An oblivious dynamically searchable encryption method

Abstract

The present invention provides an inadvertent dynamic searchable encryption method, which relates to the field of information security technology. The method includes: in the bottom layer module, based on the receiving party processor and the sending party processor, using the encoding algorithm and decoding algorithm that formally represent OKVS, and combining the VOLE technology to construct a new Labeled PSI technology, to obtain the intersection Z of both parties and the corresponding label; in the application layer, the client and the server jointly negotiate a database update method to dynamically update the database, and the client and the server jointly negotiate a database search method to decrypt the document, and complete the encryption processing of the inadvertent dynamic searchable. The present invention improves the security and efficiency of the dynamic searchable encryption technology.

Description

Technical Field

[0001] The invention belongs to the field of information security technology, and in particular relates to an inadvertent dynamic searchable encryption method. Background Art

[0002] In the era of digital economy with rapid development of information technology, data has become a new factor of production, and its storage and processing processes are gradually shifting to the cloud. However, in the cloud environment, users are separated from data, users cannot control data, and the existence of privacy content hinders the full release of data value. Although data privacy can be effectively protected by introducing high-strength cryptographic primitives to encrypt data before storage, users cannot perform meaningful calculations and search operations on ciphertext data. Therefore, how to perform efficient and secure retrieval on ciphertext data has become a challenging problem.

[0003] Searchable Encryption (SE) allows users to efficiently perform retrieval operations in ciphertext. However, most existing SE schemes are oriented towards static data sets. If the stored data is updated, the search index needs to be reconstructed. At the same time, some schemes are constructed using complex cryptographic primitives, which have good theoretical effects but extremely poor actual efficiency and limited applicable scenarios. Therefore, some scholars have proposed Dynamic Searchable Encryption (DSE) and Oblivious Keyword Search (OKS) to make up for this shortcoming.

[0004] DSE allows users to dynamically add or delete encrypted databases, while OKS can hide the statistical characteristics of keyword ciphertexts and provide better privacy protection. OKS can also be regarded as a special kind of labeled unbalanced private set intersection (Labeled PSI), so designing a searchable encryption scheme based on the Labeled PSI protocol can better protect privacy security.

[0005] Private Set Intersection (PSI) is a specific application problem in the field of secure multi-party computation and is one of the hot issues in privacy protection. PSI uses a series of underlying cryptographic technologies to allow participants to use local data sets to calculate intersections without leaking any information other than the intersection. The intersection information can be obtained by either one participant or all participants. Although PSI technology is relatively mature, there has been no research on its application in the field of dynamic searchable encryption.

[0006] Judging from the currently available codes, papers and patents, the existing DSE schemes face a series of privacy and security issues, such as the leakage of search patterns and access patterns, etc. At the same time, there is a lack of formal security models that cover the real capabilities of attackers to prove the security of the DSE scheme; in terms of update efficiency, due to the frequent updates of the index structure caused by the insertion and deletion of data, as the amount of data and the number of users continue to increase, unreasonable index structures will lead to inefficient updates, and key management will become more and more complicated; in terms of search efficiency, traditional methods need to transmit a large number of ciphertext copies, resulting in huge search communication overhead. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the present invention provides an inadvertently dynamically searchable encryption method, which solves the problems of low efficiency, high communication overhead and query privacy leakage in the prior art when supporting dynamic data update.

[0008] In order to achieve the above objectives, the technical solution adopted by the present invention is: an inadvertent dynamic searchable encryption method, comprising the following steps:

[0009] S1. In the bottom layer module, based on the receiving processor and the sending processor, the encoding algorithm and decoding algorithm of the OKVS are formally represented, and the Labeled PSI protocol is constructed based on the OKVS and VOLE technical framework. The receiving processor obtains the intersection result Z and the corresponding label, where the intersection result Z is the keyword set to be searched, and the corresponding label stores the document identifier set corresponding to the keyword;

[0010] S2. At the application layer, the client and the server jointly negotiate a database update method, encrypt the plaintext document, and complete the ciphertext database update operation; and the client and the server jointly negotiate a database search method, complete multi-keyword dynamic search based on the Labeled PSI protocol, and the client decrypts the document after obtaining the search results.

[0011] Furthermore, the step S1 includes the following steps:

[0012] S101, a receiving processor generates a random matrix M according to a key value set (k, v), wherein each row of the random matrix M includes a random block of a fixed length and a random starting position, k represents the key set, and v represents the value vector;

[0013] S102, formalizing the encoding algorithm of OKVS according to the random block elements to solve z in the linear system M·z=v; wherein z represents the encoding result of the key value set after OKVS encoding;

[0014] S103, based on the solved z, the decoding algorithm of OKVS is formally expressed to recover the given arbitrary key k i The corresponding value v i ;

[0015] S104. To construct the Labeled PSI protocol, the receiving processor encodes all keys based on OKVS and encapsulates the encoding results using the VOLE protocol. After the sending processor and the receiving processor call the VOLE protocol, the sending processor obtains parameters Δ,B, and the receiving processor obtains parameters A,C, and C=ΔA+B. The Labeled PSI protocol encapsulates the OKVS encoding results using random variables. The encapsulation process is as follows: the receiving processor encapsulates A'=A+P and transmits it to the sending processor; the sending processor encapsulates K=ΔA'+B, so that it satisfies:

[0016] K=ΔA'+B=Δ(A+P)+B=ΔA+B+ΔP=C+ΔP

[0017] Wherein, Δ represents the random scalar generated by the VOLE protocol function module, A, B, and C all represent random vectors generated by the VOLE protocol function module, and satisfy C = ΔA + B, A' represents the mask after the information is encapsulated, P represents the encoding result of the receiving processor data set after OKVS encoding, and K represents the intermediate calculation vector of the sending processor;

[0018] S105. According to the encapsulation result, based on the OKVS decoding algorithm of S103, by calculating X', L' and Y' respectively, the receiving processor obtains the intersection result Z and the corresponding label, and completes the construction of the Labeled PSI protocol:

[0019] Z=X'∩Y'

[0020] Among them, Z represents the final intersection result of the Labeled PSI protocol, X' represents the masked ciphertext of the local set X of the sender processor, L' represents the ciphertext set after the document identifier l is encrypted, and Y' represents the masked ciphertext of the local set Y of the receiver processor.

[0021] Furthermore, the step S101 includes the following steps:

[0022] A1. The receiving processor generates a random matrix M according to the key value set (k, v), wherein each row of the random matrix M includes a fixed length of b. w , random blocks with random starting positions;

[0023] A2. For each row in the random matrix M, the receiving processor randomly selects s i As the starting position of the random block of row i;

[0024] A3. According to the key k corresponding to each row i of the matrix i , using a random oracle to generate b w A random block element of bits.

