Efficient secret state retrieval method and system based on government affair data platform

Abstract

The invention discloses an efficient secret state retrieval method and system based on a government affair data platform, and the method comprises the following steps: S1, encrypting obtained sensitive data, and obtaining ciphertext data; s2, encrypting keywords in the sensitive data and generating an encrypted inverted index table; s3, sending the ciphertext data and the encrypted inverted index table to a server for storage; s4, carrying out identity verification on the user and obtaining an authorization key; generating an encrypted trap door according to the authorization key and the search demand, and sending the encrypted trap door to a server; s5, the server carries out matching according to the encrypted trap door and the encrypted inverted index table, finds ciphertext data corresponding to the search requirement and returns the ciphertext data to the user; and S6, decrypting the ciphertext data to obtain plaintext retrieval data.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to an efficient confidential retrieval method and system based on a government data platform. Background Art

[0002] With the rapid development of big data technology, more and more government systems have begun to use digital means to improve service levels. For example, the 12345 government hotline is an important channel for communication between the government and the public. Its work order information is huge and involves sensitive personal privacy; in particular, the work order content includes name, phone number, password, work order details, and call recordings. In the long-term storage and management of this data, there is a great risk of privacy leakage.

[0003] Therefore, how to achieve efficient query and retrieval while ensuring data security has become an urgent problem to be solved. Traditional encryption technologies can effectively protect the privacy of data, such as symmetric encryption (AES, DES, etc.) and asymmetric encryption (RSA, ECC, etc.), which are mainly used to prevent unauthorized personnel from accessing sensitive information. However, after adopting these encryption technologies, the data becomes ciphertext. Although its security can be ensured in storage and management, the encrypted data must be decrypted first when searching and retrieving it, which increases the computing and communication costs and seriously affects the operating efficiency of the system.

[0004] For example, in the existing 12345 platform, when a user queries a specific work order, if all the data is encrypted, it is necessary to decrypt it before keyword matching and searching the work order content. Due to the huge amount of data stored in the system (about 80TB), this method will result in a very slow retrieval speed, affecting the user experience. At the same time, frequent decryption operations may also increase the risk of leaking sensitive information. Therefore, how to achieve efficient keyword retrieval without decrypting the data has become a key issue in resolving the contradiction between data storage and retrieval.

[0005] In the prior art, searchable encryption, as a technology that can search on encrypted data, has received widespread attention in recent years. This technology allows users to perform keyword searches without decrypting data when the data is encrypted, thereby achieving efficient query operations while protecting data privacy. Searchable encryption algorithms usually use Boolean Match Tree (BMT) or multi-index structures to support efficient encrypted retrieval.

[0006] In the existing 12345 platform, only information such as name and phone number are encrypted, while the work order content and recording data are not effectively encrypted, which poses an obvious risk of privacy leakage. In addition, the existing retrieval system leads to low retrieval efficiency in the case of large amounts of data, which is difficult to meet daily work needs. When the system needs to perform a keyword search on user data, it often needs to be decrypted before searching, which not only reduces efficiency but also increases the risk of data leakage.

[0007] In summary, existing technologies face the dual challenges of privacy protection and efficient retrieval in data storage and retrieval. There is an urgent need for a technical solution that can provide comprehensive privacy protection without affecting retrieval efficiency. Summary of the invention

[0008] In view of the problem in the prior art that the retrieval efficiency of government data is low due to encryption, the present invention proposes an efficient encrypted retrieval method and system based on a government data platform.

[0009] In order to achieve the above object, the present invention provides the following technical solutions:

[0010] An efficient secret state retrieval method based on a government data platform specifically comprises the following steps:

[0011] S1: Encrypt the acquired sensitive data to obtain ciphertext data;

[0012] S2: Encrypt keywords in sensitive data and generate an encrypted inverted index table;

[0013] S3: Send the ciphertext data and encrypted inverted index table to the server for storage;

[0014] S4: authenticate the user and obtain the authorization key; generate an encrypted trapdoor based on the authorization key and search requirements and send the encrypted trapdoor to the server;

[0015] S5: The server matches the encrypted trapdoor with the encrypted inverted index table, finds the ciphertext data corresponding to the search requirement, and returns the ciphertext data to the user;

[0016] S6: Decrypt the ciphertext data to obtain the plaintext retrieval data.

