Multi-user dynamic searchable encryption method based on LabeldPSI

Abstract

The invention provides a multi-user dynamic searchable encryption method based on LabeldPSI, and relates to the technical field of information security and the field of secure multi-party computation.The multi-user dynamic searchable encryption method based on the LabeldPSI comprises the steps that firstly, in a management layer, a data owner and a cloud server collaboratively design a database updating method so as to support dynamic updating of data, and multi-user access authority management based on keywords is achieved; then, in a search module, a data user and a cloud server construct a Labeled PSI protocol suitable for the searchable encryption field by using an OKVS algorithm; and finally, in an application layer, the data user and the cloud server collaboratively design a database search method, a Labeled PSI protocol is called to carry out multi-keyword search, and a search result is decrypted. According to the invention, the privacy protection capability and the performance optimization of the dynamic searchable encryption technology are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology and the field of secure multi-party computation, and particularly relates to a multi-user dynamic searchable encryption method based on LabeledPSI. Background Art

[0002] With the rapid development of cloud computing technology, cloud storage has become an effective means to solve the problems of large-capacity data storage, interaction, and management. A cloud server can provide flexible and convenient storage and computing services for enterprises or individuals, and can support multiple users for remote access and collaborative computing. However, in a cloud computing environment, data storage and computing are outsourced to the cloud server, and users cannot directly control the data, which leads to a serious security threat to data privacy. A malicious cloud server or an external attacker may steal users' sensitive information and even infer users' behaviors through data analysis. Therefore, how to efficiently perform data retrieval while ensuring data privacy security has become a key issue.

[0003] To solve the privacy protection problem in the cloud storage environment, searchable encryption (SE) has emerged and has been widely studied and developed. Searchable encryption allows users to perform keyword searches on ciphertexts without decrypting the entire database, thus achieving efficient retrieval while ensuring data confidentiality. However, the existing searchable encryption schemes still have the following problems:

[0004] (1) Problem in the dynamic update scenario: Most searchable encryption schemes are mainly applicable to static data sets, that is, the data does not change after encryption, and it is difficult to meet the requirements of data dynamic update in the real world. Once the stored data needs to be updated, it is often necessary to reconstruct the index, which will bring huge computational and storage overheads in large-scale data scenarios.

[0005] (2) Relatively large computational and communication overheads: Some searchable encryption schemes are constructed using complex cryptographic primitives (such as fully homomorphic encryption, bilinear mapping, etc.), resulting in high computational and communication costs in the search phase and affecting the practicality of the scheme.

[0006] (3) Risk of privacy leakage: Some searchable encryption schemes may have problems such as search pattern leakage and access pattern leakage in the search phase. A malicious cloud server or an external attacker may infer users' search behaviors through such leaked information, thereby breaking the privacy protection mechanism.

[0007] To address the above issues, researchers have introduced the Labeled Private Set Intersection (Labeled PSI) protocol to optimize searchable encryption schemes. Labeled PSI is essentially an extension of Private Set Intersection (PSI), which allows multiple parties to calculate the intersection without exposing their respective data, and also includes label information. This allows Labeled PSI to achieve flexible data access while protecting user query privacy. Searchable encryption schemes based on Labeled PSI can hide the statistical characteristics of ciphertext keywords, provide higher security, and have better scalability. However, existing searchable encryption schemes based on Labeled PSI still have the following shortcomings:

[0008] (1) Search efficiency: These solutions perform a large amount of interactive communication during the search process, resulting in huge communication overhead, reducing retrieval efficiency, and making them difficult to apply to large-scale cloud storage application scenarios;

[0009] (2) Functional expansion issues: Existing solutions are limited to static dataset scenarios, and some solutions only support single keyword matching and cannot perform complex searches such as multi-keyword queries;

[0010] (3) System model problem: Most existing solutions adopt a “single-write, single-read” system model, which does not allow access rights control for different users based on keywords, which is not conducive to data sharing and collaborative applications.

[0011] In summary, existing searchable encryption schemes based on Labeled PSI still face many challenges in terms of functionality, efficiency, and security. Summary of the Invention

[0012] In response to the above-mentioned deficiencies in the prior art, the present invention provides a multi-user dynamic searchable encryption method based on LabeledPSI, which aims to solve the problem of efficient retrieval of multi-user data dynamic update and privacy protection in a cloud computing environment.

[0013] In order to achieve the above objectives, the technical solution adopted by the present invention is: a multi-user dynamic searchable encryption method based on LabeledPSI, comprising the following steps:

[0014] S1. At the management level, the data owner and the cloud server jointly negotiate the database update algorithm to support dynamic data updates and implement keyword-based multi-user access rights management;

[0015] S2. In the search module, the data user and the cloud server use the OKVS algorithm to construct a Labeled PSI protocol suitable for the searchable encryption field;

[0016] S3. At the application layer, the data user and the cloud server cooperate to design a database search method, call the LabeledPSI protocol for multi-keyword search, and decrypt the search results.

[0017] The beneficial effects of the present invention are as follows: First, at the management layer, the data owner and the cloud server cooperate to design a database update method to support dynamic data updates and implement multi-user access permission management based on keywords. Subsequently, in the search module, the data user and the cloud server use the OKVS algorithm to construct the Labeled PSI technology applicable to the field of searchable encryption. Finally, at the application layer, the data user and the cloud server cooperate to design a database search method, call Labeled PSI for multi-keyword search, and decrypt the search results. Through the present invention, the privacy protection ability and performance optimization of the dynamic searchable encryption technology are further enhanced. Aiming to ensure data privacy security, the search efficiency of the searchable encryption scheme is improved, and it is extended to multi-user and data dynamic update application scenarios.

[0018] Further, the specific content of S1 is as follows:

[0019] S101. At the management layer, the data owner generates the key privacy parameters required for update and search operations and initializes an empty keyword status table.

[0020] S102. The data owner and the cloud server jointly negotiate a database update method, encrypt the plaintext document, and generate the corresponding bitmap index structure to complete the update operation of the ciphertext database. Among them, by the data owner encrypting the plaintext document and maintaining the index structure of the ciphertext database, the dynamic update of data is supported.

[0021] S103. By the data owner distributing keyword status subsets to different users, multi-user access permission management based on keywords is realized.

[0022] The beneficial effects of the above further solution are as follows: Through the cooperation of the data owner and the cloud server, the database update algorithm is jointly negotiated, and multi-user access control permission management based on keywords is realized. According to the description of the solution, step S1 provides a more flexible, privacy-protected, and efficient database management method for the searchable encryption scheme by combining the dynamic update mechanism, encryption technology, and multi-user permission management, greatly improving the performance of the system in terms of security, privacy, and scalability.

[0023] Still further, the specific content of S101 is as follows:

[0024] A1. At the management layer, the data owner is in {0,1} λRandomly generate a key K in space s and K doc where λ represents the computational security parameter, and K s represents the keyword master key, which is used to generate keyword tokens and calculate search tokens, and K doc represents the key of the additive homomorphic encryption algorithm, which is used to encrypt or decrypt the bitmap index vector;

[0025] A2. The data owner initializes an empty keyword status table σ to record the total update times of each keyword. The data user generates corresponding keyword search tokens based on the information recorded in the keyword status table σ.

[0026] The beneficial effects of the above further solution are as follows: The generation and management of the key privacy parameter can effectively protect the security of the encryption key of the data owner, prevent the cloud server or other malicious third parties from obtaining the complete key information, and thus enhance the security of the entire system. Specifically, based on the design of the update mechanism of the encryption key and the dynamic keyword status table, the confidentiality and consistency of the ciphertext data and the index structure can be ensured during the database update process, avoiding security vulnerabilities that may be encountered in the dynamic update of traditional databases.

