Data retrieval method based on multilayer hash tree

Abstract

The invention belongs to the technical field of data security, and discloses a data retrieval method based on a multilayer Hash tree. According to the scheme, encrypted documents are uploaded to a storage node, each encrypted document corresponds to a unique document identifier at the storage node, the document identifier instead of the encrypted document is provided for a server side, and when retrieval is carried out based on input keywords, the retrieval efficiency is greatly improved. And then, the user side downloads the encrypted document from the storage node based on the target document identifier and restores the encrypted document, so that the data security is higher. A server constructs a keyword hash tree based on the perturbation hash value, a leaf node of the keyword hash tree is associated with an inverted index, the inverted index stores a document identifier list corresponding to an encrypted document containing a corresponding keyword, and data is embedded in an index structure, so that the index can be prevented from being tampered, and data verification operation is executed; and meanwhile, the hash tree structure supports local index updating, so that reconstruction of the whole index structure is avoided, and the retrieval efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data retrieval method based on a multi-level hash tree. Background Technology

[0002] With the rapid development of cloud computing and big data, protecting privacy and ensuring data security have become increasingly important. To protect data security, data must be encrypted before being uploaded to the server. However, storing data in encrypted form exacerbates the difficulty of data retrieval.

[0003] Searchable Encryption (SE) is a technology that allows users to perform search operations within encrypted documents while ensuring the privacy and security of data in its uncracked state. SE has important applications in protecting sensitive data and supporting efficient query operations, and has been widely used in scenarios such as cloud storage, finance, and medical data retrieval. The traditional process of searchable encryption generally involves: the data owner encrypting the document to be uploaded locally using an encryption key, and uploading the ciphertext to the server; an authorized data user using the key to generate a search trap using the keywords to be queried, and sending it to the server; the server searching the search trap submitted by the data user and the index table of each uploaded ciphertext, returning the ciphertext document; and the data user using the decryption key to decrypt the ciphertext document returned by the server.

[0004] In existing technical solutions, the server directly retrieves encrypted documents based on retrieval traps. If the document content is maliciously modified, it cannot be known, and data integrity cannot be effectively guaranteed. Furthermore, its index table is vulnerable to tampering attacks. Once the index is maliciously modified, the retrieval results will lose their credibility. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a data retrieval method based on a multi-level hash tree.

[0006] According to one aspect of the embodiments of this application, a data retrieval method based on a multi-level hash tree is disclosed, the method comprising:

[0007] The user client encrypts the original document to obtain an encrypted document, uploads the encrypted document to the storage node, and each encrypted document on the storage node corresponds to a unique document identifier. The user client also extracts keywords from the original document and XORs them with the first subkey, performs double hashing on the XOR result to obtain a perturbation hash value, and provides the document identifier and the perturbation hash value to the server.

[0008] The server constructs a document hash tree based on the document identifier. The hash value of the leaf node of the document hash tree is obtained by hashing the document identifier. The server also constructs a keyword hash tree based on the perturbation hash value. The hash value of the leaf node of the keyword hash tree is obtained based on the perturbation hash value of the corresponding keyword. The leaf node of the keyword hash tree is associated with an inverted index. The inverted index stores a list of document identifiers corresponding to encrypted documents containing the corresponding keyword.

[0009] The user terminal generates a dynamic token, obtains a query value based on the dynamic token and the perturbation hash value corresponding to the input keyword, and sends the query value to the server.

[0010] The server responds to the query value by generating the same dynamic token, restores the target perturbation hash value based on the same dynamic token, and searches for the leaf node corresponding to the target perturbation hash value in the keyword hash tree to obtain the target document identifier;

[0011] The user terminal downloads the encrypted document from the storage node based on the target document identifier, and restores the original document based on the downloaded encrypted document.

[0012] In some embodiments, the step of extracting keywords from the original document and performing encryption and hashing operations to obtain a perturbation hash value includes: extracting keywords from the original document; XORing the keywords with a first subkey to obtain encrypted keywords; and performing double hashing on the encrypted keywords to obtain a perturbation hash value.

