A multi-key graph database encryption method and system supporting single-keyword retrieval

Abstract

This invention utilizes homomorphic encryption to propose a multi-key graph database encryption method and system that supports single-keyword retrieval. It enables full-text retrieval of symmetric encrypted ciphertext data under multiple keys using a single keyword. By employing this invention, secure partitioned encryption of graph databases can be achieved, reducing the risk of data leakage from single-key encrypted data. It also effectively leverages the data structure characteristics of graph databases, proposing a multi-key symmetric encryption solution with enhanced security. After completing multi-key encryption, to ensure the full-text retrieval capability of the graph database, a single-keyword full-text encrypted retrieval solution is proposed, improving the memory and communication overhead of encrypted retrieval.

Description

Technical Field

[0001] This invention relates to a multi-key graph database encryption method and system that supports single-keyword retrieval, belonging to the field of database privacy protection. Background Technology

[0002] Graph databases are systems designed for processing graph data, constructing graph models using nodes, relationships, and attributes. Compared to relational databases, graph databases can more efficiently represent complex relationships between entities through a natural graph structure, avoiding cumbersome table joins. Query languages ​​such as Cypher focus on graph queries, providing intuitive and concise syntax, enabling users to easily execute complex graph queries. Graph databases are suitable for fields such as social networks and recommendation systems, emphasizing the processing of intuitive connections between entities.

[0003] Neo4j is a graph database whose data storage structure is based on a graph model. Nodes represent entities, and relationships represent the connections between entities. Both nodes and relationships can contain attributes. This flexible graph structure enables intuitive and efficient representation and querying of complex data relationships. Furthermore, labels are used in graph databases to classify or group nodes. A node can have one or more labels, classifying it into different categories. This facilitates database management and ensures data isolation and security between different attributes.

[0004] Neo4j graph databases offer flexible and varied structures; however, the unified strategy of using a single-key encryption presents serious security vulnerabilities. The main drawback of this strategy is that a key leak will expose all data. Since a single key encrypts all nodes and relationships in the graph database, its failure will lead to a global data breach. In graph database environments, single-key encryption schemes pose significant risks to maintaining database security. Maintaining data security in dynamic and complex topologies is extremely challenging. To address this issue, multi-key schemes provide independent encryption keys for different nodes and relationships, ensuring that even if one key is leaked, not all information is exposed, greatly improving system security and data privacy protection. However, multi-key encryption introduces new challenges: the inability to directly retrieve ciphertext under different keys leads to complex query and retrieval processes, increasing the complexity of data management and analysis. Attached Figure Description

[0005] Figure 1 This is a flowchart of a multi-key symmetric graph data encryption algorithm.

[0006] Figure 2 This is a diagram of a single-keyword encrypted data retrieval system for a graph database. Summary of the Invention

[0007] To solve the above technical problems, the present invention utilizes the idea of homomorphic encryption and proposes a multi-key graph database encryption method supporting single-keyword retrieval, which can achieve full-text retrieval of a single keyword for symmetrically encrypted ciphertext data under multiple keys. The method includes the following steps:

[0008] (1) Initialization: Input security parameters and output public parameters;

[0009] (2) Key generation: Input public parameters, and generate respective symmetric keys for s users respectively, and generate a pair of public and private keys for the database server;

[0010] (3) Index generation: The data user constructs an index. Input public parameters, the public key of the database server, the user's symmetric key, the index key, and the keyword set, and output the encrypted index set;

[0011] (4) Trapdoor generation: Before retrieving the ciphertext data, the data user generates a trapdoor. Input public parameters, the user's key, and the keyword to be queried, and output the query trapdoor;

[0012] (5) Query matching: The database server performs query matching. Input public parameters, the user's key, the server's private key, the query trapdoor, and the index set, and return the matched data;

[0013] (6) Decryption: The data user decrypts the returned data. Input public parameters, the ciphertext data, and the user's key, and output the data plaintext.