[0025] Furthermore, the step S102 includes the following steps:

[0026] B1. The receiving processor calculates the starting position s of each row of random blocks in the random matrix M. i Sort and renumber;

[0027] B2. The receiving processor traverses the random block elements of each row in the random matrix M. When M[i][j] = 1, the following formula is used to calculate all random block elements that satisfy M[i'][j] = 1, i'>i, and s i All elements ≤ j are processed:

[0028] M[i']=M[i']⊕M[i]

[0029] v[i']=v[i']⊕v[i]

[0030] Where M[i][j] represents the element in the i-th row and j-th column of the random matrix M, M[i] represents all elements in the i-th row of the random matrix M, v[i'] represents the element in the i'th row of the value vector, and s i represents the starting column position of the random block in the i-th row of the random matrix M, M[i'] represents all elements in the i'th row of the random matrix M, v[i] represents the elements in the i-th row of the value vector, and M[i'][j] represents the elements in the i'th row and j-th column of the random matrix M. After the row processing operation, only the elements in the i-th row of the j-th column of the random matrix M are 1, and the elements in the i'>i row are all 0;

[0031] B3. According to the processing result of step B2, use the following formula to solve z in the linear system. When there is a row with all elements being 0 during the row processing, directly set z←F m ;otherwise:

[0032] z i = <z i ,M[i]>+v i

[0033] Among them, F m represents a vector space of dimension m, z i represents the i-th row element of z, v i Represents the i-th row element in the value vector.

[0034] Furthermore, the step S103 includes the following steps:

[0035] C1. Let v←0, calculate the starting position s←H(k) of the random block and the element in the random block corresponding to any key k value Where v represents the value corresponding to any given key k, H(·) represents a random hash function, and b w represents the length of each row of the random block in the random matrix M, and k represents any key that needs to be decoded;

[0036] C2. According to the calculation result of step C1, for j∈[1,b w ], calculate v←v+u[j']·z[s+j-1] as the final return value, and complete the calculation for any given key k i The corresponding value v i Recovery, where j represents the column position of each row of the random block in the random matrix M, u[j'] represents the j'th element of the random block, and s represents the starting position of the random block.

[0037] Furthermore, the step S104 includes the following steps:

[0038] D1. To build the Labeled PSI protocol, the sending processor and the receiving processor both call the VOLE protocol, where the receiving processor encodes all keys based on OKVS and encapsulates the encoding results using the VOLE protocol;

[0039] D2. After the VOLE protocol runs, the sending processor receives and obtains the parameter Δ,B, and the receiving processor receives and obtains the parameter A,C, where Δ represents the random scalar generated by the VOLE protocol function module, and A, B, and C all represent the random vector generated by the VOLE protocol function module, and satisfy C = ΔA + B;

[0040] D3. The receiving processor uses the following formula to encapsulate A' and sends A' to the sending processor:

[0041] A'=A+P

[0042] Wherein, P represents the encoding result of OKVS performed by the receiver, and A' represents the mask after encapsulating the information;

[0043] D4. Based on A', the sending processor calculates K using the following formula:

[0044] K=ΔA'+B=Δ(A+P)+B=ΔA+B+ΔP=C+ΔP

[0045] Wherein, K represents the intermediate calculation vector of the sending processor, and P represents the encoding result of the receiving processor data set after OKVS encoding.

[0046] Furthermore, the step S105 includes the following steps:

[0047] E1. According to the encapsulation result, based on the OKVS decoding algorithm of S103, the sending processor calculates X' and L' using the following formulas:

[0048] X'={H o (Decode(K,x)-ΔH F (x))|x∈X}

[0049] L'={Sym_En(K doc ,l)|l∈L[x]}

[0050] Among them, H o and H F Decode(K,x) represents the decoding operation of OKVS, K represents the intermediate calculation vector of the sender processor, x represents the element in the set X, Sym_En represents the secure symmetric encryption algorithm, K doc represents the document encryption key, L[x] represents the document identifier set corresponding to element x, l represents an element in the document identifier set L[x], and X represents the set used by the server for the Labeled PSI protocol;

[0051] E2. The access-side processor calculates Y' using the following formula and sends it to the sender processor;

[0052] Y'={H o (Decode(C,y),y)|y∈Y}

[0053] Where Decode(C,y) represents the decoding operation of OKVS, y represents the element in the set Y, and C represents the random vector generated by the VOLE protocol;

[0054] E3. According to X' and Y', use the following formula to calculate Z, that is, the result of the original data set X∩Y:

[0055] Z = X'∩Y';

[0056] E4. According to Z, the corresponding label {L[z]|z∈Z} is obtained to complete the construction of the Labeled PSI protocol, where L[z] represents the set of document identifiers corresponding to the intersection set element z.

[0057] Furthermore, step S2 includes the following steps:

[0058] S201, generating a key, an empty keyword status table and an empty encryption database on the client;

[0059] S202, the client and the server jointly negotiate a database update method, encrypt the plaintext document, and complete the ciphertext database update operation;

[0060] S203. According to the update result, the client and the server jointly negotiate a database search method, and perform multi-keyword dynamic search based on the Labeled PSI protocol. After the client obtains the search result, it decrypts the document.

[0061] Furthermore, the step S202 includes the following steps:

[0062] F1. A series of empty lists T are generated by the client w ,T kw ,T dic ,T count ,T update , where Table T w Used to save the keyword information in this update process, table T kw Used to save keyword w to keyword token kt w The mapping table T dic Table T is used to store the ciphertext information on the document index chain DIC. count Table T is used to save the number of documents corresponding to keyword w. update Used to save all ciphertext information during this update process;

[0063] F2. The client extracts documents one by one from the document database DB. For any keyword w, the client calculates table T w , and look up the keyword σ[w] from the local keyword state table;

[0064] F3. In response to the keyword σ[w] not being found, let σ[w]←0, and calculate the latest update number n of the keyword w update ←σ[w]+1;

[0065] F4. According to the calculation result of step F3, the client obtains the kw Search in (kt w ,st w )←T kw [w], in response to not finding, calculate kt w ←F(K s ,w)、 and T kw ←T kw ∪{w,(kt w ,st w )}, where T kw [w] represents keyword w to keyword token kt w and search token stw The mapping of F(K s ,w) represents a pseudo-random function, H() represents a hash function, Indicates the latest update times of keyword w;

[0066] F5. According to the calculation result of step F4, the client obtains the count Find T in count [w], in response to not finding, let T count [w]←0, and get c w ←T count [w]+1, where T count [w] represents a list of document identifiers corresponding to keyword w, c w Indicates the number of documents corresponding to keyword w during this update operation;

[0067] F6. According to the calculation result of step F5, the calculation document encryption information loc←H(st w ,c w )、eid←Sym_En(K doc ,id) and T dic [st w ]←T dic [st w ]∪{(loc,eid)}, where loc represents the address of each node in the document index chain DIC, eid represents the encrypted ciphertext of the document identifier id, Sym_En represents the symmetric encryption operation, and K doc Represents the document encryption key, T dic [st w ] indicates the search token st w The corresponding document index chain;

[0068] F7. For any keyword w∈T w , the client calculates σ[w]←σ[w]+1, (kt w ,st w )←T kw [w]、c w ←T count [w] and value←G(st w ,1 λ )⊕(op||c w ), and (kt w ,(value,T dic [st w ]))Save to table T update In the table T update Sent to the server, where table T wAll the keyword sets involved in this update process are stored in σ[w], which represents the client local keyword status table, c w Indicates the number of documents corresponding to keyword w during this update operation, T count [w] represents the number of documents corresponding to keyword w, value represents the operation information mask of this update process, G() represents the hash function, op represents the operation type, op=0 represents the document adding operation, op=1 represents the document deleting operation, and λ represents the calculation security parameter;

[0069] F8, the server will table T update Merge with the encrypted database EDB to complete the update operation on the ciphertext database.

