A privacy-protected ciphertext searchable data integrity verification method

Abstract

The application relates to a privacy-protected ciphertext searchable data integrity verification method and belongs to the technical field of cloud storage security. The implementation method of the application is as follows: 1, a data owner performs file initialization; 2, the data owner performs system initialization; 3, the data owner performs index generation; 4, the data owner performs authentication tag generation; 5, the data owner performs trapdoor generation; 6, a third-party auditor performs challenge generation; 7, a cloud server performs proof generation; 8, the third-party auditor performs proof verification; the application realizes a privacy-protected ciphertext searchable data integrity verification method, and the flexibility of data integrity verification of a data owner end is increased through a multi-keyword simultaneous search mode.

Description

Technical Field

[0001] This invention relates to a method for verifying the integrity of encrypted searchable data with privacy protection, belonging to the field of cloud storage security technology. Background Technology

[0002] Cloud storage offers convenient storage space and easy sharing; however, it also presents challenges. Cloud storage deprives data owners of control over their data, and cloud data integrity verification technology addresses the issue of verifying the integrity of remote cloud data. Encrypted searchable data integrity verification can provide data owners with a convenient verification method. However, existing encrypted searchable data integrity verification methods lack privacy protection features. Cloud servers can directly obtain keyword information and the number of files corresponding to those keywords, leading to data privacy leaks. Storing index information or keyword sets directly on cloud servers can result in the direct leakage of keywords or the leakage of file counts during the search process, thus compromising data security.

[0003] Therefore, how to solve the technical problem of file information leakage caused by existing searchable data integrity verification has become an urgent issue to be addressed. Summary of the Invention

[0004] The purpose of this invention is to solve the technical problem of file information leakage caused by existing searchable data integrity verification, and to propose a privacy-preserving method for verifying the integrity of encrypted searchable data.

[0005] The workflow of this invention is as follows: Current methods for verifying the integrity of encrypted searchable data mainly consist of the following processes. First, the data storage process: The data owner categorizes their data, extracts keywords, and generates index tags based on these keywords. The data owner processes their data, dividing each data segment into blocks and generating verifiable data verification tags. Then, the data, index information, and data verification tags are uploaded to the cloud, while simultaneously deleting locally stored data and tags, and preserving the index information. Second, the data verification process: Data verification is generally entrusted to a third-party auditor. The data owner generates trapdoor information and sends it to the third-party auditor. The third-party auditor generates corresponding challenge information based on the trapdoor information and sends it to the cloud server. After receiving the challenge information, the cloud server locates the corresponding file information through the trapdoor information, generates corresponding proof information, and returns the proof information to the third-party auditor. Finally, the third-party auditor verifies the proof information returned by the cloud server and returns the verification result to the data owner.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] This invention provides a privacy-preserving method for verifying the integrity of encrypted searchable data, applied in a peer-to-peer network model involving a data owner, a third-party auditor, and cloud server member nodes. The data owner verifies the integrity of all files containing those keywords by providing multiple keywords. The method includes the following steps:

[0008] Step 1: The data owner extracts the keyword information associated with all files and generates an initial index matrix;

[0009] Step 1.1: Let there be v files initially uploaded and represent them as {F}. i} 1≤i≤v The number of keywords associated with all files is K.

[0010] Step 1.2: The set of keywords is represented as W = {w1, w2, ..., w...} K To prevent the number of files and keywords from being leaked to the cloud server, a matrix I with 'a' rows and 'a' columns is initialized. a×a Given a >> v and a >> K, initialize matrix I. a×a All elements are 0. The matrix can be represented as Each row of the matrix Indicates keyword w i The included file information row vector. Row vector v K+1 to v a This is to create obfuscation; the row vector values ​​are the values ​​used when initializing the matrix.

[0011] Step 2: The data owner selects system parameters, including the private and public key information required by the system, as well as other necessary parameter information, and publishes the publicly available information parameters;

[0012] Step 2.1: Select two multiplicative cyclic groups G1 and G2. T Select elements g and u from group G1, and select the bilinear pair e: G1×G1→G T .

[0013] Step 2.2: Select four different hash functions

[0014] Step 2.3: Select a random number As the private key, its corresponding public key is y = g x .

[0015] Step 2.4: Select As a key for pseudo-random hashing, The key is used as the pseudo-random function key. A public-private key pair (pk, sk) is selected for signing the message, and the signature is represented as ssg.sk (·)

[0016] Step 2.5: Select a pseudo-random hash Pseudo-random hash Pseudo-random function Here, key1, key2, and key3 represent the keys.

[0017] Step 2.6: The data owner publishes the system's public parameters.