[0017] Preferably, the S1 includes:

[0018] S1-1: Divide the sensitive data D to be encrypted into N data blocks {D1,D1,...,D i}, D i Represents the i-th data block, i≤N;

[0019] S1-2: Generate a random symmetric key K;

[0020] S1-3: Generate a random initialization vector IV and send the data block D i Perform bitwise XOR operation with IV to get the initialized data block D' i Represents the initialization data block; Represents XOR operation; then the symmetric key K is used to encrypt the initialization data block and output the ciphertext block C i ;

[0021] S1-4: All ciphertext blocks are concatenated into complete ciphertext data C in order, and the ciphertext data C and the initialization vector IV are stored on the server. During the storage process, all data is in the form of ciphertext:

[0022] C=C1||C2||...||C i (1)

[0023] In formula (1), C represents the ciphertext data; C i Represents the i-th ciphertext block.

[0024] Preferably, S2 includes:

[0025] S2-1: Extract a representative set of keywords W = {w1, w2, ..., w m},w m Indicates the mth keyword; keywords include work order type, time, and region;

[0026] S2-2: Randomly generate a symmetric key K s , used to encrypt keywords;

[0027] S2-3: Use the key symmetric key K s For keyword w m Encrypt and generate encrypted keywords: E(w m ) represents the mth encrypted keyword; Indicates the use of key K s to w m Encryption is performed;

[0028] Then the mth encrypted keyword E(w m ) is associated with the identifier to form an encrypted index item: I(w m )=E(w m ),ID m ],I(w m ) represents the encrypted index item corresponding to the mth keyword, ID m Indicates the identifier corresponding to the mth keyword;

[0029] S2-4: Create an inverted index table T according to the encrypted index items.

[0030] Preferably, in S2-4, the method for creating the inverted index table T is:

[0031] The encrypted index item I(w m ) Group by keywords, that is, each keyword w m The corresponding encrypted keyword E(w m ) as a key and the data identifier ID associated with the keyword m Form a set to form an inverted index item, and then form an encrypted inverted index table, which is in the form of key-value pairs: key: encrypted keyword E(w m ); Value: related data identifier set ID m ; Among them, each encrypted keyword E(w m ) corresponds to a related data ID m The set of: T[E(w m )]={ID m1 ,ID m2 ,...,ID mk}; where T[E(w m )] represents the encrypted keyword E(w m ) corresponding to the identifier set, ID mk Indicates the mth keyword w m The identifier of the kth data record in the corresponding inverted index.

[0032] Preferably, in S4, the method for obtaining the authorization key is:

[0033] A-1: When user U initiates a query request, the user's identity credentials are first verified. The identity credentials include the user name and password, mobile phone verification code, and digital certificate;

[0034] A-2: If the identity credential verification succeeds, a confirmation message is sent to the user indicating that the identity verification has been successful; if the verification fails, the system returns a failure message and rejects the user's query request;

[0035] A-3: After verification, generate authorization key K for user U u and send it to the user.

[0036] Preferably, the A-1 further comprises:

[0037] The identity credentials provided by the user are encrypted using the TLS encryption channel; the encrypted identity credentials are then transmitted to the server through a secure communication channel; after receiving the encrypted identity credentials, the server decrypts them and verifies the user's identity.

