Searchable encryption method and device, electronic equipment and storage medium
By using the KBBC algorithm and binary search tree of symmetric cryptographic primitives in a searchable encryption scheme, the problems of limited application scope and low search efficiency are solved, and wider application and more efficient keyword search are achieved.
Patent Information
- Application Number
- CN202410290491.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-14
- Publication Date
- 2025-09-16
Smart Images
Figure CN120654259A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of cryptography, and in particular to a searchable encryption method, device, electronic device and storage medium. Background Art
[0002] Searchable Encryption (SE) technology is a cryptographic technology that supports users to perform keyword searches on ciphertext. It can save users a lot of network and computing overhead and make full use of the huge computing resources of cloud servers to perform keyword searches on ciphertext to obtain file identifiers corresponding to documents containing specific keywords.
[0003] Most existing searchable encryption schemes are based on Trapdoor Permutation (TDP) technology. TDP relies on asymmetric cryptographic primitives, and the data storage location must be repeatedly generated based on the private key of the asymmetric cryptographic primitive. Because TDP, based on asymmetric cryptographic primitives, conflicts with server-side storage structures, the application scope of searchable encryption schemes is limited, resulting in low search efficiency. Summary of the Invention
[0004] The present invention provides a searchable encryption method, device, electronic device and storage medium, which are used to solve the defects of the searchable encryption scheme in the prior art, such as limited application scope and low search efficiency.
[0005] The present invention provides a searchable encryption method, which is applied to a server side and includes: receiving a search token in response to a retrieval request from a client; the search token includes a data identifier and a key corresponding to a keyword to be retrieved; searching a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be retrieved; the binary search tree is constructed based on multiple storage data blocks, the storage data blocks are used to store data identifiers and encrypted file information, and the encrypted file information includes a file identifier; and sending the file identifier to the client.
[0006] According to a searchable encryption method provided by the present invention, a binary search tree is searched based on a data identifier and a key to obtain a file identifier that matches the keyword to be searched, including: based on the data identifier, the binary search tree is searched to obtain a storage data block that matches the data identifier; based on the key, the encrypted file information in the storage data block that matches the data identifier is decrypted to obtain a file identifier that matches the keyword to be searched.
[0007] According to a searchable encryption method provided by the present invention, after sending a file identifier to a client, the method further includes: receiving a storage data block to be updated in response to an update request from the client; the storage data block to be updated is used to store a data identifier of a keyword to be updated and encrypted file information, the encrypted file information including the file identifier; and inserting the storage data block to be updated into a binary search tree to obtain an updated binary search tree.
[0008] According to a searchable encryption method provided by the present invention, in response to a retrieval request from a client, before receiving a search token, the method further includes: receiving a storage data block sent by the client; and constructing a binary search tree based on the storage data block.
[0009] The present invention provides a searchable encryption method, which is applied to a client and includes: determining a data identifier and a key corresponding to a keyword to be retrieved; generating a search token based on the data identifier and the key; the search token includes the data identifier and the key corresponding to the keyword to be retrieved; sending a search request to a server, so that the server searches a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be retrieved; the binary search tree is constructed based on multiple storage data blocks, the storage data blocks are used to store the data identifier and encrypted file information, and the encrypted file information includes the file identifier; and receiving the file identifier sent by the server.
[0010] According to a searchable encryption method provided by the present invention, after receiving a file identifier sent by a server, the method further includes: determining a data identifier corresponding to a keyword to be updated and a file identifier matching the keyword to be updated; generating a key corresponding to the keyword to be updated based on a key generation algorithm; encrypting the file identifier matching the keyword to be updated based on the key corresponding to the keyword to be updated to obtain encrypted file information; constructing a storage data block to be updated based on the data identifier corresponding to the keyword to be updated and the encrypted file information; the storage data block to be updated is used to store the data identifier of the keyword to be updated and the encrypted file information, the encrypted file information including the file identifier; sending the storage data block to be updated to the server so that the server inserts the storage data block to be updated into a binary search tree to obtain an updated binary search tree.
