Non-interactive ciphertext connection keyword retrieval method with result pattern hiding

Abstract

A non-interactive ciphertext connection keyword retrieval method with result pattern hiding is proposed. In the initial stage, the system key and index structure generated by the data owner are stored locally in the data owner and in the cloud server respectively. When performing connection keyword retrieval, the data owner generates trapdoor information based on the system key locally and sends it to the cloud server to perform the retrieval operation on the index structure. After the encrypted data that meets the retrieval conditions is returned, the data owner decrypts the encrypted data that meets the retrieval conditions based on the system key to obtain the retrieval results. The present invention adopts a symmetric subset predicate encryption protocol (S 2 PE) and a new non-interactive index structure generation method are used to achieve ciphertext-linked keyword retrieval with both keyword pair result pattern (KPRP) and cross-query intersection result pattern (IP) hidden. This reduces the number of interaction rounds between the cloud server and the data owner to one, improving retrieval efficiency. This allows the data owner and the cloud server to achieve KPRP and IP hiding without additional communication.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, in particular to a non-interactive ciphertext connection keyword retrieval method with hidden result patterns. Background Art

[0002] Ciphertext-linked keyword retrieval technology allows cloud servers to perform efficient linked keyword queries on ciphertext data while ensuring data and query privacy. However, existing technologies suffer from the following major drawbacks: 1) they can leak keyword pair result patterns (KPRPs) and cross-query intersection result patterns (IPs). 2) to conceal the KPRPs, the cloud server and the data owner must perform an additional round of communication, resulting in significant computational and communication overhead. Summary of the Invention

[0003] In view of the above shortcomings of the existing technology, the present invention proposes a non-interactive ciphertext connection keyword retrieval method with hidden result patterns. Specifically, a symmetric subset predicate encryption protocol (S 2 PE) and a new non-interactive index structure generation method are used to achieve ciphertext connection keyword retrieval with both keyword pair result pattern (KPRP) and cross-query intersection result pattern (IP) hidden. The number of interaction rounds between cloud servers and data owners is reduced to one, improving retrieval efficiency. This allows data owners and cloud servers to achieve KPRP and IP hiding without additional communication, that is, for a query, the result intersection of the first keyword and any other keyword; IP refers to the result intersection of the first keyword in two queries when the first keyword is different and at least one of the remaining keywords is the same.

[0004] The present invention is achieved through the following technical solutions:

[0005] The present invention relates to a non-interactive ciphertext connection keyword retrieval method with result pattern hiding. In the initial stage, the system key and index structure generated by the data owner are stored locally in the data owner and in a cloud server respectively. When performing a connection keyword retrieval, the data owner generates trapdoor information locally based on the system key and sends it to the cloud server to perform a retrieval operation on the index structure. After returning the encrypted data that meets the retrieval conditions, the data owner decrypts the encrypted data that meets the retrieval conditions based on the system key to obtain the retrieval results.

[0006] In the initial stage, the data owner Generate the system key K and index structure cEMM, where: For keywords, To include The set of all document identifiers, It is the set of all keywords in the plaintext document set.

[0007] The system key K includes: the key K of the first pseudo-random function F1 and the second pseudo-random function F2 E , K X , K T and msk, which are obtained in the following way: the data owner first randomly selects the key K E and K X , and then use the encryption multi-value mapping algorithm TSet to generate the key K according to the security parameter λ and the multi-value mapping T T , using S 2 PE.Setup algorithm generates symmetric subset predicate encryption S 2 PE's master key msk, the final output system key K = (K E ,K E ,K T ,msk).

[0008] The index structure cEMM includes: encrypted map TS and ciphertext ct, which are obtained in the following way: the data owner generates TS by running TSet.Setup algorithm according to security parameter λ and multi-value map T, 2 The PE's master key msk and the set XSet generate the ciphertext ct of the set XSet, and finally output the index structure cEMM=(TS,ct).

[0009] The trapdoor information is based on the system key K and the connection keyword to be retrieved Using the token generation algorithm in the encrypted multi-value mapping protocol And run the key generation algorithm S in the symmetric subset predicate encryption protocol 2 PE.KeyGen(msk,X) generates the key. The specific process includes: the data owner runs the TSet.GetTag algorithm to generate the key The trapdoor stag is output to the cloud server; for each Data Owner Computing And store qtag in the set QSet; further, the data owner calculates the trapdoor xtoken i =S 2 PE.KeyGen(msk,QSet) and output to the cloud server. Contains keywords A collection of document identifiers.