[0038] Preferably, in S4, the method for generating an encryption trapdoor includes:

[0039] B-1: First determine the query keyword w i , to locate the data to be retrieved;

[0040] B-2: For query keyword w i Encrypt to generate encrypted query keywords: E(w i ) represents the i-th encrypted query keyword; Indicates that the key K is used u to w i Encryption is performed;

[0041] B-3: Based on the encrypted query keyword E(w i ) Generate a search trap door P(w i ): P(w i )=Hash(E(w i )||r), where Hash represents a hash function and r is a random number;

[0042] B-4: Use the AES encryption algorithm to generate the search trap P(w i ) is encrypted to form the final encryption trapdoor P'(w i ).

[0043] Preferably, in S5, the matching method is: using the AES decryption algorithm to obtain P(w i )=Hash(E(w i )||r), use the same r to calculate all keywords to get P(w m ), and get the matching P(w m )=P(w i ); then locate the encrypted inverted index table T to obtain the corresponding identifier set.

[0044] Preferably, the S6 includes:

[0045] S6-1: Obtain the complete ciphertext data C and initialization vector IV from the server;

[0046] S6-2: Obtain the AES symmetric key K through authorization;

[0047] S6-3: Use the AES symmetric key K to encrypt each ciphertext block C i Perform decryption operation to obtain the encrypted intermediate data block: D' i =DecK(C i );Decrypt the intermediate data block D' iPerform bitwise XOR operation with the initialization vector IV to obtain the plaintext data block

[0048] S6-4: Decrypt all the plaintext data blocks D i Concatenate in order and remove padding to form complete sensitive data D, that is, D = D1||D2||...||D i .

[0049] The present invention also provides an efficient secret state retrieval system based on a government data platform, comprising a data acquisition module, a first encryption module, an extraction module, a second encryption module, an index table construction module, a storage module, an identity authentication module, a third encryption module, and a retrieval module;

[0050] The data acquisition module is used to obtain sensitive data from the government data platform. The sensitive data specifically includes the user's name, phone number, user password, work order content and recording;

[0051] The first encryption module is used to encrypt the sensitive data according to the generated AES symmetric key K to obtain ciphertext data;

[0052] The extraction module is used to extract keywords from sensitive data, including work order type, time, and region;

[0053] The second encryption module is used to generate a symmetric key K s Encrypt the keywords to obtain encrypted index items;

[0054] An index table building module, used to build an encrypted inverted index table according to encrypted index items;

[0055] A storage module, used for storing the encrypted inverted index table and ciphertext data;

[0056] The identity verification module is used to verify the identity of the user;

[0057] The third encryption module is used to generate an authorization key K after the identity authentication is passed. u Encrypt the query keywords to obtain an encrypted trapdoor;

[0058] The retrieval module is used to match the encrypted inverted index table T according to the encrypted trapdoor, find the ciphertext data corresponding to the search requirement and return the ciphertext data to the user.

[0059] In summary, due to the adoption of the above technical solution, compared with the prior art, the present invention has at least the following beneficial effects:

[0060] The present invention uses the AES symmetric encryption algorithm to encrypt and store all sensitive data (including name, phone number, user password, work order content, recording, etc.), ensuring the security of data during storage and transmission. Even if the server is attacked or leaked, sensitive information remains encrypted and cannot be directly obtained by unauthorized personnel. This method effectively reduces the risk of user privacy leakage, especially for sensitive information such as complaints and reports, and protects user privacy.

[0061] The present invention adopts symmetric searchable encryption (SSE) technology to achieve efficient retrieval of data in ciphertext state. When encrypting data, the data manager first extracts keywords and generates an encrypted index. When a user queries, a search trap is generated for retrieval, and keyword matching can be performed directly without decrypting the data first. This method not only retains the encrypted state of the data, but also greatly improves the retrieval efficiency, avoiding the high computing cost and delay problems caused by frequent decryption in conventional encryption retrieval methods.

[0062] The present invention ensures that only legally authorized users can view the retrieved ciphertext data by authorizing users to use exclusive keys to decrypt data. During the entire retrieval and matching process, the server cannot decrypt or access any sensitive information. This design improves the security and confidentiality of the system and prevents the possibility of data abuse by the server or a third party. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic diagram of an efficient secret retrieval method based on a government data platform according to an exemplary embodiment of the present invention.

