Symmetric searchable encryption method based on LWE problem with post-quantum security

Abstract

The present invention relates to the technical field of cloud storage and privacy protection, and in particular to a symmetric searchable encryption method that meets post-quantum security based on the LWE problem. The method comprises the following steps: determining a keyword, processing and generating a symmetric random key and a keyword key; encrypting a plaintext file using the symmetric random key to obtain a ciphertext file, processing a corresponding keyword to generate a binary intermediate vector, and generating a keyword index in combination with the keyword key; processing the keyword to generate a keyword vector, and determining a keyword trapdoor based on the keyword vector; searching through the keyword index to obtain a matching result, and returning the ciphertext file to the current user if the match is successful; the current user decrypting the ciphertext file using the symmetric random key to obtain a corresponding plaintext file; the security of the keyword index and the keyword trapdoor is based on the LWE problem, and corresponding technical operations are performed according to whether the keyword index and the keyword trapdoor match, thereby ensuring post-quantum security.

Description

Technical Field

[0001] The present invention relates to the field of cloud storage and privacy protection technology, and in particular to a symmetric searchable encryption method based on the LWE problem that meets post-quantum security. Background Art

[0002] In cutting-edge technologies such as cloud computing, the Internet of Things, and artificial intelligence, the storage and indexing of massive data have become inevitable requirements. How to achieve fast search while ensuring data privacy and security is a major challenge. For data owners, cloud servers are generally not completely trustworthy, so data is usually encrypted and uploaded to cloud servers to prevent privacy leaks. In response to this, in order to more effectively prevent data leaks, searchable encryption technology is usually used to support efficient search on encrypted data. That is, while protecting data privacy, it can achieve efficient search of encrypted data. This technology is suitable for scenarios that require strict data protection, such as sensitive information databases, medical data management, financial records, etc.

[0003] Currently, searchable encryption schemes are mainly divided into symmetric searchable encryption (SSE) and public key searchable encryption (PEKS). Symmetric searchable encryption uses a symmetric encryption algorithm, which is efficient and simple. However, its security is based on the difficulty of being susceptible to quantum computing. Therefore, the research on various cryptographic systems that are resistant to quantum attacks is a problem of widespread concern in the cryptography community and industry. Lattice-based cryptography, as an important branch of modern cryptography, has attracted much attention from researchers due to its inherent mathematical complexity and potential to resist quantum computing attacks. Among them, the fault-tolerant learning problem (LWE problem) is the core of lattice cryptography security, which involves solving a system of linear equations with noise.

[0004] The LWE (Learning With Errors) problem is based on a weak complexity assumption but is powerful. Currently, no known quantum algorithm can effectively solve it. Therefore, encryption methods based on LWE are considered to be resistant to quantum computing attacks. However, existing lattice-based cryptographic systems mostly focus on public key cryptography applications and are not adaptable to symmetric encryption environments that require high performance and low latency. Summary of the Invention

[0005] In order to solve the technical problems of existing searchable encryption methods, such as low security, insufficient performance, high latency, and poor adaptability in symmetric encryption environments, when facing quantum computers, the present invention aims to provide a symmetric searchable encryption method based on the LWE problem that meets post-quantum security. The cloud server, data owner, and data user are obtained separately. The technical solutions adopted are as follows:

[0006] Determine keywords based on any file, unify the keyword dimensions, process the keywords through the data owner, and generate symmetric random keys and keyword keys;

[0007] Obtain the plaintext file and the corresponding keyword, encrypt the plaintext file using a symmetric random key to obtain the ciphertext file, process the corresponding keyword to generate a binary intermediate vector, combine it with the keyword key to generate a keyword index, and upload the ciphertext file and keyword index to the cloud server;

[0008] The data user processes the keywords to generate keyword vectors, determines keyword traps based on the keyword vectors, and sends them to the cloud server;

[0009] The cloud server searches through the keyword index to obtain matching results. If the match is successful, the encrypted file is returned to the current user.

[0010] The current user decrypts the ciphertext file using the symmetric random key to obtain the corresponding plaintext file.

