A data trusted search method under cloud-edge collaboration

Abstract

This invention discloses a trusted data search method under cloud-edge collaboration, comprising data upload and search phases. During data upload, after the data owner's identity is verified by the edge cloud server, the edge cloud server distributes a key to the data owner. The data owner's terminal platform uploads encrypted data to the edge cloud server, which then signs the data and sends it to the cloud server for storage. During data search, after the data visitor's identity is verified by the edge cloud server, the data visitor's terminal platform sends search keywords to the edge cloud server to calculate a search trapdoor. The cloud server performs search matching and sends the search results to the edge cloud server. After verifying the integrity of the encrypted data, the edge cloud server sends the encrypted data and its decryption key to the data visitor's terminal platform for decryption, obtaining the search results. This invention ensures the authenticity of user identities and effectively guarantees the security and integrity of user-searched data.

Description

Technical Field

[0001] This invention relates to the field of data searchable encryption technology, specifically a trusted data search method under cloud-edge collaboration. Background Technology

[0002] Searchable encryption is an advanced technology for protecting user data privacy. Traditional encryption methods can only encrypt the entire data, making it impossible to search or query while it is encrypted. Searchable encryption, however, allows users to search and query data even while it is encrypted, ensuring effective access to encrypted data stored in the cloud. In searchable encryption, the cloud server, as a participant in the cloud-edge collaborative data search protocol, aims to process user search requests and return data to the user. While the cloud server is honest and curious, it can return search results according to the protocol or implementation plan; however, it is not entirely trustworthy. The cloud server may return incomplete or incorrect results to save money, and malicious servers may tamper with user-stored data, making search results returned by the cloud server unreliable. Most existing searchable encryption schemes use aggregators to allow users to verify search results locally. Because aggregators use public-key cryptography, verification efficiency is low. Furthermore, this method requires users to verify results locally, which can impose a computational burden on users with limited computing resources. Summary of the Invention

[0003] The technical problem to be solved by this invention is to provide a reliable data search method under cloud-edge collaboration, which ensures the authenticity of user identity and effectively guarantees the security and integrity of user search data.

[0004] The technical solution of this invention is as follows:

[0005] A cloud-edge collaborative data trust search method includes the following steps:

[0006] (1) Before the data owner uploads the data to the cloud server, the edge cloud server first uses remote authentication to verify the identity of the data owner's terminal platform. After successful verification, the edge cloud server distributes the data key and search key to the data owner's terminal platform.

[0007] (2) After the data owner terminal platform obtains the data key and search key, it uses the data key to encrypt the data to be uploaded and the search key to encrypt the keywords of the data. Then it uploads the encrypted data and encrypted keywords to the edge cloud server.

[0008] (3) After receiving the encrypted data and encrypted keywords, the edge cloud server performs a hash operation on the encrypted data, signs the hash operation result using the edge cloud server's key, and then sends the encrypted data, encrypted keywords and signature to the cloud server for storage.

[0009] (4) Before a data visitor requests to search for data in the cloud server, the edge cloud server first uses remote authentication to verify the identity of the data visitor's terminal platform.

[0010] (5) After the data visitor terminal platform successfully authenticates itself, the data visitor terminal platform sends the search keywords to the edge cloud server. The edge cloud server uses the search keywords to calculate the search trapdoor, and then sends the search request and the search trapdoor to the cloud server.

[0011] (6) The cloud server performs keyword matching in the cloud server's storage database based on the search trap. After a successful match, the searched encrypted data, along with the corresponding encrypted keywords and signature, is sent to the edge cloud server.

[0012] (7) After receiving the encrypted data, the edge cloud server verifies the integrity of the encrypted data. If the integrity of the encrypted data is not compromised, the encrypted data and the decryption key are sent to the data accessor terminal platform.

[0013] (8) The data visitor terminal platform decrypts the encrypted data to obtain the search results.

[0014] The data owner terminal platform uses its TPM module to generate public-private key pairs (AIK). DO AIK′ DO The data accessor terminal platform uses its TPM module to generate public-private key pairs (AIKs). DU AIK′ DU The edge cloud server calculates its public-private key pair (PK). ES SK ES Furthermore, the edge cloud server is configured with a collision-resistant hash function H:{0,1}. * →Z q * Then (AIK) DO AIK DU PK ES (H) is publicly available.