[0018]

[0019] Step 3: The data owner generates tags based on the keyword information corresponding to the file, and generates an index matrix based on the keyword information corresponding to the file and encrypts it, generating a blind address for each row of the index matrix;

[0020] Step 3.1: For all keywords w k ∈W, if file F i If i ∈ [1, v] contains the keyword, record the file index i in the index vector. In, that is

[0021] Step 3.2: For all keywords w k ∈W, the data owner initializes the empty set. Record the file index i to

[0022] Step 3.3: For all files F i , i∈[1,v], the set of keywords extracted by the data owner from the file. in Represents file F i The lth keyword. Let t i Represents file F i The total number of all keywords.

[0023] Step 3.4: For each file F i (i∈[1,v]), the data owner calculates the keyword information tags. The data owner is all files F i (i∈[1,v]) Calculate the index Ω of the match. i =(HF) i ·H2(FID i )) -x FID i A unique identifier for a file. The index of all matching files can be represented as Ω = {Ω}. i} i∈[1,v] .

[0024] Step 3.5: For each keyword w k ∈W, the data owner is matrix I a×a Calculate the blind address π o (w k For j∈[K+1,a], the data owner selects a random number. As matrix I a×a The addresses from row K+1 to row a. Matrix I a×a The address of all rows can be represented as Addr = {π} o (w1),π o (w2),...,π o (w K ),γ K+1 ,...,γ a}

[0025] Step 3.6: For each keyword w k ∈W, the data owner performs blind encryption on each row of the matrix as follows: For j∈[K+1,a], the data owner performs blind encryption as follows: The encrypted matrix can be represented as

[0026] Step 4: The data owner divides each file into blocks and generates corresponding authentication tags, stores the data and authentication tag information on the cloud server; and stores the index information on the blockchain;

[0027] Step 4.1: For each file F i (i∈[1,v]), the data owner divides each file into n blocks, denoted as F. i ={m ij} j∈[1,n] .

[0028] Step 4.2: Generate the index table set S i ={θ i,j} j∈[1,n] (i∈[1,v]), where θ i,j =(j,au i,j ), j represents the block index, au i,j This indicates auxiliary information about the file.

[0029] Step 4.3: The data owner utilizes the information... i,j For each file block m i,j (i∈[1,v],j∈[1,n]) Generate authentication tags Let each file F iThe set of authentication tags (i∈[1,v]) is denoted as φ i ={σ ij} j∈[1,n] .

[0030] Step 4.4: The data owner will transfer the information {φ} i ,{m i,j} j∈[1,n]} i∈[1,v] Send to the cloud server. The cloud server verifies the tag set, and the method is...

[0031] If the verification result is valid, the cloud service receives the authentication tag information.

[0032] Step 4.5: The data owner will send the information {FID} i ,S i ,Addr,E I ,Ω i} i∈[1,v] Stored on the blockchain.

[0033] Step 5: The data owner generates a trapdoor based on the keywords to be searched and sends it to a third-party auditor. The data owner then performs integrity checks on files with h different keywords, where the h keywords can be represented as W = {w1, w2, ..., w...}. h The data owner generates an index trapdoor T. w ={(π o (w i ),f l (π o (w i )))} i∈[1,h] And then send the trap to a third-party auditor.

[0034] Step 6: The third-party auditor generates challenge information and sends the challenge information and trapdoor to the cloud server. The third-party auditor generates the specific set of file blocks for the challenge in advance based on the challenge information; the third-party auditor also generates the file information for the data owner to search based on the trapdoor information.

[0035] Step 6.1: After receiving the trapdoor information, the third-party auditor selects a challenge information seed. And the number of file blocks to be challenged, c, the challenge information Chal = (T w Send (c,k1,k2) to the cloud server.

[0036] Step 6.2: The third-party auditor generates challenge information {C=(j,v ij )} j∈[1,c],i∈[1,v], where j represents the index of the block number used for the challenge file, Let set

[0037] v ij Represents a random number.

[0038] Step 6.3: For each blind address information {π} in the trapdoor o (w i ′)} i∈[1,h] A third-party auditor inspected π o (w i Does ') exist? If it does, find the corresponding row vector. Suppose a third-party auditor finds t corresponding row vectors, 1 ≤ t ≤ h, these t row vectors can be represented as

[0039]

[0040] Step 6.4: For 1≤j≤t, the third-party auditor obtains the corresponding plaintext vector. For 1 ≤ j ≤ t, the third-party auditor initializes an empty set.

[0041] Step 6.5: For each i∈[1,v], if The third-party auditor adds the file index value i to the set.

