encoding set W0 of the numeric key. Then, for any w0 ∈ W0, from the above Z... p By randomly selecting a value r and substituting it into the above formula, the ciphertext of the keyword can be constructed.
[0054] S203, the processor constructs a range search trapdoor based on search information, system parameters, administrator key, and sender key.
[0055] Specifically, the search information is the information sent by the user who needs to obtain encrypted data, and the search information includes the search range of numerical keywords.
[0056] Optionally, the administrator key includes the administrator's private key, the sender key includes the sender's public key, the search information includes the search range, and the system parameters include the relevant parameters of the group G, where G is a p-order group and p is a large prime number;
[0057] Construct a range search trapdoor using the following expression:
[0058]
[0059] Where TR stands for range search trapdoor.
[0060] SK A For the administrator's private key and PK S The sender's public key and PK S =g y Let g be a generator of group G, and r1, r2, r3, r4 and y be generators of group Z. p A number randomly selected from Z p It is a p-order finite field.
[0061] Specifically, the search range for numerical keywords in the search information is represented as [a, b]. The processor first calculates the 0-1 codes for a and (b+1) respectively. and Then from the above Z p By randomly selecting values r1, r2, r3, and r4 and substituting them into the above formula, a range search trapdoor can be constructed.
[0062] S204, the processor performs a data search on the document to be searched based on the keyword ciphertext and the range search trapdoor to obtain the target ciphertext data that matches the search information.
[0063] Specifically, the processor can determine the search range corresponding to the range search trapdoor within the data search range corresponding to the keyword ciphertext. The data in the document to be searched that corresponds to the numerical keyword within this search range is the target ciphertext data that the user wants to search for.
[0064] In this embodiment, the administrator is a trusted data transmission structure. The sender is the owner of the data. When a user sends search information to the server to search for encrypted data, the construction of the keyword ciphertext and the range search trapdoor used in the search both reference the administrator's key and the sender's key. Because the administrator's key is constructed by a trusted data transmission structure for legitimate users, the technical solution of this embodiment can reduce the risk of illegitimate users generating trapdoors and obtaining encrypted data from the cloud server, thus improving the security of searchable encryption technology.
[0065] This disclosure provides another method for searching encrypted data, such as... Figure 3 As shown, the method includes:
[0066] S301: Upon receiving the search information, the processor obtains the system parameters, the administrator key, and the sender key.
[0067] S302, the processor constructs keyword ciphertext based on the numerical keywords of the document to be searched, system parameters, administrator key, and sender key.
[0068] S303, the processor constructs a range search trapdoor based on search information, system parameters, administrator key, and sender key.
[0069] S304, the processor determines the matching numerical keyword corresponding to the keyword ciphertext, and the data search range corresponding to the matching numerical keyword.
[0070] Specifically, it matches numerical keywords in encrypted form for the documents to be searched, with each keyword corresponding to a data search range.
[0071] For example, if we take the numerical keywords of the document to be searched as the page number, specifically from page 1 to page 200, then we can determine that the data search range corresponding to the keyword ciphertext of the document to be searched is from page 1 to page 200.
[0072] For example, if the document to be searched is a medical record, and the numerical keyword of the document to be searched is the patient's age, specifically 10 to 25 years old, then the data search range corresponding to the keyword ciphertext of the document to be searched can be determined to be 10 to 25 years old.
[0073] S305, the processor determines a first target search range within the data search range that is greater than the lower limit of the range search trap threshold and less than the upper limit of the range search trap threshold.
[0074] Specifically, the lower limit of the range search trap threshold represents the lower limit of the search range corresponding to the range search trap, and the upper limit of the range search trap threshold represents the upper limit of the search range corresponding to the range search trap. For example, if the search range corresponding to the range search trap is 10 to 20 pages, then the lower limit of the range search trap threshold is 10 pages, and the upper limit of the range search trap threshold is 20 pages. As another example, if the search range corresponding to the range search trap is 50 to 60 years old, then the lower limit of the range search trap threshold is 50 years old, and the upper limit of the range search trap threshold is 60 years old.
[0075] Specifically, within the data search range, the ciphertext data corresponding to numerical keywords within the range that are greater than the lower limit of the search trap threshold and less than the upper limit of the search trap threshold is the target ciphertext data that the user wants to search for. Therefore, this embodiment of the disclosure needs to determine the first target search range in the manner described above.
