A homomorphic encryption ciphertext retrieval method and system based on a hardware encryption card

Abstract

The application belongs to the technical field of ciphertext retrieval, and discloses a homomorphic encryption ciphertext retrieval method and system based on a hardware encryption card, which comprises the following steps: constructing a ciphertext database, encrypting large-scale document data based on an encryption algorithm realized by a hardware encryption card of an encryption server, constructing a ciphertext database containing encrypted data such as ciphertext documents and homomorphic ciphertext index tables and storing the ciphertext database in a cloud server, symmetrically encrypting the documents, and homomorphically encrypting keywords extracted from the full texts of the documents; ciphertext document query, a queryer can input keywords to query the ciphertext document content of the ciphertext database through a client, the cloud server and the encryption server match the ciphertext keywords, the ciphertext documents required by the user are searched in a ciphertext state, and the obtained ciphertext document information set is returned to the client after being decrypted by the encryption server. The application can realize safe and efficient ciphertext full-text search in the full-text search scene of large-scale ciphertext documents.

Description

Technical Field

[0001] This invention belongs to the field of encrypted text retrieval technology, and more specifically, relates to a homomorphic encrypted encrypted text retrieval method and system based on a hardware encryption card. Background Technology

[0002] With the rapid development of information technology, data is playing an increasingly important role in all walks of life. However, the widespread use of data has also brought serious security and privacy issues, especially in highly sensitive fields such as healthcare and finance. How to achieve effective use of data while protecting data privacy is crucial. While traditional encryption technologies can effectively protect data confidentiality, once data is encrypted, it becomes very difficult to perform effective searches within encrypted data.

[0003] Searchable encryption is a technology that allows searching encrypted data while simultaneously encrypting it. Existing searchable encryption technologies typically utilize homomorphic encryption to perform computations on encrypted data, ensuring the confidentiality of sensitive information during processing. However, the high computational complexity of homomorphic encryption algorithms limits the efficiency of encrypted data searching in encrypted form, making it difficult to achieve usability in large-scale full-text retrieval scenarios involving encrypted documents. How to achieve efficient encrypted full-text retrieval while ensuring data security has become a pressing problem to be solved. Summary of the Invention

[0004] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a homomorphic encrypted ciphertext retrieval method and system based on hardware encryption card, which aims to achieve secure and efficient encrypted full-text search in the scenario of full-text retrieval of large-scale encrypted documents.

[0005] To achieve the above objectives, according to a first aspect of the present invention, a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card is provided, applied to an encryption server containing a hardware encryption card, comprising:

[0006] The system uses a hardware encryption card to perform symmetric encryption on plaintext documents received from the client to generate ciphertext documents. It also performs homomorphic encryption on keywords in a plaintext index table received from the client to generate ciphertext keywords. The ciphertext keywords and their associated document numbers are used as the ciphertext index table. The ciphertext documents and the ciphertext index table are then sent to a ciphertext database on a cloud server for storage. The plaintext documents are plaintext documents containing sensitive data uploaded by the data owner through the client. The plaintext index table contains keywords extracted by the client from the plaintext documents and the document numbers associated with those keywords.

[0007] After using a hardware encryption card to perform homomorphic encryption on the query keywords received from the client to generate homomorphic ciphertext corresponding to the query keywords, the homomorphic ciphertext is sent to the cloud server; wherein, the query keywords are input by the queryer through the client;

[0008] The hardware encryption card is used to symmetrically decrypt the list of encrypted document information sent by the cloud server, obtaining a decrypted list of document information, which is then sent to the client to achieve encrypted document retrieval. The encrypted document information list is obtained based on the document numbers that match the encrypted keywords retrieved from the encrypted index table when the cloud server successfully matches the homomorphic ciphertext with the ciphertext keywords in the ciphertext index table.

[0009] Furthermore, it also includes:

[0010] The hardware encryption card is invoked to perform symmetric encryption on the keywords in the plaintext index sub-table received from the client, and the last M bits of the encrypted keywords are extracted; wherein, the plaintext index sub-table is a plurality of plaintext index sub-tables divided by the client according to the word length of the keywords;

[0011] The keywords with the same last M positions are grouped into a bucket, and the buckets are numbered.

[0012] The plaintext index sub-table is also encrypted into a corresponding ciphertext index sub-table; the ciphertext index sub-table for matching the ciphertext keyword is determined according to the word length of the query keyword, and the query keyword is symmetrically encrypted. The bucket number in the ciphertext index sub-table is determined according to the last M bits of the symmetrically encrypted query keyword, and the ciphertext keyword matching is performed in the corresponding bucket according to the bucket number.

[0013] Furthermore, it also includes:

[0014] The hardware encryption card is used to perform symmetric decryption on the ciphertext document to be decrypted received from the cloud server to obtain the plaintext document, and the plaintext document is sent to the client for the queryer to view or download; wherein, the ciphertext document to be decrypted is determined by the cloud server based on the document number to be decrypted selected by the queryer from the list of decrypted document information sent by the client.

[0015] Furthermore, the encrypted keyword matching includes:

[0016] The receiving cloud server performs a homomorphic subtraction between the homomorphic ciphertext corresponding to the query keyword and the ciphertext keyword to obtain the ciphertext difference; and then performs homomorphic decryption on it. If the decryption result is 0, it indicates that the match is successful; wherein, the ciphertext keyword is the ciphertext keyword in the ciphertext index table, or the ciphertext keyword in the ciphertext index sub-table.

[0017] Furthermore, it also includes:

[0018] The hardware encryption card is used to symmetrically decrypt the list of encrypted document information after importance sorting, resulting in a decrypted list of document information. The important-sorted list of encrypted document information is obtained as follows: the cloud server merges the encrypted document information lists corresponding to each query keyword into a single encrypted document information list, calculates the TF-IDF vector of each document in the merged list, and sorts the document information in the merged list from highest to lowest importance based on the TF-IDF vector. The TF-IDF vector measures the importance of the keyword to the document.