[0042] Step 6.6: For 1≤j≤t, merge the sets of third-party auditors.

[0043] Step 7: The cloud server searches for relevant file information based on the received challenge and trap information and generates supporting documentation, which is then sent to the third-party auditor.

[0044] Step 7.1: The cloud server generates challenge information {C′=(j,v ij )} j∈[1,c],i∈[1,v] , where j represents the index of the block number used for the challenge file, Let set v ij Represents a random number.

[0045] Step 7.2: For each blind address information {π} in the trapdoor o (w i ′)} i∈[1,h] Cloud server checks π o (wi Does ') exist? If it does, find the corresponding row vector.

[0046] Step 7.3: Assume the cloud server finds the corresponding t′ row vectors, 1≤t′≤h, and these t′ row vectors can be represented as...

[0047] Step 7.4: For 1≤j≤t′, the cloud server obtains the corresponding plaintext vector.

[0048] For 1≤j≤t′, the cloud server initializes an empty set.

[0049] Step 7.5: For each i∈[1,v], if The cloud server adds the file index value i to the set.

[0050] Step 7.6: For 1≤j≤t′, merge the cloud server sets.

[0051] Step 7.7: The cloud server, based on set S′ w The information in the set, the challenge set information Q′, and the obtained index set S. w Generate the corresponding proof information Troof={T,μ}, where

[0052] Step 7.8: Randomly select cloud servers Generate R=g r The cloud server blinds μ, through μ′=μ-rh1(T w ,R) method.

[0053] Step 7.9: The cloud service sends the proof information Proof = {T, μ′, R} to the third-party auditor.

[0054] Step 8: The third-party auditor verifies the supporting information based on the received supporting information and the pre-generated index information, and informs the data owner of the verification results;

[0055] Step 8.1: After receiving the proof information, the third-party auditor locates the corresponding file F on the blockchain. i (i∈S w′ Index table S i Find the file block information for the challenge m i,j Corresponding auxiliary information au i,j (i∈S wFind the matching index information Ω for (j∈Q). i ,i∈S w .

[0056] Step 8.2: Based on the label information, the third-party auditor verifies the supporting information. The verification method is as follows: If the validation passes, it means that the documents involved in the keyword set W′ are complete. If the validation fails, it means that the documents involved in the keyword set W′ are incomplete.

[0057] Step 8.3: The third-party auditor informs the data owner of the verification results.

[0058] Beneficial effects:

[0059] Compared with existing technologies, the present invention has the following advantages:

[0060] This invention implements a privacy-preserving method for verifying the integrity of encrypted searchable data. By using multiple keywords for simultaneous searching, it increases the flexibility of data integrity verification for the data owner. Attached Figure Description

[0061] Figure 1 This is a schematic diagram of the system architecture of the present invention;

[0062] Figure 2 This is a comparison chart of index generation costs;

[0063] Figure 3 This is a comparison chart of the generation time of the certification labels;

[0064] Figure 4 This is a graph showing the evaluation of proof generation time and proof verification time. Detailed Implementation

[0065] To better illustrate the purpose and advantages of this invention, the invention will be further described below with reference to the accompanying drawings and examples. It should be noted that the implementation of this invention is not limited to the following embodiments, and any modifications or alterations made to this invention will fall within the scope of protection of this invention.

[0066] Example

[0067] like Figure 1 As shown in the figure, the specific implementation steps of the privacy-preserving encrypted searchable data integrity verification method in this embodiment are as follows:

[0068] Step 1: The data owner extracts the keyword information associated with all files and generates an initial index matrix;

[0069] Step 1.1: Let there be v files initially uploaded and represent them as {F}. i}1≤i≤v The number of keywords associated with all files is K.

[0070] Step 1.2: The set of keywords is represented as W = {w1, w2, ..., w...} K To prevent the number of files and keywords from being leaked to the cloud server, a matrix I with 'a' rows and 'a' columns is initialized. a×a Given a >> v and a >> K, initialize matrix I. a×a All elements are 0. The matrix can be represented as Each row of the matrix Indicates keyword w i The included file information row vector. Row vector v K+1 to v a This is to create obfuscation; the row vector values ​​are the values ​​used when initializing the matrix.

[0071] In this embodiment, let the initial uploaded files be 100 files and denoted as {F}. i} 1≤i≤100 The total number of keywords associated with all files is 10; the set of keywords is represented as W = {w1, w2, ..., w...} 10}={

[0072] Health, Finance, Learning, Travel, Shopping, Social, Interests, Videos, Music, Work} To prevent the number of files and keywords from being leaked to the cloud server, initialize a matrix I with 1000 rows and 1000 columns. 1000×1000 Initialize matrix I 1000×1000 All elements are 0. The matrix can be represented as Each row of the matrix Indicates keyword w i The included file information row vector. Row vector v 11 to v 1000 This is to create obfuscation; the row vector values ​​are 0, the values ​​used when initializing the matrix.

