Multi-user dynamic searchable encryption method based on labeled psi

Abstract

This invention provides a multi-user dynamic searchable encryption method based on LabeledPSI, relating to the fields of information security technology and secure multi-party computation. First, at the management layer, the data owner and the cloud server collaborate to design a database update method to support dynamic data updates and implement keyword-based multi-user access control. Then, in the search module, the data user and the cloud server utilize the OKVS algorithm to construct a Labeled PSI protocol suitable for searchable encryption. Finally, at the application layer, the data user and the cloud server collaborate to design a database search method, calling the Labeled PSI protocol to perform multi-keyword searches and decrypting the search results. This invention enhances the privacy protection capabilities and performance optimization of dynamic searchable encryption technology.

Description

Technical Field

[0001] This invention relates to the fields of information security technology and secure multi-party computation, and particularly to a multi-user dynamic searchable encryption method based on LabeledPSI. Background Technology

[0002] With the rapid development of cloud computing technology, cloud storage has become an effective means of solving the problems of large-capacity data storage, interaction, and management. Cloud servers can provide enterprises or individuals with flexible and convenient storage and computing services, and can support multiple users to access remotely and conduct collaborative computing. However, in a cloud computing environment, data storage and computing are outsourced to cloud servers, and users cannot directly control their data, which leads to serious security threats to data privacy. Malicious cloud servers or external attackers may steal sensitive user information and even speculate on user behavior through data analysis. Therefore, while ensuring data privacy and security, how to efficiently retrieve data has become a key issue.

[0003] To address privacy concerns in cloud storage environments, searchable encryption (SE) has emerged and received extensive research and development. SE allows users to perform keyword searches on ciphertext without decrypting the entire database, thus achieving efficient retrieval while ensuring data confidentiality. However, existing searchable encryption schemes still have the following problems:

[0004] (1) Problems in dynamic update scenarios: Most searchable encryption schemes are mainly applicable to static datasets, that is, the data does not change after encryption, which is difficult to meet the needs of dynamic data updates in the real world. Once the stored data needs to be updated, the index often needs to be reconstructed, which will bring huge computational and storage overhead in large-scale data scenarios.

[0005] (2) High computational and communication overhead: Some searchable encryption schemes are constructed using complex cryptographic primitives (such as fully homomorphic encryption, bilinear mapping, etc.), which leads to high computational and communication costs during the search phase and affects the practicality of the scheme.

[0006] (3) Privacy leakage risk: Some searchable encryption schemes may have problems such as search pattern leakage and access pattern leakage during the search phase. Malicious cloud servers or external attackers may use such leaked information to infer users' search behavior, thereby undermining the privacy protection mechanism.

[0007] To address the aforementioned issues, researchers have introduced the Labeled Private Set Intersection (Labeled PSI) protocol to optimize searchable encryption schemes. Labeled PSI is essentially an extension of Private Set Intersection (PSI), allowing multiple participants to compute the intersection without exposing their individual data, while attaching label information. This enables Labeled PSI to provide flexible data access while protecting user query privacy. Searchable encryption schemes based on Labeled PSI can hide the statistical properties of ciphertext keywords, providing higher security and better scalability. However, existing searchable encryption schemes based on Labeled PSI still have the following shortcomings:

[0008] (1) Search efficiency problem: These solutions involve a lot of interactive communication during the search process, resulting in huge communication overhead, which reduces retrieval efficiency and makes them difficult to apply to large-scale cloud storage application scenarios.

[0009] (2) Functional expansion issues: Existing solutions are limited to static dataset scenarios, and some solutions only support single keyword matching and cannot perform complex searches such as multi-keyword queries;

[0010] (3) System model problem: Most existing solutions adopt the "single write and single read" system model, which does not allow access control for different users based on keywords, which is not conducive to data sharing and collaborative applications.

[0011] In summary, existing searchable encryption schemes based on Labeled PSI still face many challenges in terms of functionality, efficiency, and security. Summary of the Invention

[0012] To address the aforementioned shortcomings in existing technologies, this invention provides a multi-user dynamic searchable encryption method based on LabeledPSI, aiming to solve the problem of efficient retrieval of multi-user data dynamic updates and privacy protection in a cloud computing environment.

[0013] To achieve the above objectives, the technical solution adopted by this invention is: a multi-user dynamically searchable encryption method based on LabeledPSI, comprising the following steps:

[0014] S1. At the management level, the data owner and the cloud server jointly negotiate the database update algorithm to support dynamic data updates and implement keyword-based multi-user access control.

[0015] S2. In the search module, the data user and the cloud server use the OKVS algorithm to construct the Labeled PSI protocol suitable for the searchable encryption field.

[0016] S3. At the application layer, data users collaborate with cloud servers to design database search methods, call the LabeledPSI protocol to perform multi-keyword searches, and decrypt the search results.

[0017] The beneficial effects of this invention are as follows: First, at the management layer, the data owner and the cloud server collaborate to design a database update method to support dynamic data updates and implement keyword-based multi-user access control. Then, in the search module, the data user and the cloud server utilize the OKVS algorithm to construct Labeled PSI technology suitable for the field of searchable encryption. Finally, at the application layer, the data user and the cloud server collaborate to design a database search method, calling Labeled PSI for multi-keyword searches and decrypting the search results. Through this invention, the privacy protection capabilities and performance optimization of dynamic searchable encryption technology are further enhanced. It aims to improve the search efficiency of searchable encryption schemes while ensuring data privacy and security, and to extend it to multi-user, dynamically updated data application scenarios.

[0018] Furthermore, S1 specifically refers to:

[0019] S101. At the management level, the data owner generates the key privacy parameters required for update and search operations and initializes an empty key state table.

[0020] S102. The data owner and the cloud server jointly negotiate the database update method, encrypt the plaintext document, generate the corresponding bitmap index structure, and complete the update operation of the ciphertext database. In this process, the data owner encrypts the plaintext document and maintains the index structure of the ciphertext database to support dynamic data updates.

[0021] S103. By distributing a subset of keyword statuses to different users by the data owner, multi-user access control based on keywords is achieved.

[0022] The beneficial effects of the above-mentioned further solutions are: through the collaboration between data owners and cloud servers, database update algorithms are jointly negotiated, and keyword-based multi-user access control and permission management are implemented. According to the solution description, step S1, by combining dynamic update mechanisms, encryption technology, and multi-user permission management, provides searchable encryption schemes with greater flexibility, privacy protection, and efficient database management methods, significantly improving the system's performance in terms of security, privacy, and scalability.

[0023] Furthermore, S101 specifically includes:

[0024] A1. At the management level, the data owner is in {0,1} λKey K is randomly generated in space s and K doc Where λ represents the calculated safety parameter, K s This represents the key master key, used to generate key tokens and calculate search tokens, K. doc This represents the key for the additive homomorphic encryption algorithm, used to encrypt or decrypt bitmap index vectors;

[0025] A2. The data owner initializes an empty keyword status table σ to record the total number of updates for each keyword. Data users generate corresponding keyword search tokens based on the information recorded in the keyword status table σ.