[0019] According to a second aspect of the present invention, an encryption server containing a hardware encryption card is provided, including a computer-readable storage medium and a processor;

[0020] The computer-readable storage medium is used to store executable instructions;

[0021] The processor is configured to read executable instructions stored in the computer-readable storage medium and execute the homomorphic encrypted ciphertext retrieval method according to any one of the first aspects.

[0022] According to a third aspect of the present invention, a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card is provided, applied to a cloud server, comprising:

[0023] The ciphertext database stores ciphertext documents and a ciphertext index table sent by the encryption server. The ciphertext document is generated by the encryption server (containing a hardware encryption card) performing symmetric encryption on a plaintext document received from the client. The ciphertext index table includes ciphertext keywords and document numbers associated with those keywords. The ciphertext keywords are generated by the encryption server using homomorphic encryption on keywords in the plaintext index table received from the client. The plaintext document is a plaintext document containing sensitive data uploaded by the data owner through the client. The plaintext index table contains keywords extracted by the client from the plaintext document and the document numbers associated with those keywords.

[0024] The ciphertext database stores the homomorphic ciphertext corresponding to the query keywords sent by the encryption server; wherein, the homomorphic ciphertext is generated by the encryption server calling the hardware encryption card to homomorphically encrypt the query keywords received from the client, and the query keywords are entered by the queryer through the client;

[0025] The homomorphic ciphertext is matched with the ciphertext keywords in the ciphertext index table. If a match is successful, the document number matching the ciphertext keyword is retrieved from the ciphertext index table to form a list of ciphertext document information. The list of ciphertext document information is then sent to the encryption server, which uses a hardware encryption card to perform symmetric decryption on the list of ciphertext document information. The symmetrically decrypted list of document information is then sent to the client, thus enabling ciphertext document retrieval.

[0026] According to a fourth aspect of the present invention, a cloud server is provided, including a computer-readable storage medium and a processor;

[0027] The computer-readable storage medium is used to store executable instructions;

[0028] The processor is used to read executable instructions stored in the computer-readable storage medium and execute the homomorphic encrypted ciphertext retrieval method described in the third aspect.

[0029] According to a fifth aspect of the present invention, a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card is provided, applied to a client, comprising:

[0030] Keywords are extracted from plaintext documents containing sensitive data uploaded by the data owner to generate a plaintext index table. The plaintext document and the plaintext index table are then sent to an encryption server equipped with a hardware encryption card. The encryption server uses the hardware encryption card to perform symmetric encryption on the plaintext document to generate a ciphertext document. The keywords in the plaintext index table are then homomorphically encrypted to generate ciphertext keywords. The ciphertext keywords and their associated document numbers are used as the ciphertext index table. The ciphertext document and the ciphertext index table are then sent to a ciphertext database in a cloud server for storage. The plaintext index table contains the keywords and the document numbers associated with those keywords.

[0031] The system sends the query keywords entered by the user to the encryption server and receives a list of decrypted document information corresponding to the query keywords from the encryption server, thereby enabling encrypted document retrieval. The document information list is obtained by the encryption server using a hardware encryption card to perform symmetric decryption on the encrypted document information list. The encrypted document information list is also obtained by the cloud server retrieving document numbers from the encrypted index table that match the encrypted keywords when it successfully matches homomorphic ciphertext with the encrypted keywords in the ciphertext index table. The homomorphic ciphertext is obtained by the encryption server using a hardware encryption card to perform homomorphic encryption on the query keywords.

[0032] According to a sixth aspect of the present invention, a client is provided, comprising a computer-readable storage medium and a processor;

[0033] The computer-readable storage medium is used to store executable instructions;

[0034] The processor is used to read executable instructions stored in the computer-readable storage medium and execute the homomorphic encrypted ciphertext retrieval method described in the fifth aspect.

[0035] In summary, the above-described technical solutions conceived in this invention can achieve the following beneficial effects:

[0036] (1) This invention considers that although hardware encryption cards have high encryption and decryption efficiency, they cannot achieve encrypted retrieval. While homomorphic encryption technology can perform calculations on data in both encrypted and decrypted states, its retrieval efficiency is extremely low in the face of full-text retrieval scenarios involving large-scale encrypted documents. Therefore, this invention combines hardware encryption cards and homomorphic encryption. The hardware encryption card improves the speed of encryption calculations and provides a reliable computing environment for encryption, decryption, key generation, and management, enabling cloud servers and encryption servers to support full-text keyword retrieval services for large-scale encrypted documents. Specifically, plaintext documents uploaded by data owners through clients are stored in encrypted form in the database of the cloud server. Data encryption and decryption are performed in the hardware encryption card of the encryption server. Attackers cannot obtain plaintext information through encrypted documents in the cloud server, thus protecting data security. At the same time, based on homomorphic encryption technology, the keywords in the encrypted index table are encrypted into random ciphertext using a homomorphic encryption algorithm. Attackers cannot obtain the order information of keywords or the correspondence between keywords and documents through the encrypted index table in the cloud server, ensuring the security of the index table. Furthermore, by combining hardware encryption cards with homomorphic encryption, and performing encryption and decryption based on the hardware encryption card, a secure and efficient computing environment is provided for the implementation of searchable encryption. This enables the homomorphic encryption ciphertext retrieval method based on hardware encryption cards of the present invention to achieve secure and efficient full-text search of ciphertext documents in scenarios involving large-scale full-text retrieval of ciphertext documents.