[0073] Step 2: The data owner selects system parameters, including the private and public key information required by the system, as well as other necessary parameter information, and publishes the publicly available information parameters;

[0074] Step 2.1: Select two multiplicative cyclic groups G1 and G2. T Select elements g and u from group G1, and select the bilinear pair e: G1×G1→G T .

[0075] Step 2.2: Select four different hash functions

[0076] Step 2.3: Select a random number As the private key, its corresponding public key is y = g x .

[0077] Step 2.4: Select As a key for pseudo-random hashing, The key is used as the pseudo-random function key. A public-private key pair (pk, sk) is selected for signing the message, and the signature is represented as ssg. sk (·)

[0078] Step 2.5: Select a pseudo-random hash Pseudo-random hash Pseudo-random function Here, key1, key2, and key3 represent the keys.

[0079] Step 2.6: The data owner publishes the system's public parameters.

[0080]

[0081] In the embodiment, two multiplication cyclic groups G1 and G2 are selected. T Select elements g and u from group G1, and select the bilinear pair e: G1×G1→G T Select four different hash functions Select random number As the private key, its corresponding public key is y = g x Select As a key for pseudo-random hashing, The key is used as the pseudo-random function key. A public-private key pair (pk, sk) is selected for signing the message, and the signature is represented as ssg. sk (·); Select a pseudo-random hash Pseudo-random hash Pseudo-random function Where key1, key2, and key3 represent keys; the data owner publishes system parameters.

[0082] Step 3: The data owner generates tags based on the keyword information corresponding to the file, and generates an index matrix based on the keyword information corresponding to the file and encrypts it, generating a blind address for each row of the index matrix;

[0083] Step 3.1: For all keywords w k ∈W, if file F i If i ∈ [1, v] contains the keyword, record the file index i in the index vector. In, that is

[0084] In the embodiment, for all keywords w k For example, if the keyword w1 = health, and file F7, 7 ∈ [1, 100] contains this keyword, then record the file index 7 in the index vector. In, that is

[0085]

[0086] Step 3.2: For all keywords w k ∈W, the data owner initializes the empty set. Record the file index i to

[0087] In the embodiment, for all keywords w k ∈W, the data owner initializes the empty set. Record the file index i to For example, w k = travel,

[0088] Step 3.3: For all files F i , i∈[1,v], the set of keywords extracted by the data owner from the file. in Represents file F i The lth keyword. Let t i Represents file F i The total number of all keywords.

[0089] In the embodiment, for all files F l , i∈[1,100], the set of keywords extracted by the data owner from the file. in Represents file F i The lth keyword. Let i t Represents file F i The total number of all keywords. For example

[0090]

[0091] Step 3.4: For each file F i (i∈[1,v]), the data owner calculates the keyword information tags. The data owner is all files F i (i∈[1,v]) Calculate the index Ω of the match. i =(HF) i·H2(FID i )) -x FID i A unique identifier for a file. The index of all matching files can be represented as...

[0092] In the embodiment, for each file F i (i∈[1,100]), the data owner calculates the keyword information tags. The data owner is all files F i (i∈[1,100]) Calculate the matching index Ω i =(HF) i ·H2(FID i )) -x FID i A unique identifier for a file. The index of all matching files can be represented as Ω = {Ω}. i} i∈[1,100] .

[0093] Step 3.5: For each keyword w k ∈W, the data owner is matrix I a×a Calculate the blind address π o (w k For j∈[K+1,a], the data owner selects a random number. As matrix I a×a The addresses from row K+1 to row a. Matrix I a×a The address of all rows can be represented as Addr = {π} o (w1),π o (w2),...,π o (w K ),γ K+1 ,...,γ a}

[0094] In the embodiment, for each keyword w k ∈W, the data owner is matrix I 1000×1000 Calculate the blind address π o (w k For j∈[11,1000], the data owner selects a random number. As matrix I 1000×1000 Addresses from line 11 to line 1000. Matrix I 1000×1000 The address of all rows can be represented as Addr = {π} o (w1),π o (w2),...,π o (w 10 ),γ 11 ,...,γ1000}

[0095] Step 3.6: For each keyword w k ∈W, the data owner performs blind encryption on each row of the matrix as follows: For h∈[K+1,a], the data owner performs blind encryption as follows: The encrypted matrix can be represented as

[0096]

[0097] In the embodiment, for each keyword w k ∈W, the data owner performs blind encryption on each row of the matrix as follows: For j∈[11,1000], the data owner performs blind encryption as follows: The encrypted matrix can be represented as

[0098]

[0099] Step 4: The data owner divides each file into blocks and generates corresponding authentication tags, stores the data and authentication tag information on the cloud server; and stores the index information on the blockchain;

[0100] Step 4.1: For each file F i (i∈[1,v]), the data owner divides each file into n blocks, denoted as F. i ={m ij} j∈[1,n] .