[0011] According to a searchable encryption method provided by the present invention, before determining the data identifier and key corresponding to the keyword to be retrieved, the method also includes: obtaining an index list corresponding to the keyword to be retrieved; the index list includes a file identifier that matches the keyword to be retrieved; based on the index list, generating a storage data block; the storage data block is used to store the data identifier and encrypted file information, and the encrypted file information includes the file identifier; and sending the storage data block to the server side so that the server side constructs a binary search tree based on the storage data block.
[0012] The present invention also provides a searchable encryption device, comprising: a receiving module for receiving a search token in response to a retrieval request from a client; the search token includes a data identifier and a key corresponding to the keyword to be retrieved; a retrieval module for searching a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be retrieved; the binary search tree is constructed based on multiple storage data blocks, the storage data blocks are used to store data identifiers and encrypted file information, and the encrypted file information includes a file identifier; a sending module for sending the file identifier to the client.
[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-described searchable encryption methods is implemented.
[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the above-described searchable encryption methods when executed by a processor.
[0015] The searchable encryption method, device, electronic device and storage medium provided by the present invention receive a search token in response to a retrieval request from a client; the search token includes a data identifier and a key corresponding to the keyword to be retrieved; based on the data identifier and the key, a binary search tree is searched to obtain a file identifier that matches the keyword to be retrieved; the binary search tree is constructed based on multiple storage data blocks, and the storage data blocks are used to store data identifiers and encrypted file information, and the encrypted file information includes a file identifier; and the file identifier is sent to the client. Through the above method, a binary search tree is used on the server side to store data identifiers and encrypted file information. The binary search tree is constructed based on multiple storage data blocks, and the storage data blocks are used to store data identifiers and encrypted file information. After the server side receives the search token including the data identifier and the key corresponding to the keyword to be retrieved, it can directly search the binary search tree based on the data identifier and the key to obtain the file identifier matching the keyword to be retrieved, and send the retrieved file identifier to the client, so that the user can perform keyword search on the ciphertext. Since the TDP technology based on asymmetric cryptographic primitives is not used, there is no possibility of conflict between the TDP technology and the storage structure on the server side, which can effectively expand the application scope of the searchable encryption method and improve the search efficiency of the searchable encryption method. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0017] Figure 1 This is one of the flow charts of the searchable encryption method provided by the present invention;
[0018] Figure 2 This is the second flow chart of the searchable encryption method provided by the present invention;
[0019] Figure 3 It is a schematic structural diagram of the searchable encryption device provided by the present invention;
[0020] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION
[0021] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.
[0022] See also Figure 1 , Figure 1 This is one of the flow charts of the searchable encryption method provided by the present invention. In this embodiment, the searchable encryption method is applied to the server side, and the searchable encryption method includes steps S110 to S130, each of which is as follows:
[0023] S110: In response to the retrieval request from the client, a search token is received.
[0024] The search token includes a data identifier and a key corresponding to the keyword to be retrieved.
[0025] Searchable encryption technology is a technology that encrypts data files and stores them on the server side. When the user (client) needs it, the ciphertext stored on the server side can be retrieved.
[0026] For example, to save local resources, users can outsource files to cloud servers. However, clients do not want the cloud service provider to access the specific file contents, so they need to encrypt the files before storing them. Furthermore, if a user wants to query a specific data file on the cloud server, only authorized users can retrieve the corresponding ciphertext data based on keywords.
[0027] Specifically, when a user needs to retrieve a file containing a specific keyword, the user needs to obtain a file identifier corresponding to the file containing the specific keyword.
[0028] The file identifier and the file have a one-to-one correspondence. Based on the file identifier, the corresponding file containing the specific keyword can be obtained from the server.
[0029] Specifically, when the user needs to retrieve the file identifier corresponding to the file containing the keyword to be retrieved w on the server side, he can send a search request to the server side. The search request can carry a search token t. The search token t includes the data identifier and key corresponding to the keyword to be retrieved. The server side can search based on the search token t to obtain the file identifier that matches the keyword to be retrieved.
[0030] Optionally, the search token t is stored in the client and can be recorded as (W[w].id, W[w].key), where W[w].id is the data identifier corresponding to the keyword w to be retrieved, and W[w].key is the key corresponding to the keyword w to be retrieved.
[0031] S120: Based on the data identifier and the key, the binary search tree is searched to obtain a file identifier that matches the keyword to be searched.