[0014] Further, in step (2), according to different attributes of different nodes and relationships, distribute the key k i ∈K, 0 ≤ i < s, where s = n1 + n2, representing the total attributes of nodes and relationships in the graph database, K is the key space, and the set of s keys generated by the key distribution of the MSE algorithm is {k i}, as the user's key. The server selects a random value i∈[1,s] , calculates , selects a random value as pk , and makes the public key pk DB,2 of the server be pk DB = (pk DB,1 , pk DB,2 ), and the private key is sk DB = x, where the order of the multiplicative cyclic group is a prime number p, and g1 is a generator of the group G1.

[0015] Further, in step (3), first, calculate the index key through the symmetric key set before constructing the encrypted index represents the data file D of the i-th attribute iThe index key, where g2 is the multiplication group. The generators; then, for D i Select random value Calculate I2 using the user's symmetric key and select a random value. For the keyword set W = {w1,...,w...} L}, for keywords Calculate the encrypted key index in H2() is a hash function, and t represents the key information of the database server.

[0016] Furthermore, in step (4), a portion of the keys in the key set is used to perform homomorphic encryption to obtain the encrypted current D. i key k i Generate ciphertext Henc PK (k i In this algorithm, HEnc represents the homomorphic encryption algorithm, PK represents the public key of the HEnc algorithm, homomorphic addition is performed sequentially according to the order of the user key set, and finally decryption is performed using the private key SK of the HEnc algorithm to obtain the aggregate key. User selects random value Given the original keyword w and the keyword w′ to be searched, calculate the query trapdoor Tr for the keyword w′ to be searched. w′ ={Tr1,Tr2,Tr3}, where

[0017]

[0018] Based on the above methods, this invention proposes a multi-key graph database encryption system that supports single-keyword retrieval. This system can perform full-text retrieval of symmetric encrypted ciphertext data under multiple keys using a single keyword, and mainly includes the following modules:

[0019] (1) Initialization module: This module takes security parameters as input and outputs common parameters;

[0020] (2) Key generation module: This module takes common parameters as input, generates symmetric keys for each of the s users, and generates a public-private key pair for the database server.

[0021] (3) Index generation module: This module is used by data users to build indexes. It takes public parameters, database server public key, user symmetric key, index key and keyword set as input, and outputs encrypted index set.

[0022] (4) Trapdoor generation module: Before retrieving encrypted data, this module generates trapdoors by the data user. The user inputs public parameters, user key and keyword to be queried, and outputs the query trapdoor.

[0023] (5) Query matching module, which performs query matching by the database server. It inputs public parameters, user key, server private key, query trapdoor, and index set, and returns the matched data.

[0024] (6) Decryption module, which decrypts the returned data by the data user. It inputs public parameters, ciphertext data, and user key, and outputs the plaintext data.

[0025] Furthermore, in the key generation module, keys k i ∈K, 0 ≤ i < s are distributed to data users according to different attributes of different nodes and relationships, where s = n1 + n2 represents the total sum of the attributes of nodes and relationships in the graph database, K is the key space, and a set of s keys {k i} i∈[1,s] is generated by the key distribution of the MSE algorithm as the user key. The server selects a random value to calculate Select a random value as pk DB,2 , and let the public key pk DB of the server be (pk DB,1 , pk DB,2 ), and the private key be sk DB = x, where the order of the multiplicative cyclic group is a prime number p, and g1 is the generator of the group G1.

[0026] Furthermore, in the index generation module, first, the index key representing the data file D i of the i-th attribute is calculated through the symmetric key set before constructing the encrypted index, where g2 is the generator of the multiplicative group ; then, a random value <00000​​​​​​​​​​​​​​​​​​​​​​​​In this algorithm, HEnc represents the homomorphic encryption algorithm, PK represents the public key of the HEnc algorithm, homomorphic addition is performed sequentially according to the order of the user key set, and finally decryption is performed using the private key SK of the HEnc algorithm to obtain the aggregate key. User selects random value Given the original keyword w and the keyword w′ to be searched, calculate the query trapdoor Tr for the keyword w′ to be searched. w′ ={Tr1,Tr2,Tr3}, where

[0028]

[0029] In summary, this invention implements secure isolation and encryption measures for graph databases, and proposes a single-key encrypted index to address the difficulty of ciphertext retrieval caused by encryption. Full-text encrypted retrieval can be achieved using a single key and a single keyword.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0031] (1) Implement secure partition encryption for graph databases. This solution addresses the issue mentioned in the background that single-key encryption carries a higher risk of data leakage. It also effectively leverages the data structure characteristics of graph databases and proposes a multi-key symmetric encryption solution, offering enhanced security.