[0101] In the embodiment, for each file F i (i∈[1,100]), the data owner divides each file into 500 blocks, denoted as F. i ={m ij} i∈[1,100],j∈[1,500] .

[0102] Step 4.2: Generate the index table set S i ={θ i,j} j∈[1,n] (i∈[1,v]), where θ i,j =(j,au i,j ), j represents the block index, au i,j This indicates auxiliary information about the file.

[0103] In the embodiment, an index table set S is generated. i ={θ i,j} j∈[1,500] (i∈[1,100]), where θi,j =(j,au i,j ), j represents the block index, au i,j This indicates auxiliary information about the file.

[0104] Step 4.3: The data owner utilizes the information... i,j For each file block m i,j (i∈[1,v],j∈[1,n]) Generate authentication tags Let each file F i The set of authentication tags (i∈[1,v]) is denoted as φ i ={σ ij} j∈[1,n] .

[0105] In the example, the data owner uses information au i,j For each file block m i,j (i∈[1,100],j∈[1,500]) Generate authentication tags Let each file F i The set of authentication tags (i∈[1,100]) is denoted as φ i ={σ ij} j∈[1,500] .

[0106] Step 4.4: The data owner will transfer the information {φ} i ,{m i,j} j∈[1,n]} i∈[1,v] Send to the cloud server. The cloud server verifies the tag set, and the method is...

[0107] If the verification result is valid, the cloud service receives the authentication tag information.

[0108] In the embodiment, the data owner will send information {φ i ,{m i,j} j∈[1,500]} i∈[1,100] Send to the cloud server. The cloud server verifies the tag set, and the method is... If the verification result is valid, the cloud service receives the authentication tag information.

[0109] Step 4.5: The data owner will send the information {FID} i ,S i ,Addr,E I ,Ω i} i∈[1,v] Stored on the blockchain.

[0110] Step 5: The data owner generates a trapdoor based on the keywords to be searched and sends it to a third-party auditor. The data owner then performs integrity checks on files with h different keywords, where the h keywords can be represented as W = {w1, w2, ..., w...}. h The data owner generates an index trapdoor T. w ={(π o (w i ),f l (π o (w i )))} i∈[1,h] And then send the trap to a third-party auditor.

[0111] In this example, suppose the data owner wants to perform an integrity check on a file with h = 3 different keywords, where h keywords can be represented as W = {learning, video, work}. The data owner generates an index trapdoor T. w ={(π o (w i ),f l (π o (w i )))} i∈[1,3] And then send the trap to a third-party auditor.

[0112] Step 6: The third-party auditor generates challenge information and sends the challenge information and trapdoor to the cloud server. The third-party auditor generates the specific set of file blocks for the challenge in advance based on the challenge information; the third-party auditor also generates the file information for the data owner to search based on the trapdoor information.

[0113] Step 6.1: After receiving the trapdoor information, the third-party auditor selects a challenge information seed. And the number of file blocks to be challenged, c, the challenge information Chal = (T w Send (c,k1,k2) to the cloud server.

[0114] In this embodiment, after receiving the trapdoor information, the third-party auditor selects a challenge information seed. Given the number of file blocks to be challenged, c = 300, the challenge information Chal = (T w Send (c,k1,k2) to the cloud server.

[0115] Step 6.2: The third-party auditor generates challenge information {C=(j,v ij )} j∈[1,c],i∈[1,v] , where j represents the index of the block number used for the challenge file, Let set vij Represents a random number.

[0116] In the embodiment, the third-party auditor generates challenge information {C=(j,v ij )} j∈[1,300],i∈[1,100] , where j represents the index of the block number used for the challenge file, Let set v ij Represents a random number.

[0117] Step 6.3: For each blind address information {π} in the trapdoor o (w i ′)} i∈[1,h] A third-party auditor inspected π o (w i Does ') exist? If it does, find the corresponding row vector. Suppose a third-party auditor finds t corresponding row vectors, 1 ≤ t ≤ h, these t row vectors can be represented as

[0118]

[0119] In the embodiment, for each blind address information {π} in the trapdoor o (w i ′)} i∈[1,h] A third-party auditor inspected π o (w i Does ') exist? If it does, find the corresponding row vector. Suppose a third-party auditor finds t corresponding row vectors, where 1 ≤ t ≤ 3. These t row vectors can be represented as...