[0064] Figure 2 A schematic diagram of an efficient confidential retrieval system based on a government data platform according to an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0065] The present invention is further described in detail below in conjunction with the examples and specific implementation methods. However, this should not be understood as the scope of the above subject matter of the present invention being limited to the following examples, and all technologies realized based on the content of the present invention belong to the scope of the present invention.

[0066] In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0067] like Figure 1 As shown, the present invention provides an efficient secret state retrieval method based on a government data platform, which specifically includes the following steps:

[0068] S1: The data manager uses the AES symmetric encryption algorithm to encrypt all sensitive data to obtain ciphertext data.

[0069] In this embodiment, the AES symmetric encryption algorithm is used to encrypt all sensitive data submitted by users. For example, if it is for the 12345 government data platform, the sensitive data specifically includes the user's name, phone number, user password, work order content, recording and other data.

[0070] In this embodiment, the process of encrypting all sensitive data using the AES symmetric encryption algorithm includes:

[0071] S1-1: Data preprocessing: Divide the sensitive data D to be encrypted (including name, phone number, password, work order content, recording, etc.) into N data blocks {D1, D2, ..., D i}, D i Represents the i-th data block, i≤N. The length of each data block is 16 bytes; if the length is less than 16 bytes, a padding algorithm (such as PKCS7) is used to supplement the length to obtain a processed data block sequence.

[0072] S1-2: Key generation and management: The system generates a 128-bit AES symmetric key K (generated using a random number generator or directly calling a library, which is a prior art). The generated key K is protected by a secure storage mechanism to ensure that only authorized users can access it.

[0073] S1-3: Encryption: Generate a random initialization vector IV and encode the data block D i Perform bitwise XOR operation with IV to get the initialized data block D' i Represents the initialization data block; represents XOR operation; then the AES symmetric key K is used to perform 10 rounds of main round key operations on the initialization data block (which is the existing technology, AES encryption standard), including byte replacement, row shift, column mixing and round key addition (column mixing is not performed in the last round), and the ciphertext block C is output. i .

[0074] S1-4: Ciphertext concatenation and storage: All ciphertext blocks are concatenated into complete ciphertext data C in sequence, and the ciphertext data C and the initialization vector IV are stored on the server. During the storage process, all data is in the form of ciphertext.

[0075] C=C1||C2||...||C i (1)

[0076] In formula (1), C represents the ciphertext data; C i Represents the i-th ciphertext block.

[0077] S2: The data manager uses symmetric searchable encryption technology to encrypt keywords in sensitive data and generate an encrypted inverted index table.

[0078] In this embodiment, in S1, sensitive data is fully encrypted to protect the privacy of sensitive data; in S2, in order to support search operations (quickly query related data in an encrypted state), it is necessary to extract keywords from sensitive data and encrypt the keywords to generate an encrypted index table; that is, S1 is for the overall security of data, and S2 is for the security of search needs.

[0079] For example, if targeting the 12345 government data platform, representative keywords (such as work order type, time, region, etc.) can be extracted from the work order content. These keywords will serve as the main basis for users to search for work orders.

[0080] In this embodiment, the process of generating an encrypted index using symmetric searchable encryption technology includes:

[0081] S2-1: Keyword extraction: Extract a representative set of keywords W = {w1, w2, ..., w m},w m Indicates the mth keyword, where the keyword includes key information such as work order type, time, region, etc. These keywords will be used as the main matching conditions when users query.

[0082] S2-2: Key generation: Generate a symmetric key K for the encrypted index s (A pseudo-random number generator can be used to generate the symmetric key K s , which is a prior art, so it will not be described in detail here), the symmetric key K s Used to encrypt keywords, stored separately from the master encryption key K, and accessible only to authorized users.