[0070] Furthermore, the step S203 includes the following steps:

[0071] G1. Based on the update result, the client generates Y”, R←{}. For any keyword w, calculate kt w ←F(K s ,w)、st w ←H(kt w ,σ[w]), and the search token st w Save to Y", where Y represents the client's set for the Labeled PSI protocol, R represents the final result set, and kt w represents a keyword token, F(K s ,w) represents a pseudo-random function, st w represents the search token, H() represents the hash function, σ[w] represents the keyword, kt w Represents a keyword token;

[0072] G2, the server generates X”, L[x]←{}, for the encrypted database EDB, calculate st w ←H(kt w ,c i ), where "X" represents the set of Labeled PSI protocols used by the server, L[x] represents the set of document identifiers corresponding to element x, and c i Indicates the c i nodes;

[0073] G3, based on the generated search token st w , use the following formula to calculate op and c w :

[0074] (op||c w )←value⊕G(st w ,1 λ )

[0075] Among them, c w represents the number of documents corresponding to the keyword w during this update operation, value represents the operation information mask of the corresponding update process, G() represents the hash function, op represents the operation type, op=0 represents the document adding operation, op=1 represents the document deleting operation, and λ represents the calculation security parameter;

[0076] G4, from 1 to c w , we can calculate loc←H(st w ,j) and Eid←EDB[loc], where loc represents the address of the jth node in the document index chain DIC, Eid is the encrypted ciphertext of the document identifier id, and EDB represents the encrypted database;

[0077] G5. The server sends the search token st w Save to X", add the encrypted document identifier with op=0 to L[x], and remove the encrypted document identifier with op=1 from L[x];

[0078] G6. The client and the server jointly call the Labeled PSI protocol. After the Labeled PSI protocol runs, the client receives the final result intersection I = X”∩Y” and {L[y']|y'∈I} corresponding to the intersection element, where L[y'] represents the encrypted document to be searched by the client, and y' represents the intersection set element;

[0079] G7. The client saves L[y'] to the set R and uses the key to decrypt the document, completing the encryption processing of the inadvertent dynamic searchable document.

[0080] Beneficial effects of the present invention:

[0081] (1) The present invention applies new cryptographic parameters. The existing technology is still blank in the field of searchable encryption using PSI. The present invention proposes a new and effective oblivious keyword search protocol. Compared with the traditional dynamic searchable encryption protocol, the present invention supports multi-keyword search, realizes forward security and backward security, and protects the privacy of the search mode during the search process.

[0082] (2) Compared with the OKS protocol in which the number of ciphertexts is equal to the product of the number of keywords and the number of files, the communication overhead of the present invention is only equal to the number of files corresponding to the query keyword set, and the communication efficiency is higher; a formal security model is used to prove the security of the protocol, that is, a random oracle model is used to simulate common attacks, such as selected keyword attacks, to prove the security of the protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 The figure is a flow chart of the method of the present invention.

[0084] Figure 2 A schematic diagram of a dynamic searchable encryption system model that satisfies a single-read and single-write architecture is provided according to an implementation use case of the present invention. DETAILED DESCRIPTION

[0085] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0086] Example

[0087] like Figure 1 to Figure 2As shown, the present invention provides an oblivious dynamic searchable encryption method, including an underlying module (Labeled PSI) and an application layer. The underlying module is mainly used to support the implementation of the application layer search algorithm. Its technical structure consists of Oblivious Key-Value Stores (Oblivious Key-Value Stores OKVS) and Vector Oblivious Linear Evaluation (Transparent Vector Linear Evaluation VOLE), and mainly includes two entities: a sender processor Sender and a receiver processor Receiver. Among them, the sender processor Sender holds a data set X. For any x∈X, the sender processor Sender holds a set of corresponding label sets {L[x]|x∈X}, and the receiver processor Receiver holds a data set Y; its technical architecture consists of Oblivious Key-Value Stores (OKVS) and Vector Oblivious Linear Evaluation (VOLE). The application layer has two entities, the client and the server; the dynamic searchable encryption scheme involved in the present invention can be roughly divided into three stages: Setup, Update and Search, and is based on a special secondary index structure, which includes a keyword index chain (Keyword index chain, KIC) and a document index chain (Document index chain, DIC), wherein the keyword index chain KIC is used to store keyword update information, and the document index chain DIC is used to store encrypted document information; in the index structure, each keyword w corresponds to a keyword index chain KIC, each keyword index chain KIC contains n nodes, each node represents an update operation of the keyword, and the node is linked to a document index chain DIC; and each node of the document index chain DIC corresponds to an encrypted keyword / document pair. Among them, the Labeled PSI protocol is a labeled unbalanced privacy set intersection technology. Its implementation method is as follows:

[0088] S1. In the bottom layer module, based on the receiving processor and the sending processor, the encoding algorithm and decoding algorithm of the OKVS are formally represented, and the Labeled PSI protocol is constructed based on the OKVS and VOLE technical framework. The receiving processor obtains the intersection result Z and the corresponding label, where the intersection result Z is the keyword set to be searched, and the corresponding label stores the document identifier set corresponding to the keyword. The implementation method is as follows:

[0089] S101, the receiving processor generates a random matrix M according to the key value set (k, v), wherein each row of the random matrix M includes a random block of fixed length and random starting position, k represents the key set, and v represents the value vector, and the implementation method thereof is as follows:

[0090] A1. The receiving processor generates a random matrix M according to the key value set (k, v), wherein each row of the random matrix M includes a fixed length of b. w , random blocks with random starting positions;

[0091] A2. For each row in the random matrix M, the receiving processor randomly selects s i As the starting position of the random block of row i;

[0092] A3. According to the key k corresponding to each row i of the matrix i , using a random oracle to generate b w A random block element of bits.

