Symmetrical searchable encryption method based on quantum security after meeting LWE problem

Abstract

The invention relates to the technical field of cloud storage and privacy protection, in particular to a symmetric searchable encryption method based on quantum security after an LWE problem is satisfied, and the method comprises the steps: determining a keyword, and carrying out the processing to generate a symmetric random key and a keyword key; encrypting a plaintext file by using a symmetric random key to obtain a ciphertext file, processing a corresponding keyword to generate a binary intermediate vector, and generating a keyword index in combination with a keyword key; processing the keyword to generate a keyword vector, and determining a keyword trap door based on the keyword vector; performing retrieval through the keyword index to obtain a matching result, and if the matching is successful, returning the ciphertext file to the current user; the current user decrypts the ciphertext file according to the symmetric random key to obtain a corresponding plaintext file; the security of the keyword index and the keyword trap door is based on the LWE problem, and the post quantum security is ensured according to whether the keyword index and the keyword trap door are matched or not and executing corresponding technical operation.

Description

Technical Field

[0001] The present invention relates to the technical fields of cloud storage and privacy protection, and particularly to a symmetric searchable encryption method that meets post-quantum security based on the LWE problem. Background Art

[0002] In the forefront technologies such as cloud computing, the Internet of Things, and artificial intelligence, the storage and indexing of massive amounts of data have become inevitable requirements. How to achieve fast search while ensuring data privacy and security is a major challenge. For data owners, cloud servers are generally not fully trusted. Therefore, data is usually encrypted and uploaded to the cloud server to prevent privacy leakage. In this regard, to more efficiently prevent data leakage, searchable encryption technology is usually adopted to support efficient search on encrypted data, that is, while protecting data privacy, efficient search of encrypted data is realized, which is applicable to scenarios that require strict data protection, such as sensitive information databases, medical data management, financial records, etc.

[0003] Currently, searchable encryption schemes are mainly divided into symmetric searchable encryption (SSE, Symmetric Searchable Encryption) and public key searchable encryption (PEKS, Password Encryption Key Security). Among them, symmetric searchable encryption uses symmetric encryption algorithms, which are efficient and simple. However, its security is based on problems vulnerable to quantum computing. Therefore, the research on various cryptographic systems resistant to quantum attacks is an issue widely concerned by the cryptographic community and the industrial community. As an important branch of modern cryptography, lattice-based cryptography has attracted much attention from researchers due to its inherent mathematical complexity and potential for resisting quantum computing attacks. Among them, the learning with errors (LWE) problem is the core of the security of lattice cryptography, which involves solving linear equations with noise.

[0004] The LWE (Learning With Errors) problem is based on a weak complexity assumption but is powerful. Currently, no known quantum algorithm can effectively solve it. Therefore, encryption methods based on LWE are considered to be able to resist quantum computing attacks. However, most of the existing lattice-based cryptographic systems focus on public key cryptographic application scenarios and are not suitable enough for symmetric encryption environments that require high performance and low latency. Summary of the Invention

[0005] In order to solve the technical problems that the existing searchable encryption methods have low security, insufficient performance, high latency, and poor adaptability in the symmetric encryption environment when facing quantum computers, the purpose of the present invention is to provide a symmetric searchable encryption method that meets post-quantum security based on the LWE problem. The cloud server, the data owner, and the data user are respectively obtained, and the specific technical solutions adopted are as follows: Determine keywords based on any file, unify the dimensions of the keywords, and have the data owner process the keywords to generate a symmetric random key and a keyword key; Obtain the plaintext file and the corresponding keywords, use the symmetric random key to encrypt the plaintext file to obtain the ciphertext file, process the corresponding keywords to generate a binary intermediate vector, and generate a keyword index in combination with the keyword key, and upload the ciphertext file and the keyword index to the cloud server; Have the data user process the keywords to generate a keyword vector, determine a keyword trapdoor based on the keyword vector, and send it to the cloud server; The cloud server retrieves through the keyword index to obtain a matching result. If the match is successful, return the ciphertext file to the current user; The current user decrypts the ciphertext file according to the symmetric random key to obtain the corresponding plaintext file.

[0006] Preferably, determining keywords based on any file and having the data owner process the keywords to generate a symmetric random key and a keyword key includes: Input security parameters, and have the data owner generate a symmetric random key based on a pseudorandom number generator; Obtain a set of integers, and determine the discrete Gaussian distribution of any integer in the set of integers; Respectively determine the sampling random vector and the sampling matrix of the data owner through the random distribution and the discrete Gaussian distribution, and generate a keyword key.