[0037] (2) Furthermore, the ciphertext index table is divided into several sub-index tables according to the word length of the keywords. Each sub-table is divided into multiple buckets according to the last M bits of the symmetric encrypted ciphertext of the keywords, and the buckets are numbered. When performing ciphertext keyword matching, it is only necessary to select the corresponding bucket for ciphertext keyword matching according to the word length and bucket number, which further improves the retrieval efficiency.

[0038] (3) Further, the encrypted document information lists corresponding to each query keyword are merged into a single encrypted document information list by taking the union of the lists. The document information in the merged encrypted document information list is sorted from high to low importance according to the TF-IDF vector, so that the queryer can quickly obtain the required document information from the decrypted document information list and further improve the retrieval efficiency. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card in an embodiment of the present invention.

[0040] Figure 2 This is a schematic diagram illustrating the process of constructing a encrypted database in an embodiment of the present invention.

[0041] Figure 3 This is a schematic diagram of the encrypted text retrieval process in an embodiment of the present invention.

[0042] Figure 4 This is a schematic diagram of the keyword matching process in an embodiment of the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0044] Example 1

[0045] like Figure 1 As shown, this embodiment of the invention provides a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card, mainly including:

[0046] The data owner submits a plaintext document containing sensitive data to the client.

[0047] The client extracts keywords from the plaintext document to generate a plaintext index table, which contains each keyword and the plaintext document number associated with each keyword. The client then sends the plaintext document and the plaintext index table to an encryption server containing a hardware encryption card.

[0048] The encryption server uses the symmetric encryption algorithm of the hardware encryption card to symmetrically encrypt the plaintext document, generating a ciphertext document. Simultaneously, the hardware encryption card uses a homomorphic encryption algorithm to homomorphically encrypt keywords in the plaintext index table, generating ciphertext keywords to create a ciphertext index table. The ciphertext index table includes ciphertext keywords and ciphertext document numbers; the ciphertext document numbers are the same as the plaintext document numbers, meaning the document numbers in the plaintext index table are not encrypted. The encryption server then sends the ciphertext document and the ciphertext index table to a ciphertext database on a cloud server for storage.

[0049] Users with the appropriate permissions can enter search keywords through the corresponding client.

[0050] The client sends the query keywords to the encrypted server.

[0051] The encryption server calls the hardware encryption card to perform homomorphic encryption on the query keywords, generates the homomorphic ciphertext corresponding to the query keywords, and then sends the homomorphic ciphertext corresponding to the query keywords to the cloud server.

[0052] The cloud server matches the homomorphic ciphertext corresponding to the query keyword with the ciphertext keywords in its ciphertext index table stored in the ciphertext database. If a match is found, the cloud server retrieves all ciphertext document numbers matching the keyword from the ciphertext index table and generates a list of ciphertext document information. This list includes encrypted document information, such as the document title. The cloud server then sends this list of ciphertext document information to the encryption server.

[0053] The hardware encryption card in the encryption server uses a symmetric encryption algorithm to symmetrically decrypt the list of encrypted document information, obtaining a decrypted list of document information, which is then sent to the client for authorized users to view, thus enabling encrypted document retrieval. Preferably, the encryption server only decrypts the encrypted document information in the encrypted document information list, avoiding the need to decrypt all matching encrypted document content, thereby reducing the computational load of decryption and improving retrieval efficiency.

[0054] Furthermore, the retrieval method in this embodiment of the invention further includes:

[0055] Users with the appropriate permissions can determine the plaintext document number they wish to view or download based on the decrypted document information list.

[0056] The client sends the plaintext document number to the cloud server.

[0057] The cloud server sends the encrypted document stored in its encrypted database to the encryption server based on the plaintext document number.

[0058] The encryption server calls the symmetric encryption algorithm of the hardware encryption card to symmetrically decrypt the ciphertext document, obtain the plaintext document, and sends the plaintext document to the corresponding client for the queryer to view or download.

[0059] To further improve retrieval efficiency, in embodiments of the present invention, such as Figures 2-4 As shown, after generating the plaintext index table, the client further divides the plaintext index table into multiple plaintext index sub-tables according to the word length of each keyword. That is, the word length of keywords within the same plaintext index sub-table is equal. Each row in each plaintext index sub-table represents a keyword, and each row contains the numbers of all plaintext documents containing that keyword.

[0060] Correspondingly, when the encryption server performs encryption, it also includes: the hardware encryption card calls a symmetric encryption algorithm to symmetrically encrypt the keywords in each plaintext index sub-table, and extracts the last M bits of the encrypted keywords. In each plaintext index sub-table, keywords with the same last M bits are grouped into a bucket, and the buckets in the plaintext index sub-table are numbered; in each plaintext index sub-table, the keyword, the corresponding plaintext document number, and the bucket number correspond one-to-one. As a preferred implementation, the last M bits of the encrypted keywords are directly used as the bucket number, and keywords with the same bucket number are grouped into a bucket. In this embodiment of the invention, M is 8. In other embodiments, M can also be 16, etc. The smaller M is, the higher the security. Correspondingly, the larger M is, the higher the retrieval efficiency. In practical applications, a trade-off is made between security and efficiency.

[0061] Correspondingly, when the encryption server calls the hardware encryption card for encryption, it encrypts each plaintext index sub-table into the corresponding ciphertext index sub-table.