[0076] S306, the processor uses the numerical keyword corresponding to the first target search range as the target keyword.
[0077] Specifically, since all the numerical keywords in the first target search range are greater than the lower limit of the search trapdoor threshold and less than the upper limit, the data corresponding to the numerical keywords in the first target search range is the encrypted data that the user wants to search for. Therefore, the numerical keywords corresponding to the first target search range can be determined as target keywords so that subsequent steps can search for the target encrypted data from the document to be searched based on the target keywords.
[0078] S307, the processor uses the data in the document to be searched that matches the target keyword as the target encrypted data.
[0079] Specifically, since the target keywords are all numerical keywords within the first target search range, the data in the document to be searched that satisfies the target keywords is the target encrypted data that the user wants to search for.
[0080] Optionally, before performing a data search on the document to be searched based on the keyword ciphertext and the range search trap, the method further includes: confirming whether the target ciphertext data can be searched from the data search range corresponding to the keyword ciphertext based on the keyword ciphertext and the range search trap.
[0081] Specifically, in and In this case, it can be confirmed that the target ciphertext data can be searched within the data search range corresponding to the keyword ciphertext. Among them, e, C1, and The meaning expressed is the same as that of the parameters in the above expressions for constructing keyword ciphertext and constructing range search trapdoors, and will not be repeated here in the embodiments of this disclosure.
[0082] In this embodiment of the disclosure, when searching for encrypted data based on keyword ciphertext and a range search trapdoor, the data search range corresponding to the keyword ciphertext is first determined. A first target search range within the data search range is then determined based on the range search trapdoor. Finally, data in the document to be searched that contains numerical keywords within the first target search range is used as the target ciphertext data. This ensures that all determined target ciphertext data falls within the search range corresponding to the range search trapdoor, improving the accuracy of the retrieved target ciphertext data.
[0083] This disclosure provides another method for searching encrypted data, such as... Figure 4 As shown, the method includes:
[0084] S401: Upon receiving the search information, the processor obtains the system parameters, the administrator key, and the sender key.
[0085] S402, the processor constructs keyword ciphertext based on the numerical keywords of the document to be searched, system parameters, administrator key, and sender key.
[0086] S403, the processor constructs a range search trapdoor based on search information, system parameters, administrator key, and sender key.
[0087] S404, the processor obtains the target historical search trapdoor that matches the range search trapdoor.
[0088] Specifically, a historical search trap is a range search trap generated when the user performs a ciphertext data search before the current ciphertext data search. A target historical search trap is either a historical search trap whose search range includes the search range corresponding to the range search trap, or a historical search trap whose search range is contained within the search range corresponding to the range search trap.
[0089] S405, the processor determines the target ciphertext index in the historical ciphertext index set that corresponds to the target historical search trapdoor.
[0090] Specifically, the historical ciphertext index set is denoted by C, where C = {{T1,V1,Con1,Cod1},{T2,V2,Con2,Cod2},…,{T n V n ,Con n Cod nFor example, a ciphertext index C1 can be represented as {T1,V1,Con1,Cod1}, and the range search trapdoor corresponding to the ciphertext index C1 is TR1.
[0091] Where T1 represents the set of ciphertext data that matches the range search trapdoor TR1. V1 represents the set of ciphertext data that is not matched with the range search trapdoor TR1. Con1 represents the labels of all subsets of T1, and Cod1 represents all labels that are subsets of T1.
[0092] Specifically, the historical ciphertext index set stores the ciphertext indexes corresponding to all historical search trapdoors. Therefore, the target ciphertext index corresponding to the target historical search trapdoor can be found from the historical ciphertext index set.
[0093] S406, the processor selects the first target search range from the data search range corresponding to the keyword ciphertext according to the target ciphertext index, and takes the numerical keyword matched by the trapdoor in the range search within the first target search range as the target keyword.
[0094] Specifically, based on the matching relationship between the target historical search trapdoor and the range search trapdoor, and according to the target ciphertext index, the first target search range is selected from the data search range corresponding to the keyword ciphertext.