[0007] Preferably, the formula for determining the discrete Gaussian distribution of any integer in the set of integers is:

[0008] where represents the discrete Gaussian distribution of the integer with parameter ; ; and both represent integers; represents a parameter; represents a set of integers; The data owner selects integer parameters and and and where represents the modulus; represents the dimension of the LWE problem; represents the dimension of the keyword; define Let The sampling random vector of the data owner and at the sampling matrix , return the keyword key .

[0009] Preferably, obtain the plaintext file and the corresponding keyword, encrypt the plaintext file with a symmetric random key to obtain the ciphertext file, process the corresponding keyword to generate a binary bit string vector, and generate a keyword index in combination with the keyword key, and upload the ciphertext file and the keyword index to the cloud server, including: Encrypt the plaintext file with a symmetric random key through a symmetric encryption algorithm to obtain the ciphertext file; Obtain a hash function, determine the loop variable, and process the corresponding keyword to generate a binary intermediate vector; Obtain the keyword index using the keyword key, and the corresponding calculation formula is:

[0010] where, represents the keyword index; represents the sampling random vector in the keyword key; , represents the identity matrix of dimension , represents the sampling matrix in the keyword key; represents the modulus; , represents the dimension of the LWE problem, represents the dimension of the keyword; represents the binary intermediate vector; Upload the ciphertext file and the keyword index to the cloud server.

[0011] Preferably, obtain a hash function, determine the loop variable, and process the corresponding keyword to generate a binary intermediate vector, including: Based on the dimension of the keyword , by default, a -dimensional vector with all values being 1, denoted as ; Determine the loop variable, denoted as counter, and let its value increase from 1 to in sequence, and calculate the positive integer, and the corresponding calculation formula is:

[0012] where, represents the positive integer; represents the hash function; represents the keyword; represents the loop variable; represents the dimension of the keyword; Based on the positive integer, for the vector in the corresponding One position is denoted as -1, and it is repeated through a loop variable times to generate a binary intermediate vector of the keyword, denoted as .

[0013] Preferably, the keyword vector is generated by the data user processing the keyword, the keyword trapdoor is determined based on the keyword vector, and sent to the cloud server, including: The keyword vector is generated by the data user processing the keyword, denoted as ; Determine the sampling random vector of the data user and the error vector of the sampling Gaussian distribution, and calculate the first intermediate value; Integrate the first intermediate value and the sampling random vector of the data user to determine the second intermediate value, combine the keyword secret key to determine the third intermediate value, generate the keyword trapdoor according to the second intermediate value and the third intermediate value, and send it to the cloud server.

[0014] Preferably, determine the sampling random vector of the data user and the error vector of the sampling Gaussian distribution, calculate the first intermediate value, and the corresponding calculation formula is:

[0015] Where represents the first intermediate value; represents the sampling matrix in the keyword secret key; represents the transpose of the sampling matrix; represents the sampling random vector of the data user; , both represent the modulus; represents the keyword vector; represents the error vector of the sampling Gaussian distribution; represents the set of integers; represents the dimension of the keyword.

[0016] Preferably, integrate the first intermediate value and the sampling random vector of the data user to determine the second intermediate value, combine the keyword secret key to determine the third intermediate value, generate the keyword trapdoor according to the second intermediate value and the third intermediate value, and send it to the cloud server, including: Integrate the first intermediate value and the sampling random vector of the data user to determine the second intermediate value, and the corresponding calculation formula is:

[0017] Where represents the second intermediate value; represents the first intermediate value; represents the sampling random vector of the data user; represents the set of integers; denotes the modulus; , denotes the dimension of the LWE problem, denotes the dimension of the keyword; Determine the third intermediate value in combination with the keyword key, and the corresponding calculation formula is:

[0018] wherein, denotes the third intermediate value; denotes the sampling random vector in the keyword key; Generate a keyword trapdoor according to the second intermediate value and the third intermediate value, and the corresponding calculation formula is:

[0019] wherein, denotes the keyword trapdoor.