[0062] Correspondingly, after the encryption server calls the hardware encryption card to perform homomorphic encryption on the query keywords, it also includes: determining the ciphertext index sub-table for matching the above ciphertext keywords based on the word length of the query keywords;

[0063] The system then uses a symmetric encryption algorithm to symmetrically encrypt the query keywords. Based on the last M bits of the encrypted query keywords, it determines the bucket number in the ciphertext index sub-table required for ciphertext keyword matching. Ciphertext keyword matching is then performed within the bucket corresponding to that bucket number. As a preferred implementation, the last M bits of the symmetrically encrypted query keywords are used as the bucket number for the current query keyword. Based on this bucket number, a bucket in the ciphertext index sub-table required for ciphertext keyword matching is selected, and ciphertext keyword matching is performed within that bucket. This allows for direct homomorphic matching within the bucket containing the keyword, significantly improving retrieval efficiency.

[0064] Specifically, the keys required for encryption and decryption by the encryption server are stored in the hardware encryption card of the encryption server. The encryption server is also used to generate corresponding system parameters based on security parameters. These system parameters are used to generate public-private key pairs and for authentication of users (including data owners and users with appropriate permissions). The public key is used when the encryption server performs homomorphic encryption, and the private key is used when the encryption server performs homomorphic decryption. During encryption and decryption, the encryption server authenticates the key index holder (such as the user mentioned above) based on the key index.

[0065] Specifically, the cloud server performs the aforementioned encrypted keyword matching, including:

[0066] Perform homomorphic subtraction on the homomorphic ciphertext corresponding to the query keyword and each ciphertext keyword in its corresponding ciphertext index table (or ciphertext index sub-table) to obtain the ciphertext difference between the two keywords in the ciphertext state; send all ciphertext differences to the encryption server for decryption. If the decryption result is 0, it indicates a successful match.

[0067] As a preferred implementation, after the cloud server queries the ciphertext index table for all ciphertext document numbers matching the ciphertext keywords and forms a list of ciphertext document information, it also includes:

[0068] Take the union of the encrypted document information lists corresponding to each query keyword, so as to merge the encrypted document information lists corresponding to each query keyword into a single encrypted document information list;

[0069] Calculate the TF-IDF vectors of the documents in the merged encrypted document information list, sort the document information in the merged encrypted document information list from high to low importance based on the TF-IDF vectors, and send the encrypted document information list sorted by importance to the encryption server; where the TF-IDF vector is used to measure the importance of keywords to documents;

[0070] Correspondingly, the hardware encryption card in the encryption server uses a symmetric encryption algorithm to symmetrically decrypt the list of encrypted documents after they have been sorted by importance. This further improves retrieval efficiency.

[0071] As a preferred implementation, the client authenticates the data owner before extracting keywords from the plaintext document. Correspondingly, the client authenticates the queryer before sending the query keywords to the encryption server. The client extracts keywords from the plaintext document provided by the data owner by performing word segmentation. The client extracts query keywords from the search string entered by the queryer by performing word segmentation.

[0072] As a preferred implementation, the aforementioned homomorphic encryption algorithm is an integer homomorphic encryption algorithm, which can further improve retrieval efficiency. When the encryption server performs symmetric encryption on plaintext documents, it uses the SM4 symmetric encryption algorithm. When using symmetric encryption algorithms to generate bucket numbers for keywords (keywords in the plaintext index sub-table or query keywords), it uses the AES symmetric encryption algorithm. In this way, retrieval efficiency can be further improved while ensuring security.

[0073] In this embodiment of the invention, the queryer is an entity that needs to obtain specific data. The queryer may be an individual user, an enterprise organization, or other client system. The queryer typically initiates a data query request to a cloud server to obtain the required data. A cloud server is an entity that stores and manages data, responsible for managing, storing, and maintaining the data, and providing the data to the query client as needed. The encryption server provides encryption and decryption functions based on encryption algorithms supported by a hardware encryption card. A hardware encryption card is a hardware device specifically designed to protect encryption keys and perform encryption operations. It provides a secure and efficient way to handle encryption tasks and key management. The role of the hardware encryption card is to protect data security, improve performance, and prevent key leakage.

[0074] As one specific implementation method, the connection process between the client, cloud server, and encryption server includes the following steps:

[0075] Step 1. System Initialization: The encryption server generates a key and verification information based on security parameters. The steps for generating the public and private keys required for integer homomorphic encryption are as follows: Select two large prime numbers p and q, and calculate their product pair 2. l Take the modulo to get n, where l is the number of bits in the homomorphic ciphertext. Calculate the least common multiple λ of p-1 and q-1, and choose a random number g such that g is n. 2 Find a unit root of the modulo and obtain the public key (n, g). Calculate g. λ mod n 2 The multiplicative inverse μ is obtained to get the private key (λ,μ).

[0076] Step 2. Constructing the Ciphertext Database: The data owner submits a document containing sensitive data to the client. The client extracts keywords from the document and generates an index table associated with the document number. Then, the client sends the document and index table to the encryption server. The encryption server encrypts the document and index table, generates bucket numbers, and then sends them to the cloud server. The cloud server stores the ciphertext document and ciphertext index table in the ciphertext database. This step specifically includes the following sub-steps:

[0077] 2.1 The data owner submits the document to the client. The client first verifies the user's identity. If the verification is successful, the document is assigned a document number. At the same time, the word segmentation algorithm is called to extract keywords and generate an index. The index table is divided into several sub-tables according to the keyword length. Each row in the table represents a keyword and contains the numbers of all documents containing that keyword. After the keyword extraction is completed, the document, index table and key index are sent to the encryption server.

[0078] 2.2 The encryption server calls the symmetric encryption algorithm of the hardware encryption card to encrypt the document, calls the integer homomorphic encryption algorithm to encrypt the keywords in the index table, calls the symmetric encryption algorithm to encrypt the keywords and extracts the last 8 bits of the ciphertext as the bucket number, and uses the bucket number of the keyword, the integer homomorphic ciphertext corresponding to the keyword, and the associated document number as a new ciphertext index table, and sends the ciphertext document and the ciphertext index table to the cloud server.