[0027] Furthermore, the S102 is specifically as follows:

[0028] B1. The data owner initializes an empty mapping table ADD and T for this update operation w where the table ADD is used to store the mapping relationship between the search token and the ciphertext database, and the table T w is used to store the temporarily extracted keyword set;

[0029] B2. For the plaintext document set DB, the data owner processes each document doc one by one, extracts the keywords and document identifiers in the document, and saves all the keywords to the keyword set T w ;

[0030] B3. For the selected keyword w ∈ T w , the data owner queries the keyword status table σ to obtain the previous update times n of the keyword w, i.e., n ← σ[w]; if the keyword w does not exist in the keyword status table σ, then the keyword w is saved to the keyword status table σ and the initial update times is set to 0; where at this time, the keyword status table σ does not need to be updated, and σ[w] represents the total update times of the keyword w recorded in the keyword status table σ;

[0031] B4. For the keyword w, generate its corresponding bitmap index vector BS ← b1, b2,..., b j , if the keyword w exists in the j-th document, then the j-th bit b of the bitmap index vector BS jis 1, otherwise it is 0, where,

[0032] If the update operation type op is a delete operation, first perform a two's complement modulo operation on the bitmap index vector:

[0033] BS←((111...111)2 - BS)mod2 α

[0034] where, α represents the total number of files in the database;

[0035] Then, based on the secret key K doc use the additive homomorphic encryption algorithm to encrypt the bitmap index vector BS to obtain the encrypted bitmap index vector EBS:

[0036] EBS←Enc(K doc ,BS)

[0037] where, Enc represents the additive homomorphic encryption algorithm, BS represents the bitmap index vector, and b j represents the j-th bit in the bitmap index vector;

[0038] B5. The data owner uses the keyword secret key K s to generate the keyword token kt w ←F(K s ,w), calculates the search token st w using the following formula, and saves the keyword token kt w , the search token st w and the encrypted bitmap index vector EBS into the set ADD, and the data owner sends the set ADD to the cloud server:

[0039] st w ←H(kt w ,n + 1)

[0040] where, F represents the pseudo-random function, H represents the random hash function, n represents the number of updates before querying the keyword w in the keyword status table σ, and n + 1 represents the number of updates corresponding to this update operation;

[0041] B6. For each keyword w in the set T w , the keyword status table σ obtains the number of updates n←σ[w] corresponding to the keyword w, and updates the status table using σ[w]←n + 1;

[0042] B7. The cloud server merges the corresponding different search tokens and encrypted bitmaps, and the content of the ciphertext database according to the keyword token kt w to complete the update operation of the ciphertext database.

[0043] The beneficial effects of the above further solution are as follows: Through precise index management, flexible support for update operations, encryption privacy protection, the security of the key management mechanism, and an automated update process, the capabilities of the searchable encryption solution in aspects such as dynamic updates, data privacy protection, and multi-user access control are further enhanced. Whether it is a large database with frequent updates or a complex scenario with multi-user concurrent queries, this design can effectively support data updates and ciphertext retrieval. Specifically, steps B2 and B3 describe the precise database update process, enabling the update of each document to be accurately located based on its keywords and document identifiers; while step B4 uses a two's complement modulo operation to flexibly adjust the bitmap index to support more complex database update operations; and steps B5 to B7 ensure that at each update, the status table is maintained by automatically obtaining the update information corresponding to the keywords, and the merging of the ciphertext database on the cloud server side is completed.

[0044] Furthermore, the specific content of S103 is as follows:

[0045] C1. For different data users DU1, DU2,..., DU m , the data owner sets keyword access permissions for them, where DU m represents a data user;

[0046] C2. The data owner divides the keyword status table σ into different subsets σ1, σ2,..., σ m , and distributes them to the corresponding data users;

[0047] C3. By the data user DU i , during the search phase, use the distributed keyword status table σ i to construct a search token and complete the keyword search operation; among them, since the keyword status table σ i records the information necessary to generate the search token, the data user can only generate a valid search token for its authorized keywords and cannot query unauthorized keywords, realizing multi-user access control based on keywords.

[0048] The beneficial effects of the above further solution are as follows: By finely managing the keyword status tables of each data user in a multi-user environment, the privacy protection and security of data are enhanced, and the access behavior of users is effectively controlled. Specifically, each data user can only generate a search token for authorized keywords based on the subset of the keyword status table distributed by the data owner, thus realizing an efficient and flexible permission management mechanism; in addition, the data owner can flexibly adjust the permissions of each data user according to business needs without large-scale modification or reconstruction of the database structure, and this control mechanism can prevent permission abuse and malicious access.

[0049] Furthermore, S2 is specifically as follows:

[0050] S201: In the search module, the cloud server holds a dataset X of size n x , and for each element x ∈ X in the dataset X, its corresponding label value is L[x]; the data user holds a dataset Y of size n y . In the preprocessing stage, first, the cloud server adds λ bits to the label L[x] and expands it to L'[x] = 0 λ ||L[x]. Subsequently, the cloud server obtains the set of all label values . Finally, the cloud server calculates the exclusive OR value of the element value and its extended label x ⊕ L'[x], where L'[x] represents the extended label value, representing the n x th element corresponding extended label value;

[0051] S202: Based on the OKVS algorithm, the cloud server encodes the set of key-value pairs composed of the element x and x ⊕ L'[x] to obtain an encoding result and sends the encoding result to the data user to construct a Labeled PSI protocol under a semi-honest security model;

[0052] S203: For each element y in the dataset Y, the data user calculates its OKVS decoding value and solves its corresponding label value and determines whether it is the correct label value according to whether the first λ bits are 0. Among them, represents the encoding result obtained in S202, represents the decoding value of the OKVS decoding algorithm based on the key y for .

[0053] The beneficial effect of the above further solution is that by combining the OKVS algorithm for encoding elements and labels, label expansion, and exclusive OR operation, it enhances data privacy protection for the constructed Labeled PSI protocol, improves the security of the protocol, and effectively prevents label leakage and attacks. Specifically, through efficient encryption encoding operations and decoding verification mechanisms, the Labeled PSI protocol can still maintain good performance in a large-scale data environment, while improving the security, accuracy, and anti-attack ability of the searchable encryption scheme in the search stage.

[0054] Furthermore, S201 is specifically as follows:

[0055] D1: In the search module, the cloud server holds a dataset X of size n xThe dataset X and the set of label values L. For each element x ∈ X, there is a corresponding label value L[x]; the data user holds a dataset Y of size n y ;

[0056] D2. In the preprocessing stage, for the label value L[x] corresponding to each element x in the dataset X, the cloud server adds λ bits of 0 bits to it and expands it to L'[x] = 0 λ ||L[x], and the cloud server obtains the set of all label values

[0057] D3. For each element x ∈ X in the dataset X, the cloud server calculates the exclusive-or value of the element value and its extended label x ⊕ L'[x];

[0058] Specifically, S202 is as follows:

[0059] E1. For each element x in the dataset X, the cloud server forms a key-value pair set I by combining the element x with its corresponding value x ⊕ L'[x], that is, I = {x i , x i ⊕L'[x i | i ∈ [n x}, where x i represents the i-th data element, L'[x i represents the extended label value corresponding to the i-th data element, n x represents the total number of elements in the dataset X, and i represents the relative position of the element x i in the dataset X;

[0060] E2. The cloud server selects the encoding algorithm Encode of OKVS to encode the set I, that is and sends the encoding result to the data user to construct a Labeled PSI protocol under a semi-honest security model, where OKVS includes an encoding algorithm Encode and a decoding algorithm Decode. For any key k and its corresponding value v, the following formula is satisfied:

[0061]

[0062]

[0063] where H F represents a random hash function, Encode() represents an encoding operation, k represents the key to be encoded, and v represents the value corresponding to the key k;

[0064] Specifically, S203 is as follows:

[0065] F1. For each element y in the data set Y, the data user calculates its OKVS decoded value. Among them, for any encoded key k and the encoding result Use the OKVS decoding algorithm Decode to solve for the value v corresponding to the key k; for any unencoded key k' and the encoding result Use the OKVS decoding algorithm Decode to solve for an indistinguishable random value;

[0066] F2. According to the decoded value The data user uses the following formula to solve for the label value L'[y] corresponding to the element:

[0067]

[0068] F3. The data user determines whether the element y is an intersection element and whether the label value is the correct label value based on whether the first λ bits of the label value are 0. Among them, in the application layer, if the element y belongs to the intersection element, the keyword to be queried can be matched in the ciphertext database, and the corresponding label value is the set of document label values expected to be searched.