[0093] In this embodiment, the receiving processor Receiver generates a random matrix M∈F n×m , each row of the random matrix M contains a length of b w The random blocks are randomly selected from {0,1}, and all elements outside the blocks are 0; for each row i∈[1,n] in the random matrix, the receiver processor Receiver randomly selects s i ←H(k i ) as the starting position of the random block in the i-th row, where k i represents the i-th key value; then a random oracle is used to generate b w Random block elements of bits

[0094] S102, according to the random block elements, the coding algorithm of OKVS is formally represented to solve z in the linear system M·z=v; wherein z represents the coding result of the key value set after OKVS coding; the implementation method thereof is as follows:

[0095] B1. The receiving processor calculates the starting position s of each row of random blocks in the random matrix M. i Sort and renumber;

[0096] B2. The receiving processor traverses the random block elements of each row in the random matrix M. When M[i][j] = 1, the following formula is used to calculate all random block elements that satisfy M[i'][j] = 1, i'>i, and s i All elements ≤ j are processed:

[0097]

[0098]

[0099] Where M[i][j] represents the element in the i-th row and j-th column of the random matrix M, M[i] represents all elements in the i-th row of the random matrix M, v[i'] represents the element in the i'th row of the value vector, and s i represents the starting column position of the random block in the i-th row of the random matrix M, M[i'] represents all elements in the i'th row of the random matrix M, v[i] represents the elements in the i-th row of the value vector, and M[i'][j] represents the elements in the i'th row and j-th column of the random matrix M. After the row processing operation, only the elements in the i-th row of the j-th column of the random matrix M are 1, and the elements in the i'>i row are all 0;

[0100] B3. According to the processing result of step B2, use the following formula to solve z in the linear system. When there is a row with all elements being 0 during the row processing, directly set z←F m ;otherwise:

[0101] z i = <z i ,M[i]>+v i

[0102] Among them, F m represents a vector space of dimension m, z i represents the i-th row element of z, v i Represents the i-th row element in the value vector.

[0103] In this embodiment, this step calculates the encoding algorithm Encode of OKVS; to formalize the OKVS encoding algorithm, it is necessary to solve the linear system M×z=v, where v={v1,v2,...,v n}, M is based on {k1,k2,...,k n}Generated random matrix, v represents the value set, v n represents the nth element, k n represents the nth element, and I represents the key value set;

[0104] The receiver processor calculates P = OKVS.Encode (I), where the input parameters are I = {(k1, v1), (k2, v2), ..., (k n ,v n )}, P represents the information after being encoded by the OKVS encoding algorithm, k n ,v n Represents the nth key and value respectively; first, the receiver processor Receiver needs to calculate the starting position s of each random block in the random matrix M iSort and renumber, requiring s1≤s2≤...≤s n ,s n represents the starting position of the random block in the nth row of the random matrix M; then, the receiver processor traverses the random block element j in each row of the random matrix. If M[i][j] = 1, then for all random blocks that satisfy i'>i&s i′ All rows i' ≤ j are processed:

[0105]

[0106]

[0107] Finally, according to z i = <z i ,M[i]>+v i Solve the solution z of the linear system; if during the row processing, it is found that all the elements in a row are 0, then directly set z←F m .

[0108] S103, based on the solved z, the decoding algorithm of OKVS is formally expressed to recover the given arbitrary key k i The corresponding value v i , which is implemented as follows:

[0109] C1. Let v←0, calculate the starting position s←H(k) of the random block and the element in the random block corresponding to any key k value Where v represents the value corresponding to any given key k, H(·) represents a random hash function, and b w represents the length of each row of the random block in the random matrix M, and k represents any key that needs to be decoded;

[0110] C2. According to the calculation result of step C1, for j∈[1,b w ], calculate v←v+u[j']·z[s+j-1] as the final return value, and complete the calculation for any given key k i The corresponding value v i Recovery, where j represents the column position of each row of the random block in the random matrix M, u[j'] represents the j'th element of the random block, and s represents the starting position of the random block.

[0111] In this embodiment, this step calculates the decoding algorithm Decode of OKVS; the decoding algorithm of OKVS is formally represented, that is, given any key value k, the decoding party can recover its corresponding value v;

[0112] The decoder has the solution z of the linear system and an arbitrary key value k; let v←0, the decoder first calculates the starting position s←H(k) of the random block corresponding to the key value and the element in the block Then for j∈[1,b w ], calculate v←v+u[j]·z[s+j-1] as the final return value.

[0113] S104. To construct the Labeled PSI protocol, the receiving processor encodes all keys based on OKVS and encapsulates the encoding results using the VOLE protocol. After the sending processor and the receiving processor call the VOLE protocol, the sending processor obtains parameters Δ,B, and the receiving processor obtains parameters A,C, and C=ΔA+B. The Labeled PSI protocol encapsulates the OKVS encoding results using random variables. The encapsulation process is as follows: the receiving processor encapsulates A'=A+P and transmits it to the sending processor; the sending processor encapsulates K=ΔA'+B, so that it satisfies:

[0114] K=ΔA'+B=Δ(A+P)+B=ΔA+B+ΔP=C+ΔP

[0115] Among them, Δ represents the random scalar generated by the VOLE protocol function module, A, B, C all represent the random vectors generated by the VOLE protocol function module, and satisfy C = ΔA + B, A' represents the mask after the information is encapsulated, K represents the intermediate calculation vector of the sender processor, and P represents the encoding result of the receiver processor data set after OKVS encoding. The implementation method is as follows:

[0116] D1. To build the Labeled PSI protocol, the sending processor and the receiving processor both call the VOLE protocol, where the receiving processor encodes all keys based on OKVS and encapsulates the encoding results using the VOLE protocol;

[0117] D2. After the VOLE protocol runs, the sending processor receives and obtains the parameter Δ,B, and the receiving processor receives and obtains the parameter A,C, where Δ represents the random scalar generated by the VOLE protocol function module, and A, B, and C all represent the random vector generated by the VOLE protocol function module, and satisfy C = ΔA + B;

[0118] D3. The receiving processor uses the following formula to encapsulate A' and sends A' to the sending processor:

[0119] A'=A+P

[0120] Wherein, P represents the encoding result of OKVS performed by the receiver, and A' represents the mask after encapsulating the information;

[0121] D4. Based on A', the sending processor calculates K using the following formula:

[0122] K=ΔA'+B=Δ(A+P)+B=ΔA+B+ΔP=C+ΔP

[0123] Wherein, K represents the intermediate calculation vector of the sending processor, and P represents the encoding result of the receiving processor data set after OKVS encoding.

[0124] S105. According to the encapsulation result, based on the OKVS decoding algorithm of S103, by calculating X', L' and Y' respectively, the receiving processor obtains the intersection result Z and the corresponding label, and completes the construction of the Labeled PSI protocol:

[0125] Z=X'∩Y'

[0126] Among them, Z represents the final intersection result of the Labeled PSI protocol, X' represents the masked ciphertext of the local set X of the sender processor, L' represents the ciphertext set after the document identifier l is encrypted, that is, the encrypted document identifier corresponding to the keyword in the encrypted database EDB, and Y' represents the masked ciphertext of the local set Y of the receiver processor. The implementation method is as follows:

[0127] E1. According to the encapsulation result, based on the OKVS decoding algorithm of S103, the sending processor calculates X' and L' using the following formulas:

[0128] X'={H o (Decode(K,x)-ΔH F (x))|x∈X}

[0129] L'={Sym_En(K doc ,l)|l∈L[x]}

[0130] Among them, H o and H F Decode(K,x) represents the decoding operation of OKVS, K represents the intermediate calculation vector of the sender processor, x represents the element in the set X, that is, the keyword, Sym_En represents the secure symmetric encryption algorithm, K doc represents the document encryption key, L[x] represents the document identifier set corresponding to element x, l represents an element in the document identifier set L[x], and X represents the set used by the server for the Labeled PSI protocol;

[0131] E2. The access-side processor calculates Y' using the following formula and sends it to the sender processor;

[0132] Y'={H ° (Decode(C,y),y)|y∈Y}

[0133] Where Decode(C,y) represents the decoding operation of OKVS, y represents the elements in the set Y, i.e., the keywords, and C represents the random vector generated by the VOLE protocol;

[0134] E3. According to X' and Y', use the following formula to calculate Z, that is, the result of the original data set X∩Y:

[0135] Z=X'∩Y'

[0136] E4. According to Z, the corresponding label {L[z]|z∈Z} is obtained to complete the construction of the Labeled PSI protocol, where L[z] represents the set of document identifiers corresponding to the intersection set element z.

