A multi-source encrypted data boolean query method and a computer readable medium

Abstract

The application discloses an encrypted data Boolean query method and a computer readable medium, and relates to the technical field of network and information security, the method comprises the following steps: a key generation center generates system parameters, and generates keys for data owners, data users and cloud servers; each data owner encrypts own data, generates an index for the encrypted data, and stores the encrypted data and the index on a cloud server A; after obtaining the authorization of the data owner, each data user constructs a query request and initiates a Boolean query to the cloud server A; the cloud server A stores the encrypted data and the index, processes the involved index according to the query request, and then gives the cloud server B for further Boolean calculation, and uses the calculation result to find the corresponding data of the query and return the data to the data user. Compared with the current encrypted data Boolean query method, the application mainly solves the problems of low query efficiency and the non-support of multi-source data query.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network and information security, and particularly relates to a safe and efficient multi-source encrypted data Boolean query method and a computer readable medium. BACKGROUND

[0002] The development of cloud computing technology brings many conveniences to data processing, and more and more enterprises and institutions choose to upload private data to the cloud, so as to more conveniently and efficiently calculate and share data. However, hosting data on a cloud server means losing control over the data, and users cannot know whether their data has been stolen or modified. In order to solve the trust problem brought by storing data in the cloud, sensitive data is usually encrypted to prevent unauthorized access. However, ciphertext data is usually unreadable, and it is difficult and very time-consuming to directly query the ciphertext data. The traditional data retrieval method needs to decrypt all the data to obtain plaintext data before querying, whether the decryption is performed in the cloud or downloaded to the local computer, it is impossible to guarantee both security and efficiency, so the query must be completed without decryption.

[0003] As a solution to ciphertext query, searchable encryption technology has been extensively studied in recent years, especially Boolean query, but the limitations in efficiency and function hinder its widespread use in practical scenarios. In order to improve the query efficiency, the Boolean query is usually regarded as multiple conjunctive queries, and the cloud server executes each conjunctive query respectively and combines all the query results as the final result. This method does not support complex queries well, and cannot handle the non-operation in the Boolean query A complete Boolean query method usually involves complex cryptographic algorithms, which is computationally expensive and difficult to apply to large-scale data. In addition, querying multiple sources of data at the same time is also an important application scenario of ciphertext query, and the existing system only considers a single data owner. To complete multi-source query, a unified index needs to be constructed for the data of different data owners, but this also means that once a user obtains the authorization of one of the data owners, he can access the data of all other data owners. SUMMARY

[0004] Based on the above problems, the present application provides a safe and efficient multi-source encrypted data Boolean query method and a computer readable medium. The problems of low query efficiency and non-support of multi-source data query in the Boolean query of encrypted data are solved.

[0005] The safe and efficient multi-source encrypted data Boolean query method designed by the present application comprises the following steps:

[0006] S1: a key generation center generates system parameters, and generates corresponding keys for a data owner, a data user and a cloud server based on the generated system parameters;

[0007] S2: the data owner constructs an index for a data document, calculates a hash value of each keyword as a binary number, divides the index into four sub-indices by using two pseudo-random binary strings, encrypts each sub-index, and sends the encrypted sub-indices to the cloud server A, wherein the relationship between each bit of the sub-index and the original index is determined by the value of the corresponding bit of the two pseudo-random binary strings; assuming that the index has five bits in total, the two pseudo-random binary strings are 10111 and 00010, and the third bit of the sub-index is determined by the third bit "1" of 10111 and the third bit "0" of 00010.

[0008] S3: the data user sends his / her identity to the data owner, the data owner generates a key dedicated to the data user, and completes an authorization process;

[0009] S4: the data user constructs a query request according to a keyword involved in the query and the key of the data owner, and sends the query request to the cloud server A;

[0010] S5: the cloud server A finds corresponding indexes according to the request of the data user, combines the indexes of different data owners corresponding to each keyword into a calculable index, hides the order features of the indexes by permutation, and sends the indexes to the cloud server B;

[0011] S6: the cloud server B performs Boolean calculation by using the indexes sent by the cloud server A, and returns the result to the cloud server A;

[0012] S7: the cloud server A finds corresponding data documents according to the calculation result of the cloud server B, and returns the data documents to the data user.

[0013] Further, when the data owner adds a data document, the data owner constructs an addition request and sends the addition request to the cloud server A, and the cloud server A completes index updating; when the data owner deletes a data document, the data owner constructs a deletion request and sends the deletion request to the cloud server A, and the cloud server A completes index updating.

