Searchable encryption management method and device, storage medium and electronic equipment

Abstract

The invention provides a searchable encryption management method and device, a storage medium and electronic equipment, and relates to the technical field of database encryption access. Determining a database operation required by the proxy server and target data required to be operated based on the target data request; the target equipment is any one of a cloud server and user equipment; executing a data operation corresponding to the database operation on the target data based on the keyword of the target data; wherein the database operation comprises any one of the following operations: data initialization operation, data query operation, data addition operation, data deletion operation and data updating operation. The searchable encryption management method and device, the storage medium and the electronic equipment provided by the invention are used for improving the calculation performance, the security and the access efficiency of searchable encryption.

Description

Technical Field

[0001] This application relates to the technical field of database encrypted access, and particularly to a searchable encryption management method, device, storage medium, and electronic device. Background Art

[0002] Searchable Encryption (SE) is a technology that allows users to perform search operations on encrypted data while ensuring the privacy and security of the data in the un-decrypted state. Searchable encryption has important applications in protecting sensitive data (such as medical records, financial information, etc.) and supporting efficient query operations.

[0003] Searchable encryption can be classified into single-user searchable encryption and multi-user searchable encryption according to the key management method. The single-user searchable encryption scheme is simple and efficient. It usually uses symmetric keys for encryption and decryption, with small computational overhead, simple algorithms, and fast speed, but it is limited to single-user access. The multi-user searchable encryption supports fine-grained access control and allows multiple users to access encrypted data. However, since the operations involving public keys and private keys are usually more complex and time-consuming than symmetric key operations, the encryption and retrieval efficiency of this scheme is relatively low.

[0004] Based on this, there is an urgent need for a simple and efficient searchable encryption scheme to improve the computational performance, security, and access efficiency of searchable encryption. Summary of the Invention

[0005] The purpose of this application is to provide a searchable encryption management method, device, storage medium, and electronic device, which are used to improve the computational performance, security, and access efficiency of searchable encryption.

[0006] This application provides a searchable encryption management method, including: Receive a target data request sent by a target device, and determine, based on the target data request, the database operation that the proxy server needs to perform and the target data for which the operation needs to be performed; the target device is either a cloud server or a user device; perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored on each cloud server.

[0007] In this way, the proxy server can efficiently manage the encrypted data stored on each cloud server, greatly reducing the computational complexity.

[0008] Optionally, the database operation is: a data initialization operation initiated by a target cloud server; the target cloud server is any one of the multiple cloud servers; the performing, on the target data, a data operation corresponding to the database operation based on the keywords of the target data includes: using a preset keyword extraction algorithm to extract the keywords corresponding to each plaintext data in the multiple plaintext data included in the target data, and generating a first data pair; the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; based on the target key and the target counter generated by the proxy server, using the reserved format encryption algorithm to generate the ciphertext data corresponding to each plaintext data, and at the same time, using the Bloom filter generation algorithm with the keyword set corresponding to each plaintext data as the input to generate the Bloom filter corresponding to each plaintext data, and obtaining a second data pair corresponding to each data; the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the multiple plaintext data; sequentially storing the second data pair of each plaintext data as encrypted data into the target cloud server, and storing the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server into the proxy server.

[0009] In this way, after the proxy server completes the initialization operation of the data and stores the encrypted data on each cloud server, it is convenient to perform operations such as querying, adding, deleting, and updating the encrypted data stored on each cloud server in the subsequent process.

[0010] Optionally, the database operation is: a data query operation initiated by the target user device; the data operation corresponding to the database operation performed on the target data based on the keyword of the target data includes: obtaining a first keyword included in the data requested to be queried by the user device, and using the Bloom filter generation algorithm to generate a query vector corresponding to the first keyword with the first keyword as input; the query vector is: a multi-dimensional binary vector; sending the query vector to each cloud server respectively, and receiving the query data returned by the target cloud server; based on the row number of each data and the data encryption and decryption key corresponding to the target cloud server, using the decryption algorithm corresponding to the reserved format encryption algorithm to decrypt the encrypted data in the query data to obtain the plaintext data, and sending the plaintext data to the user device; wherein, the target cloud server is the cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; the query data includes: among the multiple encrypted data stored in the target cloud server, at least one encrypted data whose Bloom filter matches the query vector.

[0011] In this way, the user can retrieve according to the keyword, and conveniently, quickly and securely find the required information from multiple cloud servers.

[0012] Optionally, the database operation is: a data addition operation initiated by the target user device; the data operation corresponding to the database operation performed on the target data based on the keyword of the target data includes: obtaining at least one data added to the target cloud server, and using a preset keyword extraction algorithm to extract the keyword corresponding to each plaintext data in the at least one data to generate a third data pair; the third data pair includes: plaintext data and the corresponding keyword set; each plaintext data corresponds to at least one keyword; based on the data encryption and decryption key and the data counter of the target cloud server, using the reserved format encryption algorithm to generate the ciphertext data corresponding to each plaintext data, and at the same time, using the Bloom filter generation algorithm to generate the Bloom filter corresponding to each plaintext data with the keyword set corresponding to each plaintext data as input, and obtaining the fourth data pair corresponding to each data; the fourth data pair includes: ciphertext data and the corresponding Bloom filter; after storing the encrypted data in the target cloud server, sequentially storing the fourth data pair of each plaintext data as encrypted data into the target cloud server in order.

[0013] In this way, after the proxy server adds the encrypted data to the encrypted data stored in the corresponding cloud server, since no operation is performed on the already stored encrypted data, it is more convenient and faster.

[0014] Optionally, the database operation is: a data deletion operation initiated by the target user device; the data operation corresponding to the database operation performed on the target data based on the keywords of the target data includes: obtaining a second keyword included in the data requested to be deleted by the user device, and using the second keyword as, generating a deletion vector using the Bloom filter generation algorithm; the deletion vector is: a multi-dimensional binary vector; sending the deletion vector to each cloud server respectively; wherein, the target cloud server is the cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter in the multiple encrypted data stored in the target cloud server that matches the deletion vector to 0.