[0069] The beneficial effects of the above further solution are as follows: By introducing the OKVS decoding algorithm and the label value verification mechanism, the data user only needs to identify the intersection elements through the first λ bits of the label value during the search phase, effectively preventing the influence of incorrect labels and data tampering, and at the same time improving the efficiency and accuracy of multi-keyword queries. Specifically, in step F1, the encoded result is processed by the OKVS decoding algorithm. When an encoded key is input, its corresponding value will be returned; when an unencoded key is input, the OKVS decoding algorithm will output an indistinguishable random value. This design ensures that even if the cloud server or malicious user obtains the encoding result (i.e., the index structure), they cannot infer the actual content of the data, thus preventing data leakage and abuse and enhancing data privacy protection. In steps F2 and F3, the data user calculates the label value corresponding to the element based on the decoded value, and identifies the elements belonging to the intersection by verifying the first λ bits of the label value, and quickly obtains the matching documents in the ciphertext database.

[0070] Furthermore, the specific content of S3 is as follows:

[0071] S301. In the application layer, the cloud server preprocesses the ciphertext database, saves the ciphertext search tokens st corresponding to different keywords w into the set SX, and saves the corresponding encrypted bitmap index vector EBS into the label set SL;

[0072] S302. Each keyword in the set Q to be queried is preprocessed by the data user, and the corresponding ciphertext search token st is generated through the keyword status table σ w , and it is saved into the set CY;

[0073] S303. The data user and the cloud server jointly call the Labeled PSI protocol. After the protocol runs to completion, the data user obtains the search result and solves it through the decryption key.

[0074] The beneficial effects of the above further solution are as follows: Through the cooperation between the cloud server and the data user, combined with the Labeled PSI protocol, the search efficiency and accuracy of searchable encryption can be effectively improved. Specifically, in the search phase, the ciphertext database always remains encrypted, and only when the data user uses the authorized keywords can the search result be obtained through the Labeled PSI protocol, thus improving the search efficiency while ensuring data privacy. In addition, since the cloud server has preprocessed the ciphertext database and saved the search token and label index, the data user can quickly obtain the corresponding search token in the query phase, avoiding complex ciphertext processing during each query. This mechanism reduces the computational overhead and improves the accuracy and flexibility of multi-keyword search.

[0075] Furthermore, the specific content of S301 is as follows:

[0076] G1. At the application layer, the cloud server initializes the empty sets SX and SL;

[0077] G2. The cloud server processes the ciphertext database, stores the ciphertext search token st w into the set SX, and stores the corresponding encrypted bitmap index EBS of the ciphertext search token st w into the set SL. Among them, the set SX in S3 corresponds to the data set X in S2, the ciphertext search token st w in the set SX corresponds to the element x in the data set X, the set SL corresponds to the label data set L, and the encrypted bitmap index EBS corresponding to each ciphertext search token st w corresponds to the label value L[x];

[0078] The specific content of S302 is as follows:

[0079] H1. The data user initializes the empty sets CY and result set R;

[0080] H2. For each keyword w ∈ Q in the set of keywords to be queried, the data user DU i queries its corresponding subset σ of the keyword status table i , and obtains the update count n ← σ corresponding to the keyword w i[w], where σ i [w] represents the total number of updates recorded for keyword w in the state table σ i ;

[0081] H3. The data user generates the corresponding keyword token kt w ←F(K s , w), and calculates its corresponding ciphertext search token st w ←H(kt w , n), and saves the ciphertext search token to the set CY. Among them, the set CY in S3 corresponds to the data set Y in S2, and the ciphertext search token st in the set CY w corresponds to the element y in the data set Y, K s represents the keyword master key, which is used to generate keyword tokens and calculate search tokens, F represents a pseudorandom function, H represents a random hash function, n represents the number of updates before querying keyword w in the keyword state table σ, n + 1 represents the number of updates corresponding to this update operation, and kt w represents the keyword token;

[0082] The specific content of S303 is as follows:

[0083] I1. Let the data set of the cloud server be SX and the label value set be SL, where each element st w corresponds to a label value EBS, and let the data set of the data user be CY. Among them, EBS represents the encrypted bitmap index vector;

[0084] I2. The cloud server and the data user jointly call the Labeled PSI protocol. The data user obtains the intersection result and the correct ciphertext label value, and saves the search result to the set R;

[0085] I3. The data user uses the key K doc to decrypt the encrypted bitmap index to obtain the required document identifier, and completes the solution of the search result.

[0086] The beneficial effects of the above further solution are as follows: Steps S301 to S303 further refine the cooperation method between the cloud server and the data user, and optimize security, efficiency, and accuracy during the processes of processing the encrypted database, generating search tokens, and executing the Labeled PSI protocol. Specifically, when storing and managing encrypted data, the cloud server can not only maintain the queryability of the encrypted data but also quickly respond to the query requests of the data user, avoiding repeated calculations. The data user can only perform legal queries on authorized keywords. At the same time, since the search tokens are generated based on a random hash function, it is difficult for malicious attackers to infer the search tokens through reverse engineering. The Labeled PSI protocol can ensure that even when interacting between the cloud server and the data user, sensitive data will not be leaked, while also ensuring efficient multi-keyword search and accurate query results. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 It is a flowchart of the method of the present invention.

[0088] Figure 2 It is a schematic diagram of a multi-user dynamic searchable encryption system model that meets the single-write multi-read architecture provided according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0089] The following describes the specific embodiments of the present invention to facilitate those skilled in the art of this technology to understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art of this technology, as long as various changes are within the spirit and scope of the present invention defined and determined by the appended claims, these changes are obvious, and all inventions created using the concept of the present invention are within the scope of protection.

[0090] Embodiment

[0091] Such as Figure 1 and Figure 2As shown in the figure, the present invention provides a multi - user dynamic searchable encryption method based on the Labeled PSI protocol, which includes a bottom - layer module (Labeled PSI), a management layer, and an application layer. The bottom - layer module is mainly used to support the implementation of the search algorithm in the application layer. Its main technical structure consists of Oblivious Key - Value Stores (OKVS), and mainly includes two entities: the cloud server Server and the data user DU. Among them, the cloud server holds the data set X. For any x ∈ X, the cloud server Server holds its corresponding label {L[x]|x ∈ X}, and the data user holds the data set Y. In the management layer, there are two entities: the data owner (DO) and the cloud server Server, which can maintain the dynamic update of data and implement access control for different users. In the application layer, there are two entities: the data user (DU) and the cloud server Server, which can complete the retrieval and decryption of ciphertext data based on keywords. The dynamic searchable encryption scheme designed by the present invention can generally be divided into three stages: Setup, Update, and Search (initialization, update, and search). And it performs data dynamic update based on the bitmap index structure. In the data dynamic update stage, only one modular addition using the additive homomorphic encryption algorithm is required to complete the merging of the new ciphertext database and the original ciphertext database; keyword retrieval is performed based on the Labeled PSI protocol. After the protocol call ends, the data user obtains the search result while the cloud server cannot obtain any information. Finally, the data user uses the decryption key to decrypt the search result. The implementation method is as follows:

[0092] S1. In the management layer, the data owner and the cloud server jointly negotiate the database update algorithm to support the dynamic update of data and implement multi - user access permission management based on keywords.