[0032] The binary search tree is constructed based on a plurality of storage data blocks, where the storage data blocks are used to store data identifiers and encrypted file information, where the encrypted file information includes the file identifier.
[0033] To facilitate retrieval, the server can use a binary search tree to store ciphertext.
[0034] Specifically, before the search begins, for each file identifier corresponding to a file containing the keyword w to be searched, the client can generate a corresponding storage data block for the file identifier based on a preset algorithm, which is used to store the data identifier and encrypted file information; wherein the encrypted file information includes the file identifier.
[0035] It should be noted that, in this embodiment, the file identifier contained in the encrypted file information is encrypted based on the key and stored as ciphertext on the server side; when the user searches, the key needs to be provided for decryption to obtain the decrypted file identifier.
[0036] Furthermore, the client may send all generated storage data blocks to the server. After receiving the storage data blocks, the server may construct a binary search tree based on the storage data blocks, where each node of the binary search tree is a storage data block.
[0037] Furthermore, in response to the client's retrieval request, after receiving the search token, the server can retrieve and decrypt each node on the binary search tree, that is, the stored data block, one by one based on the data identifier and key to obtain the file identifier that matches the keyword to be retrieved.
[0038] S130: Send the file identifier to the client.
[0039] After obtaining the file identifier that matches the keyword to be searched, the server may return the file identifier that matches the keyword to be searched to the client to complete the search for the ciphertext.
[0040] Optionally, after obtaining a file identifier that matches the keyword to be searched, the client may send a file retrieval request to the server. The file retrieval request may carry the file identifier. After receiving the file retrieval request, the server may search and obtain the corresponding encrypted file in the database based on the file identifier, and return the encrypted file that matches the file identifier to the client. The client may decrypt the encrypted file by itself to obtain the plaintext of the encrypted file.
[0041] Optionally, after the server obtains the file identifier that matches the keyword to be searched, it can directly search and obtain the corresponding encrypted file in the database based on the file identifier that matches the keyword to be searched, and return the encrypted file and file identifier that match the file identifier to the client. The client can decrypt the encrypted file by itself to obtain the plaintext of the encrypted file.
[0042] The present invention provides a searchable encryption method that, in response to a search request from a client, receives a search token comprising a data identifier and a key corresponding to a keyword to be searched; searches a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be searched; the binary search tree is constructed based on a plurality of storage data blocks, the storage data blocks being used to store the data identifier and encrypted file information, the encrypted file information including the file identifier; and sends the file identifier to the client. In this manner, a binary search tree is used on the server to store the data identifier and the encrypted file information; the binary search tree is constructed based on a plurality of storage data blocks, the storage data blocks being used to store the data identifier and the encrypted file information; after receiving the search token comprising the data identifier and the key corresponding to the keyword to be searched, the server can directly search the binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be searched, and sends the retrieved file identifier to the client, thereby enabling the user to perform keyword searches on ciphertext. Since the TDP technology based on asymmetric cryptographic primitives is not used, there is no possibility of conflict between the TDP technology and the server's storage structure, effectively expanding the application scope of the searchable encryption method and improving the search efficiency of the searchable encryption method.
[0043] In some embodiments, based on the data identifier and the key, a binary search tree is searched to obtain a file identifier that matches the keyword to be retrieved, including: based on the data identifier, a binary search tree is searched to obtain a storage data block that matches the data identifier; based on the key, the encrypted file information in the storage data block that matches the data identifier is decrypted to obtain a file identifier that matches the keyword to be retrieved.
[0044] In this embodiment, each storage data block on the binary search tree T is generated based on the KBBC algorithm (key-based blockchain algorithm).
[0045] The principle of the KBBC algorithm is as follows:
[0046] Define data block set B, which contains b1 to b n There are n data blocks in total. The data blocks can be stored based on blockchain technology as storage data blocks to provide security protection for the data.
[0047] Each storage data block b can be expressed as b=(id, value, key, ptr).
[0048] Among them, id is the data identifier; value is the specific value of the data, that is, the ciphertext that needs to be stored; key is the key of the next block in the blockchain; ptr is the data identifier of the next block in the blockchain.