[0095] Optionally, selecting the first target search range from the data search range corresponding to the keyword ciphertext based on the target ciphertext index includes: when the target historical search trapdoor is the search range of the range search trapdoor included in the search range, searching from the trapdoor set corresponding to the Con tag set in the target ciphertext index. and Then with corresponding correspond as well as corresponding The corresponding data range is used as the first target search range; among which, This represents the trapdoor TR, which represents the smallest containment range search trapdoor in the search range. This indicates the trapdoor that is most contained within the range search trapdoor TR in terms of search range. Indicates and Uncompared sets of encrypted data Indicates and Uncompared sets of encrypted data Indicates and The complement of the matched ciphertext data set.
[0096] Optionally, selecting the first target search range from the data search range corresponding to the keyword ciphertext based on the target ciphertext index includes: when the target historical search trapdoor is the search range of the range search trapdoor, searching from the trapdoor set corresponding to the Cod tag set in the target ciphertext index. and Then with corresponding correspond as well as corresponding The corresponding data range is used as the first target search range; among which, This represents the trapdoor TR, which represents the smallest containment range search trapdoor in the search range. This indicates the trapdoor that is most contained within the range search trapdoor TR in terms of search range. Indicates and Uncompared sets of encrypted data Indicates and Uncompared sets of encrypted data Indicates and The complement of the matched ciphertext data set.
[0097] Specifically, since the target search range is a portion of the data search range selected based on the target ciphertext index, and since the target ciphertext index corresponds to the ciphertext index of the target historical search trap, and the target historical search trap matches the range search trap, the target search range contains all the ciphertext data the user needs to search for. Therefore, using the numerical keywords matched by the range search trap within the first target search range as the target keywords, i.e., searching for ciphertext data only by comparing the numerical keywords matched by the range search trap with the numerical keywords within the target search range, reduces the amount of data compared to comparing both the numerical keywords matched by the range search trap and the numerical keywords within the data search range, thereby improving the speed of ciphertext data searching.
[0098] S407, the processor uses the data in the document to be searched that matches the target keyword as the target encrypted data.
[0099] Specifically, since the target keywords are all numerical keywords within the first target search range, and these keywords correspond to the numerical keywords of the range search trapdoor, the data in the document to be searched that satisfies the target keywords is the target encrypted data that the user wants to search for.
[0100] In this embodiment of the disclosure, when performing encrypted data search, only the first target search range within the data search range is searched, which reduces the amount of data that needs to be compared and improves the speed of encrypted data search.
[0101] Optionally, obtaining the target historical search trap that matches the range search trap includes: determining the second target search range corresponding to the range search trap; obtaining a set of historical search traps; determining the minimum search range in the set of historical search traps that contains the second target search range, and taking the historical search trap corresponding to the minimum search range as the target historical search trap.
[0102] Specifically, the second target search range represents the search range within the user-inputted search information in encrypted form, and the historical search trapdoor set is the set of range search trapdoors generated when the user performed encrypted data searches before this encrypted data search. This can be achieved through TR... i∈{1,2,,…n} express.
[0103] For example, using a historical search trapdoor as TR * Taking the range search trapdoor TR as an example, in and In this case, it can be determined that the search trapdoor TR * The search range includes the search range with the range search trapdoor TR. Parameters marked with "*" represent parameters related to the range search trapdoor. Since the meanings of the parameters in this expression are the same as those of the parameters in the expression constructing the range search trapdoor, the specific meanings of these parameters will not be elaborated further in this embodiment.
[0104] Optionally, obtaining the target historical search trap that matches the range search trap includes: determining the second target search range corresponding to the range search trap; obtaining a set of historical search traps; determining the largest search range contained in the set of historical search traps within the first target search range, and using the historical search trap corresponding to the largest search range as the target historical search trap.
[0105] Specifically, the second target search range represents the search range within the user-inputted search information in encrypted form, and the historical search trapdoor set is the set of range search trapdoors generated when the user performed encrypted data searches before this encrypted data search. This can be achieved through TR... i∈{1,2,,…n} express.
[0106] For example, using a historical search trapdoor as TR * Taking the range search trapdoor TR as an example, in and In this case, it can be determined that the search trapdoor TR * The search range is included within the search range of the range search trapdoor TR. Parameters marked with "*" represent parameters related to the range search trapdoor. Since the meanings of the parameters in this expression are the same as those of the parameters in the expression constructing the range search trapdoor, the specific meanings of these parameters will not be elaborated further in this embodiment.
[0107] This disclosure provides another method for searching encrypted data, such as... Figure 5 As shown, the method includes:
[0108] S501: Upon receiving search information, the processor obtains system parameters, the administrator key, and the sender key.