[0015] In this way, when performing the data deletion operation, since the data to be deleted is directly overwritten with random numbers, the integrity of the data will not be damaged, and the execution efficiency of the deletion operation is very high.

[0016] Optionally, the database operation is: a data update operation jointly performed by the proxy server and the cloud server; the data operation corresponding to the database operation performed on the target data based on the keywords of the target data includes: obtaining a plurality of ciphertext data sent by the target cloud server and the old key corresponding to the target cloud server; generating a new key and a new counter corresponding to the target cloud server, and decrypting the plurality of ciphertext data using the old key; the target cloud server is the cloud server among the multiple cloud servers that needs to perform data update; when decrypting, if the Bloom filter of the encrypted data is a null value, set the plaintext data of the encrypted data to a null value; if the current plaintext data is not a null value, encrypt the current plaintext data using the reserved format encryption algorithm based on the new key, and use the keyword set corresponding to the current plaintext data as input, generate a Bloom filter corresponding to the current plaintext data using the Bloom filter generation algorithm, and update the new counter; sequentially store the encrypted data of each plaintext data into the target cloud server, and store the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

[0017] Thus, when a large amount of data is deleted, these data still occupy storage space and affect the retrieval efficiency. At the same time, to improve data security, it is necessary to regularly update the data, realizing re-encryption of the data while deleting useless data.

[0018] Optionally, the Bloom filter generation algorithm includes: initializing a line number counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent multiple parameter values corresponding to the line number of each line of data; the dimension of the multi-dimensional binary vector is the same as the number of lines of data stored on the cloud server; the number of parameter values corresponding to the line number of each line of data is the same as the number of keywords of the ciphertext data corresponding to the line number; sequentially inputting the value of the current line number counter and the currently calculated keyword into the multiple hash functions for OR operation to obtain a result value corresponding to each hash function; the value of the line number counter is obtained by cumulative calculation based on the line number of each line of data; after adjusting the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm, a vector composed of multiple parameter values corresponding to each line number is obtained; wherein, the preset assignment algorithm includes: if among the multiple parameter values corresponding to the line number, there is a target parameter value whose parameter value number is the same as the result value corresponding to any one of the multiple hash functions and the parameter value is 0, then assign the target parameter value to 1.

[0019] Thus, by using the above Bloom filter generation algorithm, the encrypted data corresponding to the plaintext data can be quickly calculated, greatly improving the execution efficiency of operations such as data query, addition, deletion, and update.

[0020] The present application further provides a searchable encryption management device, including: A receiving module, configured to receive a target data request sent by a target device; a determining module, configured to determine, based on the target data request, database operations that the proxy server needs to perform and target data on which operations need to be performed; the target device being any one of a cloud server and a user device; a data operation module, configured to perform data operations corresponding to the database operations on the target data based on keywords of the target data; wherein the database operations include any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores: data encryption and decryption keys for each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored on each cloud server.

[0021] Optionally, the database operation is: a data initialization operation initiated by a target cloud server; the target cloud server being any one of the multiple cloud servers; the data operation module is specifically configured to use a preset keyword extraction algorithm to extract keywords corresponding to each plaintext data in multiple plaintext data included in the target data, and generate a first data pair; the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module is further specifically configured to generate ciphertext data corresponding to each plaintext data based on a target key and a target counter generated by the proxy server using a reserved format encryption algorithm, and at the same time, use the Bloom filter generation algorithm with the keyword set corresponding to each plaintext data as input to generate a Bloom filter corresponding to each plaintext data, and obtain a second data pair corresponding to each data; the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the multiple plaintext data; the data operation module is further specifically configured to sequentially store the second data pair of each plaintext data as encrypted data into the target cloud server, and store the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server into the proxy server.

[0022] Optionally, the database operation is a data query operation initiated by a target user device; the data operation module is specifically configured to obtain a first keyword included in the data requested to be queried by the user device, and use the Bloom filter generation algorithm to generate a query vector corresponding to the first keyword with the first keyword as the input; the query vector is a multi-dimensional binary vector; the receiving module is further configured to send the query vector to each cloud server respectively, and receive query data returned by the target cloud server; the data operation module is specifically further configured to decrypt the encrypted data in the query data using a decryption algorithm corresponding to the reserved format encryption algorithm based on the row number of each data and the data encryption and decryption key corresponding to the target cloud server to obtain plaintext data, and send the plaintext data to the user device; wherein, the target cloud server is a cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; the query data includes at least one encrypted data among the multiple encrypted data stored in the target cloud server whose Bloom filter matches the query vector.

[0023] Optionally, the database operation is a data addition operation initiated by a target user device; the data operation module is specifically configured to obtain at least one data added to the target cloud server, and use a preset keyword extraction algorithm to extract keywords corresponding to each plaintext data in the at least one data to generate a third data pair; the third data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module is specifically further configured to generate ciphertext data corresponding to each plaintext data using the reserved format encryption algorithm based on the data encryption and decryption key and data counter of the target cloud server, and at the same time, use the Bloom filter generation algorithm to generate a Bloom filter corresponding to each plaintext data with the keyword set corresponding to each plaintext data as the input, and obtain a fourth data pair corresponding to each data; the fourth data pair includes: ciphertext data and a corresponding Bloom filter; the data operation module is specifically further configured to sequentially store the fourth data pair of each plaintext data as encrypted data into the target cloud server after the encrypted data stored in the target cloud server.

[0024] Optionally, the database operation is a data deletion operation initiated by the target user device; the data operation module is specifically configured to obtain a second keyword included in the data requested to be deleted by the user device, and use the second keyword as an input to generate a deletion vector using the Bloom filter generation algorithm; the deletion vector is a multi-dimensional binary vector; the data operation module is further specifically configured to send the deletion vector to each cloud server respectively; wherein, the target cloud server is a cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter in the multiple encrypted data stored in the target cloud server that matches the deletion vector to 0.