[0014] Further, step S1 includes:

[0015] S1.1: the key generation center selects a bilinear group of order p, wherein p is a prime number There is a group and a bilinear mapping e that can be calculated efficiently: g is a generator of ;

[0016] S1.2: The key generation center selects a pseudo-random generator PRG for generating pseudo-random binary strings, selects two hash functions H1, H2 for converting binary strings of arbitrary length into elements in the group G and one-bit binary numbers, respectively;

[0017] S1.3: The key generation center assigns an identity to each data owner in the system and generates two keys for it, the keys are elements in the integer group modulo p;

[0018] S1.4: The key generation center assigns an identity to each data user in the system.

[0019] S1.5: The key generation center generates a pair of public and private keys for asymmetric encryption, sends the private key to the cloud server B, and sends the public key to all data owners and data users.

[0020] Further, step S2 comprises:

[0021] S2.1: The data owner constructs an index for his own document according to the keywords for query, calculates a binary index with a length equal to the number of documents for each keyword, where each bit represents the existence of the keyword in the corresponding document;

[0022] S2.2: The data owner selects two random keys k a，1 , and generates two binary strings r1 = [PRG(k a,1 )] 1…m , r2 = [PRG(k a,2 )] 1…m based on the two keys using the pseudo-random generator PRG, respectively, where is the set of rational numbers, [PRG(k a,1 )] 1…m represents the 1st to m bits of the pseudo-random binary string generated by the pseudo-random generator PRG using the key k a,1 ;

[0023] S2.3: The data owner uses the hash function H2 to calculate a hash value p i of a one-bit binary number for each keyword w i , and decomposes the index idx i corresponding to the keyword into four sub-indices idx i,1 , idx i,2 , idx i,3 , idx i,4 according to p i and the two binary strings r1, r2, where each bit of the sub-index satisfies the condition: ​This ensures security when sub-indexes are stored on cloud servers. When the cloud server cannot distinguish the relationships between indexes, from the cloud server's perspective, these indexes are indistinguishable from randomly generated binary strings.

[0024] S2.4: The data owner owns each sub-index idx i,j Calculate the encrypted index And calculate the tag for each encrypted index. Where sk a,1 ,sk a,2 It is the key generated by the key generation center for the data owner; that is, the key w that the data owner associates with each sub-index. i A group is computed using the hash function H1 with the index j∈[1,4]. The elements in the group, using the group's generator g and two keys sk distributed by the key generation center. a,1 ,sk a,2 A bilinear mapping calculation is performed, and two values ​​are calculated for each of the two keys. One of these values ​​is used as the tag for the sub-index. i,j Another key, used as the pseudo-random number generator (PRG), calculates a binary string and then XORs this binary string with the sub-index to obtain the encrypted index eidx. i,j ;

[0025] S2.5: The data owner generates an index to indicate the deletion status of a document. Initially, each bit is 1, indicating that the document has not been deleted. Each bit is encrypted with an asymmetric encryption public key to prevent cloud server A from knowing the deletion status of the document when the index is stored on cloud server A.

[0026] S2.6: The data owner sends the encrypted document, all "tag-encrypted index" pairs, the correspondence between each bit of the document and the index, the index indicating the deletion status, and their own identity to the cloud server A for storage.

[0027] Further, step S3 includes:

[0028] S3.1: Data users send their identity to the data owner;

[0029] S3.2: The data owner selects a unique key for the data user from the group of integers modulo p, and sends the key, the two keys used by the data owner when generating the binary string, and the number of data documents owned by the data owner to the data user;

[0030] S3.3: The data owner calculates two derived keys based on the key generated for the user and the two keys distributed by the key generation center, and stores them on cloud server A so that cloud server A can find and decrypt the relevant index according to the user's request.

[0031] Further, step S4 includes:

[0032] S4.1: The query that the data user will perform is represented as a set of keywords W' and a Boolean expression f;

[0033] S4.2: The data user selects a random number as a key and uses a pseudo-random generator (PRG) to generate a binary string q. Each bit of this binary string is used to replace each keyword in W'. If the value is 0, the two replaced keywords correspond to the 1st and 2nd sub-indices, respectively; if the value is 1, the two replaced keywords correspond to the 3rd and 4th sub-indices, respectively. Finally, a new keyword set W is obtained. The replaced keywords no longer have practical meaning but are the same values ​​used by the data owner when calculating the sub-index labels, so that they can be used by the cloud server to calculate labels subsequently.