[0020] Preferably, the cloud server retrieves through the keyword index to obtain a matching result. If the match is successful, the ciphertext file is returned to the current user, including: The cloud server parses the keyword trapdoor, calculates and outputs the result dimension; Based on whether the result dimension is equal to the dimension of the keyword, if the two are not equal, it means the retrieval fails, and it returns to the data user to determine that there is no matching result and ends the retrieval process; if the two are equal, the ciphertext file is returned to the current user.

[0021] Preferably, calculate and output the result dimension, and the corresponding calculation formula is:

[0022] wherein, denotes the result dimension; denotes the integer operation; , both denote the modulus; denotes the third intermediate value; denotes the second intermediate value; denotes the keyword index corresponding to after parsing the keyword trapdoor; denotes the inner product operation of two vectors; denotes the integer set.

[0023] The present invention has the following beneficial effects: In the new method of symmetric searchable encryption provided by this application, whether the keywords in the search algorithm match is determined by calculating the inner product value of the keyword index and the keyword trapdoor, and the operation efficiency is high. That is, in this process, the cloud server cannot obtain the specific information of the keywords, and only searches the uploaded files through the keywords of the encrypted files, with a high degree of information encryption, preventing the leakage of data and keyword information. Moreover, the security of the keyword index and the keyword trapdoor is based on the LWE problem, and the calculation mainly involves the product operation of matrices and vectors, and the operation efficiency is much higher than that of the public key searchable encryption method. Then, the cloud server verifies whether the keyword index and the keyword trapdoor match by calculating the inner product value, and performs corresponding technical operations according to the matching result, which can provide post-quantum security. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0025] Figure 1 It is a flowchart of the steps of a symmetric searchable encryption method based on the LWE problem and satisfying post-quantum security provided by an embodiment of the present invention; Figure 2 It is an implementation flowchart of a symmetric searchable encryption method based on the LWE problem and satisfying post-quantum security provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0026] In order to further elaborate on the technical means and effects adopted by the present invention to achieve the intended invention purpose, the following will, in conjunction with the accompanying drawings and preferred embodiments, elaborate in detail on a symmetric searchable encryption method based on the LWE problem and satisfying post-quantum security proposed by the present invention, its specific implementation manner, structure, features and effects. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs.

[0028] The following will specifically describe the specific solution of a symmetric searchable encryption method based on the LWE problem and satisfying post-quantum security provided by the present invention with reference to the accompanying drawings.

[0029] Please refer to Figure 1 andFigure 2 , which respectively show the step flow chart and the implementation flow chart of a symmetric searchable encryption method that meets post-quantum security based on the LWE problem provided by an embodiment of the present invention. The cloud server, the data owner, and the data user are respectively obtained. The method includes: Step S1: Determine keywords based on any file, unify the dimensions of the keywords, and process the keywords by the data owner to generate a symmetric random key and a keyword key; Step S2: Obtain the plaintext file and the corresponding keywords, encrypt the plaintext file with the symmetric random key to obtain the ciphertext file, process the corresponding keywords to generate a binary intermediate vector, generate a keyword index by combining the keyword key, and upload the ciphertext file and the keyword index to the cloud server; Step S3: Process the keywords by the data user to generate a keyword vector, determine a keyword trapdoor based on the keyword vector, and send it to the cloud server; Step S4: The cloud server retrieves through the keyword index to obtain a matching result. If the match is successful, return the ciphertext file to the current user; Step S5: The current user decrypts the ciphertext file according to the symmetric random key to obtain the corresponding plaintext file.

[0030] For better illustration, the LWE problem, that is, the Learning With Errors problem, is a mathematical problem that represents finding a vector in a high-dimensional space such that the inner product between the vector and another vector plus a small perturbation value, that is, an error, is equal to a given target value under a certain modulus; its complexity is relatively high and it is difficult to be effectively solved by a traditional computer, which can provide security guarantees for post-quantum cryptography; optionally, in this embodiment, mainly for the search case where each file contains a single keyword, the steps are divided into five parts: key generation, file encryption and keyword index generation, trapdoor generation, search, and decryption. Among them, the cloud server, that is, Cloud Server (CS), has storage capabilities and can provide a stable and secure cloud storage solution; the data owner, that is, Data Owner (DO) and the data user, that is, Data Uesr (DU), are both used to process data and perform analysis to maximize the value of the data.

[0031] As an alternative implementation, the data owner DO and the data user DU can be the same user. In this case, the access and use of the data are more direct and convenient. They can also belong to different users. In this case, it is necessary to share the key information between the two to ensure the secure transmission of the data and the effective management of the access rights. It should be noted that usually, the key exchange is carried out through a secure channel to prevent unauthorized third parties from obtaining sensitive information, and the key is updated regularly to better protect the data security.