[0025] Optionally, the database operation is a data update operation jointly executed by the proxy server and the cloud server; the data operation module is specifically configured to obtain a plurality of ciphertext data sent by the target cloud server and the old key corresponding to the target cloud server; the data operation module is further specifically configured to generate a new key and a new counter corresponding to the target cloud server, and decrypt the plurality of ciphertext data using the old key; the target cloud server is a cloud server among the multiple cloud servers that needs to perform data update; when decrypting, if the Bloom filter of the encrypted data is a null value, the plaintext data of the encrypted data is set to a null value; the data operation module is further specifically configured to, if the current plaintext data is not a null value, encrypt the current plaintext data using the reserved format encryption algorithm based on the new key, and use the Bloom filter generation algorithm with the keyword set corresponding to the current plaintext data as an input to generate a Bloom filter corresponding to the current plaintext data, and update the new counter; the data operation module is further specifically configured to sequentially store the encrypted data of each plaintext data into the target cloud server, and store the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

[0026] Optionally, the data operation module is specifically configured to initialize a line number counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent multiple parameter values corresponding to the line number of each line of data; the dimension of the multi-dimensional binary vector is the same as the number of lines of data stored on the cloud server; the number of parameter values corresponding to the line number of each line of data is the same as the number of keywords in the ciphertext data corresponding to the line number; the data operation module is further specifically configured to sequentially input the value of the current line number counter and the currently calculated keyword into the multiple hash functions for OR operation to obtain a result value corresponding to each hash function; the value of the line number counter is obtained by cumulative calculation based on the line number of each line of data; the data operation module is further specifically configured to adjust the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm to obtain a vector composed of multiple parameter values corresponding to each line number; wherein, the preset assignment algorithm includes: if there is a target parameter value in the multiple parameter values corresponding to the line number, the parameter value number of which is the same as the result value corresponding to any one of the multiple hash functions and the parameter value is 0, then assign the target parameter value to 1.

[0027] The present application also provides a computer program product, including a computer program / instructions, which when executed by a processor, implement the steps of the searchable encryption management method as described in any one of the above.

[0028] The present application also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the steps of the searchable encryption management method as described in any one of the above.

[0029] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the searchable encryption management method as described in any one of the above.

[0030] The searchable encryption management method, device, storage medium and electronic device provided by this application are applied to the proxy server in the searchable encryption management system. The searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device. First, receive a target data request sent by a target device, and determine the database operation that the proxy server needs to perform and the target data to be operated on based on the target data request; the target device is any one of the cloud server and the user device; then, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates the encrypted data stored on each cloud server among the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in this application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of this application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0032] Figure 1 It is a schematic diagram of the system architecture of the searchable encryption management system provided by this application; Figure 2 It is a schematic flowchart of the searchable encryption management method provided by this application; Figure 3 It is a schematic diagram of the structure of the searchable encryption management device provided by this application; Figure 4 It is a schematic diagram of the structure of the electronic device provided by this application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0033] To make the objectives, technical solutions and advantages of this application more clear, the following will, in conjunction with the accompanying drawings in this application, clearly and completely describe the technical solutions in this application. Obviously, the described embodiments are some, but not all, of the embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without creative efforts shall fall within the scope of protection of this application.

[0034] The terms "first", "second", etc. in the description and claims of this application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such used data may be interchanged under appropriate circumstances so that the embodiments of this application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc., generally belong to the same category, and the number of objects is not limited. For example, the first object may be one or multiple. In addition, "and / or" in the description and claims means at least one of the connected objects, and the character " / ", generally represents an "or" relationship between the associated objects before and after.

[0035] The searchable encryption schemes in the related art mainly have the following technical problems: ①. Performance problems: Searchable encryption schemes that support complex functions often need to use homomorphic encryption, public key cryptography, etc., which usually involve complex cryptographic operations and have low efficiency. ②. Complex user management: In searchable encryption schemes, how to perform access control on users is a key issue. Especially in a multi-user environment, fine-grained access authorization needs to be implemented to ensure the secure sharing and retrieval of data. ③. Security problems: Many public key searchable encryption schemes still fail to effectively address the potential threat of keyword guessing attacks. An attacker may efficiently recover the query keyword by using the known keywords and observing the number of encrypted files returned by the search results. ④. Limited query functions: Many schemes sacrifice efficiency or security to improve the query expression ability, and it is difficult to achieve a balance between the diversity of query functions and efficiency or security.

[0036] In response to the above technical problems existing in the related art, as Figure 1 shown, the embodiments of this application provide a searchable encryption management system, which includes: a proxy server, a cloud server for storing encrypted data, and a user device. The cloud server is used to store the encrypted data of the database and feedback the data operation requests of the proxy server (the proxy server is a trusted proxy server). The proxy server completes operations such as initialization, query, addition, deletion, and update of the data in the database through communication with the cloud server, and manages the multi-user access rights using the access control policy. The user device accesses the database through the proxy server to obtain the required services.

[0037] The following will combine the accompanying drawings and, through specific embodiments and their application scenarios, elaborate in detail on the searchable encryption management method provided by the embodiments of the present application.

[0038] As Figure 2 shown, a searchable encryption management method provided by an embodiment of the present application may include the following steps 201 and 203: Step 201, receive a target data request sent by a target device, and determine, based on the target data request, the database operation that the proxy server needs to perform and the target data for which the operation needs to be performed.

[0039] Wherein, the target device is either a cloud server or a user device.

[0040] It can be understood that in the embodiments of the present application, the database operation includes any one of the following: a data initialization operation jointly executed by the cloud server and the proxy server, a data query operation jointly executed by the user device, the proxy server, and the cloud server, a data addition operation jointly executed by the user device, the proxy server, and the cloud server, a data deletion operation jointly executed by the user device, the proxy server, and the cloud server, and a data update operation jointly executed by the proxy server and the cloud server.