[0011] Preferably, a keyword is determined based on any file, and the keyword is processed by the data owner to generate a symmetric random key and a keyword key, including:

[0012] Input security parameters and generate a symmetric random key based on a pseudo-random number generator by the data owner;

[0013] Get a set of integers and determine the discrete Gaussian distribution of any integer in the set of integers;

[0014] The sampling random vector and sampling matrix of the data owner are determined by random distribution and discrete Gaussian distribution respectively to generate the keyword key.

[0015] Preferably, the discrete Gaussian distribution of any integer in the set of integers is determined, and the corresponding calculation formula is:

[0016]

[0017] in, Indicates that the parameter is Integer discrete Gaussian distribution of ; 、 All represent integers; Represents parameters; represents a set of integers;

[0018] The data owner chooses the integer parameter 、 、 and ,in, Represents the modulus; Represents the dimension of the LWE problem; Represents the dimension of keywords; defines ,make , a random vector of samples from the data owner , and in Sampling Matrix , returns the keyword key .

[0019] Preferably, obtaining a plaintext file and a corresponding keyword, encrypting the plaintext file using a symmetric random key to obtain a ciphertext file, processing the corresponding keyword to generate a binary bit string vector, combining the keyword key to generate a keyword index, and uploading the ciphertext file and the keyword index to a cloud server includes:

[0020] Use a symmetric random key to encrypt the plaintext file through a symmetric encryption algorithm to obtain a ciphertext file;

[0021] Obtain the hash function, determine the loop variable, and process the corresponding keyword to generate a binary intermediate vector;

[0022] The keyword index is obtained using the keyword key. The corresponding calculation formula is:

[0023]

[0024] in, Indicates keyword index; represents a sampled random vector in the keyword key; , Represents the dimension as The identity matrix, represents the sampling matrix in the keyword key; Represents the modulus; , represents the dimension of the LWE problem, Dimensions representing keywords; represents a binary intermediate vector;

[0025] Upload the ciphertext file and keyword index to the cloud server.

[0026] Preferably, obtaining a hash function, determining a loop variable, and processing a corresponding keyword to generate a binary intermediate vector include:

[0027] Keyword-based dimensions , the default value is 1 dimensional vector, denoted as ;

[0028] Determine the loop variable, record it as counter, and let its value increase from 1 to , calculate the positive integer, the corresponding calculation formula is:

[0029]

[0030] in, represents a positive integer; represents a hash function; Indicates keywords; Represents the loop variable; Dimensions representing keywords;

[0031] Based on positive integers, the vector The corresponding The position is recorded as -1, and repeated through the loop variable times, generate the binary intermediate vector of the keyword, recorded as .

[0032] Preferably, a data user processes keywords to generate keyword vectors, determines keyword trapdoors based on the keyword vectors, and sends the keyword trapdoors to a cloud server, including:

[0033] The keyword vector is generated by processing the keyword by the data user, which is recorded as ;

[0034] Determine a sampling random vector of a data user and an error vector of a sampling Gaussian distribution, and calculate a first intermediate value;

[0035] The first intermediate value and the sampled random vector of the data user are integrated to determine the second intermediate value, and the third intermediate value is determined by combining the keyword key. A keyword trapdoor is generated according to the second intermediate value and the third intermediate value and sent to the cloud server.

[0036] Preferably, the sampling random vector of the data user and the error vector of the sampling Gaussian distribution are determined, and the first intermediate value is calculated. The corresponding calculation formula is:

[0037]

[0038] in, represents the first intermediate value; represents the sampling matrix in the keyword key; represents the transpose of the sampling matrix; A random vector representing the sampled data user; 、 Both represent modulus; represents the keyword vector; represents the error vector of the sampled Gaussian distribution; represents a set of integers; Represents the dimension of the keyword.

[0039] Preferably, the first intermediate value and the sampled random vector of the data user are integrated to determine the second intermediate value, the third intermediate value is determined in combination with the keyword key, and a keyword trapdoor is generated based on the second intermediate value and the third intermediate value and sent to the cloud server, including:

[0040] The first intermediate value and the sampled random vector of the data user are integrated to determine the second intermediate value. The corresponding calculation formula is:

[0041]

[0042] in, represents the second median value; represents the first intermediate value; A random vector representing the sampled data user; represents a set of integers; Represents the modulus; , represents the dimension of the LWE problem, Dimensions representing keywords;

[0043] The third intermediate value is determined by combining the keyword key. The corresponding calculation formula is:

[0044]

[0045] in, represents the third median value; represents a sampled random vector in the keyword key;

[0046] Generate a keyword trapdoor based on the second and third intermediate values. The corresponding calculation formula is:

[0047]

[0048] in, Represents a keyword trapdoor.