[0079] 2.3 After receiving the encrypted document and encrypted index table, the cloud server first verifies the message's consistency proof. If the verification passes, it stores the encrypted document and encrypted index, among other encrypted data, into the encrypted database. The entire encrypted database construction process is as follows: Figure 2 As shown, the ciphertext document is obtained by symmetric encryption of the document. Each row of the ciphertext index table consists of the bucket number of the keyword extracted from a document, the integer homomorphic ciphertext corresponding to the keyword, and the document numbers of all documents containing the keyword. At the same time, the ciphertext index table is divided into several sub-tables according to the word length of the keyword, and each sub-table is divided into several buckets according to the bucket number.

[0080] Step 3. Ciphertext Query: All users with the appropriate permissions can query the ciphertext document content of the ciphertext database by entering keywords on the client. Specifically, the client sends the query keywords to the encryption server, which encrypts them into homomorphic ciphertext and then sends them to the cloud server. The cloud server first finds the bucket containing the keyword, then performs a homomorphic subtraction between the homomorphic ciphertext of the query keyword and the ciphertext keyword in the ciphertext index table, and finally sends the result to the encryption server for decryption. A result of 0 indicates a successful keyword match. Figure 3 This is a diagram illustrating the encrypted text retrieval process. (Refer to...) Figure 3 The client divides the search string into keywords t1 to t2. k There are k query keywords. Each query keyword is matched with a homomorphically encrypted ciphertext index table to obtain a document set 1 to k. The union of the k document sets is taken to obtain a document set D. The TF-IDF vector is calculated for the documents in D. The documents are sorted according to the TF-IDF vector. The sorted ciphertext document information list is sent to the encryption server. After decryption, the encryption server returns the document information list as the query result to the client. Figure 4 This is a schematic diagram of the keyword matching process of the present invention, with reference to... Figure 4 This step specifically includes the following sub-steps:

[0081] 3.1 When a user enters a search string on the client to query a encrypted document, the client verifies the user's identity and permissions. If the verification is successful, the search string is segmented to extract the query keywords, and the query keywords and key index are sent to the encryption server.

[0082] 3.2 The encryption server calls the integer homomorphic encryption algorithm of the hardware encryption card to encrypt the query keywords and generate homomorphic ciphertext, calls the symmetric encryption algorithm to encrypt the query keywords and generate bucket numbers, and sends the word length of the query keywords, the integer homomorphic ciphertext corresponding to the query keywords, and the bucket numbers to the cloud server;

[0083] 3.3 The cloud server finds the bucket containing the query keyword based on the word length and bucket number, performs homomorphic subtraction with all the encrypted keywords in the encrypted index table within the bucket, and sends the resulting difference to the encryption server. After decryption, the encryption server returns the result of the homomorphic subtraction to the cloud server. A result of 0 indicates that the keyword is successfully matched. The cloud server extracts the encrypted document number corresponding to the query keyword based on the result.

[0084] 3.4 The cloud server takes the union of each encrypted document set, calculates the TF-IDF vector as a standard to measure the importance of keywords to documents, sorts the documents according to the TF-IDF vector, and sends the sorted encrypted document information list to the encryption server. After decryption, the encryption server returns the document information list as the query result to the client.

[0085] Step 4. Plaintext Acquisition: The querying user obtains a list of matching document information and selects to view or download the plaintext version of the desired document. Specifically, the client sends a decryption request (the querying user determines the plaintext document number to view or download based on the decrypted document information list) to the cloud server. Upon receiving the request, the cloud server sends the encrypted document to the encryption server. The encryption server uses the symmetric encryption algorithm of the hardware encryption card to decrypt the encrypted document and returns the decrypted document to the client. This step includes the following sub-steps:

[0086] 4.1 The inquirer selects the document number to be decrypted through the client and sends it to the cloud server;

[0087] 4.2 The cloud server extracts the corresponding ciphertext document from the ciphertext database and sends it to the encryption server;

[0088] 4.3 The encryption server calls the symmetric encryption algorithm of the hardware encryption card to decrypt the ciphertext document and returns the plaintext document to the client.

[0089] This invention addresses the issue that while hardware encryption cards offer high encryption and decryption efficiency, they cannot perform encrypted retrieval. Homomorphic encryption, while enabling computation (retrieval) of data in both encrypted and decrypted states, suffers from extremely low efficiency in full-text retrieval scenarios involving large-scale encrypted documents. Therefore, this invention combines hardware encryption cards with homomorphic encryption. The hardware encryption card improves the speed of encryption computation while providing a reliable computing environment for encryption, decryption, and key generation and management, enabling cloud servers and encryption servers to support full-text keyword retrieval services for large-scale encrypted documents. Specifically, plaintext documents uploaded by data owners via clients are stored in encrypted form in the cloud server's database. Data encryption and decryption are performed on the hardware encryption card of the encryption server, preventing attackers from accessing plaintext information through encrypted documents on the cloud server, thus protecting data security. Furthermore, based on homomorphic encryption, keywords in the encrypted index table are encrypted into random ciphertext using a homomorphic encryption algorithm. Attackers cannot obtain the keyword order information or the correspondence between keywords and documents through the encrypted index table on the cloud server, ensuring the security of the index table. Furthermore, by combining hardware encryption cards with homomorphic encryption, and performing encryption and decryption based on the hardware encryption card, a secure and efficient computing environment is provided for the implementation of searchable encryption. This enables the homomorphic encryption ciphertext retrieval method based on hardware encryption cards of the present invention to achieve secure and efficient full-text search of ciphertext documents in scenarios involving large-scale full-text retrieval of ciphertext documents.