[0041] Exemplarily, the above data initialization operation is mainly used to encrypt plaintext data and then store the ciphertext data in the cloud server; the above data query operation is mainly used for the user device to query the encrypted data stored in the cloud server through the proxy server; the above data addition operation is mainly used to add ciphertext data to the cloud server; the above data deletion operation is mainly used to delete the ciphertext data in the cloud server; the above data update operation is mainly used to clear the ciphertext data that has been deleted in the cloud server to improve the utilization rate of the storage space.

[0042] Step 202, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data.

[0043] Wherein, the proxy server communicates with multiple cloud servers, and the proxy server generates the encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the multiple ciphertext data are: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0044] Exemplarily, in the embodiments of the present application, data storage and query are mainly performed through a Bloom filter generated from keywords. The keywords are obtained by extracting keywords from plaintext data or provided by the user device when deleting data; the Bloom filter is generated by the Bloom filter generation algorithm provided in the embodiments of the present application. The Bloom filter generation algorithm mainly uses the input keywords and multiple hash functions generated based on the reserved format encryption algorithm used by the proxy server to obtain the corresponding Bloom filter.

[0045] It should be noted that a Bloom filter (BF) is a probabilistic data structure with extremely high space efficiency and can be used to test whether an element is a member of a set. When the BF determines that an element is in the set, there is a certain false positive rate, and when the BF determines that an element is not in the set, then the element must not be in the set. The false positive probability of the Bloom filter , where represents the number of data stored in the Bloom filter (corresponding to each data item's number of keywords in this solution), represents the length of the Bloom filter, represents the number of hash functions.

[0046] Optionally, the above database operation may be: a data initialization operation initiated by the target cloud server; the target cloud server is any one of the multiple cloud servers.

[0047] Specifically, step 202 may further include the following steps 202a1 to 202a3: Step 202a1: Use a preset keyword extraction algorithm to extract the keyword corresponding to each plaintext data in the multiple plaintext data included in the target data, and generate a first data pair.

[0048] Wherein, the first data pair includes: plaintext data and the corresponding keyword set; each plaintext data corresponds to at least one keyword.

[0049] Step 202a2: Based on the target key and the target counter generated by the proxy server, use the reserved format encryption algorithm to generate the ciphertext data corresponding to each plaintext data. At the same time, use the Bloom filter generation algorithm with the keyword set corresponding to each plaintext data as the input to generate the Bloom filter corresponding to each plaintext data, and obtain the second data pair corresponding to each data.

[0050] Wherein, the second data pair includes: ciphertext data and the corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the multiple plaintext data.

[0051] Step 202a3: Store the second data pair of each plaintext data in the target cloud server in sequence, and store the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server in the proxy server.

[0052] For example, the proxy server completes data initialization and stores the ciphertext data in the cloud server. The specific steps are as follows: ①. Suppose there are pieces of data in the database of the cloud server, denoted as (i.e., the above-mentioned multiple plaintext data).

[0053] ②. The proxy server extracts the keywords of each piece of data in sequence through the keyword extraction algorithm to generate data-keyword set pairs (i.e., the above-mentioned first data pairs), and each data pair is denoted as . Among them, represents the keyword set , represents the number of keywords extracted from the data .

[0054] It should be noted that there are many ways to extract keywords, such as rule-based, word segmentation, machine learning, etc. The specific extraction algorithm is determined by the actual application scenario.

[0055] ③. The proxy server selects the format-preserving encryption algorithm and the corresponding decryption algorithm to generate the hash functions (i.e., the above-mentioned multiple hash functions) of the Bloom filter. The output space of the hash functions is all , where represents the vector length of the Bloom filter.

[0056] ④. The proxy server generates the data encryption and decryption key and the data counter , as well as the keyword counter for processing keywords.

[0057] ⑤. For any plaintext data , the proxy server encrypts it using the format-preserving encryption algorithm, and the corresponding ciphertext data is denoted as , that is, , where . The initial value of COUNTER is the random number generated together with KEY in step ④.

[0058] ⑥. For any plaintext data , the keyword set extracted by the keyword extraction algorithm is: , the proxy server uses the Bloom filter generation algorithm to generate the Bloom filter The specific process is as follows: a. Initialization vector dimensional binary vector .

[0059] b. For each keyword in the plaintext data , , calculate in sequence ,in .like , then let ,in .

[0060] ⑦、Compare the Bloom filter with the plaintext data Stored sequentially in the cloud server, the number of rows corresponding to each row of data is The Bloom filter and the plaintext data pair is the second data pair mentioned above.

[0061] ⑧. The proxy server stores data encryption and decryption keys , data counter , keyword counter And the total number of data .

[0062] It should be noted that data can be stored in multiple cloud servers, and only a counter needs to be set for each server. And stored in the proxy server.

[0063] Optionally, the above database operation may also be: a data query operation initiated by the target user equipment.

[0064] Specifically, the above step 202 may further include the following steps 202b1 to 202b3: Step 202b1: Obtain a first keyword contained in the data requested by the user equipment for query, and generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm based on the first keyword and the multiple hash functions.

[0065] Wherein, the query vector is: a multi-dimensional binary vector.

[0066] Step 202b2: Send the query vector to each cloud server respectively, and receive query data returned by the target cloud server.

[0067] Step 202b3: Based on the line number of each data and the data encryption and decryption key corresponding to the target cloud server, use the decryption algorithm corresponding to the reserved format encryption algorithm to decrypt the encrypted data in the query data to obtain the plaintext data, and send the plaintext data to the user device; Among them, the target cloud server is the cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; the query data includes: among the multiple encrypted data stored in the target cloud server, at least one encrypted data whose Bloom filter matches the query vector.

[0068] For example, the user device completes the query of encrypted data through the proxy server, and the specific steps are as follows: ①. Let the keyword queried by the user be (i.e., the above first keyword), and send to the proxy server.

[0069] ②. The proxy server generates a query vector according to , and the specific process is as follows: a. Initialize the vector -dimensional binary vector .