[0083] S2-3: Keyword encryption (index generation): using the key symmetric key K s For keyword w m Encrypt and generate encrypted keywords: E(w m ) represents the mth encrypted keyword; Indicates the use of key K s to w m Encryption is performed.

[0084] Then the mth encrypted keyword E(w m ) and an identifier (such as a work order ID)m ) to form the encrypted index item I(w m )=[E(w m ),ID m ],I(w m ) represents the encrypted index item corresponding to the mth keyword, ID m Indicates the identifier corresponding to the mth keyword.

[0085] S2-4: Create an encrypted inverted index table: Create an inverted index structure T to facilitate keyword retrieval in an encrypted state.

[0086] In this embodiment, all encrypted index items I(w m ) Group by keyword (that is, each keyword w m The corresponding encrypted keyword E(w m ) as a key and associate the key with all the data identifier IDs associated with the keyword m Form a set, constitute an inverted index item), form an encrypted inverted index table, the inverted index table is in the form of key-value pairs: key: encrypted keyword E(w m ); Value: related data identifier set ID m . Each encrypted keyword E(w m ) corresponds to a related data ID m The set of: T[E(w m )]={ID m1 ,ID m2 ,...,ID mk}; where T[E(w m )] represents the encrypted keyword E(w m ) corresponding to the identifier set, ID mk Indicates the mth keyword w m The identifier of the kth data record in the corresponding inverted index.

[0087] In this embodiment, the inverted index structure allows searching for keywords in an encrypted state and quickly locating related data.

[0088] S3: The data manager sends the ciphertext data and the encrypted inverted index table to the server for storage.

[0089] In this embodiment, the encrypted inverted index table T is sent together with the ciphertext data and stored in the server, ensuring that both the data and the search index are in an encrypted state to avoid leakage of sensitive information.

[0090] S4: The user authenticates the data manager and obtains an authorization key; an encryption trapdoor is generated based on the authorization key and search requirements and sent to the server.

[0091] In this embodiment, when a user initiates a query request, the user is first authenticated through the identity authentication mechanism to ensure that only authorized users can perform retrieval operations. After the authentication is passed, the user will obtain an authorization key for generating a search trap. The process of user identity authentication includes:

[0092] A-1: User initiates identity authentication request: When a user (denoted as U) initiates a query request, the system first requires the user to authenticate to ensure that he has the retrieval authority. The user submits a verification request and provides identity credentials (such as user name and password, mobile phone verification code, digital certificate, etc.).

[0093] A-2: Encrypted transmission of identity credentials: The system encrypts the identity credentials provided by the user (using TLS encrypted channel) to ensure that the identity credentials cannot be stolen during transmission. The encrypted identity credentials are transmitted to the data manager through a secure communication channel.

[0094] A-3: Credential verification: After receiving the encrypted identity credentials, the data manager decrypts and verifies the user's identity; if the identity credential verification is successful, the data manager sends a confirmation message to the user that the identity authentication is successful; if the verification fails, the system returns a failure message and rejects the user's query request to prevent unauthorized users from accessing sensitive data.

[0095] A-4: Generate authorization key: After verification, the system generates an authorization key K for the uth user. u This key will be used to generate a search trapdoor, allowing users to perform retrieval operations in a confidential state.

[0096] In this embodiment, the method for generating an encryption trapdoor according to the authorization key and the search requirement includes:

[0097] B-1: User determines the query keyword: The user first determines the query keyword (or multiple keywords) i , locate the data that needs to be retrieved (such as work order type, time, region, etc.).

[0098] B-2: Keyword encryption: The user obtains the authorization key K after passing the identity authentication. u , the user's query keyword w i Encrypt to generate encrypted query keywords: E(w i ) represents the i-th encrypted query keyword; Indicates that the key K is used u to w i Encryption is performed.

[0099] B-3: Generate a search trap: The user enters the encrypted query keyword E(wi ) is further processed to generate the search trap door P(w i ): P(w i )=Hash(E(w i )||r), where Hash represents a hash function and r is a random number.