[0015] The specific steps for the edge cloud server to remotely verify the identity of the data owner or data visitor terminal platform are as follows: The data owner or data visitor terminal platform calculates a random number N, and then generates a remote verification request (ID, N, PCR, IML) by combining the PCR value in the TPM module of the data owner or data visitor terminal platform and the integrity measurement log (IML) value. This remote verification request (ID, N, PCR, IML) is then sent to the edge cloud server. The IML value in the remote verification request records the integrity measurement information of the data owner or data visitor terminal platform under a secure state. This integrity measurement information under a secure state is stored in the PCR value, which can only be read. The edge cloud server compares the integrity measurement information in the PCR value of the remote verification request with the IML value in the remote verification request. If they match, the data owner or data visitor terminal platform is determined to be in a secure state, i.e., verification is successful. If they do not match, the data owner or data visitor terminal platform is determined to be in an insecure state, i.e., verification fails, and data upload or data search is not possible.

[0016] After the data owner's terminal platform successfully authenticates the user, the edge cloud server calculates the data key. Share and search key Search Then the edge cloud server uses the public key AIK of the data owner's terminal platform. DO Data Key Share and search key Search Further encryption is performed to obtain the data encryption key. and searching for encryption keys The encryption formulas are shown in equations (1) and (2) below:

[0017]

[0018]

[0019] Then the edge cloud server uses the data encryption key. and searching for encryption keys The data is sent to the data owner's terminal platform, which then uses its private key AIK′. DO Data encryption key and searching for encryption keys Decrypt to obtain the data key. Share and search key Search The decryption formulas are shown in equations (3) and (4) below:

[0020]

[0021]

[0022] In equations (1) to (4), Encrypt(X,Key) means encrypting X using the key Key, and Decrypt(Y,Key′) means decrypting Y using the key Key′.

[0023] The formulas for encrypting the data to be uploaded using a data key and encrypting the keywords of the data using a search key are shown in equations (5) and (6) below:

[0024] C Date ←Encrypt(Date,Key Share (5);

[0025] C Keywords ←Encrypt(Keywords,Key Search (6);

[0026] In equations (5) and (6), C Date Indicates encrypted data, C Keywords This represents the encryption key, Date represents the uploaded data, and Keywords represents the keywords in the uploaded data.

[0027] The calculation formula for the edge cloud server to perform hash operation on encrypted data and then sign the hash operation result using the edge cloud server's key is shown in the following formula (7):

[0028]

[0029] In equation (7), H(C) Date ) represents the hash result of encrypted data, SK ES This is the private key for the edge cloud server. For signature;

[0030] Then, the encrypted data, the encrypted key, and the signature are combined into a tuple. The tuple is sent to the storage database on the cloud server for storage.

[0031] The data visitor terminal platform sends search keywords to the edge cloud server. The edge cloud server uses the search keywords to calculate the search trapdoor, and then sends the search request and the search trapdoor to the cloud server. The specific steps are as follows:

[0032] First, the data visitor terminal platform sends a search request Q←(id,Keywords) Search (Assigned to the edge cloud server, id is the identity identifier of the data visitor's terminal platform, Keywords) SearchFor the search keywords, the edge cloud server then uses the search keywords. Search and its corresponding search key. Search Calculate the search trapdoor T W The calculation formula is equation (8):

[0033] T W ←Encrypt(Keywords,Key Search (8);

[0034] In equation (8), Keywords Search The edge cloud server retrieves the corresponding search key based on the keywords that match the data uploaded to the data owner's terminal platform. Search Then the search trapdoor T is calculated. W ;

[0035] Finally, the edge cloud server will combine the data visitor's terminal platform identity ID and the search trap T. W Combined into a single search access request Q′←(id,T) W Finally, the search access request Q′ is sent to the cloud server.