[0034] S4.3: Data users base their data on each keyword w in W'. i Calculate an N-dimensional vector p, where each element is p[i] = H2(w i ), and based on p and q, each variable a in f j Replace with (◇) j,1 a j,1 ∧◇ j,2 a j,2 ), among which ◇ j，1 , Get {f 0,0 ,f 0,1 ,f 1,0 ,f 1,1}, in each f c,d middle,

[0035] Specifically, the data user uses the hash function H2 to calculate a one-bit binary number for each keyword in the original keyword set W', uses these numbers to form a vector p, and then replaces each variable in the Boolean expression f according to p and q to generate a new expression f. 0,0 For the j-th variable a in f j If q[j] = 0 and p[j] = 0, then replace it with (a j,1 ∧a j,2 If q[j] = 1 and p[j] = 0, then replace with If q[j] = 0 and p[j] = 1, then replace with If q[j] = 1 and p[j] = 1, replace by

[0036] The data user replaces each variable in f according to p and q to generate a new expression f 0,1 : for the jth variable a in f j If q[j] = 0 and p[j] = 0, replace by If q[j] = 1 and p[j] = 0, replace by j,1 ∧ a j,2 ; if q[j] = 0 and p[j] = 1, replace by If q[j] = 1 and p[j] = 1, replace by

[0037] The data user replaces each variable in f according to p and q to generate a new expression f 1,0 : for the jth variable a in f j If q[j] = 0 and p[j] = 0, replace by If q[j] = 1 and p[j] = 0, replace by If q[j] = 0 and p[j] = 1, replace by If q[j] = 1 and p[j] = 1, replace by j,1 ∧ a j,2 ;

[0038] The data user replaces each variable in f according to p and q to generate a new expression f 1,1 : for the jth variable a in f j If q[j] = 0 and p[j] = 0, replace by If q[j] = 1 and p[j] = 0, replace by If q[j] = 0 and p[j] = 1, replace by j,1 ∧ a j,2 ; if q[j] = 1 and p[j] = 1, replace by

[0039] S4.4: The data user represents the set of Boolean expressions F = {f 0,0 , f 0,1 , f 1,0 , f 1,1} as a string and encrypts F using the asymmetric encryption public key to obtain F';

[0040] S4.5: The data user selects a random number rk, and then uses the key of each data owner involved in the query to restore the two binary strings used by them when they decomposed the index, and connects the two binary strings to obtain two binary strings with the same length as the total number of documents of the data owners involved in the query, and then respectively performs XOR operation with a binary string with the same length calculated by using rk as the key of the pseudo-random generator PRG to obtain r1 and r2;

[0041] S4.6: The data user generates a random permutation order π, and respectively permutes r1 and r2 to disturb the order of each bit, and encrypts the permuted {r1, r2} using the asymmetric encryption public key to obtain {r'1, r'2};

[0042] S4.7: The data user calculates the trapdoor for each keyword in the keyword set W, and the trapdoor is calculated by the hash value of the keyword and the key generated by each data owner for the data user in the authorization process. Based on the principle of bilinear mapping, the cloud server A can find and decrypt the index related to the keyword through the trapdoor. Then the data user sends the trapdoor, the identity of the data owner involved in the query, the encrypted Boolean expression, {r'1, r'2}, rk, π, and the identity of the data user to the cloud server A.

[0043] Further, step S5 comprises:

[0044] S5.1: The cloud server A finds the derived key stored on the cloud server A in the authorization process according to the identities of the data user and the data owner;

[0045] S5.2: The cloud server A finds all the encrypted indexes involved through the derived key and the trapdoor, and decrypts to obtain the index values without XOR calculation, and then connects all the indexes corresponding to each keyword according to the order of the data owner, and performs XOR operation with the binary string calculated by using rk as the key of the pseudo-random generator PRG to obtain a total index. At this time, although the index is no longer in the XOR encryption state, since the indexes are sub-indexes and the cloud server A does not know the keywords corresponding to the indexes and the relationship between the indexes, the cloud server A cannot learn any information from the indexes;

[0046] S5.3: The cloud server A finds the index of the record deletion state of each data owner involved in the query, and connects these indexes as a total index d';

[0047] S5.4: The cloud server A permutes the total index of each keyword and d' using π, and then sends it to the cloud server B together with the encrypted Boolean expression and {r'1, r'2}.