[0070] b. For the input target keyword, it is necessary to calculate in sequence, where . If , then let , where .

[0071] c. Send (i.e., the query vector corresponding to the first keyword, where the query vector contains multiple vectors, and the total number of vectors is the same as the total number of ciphertext data stored on the target cloud server) to the cloud server.

[0072] d. The cloud server retrieves the ciphertext database. If , then return the data to the proxy server.

[0073] e. Let the proxy server receive the data returned by the cloud server, where represents the total number of returned data. The proxy server decrypts each piece of data in sequence , where . And send the decrypted data to the user.

[0074] It should be noted that the proxy server can send a fixed number of retrieval vectors to the cloud server each time until the required retrieval information is obtained. Retrieval can be performed on multiple cloud servers simultaneously. When retrieving each server, the counter used for decrypting the returned data is the counter corresponding to that server. Multi-keyword retrieval is supported, and keyword logical operations are also supported. For example, when retrieving data that simultaneously contains keyword and , retrieval vectors are generated separately according to the keywords and , calculate , and use for retrieval.

[0075] Optionally, the above database operation can also be: a data addition operation initiated by the target user device.

[0076] Specifically, the above step 202 can further include the following steps 202c1 to 202c3: Step 202c1: Obtain at least one piece of data newly added to the target cloud server, and use a preset keyword extraction algorithm to extract the keywords corresponding to each plaintext data in the at least one piece of data, generating a third data pair.

[0077] Among them, the third data pair includes: plaintext data and the corresponding keyword set, and each plaintext data corresponds to at least one keyword.

[0078] Step 202c2: Based on the data encryption and decryption key and data counter of the target cloud server, use a reserved format encryption algorithm to generate the ciphertext data corresponding to each plaintext data. At the same time, taking the keyword set corresponding to each plaintext data as input, use the Bloom filter generation algorithm to generate the Bloom filter corresponding to each plaintext data, and obtain the fourth data pair corresponding to each data.

[0079] Among them, the fourth data pair includes: ciphertext data and the corresponding Bloom filter.

[0080] Step 202c3: After storing the encrypted data in the target cloud server, sequentially store the fourth data pair of each plaintext data as encrypted data into the target cloud server in order.

[0081] For example, the user device completes the data addition operation through the proxy server. Similar to the data initialization process, the difference is that the data addition operation adds the ciphertext data to the back of the existing ciphertext database. The specific process is as follows: ①. Assume that the user adds pieces of data (i.e., the above at least one piece of data) to the database, denoted as .

[0082] ②. The proxy server extracts the keywords of each piece of data in sequence through the keyword extraction algorithm, generates a data-keyword set pair (i.e., the above-mentioned third data pair), and records it as , where represents the keyword set , represents the number of keywords extracted from the data .

[0083] ③. For any data , the proxy server encrypts it using the reserved format encryption algorithm, and records the corresponding ciphertext as , that is , where , where is the number of data currently stored in the cloud server.

[0084] ④. For any data , the corresponding keyword set extracted through the preset keyword extraction algorithm is , and the proxy service generates a Bloom filter using the Bloom filter generation algorithm. The specific process is as follows: a. Initialize the vector - dimensional binary vector ; b. For each keyword , , calculate in sequence, where . If , then let , where .

[0085] ⑤. Add the data ciphertext and the Bloom filter pair to the cloud server in sequence. The line number corresponding to each line of data is .

[0086] It should be noted that data updates can be completed in parallel on multiple cloud servers. When updating each server, only the counter corresponding to that server needs to be used respectively.

[0087] Optionally, the above database operation can also be: a data deletion operation initiated by the target user device.

[0088] Specifically, step 202 above can further include the following step 202d1 and step 202d2: Step 202d1. Obtain the second keyword included in the data requested to be deleted by the user device, and use the second keyword as, and generate a deletion vector using the Bloom filter generation algorithm.

[0089] Among them, the deletion vector is: a multi-dimensional binary vector.

[0090] Step 202d2: Send the deletion vector to each cloud server respectively.

[0091] Among them, the target cloud server is the cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter in the multiple encrypted data stored in the target cloud server that matches the deletion vector to 0.

[0092] For example, the user device completes the data deletion operation through the proxy server. Similar to the data query process, the difference is that when deleting data, the queried data is overwritten with random data. The specific process is as follows: ①. Suppose the user requests to delete the data containing the keyword , and send to the proxy server.

[0093] ②. The proxy server generates a query vector according to . The specific process is as follows: a. Initialize the vector multi-dimensional binary vector .

[0094] b. Calculate in sequence, where . If , then let , where .

[0095] c. Send to the cloud server.

[0096] d. The cloud server retrieves the ciphertext database. If , then set to an all-zero vector, and overwrite the data with random data in the same format.

[0097] It should be noted that data deletion operations can be performed on multiple cloud servers simultaneously. When deleting data on each server, the corresponding server's counter is used to generate the retrieval vector. Multi-keyword deletion is supported, and keyword logical operations are supported. For example, to delete data that simultaneously contains keywords and , retrieval vectors and are generated according to the keywords respectively, calculate , and send to the cloud server for deletion operation.

[0098] Optionally, after data deletion, the deleted data is filled with random numbers. When there is a large amount of deleted data, these data still occupy storage space and affect retrieval efficiency. At the same time, to improve data security, it is necessary to regularly update the data, implement re-encryption of the data, and delete useless data.

[0099] Specifically, step 202 may further include the following steps 202e1 to 202e4: Step 202e1: Obtain multiple ciphertext data sent by the target cloud server and the old key corresponding to the target cloud server.

[0100] Step 202e2: Generate a new key and a new counter corresponding to the target cloud server, and decrypt the multiple ciphertext data using the old key.

[0101] Wherein, the target cloud server is the cloud server that needs to update data among the multiple cloud servers; when decrypting, if the Bloom filter of the encrypted data is a null value, the plaintext data of the encrypted data is set to a null value.