[0137] S2. At the application layer, the client and the server jointly negotiate a database update method, encrypt the plaintext document, and complete the ciphertext database update operation; and the client and the server jointly negotiate a database search method, complete the multi-keyword inadvertent dynamic search based on the Labeled PSI protocol, and the client decrypts the document after obtaining the search result. The implementation method is as follows:

[0138] S201, generating a key, an empty keyword status table and an empty encryption database on the client;

[0139] In this embodiment, the client Client generates a key {K s ,K doc}, an empty keyword state table σ and an empty encryption database EDB.

[0140] S202: Generate a key, an empty keyword status table, and an empty encryption database on the client. The implementation method is as follows:

[0141] F1. A series of empty lists T are generated by the client w ,T kw ,T dic ,T count ,T update , where Table T w Used to save the keyword information in this update process, table T kw Used to save keyword w to keyword token kt w The mapping table T dic Table T is used to store the ciphertext information on the document index chain DIC. count Table T is used to save the number of documents corresponding to keyword w. update Used to save all ciphertext information during this update process;

[0142] F2. The client extracts documents one by one from the document database DB. For any keyword w, the client calculates table T w , and look up the keyword σ[w] from the local keyword state table;

[0143] F3. In response to the keyword σ[w] not being found, let σ[w]←0, and calculate the latest update number n of the keyword w update ←σ[w]+1;

[0144] F4. According to the calculation result of step F3, the client obtains the kw Search in (kt w ,st w )←T kw [w], in response to not finding, calculate kt w ←F(K s ,w)、 and T kw ←T kw ∪{w,(kt w ,st w )}, where T kw [w] represents keyword w to keyword token kt w and search token st w The mapping of F(K s ,w) represents a pseudo-random function, H() represents a hash function, Indicates the latest update times of keyword w;

[0145] F5. According to the calculation result of step F4, the client obtains the count Find T in count [w], in response to not finding, let T count [w]←0, and get c w ←T count [w]+1, where T count [w] represents a list of document identifiers corresponding to keyword w, c w Indicates the number of documents corresponding to keyword w during this update operation;

[0146] F6. According to the calculation result of step F5, the calculation document encryption information loc←H(st w ,c w )、eid←Sym_En(K doc ,id) and T dic [st w ]←T dic [st w]∪{(loc,eid)}, where loc represents the address of each node in the document index chain DIC, eid represents the encrypted ciphertext of the document identifier id, Sym_En represents the symmetric encryption operation, and K doc Represents the document encryption key, T dic [st w ] indicates the search token st w The corresponding document index chain;

[0147] F7. For any keyword w∈T w , the client calculates σ[w]←σ[w]+1, (kt w ,st w )←T kw [w]、c w ←T count [w] and And (kt w ,(value,T dic [st w ]))Save to table T update In the table T update Sent to the server, where table T w All the keyword sets involved in this update process are stored in σ[w], which represents the client local keyword status table, c w Indicates the number of documents corresponding to keyword w during this update operation, T count [w] represents the number of documents corresponding to keyword w, value represents the operation information mask of this update process, G() represents the hash function, op represents the operation type, op=0 represents the document adding operation, op=1 represents the document deleting operation, and λ represents the calculation security parameter;

[0148] F8, the server will table T update Merge with the encrypted database EDB to complete the update operation on the ciphertext database.

[0149] In this embodiment, the client Client and the server Server jointly negotiate a database update algorithm Update.

[0150] In this embodiment, the client first generates a series of empty lists T w ,T kw ,T dic ,T count ,T update , where T w Used to save keyword information during this update. kw Used to save keyword w to keyword token kt w The mapping of T dicUsed to save the ciphertext information on DIC, T count Used to save the number of documents corresponding to keyword w, T update Used to save all ciphertext information during this update process;

[0151] The client first obtains the Extract documents one by one from doc=(id,W id ), for any w∈W id , the client calculates T w ←T w ∪{w}, and search for the keyword σ[w] from the local keyword state table. If not found, set σ[w]←0 and get the latest update number n of keyword w update ←σ[w]+1; Client Client from list T kw Search in (kt w ,st w )←T kw [w], if not found, calculate kt w ←F(K s ,w)、 and T kw ←T kw ∪{w,(kt w ,st w )}; Client Client from the list T count Find T in count [w], if not found, then let T count [w]←0, and get c w ←T count [w]+1, then calculate the document encryption information loc←H(st w ,c w )、eid←Sym_En(K doc ,id) and T dic [st w ]←T dic [st w ]∪{(loc,eid)};

[0152] Table T w Saves all the keyword sets in this update process. For any w∈T w , the client calculates σ[w]←σ[w]+1, (kt w ,st w )←T kw [w]、c w ←T count [w] and And (kt w,(value,T dic [st w ]))Save to table T update Finally, the client Client will list T update Send to the server Server; the server Server will list T update Merge with the encrypted database EDB, that is: EDB←EDB∪T update .

[0153] S203. According to the update result, the client and the server jointly negotiate a database search method, and perform multi-keyword dynamic search based on the Labeled PSI protocol. After the client obtains the search result, it decrypts the document. The implementation method is as follows:

[0154] G1. Based on the update result, the client generates Y”, R←{}. For any keyword w, calculate kt w ←F(K s ,w)、st w ←H(kt w ,σ[w]), and the search token st w Save to Y", where Y represents the client's set for the Labeled PSI protocol, R represents the final result set, and kt w represents a keyword token, F(K s ,w) represents a pseudo-random function, st w represents the search token, H() represents the hash function, σ[w] represents the keyword, kt w Represents a keyword token;

[0155] G2, the server generates X”, L[x]←{}, for the encrypted database EDB, calculate st w ←H(kt w ,c i ), where "X" represents the set of Labeled PSI protocols used by the server, L[x] represents the set of document identifiers corresponding to element x, and c i Indicates the c i nodes;

[0156] G3, based on the generated search token st w , use the following formula to calculate op and c w :

[0157] (op||c w )←value⊕G(st w ,1 λ )