[0010] The encrypted data that meets the retrieval conditions is retrieved by the cloud server by executing the retrieval algorithm TSet.Retrieve(TSet,stag) in the encrypted multi-value mapping protocol to obtain the encrypted data containing the keyword Corresponding ciphertext document identifier set For each Cloud server based on trapdoor xtoken i , the ciphertext ct of the set XSet, execute the decryption algorithm S in the symmetric subset predicate encryption protocol 2 PE.Dec(xtoken i ,ct), if the input result is msg='True', then the corresponding e i Output to the data owner.

[0011] The decryption is calculated by the data owner. For each e returned, the data owner executes the decryption algorithm in the symmetric encryption algorithm SE Output the corresponding plaintext v as the final retrieval result.

[0012] The present invention relates to a system for implementing the above method, comprising: an index generation module, a trapdoor generation module, a retrieval module and a decryption module, wherein: the data owner uses the index generation module to generate a data according to the plaintext document set. Generate index structure cEMM and store it in cloud server; data owner generates module through trapdoor and searches according to retrieval conditions Generate the corresponding trapdoor and output it to the cloud server; the cloud server uses the retrieval module to perform a retrieval operation based on the trapdoor information, obtains the ciphertext document identifier that meets the retrieval conditions and returns it to the data owner; the data owner obtains the final plaintext document identifier through the decryption algorithm in the symmetric encryption algorithm.

[0013] Technical Effects

[0014] The present invention uses a symmetric subset predicate encryption protocol S 2 PE achieves efficient subset membership determination; through an index structure generation method, data owners can non-interactively generate trapdoors for search keywords and a non-interactive ciphertext-linked keyword search scheme with hidden result patterns, thereby simultaneously protecting the keyword pair result pattern (KPRP) and the cross-query intersection result pattern (IP). Compared with existing technologies, this invention can reduce the communication between data owners and cloud servers to one round and greatly improve retrieval efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 Schematic diagram of application scenario of the embodiment;

[0016] Figure 2 Flowchart of the present invention;

[0017] Figure 3 and Figure 4 Schematic diagram of the embodiment effect. DETAILED DESCRIPTION

[0018] like Figure 1 As shown, the application scenario of this embodiment includes: a data owner and a cloud server, wherein: the data owner generates an index structure for a plaintext document set and uploads it to the cloud server, the data owner generates a search trap based on the connection keywords to be retrieved, decrypts the ciphertext search results that meet the search conditions from the cloud server, and obtains the plaintext search results; the cloud server stores the index structure sent by the data owner, receives the search trap sent by the data owner, performs a search in the index structure, and returns the search results that meet the search conditions to the data owner.

[0019] like Figure 2 As shown, the present embodiment involves a non-interactive ciphertext connection keyword retrieval method based on result pattern hiding in the above scenario, including the following steps:

[0020] Step 1: Index structure generation: The data owner generates an index structure based on the plaintext document set and outsources the index structure to the cloud server. This includes:

[0021] Step 1.1: Select a key K for the first pseudo-random function F1 E , select the key K for the second pseudo-random function F2 X , initialize an empty multi-valued map T, run S 2 PE.Setup(1 λ ) to obtain the key msk, specifically: select an integer b, generate the key sk∈{0,1} of the pseudo-random function F λ ; Run the initialization algorithm in the XOR filter algorithm Generate an XOR filter with parameters (b,3) and output S 2 PE master key Message Space and complete works in: Contains 3 hash functions (h0,h1,h2),

[0022] Step 1.2: Generate a multi-valued map T and a set XSet, including:

[0023] 1.2.1 First cycle: For Each keyword Initialize the empty set t and run the first pseudo-random function Generate keywords Key

[0024] The pseudo-random function is implemented using HMAC-SHA 256.

[0025] 1.2.2 Second cycle: For Encrypt using the encryption algorithm SE.Enc in the symmetric encryption algorithm SE The corresponding document identifier set The i-th document identifier in gets the document identifier ciphertext e, that is, Then add e to the set t.