[0090] To further improve retrieval efficiency, the encrypted index table is divided into several sub-index tables according to the keyword length. Each sub-table is further divided into several buckets according to the bucket number. The bucket number is generated based on the symmetric encryption of the encrypted text, which ensures security while further optimizing query efficiency.

[0091] Example 2

[0092] This invention provides a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card, applied to an encryption server containing a hardware encryption card, comprising:

[0093] The system uses a hardware encryption card to perform symmetric encryption on plaintext documents received from the client to generate ciphertext documents. It also performs homomorphic encryption on keywords in the plaintext index table received from the client to generate ciphertext keywords. The ciphertext keywords and their associated document numbers are used as the ciphertext index table. The ciphertext documents and the ciphertext index table are then sent to a ciphertext database on a cloud server for storage. The plaintext documents are those containing sensitive data uploaded by the data owner through the client. The plaintext index table contains keywords extracted by the client from the plaintext documents and the document numbers associated with those keywords.

[0094] After using a hardware encryption card to perform homomorphic encryption on the query keywords received from the client to generate homomorphic ciphertext corresponding to the query keywords, the homomorphic ciphertext is sent to the cloud server; where the query keywords are input by the queryer through the client.

[0095] The hardware encryption card is used to symmetrically decrypt the list of encrypted document information sent by the cloud server, obtaining a decrypted list of document information, which is then sent to the client to achieve encrypted document retrieval. The encrypted document information list is obtained based on the document numbers that match the encrypted keywords retrieved from the encrypted index table when the cloud server successfully matches the homomorphic ciphertext with the ciphertext keywords in the ciphertext index table.

[0096] Furthermore, it also includes:

[0097] The hardware encryption card is invoked to perform symmetric encryption on the keywords in the plaintext index sub-table received from the client, and the last M bits of the encrypted keywords are extracted; where the plaintext index sub-table is a set of multiple plaintext index sub-tables divided by the client according to the word length of the keywords.

[0098] Group keywords with the same last M positions into a bucket and number the buckets accordingly;

[0099] The plaintext index sub-table is also encrypted into a corresponding ciphertext index sub-table; the ciphertext index sub-table for ciphertext keyword matching is determined according to the word length of the query keyword, and the query keyword is symmetrically encrypted. The bucket number in the ciphertext index sub-table is determined according to the last M bits of the symmetrically encrypted query keyword, and the ciphertext keyword matching is performed in the corresponding bucket according to the bucket number.

[0100] Furthermore, it also includes:

[0101] The hardware encryption card is used to perform symmetric decryption on the ciphertext document received from the cloud server to obtain the plaintext document, which is then sent to the client for the queryer to view or download. The ciphertext document to be decrypted is determined by the cloud server based on the document number selected by the queryer from the list of decrypted document information sent by the client.

[0102] Furthermore, encrypted keyword matching includes:

[0103] The receiving cloud server performs homomorphic subtraction between the homomorphic ciphertext corresponding to the query keyword and the ciphertext keyword to obtain the ciphertext difference; and then performs homomorphic decryption on it. If the decryption result is 0, it means that the match is successful; where the ciphertext keyword is either the ciphertext keyword in the ciphertext index table or the ciphertext keyword in the ciphertext index sub-table.

[0104] Furthermore, it also includes:

[0105] The hardware encryption card is used to symmetrically decrypt the list of encrypted documents after importance sorting, resulting in a decrypted list of documents. The important-sorted list of encrypted documents is obtained as follows: the cloud server merges the encrypted document lists corresponding to each query keyword into a single encrypted document list, calculates the TF-IDF vector of each document in the merged list, and sorts the documents in the merged list by importance from highest to lowest based on the TF-IDF vector. The TF-IDF vector measures the importance of the keywords to the documents.

[0106] For specific technical solutions related to the client, encryption server, and cloud server, please refer to the corresponding description in Example 1, which will not be repeated here.

[0107] Example 3

[0108] This invention provides an encryption server containing a hardware encryption card, including a computer-readable storage medium and a processor;

[0109] Computer-readable storage media are used to store executable instructions;

[0110] The processor is used to read executable instructions stored in a computer-readable storage medium to execute the homomorphic encrypted ciphertext retrieval method in Embodiment 2.

[0111] For specific technical solutions, please refer to the corresponding description in Embodiment 2, which will not be repeated here.

[0112] Example 4

[0113] This invention provides a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card, applied to a cloud server, including:

[0114] The ciphertext database stores ciphertext documents and a ciphertext index table sent by the encryption server. The ciphertext document is generated by the encryption server (containing a hardware encryption card) using symmetric encryption on a plaintext document received from the client. The ciphertext index table includes ciphertext keywords and their associated document numbers. The ciphertext keywords are generated by the encryption server using homomorphic encryption on keywords in the plaintext index table received from the client. The plaintext document is a plaintext document containing sensitive data uploaded by the data owner through the client. The plaintext index table contains keywords extracted by the client from the plaintext document and their associated document numbers.

[0115] The ciphertext database stores the homomorphic ciphertext corresponding to the query keywords sent by the encryption server; the homomorphic ciphertext is generated by the encryption server calling the hardware encryption card to homomorphically encrypt the query keywords received from the client, and the query keywords are entered by the queryer through the client.

[0116] The homomorphic ciphertext is matched with the ciphertext keywords in the ciphertext index table. When a match is successful, the document number matching the ciphertext keyword is retrieved from the ciphertext index table to form a list of ciphertext document information. This list is then sent to the encryption server, which uses a hardware encryption card to perform symmetric decryption on the list of ciphertext document information. The decrypted list of document information is then sent to the client, thus enabling ciphertext document retrieval.

[0117] For specific technical solutions related to the client, encryption server, and cloud server, please refer to the corresponding description in Example 1, which will not be repeated here.