[0048] Further, step S6 comprises:

[0049] S6.1: Cloud server B decrypts the Boolean expression using the asymmetric encryption private key, decrypts {r'1, r'2} to get {r1, r2}, and then substitutes all the total indexes corresponding to the keywords into the four Boolean expressions to calculate ridx1, ridx2, ridx3, ridx4;

[0050] S6.2: Cloud server B decrypts each bit of d' using the asymmetric encryption private key to get d", and calculates Send ridx to cloud server A.

[0051] Further, step S7 includes:

[0052] S7.1: Cloud server A uses π to inverse ridx to get ridx';

[0053] S7.2: Cloud server A splits ridx' according to the number of documents of each data owner, as the index of the query result of each data owner, and finds the document corresponding to the position of 1 in each result index according to the correspondence between the document and the sum of each bit, and sends it to the data user.

[0054] Further, when the data owner adds a new document, the encrypted index and the corresponding label of the document are calculated separately according to the steps S2.1-S2.4, and then the number 1 is encrypted using the asymmetric encryption public key to get d new Send the encrypted document, encrypted index, label, d new and his identity to cloud server A;

[0055] Cloud server A finds the corresponding encrypted index for each label, adds the encrypted index of the new document to the end, and records the correspondence between the new bit and the new document;

[0056] Cloud server A finds the index recording the deletion state, and adds d new to the end;

[0057] After cloud server A completes the index update, the data owner synchronizes the updated number of documents to all authorized data users.

[0058] Further, when the data owner deletes a document, a new binary index is constructed, in which the position corresponding to the deleted document is set to 0, and the positions of the rest are set to 1, and each bit is encrypted using the asymmetric encryption public key to get index d', and then d' and his identity are sent to cloud server A;

[0059] Cloud server A finds the index recording the deletion state and replaces it with d'.

[0060] Based on the same inventive concept, the application also designs a computer readable medium, which stores a computer program, and the program is executed by a processor to realize the multi-source encrypted data Boolean query method.

[0061] The application has the advantages that:

[0062] The application includes a key generation center, a plurality of data owners, a plurality of data users, two cloud servers A and B. The key generation center generates system parameters, generates keys for data owners, data users and cloud servers; each data owner encrypts his own data document, generates an index for the encrypted document, and stores the encrypted document and the index on the cloud server A; each data user gets the authorization of the data owner, constructs a query request to initiate a Boolean query to the cloud server A; the cloud server A stores the encrypted document and the index, processes the involved index according to the query request, and then gives it to the cloud server B for further Boolean calculation, and uses the calculation result to find the corresponding data document of the query and returns it to the data user.

[0063] Compared with the traditional method, the application designs an encrypted index based on a bitmap, maps the Boolean query to a logical operation on the index, so that the query efficiency is close to the plaintext query, and has good performance under any form of complex query. The index is stored in the form of four decomposed sub-indices on the cloud server, only authorized users can use the index for query, and the simple structure design enables the index to be flexibly combined, thereby realizing multi-source data query. And the user can simultaneously perform Boolean query on the data of multiple data owners, and the query process is safe and efficient, and unauthorized data cannot be queried. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 The figure is a schematic diagram of the model structure of the application. DETAILED DESCRIPTION

[0065] The application will be further described below in combination with the drawings.

[0066] Example 1

[0067] In this embodiment, the key generation center is considered to be completely trusted, the data owner, the data user, the cloud server A and the cloud server B are honest and curious, which means that they will honestly execute the pre-defined algorithm, but may try to access unauthorized data or learn more valuable information from the encrypted data and the calculation process. In addition, the cloud server A and the cloud server B will not collude.

[0068] As shown in Figure 1 The application provides a safe and efficient multi-source encrypted data Boolean query method, which includes the following steps:

[0069] S1: a key generation center generates system parameters, generates corresponding keys for a data owner, a data user and a cloud server based on the generated system parameters;

[0070] S2: the data owner constructs an index for a data document, calculates a hash value of each keyword as a binary number, divides the index into four sub-indices by using two pseudo-random binary strings, encrypts each sub-index, and sends the encrypted sub-indices to the cloud server A, wherein the relationship between each bit of the sub-index and the original index is determined by the value of the corresponding bit of the two pseudo-random binary strings;

[0071] S3: the data user sends his / her identity to the data owner, and the data owner generates a special key for the data user to complete the authorization process;

[0072] S4: the data user constructs a query request according to the keywords involved in the query and the key of the data owner, and sends the query request to the cloud server A;

[0073] S5: the cloud server A finds the corresponding index according to the request of the data user, combines the indexes of different data owners corresponding to each keyword into a computable index, hides the order features of the indexes by permutation, and sends the indexes to the cloud server B;

[0074] S6: the cloud server B performs Boolean calculation using the indexes sent by the cloud server A, and returns the result to the cloud server A;

[0075] S7: the cloud server A finds the corresponding data document according to the calculation result of the cloud server B, and returns the data document to the data user;

[0076] S8: when a new data document is added, the data owner constructs an addition request and sends the addition request to the cloud server A, and the cloud server A completes index updating;

[0077] S9: when a data document is deleted, the data owner constructs a deletion request and sends the deletion request to the cloud server A, and the cloud server A completes index updating.