[0013] In some embodiments, the server further constructs a document hash tree based on the document identifier, and the hash value of the leaf node of the document hash tree is obtained by hashing the document identifier.

[0014] In some embodiments, constructing a document hash tree based on the document identifier includes: performing a hash operation based on the document identifier to obtain the hash value of the leaf node; concatenating the hash values ​​of two adjacent leaf nodes and performing another hash operation to obtain the hash value of the parent node; concatenating the hash values ​​of the parent nodes in pairs and calculating a new hash value for the parent node, until a root node is finally generated, thus constructing a document hash tree with a multi-level structure. Before the user terminal downloads the encrypted document from the storage node based on the target document identifier, the method further includes: the user terminal calculating the target hash value corresponding to the target document identifier; combining the target hash value with the hash values ​​of other parent nodes of the document hash tree to obtain a first root hash; comparing the first root hash with the root hash of the document hash tree; determining whether the data verification passes based on the comparison result; and when the data verification passes, then executing the download of the encrypted document from the storage node based on the target document identifier.

[0015] In some embodiments, constructing a keyword hash tree based on the perturbation hash value includes: for each keyword, using an inverted index to store a list of document identifiers corresponding to encrypted documents containing the keyword; concatenating the hash values ​​corresponding to all document identifiers in the document identifier list and then performing a hash operation to obtain a list hash root; concatenating the obtained list hash root with the corresponding perturbation hash value and then performing a hash operation to obtain the hash value of a leaf node; concatenating the hash values ​​of two adjacent leaf nodes and then performing a hash operation to obtain the hash value of a parent node; concatenating the obtained hash values ​​of the parent nodes in pairs and then calculating a new hash value of the parent node, until a root node is finally generated, thus constructing a keyword hash tree.

[0016] In some embodiments, before the user terminal downloads the encrypted document from the storage node based on the target document identifier, the method further includes: the user terminal concatenating the target perturbation hash value and the corresponding list hash root, and then performing a hash operation to obtain the hash value of the first leaf node of the keyword hash tree; obtaining the second root hash based on the hash value of the first leaf node combined with the hash values ​​of the other leaf nodes of the keyword hash tree; comparing the second root hash with the root hash of the keyword hash tree, and determining whether the data verification is successful based on the comparison result; and when the data verification is successful, then executing the download of the encrypted document from the storage node based on the target document identifier.

[0017] In some embodiments, before the user terminal downloads the encrypted document from the storage node based on the target document identifier, the method further includes: the user terminal performing data verification; and when the data verification is successful, then the downloading of the encrypted document from the storage node based on the target document identifier is performed.

[0018] In some embodiments, after constructing the document hash tree and the keyword hash tree, the method further includes: binding the root hash of the document hash tree with the root hash of the keyword hash tree to obtain a global root hash. The user terminal performs data verification, including: calculating the target hash value corresponding to the target document identifier; combining the target hash value with the hash values ​​of other parent nodes of the document hash tree to obtain a first root hash; concatenating the target perturbation hash value with the list hash root of the corresponding document identifier list, and then performing a hash operation, wherein the list hash root is obtained by concatenating the hash values ​​corresponding to all document identifiers included in the document identifier list; combining the hash operation result with the hash values ​​of other leaf nodes of the keyword hash tree to obtain a second root hash; binding the first root hash and the second hash to obtain a third hash; comparing the third hash with the global root hash, and determining whether the data verification passes based on the comparison result.

[0019] In some embodiments, the user terminal encrypts the original document to obtain an encrypted document, including: the user terminal encrypts the original document based on a second subkey, an encryption vector, and an encryption algorithm to obtain an encrypted document; wherein the second subkey is different from the first subkey. Before the user terminal encrypts the original document based on the second subkey, the encryption vector, and the encryption algorithm, the method further includes: the user terminal generating a master key, and generating the first subkey and the second subkey based on the master key; and requesting the server to generate a TOTP key. The user terminal obtains a query value based on the perturbation hash value corresponding to the input keyword, including: the user terminal generating a dynamic token based on the TOTP key and time, and performing an XOR operation on the dynamic token and the perturbation hash value corresponding to the input keyword to obtain the query value. The server restores the target perturbation hash value in response to the query value, including: the server generating the same dynamic token based on the TOTP key and time in response to the received query value; and performing an XOR operation on the same dynamic token and the query value to obtain the target perturbation hash value.

