Dynamic searchable encryption method and system

Abstract

The invention discloses a dynamic searchable encryption method and system, and the method comprises the steps: setting security parameters, generating a secret key, selecting primitives, and initializing data structures on a client and a server; the client constructs an encryption index according to the update type and the update entry, and submits the encryption index to the server as an update request; based on the update request, the client performs a first round of communication with the server, and retrieves a record identifier required to be recorded from the server; and the client performs a second round of communication with the server, and obtains the record plaintext according to the record identifier. According to the method, the privacy of the target keyword can be protected, meanwhile, the high efficiency and safety of the query process are ensured, and the method is suitable for safe query and dynamic update scenes of large-scale encrypted data.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a dynamic searchable encryption method and system. Background Art

[0002] With the popularity of electric vehicles (EVs) and the development of smart grid technology, more and more EVs are interacting with the grid. This vehicle-to-grid (V2G) interaction model can not only improve the stability of the grid, but also bring additional benefits to EV owners. However, in the process of vehicle-to-grid interaction, a large amount of sensitive data is transmitted, including vehicle location information, battery status, charging history, etc. If this data is transmitted directly without encryption, it may face the risk of leakage, that is, attackers may obtain users' privacy information by intercepting and analyzing this data, and even affect the operation of the grid.

[0003] In a V2G environment, electric vehicle owners may need to share data with grid operators and other users to achieve optimized scheduling and power trading. To protect data privacy, this sensitive data must be encrypted. However, a major challenge in encrypting data is how to achieve efficient keyword search while ensuring data privacy. This is particularly important for real-time monitoring and management of the status of the power grid and electric vehicles. Dynamic Searchable Symmetric Encryption (DSSE) is a technology widely used in V2G environments to perform secure keyword searches on constantly changing ciphertexts. In DSSE applications, all data related to the interaction between electric vehicles and the grid is encrypted and stored in the cloud, helping to maintain the confidentiality of the data. DSSE allows electric vehicles and grid operators to send update queries to the cloud server to add or delete ciphertexts and delegate keyword search queries while maintaining the confidentiality of keywords. Many studies and practices have demonstrated the effectiveness of DSSE in various application scenarios.

[0004] In recent years, researchers have focused on developing DSSEs with strong security to minimize information leakage. To address these issues, researchers defined forward security and backward security. Forward security ensures that any new update query does not leak keyword information from earlier queries, while backward security ensures that attackers cannot learn too much information from update queries between any two adjacent search queries. Researchers further divide backward security into three types (Type-I, Type-II, and Type-III) to limit the extent of information leakage.

[0005] To further limit privacy leakage, the researchers proposed Type-I-backward security, which is the strongest known one. In short, Type-I-backward security requires that the information leakage caused by a search query includes which files match the query and when the relevant update query was issued. It should be noted that in Type-I-backward security, the attacker cannot distinguish between add and delete queries.

[0006] Therefore, how to achieve efficient data retrieval and ensure the security and privacy protection of the retrieval process while protecting the data security of the interaction between electric vehicles and the power grid has become an urgent problem to be solved. To this end, a highly secure and efficient searchable encryption scheme is needed. Summary of the invention

[0007] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0008] In view of the above existing problems, the present invention is proposed.

[0009] Therefore, the present invention provides a dynamic searchable encryption method and system to solve the problem of malicious clients replaying unreasonable requests and causing server overload.

[0010] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0011] In a first aspect, the present invention provides a dynamic searchable encryption method, comprising:

[0012] Set security parameters, key generation and selection primitives, and initialize data structures on the client and server;

[0013] The client constructs an encrypted index based on the update type and update items, and submits the encrypted index to the server as an update request;

[0014] Based on the update request, the client conducts the first round of communication with the server to retrieve the record identifier of the required record from the server;

[0015] The client and the server perform a second round of communication and obtain the record plaintext based on the record identifier.