[0036] After receiving the encrypted data, the edge cloud server verifies the integrity of the encrypted data, that is, compares whether H1 and H2 are consistent. The calculation formulas for H1 and H2 are shown in equations (9) and (10) below:

[0037] H1←H(C Date (9);

[0038]

[0039] In equations (9) and (10), H1 represents the hash result H(C) of the encrypted data. Date H2 indicates the use of the public key PK of the edge cloud server. ES Decrypt Signature The resulting hash value;

[0040] When H1 = H2, the integrity of the encrypted data is not compromised, and then the edge cloud server will transfer the search results R←(C). Date C Key ) is sent to the data accessor terminal platform, C Key The calculation formula is as follows (11):

[0041] C Key ←Encrypt(Key Share AIK DU (11);

[0042] In equation (11), C Key This indicates the use of the public key AIK of the data accessor terminal platform. DU Further encryption of data key Share The obtained key;

[0043] When H1≠H2, the integrity of the encrypted data is compromised, and the edge cloud server then sends the search results - data corruption information to the data visitor's terminal platform.

[0044] The data visitor terminal platform receives the search result R and uses its private key AIK′. DU For C Key Decrypt to obtain the data key. Share Finally, use the data key. Share For encrypted data C Date Decryption is performed to obtain the searched data result Date. The calculation formulas are shown in equations (12) and (13) below:

[0045] Key Share ←Decrypt(C Key AIK′ DU (12);

[0046] Date←Decrypt(C Date Key Share (13).

[0047] Advantages of this invention:

[0048] (1) This invention combines remote authentication technology. The edge cloud server has a built-in TPM trusted platform module. The edge cloud server will decide whether to provide services based on the result of the remote authentication of the user, thereby ensuring the authenticity of the user's identity.

[0049] (2) In view of the problem that cloud servers may return incorrect search data, this invention uses a trusted edge cloud server to verify the hash value of the data, ensuring the security and integrity of the search data, and effectively avoiding the computational burden of users performing verification locally.

[0050] (3) The present invention can resist key leakage attacks. Even if the key is leaked, the data key still needs to be decrypted using the data accesser's private key in order to further decrypt and obtain the search data results, so that attackers cannot directly obtain the user's search data results through the key. Attached Figure Description

[0051] Figure 1 This is a flowchart of the data upload process performed by the data owner in this invention.

[0052] Figure 2 This is a flowchart of the data search process performed by the data visitor in this invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] A cloud-edge collaborative data trust search method includes the following steps:

[0055] (1) Initialization phase: The data owner's terminal platform uses its TPM module to generate a public-private key pair (AIK). DO AIK′ DO The data accessor terminal platform uses its TPM module to generate public-private key pairs (AIKs). DU AIK′ DU The edge cloud server calculates its public-private key pair (PK). ES SK ES Furthermore, the edge cloud server is configured with a collision-resistant hash function H:{0,1}. * →Z q * Then (AIK) DO AIK DU PK ES H) Publicly available;

[0056] (2) See Figure 1 Data upload stage:

[0057] S21. Before the data owner uploads the data to the cloud server, the edge cloud server first verifies the identity of the data owner's terminal platform using remote authentication. After successful verification, the edge cloud server distributes a data key and a search key to the data owner's terminal platform. The specific steps are as follows:

[0058] First, the data owner terminal platform calculates a random number N. Then, it combines the PCR value from the TPM module of the data owner terminal platform with the integrity measurement log (IML) value to generate a remote verification request: (ID, N, PCR, IML). The remote verification request (ID, N, PCR, IML) is then sent to the edge cloud server. The IML value in the remote verification request records the integrity measurement information of the data owner terminal platform in a secure state. This integrity measurement information in a secure state is stored in the PCR value. The PCR value can only be read. The edge cloud server compares the integrity measurement information in the PCR value of the remote verification request with the IML value in the remote verification request. If they match, the data owner terminal platform is determined to be in a secure state, i.e., the verification is successful. If they do not match, the data owner terminal platform is determined to be in an insecure state, i.e., the verification fails, and data upload cannot be performed.