[0049] Assume that C is the blockchain corresponding to the subset S of the data block set B, n c is the total number of data blocks B on the chain, then the stored data blocks on the blockchain C can be divided into three types: head block (i.e. the first block, denoted as C.head), tail block (i.e. the last block, denoted as C.tail) and internal blocks (i.e. the remaining blocks between the head block and the tail block, denoted as C.internal).
[0050] The KBBC algorithm can include three steps: initialization, adding storage data blocks, and retrieval. The process of generating blockchain C based on the KBBC algorithm is as follows:
[0051] (1) Initialization: During the initialization process, the KBBC algorithm does not receive any input information and only outputs a description of the blockchain C.
[0052] (2) Add storage data blocks (add each block to blockchain C to generate blockchain C): This step receives (C, id, value, 1 λ ) as input information and output a new storage data block; where 1 λ is a safety parameter.
[0053] Specifically, a storage data block b = (id, value, key, ptr) is generated first; in {0, 1} λ A random key k is generated in the storage data block b; based on the random key k, information other than the data identifier (i.e., id) in the storage data block b, i.e., the file identifier (i.e., value), the key of the next block (i.e., key), and the data identifier of the next block (i.e., ptr), is encrypted to obtain an encrypted storage data block, which is used to store the data identifier (i.e., id) and encrypted file information, wherein the encrypted file information includes the file identifier (i.e., value) encrypted based on the key, the key of the next block (i.e., key), and the data identifier of the next block (i.e., ptr); the encrypted storage data block is stored on the server side.
[0054] (3) Retrieval: The client can initiate a retrieval to the server based on the data identifier (i.e., id) and the random key k to retrieve the stored data block that matches the data identifier, and perform decryption based on the random key k to obtain the decrypted file identifier, the key of the next block, and the data identifier of the next block; based on the key of the next block and the data identifier of the next block, the next block in the blockchain C can be retrieved until all blocks in the blockchain C are retrieved.
[0055] Specifically, for each file identifier corresponding to a file containing the keyword w to be retrieved, the client can generate a corresponding storage data block b for the file identifier based on the KBBC algorithm, which is used to store the data identifier and encrypted file information; wherein the encrypted file information includes the file identifier, the key of the next block and the data identifier of the next block, that is, the storage data block b = (id, value, key, ptr). In addition to the data identifier (i.e., id), the file identifier (i.e., value), the key of the next block (i.e., key) and the data identifier of the next block (i.e., ptr) are all encrypted based on the key and stored as ciphertext on the server side.
[0056] Furthermore, the client may send all generated storage data blocks to the server. After receiving the storage data blocks, the server may construct a binary search tree based on the storage data blocks, where each node of the binary search tree is a storage data block.
[0057] Furthermore, when the user needs to retrieve the file identifier corresponding to the file containing the keyword to be searched on the server side, he can send a search request to the server side, and the search request can carry a search token; the server side responds to the client's search request, and after receiving the search token, the server side can search each node on the binary search tree, that is, the storage data block, one by one based on the data identifier to obtain the storage data block that matches the data identifier.
[0058] Furthermore, based on the key, the encrypted file information in the storage data block matching the data identifier is decrypted to obtain the file identifier matching the keyword to be retrieved, the key of the next block and the data identifier of the next block.
[0059] Furthermore, the next block in blockchain C can be retrieved based on the key of the next block and the data identifier of the next block until all blocks in blockchain C are retrieved, thereby ensuring that all blocks in blockchain C are not missed.
[0060] In this embodiment, the client uses the KBBC algorithm based on symmetric cryptographic primitives (i.e., the encryption process and decryption process use the same key) to generate the corresponding storage data block, so that the server can decrypt the encrypted file information in the storage data block based on the key sent by the client. Compared with the searchable encryption method using asymmetric cryptographic primitives, the searchable encryption method of this embodiment has lower cryptographic computation overhead, and can effectively improve search efficiency while ensuring the security of forward privacy.
[0061] In some embodiments, after sending the file identifier to the client, it also includes: receiving the storage data block to be updated in response to the client's update request; the storage data block to be updated is used to store the data identifier of the keyword to be updated and the encrypted file information, and the encrypted file information includes the file identifier; inserting the storage data block to be updated into the binary search tree to obtain an updated binary search tree.
[0062] It is understandable that the client can update the files stored on the server.