[0120]

[0121] Step 6.4: For 1≤j≤t, the third-party auditor obtains the corresponding plaintext vector. For 1 ≤ j ≤ t, the third-party auditor initializes an empty set.

[0122] In this embodiment, for 1≤j≤3, the third-party auditor obtains the corresponding plaintext vector. For 1≤j≤3, the third-party auditor initializes an empty set.

[0123] Step 6.5: For each i∈[1,v], if The third-party auditor adds the file index value i to the set.

[0124] In the embodiment, for each i∈[1,100], if The third-party auditor adds the file index value i to the set.

[0125] Step 6.6: For 1≤j≤t, merge the sets of third-party auditors.

[0126] Step 7: The cloud server searches for relevant file information based on the received challenge and trap information and generates supporting documentation, which is then sent to the third-party auditor.

[0127] Step 7.1: The cloud server generates challenge information {C′=(j,v ij )} j∈[1,c],i∈[1,v] , where j represents the index of the block number used for the challenge file, Let set v ij Represents a random number.

[0128] In the embodiment, the cloud server generates challenge information {C′=(j,v ij )} j∈[1,300],i∈[1,100] , where j represents the index of the block number used for the challenge file, Let set v ij Represents a random number.

[0129] Step 7.2: For each blind address information {π} in the trapdoor o (w i ′)} i∈[1,h] Cloud server checks π o (w i Does ') exist? If it does, find the corresponding row vector.

[0130] Step 7.3: Assume the cloud server finds the corresponding t′ row vectors, 1≤t′≤h, and these t′ row vectors can be represented as...

[0131] In this embodiment, it is assumed that the cloud server finds the corresponding t′ row vectors, 1≤t′≤3, and these t′ row vectors can be represented as follows:

[0132] Step 7.4: For 1≤j≤t′, the cloud server obtains the corresponding plaintext vector.

[0133] For 1≤j≤t′, the cloud server initializes an empty set.

[0134] Step 7.5: For each i∈[1,v], if The cloud server adds the file index value i to the set.

[0135] In the embodiment, for each i∈[1,100], if The cloud server adds the file index value i to the set.

[0136] Step 7.6: For 1≤j≤t′, merge the cloud server sets.

[0137] Step 7.7: The cloud server, based on set S′ w The information in the set, the challenge set information Q′, and the obtained index set S. w Generate the corresponding proof information Proof={T,μ}, where

[0138] Step 7.8: Randomly select cloud servers Generate R=g r The cloud server blinds μ, through μ′=μ-rh1(T w ,R) method.

[0139] Step 7.9: The cloud service sends the proof information Proof = {T, μ′, R} to the third-party auditor.

[0140] Step 8: The third-party auditor verifies the supporting information based on the received supporting information and the pre-generated index information, and informs the data owner of the verification results;

[0141] Step 8.1: After receiving the proof information, the third-party auditor locates the corresponding file F on the blockchain. i (i∈S w′ Index table S i Find the file block information for the challenge m i,j Corresponding auxiliary information au i,j (i∈S w Find the matching index information Ω for (j∈Q). i ,i∈S w .

[0142] Step 8.2: Based on the label information, the third-party auditor verifies the supporting information. The verification method is as follows: If the validation passes, it means that the documents involved in the keyword set W′ are complete. If the validation fails, it means that the documents involved in the keyword set W′ are incomplete.

[0143] Step 8.3: The third-party auditor informs the data owner of the verification results.

[0144] To further demonstrate the superiority of this invention, simulation experiments were conducted to evaluate its computational cost on a Windows 10 operating system equipped with an Intel i7 2.5GHz CPU and 8GB of memory, using the JPBC library. We employed Type-A pairing, with each prime number being 512 bits long and the group order being 160 bits. To test the proposed scheme, it was compared with existing schemes proposed by Liu et al., Miao et al., and Peng et al., evaluating the overhead of indexing labels, authentication labels, proof generation, and verification. As shown in the experimental results, this invention improves efficiency in index generation compared to existing schemes, while the overhead in other aspects remains similar.

[0145] like Figure 2 As shown in the figure, the overhead of generating the index is compared, where the horizontal axis represents the number of files containing the same keyword and the vertical axis represents the time overhead of the index. It can be seen from the figure that the index proposed in this invention can significantly reduce the time overhead; it is not much different from the scheme of Peng et al.