[0059] After the data owner's terminal platform successfully authenticates their identity, the edge cloud server calculates the data key. Share and search key Search Then the edge cloud server uses the public key AIK of the data owner's terminal platform. DO Data Key Share and search key Search Further encryption is performed to obtain the data encryption key. and searching for encryption keys The encryption formulas are shown in equations (1) and (2) below:

[0060]

[0061]

[0062] Then the edge cloud server uses the data encryption key. and searching for encryption keys The data is sent to the data owner's terminal platform, which then uses its private key AIK′. DO Data encryption key and searching for encryption keys Decrypt to obtain the data key. Share and search key Search The decryption formulas are shown in equations (3) and (4) below:

[0063]

[0064]

[0065] In equations (1)-(4), Encrypt(X,Key) means encrypting X using the key Key, and Decrypt(Y,Key′) means decrypting Y using the key Key′.

[0066] S22. After the data owner terminal platform obtains the data key and search key, it uses the data key to encrypt the data to be uploaded and uses the search key to encrypt the keywords of the data. The encryption formulas are shown in equations (5) and (6) below. Then, the encrypted data and encrypted keywords are uploaded to the edge cloud server.

[0067] C Date ←Encrypt(Date,Key Share (5);

[0068] C Keywords ←Encrypt(Keywords,Key Search (6);

[0069] In equations (5) and (6), C Date Indicates encrypted data, C Keywords This indicates the encryption key, Date represents the uploaded data, and Keywords represent the keywords in the uploaded data;

[0070] S23. After receiving the encrypted data and the encrypted keyword, the edge cloud server performs a hash operation on the encrypted data, and then uses the edge cloud server's key to sign the result of the hash operation. The calculation formula is shown in the following formula (7):

[0071]

[0072] In equation (7), H(C) Date ) represents the hash result of encrypted data, SK ES This is the private key for the edge cloud server. For signature;

[0073] Then, the encrypted data, the encrypted key, and the signature are combined into a tuple. The tuple is sent to the cloud server's storage database for storage;

[0074] (3) See Figure 2 Data search phase:

[0075] S31. Before a data visitor requests to search for data in the cloud server, the edge cloud server first uses remote authentication to verify the identity of the data visitor's terminal platform.

[0076] S32. After successful authentication of the data visitor terminal platform, the data visitor terminal platform sends the search keywords to the edge cloud server. The edge cloud server uses the search keywords to calculate the search trapdoor, and then sends the search request and the search trapdoor to the cloud server. The specific steps are as follows:

[0077] First, the data visitor terminal platform sends a search request Q←(id,Keywords) Search (Assigned to the edge cloud server, id is the identity identifier of the data visitor's terminal platform, Keywords) Search For the search keywords, the edge cloud server then uses the search keywords. Search and its corresponding search key. Search Calculate the search trapdoor T W The calculation formula is equation (8):

[0078] T W ←Encrypt(Keywords,Key Search (8);

[0079] In equation (8), Keywords Search The edge cloud server retrieves the corresponding search key based on the keywords that match the data uploaded to the data owner's terminal platform. Search Then the search trapdoor T is calculated. W ;

[0080] Finally, the edge cloud server will combine the data visitor's terminal platform identity ID and the search trap T. W Combined into a single search access request Q′←(id,T) W Finally, the search access request Q′ is sent to the cloud server;

[0081] S33, cloud server based on search trap T W The system performs keyword matching in the cloud server's storage database. Once a match is successful, it retrieves the encrypted data along with the corresponding encrypted keywords and signature. Send to the edge cloud server;

[0082] S34. After receiving the encrypted data, the edge cloud server verifies the integrity of the encrypted data, that is, compares whether H1 and H2 are consistent. The calculation formulas for H1 and H2 are shown in equations (9) and (10) below:

[0083] H1←H(C Date (9);

[0084]

[0085] In equations (9) and (10), H1 represents the hash result H(C) of the encrypted data. Date H2 indicates the use of the public key PK of the edge cloud server. ES Decrypt Signature The resulting hash value;

[0086] When H1 = H2, the integrity of the encrypted data is not compromised, and then the edge cloud server will transfer the search results R←(C). Date C Key ) is sent to the data accessor terminal platform, C Key The calculation formula is as follows (11):

[0087] C Key ←Encrypt(Key Share AIK DU (11);

[0088] In equation (11), C Key This indicates the use of the public key AIK of the data accessor terminal platform. DU Further encryption of data key Share The obtained key;

[0089] When H1≠H2, the integrity of the encrypted data is compromised, and the edge cloud server then sends the search results - data corruption information to the data visitor's terminal platform.