[0100] B-4: Search trap encryption and transmission: The system generates the search trap P(w i ) is encrypted (AES encryption algorithm can be used for encryption) to form the final encryption trapdoor P'(w i ) to ensure that the trapdoor is not intercepted or tampered with during transmission. The user will encrypt the trapdoor P'(w i ) is sent to the server via a secure communication channel.

[0101] The search trap is used to match the encrypted index. The search trap encrypts the user's query keywords and sends them to the server through a secure communication channel to ensure data privacy during the query process.

[0102] S5: The server matches the encrypted inverted index table T according to the encrypted trapdoor, finds the ciphertext data corresponding to the search requirement and returns the ciphertext data to the user.

[0103] In this embodiment, after receiving the search trap generated by the user, the server uses the encrypted inverted index table T for matching.

[0104] The matching method is: use the AES decryption algorithm to obtain P(w i )=Hash(E(w i )||r), where r is allocated and stored by the data manager when building the index. The server can use the same r to calculate all keywords to obtain P(w m ), and get the matching P(w m )=P(w i ); then locate the index table T to obtain the corresponding identifier set.

[0105] During this process, the server does not need to decrypt any data, and only performs encrypted queries through indexes. The matching result is the corresponding ciphertext data (such as work order content or recording). The server will return the matched ciphertext data directly to the user, and the server cannot access or decrypt the data during the entire process.

[0106] S6: The user uses the AES symmetric key to decrypt the ciphertext data and obtain the plaintext search data.

[0107] In this embodiment, after receiving the ciphertext data, the user uses the authorization key (AES symmetric key) to decrypt the returned data. The process of the user using the AES symmetric key to decrypt the ciphertext data includes:

[0108] S6-1: Obtain ciphertext data C and initialization vector IV: The user obtains the complete ciphertext data C (including the encrypted data block sequence C1, C2, ..., Cn) and initialization vector IV from the server.

[0109] S6-2: Obtain decryption key: The user obtains the AES symmetric key K through authorization.

[0110] S6-3: Decryption: Use the key K and the AES decryption algorithm to decrypt each ciphertext block Ci to obtain the encrypted intermediate data block D'i: D'i = DecK(Ci). Perform a bitwise XOR operation on the decrypted intermediate data block D'i and the initialization vector IV to obtain the plaintext data block Di: Di ​​= D'i ⊕ IV

[0111] Plaintext splicing: All decrypted plaintext data blocks D1, D2, ..., Dn are spliced ​​in order and the padding is removed to form a complete plaintext data D, that is: D = D1||D2||...||Dn.

[0112] For example, on the 12345 platform, users can decrypt and view the work order content and related information through the AES symmetric encryption algorithm. This process ensures that only authorized users can access plaintext data, further protecting data privacy.

[0113] The present invention provides a technical solution that can protect user privacy and achieve efficient retrieval by combining searchable encryption technology, ensuring that work order information and its sensitive data can be efficiently retrieved in an encrypted state, and only authorized users can decrypt and view the retrieval results. The present invention ensures the efficient operation of the system while providing data privacy protection. It is suitable for various application scenarios that require efficient and secure data storage and retrieval, such as the Chongqing 12345 platform, for the storage and retrieval of sensitive work order information such as reports and complaints.

[0114] Based on the above-mentioned efficient confidential retrieval method based on the government data platform, the present invention also provides an efficient confidential retrieval system based on the government data platform, such as Figure 2 As shown, it specifically includes a data acquisition module, a first encryption module, an extraction module, a second encryption module, an index table construction module, a storage module (built in the server), an identity authentication module, a third encryption module, and a retrieval module.