[0026] The beneficial effects of the above-mentioned further solutions are: the generation and management of key privacy parameters can effectively protect the security of the data owner's encryption key, prevent cloud servers or other malicious third parties from obtaining complete key information, thereby improving the security of the entire system. Specifically, the update mechanism based on encryption keys and dynamic keyword state tables ensures the confidentiality and consistency of ciphertext data and index structure during the database update process, avoiding security vulnerabilities that may be encountered in traditional database dynamic updates.

[0027] Furthermore, S102 specifically includes:

[0028] B1. The data owner initializes the empty mapping tables ADD and T required for this update operation. w Table ADD stores the mapping between search tokens and the encrypted database, while table T... w Used to store a set of keywords that have been temporarily extracted;

[0029] B2. For the plaintext document set DB, the data owner processes each document doc one by one, extracting keywords and document identifiers from the documents, and saving all keywords to the keyword set T. w middle;

[0030] B3. For the selected keyword w∈T w The data owner queries the keyword status table σ to obtain the number of updates n←σ[w] before keyword w; if keyword w does not exist in the keyword status table σ, then keyword w is saved to the keyword status table σ and the initial update count is set to 0; where, at this time, there is no need to update the keyword status table σ, and σ[w] represents the total number of updates recorded for keyword w in the keyword status table σ.

[0031] B4. For the keyword w, generate its corresponding bitmap index vector BS←b1,b2,...,b j If keyword w exists in the j-th document, then the j-th bit b in the bitmap index vector BS is... jIt is 1 if it is not 0 otherwise, where,

[0032] If the update operation type op is a delete operation, then first perform a complement modulo operation on the bitmap index vector:

[0033] BS←((111...111)2-BS)mod2 α

[0034] Where α represents the total number of files in the database;

[0035] Then, using the following formula, based on key K doc The bitmap index vector BS is encrypted using an additive homomorphic encryption algorithm to obtain the encrypted bitmap index vector EBS:

[0036] EBS←Enc(K doc ,BS)

[0037] Where Enc represents the additive homomorphic encryption algorithm, BS represents the bitmap index vector, and b j This represents the j-th bit in the bitmap index vector;

[0038] B5. By the data owner, using the key K s Generate keyword token kt w ←F(K s The search token st is calculated using the following formula (w). w and the keyword token kt w Search token st w The encrypted bitmap index vector EBS is saved to a collection ADD, and the data owner sends the collection ADD to the cloud server:

[0039] st w ←H(kt w (n+1)

[0040] Where F represents a pseudo-random function, H represents a random hash function, n represents the number of updates before the keyword w is found in the keyword status table σ, and n+1 represents the number of updates corresponding to this update operation;

[0041] B6. For set T w For each keyword w in the table, the keyword state table σ obtains the update count n←σ[w] corresponding to keyword w, and updates the state table using σ[w]←n+1;

[0042] B7. The cloud server determines the keyword token kt. w The corresponding different search tokens and encrypted bitmap indexes are merged with the contents of the ciphertext database to complete the update operation of the ciphertext database.

[0043] The beneficial effects of the above-mentioned further scheme are: through precise index management, flexible update operation support, encrypted privacy protection, secure key management mechanism, and automated update process, it further enhances the capabilities of searchable encryption schemes in dynamic updates, data privacy protection, and multi-user access control. Whether it's a large database with frequent updates or a complex scenario with multiple users concurrently querying, this design can effectively support data updates and encrypted retrieval. Specifically, steps B2 and B3 describe a precise database update process, allowing for accurate location of each document's update based on its keywords and document identifier; step B4 uses a complement modulo operation, enabling flexible adjustment of the bitmap index to support more complex database update operations; and steps B5 to B7 ensure that during each update, the update information corresponding to the keywords is automatically obtained to maintain the state table and complete the merging of the encrypted database on the cloud server.

[0044] Furthermore, S103 specifically includes:

[0045] C1. For different data users DU1, DU2, ..., DU m The data owner sets keyword access permissions for it, where DU m Indicates the data user;

[0046] C2. The data owner divides the key state table σ into different subsets σ1, σ2, ..., σ... m And distribute it to the corresponding data users;

[0047] C3, by data user DU i During the search phase, the distributed keyword status table σ is used. i Construct a search token and complete the keyword search operation; where, due to the keyword status table σ i It records the information necessary to generate a search token. Data users can only generate valid search tokens for their authorized keywords and cannot query for unauthorized keywords, thus realizing keyword-based multi-user access control.

[0048] The beneficial effects of the aforementioned further solutions are: by finely managing the keyword status table of each data user in a multi-user environment, data privacy and security are enhanced, and user access behavior is effectively controlled. Specifically, each data user can only generate a search token for authorized keywords based on a subset of the keyword status table distributed by the data owner, thereby achieving an efficient and flexible permission management mechanism. In addition, the data owner can flexibly adjust the permissions of each data user according to business needs without requiring large-scale modifications or reconstructions to the database structure, and this control mechanism can prevent permission abuse and malicious access.

[0049] Furthermore, S2 specifically refers to:

[0050] S201. In the search module, the cloud server holds a size of n. x Given a dataset X, for each element x∈X in dataset X, its corresponding label value is L[x]; the data user holds a dataset of size n. y The dataset Y; in the preprocessing stage, the cloud server first adds λ bits to the label L[x], expanding it to L'[x] = 0. λ ||L[x], then the cloud server obtains the set of all tag values. Finally, the cloud server calculates the XOR value x⊕L'[x] between the element value and its extended tag, where L'[x] represents the extended tag value. Indicates the nth x element The corresponding extended tag value;

[0051] S202. The cloud server encodes the set of key-value pairs consisting of element x and x⊕L'[x] based on the OKVS algorithm to obtain the encoding result. and the encoding result Send to data users to build the Labeled PSI protocol under the semi-honest security model;

[0052] S203. For each element y in dataset Y, the data user calculates its OKVS decoding value and solves for its corresponding label value. And it determines whether it is a correct label value based on whether the first λ bits are 0, where, This represents the encoding result obtained from S202. This indicates that the OKVS decoding algorithm is based on key y pairs. The decoded value.

[0053] The beneficial effects of the aforementioned further scheme are: by combining the OKVS algorithm for element and label encoding, label expansion, and XOR operations, the constructed Labeled PSI protocol enhances data privacy protection, improves protocol security, and effectively prevents label leakage and attacks. Specifically, through efficient encryption encoding operations and decoding verification mechanisms, the Labeled PSI protocol can maintain good performance in large-scale data environments, while improving the security, accuracy, and anti-attack capabilities of searchable encryption schemes during the search phase.

[0054] Furthermore, S201 specifically includes:

[0055] D1. In the search module, the cloud server holds a size of n. xGiven a dataset X and a set of label values ​​L, for each element x∈X, there is a corresponding label value L[x]; the data user holds a set of n data values. y The dataset Y;

[0056] D2. In the preprocessing stage, for each element x in the dataset X corresponding to the label value L[x], the cloud server adds λ zero bits to it and expands it to L'[x] = 0. λ ||L[x], and obtain the set of all tag values ​​from the cloud server.