[0016] As a preferred solution of the dynamic searchable encryption method described in the present invention, wherein:

[0017] The key generation includes initializing a pair of homomorphic encryption keys and initializing a random secret key K Σ ;

[0018] The pair of homomorphic encryption keys includes a private key sk and a public key pk;

[0019] The selection primitive includes generating a pseudo-random function P and generating two sets of independent hash functions H 1 and H 2 ;

[0020] Initializing the data structures on the client and server includes initializing three empty mappings S on the client and server respectively. C ,S S and EDB, which are used to store client and server status information, as well as encryption indexes, respectively;

[0021] Initializing the data structures on the client and server also includes using a homomorphic encryption algorithm to generate an encrypted bitmap index V 0 .

[0022] As a preferred solution of the dynamic searchable encryption method described in the present invention, wherein:

[0023] The client constructs an encrypted index according to the update type and the update item, and submits the encrypted index to the server as an update request, including the following steps:

[0024] The client uses the preset key derivation function to calculate the secret key K corresponding to the keyword w w ;

[0025] The client retrieves the current state S of keyword w c [w];

[0026] If the current state of keyword w is empty, initialize the state;

[0027] The client chooses a new random value R c+1 ;

[0028] The client uses the hash function H 1 Calculate the index I←H 1 (K w ,R c+1 ), and use the hash function H 2 And XOR operation to calculate the ciphertext C←H 2 (K w ,R c+1 )⊕R c ;

[0029] Based on the input operation type op and record set F, the client calculates the dual bitmap index;

[0030] The client uses homomorphic encryption technology to encrypt the double bitmap index and generate an encrypted vector Va ←B, Enc(sk,bs a ,n) and V b ←B, Enc(sk,bs b ,n);

[0031] The client sends the encrypted index, ciphertext, and encryption vector to the server;

[0032] The client updates the local state of keyword w.

[0033] As a preferred solution of the dynamic searchable encryption method described in the present invention, wherein:

[0034] The client performs a first round of communication with the server to retrieve the record identifier of the required record from the server, including the following steps:

[0035] The client calculates the keyword key;

[0036] The client generates a keyword search trap and submits it to the server;

[0037] After receiving the search trapdoor, the server calculates the index entry value according to the trapdoor and calculates the dual-bitmap index of the keyword through the homomorphic ciphertext.

[0038] As a preferred solution of the dynamic searchable encryption method described in the present invention, wherein:

[0039] The client generates a keyword search trap and submits it to the server, including the following steps:

[0040] Calculate the secret key K for keyword w w ;

[0041] Retrieve the client status S for keyword w c [w];

[0042] If the client status is empty, it returns an empty value;

[0043] Otherwise, a search trap is generated (K w ,R c ,c 0 ,c),Update the client status;

[0044] Send the search trapdoor to the server;

[0045] After receiving the search trap, the server calculates the index entry value according to the trap, including the following steps:

[0046] Check the server status S of keyword w S [K w ];

[0047] Initialize an empty map E;

[0048] Traverse from c to c 0 All indices of , calculate the index I←H 1 (K w ,R i ), retrieve and store the corresponding ciphertext (C, (V a ,V b ))←EDB[I] and double bitmap index E[ic 0 ]←(V a ,V b );

[0049] Remove removes the retrieved ciphertext and updates the server status.

[0050] As a preferred solution of the dynamic searchable encryption method described in the present invention, wherein:

[0051] After receiving the search trapdoor, the server calculates the index entry value according to the trapdoor, and also includes the server calculating the aggregation result of the dual-bitmap index according to the Boolean circuit.

[0052] As a preferred solution of the dynamic searchable encryption method described in the present invention, wherein:

[0053] The client performs a second round of communication with the server to obtain the record plaintext according to the record identifier, including the following steps:

[0054] The client uses the homomorphic decryption algorithm to decrypt the encrypted search results, obtain the dual-bitmap index, and parse the dual-bitmap index;

[0055] The client obtains the record identifier set F and sends F to the server. The server returns the ciphertext record based on the identifier set, and the client decrypts it to obtain the plaintext record.