[0020] In some embodiments, the storage node is a distributed storage system.

[0021] The technical solutions provided by the embodiments of this application have at least the following beneficial effects:

[0022] The scheme disclosed in this application uploads encrypted documents to storage nodes. Each encrypted document on the storage node corresponds to a unique document identifier. The server receives the document identifier, not the encrypted document. When searching based on input keywords, the document identifier is also obtained. The user then downloads the encrypted document from the storage node and restores it based on the target document identifier, thus enhancing data security. The server constructs a keyword hash tree based on perturbation hash values ​​and associates the leaf nodes of the keyword hash tree with an inverted index. The inverted index stores a list of document identifiers corresponding to encrypted documents containing a given keyword. The embedded data in the index structure prevents index tampering and performs data verification operations to verify data integrity. Furthermore, the hash tree structure supports partial index updates, avoiding the need to rebuild the entire index structure and improving retrieval efficiency. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the principles of this application.

[0024] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown;

[0025] Figure 2 A flowchart of a data retrieval method based on a multi-level hash tree according to an embodiment of this application is shown;

[0026] Figure 3 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S201;

[0027] Figure 4 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S202;

[0028] Figure 5 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S203;

[0029] Figure 6 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S204;

[0030] Figure 7 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S205;

[0031] Figure 8 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S206.

[0032] The annotations in the attached figures are explained as follows:

[0033] 100. System architecture; 101. User terminal; 102. Storage node; 103. Server terminal. Detailed Implementation

[0034] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this application will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0035] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more features.

[0036] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0037] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0038] Existing technical solutions suffer from problems such as the inability to verify data integrity and the vulnerability of indexes to tampering attacks. This is because the encrypted data is directly uploaded to the server. During retrieval, the server directly performs the retrieval based on the retrieval trap and the index table, returning the encrypted document. The index and data are not linked, making them susceptible to tampering attacks. Once the index is maliciously modified, the retrieval results will lose their credibility, and even if the document content is maliciously modified, it will be impossible to know.

[0039] To address this, this application provides a data retrieval method based on a multi-layer hash tree to improve data security. It uploads encrypted documents to storage nodes, where each encrypted document corresponds to a unique document identifier. The server receives the document identifier, not the encrypted document itself. When searching based on input keywords, the user obtains the document identifier. The user then downloads the encrypted document from the storage node based on the target document identifier, thus restoring the encrypted document. This method offers enhanced data security. Furthermore, the leaf nodes of the keyword hash tree are associated with an inverted index. The inverted index stores a list of document identifiers corresponding to encrypted documents containing a specific keyword. The embedded data in the index structure prevents index tampering attacks and allows for data verification operations to validate data integrity, effectively preventing index tampering.

[0040] First, let me explain some of the terms used in this application:

[0041] Multi-Layer Hash Tree (MLHT): A data structure that combines hash indexing and dynamic partial update mechanisms to improve data retrieval efficiency and privacy protection.

[0042] Searchable Encryption (SE): Allows users to perform search operations on encrypted documents without decryption.

[0043] Hash-based Message Authentication Code (HMAC): An algorithm that uses a key and a hash function to generate a message authentication code for verifying data integrity and authenticating the source of information.

[0044] Merkle tree: also known as hash tree, is a tree-like data structure based on a hash function, used to efficiently and securely verify the integrity of large-scale datasets.

[0045] Deterministic Key Derivation Functions (KDFs) are typically used to derive multiple subkeys from a master key or seed while maintaining reproducibility. They always produce the same output for the same input.

[0046] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown.