[0158] Among them, cw represents the number of documents corresponding to the keyword w during this update operation, value represents the operation information mask of the corresponding update process, G() represents the hash function, op represents the operation type, op=0 represents the document adding operation, op=1 represents the document deleting operation, and λ represents the calculation security parameter;

[0159] G4, from 1 to c w , we can calculate loc←H(st w ,j) and Eid←EDB[loc], where loc represents the address of the jth node in the document index chain DIC, Eid is the encrypted ciphertext of the document identifier id, and EDB represents the encrypted database;

[0160] G5. The server sends the search token st w Save to X", add the encrypted document identifier with op=0 to L[x], and remove the encrypted document identifier with op=1 from L[x];

[0161] G6. The client and the server jointly call the Labeled PSI protocol. After the Labeled PSI protocol runs, the client receives the final result intersection I = X”∩Y” and {L[y']|y'∈I} corresponding to the intersection element, where L[y'] represents the encrypted document to be searched by the client, and y' represents the intersection set element;

[0162] G7. The client saves L[y'] to the set R and uses the key to decrypt the document, completing the encryption processing of the inadvertent dynamic searchable document.

[0163] In this embodiment, the client Client and the server Server jointly negotiate a database search algorithm Search.

[0164] In this embodiment, the client generates Y”, R←{}, and for any w∈Q, calculates kt w ←F(K s ,w)、st w ←H(kt w ,σ[w]), and the search token st w Save to Y”; the server generates X”, L[x]←{}, for the encrypted database EDB, calculate st w ←H(kt w ,i), where i=1,2,...; and according to the generated st w calculate Get op and c w , then calculate loc←H(st w,j), Eid←EDB[loc], where j∈[1,c w ]; the server will search for the token st w Save to X", and add the encrypted document identifier with op=0 to L[x], and remove the encrypted document identifier with op=1 from L[x]; the client Client and the server Server jointly call the Labeled PSI protocol, in which the client Client plays the role of the receiver processor Receiver and the server Server plays the role of the sender processor Sender; after the protocol runs, the client Client receives the final result intersection I=X”∩Y” and {L[y']|y'∈I} corresponding to the intersection element; the client Client saves the final result L[y] to the set R and uses the key K doc Decrypt the document.

[0165] In this embodiment, the present invention is a dynamic searchable encryption model based on a single-read single-write system model. The present invention can be roughly divided into three stages: Setup, Update, and Search. In the Update stage, the constructed secondary index structure includes a keyword index chain KIC and a document index chain DIC, that is, Figure 2 The dotted box part; in the Search stage, keyword search is performed by calling the Labeled PSI module.

[0166] In this embodiment, the present invention is mainly applicable to dynamic data update scenarios, which are divided into two entities: client and server. Data document doc = (id, W id ) contains the unique document identifier id∈{0,1} * And the keyword set W id ; In the plaintext database In the example, let the document identifier set corresponding to keyword w be DB(w)={id|w∈W id}. In the Setup phase, the client generates two symmetric encryption keys K s and K doc , an empty keyword state table σ and an empty ciphertext database EDB, where K s Used to encrypt and generate various tokens, K doc Used to encrypt document identifiers, and σ is used to save the update count of each keyword

[0167] In this embodiment, in order to improve data update efficiency and reduce communication complexity, the present invention optimizes the traditional inverted index structure and adjusts it to a secondary index structure, including a keyword index chain KIC and a document index chain DIC. If each update operation is only for one keyword / document pair, the length of the keyword index chain KIC will become longer and longer, and by introducing the document index chain DIC, one keyword / document set can be processed each time.

[0168] Since the plaintext database Similar to the forward index structure, in order to encrypt it according to the index structure, a temporary empty mapping table T needs to be introduced w ,T kw ,T dic ,T count ,T update The functions of each mapping table are as described above, so the Update phase of the client includes the following steps:

[0169] Step S1: Client obtains data from the plaintext database Extract document doc=(id,W id ), and save the keyword w corresponding to the document to T w ;

[0170] Step S2: Calculate the latest update times of keyword w If during this process, the keyword state table σ does not store the information of keyword w, then let σ[w]←0;

[0171] Step S3: If in the mapping table T kw If the information of keyword w is stored in the w ,st w )←T kw [w]; if keyword w is processed for the first time, calculate the keyword token kt corresponding to keyword w w and search token st w , the formula is as follows:

[0172]

[0173] And save it to the mapping table T kw In, that is, T kw ←T kw ∪{w,(kt w ,st w )};

[0174] Step S4: Calculate the number of document identifiers c that have been added to DIC by keyword w in this round w , if in the mapping table T countIf the information of keyword w is stored in c w ←T count [w]+1, otherwise, first let T count [w]←0, then calculate c w The value of

[0175] Step S5: Calculate the encrypted document information loc←H(st w ,c w )、eid←Sym_En(K doc ,id) and T dic [st w ]←T dic [st w ]∪{(loc,eid)};

[0176] Repeat S1 to S5 until all documents in the plaintext document database DB are processed. At this time, table T w Save all the keyword sets in this update process, for all w∈T w , constructing the ciphertext database EDB according to the index structure;

[0177] Step S6: For any keyword w∈T w , the client calculates σ[w]←σ[w]+1, (kt w ,st w )←T kw [w]、c w ←T count [w] and value←G(st w ,1 λ )⊕(op||c w ), where value is the information saved by the KIC node, including the update type of the corresponding keyword w during this update (op=0 is an add operation, op=1 is a delete operation) and the number of documents c corresponding to the keyword w w ; The client Client will (kt w ,(value,T dic [st w ]))Save to table T update and sends it to the server.

[0178] In the Update phase, the server Server is based on table T update Update the local ciphertext database EDB.

[0179] Because the Labeled PSI protocol will be used in the Search phase to ensure the safe operation of the search mechanism, some security parameters need to be preset before the formal operation of the protocol to initialize the data set; during the protocol operation phase, the Server acts as the Sender role and the Client acts as the Receiver role. In a dynamic searchable encrypted search mechanism provided by the implementation use case of the present invention, the Search phase requires the client and the server to first generate a data set for locally running the Labeled PSI protocol, which mainly includes the following steps:

[0180] Step S1: The client generates a local data set Y according to the search keyword set Q. For any keyword w∈Q, calculate kt w ←F(K s ,w) and st w ←H(kt w ,σ[w]), where F is a pseudo-random function, H is a random hash function, and σ is the keyword state table held locally by the Client; the Client searches for the token st w Save to data set Y";

[0181] Step S2: The server generates a local data set X'' based on the ciphertext database EDB, and generates its corresponding label set L[x] for any x∈X''; the server calculates st w ←H(kt w ,i),i=1,2..., and according to the generated st w Calculate (op||c w )←value⊕G(st w ,1 λ ) Get the operation type op of each node on KIC and the number of nodes c corresponding to DIC w ; then calculate

[0182] loc←H(st w ,j),j=1,2,...,c w and Eid←EDB[loc];

[0183] Step S3: The server will send all st w Save to dataset X", and process the documents corresponding to the keywords according to the operation type op. Specifically, save the encrypted document identifier with op=0 to dataset L[x], and remove the encrypted document identifier with op=1 from dataset L[x];

[0184] Step S4: The client and the server jointly call the Labeled PSI protocol, where the client acts as the receiver and the server acts as the sender. After the protocol runs, the client receives the final result intersection I=X”∩Y” and {L[y']|y'∈I} corresponding to the intersection element.