[0056] In a second aspect, the present invention provides a dynamic searchable encryption system, comprising:

[0057] System initialization module, used to set security parameters, key generation and selection primitives, and initialize data structures on the client and server;

[0058] An update request construction module, used by the client to construct an encrypted index according to the update type and update items, and submit the encrypted index to the server as an update request;

[0059] A record identifier acquisition module, used for, based on an update request, the client and the server perform a first round of communication to retrieve the record identifier of the required record from the server;

[0060] The record content acquisition module is used for the client to perform a second round of communication with the server and obtain the record plain text according to the record identifier.

[0061] In a third aspect, the present invention provides a computing device, comprising:

[0062] Memory, used to store programs;

[0063] A processor is used to execute the computer executable instructions, which, when executed by the processor, implement the steps of the dynamic searchable encryption method.

[0064] In a fourth aspect, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, the steps of implementing the dynamic searchable encryption method are implemented.

[0065] Beneficial effects of the present invention: The present invention mainly utilizes the dual-bitmap index and the ciphertext calculation provided by the homomorphic encryption TFHE algorithm to save the update history of the keyword. The server calculates the dual-bitmap index of the current keyword through the counter in the trapdoor and the server-side status information, with the help of homomorphic ciphertext operation, and iterates the latest identifier set while protecting the privacy of the keyword. It performs well in terms of privacy protection and efficiency, and can protect the privacy of the keyword queried by the Client and the privacy of the recorded content returned by the Server. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0067] Figure 1 A basic flow chart of a dynamic searchable encryption method provided by one embodiment of the present invention;

[0068] Figure 2 A system architecture diagram of a dynamic searchable encryption method provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0070] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0071] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0072] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0073] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0074] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0075] Example 1

[0076] Reference Figure 1-2 Table 1 is an embodiment of the present invention, which provides a dynamic searchable encryption method, including:

[0077] In the embodiment of the present application, the client sends an update request to the server to add or delete a record, which the server can handle well; the client sends a query request to the server, which can protect the privacy of the client's request keyword. Figure 2As shown, it includes three main processes: system initialization, sending update request, and query initiation;

[0078] S1: Set security parameters, key generation and selection primitives, and initialize data structures on the client and server;

[0079] In the embodiment of the present application, security parameters, keys, and primitives (pseudo-random functions, hash functions) are determined, and three empty mappings and encrypted dual bitmaps are initialized on the client and server;

[0080] In the embodiment of the present application, in order to ensure the confidentiality of the record and the privacy of the keyword, determining the security parameters, keys and primitives includes first selecting two secure and independent hash functions H by inputting the security parameter λ and the maximum number of files n. 1 and H 2 , in the form of {0,1} λ ×{0,1} λ →{0,1} λ . Choose a secure pseudo-random function P: {0,1} λ ×W→{0,1} λ , where W represents the keyword space. Generate a pair of homomorphic encryption keys (sk, pk)←T.KeyGen(λ). Select a random master key K Σ ←{0,1} λ .

[0081] In the embodiment of the present application, initializing the data structure on the client and the server also includes generating an encrypted bitmap index V 0 .

[0082] In the embodiment of the present application, in order to protect the privacy of the keyword, the client Client uses a homomorphic encryption algorithm to encrypt 0 n To obtain the encrypted dual bitmap index, use the key sk, the initial sequence bs, and the sequence length n as the input of the encryption function B.Enc of the TFHE homomorphic encryption algorithm to generate an encrypted bitmap index V 0 ←B.Enc(sk,bs,n), the specific steps are as follows:

[0083] (1) Accepts a homomorphic encryption key sk and a bitmap index bs of size n as input;

[0084] (2) Initialize an empty vector V of size n 0 ;

[0085] (3) For i from 1 to n, calculate V[i]←T.Enc(sk,bs[i]);

[0086] (4) Return vector V;

[0087] In the embodiment of the present application, in order to ensure the privacy of keywords and the robustness of update requests, the server Server and the client Client store auxiliary information respectively. First, three empty mappings S are initialized. C ,S S and EDB, where S C and S S Used to store the status information of the client and server. 0 ,S S ,EDB) is stored in the server and (K Σ ,sk,S C ) are stored privately on the client.