[0032] Understandably, step S1 is the key generation algorithm, denoted as , which is executed by the data owner DO.

[0033] Furthermore, in step S1, it includes: Step S11: Input the security parameter, and the data owner generates a symmetric random key based on a pseudo-random number generator.

[0034] Specifically, in this embodiment, input the security parameter , which generally represents the security strength that the system needs to meet. Usually, it is required to be 128bit. Set the dimension of the keyword to . According to different files and different keywords, usually, the keyword is mapped to a fixed dimension through hash. The data owner DO generates a 128-bit random value through a secure pseudo-random number generator (PRNG, i.e., Pseudo Random Number Generator), and this generator is used to ensure that each generated vector is unique and unpredictable, denoted as , where represents the symmetric random key for encrypting the plaintext file.

[0035] Step S12: Obtain the set of integers and determine the discrete Gaussian distribution of any integer in the set of integers.

[0036] Make an explanation. represents the set of integers, where represents the modulus of the absolutely complete least residue coefficient; and then solve the discrete Gaussian distribution with parameter for any integer.

[0037] Furthermore, in step S12, to determine the discrete Gaussian distribution of any integer in the set of integers, the corresponding calculation formula is:

[0038] where represents the discrete Gaussian distribution of the integer with parameter ; , both represent integers; represents a parameter; represents a set of integers.

[0039] Step S13: Determine the sampling random vector and sampling matrix of the data owner through random distribution and discrete Gaussian distribution respectively, and generate the keyword key.

[0040] It is explained that the data owner selects integer parameters , , and , where represents the modulus; represents the dimension of the LWE problem; represents the dimension of the keyword; define Let , the sampling random vector of the data owner , and at sampling matrix , return the keyword key .

[0041] Specifically, to ensure that the parameter meets the error condition in the correctness description, select appropriate integer parameters , and , and all calculations are performed on ; represents the modulus used for rounding in the decryption phase, and satisfies , represents the dimension of the keyword; furthermore, determine the sampling random vector of the data owner as , and at sampling matrix , obtain the keyword key as and the public parameter , where , , represents the identity matrix with dimension , that is, the identity matrix with the same dimension as the keyword; represent the number of rows and columns of the matrix respectively.

[0042] It can be understood that step S2 is the encryption and index generation part, denoted as , and is also executed by the data owner DO.

[0043] Furthermore, in step S2, it includes: Step S21: Encrypt the plaintext file using a symmetric random key through a symmetric encryption algorithm to obtain a ciphertext file; where the plaintext file is denoted as , and the ciphertext file is denoted as .

[0044] Optionally, a symmetric encryption algorithm such as AES-128 or the national cipher SM4 algorithm can be used. Among them, AES-128 (Advanced Encryption Standard-128, that is, the Advanced Encryption Standard) uses a 128-bit key length to provide efficient and secure data protection; the national cipher SM4 (SM4 Algorithm) algorithm is a symmetric encryption standard independently developed in China, with high security and reliability.

[0045] Step S22: Obtain a hash function, determine a loop variable, and process the corresponding keyword to generate a binary intermediate vector.

[0046] It should be noted that the hash function is a collision-resistant hash function, that is , represents a set of integers. Specifically, SHA-1 or SHA-256 is used as the basic hash function. Among them, SHA is the Secure Hash Algorithm, the Secure Hash Algorithm; preferably, in this embodiment, based on SHA-256 as the basic hash function, it can generate a unique 256-bit, that is, 32-byte hash value to ensure the integrity and security of the data. Regarding the hash value as a 256-bit unsigned integer, through the dimension perform operations to map the hash value to the target range to effectively prevent collisions and ensure the security of data transmission.

[0047] Furthermore, in step S22, it includes: Step S221: Based on the dimension of the keyword, by default, a -dimensional vector with any value being 1 is denoted as ; that is, the dimension of the keyword is as previously set .

[0048] Step S222: Determine the loop variable, denoted as counter, and let its value increase from 1 to in sequence, and calculate a positive integer. The corresponding calculation formula is:

[0049] where represents a positive integer; represents the hash function; represents the keyword; represents the loop variable; Indicates the dimension of the keyword; Step S223: Based on a positive integer, for the vector the corresponding th position is marked as -1, and through the loop variable, it is repeated times to generate the binary intermediate vector of the keyword, denoted as .