[0109] S502, the processor constructs keyword ciphertext based on the numerical keywords of the document to be searched, system parameters, administrator key, and sender key.
[0110] The S503 processor constructs a range search trapdoor based on search information, system parameters, administrator key, and sender key.
[0111] S504, the processor obtains the target historical search trapdoor that matches the range search trapdoor.
[0112] S505, the processor determines the target ciphertext index in the historical ciphertext index set that corresponds to the target historical search trapdoor.
[0113] S506, the processor selects the first target search range from the data search range corresponding to the keyword ciphertext according to the target ciphertext index, and takes the numerical keyword matched by the trapdoor in the range search within the first target search range as the target keyword.
[0114] S507, the processor associates and saves the target keyword with the range search trapdoor, and generates a ciphertext index corresponding to the range search trapdoor.
[0115] Specifically, the target keyword is associated with and saved with the range search trap, generating a ciphertext index. When the user inputs search information and the generated range search trap is the same as the trap, the ciphertext data can be quickly found from the document to be searched directly based on the ciphertext index.
[0116] S508, the processor adds the range search trapdoor to the historical search trapdoor set and adds the ciphertext index corresponding to the range search trapdoor to the historical ciphertext index set.
[0117] Specifically, range search trapdoors and their corresponding ciphertext indexes are added to the historical search trapdoor set and the historical ciphertext index set, respectively. This increases the data content in both sets, which in turn improves the speed of subsequent ciphertext data searches.
[0118] S509, the processor uses the data in the document to be searched that matches the target keyword as the target encrypted data.
[0119] In this embodiment, after determining the target keyword corresponding to the range search trapdoor, the range search trapdoor is associated with the target keyword to generate a ciphertext index. The range search trapdoor and its corresponding ciphertext index are then added to the historical search trapdoor set and the historical ciphertext index set, respectively. This increases the data content in the historical search trapdoor set and the historical ciphertext index set after each ciphertext data search, thus improving the speed of subsequent ciphertext data searches.
[0120] Optionally, obtaining system parameters, the administrator key, and the sender key includes: obtaining security parameters; constructing system parameters based on the security parameters using a first setting algorithm; constructing the administrator key based on the system parameters using a second setting algorithm; and constructing the sender key based on the system parameters using a third setting algorithm.
[0121] Specifically, the system parameters PP = {p, g, G, G} T The first setup algorithm is the Setup algorithm. This algorithm can construct p-order groups G and G' based on the length of the security parameter k. T Randomly selecting a generator from group G yields g, according to e: G × G → G T and H:G×{0,1} * →Z p We can obtain e and H respectively. Where p is a large prime number, and Z... p It is a p-order finite field.
[0122] Specifically, the second algorithm is the KeyGenA algorithm, which takes the system parameters PP as input and starts from Z. p Randomly select x1, x2, x3 and output the administrator's public key. and administrator private key
[0123] Specifically, the second algorithm is the KeyGenS algorithm, which takes the system parameters PP as input and starts from Z. p Randomly select y from the given information and output the sender's public key PK. S =g y and sender's private key SK S =y.
[0124] Combination Figure 6As shown, this disclosure provides an apparatus 600 for searching encrypted data, comprising a processor 601 and a memory 602. Optionally, the apparatus may further include a communication interface 603 and a bus 604. The processor 601, communication interface 603, and memory 602 can communicate with each other via the bus 604. The communication interface 603 can be used for information transmission. The processor 601 can call logical instructions in the memory 602 to execute the method for controlling lighting equipment described in the above embodiment.
[0125] Furthermore, the logic instructions in the aforementioned memory 602 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.
[0126] The memory 602, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor 601 executes functional applications and data processing by running the program instructions / modules stored in the memory 602, that is, it implements the method for searching encrypted data in the above embodiments.
[0127] The memory 602 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 602 may include high-speed random access memory and may also include non-volatile memory.
[0128] Combination Figure 1 As shown, this disclosure provides a computer 10, including a computer body 100 and the aforementioned device 600 for searching encrypted data. The device 600 for searching encrypted data is installed in the computer body 100. The installation relationship described herein is not limited to placement within the product, but also includes installation connections with other components of the computer 10, including but not limited to physical connections, electrical connections, or signal transmission connections. Those skilled in the art will understand that the device 600 for searching encrypted data can be adapted to any feasible computer 10, thereby implementing other feasible embodiments.