[0088] In the present application example, S C and S S Used to store the status information of the client and server. 0 ,S S ,EDB) is stored in the server and (K Σ ,sk,S C ) are stored privately on the client.

[0089] S2: The client constructs an encrypted index based on the update type and update items, and submits the encrypted index to the server as an update request;

[0090] In the embodiment of the present application, in order to add or delete records containing the same keyword w, the client constructs an encrypted index using the master key, the homomorphic encryption key and the keyword, the record identifier set, and the keyword status information, and submits the encrypted index to the server;

[0091] In an embodiment of the present application, during the update operation, the client converts the selected update type (addition or deletion) and update entry (w, F) into a dual bitmap index, and includes the following steps:

[0092] (1) Calculate the secret key K of keyword w w ;

[0093] (2) Client status S for searching keyword w c [w];

[0094] (3) If the client state is empty, initialize the state;

[0095] (4) Select a random value R c+1 ;

[0096] (5) Calculate the index I←H 1 (K w ,R c+1 ) and the ciphertext C←H 2(K w ,R c+1 )⊕R c ;

[0097] (6) Calculate the dual bitmap index (bs) based on the input operation type (op) and record set (F) a ,bs b );

[0098] (7) Use homomorphic encryption to encrypt the double bitmap index and generate the encrypted vector V a ←B, Enc(sk,bs a ,n) and V b ←B, Enc(sk,bs b ,n);

[0099] (8) The ciphertext (I, C, (V a ,V b ))Send to the server;

[0100] (9) Update client status S C [w]←(c 0 ,c+1,R c+1 );

[0101] In the embodiment of the present application, the client first calculates the keyword w key K w ←P(K Σ ,w); retrieve the client status about keyword w (c 0 ,c,R c )←S C [w]; if S C [w]=NULL, then set c 0 ←0,c←-1, and select a random value R c ←{0,1} λ ; Choose a random value R c+1 ←{0,1} λ ; Calculate I←H 1 (K w ,R c+1 ) and C←H 2 (K w ,R c+1 )⊕R c ;

[0102] In the embodiment of the present application, a dual bitmap (bs) is set according to the input operation op and the file set F. a ,bs b ), specifically comprising the following steps:

[0103] (1) Initialize a bitmap index bs of size n for keyword w a and bsb , bs a The i-th bit is set to 1 to indicate that f in the file set i Contains the keyword w, and the operation op is "add", bs b The i-th is set to 1, otherwise it is 0;

[0104] (2) to (bs a ,bs b ) to encrypt and calculate V a ←B.Enc(sk,bs a ,n) and V b ←B.Enc(sk,bs b ,n);

[0105] In the embodiment of the present application, in order to construct a specific encrypted index, the client sends the encrypted index (I, C, (V a ,V b )) to the server, where the index entry is I and the index value is (C, (V a ,V a )); The client updates the status information S C [w]←(c 0 ,c+1,R c+1 ), the server will receive the ciphertext (I,C,(V a ,V b )) is stored in EDB[I].

[0106] In the embodiment of the present application, after receiving the updated ciphertext, the server stores the ciphertext information in EDB. This step constructs an encrypted index about the keyword w, namely EDB[I]←(C,(V a ,V b )).

[0107] S3: Based on the update request, the client conducts the first round of communication with the server and retrieves the record identifier of the required record from the server;

[0108] In the embodiment of the present application, in order to query all records containing the keyword w, the client performs two rounds of communication with the server. The purpose of the first round of communication is to retrieve the record identifier of the required record from the server. The client first calculates the keyword key and constructs a search trapdoor according to the state information. The server uses the trapdoor to calculate the index entry value and calculates the dual-bitmap index of the keyword through the homomorphic ciphertext.