[0049] Preferably, the cloud server searches through the keyword index to obtain matching results. If the match is successful, the ciphertext file is returned to the current user, including:

[0050] The cloud server parses the keyword trapdoor, calculates and outputs the resulting dimension;

[0051] Based on the result dimension, determine whether it is equal to the keyword dimension. If the two are not equal, it means the retrieval fails and returns to the data user, confirming that there is no matching result and ending the retrieval process; if the two are equal, return the encrypted file to the current user.

[0052] Preferably, the result dimension is calculated and outputted, and the corresponding calculation formula is:

[0053]

[0054] in, Represents the outcome dimension; Indicates rounding operation; 、 Both represent modulus; represents the third median value; represents the second median value; Indicates the keyword index corresponding to the keyword trapdoor after parsing; Represents the inner product operation of two vectors; Represents a set of integers.

[0055] The present invention has the following beneficial effects:

[0056] In the new symmetric searchable encryption method provided by the present application, whether the search algorithm keyword matches is determined by calculating the vector inner product value of the keyword index and the keyword trapdoor, and the operating efficiency is high. That is, in this process, the cloud server cannot obtain the specific information of the keyword, and only searches the uploaded file through the keyword of the encrypted file. The information encryption degree is high, which prevents the leakage of data and keyword information; and the security of the keyword index and keyword trapdoor is based on the LWE problem, and the calculation mainly involves the product operation of the matrix and the vector, and the operating efficiency is much higher than the public key searchable encryption method; then, the cloud server verifies whether the keyword index and the keyword trapdoor match by calculating the vector inner product value, and performs corresponding technical operations according to the matching results, which can provide post-quantum security. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 A flowchart of a symmetric searchable encryption method based on the LWE problem that meets post-quantum security is provided in one embodiment of the present invention;

[0059] Figure 2 This is a flowchart of an implementation of a symmetric searchable encryption method based on the LWE problem that meets post-quantum security provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0060] To further illustrate the technical means and effectiveness of the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effectiveness of a symmetric searchable encryption method based on the LWE problem that meets post-quantum security. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0061] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0062] The following describes in detail a specific solution of a symmetric searchable encryption method based on the LWE problem that meets post-quantum security provided by the present invention in conjunction with the accompanying drawings.

[0063] Please combine Figure 1 and Figure 2 , which respectively show a step flowchart and an implementation flowchart of a symmetric searchable encryption method based on the LWE problem that meets post-quantum security provided by an embodiment of the present invention, respectively obtaining a cloud server, a data owner, and a data user, and the method includes:

[0064] Step S1: Determine keywords based on any file, unify the dimensions of the keywords, process the keywords through the data owner, and generate symmetric random keys and keyword keys;

[0065] Step S2: Obtain a plaintext file and the corresponding keyword, encrypt the plaintext file using a symmetric random key to obtain a ciphertext file, process the corresponding keyword to generate a binary intermediate vector, combine the keyword key to generate a keyword index, and upload the ciphertext file and keyword index to the cloud server;

[0066] Step S3: The data user processes the keyword to generate a keyword vector, determines the keyword trapdoor based on the keyword vector, and sends it to the cloud server;

[0067] Step S4: The cloud server searches through the keyword index to obtain matching results. If the match is successful, the encrypted file is returned to the current user.

[0068] Step S5: The current user decrypts the ciphertext file using the symmetric random key to obtain the corresponding plaintext file.

[0069] To better illustrate, the LWE problem, namely the Learning With Errors problem, is a difficult mathematical problem, which means finding a vector in a high-dimensional space so that the inner product between the vector and another vector plus a small perturbation value, namely the error, is equal to a given target value under a certain modulus; its complexity is high and it is difficult to be effectively solved by traditional computers, which can provide security for post-quantum cryptography; optionally, in this embodiment, mainly for the search situation where each file contains a single keyword, the steps are divided into five parts: key generation, file encryption and keyword index generation, trapdoor generation, search and decryption, among which the cloud server, namely Cloud Server (CS), has storage capacity and can provide a stable and secure cloud storage solution; the data owner, namely Data Owner (DO) and the data user, namely Data Uesr (DU), are both used to process and analyze data to maximize the value of the data.