[0063] After the client uploads the encrypted file to the server's database, the binary search tree needs to be updated to facilitate the next search.
[0064] Specifically, the client first determines the data identifier corresponding to the keyword to be updated and the file identifier matching the keyword to be updated, and generates a storage data block to be updated based on the KBBC algorithm; sends an update request to the server, and the update request can carry the storage data block to be updated. The storage data block to be updated is used to store the data identifier of the keyword to be updated and the encrypted file information, and the encrypted file information includes the file identifier.
[0065] Furthermore, the server receives the to-be-updated storage data block in response to the update request from the client, and inserts the to-be-updated storage data block into the binary search tree to obtain an updated binary search tree.
[0066] In some embodiments, in response to a retrieval request from a client, before receiving a search token, the method further includes: receiving a storage data block sent by the client; and constructing a binary search tree based on the storage data block.
[0067] See also Figure 2 , Figure 2 This is the second flow chart of the searchable encryption method provided by the present invention. In this embodiment, the searchable encryption method is applied to the client, and the searchable encryption method includes steps S210 to S240, each of which is as follows:
[0068] S210: Determine the data identifier and key corresponding to the keyword to be retrieved.
[0069] Specifically, when a user needs to retrieve a file identifier corresponding to a file containing a keyword w to be retrieved on the server side, the user may first determine a data identifier and a key corresponding to the keyword w to be retrieved.
[0070] S220: Generate a search token based on the data identifier and the key.
[0071] The search token includes a data identifier and a key corresponding to the keyword to be retrieved.
[0072] Specifically, after determining the data identifier and key corresponding to the keyword w to be retrieved, a search token may be generated based on the data identifier and the key.
[0073] The search token t can be stored in the client and can be recorded as (W[w].id, W[w].key), where W[w].id is the data identifier corresponding to the keyword w to be retrieved, and W[w].key is the key corresponding to the keyword w to be retrieved.
[0074] S230: Sending a search request to the server, so that the server searches the binary search tree based on the data identifier and the key, and obtains a file identifier that matches the keyword to be searched.
[0075] The binary search tree is constructed based on a plurality of storage data blocks, where the storage data blocks are used to store data identifiers and encrypted file information, where the encrypted file information includes the file identifier.
[0076] S240: Receive the file identifier sent by the server.
[0077] In some embodiments, after receiving the file identifier sent by the server, it also includes: determining the data identifier corresponding to the keyword to be updated and the file identifier matching the keyword to be updated; generating a key corresponding to the keyword to be updated based on a key generation algorithm; encrypting the file identifier matching the keyword to be updated based on the key corresponding to the keyword to be updated to obtain encrypted file information; constructing a storage data block to be updated based on the data identifier corresponding to the keyword to be updated and the encrypted file information; the storage data block to be updated is used to store the data identifier of the keyword to be updated and the encrypted file information, and the encrypted file information includes the file identifier; sending the storage data block to be updated to the server, so that the server inserts the storage data block to be updated into the binary search tree to obtain an updated binary search tree.
[0078] It is understandable that the client can update the files stored on the server.
[0079] After the client uploads the encrypted file to the server's database, the binary search tree needs to be updated to facilitate the next search.
[0080] Specifically, the client needs to determine the data identifier corresponding to the keyword to be updated and the file identifier matching the keyword to be updated, and generate the storage data block b to be updated based on the KBBC algorithm.
[0081] The data identifier of the storage data block to be updated is the data identifier corresponding to the keyword to be updated. The data identifier corresponding to the keyword to be updated can be based on {0,1} λ Generate random values sampled from .
[0082] Specifically, based on a key generation algorithm, a key corresponding to the keyword to be updated is generated; based on the key corresponding to the keyword to be updated, a file identifier matching the keyword to be updated is encrypted to obtain encrypted file information.
[0083] Optionally, the encrypted file information includes a file identifier, a key of the next block, and a data identifier of the next block.
[0084] Optionally, the encrypted file information includes a file identifier, an operation operator, a key for the next block, and a data identifier for the next block.
[0085] Optionally, the operation operator may be used to represent an operation on the storage data block to be updated. For example, the operation operators add and del may respectively represent inserting or deleting the storage data block to be updated.