[0078] In an embodiment, step S1 comprises:

[0079] S1.1: the key generation center selects a bilinear group of order p, where p is a prime number There is a group and a bilinear mapping e: g is a generator of ;

[0080] S1.2: the key generation center selects a pseudo-random generator PRG and two hash functions H1: H2: {0, 1} * → {0, 1};

[0081] S1.3: The key generation center is for each data owner (DO) in the system. i Assign an identity (oid) i And generate two keys sk for it. i，1 , in Let p be the group of integers modulo p;

[0082] S1.4: The key generation center generates keys for each data user DU in the system. i Assign an identity UID i .

[0083] S1.5: The key generation center generates a public-private key pair (pk) for asymmetric encryption. B and SK B , sk B Send to cloud server B, and the PK B Send to all data owners and data users.

[0084] In one implementation, step S2 includes:

[0085] S2.1: A data owner, denoted as DO a Based on the keywords used for the query For my m documents Construct an index idx = {idx2, idx2, ..., idx} n}: For each keyword Calculate a binary index idx of length m. i Each bit of the index satisfies

[0086] S2.2: Data Owner (DO) a Choose two keys k a，1 , Use a pseudo-random generator to calculate two binary strings r1 = [PRG(k)] a,1 )] 1…m r2 = [PRG(k a,2 )] 1…m .in It is the set of rational numbers, [PRG(k a,1 )] 1…m This indicates that the pseudo-random generator PRG uses the key k. a,1 The first to m bits of the generated pseudo-random binary string;

[0087] S2.3: Data Owner (DO) a For each index idx i ∈idx calculate p i =H2(w i), and then construct sub-index idx i,1 , idx i,2 , idx i,3 , idx i,4 Each bit of the sub-index satisfies the condition: if and then idx i,1 [j] ^ idx i,2 [j] = idx i [j], if and then idx i,3 [j] ^ idx i,4 [j] = idx i [j]; if and then if and then That is, according to and are (0, 0), (0, 1), (1, 0), (1, 1), the value of the sub-index is determined according to the corresponding one of the above four construction methods, and each bit of the index corresponds to a different case.

[0088] S2.4: Data owner DO a Calculates the encrypted index i,j for each sub-index idx and calculates the tag for each encrypted index

[0089] S2.5: Data owner DO a Generates an index to indicate the deletion state of the document, which is initially {1} m Each bit is encrypted using the asymmetric encryption public key pk B to obtain d a . Where {1} m is a binary string consisting of m 1s;

[0090] S2.6: Data owner DO a Sends the encrypted document, all "tag-encrypted index" pairs {tag i,j , eidx i,j}, the correspondence between the encrypted document and each bit of the index, d a and its own identity uid a to the cloud server A for storage.

[0091] In one embodiment, step S3 includes:

[0092] S3.1: Data user, denoted as DU i , sends his identity uid i to the data owner DO a ;

[0093] S3.2: Data owner DO a generates a key k i for the data user DU a ; sends uk a,1 , k a,2 , and the number of data documents m a it owns to the data user DU i ;

[0094] S3.3: Data owner DO a computes the key k and and sends them to the cloud server A for storage with oid a and uid i as tags.

[0095] In one embodiment, step S4 comprises:

[0096] S4.1: Data user, denoted as DU, whose query contains N keywords, denoted as W', and involves data owners {DO1, DO2,..., DO x}, whose identities are denoted as R = {oid1, oid2,..., oid x}, and each data owner DO i owns m i documents, represents the query in the form of a set W' containing N keywords and a Boolean expression f(a1, a2,..., a N ) containing N variables;

[0097] S4.2: Data user selects a random number rand and computes q = [PRG(rand)] 1…N , then replaces each keyword in W' as follows: if q[i] = 0, replace the ith keyword with w i ||1 and w i ||2; if q[i] = 1, replace the ith keyword with w i ||3 and w i ||4; obtains a new set W containing 2N keywords;