[0146] like Figure 3 As shown in the figure, the authentication tag generation time is compared, where the horizontal axis represents the number of file blocks and the vertical axis represents the authentication tag generation time. It can be seen from the figure that the authentication tag generation time of the present invention is not much different from that of Liu et al., Miao et al., Peng et al.;

[0147] like Figure 4 As shown in the figure, the proof generation time is evaluated, where the horizontal axis represents the number of file blocks challenged and the vertical axis represents the proof verification time. It can be seen from the figure that the proof verification time increases with the increase of the number of file blocks challenged; at the same time, the proof verification time increases with the increase of the number of files containing the same keyword.

[0148] The above detailed description further illustrates the purpose, technical solution, and beneficial effects of the invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for verifying the integrity of privacy-preserving encrypted searchable data, characterized in that: Includes the following steps, Step 1: The data owner extracts the keyword information associated with all files and generates an initial index matrix; Step 2: The data owner selects system parameters, including the private and public key information required by the system, as well as other necessary parameter information, and publishes the publicly available information parameters; Step 3: The data owner generates tags based on the keyword information corresponding to the file, and generates an index matrix based on the keyword information corresponding to the file and encrypts it, generating a blind address for each row of the index matrix; Step 3.1: For all keywords w k ∈W, if file F i If i ∈ [1, v] contains the keyword, record the file index i in the index vector. In, that is Step 3.2: For all keywords w k ∈W, the data owner initializes the empty set. Record the file index i to Step 3.3: For all files F i i∈[1,v], the set of keywords extracted by the data owner from the file. in Represents file F i The first keyword; let t i Represents file F i The total number of all keywords; Step 3.4: For each file F i (i∈[1,v]), the data owner calculates the keyword information tags. The data owner is all files F i (i∈[1, v]) Calculate the index Ω of the match. i =(HF) i ·H2(FID i )) -x FID i A unique identifier for a file; the index of all matching files can be represented as Ω = {Ω} i } i∈[1，v] ; Step 3.5: For each keyword w k ∈W, the data owner is matrix I a×a Calculate the blind address π o (w k For j∈[K+1, a], the data owner selects a random number. As matrix I a×a The addresses from row K+1 to row a; matrix I a×a The address of all rows can be represented as Addr = {π} o (w1), π o (w2), ..., π o (w K ), γ K+1 , ..., γ a }; Step 3.6: For each keyword w k ∈W, the data owner performs blind encryption on each row of the matrix as follows: For j∈[K+1, a], the data owner performs blind encryption as follows: The encrypted matrix can be represented as Step 4: The data owner divides each file into blocks and generates corresponding authentication tags, stores the data and authentication tag information on the cloud server; and stores the index information on the blockchain; Step 4.1: For each file F i (i∈[1,v]), the data owner divides each file into n blocks, denoted as F. i ={m ij } j∈[1，n] ; Step 4.2: Generate the index table set S i ={θ i，j } j∈[1，n] (i∈[1,v]), where θ i，j =(j, au) i，j ), j represents the block index, au i，j Indicates auxiliary information for the file; Step 4.3: The data owner utilizes the information... i，j For each file block m i，j (i∈[1, v], j∈[1, n]) Generate authentication tags Let each file F i The set of authentication tags (i∈[1, v]) is denoted as φ i ={σ ij } j∈[1，n] ; Step 4.4: The data owner will transfer the information {φ} i , {m i，j } j∈[1，n] } i∈[1，v] Send to the cloud server; the cloud server verifies the tag set, via [method / method] If the verification result is valid, the cloud service receives the authentication tag information; Step 4.5: The data owner will send the information {FID} i S i Addr, E I Ω i } i∈[1，v] Stored on the blockchain; Step 5: The data owner generates a trapdoor based on the keywords to be searched and sends it to a third-party auditor. The data owner then performs integrity checks on files with h different keywords, where the h keywords can be represented as W = {w1, w2, ..., w...}. h The data owner generates an index trapdoor T. w ={(π o (w i ), f l (π o (w i )))} i∈[1，h] And send the trap to a third-party auditor; Step 6: The third-party auditor generates challenge information and sends the challenge information and trapdoor to the cloud server. The third-party auditor generates the specific set of file blocks for the challenge in advance based on the challenge information; the third-party auditor also generates the file information for the data owner to search based on the trapdoor information. Step 6.1: After receiving the trapdoor information, the third-party auditor selects a challenge information seed. And the number of file blocks to be challenged, c, the challenge information Chal = (T w (c, k1, k2) are sent to the cloud server; Step 6.2: The third-party auditor generates challenge information {C = (j, v ij )} j∈[1，c]，i∈[1，v] , where j represents the index of the block number used for the challenge file, Let set v ij Represents a random number. i∈[1, v], j∈Q; Step 6.3: For each blind address information {π} in the trapdoor o (w i ′)} i∈[1，h] A third-party auditor inspected π o (w i Does ') exist? If it does, find the corresponding row vector. Suppose a third-party auditor finds t corresponding row vectors, 1 ≤ t ≤ h, these t row vectors can be represented as Step 6.4: For 1≤j≤t, the third-party auditor obtains the corresponding plaintext vector. For 1 ≤ j ≤ t, the third-party auditor initializes an empty set. Step 6.5: For each i∈[1, v], if The third-party auditor adds the file index value i to the set. Step 6.6: For 1≤j≤t, merge the sets of third-party auditors. Step 7: The cloud server searches for relevant file information based on the received challenge and trap information and generates supporting documentation, which is then sent to the third-party auditor. Step 7.1: The cloud server generates challenge information {C′=(j, v ij )} j∈[1，c]，i∈[1，v] , where j represents the index of the block number used for the challenge file, Let set v ij Represents a random number. i∈[1,v],j∈Q′; Step 7.2: For each blind address information {π} in the trapdoor o (w i ′)} i∈[1，h] Cloud server checks π o (w′ i Does it exist? If it does, find the corresponding row vector. Step 7.3: Assume the cloud server finds the corresponding t′ row vectors, 1≤t′≤h, and these t′ row vectors can be represented as... Step 7.4: For 1≤j≤t′, the cloud server obtains the corresponding plaintext vector. For 1≤j≤t′, the cloud server initializes an empty set. Step 7.5: For each i∈[1, v], if The cloud server adds the file index value i to the set. Step 7.6: For 1≤j≤t′, merge the cloud server sets. Step 7.7: The cloud server, based on set S′ w The information in the set, the challenge set information Q, and the obtained index set S. w Generate the corresponding proof information Proof = {T, μ}, where Step 7.8: Randomly select cloud servers Generate R=g r The cloud server blinds μ, through μ′=μ-rh1(T w ,R) method; Step 7.9: The cloud service sends the proof information Proof = {T, μ′, R} to the third-party auditor; Step 8: The third-party auditor verifies the supporting information based on the received supporting information and the pre-generated index information, and informs the data owner of the verification results; Step 8.1: After receiving the proof information, the third-party auditor locates the corresponding file F on the blockchain. i (i∈S w′ Index table S i Find the file block information for the challenge m i，j Corresponding auxiliary information au i，j (i∈S w Find the matching index information Ω (j∈Q). i , i∈S w ; Step 8.2: Based on the label information, the third-party auditor verifies the supporting information. The verification method is as follows: If the verification passes, it means that the files involved in the keyword set W′ are complete; if the verification fails, it means that the files involved in the keyword set W′ are incomplete. Step 8.3: The third-party auditor informs the data owner of the verification results.