[0047] like Figure 1As shown, the system architecture 100 may include a user terminal 101, a storage node 102, and a server 103. The user terminal 101 can communicate with the storage node 102 and the server 103. For example, the user terminal 101 and the storage node 102 can send and receive encrypted documents, the user terminal 101 and the server 103 can send and receive document identifiers and perturbation hash values, and the user terminal 101 and the server 103 can send and receive query values.

[0048] Storage node 102 can be a distributed storage system. Encrypted documents are uploaded to the distributed storage system through a public communication interface. Distributed storage nodes located around the Internet are used to store the encrypted documents. The distributed storage system uses content addressing to uniquely identify documents, ensuring the uniqueness and verifiability of documents, avoiding single points of failure, and helping to ensure data security and tamper resistance.

[0049] The implementation details of the technical solutions in the embodiments of this application are described in detail below:

[0050] Figure 2 A flowchart of a data retrieval method based on a multi-level hash tree according to an embodiment of this application is shown. (See attached document.) Figure 2 As shown, this data retrieval method can be executed by a system consisting of a user terminal, a storage node, and a server. The user terminal, storage node, and server can be... Figure 1 The user terminal 101, storage node 102, and server terminal 103 are shown in the diagram. This data retrieval method includes at least the following steps: key generation, data processing and uploading, hash tree construction, query initiation, query processing, data verification, and data download and restoration. These correspond to steps S201 to S207, and are detailed below:

[0051] In step S201, the user terminal generates a master key and generates a first subkey and a second subkey based on the master key.

[0052] In some implementations, in step S201, a first subkey and a second subkey are derived from the master key using a deterministic key derivation algorithm.

[0053] The first and second subkeys are derived by a deterministic key derivation algorithm. Under the premise of ensuring security, hierarchical management and minimization of exposure of subkeys are achieved, while effectively preventing misuse attacks.

[0054] In some implementations, a deterministic key derivation algorithm combined with a hash algorithm is used to derive the first and second subkeys. The second subkey differs from the first subkey; the first subkey carries information about the encryption algorithm (ENC), while the second subkey carries information about the hash algorithm.

[0055] The first and second subkeys are derived by using a deterministic key derivation algorithm combined with a hash algorithm. First, the input master key is transformed into a uniformly distributed pseudo-random key, and then expanded into an output key of arbitrary length, i.e., a subkey, by combining context information. This can achieve accurate key separation, entropy conservation, robustness against missing salt values, and meet the requirements of lightweight computing.

[0056] For example, the master key is:

[0057] master=0x2ff0ae00b6b82f451b26af1719fb6bf3cc5c7736e51727381eeb487ba8a36fc5;

[0058] The first subkey is:

[0059] K_enc=0xdeae3f21361b5ac4991e37e2daff4395bad04cd629bf72431aa206c0ad637c05;

[0060] The second subkey is:

[0061] K_hash=0xc1872c4006c57056784194c03429fb590b2329860e50d3bc486f2d5012dad414.

[0062] In some implementations, in step S201, the user also requests the server to generate a TOTP key, which is held by both the server and the user.

[0063] For example, the TOTP key is:

[0064] K_totp=SNXKP2VQYJZPJOTV4IPUV4OHSO546HB6.

[0065] Figure 3 An embodiment of this application is shown. Figure 2 The detailed flowchart of step S201 is as follows: Figure 3 As shown, the key generation step includes the following steps S301-S303, which are described in detail below:

[0066] In step S301, the user terminal generates a master key.

[0067] In step S302, the user terminal derives the first subkey and the second subkey based on the master key using a deterministic key derivation algorithm combined with a hash algorithm.

[0068] In step S303, the user requests the server to generate a TOTP key.

[0069] exist Figure 3 In the illustrated embodiment, a deterministic key derivation algorithm combined with a hash algorithm is used to derive the first and second subkeys. These subkeys are then expanded to arbitrary lengths by incorporating context information, achieving precise key separation, entropy conservation, and robustness against missing salt values, while also meeting lightweight computing requirements.