[0050] To make an explanation, for the all-ones vector the th position is determined to be -1, and then it is repeated times to obtain the binary intermediate vector with a length of .

[0051] Step S23: Use the keyword secret key to obtain the keyword index, and the corresponding calculation formula is:

[0052] where, represents the keyword index; represents the sampling random vector in the keyword secret key; , represents the identity matrix with a dimension of , represents the sampling matrix in the keyword secret key; represents the modulus; , represents the dimension of the LWE problem, represents the dimension of the keyword; represents the binary intermediate vector; Step S24: Upload the ciphertext file and the keyword index to the cloud server; that is, ensure that the data is protected using the Advanced Encryption Standard during transmission and stored to ensure the confidentiality and integrity of the information.

[0053] It can be explained that is the sampling random vector. In the matrix , is the secret matrix, and the binary intermediate vector is obtained by processing the keyword through a hash function. Therefore, during the calculation of the keyword index, is embedded into the keyword secret key through a linear transformation, and the sampling random vector provides random masking to ensure that the overall structure conforms to the characteristics of the LWE hard problem.

[0054] It can be understood that Step S3 is the trapdoor generation part, denoted as , which is executed by the data user DU; among them, the generation of both the keyword index part and the keyword trapdoor satisfies post-quantum security. In subsequent processing by the cloud server, only the inner product value of the two parts can be obtained, and the information of the keyword cannot be obtained, improving the overall security of the data.

[0055] Further, in step S3, it includes: Step S31: The data user processes the keyword to generate a keyword vector, denoted as ; that is, the data user DU processes the keyword based on step S22 to obtain the keyword vector in the same steps.

[0056] Step S32: Determine the sampling random vector and the error vector of the sampling Gaussian distribution of the data user, and calculate the first intermediate value; it should be noted that the sampling random vector of the data user is , and the error vector of the sampling Gaussian distribution is , where represents a discrete Gaussian distribution with dimension .

[0057] Further, in step S32, to calculate the first intermediate value, the corresponding calculation formula is:

[0058] where represents the first intermediate value; represents the sampling matrix in the keyword key; represents the transpose of the sampling matrix; represents the sampling random vector of the data user; , both represent the modulus; represents the keyword vector; represents the error vector of the sampling Gaussian distribution; represents the set of integers; represents the dimension of the keyword.

[0059] It should be noted that represents the keyword vector, that is, it corresponds to the keyword in step S31 and generates the keyword vector from it; represents the noise term, represents the error vector of the sampling Gaussian distribution, and its randomness masks the value of the keyword vector .

[0060] Step S33: Integrate the first intermediate value and the sampling random vector of the data user to determine the second intermediate value, combine the keyword key to determine the third intermediate value, and generate a keyword trapdoor according to the second intermediate value and the third intermediate value, and send it to the cloud server.

[0061] Further, in step S33, it includes: Step S331: Integrate the first intermediate value and the sampling random vector of the data user to determine the second intermediate value. The corresponding calculation formula is:

[0062] Wherein, represents the second intermediate value; represents the first intermediate value; represents the sampling random vector of the data user; represents the set of integers; represents the modulus; , represents the dimension of the LWE problem, represents the dimension of the keyword; Step S332: Combine the keyword key to determine the third intermediate value. The corresponding calculation formula is:

[0063] Wherein, represents the third intermediate value; represents the sampling random vector in the keyword key; Step S333: Generate a keyword trapdoor according to the second intermediate value and the third intermediate value. The corresponding calculation formula is:

[0064] Wherein, represents the keyword trapdoor.

[0065] It can be understood that step S4 is the search algorithm, denoted as , which is executed in cooperation with the cloud server.

[0066] Further, in step S4, it includes: Step S41: The cloud server parses the keyword trapdoor and calculates and outputs the result dimension.

[0067] Further, in step S41, when calculating and outputting the result dimension, the corresponding calculation formula is:

[0068] Wherein, represents the result dimension; represents the integer operation; 、 both represent the modulus; represents the third intermediate value; represents the second intermediate value; represents the keyword index corresponding to after parsing the keyword trapdoor; Represents the inner product operation of two vectors; Represents the set of integers.