[0057] D3. For each element x∈X in dataset X, the cloud server calculates the XOR value x⊕L'[x] of the element value and its extended label;

[0058] Specifically, S202 is as follows:

[0059] E1. For each element x in dataset X, the cloud server will form a key-value pair set I by combining element x with its corresponding value x⊕L'[x], i.e., I = {x} i ,x i ⊕L'[x i ]|i∈[n x ]}, where x i L'[x] represents the i-th data element. i ] represents the extended label value corresponding to the i-th data element, n x Let i represent the total number of elements in dataset X, and let i represent the number of elements in x. i Relative position in dataset X;

[0060] E2. The set I is encoded using the OKVS encoding algorithm (Encode) by the cloud server. and the encoding result Sending data to the user to construct the Labeled PSI protocol under the semi-honest security model, where OKVS includes an encoding algorithm (Encode) and a decoding algorithm (Decode), and for any key k and its corresponding value v, the following formula is satisfied:

[0061]

[0062]

[0063] Among them, H F This represents a random hash function, Encode() represents the encoding operation, k represents the key to be encoded, and v represents the value corresponding to key k.

[0064] Specifically, S203 is:

[0065] F1. For each element y in the dataset Y, the data user calculates its OKVS decoding value. The input consists of any encoded key k and the encoding result. The value v corresponding to the key k is obtained using the OKVS decoding algorithm; input any unencoded key k' and the encoded result. The indistinguishable random value is obtained by using OKVS's decoding algorithm.

[0066] F2, based on the decoded value The data user calculates the label value L'[y] corresponding to the element using the following formula:

[0067]

[0068] F3. The data user determines whether the element y is an intersection element and whether the tag value is a correct tag value based on whether the first λ bits of the tag value are 0. In the application layer, if the element y is an intersection element, the keyword to be queried can be matched in the encrypted database, and its corresponding tag value is the set of document tag values ​​expected to be obtained by the search.

[0069] The beneficial effects of the above-mentioned further scheme are as follows: By introducing the OKVS decoding algorithm and tag value verification mechanism, data users only need to identify the intersection elements through the first λ bits of the tag value during the search phase, effectively preventing the impact of incorrect tags and data tampering, while improving the efficiency and accuracy of multi-keyword queries. Specifically, step F1 processes the encoded result through the OKVS decoding algorithm. When an encoded key is input, it returns its corresponding value; when an unencoded key is input, the OKVS decoding algorithm outputs an indistinguishable random value. This design ensures that even if a cloud server or malicious user obtains the encoded result (i.e., the index structure), they cannot infer the actual content of the data, thereby preventing data leakage and abuse and enhancing data privacy protection. In steps F2 and F3, the data user calculates the tag value corresponding to the element based on the decoded value, and identifies the elements belonging to the intersection by verifying the first λ bits of the tag value, and quickly obtains the matching document in the encrypted database.

[0070] Furthermore, S3 specifically refers to:

[0071] S301. At the application layer, the cloud server preprocesses the encrypted database, separating the encrypted search tokens corresponding to different keywords. w Save it to the set SX, and save its corresponding encrypted bitmap index vector EBS to the tag set SL;

[0072] S302. The data user preprocesses each keyword in the keyword set Q to be queried, and generates a corresponding encrypted search token st through the keyword status table σ. w And save it to the collection CY;

[0073] S303. The Labeled PSI protocol is jointly invoked by the data user and the cloud server. After the protocol runs, the data user obtains the search results and solves them using the decryption key.

[0074] The beneficial effects of the aforementioned further solution are as follows: through collaboration between cloud servers and data users, combined with the LabeledPSI protocol, the efficiency and accuracy of searchable encrypted searches can be effectively improved. Specifically, during the search phase, the encrypted database remains encrypted at all times. Data users can only obtain search results through the LabeledPSI protocol using authorized keywords, thereby improving search efficiency while ensuring data privacy. Furthermore, because the cloud server pre-processes the encrypted database and stores search tokens and tag indexes, data users can quickly obtain the corresponding search tokens during the query phase, avoiding complex encrypted processing for each query. This mechanism reduces computational overhead and improves the accuracy and flexibility of multi-keyword searches.

[0075] Furthermore, S301 specifically includes:

[0076] G1. At the application layer, the cloud server initializes empty sets SX and SL;

[0077] G2, The cloud server processes the encrypted database and sends the encrypted search token st w Store to collection SX, and add the ciphertext search token st w The corresponding encrypted bitmap index EBS is stored in set SL, where set SX in S3 corresponds to dataset X in S2, and the encrypted search token st in set SX... w For each element x in dataset X, set SL corresponds to the label dataset L, and each encrypted search token st w The corresponding encrypted bitmap index EBS corresponds to the tag value L[x];

[0078] Specifically, S302 is as follows:

[0079] H1. An empty set CY and result set R are initialized by the data user;

[0080] H2. For each keyword w∈Q in the set of keywords to be queried, by data user DU i Query the corresponding keyword status table subset σ i The update count n ← σ corresponding to the keyword w is obtained. i[w], where σ i [w] indicates that the keyword w is in the state table σ i The total number of updates recorded in the middle;

[0081] H3. The data user generates the corresponding keyword token kt. w ←F(K s ,w), and calculate its corresponding ciphertext search token st w ←H(kt w (n), and save the encrypted search token to the set CY, where the set CY in S3 corresponds to the dataset Y in S2, and the encrypted search token st in the set CY is... w For the corresponding element y in dataset Y, K s This represents the key master key, used to generate key tokens and calculate search tokens. F represents a pseudo-random function, H represents a random hash function, n represents the number of updates before key w is found in the key status table σ, n+1 represents the number of updates corresponding to this update operation, and kt w Represents a keyword token;

[0082] Specifically, S303 is:

[0083] I1. Let the dataset of the cloud server be SX and the tag value set be SL, where each element st w A corresponding tag value EBS is defined, and the dataset of the data user is CY, where EBS represents the encrypted bitmap index vector;

[0084] I2. The cloud server and data user jointly invoke the Labeled PSI protocol, and the data user obtains the intersection result and the correct encrypted label value, and saves the search results to set R;

[0085] I3. By the data user, using key K doc Decrypt the encrypted bitmap index to obtain the required document identifier, and complete the search for the results.

[0086] The beneficial effects of the above-mentioned further solutions are as follows: Steps S301 to S303 further refine the collaboration method between the cloud server and data users, optimizing security, efficiency, and accuracy in the processes of processing the encrypted database, generating search tokens, and executing the Labeled PSI protocol. Specifically, when storing and managing encrypted data, the cloud server can maintain the queryability of the encrypted data while quickly responding to data users' query requests, avoiding redundant calculations. Data users can only perform legitimate queries using authorized keywords. Furthermore, since the search token is generated based on a random hash function, malicious attackers find it difficult to deduce the search token through reverse engineering. The Labeled PSI protocol ensures that sensitive data is not leaked even during interactions between the cloud server and data users, while also guaranteeing efficient multi-keyword searches and accurate query results. Attached Figure Description

[0087] Figure 1 This is a flowchart of the method of the present invention.