[0185] Since the client uses the latest update count σ[w] of each keyword to dynamically generate the search token st w , so the client uses the previous search token st w 'The search results cannot be obtained, which ensures the user's forward privacy security; if the client uses a keyword w' that does not exist in the database EDB, due to the characteristics of the PSI protocol, the final intersection result does not contain the result corresponding to the keyword w';

[0186] Step S5: The client uses the key K doc Decrypt the data set L[y'] and get the final plaintext result.

[0187] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the implementation methods of the present invention, and should be understood that the protection scope of the present invention is not limited to such special statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A method for inadvertently dynamically searchable encryption, characterized in that: The following steps are involved: S1. In the bottom layer module, based on the receiving processor and the sending processor, the encoding algorithm and decoding algorithm of the OKVS are formally represented, and the Labeled PSI protocol is constructed based on the OKVS and VOLE technical framework. The receiving processor obtains the intersection result Z and the corresponding label, where the intersection result Z is the keyword set to be searched, and the corresponding label stores the document identifier set corresponding to the keyword; The step S1 comprises the following steps: S101, a receiving processor generates a random matrix M according to a key value set (k, v), wherein each row of the random matrix M includes a random block of a fixed length and a random starting position, k represents the key set, and v represents the value vector; S102, formalizing the encoding algorithm of OKVS according to the random block elements to solve z in the linear system M·z=v; wherein z represents the encoding result of the key value set after OKVS encoding; S103, based on the solved z, the decoding algorithm of OKVS is formally expressed to recover the given arbitrary key k i The corresponding value v i ; S104. To construct the Labeled PSI protocol, the receiving processor encodes all keys based on OKVS and encapsulates the encoding results using the VOLE protocol. After the sending processor and the receiving processor call the VOLE protocol, the sending processor obtains parameters Δ,B, and the receiving processor obtains parameters A,C, and C=ΔA+B. The Labeled PSI protocol encapsulates the OKVS encoding results using random variables. The encapsulation process is as follows: the receiving processor encapsulates A'=A+P and transmits it to the sending processor; the sending processor encapsulates K=ΔA'+B, so that it satisfies: K=ΔA'+B=Δ(A+P)+B=ΔA+B+ΔP=C+ΔP Wherein, Δ represents the random scalar generated by the VOLE protocol function module, A, B, and C all represent random vectors generated by the VOLE protocol function module, and satisfy C = ΔA + B, A' represents the mask after the information is encapsulated, P represents the encoding result of the receiving processor data set after OKVS encoding, and K represents the intermediate calculation vector of the sending processor; S105. According to the encapsulation result, based on the OKVS decoding algorithm of S103, by calculating X', L' and Y' respectively, the receiving processor obtains the intersection result Z and the corresponding label, and completes the construction of the Labeled PSI protocol: Z=X'∩Y' Among them, Z represents the final intersection result of the Labeled PSI protocol, X' represents the masked ciphertext of the local set X of the sender processor, L' represents the ciphertext set after the document identifier l is encrypted, and Y' represents the masked ciphertext of the local set Y of the receiver processor; S2. At the application layer, the client and the server jointly negotiate a database update method, encrypt the plaintext document, and complete the ciphertext database update operation; and the client and the server jointly negotiate a database search method, complete the multi-keyword dynamic search based on the Labeled PSI protocol, and the client decrypts the document after obtaining the search result; The step S2 comprises the following steps: S201, generate keys {K s ,K doc }, an empty keyword state table σ and an empty encryption database EDB; S202, the client and the server jointly negotiate a database update method, encrypt the plaintext document, and complete the ciphertext database update operation; S203. According to the update result, the client and the server jointly negotiate a database search method, and perform multi-keyword dynamic search based on the LabeledPSI protocol. After the client obtains the search result, it decrypts the document.

2. The inadvertent dynamic searchable encryption method according to claim 1, characterized in that: The step S101 comprises the following steps: A1. The receiving processor generates a random matrix M according to the key value set (k, v), wherein each row of the random matrix M includes a fixed length of b. w , random blocks with random starting positions; A2. For each row in the random matrix M, the receiving processor randomly selects s i As the starting position of the random block of row i; A3. According to the key k corresponding to each row i of the matrix i , using a random oracle to generate b w A random block element of bits.

3. The inadvertent dynamic searchable encryption method according to claim 1, characterized in that: The step S102 includes the following steps: B1. The receiving processor calculates the starting position s of each row of random blocks in the random matrix M. i Sort and renumber; B2. The receiving processor traverses the random block elements of each row in the random matrix M. When M[i][j] = 1, the following formula is used to calculate all random block elements that satisfy M[i'][j] = 1, i'>i, and s i All elements ≤ j are processed: M[i']=M[i']⊕M[i] v[i']=v[i']⊕v[i] Where M[i][j] represents the element in the i-th row and j-th column of the random matrix M, M[i] represents all elements in the i-th row of the random matrix M, v[i'] represents the element in the i'th row of the value vector, and s i represents the starting column position of the random block in the i-th row of the random matrix M, M[i'] represents all elements in the i'th row of the random matrix M, v[i] represents the i-th row element in the value vector, and M[i'][j] represents the i'th row and j-th column element in the random matrix M. After the row processing operation, only the elements in the i-th row of the j-th column of the random matrix M are 1, and the elements in the i'>i row are all 0; B3. According to the processing result of step B2, use the following formula to solve z in the linear system. When there is a row with all elements being 0 during the row processing, directly set z←F m ;otherwise: z i =<z i ,M[i]>+v i Among them, F m represents a vector space of dimension m, z i represents the i-th row element of z, v i Represents the i-th row element in the value vector.

4. The inadvertent dynamic searchable encryption method according to claim 1, characterized in that: The step S103 comprises the following steps: C1. Let v←0, calculate the starting position s←H(k) of the random block and the element in the random block corresponding to any key k value Where v represents the value corresponding to any given key k, H(·) represents a random hash function, and b w represents the length of each row of the random block of the random matrix M, and k represents any key that needs to be decoded; C2. According to the calculation result of step C1, for j∈[1,b w ], calculate v←v+u[j']·z[s+j-1] as the final return value, and complete the calculation for any given key k i The corresponding value v i Recovery, where j represents the column position of each row of the random block in the random matrix M, u[j'] represents the j'th element of the random block, and s represents the starting position of the random block.