[0093] In this embodiment, in the management layer, the data owner and the cloud server jointly negotiate the database update algorithm to ensure the dynamic update of data and access control for different users. The data owner encrypts the plaintext document set and maintains the index structure of the ciphertext database to support the dynamic update of data; and realizes multi - user access permission management based on keywords by distributing subsets of the keyword status table to different users, so as to ensure that different users can only query the data within their authorized scope. The implementation method is as follows:

[0094] S101. In the management layer, the data owner generates the key privacy parameters required for update and search operations and initializes an empty keyword status table. The implementation method is as follows:

[0095] A1. In the management layer, the data owner is in {0,1} λRandomly generate a key K in space s and K doc , where λ represents the computational security parameter, K s represents the keyword master key, which is used to generate keyword tokens and compute search tokens, and K doc represents the additive homomorphic encryption algorithm key, which is used to encrypt or decrypt the bitmap index vector;

[0096] A2. The data owner initializes an empty keyword status table σ to record the total update times of each keyword. The data user generates corresponding keyword search tokens based on the information recorded in the keyword status table σ.

[0097] In this embodiment, the data owner DO executes an initialization algorithm Setup. The data owner randomly generates two key parameters: K s ←{0,1} λ and K doc ←{0,1} λ ; where the keyword master key K s is used to generate other sub - keys or tokens, including keyword tokens and search tokens, and the additive homomorphic encryption algorithm key K doc is mainly used to encrypt or decrypt the bitmap index vector.

[0098] Meanwhile, the data owner initializes a keyword status table σ to store the total update times of each keyword. The data owner can achieve keyword - based access control by distributing subsets of the status table σ to different data users. In the application layer, the data user can construct search tokens based on the key parameters and the subset of the status table shared by the data owner to complete the encrypted text retrieval and decryption of keywords.

[0099] S102. The data owner and the cloud server jointly negotiate a database update method, encrypt the plain - text documents, and generate corresponding bitmap index structures to complete the update operation of the encrypted database. Among them, by the data owner encrypting the plain - text documents and maintaining the index structure of the encrypted database, dynamic update of data is supported. Specifically:

[0100] B1. The data owner initializes an empty mapping table ADD and T w , where the table ADD is used to store the mapping relationship between search tokens and the encrypted database, and the table T w is used to store the temporarily extracted keyword set;

[0101] B2. For the plain - text document set DB, the data owner processes each document doc one by one, extracts the keywords and document identifiers in the document, and saves all the keywords into the keyword set T w ;

[0102] B3. For the selected keyword \(w\in T\) w , the data owner queries the keyword status table \(\sigma\) to obtain the number of updates \(n\) before the keyword \(w\), i.e., \(n\leftarrow\sigma[w]\); if the keyword \(w\) does not exist in the keyword status table \(\sigma\), then the keyword \(w\) is saved to the keyword status table \(\sigma\) and the initial number of updates is set to 0; where, at this time, there is no need to update the keyword status table \(\sigma\), and \(\sigma[w]\) represents the total number of updates recorded for the keyword \(w\) in the keyword status table \(\sigma\).

[0103] B4. For the keyword \(w\), generate its corresponding bitmap index vector \(BS\leftarrow b_1,b_2,\cdots,b\) j , if the keyword \(w\) exists in the \(j\)-th document, then the \(j\)-th bit \(b\) of the bitmap index vector \(BS\) j is 1, otherwise it is 0, where

[0104] if the update operation type \(op\) is a deletion operation, then first perform a complement modulo operation on the bitmap index vector:

[0105] \(BS\leftarrow((111\cdots111)_2 - BS)\bmod2\) α

[0106] where \(\alpha\) represents the total number of files in the database;

[0107] Then, using the following formula, based on the key \(K\) doc encrypt the bitmap index vector \(BS\) using the additive homomorphic encryption algorithm to obtain the encrypted bitmap index vector \(EBS\):

[0108] \(EBS\leftarrow Enc(K\) doc ,BS)

[0109] where \(Enc\) represents the additive homomorphic encryption algorithm, \(BS\) represents the bitmap index vector, and \(b\) j represents the \(j\)-th bit in the bitmap index vector;

[0110] B5. The data owner generates the keyword token \(kt\) s \(\leftarrow F(K\) w ,w)\), calculates the search token \(st\) s using the following formula, and saves the keyword token \(kt\) w , the search token \(st\) w and the encrypted bitmap index vector \(EBS\) to the set \(ADD\), and the data owner sends the set \(ADD\) to the cloud server: w \(st\)

[0111] \(\leftarrow H(kt\) w ,n + 1) w

[0112] Among them, F represents a pseudo-random function, H represents a random hash function, n represents the number of updates before querying the keyword w in the keyword status table σ, and n + 1 represents the number of updates corresponding to the current update operation;

[0113] B6. For each keyword w in the set T w in the keyword status table σ obtains the update count n ← σ[w] corresponding to the keyword w, and updates the status table using σ[w] ← n + 1;

[0114] B7. The cloud server merges the corresponding different search tokens and encrypted bitmap indexes with the content of the ciphertext database according to the keyword token kt w to complete the update operation of the ciphertext database.

[0115] In this embodiment, the data owner DO and the cloud server Server jointly negotiate a database update algorithm Update.

[0116] In this embodiment, the data owner DO first initializes the empty mapping tables ADD and T w required for the current update operation, where the table ADD is used to store the mapping relationship between search tokens and the ciphertext database, and the table T w is used to temporarily store the set of keywords extracted from the documents;

[0117] The data owner DO first processes each document doc in the plaintext document set DB one by one, extracts the keywords and document identifiers of the document, and saves all the keywords to the set T w . For the selected keyword w ∈ T w , the data owner DO queries σ to obtain its previous update count n ← σ[w]; if w is a keyword newly added in this operation, it is saved to σ and set to the initial value of 0;

[0118] Subsequently, the data owner DO generates the corresponding bitmap index vector BS for the keyword w according to the type of the current update operation. If it is an addition operation, BS is directly generated according to the document containing the keyword w, that is, BS ← b1, b2,..., b n ; if it is a deletion operation, the bitmap index vector needs to be complemented and modulo-operated first, that is, calculate BS ← ((111...111)2 - BS) mod 2 n ; at the same time, the bitmap index vector BS is encrypted using the additive homomorphic encryption algorithm based on the key K doc , that is, calculate EBS ← Enc(K doc , BS), where Enc is the additive homomorphic encryption algorithm;

[0119] For the selected keyword w, by the data owner DO, using the keyword key Ks Generate keyword token kt w ←F(K s , w), and calculate the search token, i.e., st, using the retrieved update count n←σ[w]. w ←H(kt w , n + 1), where F represents a pseudorandom function and H represents a random hash function; subsequently, the data owner DO stores kt w , st w and ciphertext data such as EBS in the set ADD, and sends this set to the cloud server; for each keyword w in the set T w , retrieve its corresponding update count n←σ[w] by querying the status table σ, and update the status table using σ[w]←n + 1.