[0115] The data acquisition module is used to obtain sensitive data from the government data platform. The sensitive data specifically includes the user's name, phone number, user password, work order content, recording and other data;

[0116] The first encryption module is used to encrypt the sensitive data according to the generated AES symmetric key K to obtain ciphertext data;

[0117] Extraction module, used to extract keywords from sensitive data, including work order type, time, region, etc.;

[0118] The second encryption module is used to generate a symmetric key K s Encrypt the keywords to obtain encrypted index items;

[0119] An index table construction module is used to construct an encrypted inverted index table based on encrypted index items, so as to query keywords in an encrypted state and quickly locate relevant data;

[0120] A storage module, used for storing the encrypted inverted index table and ciphertext data;

[0121] The identity verification module is used to verify the identity of the user;

[0122] The third encryption module is used to generate an authorization key K after the identity authentication is passed. u Encrypt the query keywords to obtain an encrypted trapdoor;

[0123] The retrieval module is used to match the encrypted inverted index table T according to the encrypted trapdoor, find the ciphertext data corresponding to the search requirement and return the ciphertext data to the user.

[0124] Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. An efficient secret retrieval method based on a government data platform, characterized in that: The specific steps include: S1: Encrypt the acquired sensitive data to obtain ciphertext data; S2: Encrypt keywords in sensitive data and generate an encrypted inverted index table; S3: Send the ciphertext data and encrypted inverted index table to the server for storage; S4: authenticate the user and obtain the authorization key; generate an encrypted trapdoor based on the authorization key and search requirements and send the encrypted trapdoor to the server; S5: The server matches the encrypted trapdoor with the encrypted inverted index table, finds the ciphertext data corresponding to the search requirement, and returns the ciphertext data to the user; S6: Decrypt the ciphertext data to obtain the plaintext retrieval data.

2. The efficient secret state retrieval method based on the government data platform as claimed in claim 1, characterized in that: The S1 includes: S1-1: Divide the sensitive data D to be encrypted into N data blocks {D1,D1,...,D i }, D i Represents the i-th data block, i≤N; S1-2: Generate a random symmetric key K; S1-3: Generate a random initialization vector IV and send the data block D i Perform bitwise XOR operation with IV to get the initialized data block D' i Represents the initialization data block; Represents XOR operation; then the symmetric key K is used to encrypt the initialization data block and output the ciphertext block C i ; S1-4: All ciphertext blocks are concatenated into complete ciphertext data C in order, and the ciphertext data C and the initialization vector IV are stored on the server. During the storage process, all data is in the form of ciphertext: C=C1||C2||...||C i (1) In formula (1), C represents the ciphertext data; C i Represents the i-th ciphertext block.

3. The efficient secret state retrieval method based on the government data platform as claimed in claim 1 is characterized in that: The S2 includes: S2-1: Extract a representative set of keywords W from sensitive data = {w1,w2,...,w m },w m Indicates the mth keyword; keywords include work order type, time, and region; S2-2: Randomly generate a symmetric key K s , used to encrypt keywords; S2-3: Use the key symmetric key K s For keyword w m Encrypt and generate encrypted keywords: E(w m ) represents the mth encrypted keyword; Indicates the use of key K s For w m Encryption is performed; Then the mth encrypted keyword E(w m ) is associated with the identifier to form an encrypted index item: I(w m )=[E(w m ),ID m ],I(w m ) represents the encrypted index item corresponding to the mth keyword, ID m Indicates the identifier corresponding to the mth keyword; S2-4: Create an inverted index table T based on the encrypted index items.

4. The efficient secret state retrieval method based on the government data platform as claimed in claim 3 is characterized in that: In S2-4, the method for creating the inverted index table T is: The encrypted index item I(w m ) Group by keywords, that is, each keyword w m The corresponding encrypted keyword E(w m ) as a key and the data identifier ID associated with the keyword m Form a set to form an inverted index item, and then form an encrypted inverted index table, which is in the form of key-value pairs: key: encrypted keyword E(w m ); Value: Related data identifier set ID m ; Among them, each encrypted keyword E(w m ) corresponds to a related data ID m The set of: T[E(w m )]={ID m1 ,ID m2 ,...,ID mk }; where T[E(w m )] represents the encrypted keyword E(w m ) corresponding to the identifier set, ID mk Indicates the mth keyword w m The identifier of the kth data record in the corresponding inverted index.