[0086] Furthermore, based on the data identifier corresponding to the keyword to be updated and the encrypted file information, a storage data block to be updated is constructed.
[0087] The to-be-updated storage data block is used to store the data identifier of the to-be-updated keyword and the encrypted file information, where the encrypted file information includes the file identifier.
[0088] Optionally, to further ensure data security, the client can sample the key, perform a hash operation based on the key and the data identifier, and generate a symbol mask mask; the encrypted file information is further encrypted based on the symbol mask mask, and the storage data block b to be updated can be expressed as b = (id, (value, key, ptr) □ mask).
[0089] Among them, value is the file identifier and operation operator encrypted by the key; key is the key of the next block; ptr is the data identifier of the next block.
[0090] Furthermore, the stored data block to be updated is sent to the server side, so that the server side inserts the stored data block to be updated into the binary search tree to obtain an updated binary search tree.
[0091] In some embodiments, before determining the data identifier and key corresponding to the keyword to be retrieved, it also includes: obtaining an index list corresponding to the keyword to be retrieved; the index list includes a file identifier that matches the keyword to be retrieved; based on the index list, generating a storage data block; the storage data block is used to store the data identifier and encrypted file information, and the encrypted file information includes the file identifier; sending the storage data block to the server side, so that the server side constructs a binary search tree based on the storage data block.
[0092] It can be understood that before sending a retrieval request to the server, a binary search tree needs to be constructed on the server.
[0093] Specifically, the client may obtain an index list corresponding to the keyword to be searched; the index list includes file identifiers that match the keyword to be searched.
[0094] Specifically, this embodiment uses an inverted index to build: for each keyword w, an index list L is built w , used to store the file identifiers that match the keyword to be retrieved, that is, the file identifiers (ind1,...ind n ).
[0095] Where n = |L w |, n represents the number of file identifiers in the index list that match the keyword to be retrieved, |L w | represents the index list L w The size of the list.
[0096] Furthermore, based on the index list, a storage data block is generated.
[0097] Specifically, for each file identifier corresponding to a file containing the keyword w to be retrieved, the client may generate a corresponding storage data block for the file identifier based on the KBBC algorithm, for storing the data identifier and encrypted file information; wherein the encrypted file information includes the file identifier.
[0098] The storage data block is used to store a data identifier and encrypted file information, where the encrypted file information includes a file identifier.
[0099] Furthermore, all stored data blocks are sent to the server side, so that the server side constructs a binary search tree based on the stored data blocks.
[0100] It should be noted that, on the server side, the storage data block in the binary search tree T can be divided into two parts: T[id] and T[id].data; among them, T[id] is used to store data identifiers, and T[id].data is used to store encrypted file information.
[0101] Since the index list L w contains n file identifiers, so the binary search tree T constructed on the server side contains n nodes (i.e., storage data blocks), and the index list depth corresponding to the binary search tree T is log n.
[0102] The present invention also provides a searchable encryption device. Figure 3 , Figure 33 is a schematic diagram of the structure of the searchable encryption device provided by the present invention. In this embodiment, the searchable encryption device includes a receiving module 310 , a retrieval module 320 and a sending module 330 .
[0103] The receiving module 310 is configured to receive a search token in response to a search request from a client. The search token includes a data identifier and a key corresponding to the keyword to be searched.
[0104] The retrieval module 320 is used to search the binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be searched.
[0105] The binary search tree is constructed based on a plurality of storage data blocks, where the storage data blocks are used to store data identifiers and encrypted file information, where the encrypted file information includes the file identifier.
[0106] The sending module 330 is configured to send the file identifier to the client.
[0107] In some embodiments, the retrieval module 320 is used to search the binary search tree based on the data identifier to obtain a storage data block that matches the data identifier; based on the key, decrypt the encrypted file information in the storage data block that matches the data identifier to obtain a file identifier that matches the keyword to be retrieved.
[0108] In some embodiments, the searchable encryption device further includes an update module.
[0109] The update module is used to respond to the client's update request and receive the storage data block to be updated; the storage data block to be updated is used to store the data identifier of the keyword to be updated and the encrypted file information, and the encrypted file information includes the file identifier; the storage data block to be updated is inserted into the binary search tree to obtain an updated binary search tree.