[0102] Step 202e3: If the current plaintext data is not a null value, encrypt the current plaintext data using the reserved format encryption algorithm based on the new key, and use the Bloom filter generation algorithm to generate the Bloom filter corresponding to the current plaintext data with the keyword set corresponding to the current plaintext data as the input, and update the new counter.

[0103] Step 202e4: Store the encrypted data of each plaintext data into the target cloud server in sequence, and store the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

[0104] For example, data update is completed by the proxy server and the cloud server, and the specific process is as follows: ①. The proxy server generates a new data encryption and decryption key and a data counter , and a counter for processing keywords , and let .

[0105] ②. The cloud server sequentially sends all data ciphertexts (if , then set to NULL and then send) to the proxy server.

[0106] ③. For the data , the proxy server decrypts it using the reserved format encryption algorithm, encrypts it using the new key and counter, and generates a new Bloom filter. The specific process is as follows: For to , calculate a. Initialize the vector dimensional binary vector .

[0107] b. For each keyword , , calculate . If , then let , where .

[0108] c. Update the new keyword counter .

[0109] ④. Store the updated data ciphertext and the Bloom filter pair sequentially in the cloud server in order. The line number corresponding to each line of data is .

[0110] ⑤. The proxy server stores the new data encryption and decryption key and the data counter , as well as the total number of data .

[0111] It should be noted that the data stored in multiple cloud servers can be updated simultaneously. Just generate new keys and counters for each server separately.

[0112] The searchable encryption management method provided by the embodiments of this application uses a proxy server to complete the searchable encryption of the database. A user access control mechanism is deployed on the proxy server, and multi-user searchable encryption can be achieved. The data ciphertext is stored in the cloud server. Due to the use of the reserved format encryption scheme, database encryption can be achieved without modifying the database. The Bloom filter is used to store keyword information, and combined with the keyword extraction strategy, fuzzy searchable is achieved. Multi-keyword queries are supported, and keyword logical operation queries are supported.

[0113] The searchable encryption management method provided by the embodiment of the present application is applied to a proxy server in a searchable encryption management system. The searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device. First, receive a target data request sent by a target device, and determine the database operation that the proxy server needs to perform and the target data to be operated on based on the target data request; the target device is any one of the cloud server and the user device; then, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates the encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0114] It should be noted that for the searchable encryption management method provided by the embodiment of the present application, the execution subject can be a searchable encryption management device, or a control module in the searchable encryption management device for executing the searchable encryption management method. In the embodiment of the present application, the case where the searchable encryption management device executes the searchable encryption management method is taken as an example to illustrate the searchable encryption management device provided by the embodiment of the present application.

[0115] It should be noted that in the embodiment of the present application, the searchable encryption management methods shown in the above respective method drawings are all exemplarily illustrated by taking one drawing in the embodiment of the present application as an example. Specifically, when implemented, the searchable encryption management methods shown in the above respective method drawings can also be implemented in combination with any other combinable drawings schemed in the above embodiments, which will not be elaborated here.

[0116] The searchable encryption management device provided by the present application will be described below, and the following description can be mutually referred to corresponding to the searchable encryption management method described above.

[0117] Figure 3 The structural schematic diagram of the searchable encryption management device provided by the embodiment of the present application is as [[ID=ID=14]] Figure 3 shown, and specifically includes: A receiving module 301, configured to receive a target data request sent by a target device; a determining module 302, configured to determine, based on the target data request, database operations that the proxy server needs to perform and target data on which operations need to be performed; the target device being any one of a cloud server and a user device; a data operation module 303, configured to perform data operations corresponding to the database operations on the target data based on keywords of the target data; wherein the database operations include any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores: data encryption and decryption keys for each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored on each cloud server.

[0118] Optionally, the database operation is: a data initialization operation initiated by a target cloud server; the target cloud server being any one of the multiple cloud servers; the data operation module 303 is specifically configured to use a preset keyword extraction algorithm to extract keywords corresponding to each plaintext data in the multiple plaintext data included in the target data, and generate a first data pair; the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module 303 is specifically further configured to generate ciphertext data corresponding to each plaintext data based on a target key and a target counter generated by the proxy server using a reserved format encryption algorithm, and at the same time, use the Bloom filter generation algorithm to generate a Bloom filter corresponding to each plaintext data with the keyword set corresponding to each plaintext data as input, and obtain a second data pair corresponding to each data; the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the multiple plaintext data; the data operation module 303 is specifically further configured to sequentially store the second data pair of each plaintext data as encrypted data into the target cloud server, and store the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server into the proxy server.

[0119] Optionally, the database operation is: a data query operation initiated by a target user device; the data operation module 303 is specifically configured to obtain a first keyword included in the data requested to be queried by the user device, and use the Bloom filter generation algorithm to generate a query vector corresponding to the first keyword with the first keyword as the input; the query vector is: a multi-dimensional binary vector; the receiving module 301 is further configured to send the query vector to each cloud server respectively, and receive the query data returned by the target cloud server; the data operation module 303 is specifically further configured to decrypt the encrypted data in the query data using a decryption algorithm corresponding to the reserved format encryption algorithm based on the row number of each data and the data encryption and decryption key corresponding to the target cloud server to obtain plaintext data, and send the plaintext data to the user device; wherein, the target cloud server is a cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; the query data includes: among the multiple encrypted data stored in the target cloud server, at least one encrypted data whose Bloom filter matches the query vector.

[0120] Optionally, the database operation is: a data addition operation initiated by a target user device; the data operation module 303 is specifically configured to obtain at least one data added to the target cloud server, and use a preset keyword extraction algorithm to extract the keywords corresponding to each plaintext data in the at least one data to generate a third data pair; the third data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module 303 is specifically further configured to generate ciphertext data corresponding to each plaintext data using the reserved format encryption algorithm based on the data encryption and decryption key and data counter of the target cloud server, and at the same time, use the Bloom filter generation algorithm to generate a Bloom filter corresponding to each plaintext data with the keyword set corresponding to each plaintext data as the input, and obtain a fourth data pair corresponding to each data; the fourth data pair includes: ciphertext data and a corresponding Bloom filter; the data operation module 303 is specifically further configured to sequentially store the fourth data pair of each plaintext data as encrypted data into the target cloud server after the encrypted data stored in the target cloud server.