[0070] As an optional implementation, the data owner DO and the data user DU can be the same user, in which case data access and use are more direct and convenient; the two can also belong to different users, in which case key information needs to be shared between the two to ensure secure data transmission and effective management of access rights; it can be explained that key exchange is usually performed through a secure channel to prevent unauthorized third parties from obtaining sensitive information, and the key is updated regularly to better ensure data security.

[0071] It can be understood that step S1 is the key generation algorithm, which is recorded as , which is executed by the data owner DO.

[0072] Furthermore, step S1 includes:

[0073] Step S11: input security parameters, and the data owner generates a symmetric random key based on a pseudo-random number generator.

[0074] Specifically, in this embodiment, the security parameters are input , which generally indicates the security strength that the system needs to meet, usually requiring 128 bits, and setting the dimension of the keyword to , depending on the file, the keyword is different, usually the keyword is mapped to a fixed dimension through hash; the data owner DO generates a 128-bit random value through a secure pseudo-random number generator (PRNG, Pseudo Random Number Generator), which is used to ensure that each generated vector is unique and difficult to predict, denoted as ,in, Indicates the symmetric random key used to encrypt plaintext files.

[0075] Step S12: Obtain a set of integers, and determine the discrete Gaussian distribution of any integer in the set of integers.

[0076] Make an explanation, represents a set of integers, where Represents modulus The absolute minimum residual coefficient; then solve the parameter for any integer discrete Gaussian distribution of .

[0077] Furthermore, in step S12, the discrete Gaussian distribution of any integer in the integer set is determined, and the corresponding calculation formula is:

[0078]

[0079] in, Indicates that the parameter is Integer discrete Gaussian distribution of ; 、 All represent integers; Represents parameters; Represents a set of integers.

[0080] Step S13: Determine the data owner's sampling random vector and sampling matrix through random distribution and discrete Gaussian distribution respectively, and generate a keyword key.

[0081] To illustrate, the data owner chooses the integer parameter 、 、 and ,in, Represents the modulus; Represents the dimension of the LWE problem; Represents the dimension of keywords; defines ,make , a random vector of samples from the data owner , and in Sampling Matrix , returns the keyword key .

[0082] Specifically, to ensure that the parameters Satisfy the error conditions in the correctness description and choose appropriate integer parameters 、 and All calculations are performed on Onward; Represents the modulus used for rounding during the decryption phase, and satisfies , Represents the dimension of the keyword; and then determines the sampling random vector of the data owner as , and in Sampling Matrix , get the keyword key as and public parameters ,in, , , Represents the dimension The identity matrix of , that is, the identity matrix with the same dimension as the keyword; Represent the number of rows and columns of the matrix respectively.

[0083] It can be understood that step S2 is the encryption and index generation part, which is recorded as , also executed by the data owner DO.

[0084] Furthermore, step S2 includes:

[0085] Step S21: Use the symmetric random key to encrypt the plaintext file through the symmetric encryption algorithm to obtain the ciphertext file; wherein the plaintext file is recorded as , the ciphertext file is recorded as .

[0086] Optionally, symmetric encryption algorithms such as AES-128 or the National Encryption SM4 algorithm can be used. Among them, AES-128 (Advanced Encryption Standard-128) uses a 128-bit key length to provide efficient and secure data protection; the National Encryption SM4 (SM4 Algorithm) algorithm is a symmetric encryption standard independently developed in China with high security and reliability.

[0087] Step S22: Obtain a hash function, determine a loop variable, and process the corresponding keyword to generate a binary intermediate vector.

[0088] It is explained that the hash function is a collision-resistant hash function, that is, , Represents a set of integers, specifically, SHA-1 or SHA-256 is used as the basic hash function, wherein SHA is Secure Hash Algorithm; preferably, in this embodiment, based on SHA-256 as the basic hash function, it can generate a unique 256-bit, i.e., 32-byte hash value to ensure the integrity and security of the data, and the hash value is regarded as a 256-bit unsigned integer. Perform operations to map hash values ​​to target ranges , to effectively prevent collisions and ensure the security of data transmission.