2. The privacy-preserving encrypted searchable data integrity verification method as described in claim 1, characterized in that: Step 1 is implemented as follows: Step 1.1: Let there be v files initially uploaded and represent them as {F}. i } 1≤i≤v The number of keywords associated with all files is K; Step 1.2: The set of keywords is represented as W = {w1, w2, ..., w...} K To prevent the number of files and keywords from being leaked to the cloud server, a matrix I with 'a' rows and 'a' columns is initialized. a×a Given a >> v and a >> K, initialize matrix I. a×a All elements are 0; the matrix can be represented as Each row of the matrix Indicates keyword w i Includes file information row vectors; row vector v K+1 to v a This is to create obfuscation; the row vector values ​​are the values ​​used when initializing the matrix.

3. The privacy-preserving encrypted searchable data integrity verification method as described in claim 1, characterized in that: Step 2 is implemented as follows: Step 2.1: Select two multiplicative cyclic groups G1 and G2. T Select elements g and u from group G1, and select the bilinear pair e: G1×G1→G T ; Step 2.2: Select four different hash functions H1~H3: {0, 1} * →G1, Step 2.3: Select a random number As the private key, its corresponding public key is y = g x ; Step 2.4: Select As a key for pseudo-random hashing, The key for the pseudo-random function is selected; a public-private key pair (pk, sk) is chosen for signing the message, and the signature is represented as ssg. sk (·); Step 2.5: Select a pseudo-random hash Pseudo-random hash Pseudo-random function Where key1, key2, and key3 represent keys; Step 2.6: The data owner publishes the system's public parameters.

Images