[0109] In an embodiment of the present application, during a search operation, the client generates a keyword search trap and submits it to the server, including the following steps:

[0110] (1) Calculate the secret key K of keyword w w ;

[0111] (2) Client status S for searching keyword w c [w];

[0112] (3) If the client status is empty, return an empty value;

[0113] (4) Otherwise, a search trap is generated (K w ,R c ,c 0 ,c),Update the client status;

[0114] (5) Send the search trap to the server.

[0115] In the embodiment of the present application, the client calculates the secret key K of the keyword w w ←P(K Σ ,w); retrieve the client status about keyword w (c 0 ,c,R c )←S C [w]; if S C [w]=NULL, then return null value; send search trap (K w ,R c ,c 0 ,c) to the server; update the client status S C [w]←(c+1,c,R c ).

[0116] In the embodiment of the present application, after receiving the search trap, the server performs the following steps according to the trap calculation correlation:

[0117] (1) Check the server status S of keyword w S [K w ];

[0118] (2) Initialize an empty mapping E;

[0119] (3) Traverse from c to c 0 All indices of , calculate the index I←H 1 (K w ,R i ), retrieve and store the corresponding ciphertext (C, (V a ,V b ))←EDB[I] and double bitmap index E[ic 0 ]←(V a ,V b );

[0120] (4) Remove the corresponding ciphertext and update the server status.

[0121] In the embodiment of the present application, the server reads the status information. If S S [K w ]=NULL, then set V w ←V 0 ; Otherwise, set V w ←S S [K w ]; Initialize an empty map E and traverse the contents of the map from c to c 0 Do the following:

[0122] (1) Extract token information and calculate the target index entry I←H 1 (K w ,R i );

[0123] (2) Obtain the target ciphertext (C, (V) through EDB mapping a ,V b ))←EDB[I], the ciphertext provides the latest keyword status information and counter information;

[0124] (3) Since several update operations may be performed before the query request is initiated, the server needs to obtain all updated status information of keyword w, so the server retrieves the encrypted double bitmap E[ic 0 ]←(V a ,V b ) is stored in E;

[0125] (4) In order to reduce the storage overhead caused by the encrypted index stored on the server, the ciphertext EDB[I] needs to be removed;

[0126] (5) The server needs to extract the random number R generated by the last update operation to extract the last update status information i-1 , set R i-1 ←C⊕H 2 (K w ,R i ).

[0127] In the embodiment of the present application, the server then performs a second loop, which is to superimpose all updated status information to obtain the latest status information, including counters, encrypted dual-bitmap indexes, and 0 Traverse to c, including the following operations:

[0128] (1) Read the encrypted double bitmap (V a ,V b )←E[ic 0 ];

[0129] (2) Calculate V w←B.Eval(pk,(V a ,V b ),V w ,n);

[0130] In the embodiment of the present application, for the homomorphic ciphertext operation B.Eval(pk,(V a ,V b ),V w ,n), its purpose is to calculate the existence of the current record based on the operation history stored in the last double-bitmap index. The ciphertext calculation results of B.Eval can refer to Table 1. The specific steps of the ciphertext operation are:

[0131] (1) Using TFHE key pk, dual bitmap index ciphertext (V a ,V b ) and the ciphertext V of the bitmap index c As input, where V a ,V b and V c are all binary sequences of length n;

[0132] (2) Initialize an empty temporary vector V of size n t , this vector is used for the first query of keyword w, V t As the last status information of "non-existent";

[0133] (3) Use V t Calculate the new encrypted dual-bitmap index, which requires the use of TFHE homomorphic ciphertext operations, V t The calculation of each bit of is completed by the T.Eval method, including: for i from 1 to n, calculate V t [i]←T.Eval(NOT,pk,V a [i]); calculate V c [i]←T.Eval(AND,pk,V t [i],V c [i]); calculate V t [i]←T.Eval(AND,pk,V a [i],V b [i]); calculate V c [i]←T.Eval(XOR,pk,V c [i],V t [i]), and finally return the vector V c ;

[0134] (4) Update server status S S [K w ]←V w; This mapping can be used to extract the latest status information of keyword w. At this time, the bit 1 in the vector represents that the record still contains the keyword, and then the server will V w Sent to the client.