[0120] In this embodiment, the cloud server merges the corresponding different search tokens and encrypted bitmap indexes with the content of the ciphertext database according to the keyword token kt w to complete the update operation of the ciphertext database. S103, Implement multi-user access right management based on keywords by the data owner distributing keyword status subsets to different users, and the implementation method is as follows:

[0121] C1. For different data users DU1, DU2,..., DU m , the data owner sets keyword access rights for them, where DU m represents a data user;

[0122] C2. The data owner divides the keyword status table σ into different subsets σ1, σ2,..., σ m , and distributes them to the corresponding data users;

[0123] C3. The data user DU i , uses the distributed keyword status table σ i to construct search tokens during the search phase and complete the keyword search operation; among them, since the keyword status table σ i records the necessary information for generating search tokens, the data user can only generate valid search tokens for its authorized keywords and cannot query unauthorized keywords, realizing multi-user access control based on keywords.

[0124] In this embodiment, to achieve multi-user access and access control between different users, the data owner DO needs to set corresponding keyword access rights for different data users DU, and divide the keyword status table σ into different subsets σ1, σ2,..., σ m ; at the application layer, the data user DU iUse the subset σ of the distributed state table i Query the update count corresponding to the keyword w, and based on the key parameter K shared by the data owner DO s Calculate the keyword token and the search token to complete the ciphertext retrieval of the keyword.

[0125] S2. In the search module, the data user and the cloud server use the OKVS algorithm to construct a Labeled PSI protocol applicable to the field of searchable encryption;

[0126] In this embodiment, in the search module, the data user and the cloud server use the OKVS algorithm to construct a semi-honest secure Labeled PSI protocol applicable to the field of searchable encryption; after the protocol execution is completed, the data user judges the intersection result and solves the corresponding label, where the intersection result contains all successfully matched keywords, and the correctly solved label values store the document identifier information related to the keywords; the implementation method is as follows:

[0127] S201. In the search module, the cloud server holds a dataset X of size n x For each element x ∈ X in the dataset X, its corresponding label value is L[x]; the data user holds a dataset Y of size n y In the preprocessing stage, first the cloud server adds λ bits to the label L[x] and extends it to L'[x] = 0 λ ||L[x], then the cloud server obtains the set of all label values Finally, the cloud server calculates the exclusive OR value of the element value and its extended label x ⊕ L'[x], where L'[x] represents the extended label value, represents the nth x element corresponding extended label value; the implementation method is as follows:

[0128] D1. In the search module, the cloud server holds a dataset X of size n x and a set of label values L. For each element x ∈ X, there is a corresponding label value L[x]; the data user holds a dataset Y of size n y

[0129] D2. In the preprocessing stage, for the label value L[x] corresponding to each element x in the dataset X, the cloud server adds λ bits of 0 bits to it and extends it to L'[x] = 0 λ ||L[x], and the cloud server obtains the set of all label values

[0130] ​D3. For each element \(x\in X\) in the dataset \(X\), the cloud server calculates the exclusive - or value \(x\oplus L'[x]\) of the element value and its extended label.

[0131] In this embodiment, the data user DU holds a dataset \(Y\) of size \(n\). y In the application layer, \(n\) y corresponds to the number of sets of query keywords to be searched, and the dataset \(Y\) corresponds to the generated set of search tokens; the cloud server Server holds a dataset \(X\) of size \(n\). x And for each element \(x\in X\), there is a corresponding label value \(L[x]\). In the application layer, \(n\) x corresponds to the total number of keyword sets in the ciphertext database, the dataset \(X\) corresponds to all sets of search tokens, and the label set \(L\) corresponds to all encrypted bitmap index vectors.

[0132] In the pre - processing stage of this embodiment, the cloud server Server adds \(\lambda\) bits of 0 bits to each label value \(L[x]\) to expand it to \(0\) λ ||\(L[x]\), and denote it as \(L'[x]\); when the data user DU receives the ciphertext label value, it can determine whether the element is an intersection - set element and whether the label value is the correct label value by checking whether the first \(\lambda\) bits are all 0 bits.

[0133] To hide the label value, in this embodiment, the cloud server Server calculates the exclusive - or value \(x\oplus L'[x]\) of the element value and its extended label value, so as to ensure that external attackers cannot directly obtain the label value.

[0134] S202. The cloud server encodes the set of key - value pairs composed of the element \(x\) and \(x\oplus L'[x]\) based on the OKVS algorithm to obtain the encoding result and sends the encoding result to the data user to construct a Labeled PSI protocol under a semi - honest security model. The implementation method is as follows:

[0135] E1. For each element \(x\) in the dataset \(X\), the cloud server forms a set of key - value pairs \(I\) by combining the element \(x\) with its corresponding value \(x\oplus L'[x]\), that is, \(I=\{x\) i , \(x\) i \oplus L'[x\) i |i\in[n\) x}, where \(x\) i represents the \(i\) - th data element, \(L'[x\) i represents the extended label value corresponding to the \(i\) - th data element, \(n\) x represents the total number of elements in the dataset \(X\), and \(i\) represents the relative position of the element \(x\) i in the dataset \(X\);

[0136] E2. The cloud server selects the encoding algorithm Encode of OKVS to encode the set I, that is and sends the encoding result to the data user to construct the Labeled PSI protocol under the semi - honest security model. Among them, OKVS includes an encoding algorithm Encode and a decoding algorithm Decode. For any key k and its corresponding value v, the following formula is satisfied:

[0137]

[0138] Among them, H F represents a random hash function, Encode() represents the encoding operation, k represents the key to be encoded, and v represents the value corresponding to the key k.

[0139] In this embodiment, the cloud server Server forms a key - value pair set by combining the element x in the data set X with its corresponding exclusive - or value x⊕L'[x], that is, I = {x i , x i ⊕L'[x]|i∈[n x}, and calls the OKVS encoding algorithm to encode the key - value pair set. That is, the encoding result is

[0140] In particular, in this embodiment, for any k = x and v = x⊕L'[x], except for the encoding failure probability 2 -λ , the following are all satisfied and Among them, is the computational security parameter, and H F represents a random hash function.

[0141] Finally, the cloud server Server sends the encoding result to the data user DU for calculating the intersection elements and their corresponding label values.

[0142] S203. For each element y in the data set Y, the data user calculates its OKVS decoded value and solves its corresponding label value and determines whether it is the correct label value according to whether the first λ bits are 0. Among them, represents the encoding result obtained in S202, represents the decoded value of by the OKVS decoding algorithm based on the key y; its implementation method is as follows:

[0143] F1. For each element y in the data set Y, the data user calculates its OKVS decoded value Among them, when inputting any encoded key k and the encoding result Solve the value v corresponding to the key k through the OKVS decoding algorithm Decode; input any unencoded key k' and the encoding result The OKVS decoding algorithm Decode is used to obtain an indistinguishable random value.

[0144] F2, according to the decoded value The data user uses the following formula to solve the label value L'[y] corresponding to the element:

[0145]

[0146] F3. The data user determines whether the element y is an intersection element and whether the tag value is a correct tag value based on whether the first λ bits of the tag value are 0. At the application layer, if the element y belongs to the intersection element, the keyword to be queried can be matched in the ciphertext database, and its corresponding tag value is the document tag value set expected to be searched.

[0147] In this embodiment, the data user DU uses each element y in the data set Y to receive the encoding result. Decode, that is, solve According to the decoded value, the label value L'[y] corresponding to the element can be further solved through the XOR operation, that is, The data user DU can determine whether the element belongs to the intersection set and whether the label value is a correct label value based on the first λ bits of the label value.