[0118] Example 5

[0119] This invention provides a cloud server, including a computer-readable storage medium and a processor;

[0120] Computer-readable storage media are used to store executable instructions;

[0121] The processor is used to read executable instructions stored in a computer-readable storage medium to execute the homomorphic encrypted ciphertext retrieval method in Embodiment 4.

[0122] For specific technical solutions, please refer to the corresponding description in Example 4, which will not be repeated here.

[0123] Example 6

[0124] This invention provides a homomorphic encrypted ciphertext retrieval method based on a hardware encryption card, applied to a client, including:

[0125] Keywords are extracted from plaintext documents containing sensitive data uploaded by the data owner to generate a plaintext index table. The plaintext document and the plaintext index table are then sent to an encryption server equipped with a hardware encryption card. The encryption server uses the hardware encryption card to perform symmetric encryption on the plaintext document to generate a ciphertext document. The keywords in the plaintext index table are then homomorphically encrypted to generate ciphertext keywords. The ciphertext keywords and their associated document numbers are used as the ciphertext index table. The ciphertext document and the ciphertext index table are then sent to a ciphertext database on a cloud server for storage. The plaintext index table contains the keywords and the document numbers associated with those keywords.

[0126] The system sends the query keywords entered by the user to the encryption server and receives a list of decrypted document information corresponding to the query keywords from the encryption server, thus enabling encrypted document retrieval. The document information list is obtained by the encryption server using a hardware encryption card to perform symmetric decryption on the encrypted document information list. The encrypted document information list is also obtained by the cloud server retrieving document numbers from the encrypted index table that match the encrypted keywords when successfully matching homomorphic ciphertext with the encrypted keywords in the ciphertext index table. The homomorphic ciphertext is obtained by the encryption server using a hardware encryption card to perform homomorphic encryption on the query keywords.

[0127] For specific technical solutions related to the client, encryption server, and cloud server, please refer to the corresponding description in Example 1, which will not be repeated here.

[0128] Example 7

[0129] This invention provides a client, including a computer-readable storage medium and a processor;

[0130] Computer-readable storage media are used to store executable instructions;

[0131] The processor is used to read executable instructions stored in a computer-readable storage medium to execute the homomorphic encrypted ciphertext retrieval method in Embodiment 6.

[0132] The specific technical solutions are described in Example 6 and will not be repeated here. The specific technical solutions for the client, encryption server, and cloud server are described in Example 1 and will not be repeated here.

[0133] Example 8

[0134] This invention provides a homomorphic encrypted ciphertext retrieval system based on a hardware encryption card, including a client, an encryption server containing a hardware encryption card, and a cloud server;

[0135] Wherein, the client is the client in the above embodiments, the encryption server is the encryption server containing a hardware encryption card in the above embodiments, and the cloud server is the cloud server in the above embodiments.

[0136] For specific technical solutions related to the client, encryption server, and cloud server, please refer to the corresponding description in Example 1, which will not be repeated here.

[0137] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for retrieving homomorphic encrypted ciphertext based on a hardware encryption card, characterized in that, Encryption servers with hardware encryption cards are used, including: The system uses a hardware encryption card to perform symmetric encryption on plaintext documents received from the client to generate ciphertext documents. It also performs homomorphic encryption on keywords in a plaintext index table received from the client to generate ciphertext keywords. The ciphertext keywords and their associated document numbers are used as the ciphertext index table. The ciphertext documents and the ciphertext index table are then sent to a ciphertext database on a cloud server for storage. The plaintext documents are plaintext documents containing sensitive data uploaded by the data owner through the client. The plaintext index table contains keywords extracted by the client from the plaintext documents and the document numbers associated with those keywords. After using a hardware encryption card to perform homomorphic encryption on the query keywords received from the client to generate homomorphic ciphertext corresponding to the query keywords, the homomorphic ciphertext is sent to the cloud server; wherein, the query keywords are input by the queryer through the client; The hardware encryption card is used to symmetrically decrypt the list of encrypted document information sent by the cloud server to obtain the decrypted list of document information, which is then sent to the client to achieve encrypted document retrieval. The encrypted document information list is obtained based on the document numbers that match the encrypted keywords retrieved from the encrypted index table when the cloud server successfully matches the homomorphic ciphertext with the ciphertext keywords in the ciphertext index table. Also includes: The hardware encryption card is invoked to perform symmetric encryption on the keywords in the plaintext index sub-table received from the client, and the last M bits of the encrypted keywords are extracted; wherein, the plaintext index sub-table is a plurality of plaintext index sub-tables divided by the client according to the word length of the keywords; The keywords with the same last M positions are grouped into a bucket, and the buckets are numbered. The plaintext index sub-table is also encrypted into a corresponding ciphertext index sub-table; the ciphertext index sub-table for matching the ciphertext keyword is determined according to the word length of the query keyword, and the query keyword is symmetrically encrypted. The bucket number in the ciphertext index sub-table is determined according to the last M bits of the symmetrically encrypted query keyword, and the ciphertext keyword matching is performed in the corresponding bucket according to the bucket number.

2. The homomorphic encrypted ciphertext retrieval method according to claim 1, characterized in that, Also includes: The hardware encryption card is used to perform symmetric decryption on the ciphertext document to be decrypted received from the cloud server to obtain the plaintext document, and the plaintext document is sent to the client for the queryer to view or download; wherein, the ciphertext document to be decrypted is determined by the cloud server based on the document number to be decrypted selected by the queryer from the list of decrypted document information sent by the client.

3. The homomorphic encrypted ciphertext retrieval method according to claim 2, characterized in that, The encrypted keyword matching includes: The receiving cloud server performs a homomorphic subtraction between the homomorphic ciphertext corresponding to the query keyword and the ciphertext keyword to obtain the ciphertext difference; and then performs homomorphic decryption on it. If the decryption result is 0, it indicates that the match is successful; wherein, the ciphertext keyword is the ciphertext keyword in the ciphertext index table, or the ciphertext keyword in the ciphertext index sub-table.