[0026] 1.2.3 The third cycle: for Remove All keywords except Right now when Then run the second pseudorandom function Generate the value xtag, then store xtag in the set XSet, and end the third loop and the second loop.

[0027] 1.2.4 Store the set t generated in the second loop in In, that is And end the first cycle operation.

[0028] Step 1.3: Generate TS and K T , that is (TSet,K T )←TSet.Setup(1 λ ,T).

[0029] Step 1.4, generate ct, that is, ct←S 2 PE.Enc(msk,msg='True',XSet), specifically: for each element xtag in XSet i , calculate its pseudo-random function xtag' i ←F(sk,xtag i ), forming a new set XSet'=(xtag'1,xtag'2,…,xtag' |XSet| ), call the update algorithm in the XOR filter algorithm After inserting the set XSet' into the XOR filter, the ciphertext of XSet ct = B is output. Y' .

[0030] The initialization algorithm XF.Setup and the update algorithm XF.Update in the XOR filter algorithm are implemented using, but not limited to, the technology described in "Practical Volume-Hiding Encrypted Multi-Maps with Optimal Overhead and Beyond" by Wang et al.

[0031] Step 1.5: Set the system key K = (K E ,K X ,K T ,msk) is stored locally in the data owner, and the index structure cEMM=(TS,ct) is output to the cloud server;

[0032] Step 2: Generate retrieval trap information, including:

[0033] Step 2.1 When the data owner retrieves documents containing q keywords at the same time, that is, The data owner first runs the token generation algorithm TSet.GetTag in the encrypted multi-value mapping protocol to generate The trapdoor stag, that is Output stag to the cloud server.

[0034] Step 2.2 For Perform steps 2.2.1-2.2.3:

[0035] Step 2.2.1 For 2≤j≤q, generate by the second pseudo-random function F2 Qtag j Stored in a QSet i middle.

[0036] Step 2.2.2 performs the operation on the set QSet generated in step 2.2.1 i Run the key generation algorithm in the symmetric subset predicate encryption protocol to generate a trapdoor xtoken i , that is, xtoken i ←S 2 PE.KeyGen(msk,QSet i ), specifically: For QSet i Each element in qtag j , generating a set of locations And form a multiset from the position sets of all elements Next, randomly select the key K∈{0,1} of the symmetric encryption algorithm Sym λ ,calculate Encrypt using the Sym.Enc encryption algorithm in the symmetric encryption algorithm Sym λ get Right now After that, output QSet i Corresponding trapdoor information

[0037] Step 2.2.3 will Output to cloud server.

[0038] Step 3: Search, including:

[0039] Step 3.1 When the cloud server receives the stag, it runs the retrieval algorithm TSet.Retrieve in the encrypted multi-value mapping protocol to retrieve the All ciphertext document identifiers, that is, t←TSet.Retrieve(TSet,stag), where:

[0040] Step 3.2 For Run the decryption algorithm S in the symmetric subset predicate encryption protocol 2 PE.Dec for ct=B in the index structure Y Decrypt, msg i ←S 2 PE.Dec(xtoken i ,ct), specifically: calculation Then, run the decryption algorithm Sym.Dec in the symmetric encryption algorithm Sym to decrypt Right now Finally, when τ = 0 λ , output 'True', otherwise output ⊥.

[0041] Step 3.3 When msg i ='Ture', i.e. e i Is the ciphertext document identifier that meets the conditions, e i Add to the collection Res.

[0042] Step 3.4 The cloud server outputs the set Res to the data owner.

[0043] Step 4: Decryption, specifically including: the data owner runs the first pseudo-random function F1 to generate a key For each e in Res, decrypt e using the decryption algorithm SE.Dec of the symmetric encryption algorithm SE to obtain the plaintext document identifier v, and then store v in the set Rval. The data owner obtains the retrieval result Rval, and the document identifiers in Rval simultaneously contain all q search keywords.

[0044] The initialization algorithm TSet.Setup, the token generation algorithm TSet.GetTag, and the retrieval algorithm TSet.Retrieve in the encrypted multi-value mapping protocol are implemented using, but not limited to, the technology described in "Highly-ScalableSearchable Symmetric Encryption with Support for Boolean Queries" by Cash et al.