5. The efficient secret state retrieval method based on the government data platform as claimed in claim 1 is characterized in that: In S4, the method for obtaining the authorization key is: A-1: When user U initiates a query request, the user's identity credentials are first verified. The identity credentials include the user name and password, mobile phone verification code, and digital certificate; A-2: If the identity credential verification succeeds, a confirmation message is sent to the user indicating that the identity verification has been successful; if the verification fails, the system returns a failure message and rejects the user's query request; A-3: After verification, generate authorization key K for user U u and send it to the user.

6. The efficient secret state retrieval method based on the government data platform as claimed in claim 5, characterized in that: The A-1 also includes: The identity credentials provided by the user are encrypted using the TLS encryption channel; the encrypted identity credentials are then transmitted to the server through a secure communication channel; after receiving the encrypted identity credentials, the server decrypts them and verifies the user's identity.

7. The efficient secret state retrieval method based on the government data platform as claimed in claim 1 is characterized in that: In S4, the method for generating an encryption trapdoor includes: B-1: First determine the query keyword w i , to locate the data to be retrieved; B-2: For query keyword w i Encrypt to generate encrypted query keywords: E(w i ) represents the i-th encrypted query keyword; Indicates that the key K is used u For w i Encryption is performed; B-3: Based on the encrypted query keyword E(w i ) Generate a search trap door P(w i ): P(w i )=Hash(E(w i )||r), where Hash represents a hash function and r is a random number; B-4: Use the AES encryption algorithm to generate the search trap P(w i ) is encrypted to form the final encryption trapdoor P'(w i ).

8. The efficient secret state retrieval method based on the government data platform as claimed in claim 1 is characterized in that: In S5, the matching method is: use the AES decryption algorithm to obtain P(w i )=Hash(E(w i )||r), use the same r to calculate all keywords to get P(w m ), and get the matching P(w m )=P(w i ); then locate the encrypted inverted index table T to obtain the corresponding identifier set.

9. The efficient secret state retrieval method based on the government data platform as claimed in claim 1, characterized in that: The S6 includes: S6-1: Obtain the complete ciphertext data C and initialization vector IV from the server; S6-2: Obtain the AES symmetric key K through authorization; S6-3: Use the AES symmetric key K to encrypt each ciphertext block C i Perform decryption operation to obtain the encrypted intermediate data block: D' i =DecK(C i );Decrypt the intermediate data block D' i Perform bitwise XOR operation with the initialization vector IV to obtain the plaintext data block S6-4: Decrypt all the plaintext data blocks D i Concatenate in order and remove padding to form complete sensitive data D, that is, D = D1||D2||...||D i .

10. An efficient secret retrieval system based on a government data platform based on the method according to any one of claims 1 to 9, characterized in that: It includes a data acquisition module, a first encryption module, an extraction module, a second encryption module, an index table construction module, a storage module, an identity authentication module, a third encryption module, and a retrieval module; The data acquisition module is used to obtain sensitive data from the government data platform. The sensitive data specifically includes the user's name, phone number, user password, work order content and recording; The first encryption module is used to encrypt the sensitive data according to the generated AES symmetric key K to obtain ciphertext data; The extraction module is used to extract keywords from sensitive data, including work order type, time, and region; The second encryption module is used to generate a symmetric key K s Encrypt the keywords to obtain encrypted index items; An index table building module, used to build an encrypted inverted index table according to encrypted index items; A storage module, used for storing the encrypted inverted index table and ciphertext data; The identity verification module is used to verify the identity of the user; The third encryption module is used to generate an authorization key K after the identity authentication is passed. u Encrypt the query keywords to obtain an encrypted trapdoor; The retrieval module is used to match the encrypted inverted index table T according to the encrypted trapdoor, find the ciphertext data corresponding to the search requirement and return the ciphertext data to the user.

Images