[0098] S4.3: Data user computes an N-dimensional vector p from each keyword w i in W' as p[i] = H2(w iAnd based on p and q, each variable in f is replaced to generate a new expression f. 0,0 For the j-th variable a in f j If q[j] = 0 and p[j] = 0, then replace it with (a j,1 ∧a j,2 If q[j] = 1 and p[j] = 0, then replace with If q[j] = 0 and p[j] = 1, then replace with If q[j] = 1 and p[j] = 1, then replace with

[0099] The data user substitutes each variable in f based on p and q to generate a new expression f. 0,1 For the j-th variable a in f j If q[j] = 0 and p[j] = 0, then replace with If q[j] = 1 and p[j] = 0, then replace with (a j,1 ∧a j,2 If q[j] = 0 and p[j] = 1, then replace with If q[j] = 1 and p[j] = 1, then replace with

[0100] The data user substitutes each variable in f based on p and q to generate a new expression f. 1,0 For the j-th variable a in f j If q[j] = 0 and p[j] = 0, then replace with If q[j] = 1 and p[j] = 0, then replace with If q[j] = 0 and p[j] = 1, then replace with If q[j] = 1 and p[j] = 1, then replace it with (a j,1 ∧a j,2 );

[0101] The data user replaces each variable in f according to p and q to generate a new expression f. 1,1 For the j-th variable a in f j If q[j] = 0 and p[j] = 0, then replace with If q[j] = 1 and p[j] = 0, then replace with If q[j] = 0 and p[j] = 1, then replace with (a j,1 ∧a j,2 If q[j] = 1 and p[j] = 1, then replace with

[0102] S4.4: The data user will set the Boolean expression set F = {f0,0 ,f 0,1 ,f 1,0 ,f 1,1} represents a string, and uses an asymmetric encryption public key pk B Encrypting F yields F';

[0103] S4.5: The data user selects a random number rk, and uses DO for each data owner involved in the query. i The key {k i,1 ,k i,2}calculate and get and Then calculate and

[0104] S4.6: The data user generates a random permutation order π, permutes r1 and r2 respectively to shuffle the order of each bit, and uses the asymmetric encryption public key pk. B The encrypted permutation of {r1,r2} yields {r′1,r′2};

[0105] S4.7: Data users for each keyword w in the keyword set W k Calculate the trapdoor in Will Send to cloud server A. Where uid represents the data user's identity, and uk... i For the data owner DO during the authorization process i A key generated for data users.

[0106] In one implementation, step S5 includes:

[0107] S5.1: Cloud server A obtains (T,R,F′,{r′1,r′2},rk,π,uid), based on uid and each oid in R. i Find the corresponding key

[0108] S5.2: Cloud server A for each T k ∈T, for each of them calculate turn up Corresponding encrypted index calculate Then calculate Where m i It is the data owner DO i The number of data documents can be determined by cloud server A based on... The length of m i;

[0109] S5.3: Cloud server A finds the corresponding d for each oid in R i i x );

[0110] S5.4: Cloud server A permutes each e using π to get e' k k to cloud server B. Permutation means adjusting the position of each bit in the index according to an order π, for example, π is [2, 3, 5, 1, 4], which means the original first bit is placed in the second bit, the second bit is placed in the third bit, the third bit is placed in the fifth bit, the fourth bit is placed in the first bit, and the fifth bit is placed in the fourth bit. After the above permutation, "abcde" becomes "dabec".

[0111] In an embodiment, step S6 comprises:

[0112] S6.1: Cloud server B decrypts F' and {r'1, r'2} using the asymmetric encryption private key sk B 0,0 0,1 1,0 1,1 and {r1, r2} respectively, and substitutes all e' ∈ e into four Boolean expressions f k 0,0 0,1 1,0 1,1 to get ridx1, ridx2, ridx3, ridx4 respectively.

[0113] S6.2: Cloud server B decrypts each bit of d' using the asymmetric encryption private key sk B to get ridx and sends ridx to cloud server A.

[0114] In an embodiment, step S7 comprises:

[0115] S7.1: Cloud server A inversely permutes ridx using π to get ridx';

[0116] S7.2: Cloud server A splits ridx' into {ridx'1, ridx'2, …, ridx'N} according to the number of documents of each data owner x ​​​​​​​​​​​​​This serves as an index for the query results of each data owner, and based on the correspondence between documents and each bit of the index, it finds the document corresponding to the position where each result index is 1, and sends it to the data user.