[0135] In the embodiment of the present application, the server calculates the aggregation result of the dual bitmap index according to the Boolean circuit to ensure robustness. The specific steps are:

[0136] In an embodiment of the present application, a dual-bitmap index is used to represent files, and a special Boolean circuit is constructed to ensure that the aggregated dual-bitmap index can maintain the correctness of the search, even if the client's update query is unreasonable. The dual-bitmap index consists of two bitmap indexes. The first bitmap index represents the file, and the second bitmap index represents the operation of the file. When adding a file, the corresponding bits in the first and second bitmap indexes will be set to "1". When deleting a file, the corresponding bits in the first and second bitmap indexes will be set to "1" and "0", respectively. In order to update (add or delete) an entry, the generated ciphertext contains a dual-bitmap index. Let bs c Indicates the bitmap index contained in the final aggregate ciphertext (bs c The initial values ​​of are all zero), and (bs a , bs b ) represents the index of the double bitmap contained in the found matching ciphertext. The essence of aggregating the matching ciphertexts and the final aggregated ciphertext is to calculate the Boolean circuit for each bit:

[0137] bs c [i]←(bs a [i]∧bs c [i])⊕(bs a [i]∧bs b [i])

[0138] Where bs[i] represents the i-th bit in the bitmap index bs, bs c The truth table is shown in Table 1.

[0139] Table 1 Truth table of robustness calculation

[0140]

[0141] S4: The client and the server perform a second round of communication and obtain the record plaintext based on the record identifier.

[0142] In an embodiment of the present application, the purpose of the second round of communication is to retrieve the encrypted record content through the record identifier. The client decrypts and parses the double-bitmap index to obtain the record identifier, and the server returns the encrypted records corresponding to these record identifiers to the client.

[0143] In the embodiment of the present application, the client runs bsw ←B.Dec(sk,V w ,n) Decrypt the received V w ;B.Dec(sk,V w ,n) are as follows:

[0144] (1) Using the homomorphic encryption key sk and a vector V of size n c As input, where V c Each element of is a TFHE ciphertext;

[0145] (2) Initialize an empty bitmap index bs of size n;

[0146] (3) For i from 1 to n, calculate bs[i]←T.Dec(sk,V c [i]);

[0147] (4) Return the bitmap index bs, and the client will w Resolved to record identifier F;

[0148] In the embodiment of the present application, after receiving the encrypted search results, the client parses the content and obtains the correct record identifier, and then sends the record identifier to the server, and the server returns the correct encrypted record. Specifically, the following steps need to be performed:

[0149] (1) The client uses a homomorphic decryption algorithm to decrypt the encrypted search results, obtains a dual-bitmap index, and then parses the dual-bitmap index;

[0150] (2) The client obtains the record identifier set F and then sends F to the server. The server returns the ciphertext record based on the identifier set, and the client decrypts it to obtain the plaintext record.

[0151] In an embodiment of the present application, for a set of records that need to be uploaded, a dual-bitmap index of each keyword in each record is calculated; based on the dual-bitmap index, an encrypted dual-bitmap index is calculated using a homomorphic encryption algorithm; the client uses a master key to construct keyword status information; the client uses a homomorphic encryption algorithm to construct an encrypted index, and then stores the encrypted record and the encrypted index to the server; the client calculates the key, reads the keyword status information to construct a request trap; the server reads the keyword status information and uses homomorphic ciphertext operations to calculate a new encrypted dual-bitmap index; finally, the client decrypts and parses the relevant information to obtain the required encrypted record identifier in order to obtain the encrypted record from the server.

[0152] This embodiment also provides a dynamic searchable encryption system, including:

[0153] System initialization module, used to set security parameters, key generation and selection primitives, and initialize data structures on the client and server;

[0154] An update request construction module, used by the client to construct an encrypted index according to the update type and update items, and submit the encrypted index to the server as an update request;

[0155] A record identifier acquisition module, used for, based on an update request, the client and the server perform a first round of communication to retrieve the record identifier of the required record from the server;

[0156] The record content acquisition module is used for the client to perform a second round of communication with the server and obtain the record plain text according to the record identifier.