[0121] Optionally, the database operation is a data deletion operation initiated by a target user device; the data operation module 303 is specifically configured to obtain a second keyword included in the data requested to be deleted by the user device, and use the second keyword as an input to generate a deletion vector using a Bloom filter generation algorithm; the deletion vector is a multi-dimensional binary vector; the data operation module 303 is specifically further configured to send the deletion vector to each cloud server respectively; wherein, the target cloud server is a cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter in the multiple encrypted data stored in the target cloud server that matches the deletion vector to 0.

[0122] Optionally, the database operation is a data update operation jointly executed by the proxy server and the cloud server; the data operation module 303 is specifically configured to obtain multiple ciphertext data sent by a target cloud server and the old key corresponding to the target cloud server; the data operation module 303 is specifically further configured to generate a new key and a new counter corresponding to the target cloud server, and decrypt the multiple ciphertext data using the old key; the target cloud server is a cloud server among the multiple cloud servers that needs to perform data update; when decrypting, if the Bloom filter of the encrypted data is a null value, the plaintext data of the encrypted data is set to a null value; the data operation module 303 is specifically further configured to, if the current plaintext data is not a null value, encrypt the current plaintext data using a reserved format encryption algorithm based on the new key, and use the keyword set corresponding to the current plaintext data as an input to generate a Bloom filter corresponding to the current plaintext data using a Bloom filter generation algorithm, and update the new counter; the data operation module 303 is specifically further configured to sequentially store the encrypted data of each plaintext data into the target cloud server, and store the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

[0123] Optionally, the data operation module 303 is specifically configured to initialize a line number counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent multiple parameter values corresponding to the line number of each row of data; the dimension of the multi-dimensional binary vector is the same as the number of rows of data stored on the cloud server; the number of parameter values corresponding to the line number of each row of data is the same as the number of keywords of the ciphertext data corresponding to the line number; the data operation module 303 is further specifically configured to sequentially input the value of the current line number counter and the currently calculated keyword into the multiple hash functions for OR operation to obtain a result value corresponding to each hash function; the value of the line number counter is obtained by cumulative calculation based on the line number of each row of data; the data operation module 303 is further specifically configured to adjust the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm to obtain a vector composed of multiple parameter values corresponding to each line number; wherein, the preset assignment algorithm includes: if there is a target parameter value in the multiple parameter values corresponding to the line number, the parameter value number of which is the same as the result value corresponding to any one of the multiple hash functions and the parameter value is 0, then assign the target parameter value to 1.

[0124] The searchable encryption management device provided by this application is applied to an agent server in a searchable encryption management system. The searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device. First, receive a target data request sent by a target device, and determine the database operation that the agent server needs to perform and the target data to be operated based on the target data request; the target device is any one of the cloud server and the user device; then, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the agent server communicates with multiple cloud servers, and the agent server generates the encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is obtained based on: multiple hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the agent server; the agent server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored on each cloud server.

[0125] Figure 4 An entity structure diagram of an electronic device is exemplified, as Figure 4As shown in the figure, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communication bus 440. Among them, the processor 410, the communications interface 420, and the memory 430 complete communication with each other through the communication bus 440. The processor 410 may call the logical instructions in the memory 430 to execute a searchable encryption management method, which includes: applying to a proxy server in a searchable encryption management system. The searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device. First, receive a target data request sent by a target device, and determine the database operation that the proxy server needs to perform and the target data to be operated on based on the target data request; the target device is any one of the cloud server and the user device; then, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; where the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates the encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0126] In addition, when the logical instructions in the above-mentioned memory 430 are implemented in the form of software functional units and sold or used as an independent product, they may be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, may be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0127] On the other hand, the present application also provides a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the searchable encryption management method provided by each of the above methods. The method includes: being applied to a proxy server in a searchable encryption management system. The searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device. First, receive a target data request sent by a target device, and determine, based on the target data request, the database operation that the proxy server needs to perform and the target data on which the operation needs to be performed; the target device is any one of the cloud server and the user device; then, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates the encrypted data stored on each of the plurality of cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: a plurality of hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0128] In another aspect, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the searchable encryption management method provided above. The method includes: being applied to a proxy server in a searchable encryption management system, and the searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device. First, receive a target data request sent by a target device, and determine, based on the target data request, the database operation that the proxy server needs to perform and the target data on which the operation needs to be performed; the target device is any one of the cloud server and the user device; then, perform a data operation corresponding to the database operation on the target data based on the keywords of the target data; wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates the encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on: multiple hash functions; the ciphertext data is: generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0129] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0130] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not intended to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A searchable encryption management method, characterized in that, A proxy server applied to a searchable encryption management system, the searchable encryption management system further comprising: a cloud server for storing encrypted data, and a user device; The method includes: Receiving a target data request sent by a target device, and determining, based on the target data request, database operations that the proxy server needs to perform and target data on which operations need to be performed; the target device is any one of the cloud server and the user device; Performing a data operation corresponding to the database operation on the target data based on keywords of the target data; Wherein, the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is obtained based on: multiple hash functions; the ciphertext data is: generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores: data encryption and decryption keys for each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored on each cloud server.