[0089] Furthermore, step S22 includes:

[0090] Step S221: Dimension based on keywords , the default value is 1 dimensional vector, denoted as ; That is, the keyword dimensions are as pre-set above, .

[0091] Step S222: Determine the loop variable, record it as counter, and let its value increase from 1 to , calculate the positive integer, the corresponding calculation formula is:

[0092]

[0093] in, represents a positive integer; represents a hash function; Indicates keywords; Represents the loop variable; Dimensions representing keywords;

[0094] Step S223: Based on positive integers, vector The corresponding The position is recorded as -1, and repeated through the loop variable times, generate the binary intermediate vector of the keyword, recorded as .

[0095] To illustrate, the vector of all 1s The The first position is determined to be -1, and then repeated times, the length is The binary intermediate vector .

[0096] Step S23: Obtain keyword index using keyword key, the corresponding calculation formula is:

[0097]

[0098] in, Indicates keyword index; represents a sampled random vector in the keyword key; , Represents the dimension The identity matrix, represents the sampling matrix in the keyword key; Represents the modulus; , represents the dimension of the LWE problem, Dimensions representing keywords; represents a binary intermediate vector;

[0099] Step S24: Upload the ciphertext file and keyword index to the cloud server; that is, ensure that the data is protected using the Advanced Encryption Standard during transmission and stored to ensure the confidentiality and integrity of the information.

[0100] It can be explained that, To sample a random vector, in the matrix middle, is the secret matrix, and the binary intermediate vector The keyword is obtained after being processed by the hash function, so in the process of calculating the keyword index, Embed the keyword key through linear transformation and sample random vector Provide random masking to ensure that the overall structure conforms to the difficult LWE problem.

[0101] It can be understood that step S3 is the trapdoor generation part, which is recorded as , executed by the data user DU; among them, the generation of the keyword index part and the keyword trapdoor both meet post-quantum security. The subsequent cloud server processing can only obtain the inner product value of the two parts, and cannot obtain the keyword information, which improves the overall security of the data.

[0102] Furthermore, step S3 includes:

[0103] Step S31: Data users process keywords to generate keyword vectors, which are recorded as ; That is, the data user DU performs the same processing steps on the keyword based on step S22 to obtain the keyword vector.

[0104] Step S32: Determine the sampling random vector of the data user and the error vector of the sampling Gaussian distribution, and calculate the first intermediate value; to illustrate, the sampling random vector of the data user is , the error vector of the sampled Gaussian distribution is ,in, Indicates the dimension discrete Gaussian distribution of .

[0105] Furthermore, in step S32, the first intermediate value is calculated, and the corresponding calculation formula is:

[0106]

[0107] in, represents the first intermediate value; represents the sampling matrix in the keyword key; represents the transpose of the sampling matrix; A random vector representing the sampled data user; 、 Both represent modulus; represents the keyword vector; represents the error vector of the sampled Gaussian distribution; represents a set of integers; Represents the dimension of the keyword.

[0108] Make an explanation, represents a keyword vector, i.e., corresponds to the keyword in step S31 and generates a keyword vector therefrom; represents the noise term, represents the error vector of the sampled Gaussian distribution, whose randomness masks the keyword vector value.

[0109] Step S33: Integrate the first intermediate value and the sampled random vector of the data user to determine the second intermediate value, combine the keyword key to determine the third intermediate value, generate a keyword trapdoor based on the second intermediate value and the third intermediate value, and send it to the cloud server.

[0110] Furthermore, step S33 includes:

[0111] Step S331: Integrate the first intermediate value and the sampled random vector of the data user to determine the second intermediate value. The corresponding calculation formula is:

[0112]

[0113] in, represents the second median value; represents the first intermediate value; A random vector representing the sampled data user; represents a set of integers; Represents the modulus; , represents the dimension of the LWE problem, Dimensions representing keywords;

[0114] Step S332: Determine the third intermediate value in combination with the keyword key. The corresponding calculation formula is:

[0115]

[0116] in, represents the third median value; represents a sampled random vector in the keyword key;

[0117] Step S333: Generate a keyword trapdoor based on the second intermediate value and the third intermediate value. The corresponding calculation formula is:

[0118]

[0119] in, Represents a keyword trapdoor.