[0088] Figure 2 This is a schematic diagram of a multi-user dynamically searchable encryption system model that satisfies a single-write, multi-read architecture, provided for implementation use cases according to the present invention. Detailed Implementation

[0089] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0090] Example

[0091] like Figure 1 and Figure 2As shown, this invention provides a multi-user dynamically searchable encryption method based on the Labeled PSI protocol, including a bottom-level module (Labeled PSI), a management layer, and an application layer. The bottom-level module mainly supports the implementation of the application layer search algorithm. Its main technical structure consists of Oblivious Key-Value Stores (OKVS), which mainly includes two entities: a cloud server (Server) and a data user (DU). The cloud server holds a dataset X, and for any x∈X, the cloud server (Server) holds its corresponding label {L[x]|x∈X}. The data user holds a dataset Y. The management layer has two entities: the data owner (DO) and the cloud server (Server), which can maintain dynamic data updates and implement access control for different users. The application layer has two entities: the data user (DU) and the cloud server (Server), which can perform keyword-based encrypted data retrieval and decryption. The dynamic searchable encryption scheme designed in this invention can be roughly divided into three stages: Setup, Update, and Search. It dynamically updates data based on a bitmap index structure. During the dynamic data update stage, only one modular addition using an additive homomorphic encryption algorithm is needed to merge the newly added ciphertext database with the original ciphertext database. Keyword retrieval is performed based on the Labeled PSI protocol. After the protocol call is completed, the data user obtains the search results, while the cloud server receives no information. Finally, the data user decrypts the search results using the decryption key. The implementation method is as follows:

[0092] S1. At the management level, the data owner and the cloud server jointly negotiate the database update algorithm to support dynamic data updates and implement keyword-based multi-user access control.

[0093] In this embodiment, at the management level, the data owner and the cloud server jointly negotiate the database update algorithm to ensure dynamic data updates and access control for different users. The data owner encrypts the plaintext document set and maintains the index structure of the encrypted database to support dynamic data updates; and by distributing a subset of the keyword status table to different users, keyword-based multi-user access control is implemented to ensure that different users can only query data within their authorized scope. The implementation method is as follows:

[0094] S101. At the management level, the data owner generates the key privacy parameters required for update and search operations and initializes an empty key state table, as follows:

[0095] A1. At the management level, the data owner is in {0,1} λKey K is randomly generated in space s and K doc Where λ represents the calculated safety parameter, K s This represents the key master key, used to generate key tokens and calculate search tokens, K. doc This represents the key for the additive homomorphic encryption algorithm, used to encrypt or decrypt bitmap index vectors;

[0096] A2. The data owner initializes an empty keyword status table σ to record the total number of updates for each keyword. Data users generate corresponding keyword search tokens based on the information recorded in the keyword status table σ.

[0097] In this embodiment, the data owner DO executes an initialization algorithm Setup. Two key parameters, K, are randomly generated by the data owner. s ←{0,1} λ and K doc ←{0,1} λ The key is the master key K. s Used to generate other subkeys or tokens, including keyword tokens and search tokens, the additive homomorphic encryption algorithm key K. doc It is mainly used for encrypting or decrypting bitmap index vectors.

[0098] Simultaneously, the data owner initializes a keyword status table σ to store the total number of updates for each keyword. The data owner can implement keyword-based access control by distributing a subset of the status table σ to different data users. At the application layer, data users can construct search tokens based on the key parameters shared by the data owner and the subset of the status table to complete encrypted keyword retrieval and decryption.

[0099] S102. The data owner and the cloud server jointly negotiate the database update method, encrypt the plaintext document, generate a corresponding bitmap index structure, and complete the update operation of the encrypted database. Specifically, by encrypting the plaintext document and maintaining the index structure of the encrypted database, dynamic data updates are supported.

[0100] B1. The data owner initializes the empty mapping tables ADD and T required for this update operation. w Table ADD stores the mapping between search tokens and the encrypted database, while table T... w Used to store a set of keywords that have been temporarily extracted;

[0101] B2. For the plaintext document set DB, the data owner processes each document doc one by one, extracting keywords and document identifiers from the documents, and saving all keywords to the keyword set T. w middle;

[0102] B3. For the selected keyword w∈T w The data owner queries the keyword status table σ to obtain the number of updates n←σ[w] before keyword w; if keyword w does not exist in the keyword status table σ, then keyword w is saved to the keyword status table σ and the initial update count is set to 0; where, at this time, there is no need to update the keyword status table σ, and σ[w] represents the total number of updates recorded for keyword w in the keyword status table σ.

[0103] B4. For the keyword w, generate its corresponding bitmap index vector BS←b1,b2,...,b j If keyword w exists in the j-th document, then the j-th bit b in the bitmap index vector BS is... j It is 1 if it is not 0 otherwise, where,

[0104] If the update operation type op is a delete operation, then first perform a complement modulo operation on the bitmap index vector:

[0105] BS←((111...111)2-BS)mod2 α

[0106] Where α represents the total number of files in the database;

[0107] Then, using the following formula, based on key K doc The bitmap index vector BS is encrypted using an additive homomorphic encryption algorithm to obtain the encrypted bitmap index vector EBS:

[0108] EBS←Enc(K doc ,BS)

[0109] Where Enc represents the additive homomorphic encryption algorithm, BS represents the bitmap index vector, and b j This represents the j-th bit in the bitmap index vector;

[0110] B5. By the data owner, using the key K s Generate keyword token kt w ←F(K s The search token st is calculated using the following formula (w). w and the keyword token kt w Search token st w The encrypted bitmap index vector EBS is saved to a collection ADD, and the data owner sends the collection ADD to the cloud server:

[0111] st w ←H(kt w (n+1)

[0112] Where F represents a pseudo-random function, H represents a random hash function, n represents the number of updates before the keyword w is found in the keyword status table σ, and n+1 represents the number of updates corresponding to this update operation;

[0113] B6. For set T w For each keyword w in the table, the keyword state table σ obtains the update count n←σ[w] corresponding to keyword w, and updates the state table using σ[w]←n+1;

[0114] B7. The cloud server determines the keyword token kt. w The corresponding different search tokens and encrypted bitmap indexes are merged with the contents of the ciphertext database to complete the update operation of the ciphertext database.

[0115] In this embodiment, the data owner DO and the cloud server Server jointly negotiate a database update algorithm, Update.

[0116] In this embodiment, the data owner DO first initializes the empty mapping tables ADD and T required for this update operation. w Table ADD stores the mapping between search tokens and the encrypted database, while table T... w Used for temporary storage of a set of keywords extracted from a document;

[0117] The data owner, DO, first processes each document (doc) from the plaintext document collection DB, extracting the document's keywords and document identifier, and then saves all keywords to the collection T. w In the middle. For the selected keyword w∈T w The data owner DO obtains the previous update count n←σ[w] by querying σ; if w is a new keyword added in this operation, it is saved to σ and the initial value is set to 0;

[0118] Subsequently, the data owner DO generates the corresponding bitmap index vector BS based on the keyword w in this update operation. If it is an add operation, BS is generated directly based on the documents containing the keyword w, i.e., BS←b1,b2,...,b n If it is a deletion operation, the bitmap index vector needs to be complemented and moduloed first, that is, BS←((111...111)2-BS)mod2. n Simultaneously based on key K doc The bitmap index vector BS is encrypted using an additive homomorphic encryption algorithm, i.e., EBS←Enc(K) is calculated. doc ,BS), where Enc is the additive homomorphic encryption algorithm;

[0119] For the selected keyword w, the data owner DO uses the keyword key K.s Generate keyword token kt w ←F(K s The search token, st, is calculated using the number of updates n←σ[w] obtained from the query. w ←H(kt w (n+1), where F represents a pseudo-random function and H represents a random hash function; subsequently, the data owner DO will... w st w Encrypted data such as EBS is stored in the set ADD, which then sends the set to the cloud server; for set T... w For each keyword w in the table, the corresponding update count n←σ[w] is obtained by querying the state table σ, and the state table is updated using σ[w]←n+1.