[0117] In one implementation, step S8 includes:

[0118] S8.1: Data owner, denoted as DO a Add a new document D new At that time, following the steps described in S2.1-S2.4, for and Calculate the encrypted index and corresponding tags Using asymmetric encryption public key pk B Encrypting the number 1 yields d new encrypt the document and Send to cloud server A;

[0119] S8.2: Cloud server A for each tag i Find the corresponding encrypted index and set eidx i Add it to the end and record the correspondence between the newly added character and the newly added document;

[0120] S8.3: Cloud server A according to OID a Find index d a , will d new Add to d a Finally;

[0121] S8.4: After cloud server A completes the index update, the data owner will update the document count m. a Synchronize with all authorized data users.

[0122] In one implementation, step S9 includes:

[0123] S9.1: Data owner, denoted as DO a When deleting a document, a new binary index is constructed, where the position corresponding to the deleted document is set to 0, and the remaining positions are set to 1, and an asymmetric encryption public key PK is used. B Encrypting each bit yields the index d′ a Then d′ a and oid a Send to cloud server A;

[0124] S9.2: Cloud server A according to oid a Find index d a , use d' a Replace d a .

[0125] Embodiment Two

[0126] Based on the same inventive concept, the application also provides a computer readable medium, which stores a computer program, and the program is executed by a processor to implement the method described in Embodiment One.

[0127] Since the electronic device described in Embodiment Two of the application is the computer readable medium used to implement the method of multi-source encrypted data Boolean query in Embodiment One of the application, the specific structure and variations of the electronic device can be understood by those skilled in the art based on the method described in Embodiment One of the application, and thus will not be described here. Any electronic device used in the method of Embodiment One of the application belongs to the scope of protection of the application.

[0128] The specific embodiments described herein are merely illustrative of the spirit of the application. Those skilled in the art can make various modifications or supplements to the described specific embodiments or replace them with similar ways, without deviating from the spirit of the application or exceeding the scope defined by the appended claims.

Claims

1. A multi-source encrypted data Boolean query method, characterized in that, The method comprises the following steps: S1: a key generation center generates system parameters, and generates corresponding keys for a data owner, a data user and a cloud server based on the generated system parameters; S2: the data owner constructs an index for a data document, calculates a hash value of each keyword, divides the index into four sub-indices by using two pseudo-random binary strings, encrypts each sub-index, and sends the encrypted sub-indices to the cloud server A, wherein the relationship between each bit of the sub-index and the original index is determined by the values of corresponding bits of the two pseudo-random binary strings; S3: the data user sends his / her identity to the data owner, and the data owner generates a key dedicated to the data user to complete an authorization process; S4: the data user constructs a query request according to a keyword involved in the query and the key of the data owner, and sends the query request to the cloud server A, which specifically comprises: S4.1: the data user represents the query as a set of keywords and a Boolean expression; S4.2: the data user selects a random number, generates a binary string by using a pseudo-random generator, replaces each keyword in the set of keywords according to each bit of the binary string, and obtains a new set of keywords; S4.3: the data user calculates a vector according to each keyword in the original set of keywords, replaces variables in the Boolean expression according to the values in the vector and the replaced keywords, and generates four new Boolean expressions; S4.4: the data user represents the four Boolean expressions as strings and encrypts the strings by using an asymmetric encryption public key; S4.5: the data user selects a random number, restores two binary strings by using the key of each data owner involved in the query, performs XOR operation on the two binary strings and a randomly generated binary string, and obtains two binary strings; S4.6: the data user generates a random permutation order, encrypts the two binary strings after permutation; S4.7: the data user calculates a trapdoor for each keyword in the set of keywords, and sends the trapdoor, the encrypted Boolean expressions, the encrypted permutation binary strings, the permutation order, the random number and the identity to the cloud server A; S5: the cloud server A finds corresponding indexes according to the query request of the data user, combines the indexes of different data owners corresponding to each keyword into a calculable index, hides the order features of the indexes by permutation, and sends the indexes to the cloud server B; S6: the cloud server B performs Boolean calculation by using the indexes sent by the cloud server A, and returns the result to the cloud server A; S7: the cloud server A finds corresponding data documents according to the calculation result of the cloud server B, and returns the data documents to the data user.

2. The method for multi-source encrypted data Boolean query according to claim 1, wherein: When the data owner adds a data document, the data owner constructs an addition request and sends the addition request to the cloud server A, and the cloud server A updates the indexes; When the data owner deletes a data document, the data owner constructs a deletion request and sends the deletion request to the cloud server A, and the cloud server A updates the indexes.