[0045] The encryption algorithm Sym.Enc and the decryption algorithm Sym.Dec in the symmetric encryption algorithm Sym adopt, but are not limited to, the symmetric encryption algorithm that meets PCPA security requirements as described in "Searchable symmetric encryption: improved definitions and efficient constructions" by Curtmola et al.

[0046] The encryption algorithm SE.Enc and the decryption algorithm SE.Dec in the symmetric encryption algorithm SE adopt a symmetric encryption algorithm that meets IND-CPA security.

[0047] The specific experiment was carried out on a machine with an Intel(R) Core(TM) i9-11900K 3.50GHz CPU core and 128GB memory, running Ubuntu 20.04, and using Python programming language. The experimental parameters were set as follows: the false positive probability of the Bloom filter ε = 10 -6, using HMAC-SHA256 to implement the pseudo-random function, SHA-256 to implement the hash function, AES with a key length of 256-bit and CBC mode to implement symmetric encryption, and Type A pair operations in the Pypbc library to implement group operations. First, the method of the present invention (named Doris) is theoretically analyzed with the OXT scheme [Highly-Scalable Searchable SymmetricEncryption with Support for Boolean Queries], the HXT scheme [Result Pattern HidingSearchable Encryption for Conjunctive Queries], and the ConjFilter scheme [EfficientBoolean Search over Encrypted Data with Reduced Leakage], as shown in Table 1. Then, two real data sets, Enron and Enwiki, are used to experimentally compare the method Doris of the present invention with the OXT, HXT, and ConjFilter schemes. Table 2 is a parameter comparison of the experimental data sets Enron and Enwiki used.

[0048] Table 1 Performance comparison of existing solutions

[0049]

[0050] for implement Connect keyword search, Exp is the modular exponential operation, Prf is the pseudo-random function operation, H is the hash operation, Dec is the decryption operation of the symmetric encryption algorithm, Xor is the exclusive OR operation, O(T Stp ) is the initialization operation in the encrypted multi-value mapping protocol, O(T Srch ) is the retrieval operation in the encrypted multi-value mapping protocol.

[0051] Table 2 Comparison of dataset parameters

[0052] Dataset Number of documents Number of keywords Number of keyword / document pairs Enron 446131 96980 3611634 Enwiki 50285 1294263 5025847

[0053] The non-interactive ciphertext connection keyword retrieval method with result pattern hiding in the present invention (named Doris) is experimentally simulated and compared with the OXT scheme [Highly-Scalable Searchable Symmetric Encryption with Support for Boolean Queries], the HXT scheme [Result Pattern Hiding Searchable Encryption for Conjunctive Queries], and the ConjFilter scheme [Efficient Boolean Search over Encrypted Data with Reduced Leakage].

[0054] like Figure 3 As shown, when searching for two keywords, the number of different search results for the first keyword is It can be seen that the retrieval efficiency of the present invention is the highest, which is about 6 times that of the HXT solution and 1.07 times that of the ConjFilter solution.

[0055] like Figure 4 As shown, this is the number of search results for the first keyword Schematic diagram of the comparison of search time under different numbers of search keywords. It can be seen that the search efficiency of the present invention is the highest, about 42 times that of the HXT solution and 1.1 times that of the ConjFilter solution.

[0056] Compared with the existing technology, this method adopts the proposed symmetric subset predicate encryption protocol and index structure generation method to realize non-interactive keyword trapdoor generation, reduce the communication overhead of trapdoor generation, and at the same time, realize the hiding of keyword pair result pattern (KPRP) and cross-query intersection result pattern (IP) for the first time, and improve retrieval efficiency.

[0057] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principles and purpose of the present invention. The scope of protection of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. All implementation schemes within its scope shall be subject to the constraints of the present invention.