[0032] (2) This solution has the ability to perform single-keyword retrieval in a multi-key encryption system that cannot be achieved in the background technology. After completing multi-key encryption, in order to ensure the full-text retrieval capability of the graph database, a solution for single-keyword full-text ciphertext retrieval is proposed to improve the memory and communication overhead of ciphertext retrieval.

[0033] (3) Taking Neo4j as an example, this solution illustrates the feasibility and effectiveness of the proposed solution in graph databases. In addition, there are few existing solutions for graph database encryption and ciphertext retrieval. This solution provides a multi-key single-key ciphertext retrieval scheme based on symmetric encryption, which is simple and easy to deploy, improves the practicality of the scheme, and can be better integrated into applications. Detailed Implementation

[0034] In a graph database, a node is the basic data unit used to represent an entity or object. Nodes contain attributes that describe their characteristics or information; node attributes can include name, age, address, etc. Relationships describe the connections or associations between nodes, and relation attributes describe some characteristics of the relationship. Attributes are represented in key-value pairs. Additionally, labels are used in graph databases to identify the classification or grouping of nodes. A node can have one or more labels, classifying it into different categories.

[0035] To further protect the data privacy in the graph database and prevent the loss of the overall data file due to the leakage of a single key, multi-key symmetric encryption (Multi-key Symmetric Encryption Algorithm, MSE) is used to encrypt different types of attributes respectively. Specifically, assume that the nodes and relationships in the graph database have n1 and n2 different attributes respectively. The key generation center selects the parameters of different nodes, and can distribute the key k i ∈K, 0 ≤ i < s, where s = n1 + n2 and K is the key space. Use MSE.Enc to encrypt the node and relationship attribute values in the plaintext state, and MSE.Dec is the decryption algorithm. The multi-key symmetric encryption system of the graph database is as Figure 1 shown.

[0036] The encryption of the data file in the graph database by multiple keys realizes the differential access control of the database file, but there are certain limitations in the face of ciphertext file retrieval. To ensure the full-text retrieval index function of the graph database, the present invention proposes a multi-key ciphertext retrieval method for a single keyword. The method model includes two roles, the data user and the graph database server, as Figure 2 shown. The data user extracts a set of keywords from the document and encrypts them to generate an encrypted index. Then, the data user uploads the encrypted index and the encrypted document to the database server to achieve data security protection. In the data query stage, the user generates a query trapdoor according to the query keyword and submits the trapdoor to the server. In the query matching stage, the server matches the retrieved query trapdoor and the encrypted index. Finally, the server returns the encrypted documents that meet the matching keywords to the user. The user decrypts these documents locally to obtain the required information.

[0037] The present invention uses the idea of homomorphic encryption to propose a multi-key graph database encryption method that supports single-keyword retrieval, which can achieve full-text retrieval of a single keyword for symmetric encrypted ciphertext data under multiple keys. The method includes the following steps:

[0038] (1) Initialization: Input the security parameter and output the public parameter;

[0039] (2) Key generation: Input the public parameter, and generate respective symmetric keys for s users respectively, and generate a pair of public and private keys for the database server;

[0040] (3) Index generation: The data user constructs the index, inputs the public parameter, the public key of the database server, the user's symmetric key, the index key, and the keyword set, and outputs the encrypted index set;

[0041] (4) Trapdoor generation: Before retrieving the ciphertext data, the data user generates a trapdoor, inputs the public parameters, the user's key, and the keyword to be queried, and outputs the query trapdoor;

[0042] (5) Query matching: The database server performs query matching, inputs the public parameters, the user's key, the server's private key, the query trapdoor, and the index set, and returns the matched data;

[0043] (6) Decryption: The data user decrypts the returned data, inputs the public parameters, the ciphertext data, and the user's key, and outputs the plaintext data.