[0148] S3. At the application layer, data users collaborate with cloud servers to design database search methods, call the LabeledPSI protocol for multi-keyword searches, and decrypt the search results.

[0149] In this embodiment, at the application layer, the data user and the cloud server jointly negotiate a database search algorithm to complete the retrieval and decryption of ciphertext. The data user initiates a search request based on a set of query keywords and invokes S2's Labeled PSI protocol to perform a multi-keyword search. The cloud server calculates the intersection according to the protocol and returns the ciphertext search results. After obtaining the search results, the data user decrypts them using the corresponding key to recover the plaintext document data. This is achieved as follows:

[0150] S301, at the application layer, the cloud server pre-processes the ciphertext database and searches for ciphertext tokens corresponding to different keywords w Save it to the set SX, and save its corresponding encrypted bitmap index vector EBS to the label set SL. The implementation method is as follows:

[0151] G1. At the application layer, the cloud server initializes empty sets SX and SL;

[0152] G2. The cloud server processes the ciphertext database and stores the ciphertext search token st w in the set SX, and stores the corresponding encrypted bitmap index EBS of the ciphertext search token st w in the set SL. Among them, the set SX in S3 corresponds to the data set X in S2, and the ciphertext search token st in the set SX w corresponds to the element x in the data set X, the set SL corresponds to the label data set L, and each ciphertext search token st w corresponds to the corresponding encrypted bitmap index EBS corresponding to the label value L[x].

[0153] In this embodiment, the data user DU and the cloud server Server jointly negotiate a database search algorithm Search, which is divided into an offline phase and an online phase.

[0154] In this embodiment, the cloud server Server first initializes empty lists SX and SL in the offline phase. SX is used to store the search token st in the ciphertext database w , and SL is used to store the corresponding encrypted bitmap index EBS in the ciphertext database.

[0155] S302. The data user preprocesses each keyword in the keyword set Q to be queried, generates the corresponding ciphertext search token st w through the keyword status table σ, and saves it in the set CY. The implementation method is as follows:

[0156] H1. The data user initializes empty sets CY and result set R;

[0157] H2. For each keyword w ∈ Q in the keyword set to be queried, the data user DU i queries its corresponding subset of the keyword status table σ i , and obtains the update count n ← σ i [w], where σ i [w] represents the total update count recorded by the keyword w in the status table σ i ;

[0158] H3. The data user generates the corresponding keyword token kt w ←F(K s , w), and calculates its corresponding ciphertext search token st w ←H(kt w , n), and saves the ciphertext search token in the set CY. Among them, the set CY in S3 corresponds to the data set Y in S2, and the ciphertext search token st in the set CY w corresponds to the element y in the data set Y, Ks denotes the keyword master key, which is used to generate keyword tokens and compute search tokens. F represents a pseudorandom function, H represents a random hash function, n represents the number of updates before querying keyword w in the keyword status table σ, n + 1 represents the number of updates corresponding to the current update operation, and kt w denotes the keyword token.

[0159] In this embodiment, the data user DU first initializes an empty mapping table CY and an empty result set R. CY is used to store the search tokens corresponding to the set of keywords Q to be queried, and R is used to store the search results obtained after the protocol runs to completion;

[0160] For each keyword w ∈ Q in the set of keywords to be queried, the data user DU i queries the corresponding subset σ of the keyword status table i to obtain the number of updates n corresponding to keyword w ← σ i [w]; and generates the corresponding keyword token kt w ← F(K s , w), and computes the corresponding search token st w ← H(kt w , n), and saves the search token to CY.

[0161] S303. The data user and the cloud server jointly call the Labeled PSI protocol. After the protocol runs to completion, the data user obtains the search results and solves them using the decryption key. The implementation method is as follows:

[0162] I1. Let the data set of the cloud server be SX and the set of label values be SL, where each element st w corresponds to a label value EBS, and let the data set of the data user be CY, where EBS represents the encrypted bitmap index vector;

[0163] I2. The cloud server and the data user jointly call the Labeled PSI protocol. The data user obtains the intersection result and the correct ciphertext label value, and saves the search results to the set R;

[0164] I3. The data user uses the key K doc to decrypt the encrypted bitmap index to obtain the required document identifier, and completes the solution of the search results.

[0165] In particular, since the Labeled PSI protocol is called to assist keyword retrieval in the search phase, the cloud server is prevented from obtaining the information of the keywords to be queried, and the bitmap index is used to hide the returned document information. Therefore, the search mode and access mode can be hidden.

[0166] In the online phase of this embodiment, the data user DU and the cloud server Server jointly call the Labeled PSI protocol of S2 in the online phase. To clarify the correspondence between the set and the elements, it is described as follows: where the data set SX corresponds to the data set X in step S2, the search token in SX corresponds to the element x in X, the set SL corresponds to the label data set L, and the encrypted bitmap index EBS corresponding to each search token corresponds to the label value L[x]; the data set CY corresponds to the data set Y in step S2, and the search token st w corresponds to the element y in Y;

[0167] After the Labeled PSI protocol runs to completion, finally the data user DU i obtains the final intersection result and the correct ciphertext label value L'[y]; the data user DU i uses the additive homomorphic decryption key K doc to decrypt the bitmap index and obtain the required document identifier.

[0168] In this embodiment, the present invention is a multi-keyword dynamic searchable encryption model based on a single-write multi-read system model. The present invention can generally be divided into three phases: Setup, Update, and Search (initialization, update, and search); in the Update phase, the present invention uses a bitmap index structure to support dynamic data updates, and at the same time distributes subsets of the keyword status table to different users to implement multi-user access right management based on keywords; in the Search phase, multi-keyword search is performed by calling the Labeled PSI protocol module. After the data owner obtains the search result, the corresponding key is used to decrypt the result to restore the plaintext data.

[0169] In this embodiment, the present invention is mainly applicable to the scenario of dynamic data updates and is divided into three entities: the data owner DO, the data user DU, and the cloud server Server. The data document doc=(id, W id ) contains the unique document identifier id∈{0,1} * and the keyword set W id ; in the plaintext document set DB, let the set of document identifiers corresponding to the keyword w be DB(w)={id|w∈W id}. In the Setup phase, the data owner DO randomly generates the key parameters K s and K doc , and initializes the keyword status table σ, where K s represents the keyword master key, which is used to generate keyword tokens and calculate search tokens, K docRepresents the key of the additive homomorphic encryption algorithm, which is used to encrypt or decrypt the bitmap index vector. σ is used to store the update times of each keyword. Further, the data owner distributes subsets of the keyword status table σ to different users i , to implement keyword-based multi-user access permission management. Since the keyword status table σ i records the information necessary to generate search tokens, data consumers can only generate valid search tokens for the keywords they are authorized for, and cannot query unauthorized keywords, thus realizing keyword-based multi-user access control.

[0170] In this embodiment, to improve data update efficiency and reduce communication complexity, the present invention adopts a bitmap index structure, and only one modulo addition operation on the ciphertext index using the additive homomorphic encryption algorithm is required in the update operation. To encrypt the plaintext document set DB according to the index structure, it is necessary to introduce temporary empty lists ADD and T w , and the functions of each list are as described above. Therefore, the data owner DO in the Update stage includes the following steps:

[0171] Step 1: For the plaintext document set DB, the data owner processes each document doc one by one, extracts the keywords and document identifiers in the document, and saves all the keywords to the set T w ;

[0172] Step 2: For the selected keyword w ∈ T w , the data owner queries σ to obtain its previous update times n ← σ[w]; if the keyword does not exist in σ, it is saved to σ and the initial update times are set to 0; it should be noted that the status table σ does not need to be updated at this time;

[0173] Step 3: For the keyword w, generate its corresponding bitmap index vector BS ← b1, b2,..., b j , if the keyword w exists in the j-th document, the j-th bit b of the bitmap index vector BS j is 1, otherwise it is 0;

[0174] In particular, if the update operation type op is a deletion operation, the modulo complement operation needs to be performed on the bitmap index vector first:

[0175] BS ← ((111...111)2 - BS) mod 2 α

[0176] where α represents the total number of files in the database.