[0120] In this embodiment, the cloud server determines the keyword token kt. w The corresponding different search tokens and encrypted bitmap indexes are merged with the contents of the ciphertext database to complete the update operation of the ciphertext database. S103. By distributing a subset of keyword states to different users through the data owner, keyword-based multi-user access control is implemented. The implementation method is as follows:

[0121] C1. For different data users DU1, DU2, ..., DU m The data owner sets keyword access permissions for it, where DU m Indicates the data user;

[0122] C2. The data owner divides the key state table σ into different subsets σ1, σ2, ..., σ... m And distribute it to the corresponding data users;

[0123] C3, by data user DU i During the search phase, the distributed keyword status table σ is used. i Construct a search token and complete the keyword search operation; where, due to the keyword status table σ i It records the information necessary to generate a search token. Data users can only generate valid search tokens for their authorized keywords and cannot query for unauthorized keywords, thus realizing keyword-based multi-user access control.

[0124] In this embodiment, to achieve multi-user access and access control between different users, the data owner DO needs to set corresponding keyword access permissions for different data users DU, and divide the keyword status table σ into different subsets σ1, σ2, ..., σ m At the application layer, data users DU iUse the distributed state table subset σ i Query the update count for the corresponding keyword w, and based on the key parameter K shared by the data owner DO. s Calculate the keyword token and search token to complete the encrypted keyword retrieval.

[0125] S2. In the search module, the data user and the cloud server use the OKVS algorithm to construct the Labeled PSI protocol suitable for the searchable encryption field.

[0126] In this embodiment, in the search module, the data user and the cloud server utilize the OKVS algorithm to construct a semi-honest and secure Labeled PSI protocol suitable for the searchable encryption domain. After the protocol is executed, the data user determines the intersection result and solves for the corresponding label. The intersection result contains all successfully matched keywords, and the correctly solved label value stores document identifier information related to the keywords. The implementation method is as follows:

[0127] S201. In the search module, the cloud server holds a size of n. x Given a dataset X, for each element x∈X in dataset X, its corresponding label value is L[x]; the data user holds a dataset of size n. y The dataset Y; in the preprocessing stage, the cloud server first adds λ bits to the label L[x], expanding it to L'[x] = 0. λ ||L[x], then the cloud server obtains the set of all tag values. Finally, the cloud server calculates the XOR value x⊕L'[x] between the element value and its extended tag, where L'[x] represents the extended tag value. Indicates the nth x element The corresponding extended tag value; its implementation method is as follows:

[0128] D1. In the search module, the cloud server holds a size of n. x Given a dataset X and a set of label values ​​L, for each element x∈X, there is a corresponding label value L[x]; the data user holds a set of n data values. y The dataset Y;

[0129] D2. In the preprocessing stage, for each element x in the dataset X corresponding to the label value L[x], the cloud server adds λ zero bits to it and expands it to L'[x] = 0. λ ||L[x], and obtain the set of all tag values ​​from the cloud server.

[0130] D3. For each element x∈X in dataset X, the cloud server calculates the XOR value x⊕L'[x] of the element value and its extended label.

[0131] In this embodiment, the data user DU holds a size of n. y The dataset Y, in the application layer n y The dataset Y corresponds to the number of keywords in the query set, and the generated search token set corresponds to the number of keywords in the dataset Y; the cloud server Server holds a set of size n. x Given a dataset X, and for each element x∈X, a corresponding label value L[x], in the application layer n x The total number of keyword sets in the corresponding encrypted database, dataset X corresponds to all search token sets, and tag set L corresponds to all encrypted bitmap index vectors.

[0132] In the preprocessing stage of this embodiment, the cloud server adds λ zero bits to each tag value L[x], expanding it to 0. λ ||L[x], and denoted as L'[x]; when the data user DU receives the encrypted tag value, it can determine whether the element is an element of the intersection set and whether the tag value is the correct tag value by checking whether the first λ bits are all 0 bits.

[0133] To hide the tag value, this embodiment calculates the XOR value x⊕L'[x] of the element value and its expanded tag value by the cloud server Server, thereby ensuring that external attackers cannot directly obtain the tag value.

[0134] S202. The cloud server encodes the set of key-value pairs consisting of element x and x⊕L'[x] based on the OKVS algorithm to obtain the encoding result. and the encoding result The data is sent to the data user to build the Labeled PSI protocol under the semi-honest security model. The implementation method is as follows:

[0135] E1. For each element x in dataset X, the cloud server will form a key-value pair set I by combining element x with its corresponding value x⊕L'[x], i.e., I = {x} i ,x i ⊕L'[x i ]|i∈[n x ]}, where x i L'[x] represents the i-th data element. i ] represents the extended label value corresponding to the i-th data element, n x Let i represent the total number of elements in dataset X, and let i represent the number of elements in x. i Relative position in dataset X;

[0136] E2. The set I is encoded using the OKVS encoding algorithm (Encode) by the cloud server. and the encoding result Sending data to the user to construct the Labeled PSI protocol under the semi-honest security model, where OKVS includes an encoding algorithm (Encode) and a decoding algorithm (Decode), and for any key k and its corresponding value v, the following formula is satisfied:

[0137]

[0138] Among them, H F This represents a random hash function, Encode() represents the encoding operation, k represents the key to be encoded, and v represents the value corresponding to key k.

[0139] In this embodiment, the cloud server (Server) constructs a key-value pair set by combining the element x in dataset X with its corresponding XOR value x⊕L'[x], i.e., I={x i ,x i ⊕L'[x]|i∈[n x The OKVS encoding algorithm is then called to encode the set of key-value pairs, resulting in the following encoding result:

[0140] Specifically, in this embodiment, for any k = x and v = x ⊕ L'[x], except for the encoding failure probability 2 -λ In addition, all other conditions are met. as well as Among them, H is used to calculate the safety parameter. F This represents a random hash function.

[0141] Finally, the cloud server will encode the result. Send it to the data user DU to calculate the intersection elements and their corresponding label values.

[0142] S203. For each element y in dataset Y, the data user calculates its OKVS decoding value and solves for its corresponding label value. And it determines whether it is a correct label value based on whether the first λ bits are 0, where, This represents the encoding result obtained from S202. This indicates that the OKVS decoding algorithm is based on key y pairs. The decoded value; its implementation method is as follows:

[0143] F1. For each element y in the dataset Y, the data user calculates its OKVS decoding value. The input consists of any encoded key k and the encoding result. The value v corresponding to the key k is obtained using the OKVS decoding algorithm; input any unencoded key k' and the encoded result. The indistinguishable random value is obtained by using OKVS's decoding algorithm.