Claims

1. A non-interactive ciphertext connection keyword search method with result pattern hiding, characterized by initially storing a system key and index structure generated by the data owner locally on the data owner and in a cloud server, respectively. When performing a connection keyword search, the data owner locally generates trapdoor information based on the system key and sends it to the cloud server, which performs a search operation on the index structure. After returning encrypted data that meets the search criteria, the data owner decrypts the encrypted data using the system key to obtain the search results. The system key Includes: First pseudo-random function Key , which is obtained in the following way: the data owner first randomly selects a key and , and then according to the safety parameters and multi-valued mappings ,use Key ,use Algorithm to generate symmetric subset predicate encryption Master Key , and finally output the system key =( , specifically including: Step 1: Index structure generation: The data owner generates an index structure based on the plaintext document set and outsources the index structure to the cloud server. This includes: Step 1.1: The first pseudo-random function Select Key , is the second pseudo-random function Select Key , initialize an empty multi-valued map ,run Get the key , specifically: select integer , Generate pseudo-random function Key ; Run the initialization algorithm in the XOR filter algorithm ( The generation parameters are The XOR filter outputs Master Key , Message Space and complete works Contains 3 hash functions , ; Step 1.2: Generate multi-value mapping and collection , specifically including: 1.2.1 First cycle: For Each keyword : Initialize an empty collection , run the first pseudo-random function Generate keywords , 1.2.2 Second cycle: For , using the encryption algorithm in the symmetric encryption algorithm SE encryption The Document identifier to get document identifier ciphertext , , then Join Collection middle; 1.2.3 The third cycle: for Remove All keywords except , ,when , then run the second pseudo-random function Generated Values , then Stored in collections In the middle, the third cycle ends and the second cycle ends; 1.2.4 The set generated in the second loop Stored in middle, , and end the first cycle operation; Step 1.3, generate TS and , ; Step 1.4, generate ct, , specifically: for Each element in , calculate its pseudo-random function , forming a new set After that, call the update algorithm in the XOR filter algorithm will be collected After inserting into the XOR filter, the output Ciphertext ; Step 1.5: Set the system key , Stored locally in the data owner, the index structure Output to cloud server; Step 2: Generate retrieval trap information, including: Step 2.1 When the data owner retrieves the data containing When there are documents with keywords, , the data owner first runs the token generation algorithm in the encrypted multi-value mapping protocol generate , ,Will Output to cloud server; Step 2.2 For , perform steps 2.2.1-2.2.3: Step 2.2.1 For , through the second pseudo-random function generate ,Will Stored in collections middle; Step 2.2.2: For the set generated in step 2.2.1 Generate a trapdoor using the key generation algorithm in the symmetric subset predicate encryption protocol , , specifically: for Each element in , generating a set of locations , and form a multiset from the position sets of all elements ; Next, randomly select the key of the symmetric encryption algorithm Sym ,calculate , using the encryption algorithm in the symmetric encryption algorithm Sym encryption get , After that, output Corresponding trapdoor information , Step 2.2.3 will Output to cloud server, Step 3: Search, including: Step 3.1 When the cloud server receives , run the retrieval algorithm in the encrypted multi-value mapping protocol Retrieve the All ciphertext document identifiers, ,in: ; Step 3.2 For , running the decryption algorithm in the symmetric subset predicate encryption protocol For index structures To decrypt, , specifically: calculation Then, run the decryption algorithm in the symmetric encryption algorithm Sym Decryption , ; Finally, when , output , otherwise output ; Step 3.3 When , Is the ciphertext document identifier that meets the conditions, Add to Collection middle; Step 3.4 The cloud server will gather Output to data owner; Step 4: Decryption, specifically including: the data owner runs the first pseudo-random function Generate Key ,for Each , decryption algorithm using symmetric encryption algorithm SE Decryption Get the plaintext document identifier , then Stored in collections After that, the data owner gets the search results , The document identifiers in both Search keywords.

2. A non-interactive ciphertext connection keyword retrieval system for implementing the result pattern hiding of the method of claim 1, characterized in that: include: Index generation module, trapdoor generation module, retrieval module and decryption module, wherein: the data owner uses the index generation module to generate the data according to the plaintext document set. Generate index structure , and stored in the cloud server; the data owner generates the module through the trapdoor, according to the retrieval conditions Generate the corresponding trapdoor and output it to the cloud server; the cloud server uses the retrieval module to perform a retrieval operation based on the trapdoor information, obtains the ciphertext document identifier that meets the retrieval conditions and returns it to the data owner; the data owner obtains the final plaintext document identifier through the decryption algorithm in the symmetric encryption algorithm.

Images