[0177] Subsequently, using the following formula, based on the key K docUse the additive homomorphic encryption algorithm to encrypt the bitmap index vector BS to obtain EBS:

[0178] EBS ← Enc(K doc , BS)

[0179] where Enc represents the additive homomorphic encryption algorithm, and b j represents the j-th bit in the bitmap index vector;

[0180] Step 4: The data owner uses the keyword key K s to generate the keyword token kt w ← F(K s , w), and calculates the search token st w using the following formula:

[0181] st w ← H(kt w , n + 1)

[0182] where F represents the pseudo-random function, H represents the random hash function, n is the number of updates of w before querying in the state table σ, and n + 1 represents the number of updates corresponding to this update operation;

[0183] Subsequently, kt w , st w and the encrypted bitmap index vector EBS are saved to the set ADD, and finally the data owner sends the set ADD to the cloud server;

[0184] Repeat steps 1 to 4 until all documents in the plaintext document set DB are processed. At this time, the set T w stores all the keywords of this update operation;

[0185] Step 5: For each keyword w in the set T w , query the state table to obtain its corresponding update number n ← σ[w], and update the state table using σ[w] ← n + 1;

[0186] Step 6: The cloud server merges the corresponding different search tokens and encrypted bitmaps indexes with the content of the ciphertext database according to the keyword token kt w to complete the update operation of the ciphertext database.

[0187] In particular, in the data update phase, the new search token is updated through the keyword token and the keyword state table locally saved by the data owner DO. The previous search token cannot be known through the latest search token; if the data user uses the previous search token while the cloud server holds the latest search token The two parties calculate the set intersection through LabeledPSI. Since Therefore, the data user cannot obtain any information using the previous search token. In summary, the present invention is forward secure.

[0188] Since the present invention is based on a bitmap index structure, its index update only needs to perform a modulo addition on the ciphertext database through the additive homomorphic encryption algorithm to complete the document addition and deletion operations, and will not disclose the insertion time or the time corresponding to the file inserted first and then deleted. At the same time, due to the zero privacy leakage of the Labeled PSI protocol, for the files added and then deleted during the two queries, the cloud server cannot obtain their relevant information either. In summary, the present invention is backward secure at the Type-I - level.

[0189] In the Search phase, since the present invention uses the Labeled PSI protocol to ensure the secure operation of the search mechanism, before the formal operation of the protocol, that is, in the offline phase, the cloud server needs to perform dataset initialization in advance: by the cloud server, initialize the empty lists SX and SL; and store the search token st w in the list SX, and store the encrypted bitmap index EBS corresponding to the search token st w in the list SL; the data user DU i In the online phase, initialize the empty lists CY and the result set R. For each keyword w ∈ Q in the set of keywords to be queried, by the data user DU i query its corresponding subset of the keyword status table σ i , and obtain the update count n ← σ i [w] corresponding to the keyword w; and generate the corresponding keyword token kt w ← F(K s , w), and calculate its corresponding search token st w ← H(kt w , n), and save the search token to CY; further, the cloud server and the data user jointly call the Labeled PSI protocol, the cloud server acts as the role of the cloud server, the data user acts as the role of the data user, and finally the data user obtains the intersection result and the correct ciphertext label value, and saves the search result to the set R; by the data user, use the key K doc to decrypt the bitmap index to obtain the required document identifier.

[0190] Those of ordinary skill in the art will realize that the embodiments described herein are to assist the reader in understanding the implementation methods of the present invention, and it should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those of ordinary skill in the art can make various other specific deformations and combinations that do not depart from the essence of the present invention based on these technical revelations disclosed in the present invention, and these deformations and combinations are still within the protection scope of the present invention.

Claims

1. A multi-user dynamic searchable encryption method based on LabeledPSI, characterized in that, It includes the following steps: S1. At the management layer, the data owner and the cloud server jointly negotiate a database update algorithm to support dynamic data update and implement multi-user access right management based on keywords; S2. At the search module, the data user and the cloud server use the OKVS algorithm to construct a Labeled PSI protocol applicable to the field of searchable encryption; S3. At the application layer, the data user and the cloud server cooperate to design a database search method, call the Labeled PSI protocol for multi-keyword search, and decrypt the search results.

2. The multi-user dynamic searchable encryption method based on LabeledPSI according to claim 1, characterized in that, The specific content of S1 is as follows: S101. At the management layer, the data owner generates key privacy parameters required for update and search operations and initializes an empty keyword status table; S102. The data owner and the cloud server jointly negotiate a database update method, encrypt the plaintext document, and generate a corresponding bitmap index structure to complete the update operation of the ciphertext database. Among them, by the data owner encrypting the plaintext document and maintaining the index structure of the ciphertext database, dynamic data update is supported; S103. Based on keyword-based multi-user access right management is realized by the data owner distributing subsets of keyword status to different users.

3. The multi-user dynamic searchable encryption method based on LabeledPSI according to claim 2, wherein, The specific content of S101 is as follows: A1. At the management level, the data owner randomly generates a key K in the {0, 1} λ space, where λ represents the computational security parameter, K s and K doc , where λ represents the computational security parameter, K s represents the keyword master key, which is used to generate keyword tokens and compute search tokens, and K doc represents the key of the additive homomorphic encryption algorithm, which is used to encrypt or decrypt the bitmap index vector; A2. The data owner initializes an empty keyword status table σ for recording the total update times of each keyword. The data user generates corresponding keyword search tokens based on the information recorded in the keyword status table σ.

4. The multi-user dynamic searchable encryption method based on LabeledPSI according to claim 2, wherein The specific content of S102 is as follows: B1. The data owner initializes an empty mapping table ADD and T required for this update operation w , where the table ADD is used to store the mapping relationship between the search token and the ciphertext database, and the table T w is used to store the temporarily extracted keyword set; B2. For the plaintext document set DB, the data owner processes each document doc one by one, extracts the keywords and document identifiers in the document, and saves all the keywords to the keyword set T w ; B3. For the selected keyword w ∈ T w , the data owner queries the keyword status table σ to obtain the number of updates n before the keyword w, where n ← σ[w]; if the keyword w does not exist in the keyword status table σ, then the keyword w is saved to the keyword status table σ and the initial number of updates is set to 0; at this time, there is no need to update the keyword status table σ, and σ[w] represents the total number of updates recorded for the keyword w in the keyword status table σ; B4. For keyword w, generate its corresponding bitmap index vector BS ← b1, b2,..., b j , if keyword w exists in the j-th document, then the j-th bit bj of the bitmap index vector BS j is 1, otherwise it is 0, where If the update operation type op is a deletion operation, first perform a complement modulo operation on the bitmap index vector: BS ← ((111...111)₂ - BS) mod 2 α where α represents the total number of files in the database; Based on the secret key K using the following formula doc Use the additive homomorphic encryption algorithm to encrypt the bitmap index vector BS to obtain the encrypted bitmap index vector EBS: EBS←Enc(K doc ,BS) Among them, Enc represents the additive homomorphic encryption algorithm, BS represents the bitmap index vector, and b j represents the j-th bit in the bitmap index vector; B5. By the data owner, using the keyword key K s Generate the keyword token kt w ←F(K s , w), calculate the search token st using the following formula w , and save the keyword token kt w , the search token st w and the encrypted bitmap index vector EBS into the set ADD, and the data owner sends the set ADD to the cloud server: st w ←H(kt w ,n+1) where F represents a pseudo-random function, H represents a random hash function, n represents the update times before querying the keyword w in the keyword status table σ, and n + 1 represents the update times corresponding to this update operation; B6. For each keyword w in the set T w the keyword status table σ obtains the update count n corresponding to the keyword w, n ← σ[w], and updates the status table using σ[w] ← n + 1; B7. The cloud server merges the corresponding different search tokens and encrypted bitmap indexes with the content of the ciphertext database according to the keyword token kt w , and completes the update operation of the ciphertext database.