[0144] F2, based on the decoded value The data user calculates the label value L'[y] corresponding to the element using the following formula:

[0145]

[0146] F3. The data user determines whether the element y is an intersection element and whether the tag value is a correct tag value based on whether the first λ bits of the tag value are 0. In the application layer, if the element y is an intersection element, the keyword to be queried can be matched in the encrypted database, and its corresponding tag value is the set of document tag values ​​expected to be obtained by the search.

[0147] In this embodiment, the data user DU uses each element y in this dataset Y to encode the received result. Decoding, i.e., solving Based on the decoded value, the corresponding tag value L'[y] can be further calculated using an XOR operation, i.e. Data user DU can determine whether an element belongs to the intersection set and whether the label value is the correct label value based on the first λ bits of the label value.

[0148] S3. At the application layer, data users collaborate with cloud servers to design database search methods, call the LabeledPSI protocol to perform multi-keyword searches, and decrypt the search results.

[0149] In this embodiment, at the application layer, the data user and the cloud server jointly negotiate the database search algorithm to complete the retrieval and decryption of encrypted text. The data user initiates a search request based on the set of keywords to be queried and calls the S2 Labeled PSI protocol to complete a multi-keyword search. The cloud server calculates the intersection according to the protocol and returns the encrypted search results. After obtaining the search results, the data user uses the corresponding key to decrypt the results and recover the plaintext document data. The implementation method is as follows:

[0150] S301. At the application layer, the cloud server preprocesses the encrypted database, separating the encrypted search tokens corresponding to different keywords. w Save it to the set SX, and save its corresponding encrypted bitmap index vector EBS to the tag set SL. The implementation method is as follows:

[0151] G1. At the application layer, the cloud server initializes empty sets SX and SL;

[0152] G2, The cloud server processes the encrypted database and sends the encrypted search token st w Store to collection SX, and add the ciphertext search token st w The corresponding encrypted bitmap index EBS is stored in set SL, where set SX in S3 corresponds to dataset X in S2, and the encrypted search token st in set SX... w For each element x in dataset X, set SL corresponds to the label dataset L, and each encrypted search token st w The corresponding encrypted bitmap index EBS corresponds to the tag value L[x].

[0153] In this embodiment, the data user DU and the cloud server Server jointly negotiate a database search algorithm Search, which is divided into an offline phase and an online phase.

[0154] In this embodiment, during the offline phase, the cloud server Server first initializes empty lists SX and SL, where SX is used to store the search token st from the encrypted database. w SL is used to store the corresponding encrypted bitmap index EBS in the encrypted database.

[0155] S302. The data user preprocesses each keyword in the keyword set Q to be queried, and generates a corresponding encrypted search token st through the keyword status table σ. w And save it to the collection CY, as follows:

[0156] H1. An empty set CY and result set R are initialized by the data user;

[0157] H2. For each keyword w∈Q in the set of keywords to be queried, by data user DU i Query the corresponding keyword status table subset σ i The update count n ← σ corresponding to the keyword w is obtained. i [w], where σ i [w] indicates that the keyword w is in the state table σ i The total number of updates recorded in the middle;

[0158] H3. The data user generates the corresponding keyword token kt. w ←F(K s ,w), and calculate its corresponding ciphertext search token st w ←H(kt w (n), and save the encrypted search token to the set CY, where the set CY in S3 corresponds to the dataset Y in S2, and the encrypted search token st in the set CY is... w For the corresponding element y in dataset Y, Ks This represents the key master key, used to generate key tokens and calculate search tokens. F represents a pseudo-random function, H represents a random hash function, n represents the number of updates before key w is found in the key status table σ, n+1 represents the number of updates corresponding to this update operation, and kt w This represents a keyword token.

[0159] In this embodiment, the data user DU first initializes an empty mapping table CY and an empty result set R, where CY is used to store the search tokens corresponding to the set of keywords to be queried Q, and R is used to store the search results obtained after the protocol runs.

[0160] For each keyword w∈Q in the set of keywords to be queried, by data user DU i Query the corresponding keyword status table subset σ i The update count n ← σ corresponding to the keyword w is obtained. i [w]; and generate the corresponding keyword token kt from it. w ←F(K s ,w), and calculate its corresponding search token st w ←H(kt w ,n), and save the search token to CY.

[0161] S303. The Labeled PSI protocol is jointly invoked by the data user and the cloud server. After the protocol runs, the data user obtains the search results and solves them using the decryption key. The implementation method is as follows:

[0162] I1. Let the dataset of the cloud server be SX and the tag value set be SL, where each element st w A corresponding tag value EBS is defined, and the dataset of the data user is CY, where EBS represents the encrypted bitmap index vector;

[0163] I2. The cloud server and data user jointly invoke the Labeled PSI protocol, and the data user obtains the intersection result and the correct encrypted label value, and saves the search results to set R;

[0164] I3. By the data user, using key K doc Decrypt the encrypted bitmap index to obtain the required document identifier, and complete the search for the results.

[0165] In particular, by calling the Labeled PSI protocol to assist keyword retrieval during the search phase, avoiding the cloud server from obtaining the keyword information to be queried, and using bitmap indexing to hide the returned document information, it is possible to hide the search mode and access mode.

[0166] In the online phase of this embodiment, data user DU and cloud server Server jointly invoke the Labeled PSI protocol of S2. To clarify the correspondence between sets and elements, it is described as follows: where data set SX corresponds to dataset X in step S2, the search token in SX corresponds to element x in X, set SL corresponds to label dataset L, and the encrypted bitmap index EBS corresponding to each search token corresponds to the label value L[x]; data set CY corresponds to dataset Y in step S2, and the search token st in CY corresponds to element x in X. w Corresponding to element y in Y;

[0167] After the Labeled PSI protocol finishes running, the data user DU will be responsible for the final processing. i Obtain the final intersection result and the correct ciphertext label value L'[y]; by data user DU i Decrypt the key K using an additive homomorphic approach. doc Decrypt the bitmap index to obtain the required document identifier.

[0168] In this embodiment, the present invention is a multi-keyword dynamic searchable encryption model based on a single-write, multi-read system model. The invention can be broadly divided into three stages: Setup, Update, and Search (initialization, update, and search). In the Update stage, the invention uses a bitmap index structure to support dynamic data updates and distributes a subset of the keyword status table to different users, achieving multi-user access control based on keywords. In the Search stage, multi-keyword searches are performed by calling the Labeled PSI protocol module. After the data owner obtains the search results, they use the corresponding key to decrypt the results and recover the plaintext data.

[0169] In this embodiment, the present invention is mainly applicable to dynamic data update scenarios, and consists of three entities: data owner DO, data user DU, and cloud server Server. Data document doc = (id, W id ) Contains a unique document identifier id∈{0,1} * and keyword set W id In the plaintext document set DB, let the set of document identifiers corresponding to the keyword w be DB(w) = {id|w∈W}. id During the Setup phase, the data owner (DO) randomly generates the key parameter K. s and K doc And initialize the keyword state table σ, where K s This represents the key master key, used to generate key tokens and calculate search tokens, K. docσ represents the key for the additive homomorphic encryption algorithm, used to encrypt or decrypt the bitmap index vector, and stores the update count for each key. Furthermore, the data owner distributes a subset σ of the key status table to different users. i This enables keyword-based multi-user access control. Due to the keyword status table σ... i It records the information necessary to generate a search token, so data users can only generate valid search tokens for their authorized keywords and cannot query for unauthorized keywords, thus realizing keyword-based multi-user access control.