2. The method according to claim 1, characterized in that The database operation is: a data initialization operation initiated by a target cloud server; the target cloud server is any one of the multiple cloud servers; The performing, based on keywords of the target data, a data operation corresponding to the database operation on the target data includes: Using a preset keyword extraction algorithm to extract keywords corresponding to each plaintext data among multiple plaintext data included in the target data, generating a first data pair; the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; Based on a target key and a target counter generated by the proxy server, using a reserved format encryption algorithm to generate ciphertext data corresponding to each plaintext data, and at the same time, using the keyword set corresponding to each plaintext data as input, using a Bloom filter generation algorithm to generate a Bloom filter corresponding to each plaintext data, and obtaining a second data pair corresponding to each data; the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data among the multiple plaintext data; Sequentially storing the second data pair of each plaintext data as encrypted data into the target server, and storing the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server into the proxy server.

3. The method according to claim 1, wherein The database operation is: a data query operation initiated by a target user device; The performing, based on keywords of the target data, a data operation corresponding to the database operation on the target data includes: Obtain the first keyword included in the data requested by the user device for query, and use the Bloom filter generation algorithm with the first keyword as the input to generate a query vector corresponding to the first keyword; the query vector is a multi-dimensional binary vector; Send the query vector to each cloud server respectively, and receive the query data returned by the target cloud server; Based on the line number of each data and the data encryption / decryption key corresponding to the target cloud server, use the decryption algorithm corresponding to the reserved format encryption algorithm to decrypt the encrypted data in the query data to obtain the plaintext data, and send the plaintext data to the user device; Among them, the target cloud server is the cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; the query data includes: among the multiple encrypted data stored in the target cloud server, at least one encrypted data whose Bloom filter matches the query vector.

4. The method according to claim 1, wherein The database operation is: a data addition operation initiated by the target user device; The data operation corresponding to the database operation performed on the target data based on the keyword of the target data includes: Obtain at least one data added to the target cloud server, and use a preset keyword extraction algorithm to extract the keyword corresponding to each plaintext data in the at least one data to generate a third data pair; the third data pair includes: the plaintext data and the corresponding keyword set; each plaintext data corresponds to at least one keyword; Based on the data encryption / decryption key and data counter of the target cloud server, use the reserved format encryption algorithm to generate the ciphertext data corresponding to each plaintext data. At the same time, use the Bloom filter generation algorithm with the keyword set corresponding to each plaintext data as the input to generate the Bloom filter corresponding to each plaintext data, and obtain the fourth data pair corresponding to each data; the fourth data pair includes: the ciphertext data and the corresponding Bloom filter; After storing the encrypted data in the target cloud server, sequentially store the fourth data pair of each plaintext data as encrypted data into the target cloud server in order.

5. The method according to claim 1, wherein The database operation is: a data deletion operation jointly performed by the proxy server and the cloud server; The data operation corresponding to the database operation performed on the target data based on the keyword of the target data includes: Obtain the second keyword included in the data requested by the user device to be deleted, and use the Bloom filter generation algorithm with the second keyword as the input to generate a deletion vector; the deletion vector is a multi-dimensional binary vector; Send the deletion vector to each cloud server respectively; Among them, the target cloud server is the cloud server among the multiple cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter in the multiple encrypted data stored in the target cloud server whose Bloom filter matches the deletion vector to 0.

6. The method according to claim 1, wherein The database operation is: a data update operation jointly performed by the proxy server and the cloud server; Performing data operations corresponding to the database operations on the target data based on the keywords of the target data, including: Obtaining a plurality of ciphertext data sent by a target cloud server and an old key corresponding to the target cloud server; Generating a new key and a new counter corresponding to the target cloud server, and decrypting the plurality of ciphertext data using the old key; the target cloud server is the cloud server that needs to perform data update among the plurality of cloud servers; when decrypting, if the Bloom filter of the encrypted data is a null value, the plaintext data of the encrypted data is set to a null value; If the current plaintext data is not a null value, encrypting the current plaintext data using the reserved format encryption algorithm based on the new key, and using the Bloom filter generation algorithm to generate a Bloom filter corresponding to the current plaintext data with the keyword set corresponding to the current plaintext data as input, and updating the new counter; Sequentially storing the encrypted data of each plaintext data into the target cloud server, and storing the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

7. The method according to any one of claims 2 to 6, characterized in that, The Bloom filter generation algorithm includes: Initializing a row counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent a plurality of parameter values corresponding to the row number of each row of data; the dimension of the multi-dimensional binary vector is the same as the number of rows of data stored on the cloud server; the number of parameter values corresponding to the row number of each row of data is the same as the number of keywords of the ciphertext data corresponding to the row number; Sequentially inputting the value of the current row counter and the currently calculated keyword into the plurality of hash functions for OR operation to obtain a result value corresponding to each hash function; the value of the row counter is obtained by cumulative calculation based on the row number of each row of data; After adjusting the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm, obtaining a vector composed of a plurality of parameter values corresponding to each row number; Wherein, the preset assignment algorithm includes: if there is a target parameter value among the plurality of parameter values corresponding to the row number, the parameter value number of which is the same as the result value corresponding to any one of the plurality of hash functions and the parameter value is 0, then assigning the target parameter value to 1.

8. A searchable encryption management device, characterized in that, Applied to a proxy server in a searchable encryption management system, the searchable encryption management system further includes: a cloud server for storing encrypted data, and a user device; The device includes: A receiving module, configured to receive a target data request sent by a target device; A determining module, configured to determine the database operation that the proxy server needs to perform and the target data to be operated based on the target data request; the target device is any one of a cloud server and a user device; A data operation module, configured to perform data operations corresponding to the database operation on the target data based on the keywords of the target data; Among them, the database operations include any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with multiple cloud servers, and the proxy server generates encrypted data stored on each of the multiple cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on multiple hash functions; the ciphertext data is generated based on the reserved format encryption algorithm used by the proxy server; the proxy server stores: the data encryption and decryption keys of each cloud server and the data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored on each cloud server.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the steps of the searchable encryption management method according to any one of claims 1 to 7.

10. A searchable encryption management system, characterized in that, The system includes: a proxy server, a cloud server for storing encrypted data, and a user device; the proxy server is used to execute the steps of the searchable encryption management method according to any one of claims 1 to 7.

Images