4. The homomorphic encrypted ciphertext retrieval method according to claim 1, characterized in that, Also includes: The hardware encryption card is used to symmetrically decrypt the list of encrypted document information after importance sorting, resulting in a decrypted list of document information. The important-sorted list of encrypted document information is obtained as follows: the cloud server merges the encrypted document information lists corresponding to each query keyword into a single encrypted document information list, calculates the TF-IDF vector of each document in the merged list, and sorts the document information in the merged list from highest to lowest importance based on the TF-IDF vector. The TF-IDF vector measures the importance of the keyword to the document.

5. An encryption server containing a hardware encryption card, characterized in that, Includes computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is used to read executable instructions stored in the computer-readable storage medium and execute the homomorphic encrypted ciphertext retrieval method according to any one of claims 1-4.

6. A method for retrieving homomorphic encrypted ciphertext based on a hardware encryption card, characterized in that, Applied to cloud servers, including: The ciphertext database stores ciphertext documents and a ciphertext index table sent by the encryption server. The ciphertext document is generated by the encryption server (containing a hardware encryption card) performing symmetric encryption on a plaintext document received from the client. The ciphertext index table includes ciphertext keywords and document numbers associated with those keywords. The ciphertext keywords are generated by the encryption server using homomorphic encryption on keywords in the plaintext index table received from the client. The plaintext document is a plaintext document containing sensitive data uploaded by the data owner through the client. The plaintext index table contains keywords extracted by the client from the plaintext document and the document numbers associated with those keywords. The ciphertext database stores the homomorphic ciphertext corresponding to the query keywords sent by the encryption server; wherein, the homomorphic ciphertext is generated by the encryption server calling the hardware encryption card to homomorphically encrypt the query keywords received from the client, and the query keywords are entered by the queryer through the client; The homomorphic ciphertext is matched with ciphertext keywords in the ciphertext index table. If a match is successful, the document number matching the ciphertext keyword is retrieved from the ciphertext index table to form a ciphertext document information list. This list is then sent to the encryption server, which uses a hardware encryption card to symmetrically decrypt the list. The decrypted document information list is then sent to the client, enabling ciphertext document retrieval. Additionally, the encryption server uses a hardware encryption card to symmetrically encrypt keywords in the plaintext index sub-table received from the client and extracts the encrypted keywords. The last M bits of the word; wherein, the plaintext index sub-table is a plurality of plaintext index sub-tables divided by the client according to the word length of the keyword; keywords with the same last M bits are divided into a bucket and the buckets are numbered; the plaintext index sub-table is also encrypted into a corresponding ciphertext index sub-table; the ciphertext index sub-table for matching the ciphertext keyword is determined according to the word length of the query keyword, and the query keyword is symmetrically encrypted, the bucket number in the ciphertext index sub-table is determined according to the last M bits of the symmetrically encrypted query keyword, and the ciphertext keyword matching is performed in the corresponding bucket according to the bucket number.

7. A cloud server, characterized in that, Includes computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is used to read executable instructions stored in the computer-readable storage medium and execute the homomorphic encrypted ciphertext retrieval method as described in claim 6.

8. A method for retrieving homomorphic encrypted ciphertext based on a hardware encryption card, characterized in that, Applied to the client side, including: Keywords are extracted from plaintext documents containing sensitive data uploaded by the data owner to generate a plaintext index table. The plaintext document and the plaintext index table are then sent to an encryption server equipped with a hardware encryption card. The encryption server uses the hardware encryption card to perform symmetric encryption on the plaintext document to generate a ciphertext document. The keywords in the plaintext index table are then homomorphically encrypted to generate ciphertext keywords. The ciphertext keywords and their associated document numbers are used as the ciphertext index table. The ciphertext document and the ciphertext index table are then sent to a ciphertext database in a cloud server for storage. The plaintext index table contains the keywords and the document numbers associated with those keywords. The system sends the query keywords entered by the user to the encryption server and receives a list of decrypted document information corresponding to the query keywords from the encryption server, thereby enabling encrypted document retrieval. The document information list is obtained by the encryption server using a hardware encryption card to perform symmetric decryption on the encrypted document information list. The encrypted document information list is also obtained by the cloud server retrieving document numbers from the encrypted index table that match the encrypted keywords when it successfully matches homomorphic ciphertext with the encrypted keywords in the ciphertext index table. The homomorphic ciphertext is obtained by the encryption server using a hardware encryption card to perform homomorphic encryption on the query keywords. It is also used to divide the plaintext index table into multiple plaintext index sub-tables according to the word length of the keyword, and send the plaintext index sub-tables to the encryption server, so that the encryption server calls the hardware encryption card to perform symmetric encryption on the keywords in the plaintext index sub-tables, and extracts the last M bits of the encrypted keywords, divides the keywords with the same last M bits into a bucket, and numbers the buckets, and also encrypts the plaintext index sub-tables into corresponding ciphertext index sub-tables; it also determines the ciphertext index sub-table for ciphertext keyword matching according to the word length of the query keyword, performs symmetric encryption on the query keyword, determines the bucket number in the ciphertext index sub-table according to the last M bits of the symmetrically encrypted query keyword, and selects the corresponding bucket for ciphertext keyword matching according to the bucket number.

9. A client, characterized in that, Includes computer-readable storage media and processors; The computer-readable storage medium is used to store executable instructions; The processor is used to read executable instructions stored in the computer-readable storage medium and execute the homomorphic encrypted ciphertext retrieval method according to claim 8.

Images