[0170] In this embodiment, to improve data update efficiency and reduce communication complexity, the present invention adopts a bitmap index structure. During the update operation, only one modular addition operation needs to be performed on the ciphertext index using an additive homomorphic encryption algorithm. To encrypt the plaintext document set DB according to the index structure, temporary empty lists ADD and T need to be introduced. w As described above, the functions of each list are as follows: Therefore, the data owner DO in the Update phase includes the following steps:

[0171] Step 1: For the plaintext document collection DB, the data owner processes each document doc, extracts keywords and document identifiers from the documents, and saves all keywords to collection T. w middle;

[0172] Step 2: For the selected keyword w∈T w The data owner queries σ to obtain its previous update count n←σ[w]; if the keyword does not exist in σ, it is saved to σ and the initial update count is set to 0; it should be noted that the status table σ does not need to be updated at this time;

[0173] Step 3: For the keyword w, generate its corresponding bitmap index vector BS←b1,b2,...,b j If keyword w exists in the j-th document, then the j-th bit b in the bitmap index vector BS is... j It is 1 if it is true, otherwise it is 0.

[0174] Specifically, if the update operation type op is a delete operation, then the bitmap index vector needs to be complemented and moduloed first:

[0175] BS←((111...111)2-BS)mod2 α

[0176] Where α represents the total number of files in the database.

[0177] Then, using the following formula, based on the key K... docThe bitmap index vector BS is encrypted using an additive homomorphic encryption algorithm to obtain EBS:

[0178] EBS←Enc(K doc ,BS)

[0179] Where Enc represents the additive homomorphic encryption algorithm, b j This represents the j-th bit in the bitmap index vector;

[0180] Step 4: The data owner uses the key K s Generate keyword token kt w ←F(K s ,w), and calculate the search token st using the following formula w :

[0181] st w ←H(kt w (n+1)

[0182] Where F represents a pseudo-random function, H represents a random hash function, n is the number of times w was updated in the state table σ, and n+1 represents the number of updates corresponding to this update operation.

[0183] Then kt w st w The encrypted bitmap index vector EBS is saved to the collection ADD, and finally the data owner sends the collection ADD to the cloud server;

[0184] Repeat steps 1 through 4 until all documents in the plaintext document set DB have been processed. At this point, set T... w This database contains all the keywords used in this update operation.

[0185] Step 5: For set T w For each keyword w in the table, query the state table to get its corresponding update count n←σ[w], and update the state table using σ[w]←n+1;

[0186] Step 6: The cloud server uses the keyword token (kt) w The corresponding different search tokens and encrypted bitmap indexes are merged with the contents of the ciphertext database to complete the update operation of the ciphertext database.

[0187] Specifically, during the data update phase, the new search token is updated using both the keyword token and the keyword status table stored locally by the data owner (DO). Previous search tokens cannot be identified using the latest search token; if a data user uses a previous search token... The cloud server holds the latest search token. Both parties calculate the intersection of their sets using LabeledPSI, because Therefore, data users cannot obtain any information using the previous search token. In summary, this invention is forward-secure.

[0188] Because this invention is based on a bitmap index structure, its index update only requires performing a single modulo addition on the encrypted database using an additive homomorphic encryption algorithm to complete document addition and deletion operations, without revealing the insertion time or the time corresponding to a file being inserted and then deleted. Furthermore, due to the zero privacy leakage of the Labeled PSI protocol, the cloud server cannot obtain relevant information about files added and then deleted between two queries. In summary, this invention is a Type-I... - Backward safety level.

[0189] During the Search phase, because this invention uses the Labeled PSI protocol to ensure the secure operation of the search mechanism, before the protocol is officially run, i.e., in the offline phase, the cloud server needs to initialize the dataset in advance: the cloud server initializes empty lists SX and SL; and the search token st in the encrypted database... w Store in list SX, search token st w The corresponding encrypted bitmap index EBS is stored in list SL; data user DU i During the online phase, an empty list CY and result set R are initialized. For each keyword w∈Q in the set of keywords to be queried, the data user DU... i Query the corresponding keyword status table subset σ i The update count n ← σ corresponding to the keyword w is obtained. i [w]; and generate the corresponding keyword token kt. w ←F(K s ,w), and calculate its corresponding search token st w ←H(kt w The cloud server and data user jointly invoke the Labeled PSI protocol, with the cloud server acting as the cloud server and the data user acting as the data user. Finally, the data user obtains the intersection result and the correct encrypted label value, and saves the search result to set R. The data user then uses key K... doc Decrypt the bitmap index to obtain the required document identifier.

[0190] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the implementation methods of the present invention, and should be understood that the scope of protection of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of the present invention.

Claims

1. A multi-user dynamically searchable encryption method based on LabeledPSI, characterized in that, Includes the following steps: S1. At the management level, the data owner and the cloud server jointly negotiate the database update algorithm to support dynamic data updates and implement keyword-based multi-user access control. S2. In the search module, the data user and the cloud server use the OKVS algorithm to construct the Labeled PSI protocol suitable for the searchable encryption field. Specifically, S2 is: S201. In the search module, the cloud server holds a size of... dataset For dataset Each element Its corresponding tag value is ; Data user holding size dataset In the preprocessing stage, the cloud server first generates the tags. Add Bit, expand it to The cloud server then obtains the set of all tag values. Finally, the cloud server calculates the XOR value of the element value and its extended tag. , This represents the expanded tag value. Indicates the first element The corresponding extended tag value; S202, The cloud server performs element processing based on the OKVS algorithm. and Encode the key-value pair set to obtain the encoded result. and the encoding result Send to data users to build the LabeledPSI protocol under the semi-honest security model; S203, Regarding the dataset Each element The data user calculates its OKVS decoded value and solves for its corresponding tag value. And based on the previous The determination of whether a label value is correct depends on whether the bit is 0. This represents the encoding result obtained from S202. This indicates that the OKVS decoding algorithm is based on key. right The decoded value; S3. At the application layer, data users collaborate with cloud servers to design database search methods, call the Labeled PSI protocol to perform multi-keyword searches, and decrypt the search results.

2. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 1, characterized in that, Specifically, S1 is: S101. At the management level, the data owner generates the key privacy parameters required for update and search operations and initializes an empty key state table. S102. The data owner and the cloud server jointly negotiate the database update method, encrypt the plaintext document, generate the corresponding bitmap index structure, and complete the update operation of the ciphertext database. In this process, the data owner encrypts the plaintext document and maintains the index structure of the ciphertext database to support dynamic data updates. S103. By distributing a subset of keyword statuses to different users by the data owner, multi-user access control based on keywords is achieved.

3. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 2, characterized in that, Specifically, S101 is: A1. At the management level, the data owner is responsible for... Randomly generate keys in space and ,in, This indicates the calculation of safety parameters. This represents the key master key, used to generate key tokens and calculate search tokens. This represents the key for the additive homomorphic encryption algorithm, used to encrypt or decrypt bitmap index vectors; A2. Initialize an empty key status table by the data owner. This is used to record the total number of updates for each keyword. Data users access the keyword status table. The recorded information is used to generate corresponding keyword search tokens.

4. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 2, characterized in that, Specifically, S102 is as follows: B1. The data owner initializes the empty mapping table required for this update operation. and , among which, table Used to store the mapping relationship between search tokens and the encrypted database, table Used to store a set of keywords that have been temporarily extracted; B2. For collections of plaintext documents Documents are processed one by one by the data owner. Extract keywords and document identifiers from the document, and save all keywords to a keyword set. middle; B3. For the selected keywords The data owner queries the keyword status table. to obtain keywords Previous update count If keywords Not present in the keyword status table In the middle, the keywords will be... Save to Keyword Status Table And set the initial update count to In this case, there is no need to update the keyword status table. , Keyword In the keyword status table The total number of updates recorded in the middle; B4. Regarding keywords Generate its corresponding bitmap index vector If keywords Existing in the In a document, the bitmap index vector No. Bits It is 1 if it is not 0 otherwise, where, If the operation type is updated For deletion operations, the bitmap index vector is first subjected to a two's complement modulo operation: in, This indicates the total number of files in the database; Then, using the following formula, based on the key Use an additive homomorphic encryption algorithm on the bitmap index vector Encryption is performed to obtain the encrypted bitmap index vector. : in, This represents the additive homomorphic encryption algorithm. This represents a bitmap index vector. Represents the first in the bitmap index vector Bits; B5. By the data owner, using the key master key Generate Keyword Tokens The following formula is used to calculate the ciphertext search token. and the keyword token ciphertext search token With encrypted bitmap index vector Save to collection In, and the data owner will collect the collection. Send to cloud server: in, Represents a pseudo-random function. Represents a random hash function. Keyword status table Keywords found in the search Previous update count, This indicates the number of updates corresponding to this update operation; B6. For sets Each keyword in Keyword status table Get keywords Corresponding update count and utilize Update the status table; B7. The cloud server uses the keyword token. The corresponding different search tokens and encrypted bitmap indexes are merged with the contents of the ciphertext database to complete the update operation of the ciphertext database.

5. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 2, characterized in that, Specifically, S103 is: C1. For different data users The data owner sets keyword access permissions for it, where... Indicates the data user; C2. The data owner will submit the keyword status table. Divided into different subsets And distribute it to the corresponding data users; C3, by data users During the search phase, the distributed keyword status table is used. Construct a search token and complete the keyword search operation; where, due to the keyword status table It records the information necessary to generate a search token. Data users can only generate valid search tokens for their authorized keywords and cannot query for unauthorized keywords, thus realizing keyword-based multi-user access control.

6. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 1, characterized in that, Specifically, S201 is as follows: D1. In the search module, the cloud server holds a size of... dataset and tag value set For each element Each has a corresponding tag value. ; Data user holding size dataset ; D2. In the preprocessing stage, for the dataset Each element Corresponding tag value Added by the cloud server Bit bits, and expand them to The cloud server obtains a collection of all tag values. ; D3. For the dataset Each element in The cloud server calculates the XOR value of an element's value and its extended tag. ; Specifically, S202 is as follows: E1, for datasets Each element in The elements are stored on the cloud server. Its corresponding value Composition of key-value pair set ,Right now ,in, Indicates the first One data element, Indicates the first The extended label value corresponding to each data element Represents the dataset Total number of elements in the middle. i Represents element In the dataset The relative position in; E2. The encoding algorithm of OKVS is selected from the cloud server. For sets Encode, that is and the encoding result This is sent to the data user to construct the Labeled PSI protocol under the semi-honest security model, where OKVS includes an encoding algorithm. A decoding algorithm For any key and its corresponding value All satisfy the following formula: in, Represents a random hash function. Indicates encoding operation. This represents the key to be encoded. Indicator key The corresponding value; Specifically, S203 is: F1, for the dataset Each element in The OKVS decoded value is calculated by the data user. The input key can be any encoded key. and encoding results Through OKVS decoding algorithm Solve for the key corresponding value Enter any uncoded key and encoding results Through OKVS decoding algorithm Solve for indistinguishable random values; F2, based on the decoded value The data user calculates the label value corresponding to the element using the following formula. : F3. By the data user, based on the label value... Determine if the bit is 0 for the element. Whether it is an intersection element, whether the label value is a correct label value, wherein, in the application layer, if the element If it belongs to the intersection, then the element The corresponding keyword to be queried can be matched in the encrypted database, and its corresponding tag value is the set of document tag values ​​expected to be obtained from the search.

7. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 6, characterized in that, Specifically, S3 is: S301. At the application layer, the cloud server preprocesses the encrypted database, matching the encrypted search tokens corresponding to different keywords. Save to collection In, and its corresponding encrypted bitmap index vector Save to tag collection middle; S302. The data user preprocesses the set of keywords to be queried. Each keyword in the table is accessed through the keyword status table. Generate the corresponding encrypted search token And save it to a collection middle; S303. The Labeled PSI protocol is jointly invoked by the data user and the cloud server. After the protocol runs, the data user obtains the search results and solves them using the decryption key.

8. The multi-user dynamically searchable encryption method based on LabeledPSI according to claim 7, characterized in that, Specifically, S301 is: G1. At the application layer, the cloud server initializes an empty data set. and ; G2, The cloud server processes the encrypted database and retrieves the encrypted search token. Store to collection and the encrypted search token Corresponding encrypted bitmap index Store to collection In S3, the set The corresponding dataset in S2 ,gather Ciphertext search token Corresponding dataset elements in ,gather Corresponding label dataset Each encrypted search token Corresponding encrypted bitmap index Corresponding tag value ; Specifically, S302 is as follows: H1, An empty set initialized by the data user. and result set ; H2. For each keyword in the set of keywords to be queried By data users Query the corresponding keyword status table subset Get keywords Corresponding update count ,in, Keyword In the status table The total number of updates recorded in the middle; H3. Data users generate corresponding keyword tokens. And calculate its corresponding ciphertext search token. And save the encrypted search token to the collection. , where the set in S3 The corresponding dataset in S2 ,gather Ciphertext search token Corresponding dataset elements in , This represents the key master key, used to generate key tokens and calculate search tokens. Represents a pseudo-random function. Represents a random hash function. Represents the keyword status table Keywords found in the search Previous update count, This indicates the number of updates corresponding to this update operation. Represents a keyword token; Specifically, S303 is: I1. Let the data set of the cloud server be... The set of tag values ​​is , where set Each element in the text corresponds to a tag value. And let the dataset of the data user be... ,in, Represents the encrypted bitmap index vector; I2. The cloud server and data user jointly invoke the Labeled PSI protocol, allowing the data user to obtain the intersection result and the correct encrypted label value, and save the search results to the collection. ; I3. By the data user, using the key Decrypt the encrypted bitmap index to obtain the required document identifier, and complete the search for the results.

Images