[0120] It can be understood that step S4 is the search algorithm, which is recorded as , executed by the cloud server.

[0121] Furthermore, step S4 includes:

[0122] Step S41: The cloud server parses the keyword trapdoor, calculates and outputs the result dimension.

[0123] Furthermore, in step S41, the result dimension is calculated and outputted, and the corresponding calculation formula is:

[0124]

[0125] in, Represents the outcome dimension; Indicates rounding operation; 、 Both represent modulus; represents the third median value; represents the second median value; Indicates the keyword index corresponding to the keyword trapdoor after parsing; Represents the inner product operation of two vectors; Represents a set of integers.

[0126] Step S42: Determine whether the result dimension is equal to the keyword dimension based on the result dimension. If the two are not equal, it means that the retrieval failed, and the data is returned to the data user, and it is determined that there is no matching result, and the retrieval process ends; if the two are equal, the ciphertext file is returned to the current user; that is, when the result dimension successfully matches the keyword dimension, the ciphertext file is returned to the current user for subsequent decryption operations.

[0127] It can be understood that step S5 is the decryption part, which is recorded as , executed by the data user DU; that is, after the current user receives the ciphertext file returned by the cloud server, he uses the symmetric random key to decrypt the ciphertext file to obtain the plaintext file corresponding to the keyword.

[0128] For better explanation, to verify the correctness of the matching between the result dimension and the keyword dimension, based on the intermediate vector and keyword vectors To explain, ,Sure:

[0129]

[0130] Based on this formula, the left and right sides are determined respectively. The left side is , on the right , and then simplified to: ; Further simplification gives: .

[0131] The resulting dimensions are: ;

[0132] when When choosing appropriate parameters 、 、 Meet the error condition ,at this time, ; Due to the intermediate vector and keyword vectors They are generated through the same steps and methods, and are , so ,and then .

[0133] It can be understood that in the new symmetric searchable encryption method provided by the present application, whether the search algorithm keyword matches is determined by calculating the vector inner product value of the keyword index and the keyword trapdoor, and the operating efficiency is high. That is, in this process, the cloud server cannot obtain the specific information of the keyword, and only searches the uploaded file through the keyword of the encrypted file. The information encryption degree is high, which prevents the leakage of data and keyword information; and the security of the keyword index and keyword trapdoor is based on the LWE problem, and the calculation mainly involves the product operation of the matrix and the vector, and the operating efficiency is much higher than the public key searchable encryption method; then, the cloud server verifies whether the keyword index and the keyword trapdoor match by calculating the vector inner product value, and performs corresponding technical operations according to the matching results, which can provide post-quantum security.