[0044] Furthermore, in step (2), the key k i ∈K, 0 ≤ i < s is distributed to the data user according to the different attributes of different nodes and relationships, where s = n1 + n2 represents the total sum of the attributes of nodes and relationships in the graph database, K is the key space, and the set of s keys generated by the key distribution of the MSE algorithm is {k i} i∈[1,s] , which is used as the user's key. The server selects a random value to calculate Let the random value be used as pk DB,2 , and let the public key pk DB of the server be (pk DB,1 , pk DB,2 ), and the private key is sk DB = x, where the order of the multiplicative cyclic group is a prime number p, and g1 is the generator of the group G1. By combining the multi-key set with the structural characteristics of the graph database, different attributes of database nodes and relationships are encrypted respectively, preventing the loss of all data resources caused by the leakage of keys in the single-key system, and realizing the secure isolation between graph database data.

[0045] Furthermore, in step (3), to ensure the full-text ciphertext retrieval after the secure isolation between database data, an encrypted index is constructed according to the keys corresponding to the attributes of different types of nodes and relationships, and the keyword set W = {w1,..., w k} is extracted from the divided data files. First, before constructing the encrypted index, the index key is calculated through the symmetric key set, which represents the index key of the data file D i of the i-th attribute, where g2 is the generator of the multiplicative group . A random value i is selected for D , and the server public key pk DB is used to calculate Only servers possessing the corresponding private key can correctly execute query matching. Specifically, to ensure index security, I2 is calculated using the user's symmetric key, and a random value is selected. For the keyword set W = {w1,...,w...} L}, for keywords Calculate the encrypted key index H2() is a hash function.

[0046] Furthermore, in step (4), to achieve keyword indexing under multiple keys, a portion of the keys in the key set is used to calculate the encrypted current key through homomorphic encryption. i key k i Generate ciphertext HEnc PK (k i In this context, HEnc represents the homomorphic encryption algorithm, PK represents the public key of the HEnc algorithm, and homomorphic addition is performed sequentially according to the order of the user key set. Finally, the private key SK of the HEnc algorithm is used to perform decryption to obtain the aggregate key. When calculating Tr2, its security is ensured by the database server's public key, the user's key, and the aggregate key. Additionally, the user selects a random value. Given the original keyword w and the keyword w′ to be searched, calculate the query trapdoor Tr for the keyword w′ to be searched. w′ ={Tr1,Tr2,Tr3}, where

[0047] A more specific example:

[0048] {

[0049] "identity":2,

[0050] "labels":[

[0051] "metric"

[0052] ],

[0053] "properties":{

[0054] "explain":"Synchronization process error",

[0055] "name":"Database Status",

[0056] "desc": "Monitor whether the MRP process is alive. If the process does not exist, database synchronization may be interrupted."

[0057] },

[0058] "elementId":"2"

[0059] }

[0060] Taking a portion of the data from the graph database above as an example, the node name in this data entry is "metric," which contains three attributes: "explain," "name," and "desc." For this data entry, we would design three different keys to encrypt the values ​​of each of the three attribute types. For example, the AES algorithm could be used for encryption.

[0061] The specific algorithm is as follows:

[0062] (1) Initialization:

[0063] Given a security parameter λ, the parameters of the asymmetric bilinear pair are γ = (p, G1, G2, G...). T ,e,g1,g2), where the multiplicative cyclic group G1,G2,G T Let the order of the group be a prime number p, and g1 and g2 be generators of the groups G1 and G2, respectively. Let e: G1 × G2 → G T Hash function Output common parameters

[0064] (2) Key generation:

[0065] The set of s keys generated by the MSE algorithm is {k} i} i∈[1,s] This serves as the user's symmetric key. Additionally, a public-private key pair is generated for the database server, with the server selecting a random value. calculate Let random value As a PK DB,2 Then the server's public key pk DB =(pk DB,1 ,pk DB,2 The private key is sk. DB =x.

[0066] (3) Index building:

[0067] To ensure secure isolation between database data, an encrypted index is constructed according to the different types of attributes of nodes and relationships, corresponding to keys. The key set W = {w1,...,w...} is extracted from the partitioned data files. L First, before constructing the encrypted index, the index key is calculated using the symmetric key set. It represents the data file D of the i-th attribute. i The index key. For D i Select random value Use the server public key to PK DB calculate Only servers possessing the corresponding private key can correctly execute query matching. To ensure index security, I2 is calculated using the user's symmetric key, and further, a random value is selected. Calculate the encrypted key index in H2() is a hash function.