[0069] Step S42: Determine whether the result dimension is equal to the dimension of the keyword. If the two are not equal, it indicates a retrieval failure, return to the data user, determine that there is no matching result, and end the retrieval process; if the two are equal, return the ciphertext file to the current user; that is, when the result dimension matches the keyword dimension successfully, return the ciphertext file to the current user to perform subsequent decryption operations.

[0070] Understandably, step S5 is the decryption part, denoted as , which is executed by the data user DU; that is, after the current user receives the ciphertext file returned by the cloud server, use the symmetric random key to decrypt the ciphertext file to obtain the plaintext file corresponding to the keyword.

[0071] For better illustration, to verify the correctness of the matching between the result dimension and the keyword dimension, based on the intermediate vector and the keyword vector for explanation. For , determine:

[0072] Based on this formula, determine the left and right sides respectively. The left side is , and the right side is , and then simplify to get: ; further simplify to get: .

[0073] Thus, the result dimension is: ; When , select appropriate parameters , , to satisfy the error condition . At this time, ; Since the intermediate vector and the keyword vector are both generated by the same step method and are both , so , and then .

[0074] Understandably, in the new method for symmetric searchable encryption provided by the present application, whether the keywords in the search algorithm match is determined by calculating the vector inner product value of the keyword index and the keyword trapdoor, with high operating efficiency. That is, in this process, the cloud server cannot obtain the specific information of the keywords, and only searches the uploaded files through the keywords of the encrypted files, with a high degree of information encryption, preventing the leakage of data and keyword information. Moreover, the security of the keyword index and the keyword trapdoor is based on the LWE problem, and the calculation mainly involves the multiplication operation of matrices and vectors, with the operating efficiency much higher than that of the public key searchable encryption method. Then, the cloud server verifies whether the keyword index and the keyword trapdoor match by calculating the vector inner product value, and performs corresponding technical operations according to the matching result, which can provide post-quantum security.

[0075] It should be noted that the above sequence of the embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0076] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A symmetric searchable encryption method based on the LWE problem that satisfies post-quantum security, characterized in that Obtain a cloud server, a data owner, and a data user respectively. The method includes: Determine keywords based on any file, unify the dimensions of the keywords, and have the data owner process the keywords to generate a symmetric random key and a keyword key; Obtain a plaintext file and corresponding keywords, encrypt the plaintext file using the symmetric random key to obtain a ciphertext file, process the corresponding keywords to generate a binary intermediate vector, combine with the keyword key to generate a keyword index, and upload the ciphertext file and the keyword index to the cloud server; Have the data user process the keywords to generate a keyword vector, determine a keyword trapdoor based on the keyword vector, and send it to the cloud server; The cloud server retrieves through the keyword index to obtain a matching result. If the match is successful, return the ciphertext file to the current user; The current user decrypts the ciphertext file according to the symmetric random key to obtain the corresponding plaintext file.

2. The symmetric searchable encryption method based on the LWE problem that meets post-quantum security according to claim 1, characterized in that Determine keywords based on any file, and have the data owner process the keywords to generate a symmetric random key and a keyword key, including: Input a security parameter, and have the data owner generate a symmetric random key based on a pseudorandom number generator; Obtain a set of integers, and determine the discrete Gaussian distribution of any integer in the set of integers; Respectively determine the sampling random vector and the sampling matrix of the data owner through the random distribution and the discrete Gaussian distribution to generate a keyword key.

3. The symmetric searchable encryption method based on the LWE problem that meets post-quantum security according to claim 2, wherein Determine the discrete Gaussian distribution of any integer in the set of integers. The corresponding calculation formula is: ； Among them, represents an integer with parameter ; is the discrete Gaussian distribution; , both represent integers; represents a parameter; represents a set of integers; The data owner selects integer parameters , , and , where represents the modulus; represents the dimension of the LWE problem; represents the dimension of the keyword; define , let , the sampling random vector of the data owner , and at sampling matrix , return the keyword key .