[0070] In step S202, the user encrypts the original document to obtain an encrypted document, uploads the encrypted document to the storage node, and each encrypted document on the storage node corresponds to a unique document identifier. The user also extracts keywords from the original document, performs encryption and hashing operations to obtain a perturbation hash value, and provides the document identifier and perturbation hash value to the server.

[0071] The process of obtaining an encrypted document by encrypting the original document on the user end includes: the user end encrypting the original document based on the second subkey, encryption vector, and encryption algorithm to obtain the encrypted document.

[0072] In some embodiments, the user terminal uses a symmetric encryption algorithm to encrypt the original document. That is, in step S202, the original document is encrypted based on the second subkey, the encryption vector, and the symmetric encryption algorithm to obtain an encrypted document.

[0073] For example, in step S202, the original document is defined as D_i, the encryption vector is IV, and the data is encrypted using a symmetric encryption algorithm to obtain the encrypted document C_i = Y.Encrypt(K_enc,D_i,IV), where Y represents the specific encryption algorithm used.

[0074] In some embodiments, uploading an encrypted document to a storage node is equivalent to uploading the encrypted document to a distributed storage system. In the distributed storage system, each encrypted document corresponds to a unique document identifier. The document identifier CID_i = X.Add(C_i), where X represents the distributed storage system identifier.

[0075] In some embodiments, extracting keywords from the original document and performing encryption and hashing operations to obtain a perturbation hash value includes: extracting keywords from the original document; XORing the keywords with a first subkey to obtain encrypted keywords; and performing double hashing on the encrypted keywords to obtain a perturbation hash value.

[0076] The user terminal XORs the keyword with the first subkey to obtain the encrypted keyword, and then performs a double hash on the encrypted keyword to obtain a perturbation hash value. The double hash can prevent attackers from obtaining the encrypted keyword. Even if the attacker knows the first subkey, they cannot deduce the keyword. Therefore, it can resist rainbow table attacks. Attackers cannot analyze and deduce the user's search content through query patterns.

[0077] Figure 4 An embodiment of this application is shown. Figure 2 The detailed flowchart of step S202 is as follows: Figure 4 As shown, the data processing and uploading steps include the following steps S401-S404, which are described in detail below:

[0078] In step S401, the user terminal encrypts the original document based on the second subkey, encryption vector, and encryption algorithm to obtain the encrypted document.

[0079] In step S402, the encrypted document is uploaded to the distributed storage system, where each encrypted document corresponds to a unique document identifier.

[0080] In step S403, the user terminal extracts keywords from the original document, XORs the keywords with the first subkey to obtain encrypted keywords, and then performs double hashing on the encrypted keywords to obtain perturbation hash values.

[0081] In step S404, the document identifier and perturbation hash value are provided to the server.

[0082] exist Figure 4 In the illustrated embodiment, encrypted documents are uploaded to a distributed storage system, and content addressing is used to uniquely identify the documents, ensuring their uniqueness and verifiability, avoiding single points of failure, and helping to guarantee data security and prevent tampering. The encrypted keywords are obtained by XORing the keywords with the first subkey, and then double-hashing the encrypted keywords to obtain a perturbation hash value. Double hashing prevents attackers from obtaining the encrypted keywords. Even if an attacker knows the first subkey, they cannot deduce the keywords, thus resisting rainbow table attacks. Attackers cannot analyze and infer the user's search content through query patterns.

[0083] In step S203, the server constructs a keyword hash tree based on the perturbation hash value. The hash value of the leaf node of the keyword hash tree is obtained based on the perturbation hash value of the corresponding keyword. The leaf node of the keyword hash tree is associated with an inverted index, which stores a list of document identifiers corresponding to the encrypted documents containing the corresponding keyword.