[0090] S35. The data visitor terminal platform receives the search result R and uses the data visitor terminal platform's private key AIK′. DU For C Key Decrypt to obtain the data key. Share Finally, use the data key. Share For encrypted data C Date Decryption is performed to obtain the searched data result Date. The calculation formulas are shown in equations (12) and (13) below:

[0091] Key Share ←Decrypt(C Key AIK′ DU (12);

[0092] Date←Decrypt(C Date Key Share (13).

[0093] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A cloud-edge collaborative data trust search method, characterized in that: Specifically, it includes the following steps: (1) Before the data owner uploads the data to the cloud server, the edge cloud server first uses remote authentication to verify the identity of the data owner's terminal platform. After successful verification, the edge cloud server distributes the data key and search key to the data owner's terminal platform. (2) After the data owner terminal platform obtains the data key and search key, it uses the data key to encrypt the data to be uploaded and the search key to encrypt the keywords of the data. Then it uploads the encrypted data and encrypted keywords to the edge cloud server. (3) After receiving the encrypted data and encrypted keywords, the edge cloud server performs a hash operation on the encrypted data, signs the hash operation result using the edge cloud server's key, and then sends the encrypted data, encrypted keywords and signature to the cloud server for storage. (4) Before a data visitor requests to search for data in the cloud server, the edge cloud server first uses remote authentication to verify the identity of the data visitor's terminal platform. (5) After the data visitor terminal platform successfully authenticates itself, the data visitor terminal platform sends the search keywords to the edge cloud server. The edge cloud server uses the search keywords to calculate the search trapdoor, and then sends the search request and the search trapdoor to the cloud server. (6) The cloud server performs keyword matching in the cloud server's storage database based on the search trap. After a successful match, the searched encrypted data, along with the corresponding encrypted keywords and signature, is sent to the edge cloud server. (7) After receiving the encrypted data, the edge cloud server verifies the integrity of the encrypted data. If the integrity of the encrypted data is not compromised, the encrypted data and the decryption key are sent to the data accessor terminal platform. (8) The data visitor terminal platform decrypts the encrypted data to obtain the search results.

2. The data trust search method under cloud-edge collaboration according to claim 1, characterized in that: The data owner terminal platform uses its TPM module to generate public-private key pairs (AIK). DO AIK′ DO The data accessor terminal platform uses its TPM module to generate public-private key pairs (AIKs). DU AIK′ DU The edge cloud server calculates its public-private key pair (PK). ES SK ES Furthermore, the edge cloud server is configured with a collision-resistant hash function H:{0,1}. * →Z q * Then (AIK) DO AIK DU PK ES (H) is publicly available.

3. The data trust search method under cloud-edge collaboration according to claim 2, characterized in that: The specific steps for the edge cloud server to remotely verify the identity of the data owner or data visitor terminal platform are as follows: The data owner or data visitor terminal platform calculates a random number N, and then generates a remote verification request (ID, N, PCR, IML) by combining the PCR value in the TPM module of the data owner or data visitor terminal platform and the integrity measurement log (IML) value. This remote verification request (ID, N, PCR, IML) is then sent to the edge cloud server. The IML value in the remote verification request records the integrity measurement information of the data owner or data visitor terminal platform under a secure state. This integrity measurement information under a secure state is stored in the PCR value, which can only be read. The edge cloud server compares the integrity measurement information in the PCR value of the remote verification request with the IML value in the remote verification request. If they match, the data owner or data visitor terminal platform is determined to be in a secure state, i.e., verification is successful. If they do not match, the data owner or data visitor terminal platform is determined to be in an insecure state, i.e., verification fails, and data upload or data search is not possible.