[0110] In some embodiments, the searchable encryption device further comprises a building module.
[0111] The construction module is used to receive the storage data blocks sent by the client; based on the storage data blocks, a binary search tree is constructed.
[0112] The present invention also provides an electronic device. Figure 4 Schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the searchable encryption method applied to the server.
[0113] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.
[0114] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the searchable encryption method applied to the server provided by the above methods is implemented.
[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.
[0116] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.
[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.
Claims
1. A searchable encryption method, characterized in that: Applied to the server side, including: In response to a search request from a client, a search token is received; the search token includes a data identifier and a key corresponding to a keyword to be searched; Based on the data identifier and the key, a binary search tree is searched to obtain a file identifier that matches the keyword to be searched; the binary search tree is constructed based on a plurality of storage data blocks, the storage data blocks are used to store the data identifier and encrypted file information, the encrypted file information including the file identifier; The file identifier is sent to the client.
2. The searchable encryption method according to claim 1, wherein: The step of searching a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be searched includes: Based on the data identifier, searching the binary search tree to obtain a stored data block matching the data identifier; Based on the key, the encrypted file information in the storage data block matching the data identifier is decrypted to obtain a file identifier matching the keyword to be retrieved.
3. The searchable encryption method according to claim 1, wherein: After sending the file identifier to the client, the method further includes: In response to an update request from a client, receiving a to-be-updated storage data block; the to-be-updated storage data block is used to store a data identifier of a to-be-updated keyword and encrypted file information, the encrypted file information including a file identifier; Insert the to-be-updated stored data block into the binary search tree to obtain an updated binary search tree.
4. The searchable encryption method according to claim 1, wherein: The method further includes, before receiving the search token in response to the client's retrieval request, the following steps: Receiving a storage data block sent by the client; The binary search tree is constructed based on the stored data blocks.
5. A searchable encryption method, characterized in that: Applied to the client, including: Determine the data identifier and key corresponding to the keyword to be retrieved; Based on the data identifier and the key, a search token is generated; the search token includes the data identifier and the key corresponding to the keyword to be retrieved; Sending a search request to a server, so that the server searches a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be searched; the binary search tree is constructed based on a plurality of storage data blocks, the storage data blocks are used to store the data identifier and encrypted file information, the encrypted file information including the file identifier; Receive the file identifier sent by the server.
6. The searchable encryption method according to claim 5, wherein: After receiving the file identifier sent by the server, the method further includes: Determine a data identifier corresponding to the keyword to be updated and a file identifier matching the keyword to be updated; Generate a key corresponding to the keyword to be updated based on a key generation algorithm; Based on the key corresponding to the keyword to be updated, encrypting the file identifier that matches the keyword to be updated to obtain encrypted file information; Based on the data identifier corresponding to the keyword to be updated and the encrypted file information, a storage data block to be updated is constructed; the storage data block to be updated is used to store the data identifier of the keyword to be updated and the encrypted file information, the encrypted file information including the file identifier; The to-be-updated storage data block is sent to the server end, so that the server end inserts the to-be-updated storage data block into the binary search tree to obtain an updated binary search tree.
7. The searchable encryption method according to claim 5, wherein: Before determining the data identifier and key corresponding to the keyword to be retrieved, the method further includes: Obtaining an index list corresponding to the keyword to be searched; the index list includes file identifiers matching the keyword to be searched; Based on the index list, a storage data block is generated; the storage data block is used to store a data identifier and encrypted file information, wherein the encrypted file information includes a file identifier; The stored data blocks are sent to the server side, so that the server side constructs the binary search tree based on the stored data blocks.
8. A searchable encryption device, characterized in that: include: A receiving module, configured to receive a search token in response to a search request from a client; the search token includes a data identifier and a key corresponding to a keyword to be retrieved; a retrieval module, configured to search a binary search tree based on the data identifier and the key to obtain a file identifier that matches the keyword to be searched; the binary search tree is constructed based on a plurality of storage data blocks, the storage data blocks being configured to store the data identifier and encrypted file information, the encrypted file information including the file identifier; A sending module is used to send the file identifier to the client.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the searchable encryption method according to any one of claims 1 to 4 is implemented.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the searchable encryption method according to any one of claims 1 to 4 is implemented.