[0157] Furthermore, it also includes:

[0158] Memory, used to store programs;

[0159] A processor is used to load the program to execute the dynamic searchable encryption method.

[0160] This embodiment also provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the dynamic searchable encryption method.

[0161] The storage medium proposed in this embodiment and the dynamic searchable encryption method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0162] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (RandomAccess Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0163] Example 2

[0164] This is an embodiment of the present invention, which provides a dynamic searchable encryption system, including a system initialization module, an update request construction module, a record identifier acquisition module and a record content acquisition module;

[0165] In the embodiment of the present application, the system initialization module includes setting security parameters, key generation and selection primitives, and initializing data structures on the client and server;

[0166] In an embodiment of the present application, key generation includes initializing a pair of homomorphic encryption keys and initializing a random secret key; a pair of homomorphic encryption keys includes a private key and a public key;

[0167] In an embodiment of the present application, selecting a primitive includes generating a pseudo-random function and generating two sets of independent hash functions;

[0168] In the embodiment of the present application, initializing the data structures on the client and the server includes initializing three empty mappings on the client and the server, respectively, for storing the status information of the client and the server, and the encryption index;

[0169] In an embodiment of the present application, initializing the data structures on the client and the server also includes generating an encrypted bitmap index.

[0170] In the embodiment of the present application, the update request construction module includes the client constructing an encrypted index according to the update type and the update item, and submitting the encrypted index to the server as an update request;

[0171] In an embodiment of the present application, the client constructs an encrypted index according to the update type and update entry, and submits the encrypted index to the server as an update request, including calculating the secret key of the keyword w, retrieving the client state of the keyword w, initializing the state if the client state is empty, selecting a random value, calculating the index and ciphertext, calculating the dual-bitmap index according to the input operation type and record set, encrypting the dual-bitmap index using homomorphic encryption, generating an encryption vector, sending the ciphertext to the server and updating the client state.

[0172] In the embodiment of the present application, the record identifier acquisition module includes, based on the update request, the client and the server perform a first round of communication to retrieve the record identifier of the required record from the server;

[0173] In the embodiment of the present application, in order to query all records containing the keyword w, the client performs two rounds of communication with the server.

[0174] In the embodiment of the present application, the first round of communication includes the client first calculating the keyword key, constructing a search trapdoor according to the state information, the server using the trapdoor to calculate the index entry value, and calculating the dual bitmap index of the keyword through the homomorphic ciphertext;

[0175] It should be noted that the purpose of the first round of communication is to retrieve the record identifier of the required record from the server.

[0176] In the embodiment of the present application, the record content acquisition module includes a second round of communication between the client and the server to obtain the record plaintext according to the record identifier.

[0177] In an embodiment of the present application, the second round of communication includes the client sending the record identifier obtained by parsing to the server, the server searching for the encrypted record based on the mapping from the identifier to the encrypted record, sending the encrypted record set to the client, and the client decrypting the record plaintext.

[0178] It should be noted that the purpose of the second round of communication is to retrieve the encrypted record content through the record identifier.

[0179] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A dynamic searchable encryption method, characterized in that: include: Set security parameters, key generation and selection primitives, and initialize data structures on the client and server; The client constructs an encrypted index based on the update type and update items, and submits the encrypted index to the server as an update request; Based on the update request, the client conducts the first round of communication with the server to retrieve the record identifier of the required record from the server; The client and the server perform a second round of communication and obtain the record plaintext based on the record identifier.