[0068] (4) Trapdoor generation

[0069] To implement keyword indexing under multiple keys, a subset of keys in the key set is used to compute the encrypted current key using homomorphic encryption. i key k i Generate ciphertext HEnc PK (k i In this context, HEnc represents the homomorphic encryption algorithm, PK represents the public key of the HEnc algorithm, and homomorphic addition is performed sequentially according to the order of the user key set. Finally, the private key SK of the HEnc algorithm is used to perform decryption to obtain the aggregate key. User selects random value Given the original keyword w and the keyword w′ to be searched, calculate the query trapdoor Tr for the keyword w′ to be searched. w′ ={Tr1,Tr2,Tr3}, where Tr1 = u w ,

[0070] (5) Query matching

[0071] After receiving a query request, the server uses a query trapdoor to perform a match in the encrypted index. The specific process is as follows:

[0072] The server uses the I1 key in the index and its own public key to perform a PK. DB,2 Private key sk DB The secret value t is calculated as follows:

[0073]

[0074] After obtaining t, verify the equation.

[0075] If both formulas are true, the correct result can be matched.

[0076]

[0077] If w′=w, then left=right, meaning the query match is successful.

[0078] Specifically, three 256-bit keys are randomly generated for the three attributes, as follows:

[0079] {k1,k2,k3}

[0080] ={XVEBBjyBCqQeZc+7JPPaqGnJNbtr+ / jr,bsCna6tFLxBWdp6ey41GAEKfT41lYWO2,

[0081] ylklPip6l9naj4c5cVGk9i / s1TpDHrt8}

[0082] The ciphertext for the attribute values ​​are as follows:

[0083] "explain":"Synchronization process error"→"U2FsdGVkX1+SM8A8+ru5KS5wO / Ya8I9t6rAj2W85y+jTeATPOYXrKc6Zptvd3J9p"

[0084] "

[0085] "name":"Database Status"→"U2FsdGVkX19wQe0l / HbWoS4BEWeS6FIm89YVQSAEmUw="

[0086] "desc":"Monitor whether the MRP process is alive. If the process does not exist, database synchronization may be interrupted." → "U2FsdGVkX18ugi8FgGtjs+oH3HrNqODcg3FcgOqFBs7o3CP / NbzatvU429QtkHH2"

[0087] pZPhUl7IQVCiVrIyFLzjJE77yKGJ6ka+U8EHJWa1OdDojBBYBXrlEgBgfydA F150"

[0088] During the query matching process, for files D1 and D2, where D1 contains keywords w1 and w2, and D2 contains keywords w1 and w3, encrypted indexes are built using index building algorithms. When a user wants to search for data related to keyword w1, they only need to execute the trapdoor generation algorithm to generate a query trapdoor. This information is then sent to the database server. The server can use this trapdoor to perform a query process across all files and return an encrypted index containing the keyword w1, encrypted with all keys.

[0089] The units, devices, or modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. For ease of description, the above devices are described by dividing them into various modules according to their functions. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection between the devices or units shown or discussed can be through some interfaces, and the indirect coupling or communication connection between the devices or units can be electrical, mechanical, or other forms.

[0090] Those skilled in the art will also know that, besides implementing the controller using purely computer-readable program code, the same functions can be achieved by logically programming the method steps, making the controller function as logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers (PLCs), and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the devices within it used to implement various functions can also be considered structures within that hardware component. Alternatively, the devices used to implement various functions can be considered as both software modules implementing the method and structures within a hardware component.

[0091] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, classes, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0092] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, mobile terminal, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0093] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. This application can be used in numerous general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices, etc.