[0084] In some embodiments, constructing a keyword hash tree based on perturbation hash values ​​includes: for each keyword, using an inverted index to store a list of document identifiers corresponding to encrypted documents containing that keyword; concatenating the hash values ​​corresponding to all document identifiers in the document identifier list and then performing a hash operation to obtain the list hash root; concatenating the obtained list hash root with the corresponding perturbation hash value and then performing a hash operation to obtain the hash value of the leaf node; concatenating the hash values ​​of two adjacent leaf nodes and then performing a hash operation to obtain the hash value of the parent node; concatenating the obtained parent node hash values ​​in pairs and then calculating the hash value of the new parent node, until a root node is finally generated, thus constructing the keyword hash tree.

[0085] The leaf nodes of the keyword hash tree are associated with an inverted index. The inverted index stores a list of document identifiers corresponding to encrypted documents containing a keyword. The data is embedded in the index structure, which can prevent the index from being tampered with and perform data verification operations to verify data integrity.

[0086] In some embodiments, each leaf node of the keyword hash tree corresponds to a perturbation hash value (H_perturb(w)) for a keyword w, and is associated with an inverted index that stores a list of document identifiers (CIDs) corresponding to encrypted documents containing that keyword. The structure of the keyword hash tree is as follows:

[0087] Leaf nodes: Each leaf node contains hw_i = H_perturb(w).

[0088] {

[0089] "hash":"...", / / Perturbation hash value of the keyword

[0090] "root_list":"..." / / Merkle root of the CID list

[0091] "cids":["CID_1","CID_2"] / / List of associated CIDs

[0092] };

[0093] Parent node: Stores the concatenated hash value of its child nodes, Hash(Hw1||Root_list1||Hw2||Root_list2);

[0094] Root node (Root_W): The final hash value of the tree, representing the state of the entire keyword index.

[0095] Understandably, when there are few keywords, such as only two keywords, the keyword hash tree can contain only leaf nodes and a root node. The aforementioned concatenation of the hash values ​​of two adjacent leaf nodes and subsequent hash operation to obtain the hash value of the parent node; concatenation of the two obtained parent node hash values ​​together and subsequent calculation of the new parent node hash value, until a root node is finally generated and the keyword hash tree is constructed, can be simplified to: concatenating the hash values ​​of two adjacent leaf nodes and subsequent hash operation to obtain the hash value of the root node, thus constructing the keyword hash tree.

[0096] In some embodiments, the server also constructs a document hash tree based on the document identifier, and the hash value of the leaf node of the document hash tree is obtained by hashing the document identifier.

[0097] By constructing a document hash tree, data integrity can be verified in subsequent steps, such as whether the CID document identifier is forged.

[0098] In some embodiments, constructing a document hash tree based on a document identifier includes: performing a hash operation based on the document identifier to obtain the hash value of the leaf node; concatenating the hash values ​​of two adjacent leaf nodes and performing another hash operation to obtain the hash value of the parent node; concatenating the hash values ​​of the obtained parent nodes in pairs and calculating the hash value of the new parent node, until a root node is finally generated, thus constructing a document hash tree with a multi-level structure.

[0099] For example, a document hash tree with a multi-level structure is constructed as follows:

[0100]

[0101] In some embodiments, the root hash of the document hash tree is also bound to the root hash of the keyword hash tree to obtain a global root hash.

[0102] Binding the root hash of the document hash tree to the root hash of the keyword hash tree can be achieved by concatenating the root hash of the document hash tree and the root hash of the keyword hash tree, and then performing a hash operation to obtain the global root hash.

[0103] Any modification to the document content or keywords will change the global root hash, and the client can detect tampering by verifying the global root hash.

[0104] Figure 5 An embodiment of this application is shown. Figure 2 The detailed flowchart of step S203 is as follows: Figure 5As shown, the hash tree construction steps include document hash tree construction, keyword hash tree construction, and root hash binding, which correspond to steps S501-S503, S504-S507, and S508, respectively, and are explained in detail below:

[0105] In step S501, a hash operation is performed based on the document identifier to obtain the hash value of the leaf node.

[0106] In step S502, the hash values ​​of two adjacent leaf nodes are concatenated and then hashed to obtain the hash value of the parent node.