[0129] This disclosure provides a computer program that, when executed by a computer, enables the computer to perform the above-described method for searching encrypted data.
[0130] This disclosure provides a computer program product including computer instructions stored on a computer-readable storage medium, which, when executed by a computer, enable the computer to implement the above-described method for searching encrypted data.
[0131] This disclosure provides a computer-readable storage medium storing computer-executable instructions configured to perform the above-described method for searching encrypted data.
[0132] The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.
[0133] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, including: a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code; it can also be a transient storage medium.
[0134] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the claims. As used in the description of embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used in this application means including one or more of the associated listed items and all possible combinations thereof. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.
[0135] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0136] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed units may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to implement this embodiment according to actual needs. Furthermore, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0137] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
Claims
1. A method for searching encrypted data, characterized in that, include: Upon receiving the search information, obtain the system parameters, the administrator's key, and the sender's key; Construct keyword ciphertext based on the numerical keywords of the document to be searched, system parameters, administrator key, and sender key; Construct a range search trapdoor based on search information, system parameters, administrator key, and sender key; Based on keyword ciphertext and range search traps, data is searched in the document to be searched to obtain target ciphertext data that matches the search information; Among them, the administrator key includes the administrator public key and the administrator private key, the sender key includes the sender public key and the sender private key, the search information includes the search range, and the system parameters include the relevant parameters of the group G, where G is a p-order group and p is a large prime number; Construct the key ciphertext using the following expression: ,and ; in, The key is encrypted. This is the lower limit value for the keyword ciphertext. Numeric key, for The set of 0-encoded strings, where C1 is the upper limit of the key ciphertext, and , where g is a generator of group G. For the administrator's public key and , For the sender's private key and y are from A number randomly selected from the data. It is a p-order finite field; Construct a range search trapdoor using the following expression: ； Where TR stands for range search trapdoor. , , , , , , , , For the administrator's private key and , For the sender's public key and g is a group generator, and y are from A number randomly selected from the data. It is a p-order finite field; Based on keyword ciphertext and range search trapdoors, the document to be searched is searched for data to obtain target ciphertext data that matches the search information, including: Determine the matching numerical keywords corresponding to the keyword ciphertext, and the data search range corresponding to the matching numerical keywords; determine the first target search range within the data search range that is greater than the lower limit of the range search trap threshold and less than the upper limit of the range search trap threshold; take the numerical keywords corresponding to the first target search range as the target keywords; take the data in the document to be searched that satisfies the target keywords as the target ciphertext data; or, Obtain the target historical search trapdoor that matches the range search trapdoor; determine the target ciphertext index in the historical ciphertext index set that corresponds to the target historical search trapdoor; select the first target search range from the data search range corresponding to the keyword ciphertext based on the target ciphertext index, and take the numerical keyword that matches the range search trapdoor within the first target search range as the target keyword; take the data in the document to be searched that satisfies the target keyword as the target ciphertext data.
2. The method according to claim 1, characterized in that, Obtain the target historical search trapdoors that match the range search trapdoors, including: Determine the search range for the second target corresponding to the range search trapdoor; Retrieve the set of historical search traps; Determine the smallest search range in the historical search trap set that contains the second target search range, and use the historical search trap corresponding to the smallest search range as the target historical search trap; or, Determine the maximum search range contained in the historical search trap set within the second target search range, and use the historical search trap corresponding to the maximum search range as the target historical search trap.
3. The method according to claim 1, characterized in that, After using the numerical keywords matched by the trapdoor within the first target search range as the target keywords, it also includes: Associate and save the target keyword with the range search trapdoor, and generate a ciphertext index corresponding to the range search trapdoor; Add the range search trapdoor to the historical search trapdoor set, and add the ciphertext index corresponding to the range search trapdoor to the historical ciphertext index set.
4. The method according to any one of claims 1 to 3, characterized in that, Obtain system parameters, administrator key, and sender key, including: Obtain security parameters; The first algorithm is used to construct system parameters based on security parameters; The administrator key is constructed based on system parameters using the second algorithm. A third-party algorithm is used to construct the sender's key based on system parameters.
5. An apparatus for searching encrypted data, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to perform the method for searching encrypted data as described in any one of claims 1 to 4 when executing the program instructions.
6. A computer, characterized in that, include: Computer body; The apparatus for searching encrypted data as described in claim 5 is installed on the computer body.