[0094] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A multi-key graph database encryption method supporting single-keyword retrieval, capable of performing full-text retrieval of symmetric encrypted ciphertext data under multiple keys using a single keyword, characterized in that: The method includes the following steps: (1) Initialization: Input security parameters, output common parameters; (2) Key generation: Input common parameters to generate symmetric keys for each of the s users and generate a public-private key pair for the database server; (3) Index generation: The data user builds the index by inputting public parameters, database server public key, user symmetric key, index key and key set, and outputs encrypted index set; (4) Trapdoor generation: Before retrieving encrypted data, the data user generates a trapdoor by inputting public parameters, user key and keyword to be queried, and outputting the query trapdoor; (5) Query matching: The database server performs query matching, inputting public parameters, user key, server private key, query trapdoor and index set, and returns the matched data; (6) Decryption: The data user decrypts the returned data, inputs the public parameters, ciphertext data and user key, and outputs the plaintext data; In step (2), keys are distributed to data users based on the different attributes of different nodes and relationships. ,in This represents the sum of attributes of nodes and relations in a graph database. The key space is the set of s keys generated by the key distribution of the MSE algorithm. This serves as the user's key; a random value is selected by the server. ,calculate Choose a random value As , let the server's public key The private key is Among them, the multiplication cyclic group The order of the prime number p is . For the group Generators; In step (3), firstly, before constructing the encrypted index, the index key is calculated using the symmetric key set. , representing the data file of the i-th attribute The index key, where For multiplication group The generator; then, for Select random value ; Compute using user symmetric key Select random value For keyword sets For keywords , Calculate the encrypted key index ,in Here, t is a hash function, and t represents the database server's key information.

2. The multi-key graph database encryption method supporting single-keyword retrieval as described in claim 1, characterized in that: In step (4), a portion of the keys in the key set is used to perform homomorphic encryption to obtain the encrypted current key. key Generate ciphertext Here, Henc represents the homomorphic encryption algorithm, PK represents the public key of the Henc algorithm, homomorphic addition is performed sequentially according to the order of the user key set, and finally decryption is performed using the private key SK of the Henc algorithm to obtain the aggregate key. The user selects a random value. For the original keywords and keywords to be searched Calculate the keywords to be searched Query trap ,in .

3. A multi-key graph database encryption system supporting single-keyword retrieval, wherein the system can perform full-text retrieval of symmetric encrypted ciphertext data under multiple keys using a single keyword, characterized in that: Includes the following modules: (1) Initialization module: This module takes security parameters as input and outputs common parameters. (2) Key generation module: This module takes common parameters as input, generates symmetric keys for each of the s users, and generates a public-private key pair for the database server. (3) Index generation module. This module is used by data users to build indexes. It takes public parameters, database server public key, user symmetric key, index key and key set as input, and outputs encrypted index set. (4) Trapdoor generation module: Before retrieving encrypted data, this module generates trapdoors by the data user. The user inputs public parameters, user key and keyword to be queried, and outputs the query trapdoor. (5) Query matching module. This module performs query matching by the database server. It takes public parameters, user key, server private key, query trapdoor and index set as input and returns the matched data. (6) Decryption module: This module is used by the data user to decrypt the returned data. It takes common parameters, ciphertext data and user key as input and outputs plaintext data. In the key generation module, keys are distributed to data users based on different attributes of different nodes and relationships. ,in This represents the sum of attributes of nodes and relations in a graph database. The key space is the set of s keys generated by the key distribution of the MSE algorithm. This serves as the user's key; a random value is selected by the server. ,calculate Choose a random value As , let the server's public key The private key is Among them, the multiplication cyclic group The order of the prime number p is . For the group Generators; In the index generation module, the index key is first calculated using a set of symmetric keys before constructing the encrypted index. , representing the data file of the i-th attribute The index key, where For multiplication group The generator; then, for Select random value ; Calculation using user symmetric key Select random value For keyword sets For keywords , Calculate the encrypted key index ,in Here, t is a hash function, and t represents the database server's key information.

4. The multi-key graph database encryption system supporting single-keyword retrieval as described in claim 3, characterized in that: In the trapdoor generation module, a portion of the keys in the key set is used to perform homomorphic encryption to obtain the encrypted current key. key Generate ciphertext Here, Henc represents the homomorphic encryption algorithm, PK represents the public key of the Henc algorithm, homomorphic addition is performed sequentially according to the order of the user key set, and finally decryption is performed using the private key SK of the Henc algorithm to obtain the aggregate key. The user selects a random value. For the original keywords and keywords to be searched Calculate the keywords to be searched Query trap ,in .

Images