2. The dynamic searchable encryption method according to claim 1, characterized in that: The key generation includes initializing a pair of homomorphic encryption keys and initializing a random secret key K Σ ; The pair of homomorphic encryption keys includes a private key sk and a public key pk; The selection primitive includes generating a pseudo-random function P and generating two sets of independent hash functions H1 and H2; Initializing the data structures on the client and server includes initializing three empty mappings S on the client and server respectively. C ,S S and EDB, which are used to store client and server status information, as well as encryption indexes, respectively; Initializing the data structures on the client and server also includes generating an encrypted bitmap index V0 using a homomorphic encryption algorithm.

3. The dynamic searchable encryption method according to claim 1 or 2, characterized in that: The client constructs an encrypted index according to the update type and the update item, and submits the encrypted index to the server as an update request, including the following steps: The client uses the preset key derivation function to calculate the secret key K corresponding to the keyword w w ; The client retrieves the current state S of keyword w c [w]; If the current state of keyword w is empty, initialize the state; The client chooses a new random value R c+1 ; The client uses the hash function H1 to calculate the index I←H1(K w ,R c+1 ), and use the hash function H2 and XOR operation to calculate the ciphertext C←H2(K w ,R c+1 )⊕R c ; Based on the input operation type op and record set F, the client calculates the dual bitmap index; The client uses homomorphic encryption technology to encrypt the double bitmap index and generate an encrypted vector V a ←B, Enc(sk,bs a ,n) and V b ←B, Enc(sk,bs b ,n); The client sends the encrypted index, ciphertext, and encryption vector to the server; The client updates the local state of keyword w.

4. The dynamic searchable encryption method according to claim 3, characterized in that: The client performs a first round of communication with the server to retrieve the record identifier of the required record from the server, including the following steps: The client calculates the keyword key; The client generates a keyword search trap and submits it to the server; After receiving the search trapdoor, the server calculates the index entry value according to the trapdoor and calculates the dual-bitmap index of the keyword through the homomorphic ciphertext.

5. The dynamic searchable encryption method according to claim 4, characterized in that: The client generates a keyword search trap and submits it to the server, including the following steps: Calculate the secret key K for keyword w w ; Retrieve the client status S for keyword w c [w]; If the client status is empty, it returns an empty value; Otherwise, a search trap is generated (K w ,R c ,c0,c), update the client status; Send the search trapdoor to the server; After receiving the search trap, the server calculates the index entry value according to the trap, including the following steps: Check the server status S of keyword w S [K w ]; Initialize an empty map E; Traverse all indexes from c to c0 and calculate the index I←H1(K w ,R i ), retrieve and store the corresponding ciphertext (C, (V a ,V b ))←EDB[I] and dual bitmap index E[i-c0]←(V a ,V b ); Remove removes the retrieved ciphertext and updates the server status.

6. The dynamic searchable encryption method according to claim 5, characterized in that: After receiving the search trapdoor, the server calculates the index entry value according to the trapdoor, and also includes the server calculating the aggregation result of the dual-bitmap index according to the Boolean circuit.

7. The dynamic searchable encryption method according to claim 6, characterized in that: The client performs a second round of communication with the server to obtain the record plaintext according to the record identifier, including the following steps: The client uses the homomorphic decryption algorithm to decrypt the encrypted search results, obtain the dual-bitmap index, and parse the dual-bitmap index; The client obtains the record identifier set F and sends F to the server. The server returns the ciphertext record based on the identifier set, and the client decrypts it to obtain the plaintext record.

8. A system based on the dynamic searchable encryption method according to claim 1, characterized in that: System initialization module, used to set security parameters, key generation and selection primitives, and initialize data structures on the client and server; An update request construction module, used by the client to construct an encrypted index according to the update type and update items, and submit the encrypted index to the server as an update request; A record identifier acquisition module, used for, based on an update request, the client and the server perform a first round of communication to retrieve the record identifier of the required record from the server; The record content acquisition module is used for the client to perform a second round of communication with the server and obtain the record plain text according to the record identifier.

9. A computing device, characterized in that include: Memory, used to store programs; A processor, configured to load the program to execute the steps of the dynamic searchable encryption method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the steps of the dynamic searchable encryption method according to any one of claims 1 to 7 are implemented.

Images