4. The data trust search method under cloud-edge collaboration according to claim 2, characterized in that: After the data owner's terminal platform successfully authenticates the user, the edge cloud server calculates the data key. Share and search key Search Then the edge cloud server uses the public key AIK of the data owner's terminal platform. DO Data Key Share and search key Search Further encryption is performed to obtain the data encryption key. and searching for encryption keys The encryption formulas are shown in equations (1) and (2) below: Then the edge cloud server uses the data encryption key. and searching for encryption keys The data is sent to the data owner's terminal platform, which then uses its private key AIK′. DO Data encryption key and searching for encryption keys Decrypt to obtain the data key. Share and search key Search The decryption formulas are shown in equations (3) and (4) below: In equations (1) to (4), Encrypt(X,Key) means encrypting X using the key Key, and Decrypt(Y,Key′) means decrypting Y using the key Key′.

5. The data trust search method under cloud-edge collaboration according to claim 4, characterized in that: The formulas for encrypting the data to be uploaded using a data key and encrypting the keywords of the data using a search key are shown in equations (5) and (6) below: C Date ←Encrypt(Date,Key Share ) (5); C Keywords ←Encrypt(Keywords,Key Search ) (6); In equations (5) and (6), C Date Indicates encrypted data, C Keywords This represents the encryption key, Date represents the uploaded data, and Keywords represents the keywords in the uploaded data.

6. The data trust search method under cloud-edge collaboration according to claim 5, characterized in that: The calculation formula for the edge cloud server to perform hash operation on encrypted data and then sign the hash operation result using the edge cloud server's key is shown in the following formula (7): In equation (7), H(C) Date ) represents the hash result of encrypted data, SK ES This is the private key for the edge cloud server. For signature; Then, the encrypted data, the encrypted key, and the signature are combined into a tuple. The tuple is sent to the storage database on the cloud server for storage.

7. The data trust search method under cloud-edge collaboration according to claim 6, characterized in that: The data visitor terminal platform sends search keywords to the edge cloud server. The edge cloud server uses the search keywords to calculate the search trapdoor, and then sends the search request and the search trapdoor to the cloud server. The specific steps are as follows: First, the data visitor terminal platform sends a search request Q←(id,Keywords) Search (Assigned to the edge cloud server, id is the identity identifier of the data visitor's terminal platform, Keywords) Search For the search keywords, the edge cloud server then uses the search keywords. Search and its corresponding search key. Search Calculate the search trapdoor T W The calculation formula is equation (8): T W ←Encrypt(Keywords,Key Search ) (8); In equation (8), Keywords Search The edge cloud server retrieves the corresponding search key based on the keywords that match the data uploaded to the data owner's terminal platform. Search Then the search trapdoor T is calculated. W ; Finally, the edge cloud server will combine the data visitor's terminal platform identity ID and the search trap T. W Combined into a single search access request Q′←(id,T) W Finally, the search access request Q′ is sent to the cloud server.

8. The data trust search method under cloud-edge collaboration according to claim 7, characterized in that: After receiving the encrypted data, the edge cloud server verifies the integrity of the encrypted data, that is, compares whether H1 and H2 are consistent. The calculation formulas for H1 and H2 are shown in equations (9) and (10) below: H1←H(C Date ) (9); In equations (9) and (10), H1 represents the hash result H(C) of the encrypted data. Date H2 indicates the use of the public key PK of the edge cloud server. ES Decrypt Signature The resulting hash value; When H1 = H2, the integrity of the encrypted data is not compromised, and then the edge cloud server will transfer the search results R←(C). D ate,C K (ey) is sent to the data visitor terminal platform, C Key The calculation formula is as follows (11): C Key ←Encrypt(Key Share AIK DU ) (11); In equation (11), C Key This indicates the use of the public key AIK of the data accessor terminal platform. DU Further encryption of data key Share The obtained key; When H1≠H2, the integrity of the encrypted data is compromised, and the edge cloud server then sends the search results - data corruption information to the data visitor's terminal platform.

9. The data trust search method under cloud-edge collaboration according to claim 8, characterized in that: The data visitor terminal platform receives the search result R and uses its private key AIK′. DU For C Key Decrypt to obtain the data key. Share Finally, use the data key. Share For encrypted data C Date Decryption is performed to obtain the searched data result Date. The calculation formulas are shown in equations (12) and (13) below: Key Share ←Decrypt(C Key AIK DU ) (12); Date←Decrypt(C Date ,Key Share ) (13)。

Images