3. The method for multi-source encrypted data Boolean query according to claim 1, wherein, Step S1 comprises: S1.1: The key generation center selects a prime number as the order of the bilinear group S1.2: The key generation center selects a prime number as the order of the bilinear group S1.3: The key generation center selects a prime number as the order of the bilinear group S1.4: The key generation center selects a prime number as the order of the bilinear group S1.5: The key generation S1.2: The key generation center selects a pseudo-random generator. Two hash functions are selected to generate pseudo-random binary strings. , These are used to convert binary strings of arbitrary length into groups. The elements and one binary digit in the array; S1.3: The key generation center generates for each data owner in the system an identity and two keys where is a group of integers modulo ​ S1.4: Key generation center allocates an identity to each data user in the system allocates an identity ; S1.5: The key generation center generates a pair of public and private keys for asymmetric encryption and sends the private key to the cloud server B, and sends the public key to all data owners and data users.

4. The method for multi-source encrypted data Boolean query according to claim 3, wherein, Step S2 comprises: S2.1: Data owner, denoted as Based on the keywords used for the query For oneself One document Building an index For each keyword Calculate a length of binary index Each bit of the index satisfies ; S2.2: The data owner selects two keys , computes two binary strings using a pseudo-random generator , where is the set of rational numbers, denotes the pseudo-random generator and is the number of bits of the pseudo-random binary string generated using the key ; S2.3: Data owner to each index Compute Then build sub-index , , , Each bit of the sub-index satisfies the condition: ; S2.4: The data owner generates a key for each sub-index Computes the encrypted index and computes a tag for each encrypted index where is a key generated by the key generation center for the data owner, is the generator of the group . S2.5: The data owner generates an index to indicate the deletion status of the document, initially as , each bit of which is encrypted with the asymmetric encryption public key to obtain wherein is a binary string consisting of ones; S2.6: The data owner sends the encrypted document, all "tag-encrypted index" pairs , the correspondence between each bit of the encrypted document and index, and and his own identity to the cloud server A for storage.

5. The multi-source encrypted data Boolean query method of claim 4, wherein, Step S5 comprises: S5.1: Cloud server A received ,according to and Each of them Find the corresponding key ,in For the data owner during the authorization process Calculated derived key and ,by and The token is stored on cloud server A; S5.2: Cloud server A for each For each of them calculate ,turn up Corresponding encrypted index ,calculate Then calculate ;in Data owner The number of data documents can be determined by cloud server A based on... Length obtained ; S5.3: Cloud server A finds the corresponding for each of , calculates ;​ S5.4: Cloud server A sends to cloud server B the set of Using Substitute to get , the Using Substitute to get , the to cloud server B.

6. The multi-source encrypted data Boolean query method of claim 5, wherein, Step S6 comprises: S6.1: Cloud server B uses asymmetric encryption private key decrypts and obtains and and substitutes all into four Boolean expressions respectively calculates ; S6.2: Cloud server B uses asymmetric encryption private key decrypts each bit, obtaining , calculates sends to cloud server A.

7. The multi-source encrypted data Boolean query method according to claim 2, wherein: The data owner is denoted as Add a new document At that time, following the steps described in S2.1-S2.4, for and Calculate the encrypted index and corresponding tags Using asymmetric encryption public key Encrypting the number 1 yields encrypt the document and Send to cloud server A; The cloud server A adds the encrypted index to the last of the encrypted index list of the cloud server A, and records the corresponding relationship between the added bit and the added document. The cloud server A adds the encrypted index to the last of the encrypted index list of the cloud server A, and records the corresponding relationship between the added bit and the added document. The cloud server A adds the encrypted index to the The cloud server A adds the index of the cloud server B to the index of the cloud server A according to the index of the cloud server B. find the index , add to the end of the index of the cloud server A. After cloud server A completes the index update, the data owner will provide the number of updated documents to all authorized data users. synchronize to all authorized data users.

8. The method of claim 2, wherein: Data owner, denoted as When a document is deleted, a new binary index is constructed, in which the positions corresponding to the deleted documents are set to 0, and the rest are set to 1, and the asymmetric encryption public key is used to encrypt the index for each bit and are sent to the cloud server A; The cloud server A according to finds the index , replaces with .

9. A computer readable medium having stored thereon a computer program, characterized in that: the program is executed by a processor to implement the method of any one of claims 1-8.

Images