4. The symmetric searchable encryption method based on the LWE problem and meeting post-quantum security according to claim 1, characterized in that Obtain a plaintext file and corresponding keywords, encrypt the plaintext file using the symmetric random key to obtain a ciphertext file, process the corresponding keywords to generate a binary bit string vector, combine with the keyword key to generate a keyword index, and upload the ciphertext file and the keyword index to the cloud server, including: Encrypt the plaintext file using the symmetric random key through a symmetric encryption algorithm to obtain a ciphertext file; Obtain a hash function, determine a loop variable, and process the corresponding keywords to generate a binary intermediate vector; Obtain the keyword index using the keyword key. The corresponding calculation formula is: ； Among them, represents the keyword index; represents the sampling random vector in the keyword key; , represents an identity matrix of dimension ; represents the sampling matrix in the keyword key; represents the modulus; , represents the dimension of the LWE problem, represents the dimension of the keyword; represents the binary intermediate vector; Upload the ciphertext file and the keyword index to the cloud server.

5. The symmetric searchable encryption method based on the LWE problem satisfying post-quantum security according to claim 4, characterized in that, Obtain a hash function, determine a loop variable, and process the corresponding keywords to generate a binary intermediate vector, including: Keyword-based dimension , a dimension vector with any default value being 1 , denoted as ; Determine the loop variable, denoted as counter, and let its value increase from 1 to in sequence, and calculate the positive integer, with the corresponding calculation formula being: ； Among them, represents a positive integer; represents a hash function; represents a keyword; represents a loop variable; represents the dimension of the keyword; Based on positive integers, the vector in which the corresponding th position is denoted as -1, and this is repeated times through a loop variable to generate a binary intermediate vector of the keyword, denoted as .

6. The symmetric searchable encryption method based on the LWE problem that meets post-quantum security according to claim 1, wherein Have the data user process the keywords to generate a keyword vector, determine a keyword trapdoor based on the keyword vector, and send it to the cloud server, including: The keyword vector is generated by the data user processing the keyword, denoted as ; Determine the sampling random vector of the data user and the error vector of the sampling Gaussian distribution, and calculate a first intermediate value; Integrate the first intermediate value and the sampling random vector of the data user to determine a second intermediate value, combine with the keyword key to determine a third intermediate value, generate a keyword trapdoor according to the second intermediate value and the third intermediate value, and send it to the cloud server.

7. The symmetric searchable encryption method based on the LWE problem satisfying post-quantum security according to claim 6, wherein Determine the sampling random vector of the data user and the error vector of the sampling Gaussian distribution, and calculate a first intermediate value. The corresponding calculation formula is: ； Among them, represents the first intermediate value; represents the sampling matrix in the keyword key; represents the transpose of the sampling matrix; represents the sampling random vector of the data user; 、 both represent the modulus; represents the keyword vector; represents the error vector of the sampling Gaussian distribution; represents the set of integers; represents the dimension of the keyword.

8. The symmetric searchable encryption method based on the LWE problem that meets post-quantum security according to claim 7, wherein Integrate the first intermediate value and the sampling random vector of the data user to determine a second intermediate value, combine with the keyword key to determine a third intermediate value, generate a keyword trapdoor according to the second intermediate value and the third intermediate value, and send it to the cloud server, including: Integrate the first intermediate value and the sampling random vector of the data user to determine the second intermediate value, and the corresponding calculation formula is: ； Among them, represents the second intermediate value; represents the first intermediate value; represents the sampling random vector of the data user; represents the set of integers; represents the modulus; , represents the dimension of the LWE problem, represents the dimension of the keyword; Combine the keyword key to determine the third intermediate value, and the corresponding calculation formula is: ； Among them, represents the third intermediate value; represents the sampling random vector in the keyword key; Generate a keyword trapdoor according to the second intermediate value and the third intermediate value, and the corresponding calculation formula is: ； Among them, represents the keyword trapdoor.

9. The symmetric searchable encryption method based on the LWE problem that meets post-quantum security according to claim 1, characterized in that The cloud server retrieves through the keyword index to obtain the matching result. If the match is successful, return the ciphertext file to the current user, including: The cloud server parses the keyword trapdoor, calculates and outputs the result dimension; Based on whether the result dimension is equal to the dimension of the keyword, if the two are not equal, it means the retrieval fails, return to the data user, determine that there is no matching result, and end the retrieval process; if the two are equal, return the ciphertext file to the current user.

10. The symmetric searchable encryption method based on the LWE problem satisfying post-quantum security according to claim 9, wherein, Calculate and output the result dimension, and the corresponding calculation formula is: ； Among them, represents the result dimension; represents the rounding operation; , both represent the modulus; represents the third intermediate value; represents the second intermediate value; represents the keyword index corresponding to after parsing the keyword trapdoor; represents the inner product operation of two vectors; represents the integer set.

Images