[0134] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0135] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A symmetric searchable encryption method based on the LWE problem that meets post-quantum security, characterized by: The cloud server, the data owner, and the data user are obtained respectively, and the method includes: Determine keywords based on any file, unify the keyword dimensions, and process the keywords through the data owner to generate symmetric random keys and keyword keys, including: Input security parameters and generate a symmetric random key based on a pseudo-random number generator by the data owner; Get a set of integers and determine the discrete Gaussian distribution of any integer in the set. The corresponding calculation formula is: ； in, Indicates that the parameter is Integer discrete Gaussian distribution of ; 、 All represent integers; Represents parameters; represents a set of integers; The data owner chooses the integer parameter 、 、 and ,in, Represents the modulus; Represents the dimension of the LWE problem; Represents the dimension of keywords; defines ,make , a random vector of samples from the data owner , and in Sampling Matrix , returns the keyword key ; Determine the sampling random vector and sampling matrix of the data owner through random distribution and discrete Gaussian distribution respectively to generate the keyword key; Obtain the plaintext file and the corresponding keyword, encrypt the plaintext file using a symmetric random key to obtain the ciphertext file, process the corresponding keyword to generate a binary intermediate vector, combine the keyword key to generate a keyword index, and upload the ciphertext file and keyword index to the cloud server, including: Use a symmetric random key to encrypt the plaintext file through a symmetric encryption algorithm to obtain a ciphertext file; Obtain the hash function, determine the loop variable, and process the corresponding keyword to generate a binary intermediate vector; The steps of obtaining a hash function, determining a loop variable, and processing the corresponding keyword to generate a binary intermediate vector include: Keyword-based dimensions , the default value is 1 dimensional vector, denoted as ; Determine the loop variable, record it as counter, and let its value increase from 1 to , calculate the positive integer, the corresponding calculation formula is: ； in, represents a positive integer; represents a hash function; Indicates keywords; Represents the loop variable; Dimensions representing keywords; Based on positive integers, the vector The corresponding The position is recorded as -1, and repeated through the loop variable times, generate the binary intermediate vector of the keyword, recorded as ; The keyword index is obtained using the keyword key. The corresponding calculation formula is: ； in, Indicates keyword index; represents a sampled random vector in the keyword key; , Represents the dimension The identity matrix, represents the sampling matrix in the keyword key; Represents the modulus; , represents the dimension of the LWE problem, Dimensions representing keywords; represents a binary intermediate vector; Upload the ciphertext files and keyword indexes to the cloud server; The data user processes the keywords to generate keyword vectors, determines keyword traps based on the keyword vectors, and sends them to the cloud server, including: The keyword vector is generated by processing the keyword by the data user, which is recorded as ; Determine a sampling random vector of a data user and an error vector of a sampling Gaussian distribution, and calculate a first intermediate value; Integrate the first intermediate value and the sampled random vector of the data user to determine the second intermediate value, combine it with the keyword key to determine the third intermediate value, generate a keyword trapdoor based on the second intermediate value and the third intermediate value, and send it to the cloud server; The cloud server searches through the keyword index to obtain matching results. If a match is successful, the encrypted file is returned to the current user, including: The cloud server parses the keyword trapdoor, calculates and outputs the resulting dimension; Based on the result dimension, determine whether it is equal to the keyword dimension. If the two are not equal, it means the search has failed and the data user is returned to confirm that there is no matching result, ending the search process. If the two are equal, the encrypted file is returned to the current user. The current user decrypts the ciphertext file using the symmetric random key to obtain the corresponding plaintext file.

2. The symmetric searchable encryption method based on the LWE problem that satisfies post-quantum security according to claim 1, characterized in that: Determine the sampling random vector of the data user and the error vector of the sampling Gaussian distribution, and calculate the first intermediate value. The corresponding calculation formula is: ； in, represents the first intermediate value; represents the sampling matrix in the keyword key; represents the transpose of the sampling matrix; A random vector representing the sampled data user; 、 Both represent modulus; represents the keyword vector; represents the error vector of the sampled Gaussian distribution; represents a set of integers; Represents the dimension of the keyword.

3. The symmetric searchable encryption method based on the LWE problem that satisfies post-quantum security according to claim 2, characterized in that: Integrate the first intermediate value and the sampled random vector of the data user to determine the second intermediate value, combine the keyword key to determine the third intermediate value, generate a keyword trapdoor based on the second intermediate value and the third intermediate value, and send it to the cloud server, including: The first intermediate value and the sampled random vector of the data user are integrated to determine the second intermediate value. The corresponding calculation formula is: ； in, represents the second median value; represents the first intermediate value; A random vector representing the sampled data user; represents a set of integers; Represents the modulus; , represents the dimension of the LWE problem, Dimensions representing keywords; The third intermediate value is determined by combining the keyword key. The corresponding calculation formula is: ； in, represents the third median value; represents a sampled random vector in the keyword key; Generate a keyword trapdoor based on the second and third intermediate values. The corresponding calculation formula is: ； in, Represents a keyword trapdoor.

4. The symmetric searchable encryption method based on the LWE problem that satisfies post-quantum security according to claim 1, characterized in that: Calculate and output the result dimension. The corresponding calculation formula is: ； in, Represents the outcome dimension; Indicates rounding operation; 、 Both represent modulus; represents the third median value; represents the second median value; Indicates the keyword index corresponding to the keyword trapdoor after parsing; Represents the inner product operation of two vectors; Represents a set of integers.

Images