5. The inadvertent dynamic searchable encryption method according to claim 1, characterized in that: The step S104 includes the following steps: D1. To build the Labeled PSI protocol, the sending processor and the receiving processor both call the VOLE protocol, where the receiving processor encodes all keys based on OKVS and encapsulates the encoding results using the VOLE protocol; D2. After the VOLE protocol runs, the sending processor receives and obtains the parameter Δ,B, and the receiving processor receives and obtains the parameter A,C, where Δ represents the random scalar generated by the VOLE protocol function module, and A, B, and C all represent the random vector generated by the VOLE protocol function module, and satisfy C = ΔA + B; D3. The receiving processor uses the following formula to encapsulate A' and sends A' to the sending processor: A'=A+P Wherein, P represents the encoding result of OKVS performed by the receiver, and A' represents the mask after encapsulating the information; D4. Based on A', the sending processor calculates K using the following formula: K=ΔA'+B=Δ(A+P)+B=ΔA+B+ΔP=C+ΔP Wherein, K represents the intermediate calculation vector of the sending processor, and P represents the encoding result of the receiving processor data set after OKVS encoding.

6. The inadvertent dynamic searchable encryption method according to claim 1, characterized in that: The step S105 comprises the following steps: E1. According to the encapsulation result, based on the OKVS decoding algorithm of S103, the sending processor calculates X' and L' using the following formulas: X'={H°(Decode(K,x)-ΔH F (x))|x∈X} The ={Sym_En(K doc ,l)|l∈L[x]} Among them, H° and H F Decode(K,x) represents the decoding operation of OKVS, K represents the intermediate calculation vector of the sender processor, x represents the element in the set X, Sym_En represents the secure symmetric encryption algorithm, K doc represents the document encryption key, L[x] represents the document identifier set corresponding to element x, and l represents an element in the document identifier set L[x]; E2. The access-side processor calculates Y' using the following formula and sends it to the sender processor; Y'={H°(Decode(C,y),y)|y∈Y} Where Decode(C,y) represents the decoding operation of OKVS, y represents the elements in the set Y, C represents the random vector generated by the VOLE protocol, and Y represents the local set of the receiving processor; E3. According to X' and Y', use the following formula to calculate Z, that is, the result of the original data set X∩Y: Z=X'∩Y' E4. According to Z, the corresponding label {L[z]|z∈Z} is obtained to complete the construction of the Labeled PSI protocol, where L[z] represents the set of document identifiers corresponding to the intersection set element z.

7. The oblivious dynamically searchable encryption method according to claim 1, characterized in that: The step S202 comprises the following steps: F1. A series of empty lists T are generated by the client w ,T kw ,T dic ,T count ,T update , where Table T w Used to save the keyword information in this update process, table T kw Used to save keyword w to keyword token kt w The mapping table T dic Table T is used to store the ciphertext information on the document index chain DIC. count Table T is used to save the number of documents corresponding to keyword w. update Used to save all ciphertext information during this update process; F2. The client extracts documents one by one from the document database DB. For any keyword w, the client calculates table T w , and look up the keyword σ[w] from the local keyword state table; F3. In response to the keyword σ[w] not being found, let σ[w]←0, and calculate the latest update number n of the keyword w update ←σ[w]+1; F4. According to the calculation result of step F3, the client obtains the kw Search in (kt w ,st w )←T kw [w], in response to not finding, calculate kt w ←F(K s ,w)、 and T kw ←T kw ∪{w,(kt w ,st w )}, where T kw [w] represents keyword w to keyword token kt w and search token st w The mapping of F(K s ,w) represents a pseudo-random function, H() represents a hash function, Indicates the latest update times of keyword w, K s Represents a symmetric encryption key; F5. According to the calculation result of step F4, the client obtains the count Find T in count [w], in response to not finding, let T count [w]←0, and get c w ←T count [w]+1, where T count [w] represents a list of document identifiers corresponding to keyword w, c w Indicates the number of documents corresponding to keyword w during this update operation; F6. According to the calculation result of step F5, the calculation document encryption information loc←H(st w ,c w )、eid←Sym_En(K doc ,id) and T dic [st w ]←T dic [st w ]∪{(loc,eid)}, where loc represents the address of each node in the document index chain DIC, eid represents the encrypted ciphertext of the document identifier id, Sym_En represents the symmetric encryption operation, and K doc Represents the document encryption key, T dic [st w ] indicates the search token st w The corresponding document index chain; F7. For any keyword w∈T w , the client calculates σ[w]←σ[w]+1, (kt w ,st w )←T kw [w]、c w ←T count [w] and value←G(st w ,1 λ )⊕(op||c w ), and (kt w ,(value,T dic [st w ]))Save to table T update In the table T update Sent to the server, where table T w All the keyword sets involved in this update process are stored in σ[w], which represents the client local keyword status table, c w Indicates the number of documents corresponding to keyword w during this update operation, T count [w] represents the number of documents corresponding to keyword w, value represents the operation information mask of this update process, G() represents the hash function, op represents the operation type, op=0 represents the document adding operation, op=1 represents the document deleting operation, and λ represents the calculation security parameter; F8, the server will table T update Merge with the encrypted database EDB to complete the update operation on the ciphertext database.

8. The method of inadvertent dynamic searchable encryption according to claim 1, characterized in that: The step S203 comprises the following steps: G1. Based on the update result, the client generates Y”, R←{}. For any keyword w, calculate kt w ←F(K s ,w)、st w ←H(kt w ,σ[w]), and the search token st w Save to Y", where Y represents the client's set for the Labeled PSI protocol, R represents the final result set, and kt w represents a keyword token, F(K s ,w) represents a pseudo-random function, st w represents the search token, H() represents the hash function, σ[w] represents the keyword, kt w represents the keyword token, K s Represents a symmetric encryption key; G2, the server generates X”, L[x]←{}, for the encrypted database EDB, calculate st w ←H(kt w ,c i ), where "X" represents the set of Labeled PSI protocols used by the server, L[x] represents the set of document identifiers corresponding to element x, and c i Indicates the c i nodes; G3, based on the generated search token st w , use the following formula to calculate op and c w : (on||c w )←value⊕G(st w ,1 λ ) Among them, c w represents the number of documents corresponding to the keyword w during this update operation, value represents the operation information mask of the corresponding update process, G() represents the hash function, op represents the operation type, op=0 represents the document adding operation, op=1 represents the document deleting operation, and λ represents the calculation security parameter; G4, from 1 to c w , we can calculate loc←H(st w ,j) and Eid←EDB[loc], where loc represents the address of the jth node in the document index chain DIC, Eid is the encrypted ciphertext of the document identifier id, and EDB represents the encrypted database; G5. The server sends the search token st w Save to X", add the encrypted document identifier with op=0 to L[x], and remove the encrypted document identifier with op=1 from L[x]; G6. The client and the server jointly call the Labeled PSI protocol. After the Labeled PSI protocol runs, the client receives the final result intersection I = X”∩Y” and {L[y']|y'∈I} corresponding to the intersection element, where L[y'] represents the encrypted document to be searched by the client, and y' represents the intersection set element; G7. The client saves L[y'] to the set R and uses the key to decrypt the document, completing the encryption processing of the inadvertent dynamic searchable document.

Images