5. The multi-user dynamic searchable encryption method based on LabeledPSI according to claim 2, characterized in that, The specific content of S103 is as follows: C1. For different data users DU1, DU2,..., DU m , the data owner sets keyword access permissions for them, where DU m represents a data user; C2. The data owner divides the keyword status table σ into different subsets σ1, σ2,..., σ m , and distributes them to the corresponding data users; C3. By the data user DU i , use the distributed keyword status table σ during the search phase i to construct a search token and complete the keyword search operation; among them, since the keyword status table σ i records the information necessary to generate the search token, the data user can only generate a valid search token for its authorized keywords and cannot query unauthorized keywords, realizing multi-user access control based on keywords.

6. The multi - user dynamic searchable encryption method based on LabeledPSI according to claim 1, wherein, The specific content of S2 is as follows: S201. In the search module, the cloud server holds a dataset X of size n x , and for each element x ∈ X in the dataset X, its corresponding label value is L[x]; the data user holds a dataset Y of size n y . In the preprocessing stage, first, the cloud server adds λ bits to the label L[x] to expand it to L'[x] = 0 λ ||L[x]. Subsequently, the cloud server obtains the set of all label values . Finally, the cloud server calculates the XOR value of the element value and its extended label . L'[x] represents the extended label value, represents the n x th element corresponding extended label value; S202. The cloud server encodes the set of key-value pairs composed of element x and to obtain an encoding result and sends the encoding result to the data user to construct a Labeled PSI protocol under a semi-honest security model; S203. For each element y in the dataset Y, the data user calculates its OKVS decoded value and solves for its corresponding tag value and determines whether it is the correct tag value based on whether the first λ bits are 0, where represents the encoding result obtained in S202, represents the OKVS decoding algorithm based on the key y for the decoded value.

7. The multi-user dynamic searchable encryption method based on LabeledPSI according to claim 6, wherein The specific content of S201 is as follows: D1. In the search module, the cloud server holds a dataset X of size n x and a set of label values L. For each element x ∈ X, there is a corresponding label value L[x]; the data user holds a dataset Y of size n y . D2. In the preprocessing stage, for the label value L[x] corresponding to each element x in the dataset X, the cloud server adds λ bits of 0 bits to it and expands it to L'[x]=0 λ ||L[x], and the cloud server obtains the set of all label values D3. For each element x ∈ X in the dataset X, the cloud server calculates the exclusive OR value of the element value and its extended label The specific content of S202 is as follows: E1. For each element x in the data set X, the cloud server combines the element x with its corresponding value to form a key-value pair set I, that is where x i represents the i-th data element, and L'[x i represents the extended label value corresponding to the i-th data element, and n x represents the total number of elements in the data set X, and i represents the relative position of the element x i in the data set X; E2. The cloud server selects the encoding algorithm Encode of OKVS to encode the set I, that is and sends the encoding result to the data user to construct a Labeled PSI protocol under the semi-honest security model. Among them, OKVS includes an encoding algorithm Encode and a decoding algorithm Decode. For any key k and its corresponding value v, the following formula is satisfied: Among them, H F represents a random hash function, Encode() represents an encoding operation, k represents the key to be encoded, and v represents the value corresponding to the key k; The specific content of S203 is as follows: F1. For each element y in the data set Y, the data user calculates its OKVS decoded value where, for any encoded key k and the encoding result the value v corresponding to the key k is solved by the OKVS decoding algorithm Decode; for any unencoded key k' and the encoding result an indistinguishable random value is solved by the OKVS decoding algorithm Decode; F2. According to the decoded value The data user uses the following formula to solve the tag value L'[y] corresponding to the element: F3. The data user determines whether the element y is an intersection element and whether the label value is the correct label value according to whether the first λ bits of the label value are 0. Among them, at the application layer, if the element y belongs to the intersection element, the keyword to be queried can be matched in the ciphertext database, and its corresponding label value is the set of document label values expected to be searched.

8. The multi - user dynamic searchable encryption method based on LabeledPSI according to claim 7, wherein, The specific content of S3 is as follows: S301. At the application layer, the cloud server preprocesses the ciphertext database, saves the ciphertext search tokens st corresponding to different keywords into the set SX, and saves the corresponding encrypted bitmap index vector EBS into the label set SL; w ​ S302. Each keyword in the set Q of keywords to be queried is preprocessed by the data user, and the corresponding ciphertext search token st is generated through the keyword status table σ w and saved to the set CY; S303. The data user and the cloud server jointly call the Labeled PSI protocol. After the protocol runs, the data user obtains the search results and solves them through the decryption key.

9. The multi-user dynamic searchable encryption method based on LabeledPSI according to claim 8, characterized in that The specific content of S301 is as follows: G1. At the application layer, the cloud server initializes empty sets SX and SL; G2. The cloud server processes the ciphertext database and stores the ciphertext search token st w in the set SX, and stores the encrypted bitmap index EBS corresponding to the ciphertext search token st w in the set SL. Among them, the set SX in S3 corresponds to the data set X in S2, and the ciphertext search token st w in the set SX corresponds to the element x in the data set X, the set SL corresponds to the label data set L, and each ciphertext search token st w corresponds to the encrypted bitmap index EBS corresponding to the label value L[x]; The specific content of S302 is as follows: H1. The data user initializes empty sets CY and result set R; H2. For each keyword w ∈ Q in the set of keywords to be queried, the data user DU i queries its corresponding subset σ of the keyword status table i , and obtains the update count n ← σ i [w], where σ i [w] represents the total update count of keyword w recorded in the status table σ i ; H3. The data user generates the corresponding keyword token kt w ←F(K s , w), and calculates its corresponding ciphertext search token st w ←H(kt w , n), and saves the ciphertext search token to the set CY. Among them, the set CY in S3 corresponds to the data set Y in S2, and the ciphertext search token st in the set CY w corresponds to the element y in the data set Y, K s represents the keyword master key, which is used to generate keyword tokens and calculate search tokens. F represents a pseudo-random function, H represents a random hash function, n represents the number of updates before querying the keyword w in the keyword status table σ, n + 1 represents the number of updates corresponding to this update operation, and kt w represents the keyword token; The specific content of S303 is as follows: I1. Let the data set of the cloud server be SX and the set of tag values be SL, where each element st w corresponds to a tag value EBS, and let the data set of the data user be CY, where EBS represents an encrypted bitmap index vector; I2. The cloud server and the data user jointly invoke the Labeled PSI protocol. The data user obtains the intersection result and the correct ciphertext label value, and saves the search result to the set R. I3. The data user uses the key K doc to decrypt the encrypted bitmap index to obtain the required document identifier, thereby completing the solution of the search results.

Images