[0107] In step S503, the hash values ​​of the parent nodes are concatenated in pairs, and the hash values ​​of the new parent nodes are calculated until a root node is finally generated, thus constructing a document hash tree with a multi-level structure.

[0108] In step S504, for each keyword, an inverted index is used to store a list of document identifiers corresponding to the encrypted documents containing the keyword. The hash values ​​corresponding to all document identifiers in the document identifier list are concatenated and then hashed to obtain the list hash root.

[0109] In step S505, the obtained list hash root is concatenated with the corresponding perturbation hash value, and then a hash operation is performed to obtain the hash value of the leaf node.

[0110] In step S506, the hash values ​​of two adjacent leaf nodes are concatenated and then hashed to obtain the hash value of the parent node.

[0111] In step S507, the hash values ​​of the parent nodes are concatenated in pairs, and the hash values ​​of the new parent nodes are calculated until a root node is finally generated, thus constructing a keyword hash tree.

[0112] In step S508, the root hash of the document hash tree is concatenated with the root hash of the keyword hash tree, and then a hash operation is performed to obtain the global root hash.

[0113] exist Figure 5In the illustrated embodiment, by constructing a document hash tree, data integrity can be verified in subsequent steps, such as whether the CID document identifier is forged. The leaf nodes of the keyword hash tree are associated with an inverted index, which stores a list of document identifiers corresponding to encrypted documents containing a specific keyword. The index structure embeds data to prevent index tampering and performs data verification operations to verify data integrity. The root hash of the document hash tree is concatenated with the root hash of the keyword hash tree, and then a hash operation is performed to obtain the global root hash. Any modification to the document content or index will change the global root hash, and the user can detect tampering by verifying the global root hash.

[0114] In step S204, the user terminal obtains the query value based on the perturbation hash value corresponding to the input keyword and sends the query value to the server.

[0115] In some embodiments, the user terminal obtains the query value based on the perturbation hash value corresponding to the input keyword, including: the user terminal generates a dynamic token based on the TOTP key and time, and performs an XOR operation on the dynamic token and the perturbation hash value corresponding to the input keyword to obtain the query value.

[0116] A dynamic token is generated based on the TOTP key and time. Then, an XOR operation is performed between the dynamic token and the perturbation hash value corresponding to the input keyword to obtain the query value. The query value is dynamic and changes dynamically each time, which can effectively interfere with the attacker's statistical inference and prevent the attacker from deducing the user's intention.

[0117] Figure 6 An embodiment of this application is shown. Figure 2 The detailed flowchart of step S204 is as follows: Figure 6 As shown, the query initiation steps include the following steps S601-S603, which are described in detail below:

[0118] In step S601, the user terminal generates a dynamic token based on the TOTP key and time.

[0119] In step S602, an XOR operation is performed based on the dynamic token and the perturbation hash value corresponding to the input keyword to obtain the query value.

[0120] In step S603, the query value is sent to the server.

[0121] exist Figure 6 In the illustrated embodiment, a dynamic token is generated based on the TOTP key and time. Then, an XOR operation is performed on the dynamic token and the perturbation hash value corresponding to the input keyword to obtain the query value. The query value is dynamic, and it changes dynamically each time. This can effectively interfere with the attacker's statistical inference and prevent the attacker from inferring the user's intent.

[0122] In step S205, the server responds to the query value to restore the target perturbation hash value, and searches for the leaf node corresponding to the target perturbation hash value in the keyword hash tree to obtain the target document identifier.

[0123] In some embodiments, the server restores the target perturbation hash value in response to the query value, including: the server generates the same dynamic token based on the TOTP key and time in response to the received query value; and performs an XOR operation based on the same dynamic token and the query value to obtain the target perturbation hash value.

[0124] Figure 7 An embodiment of this application is shown. Figure 2 Detailed flowchart of step S205, such as Figure 7 As shown, the query processing steps include the following steps S701-S703, which are described in detail below:

[0125] In step S701, the server responds to the received query value by generating the same dynamic token based on the TOTP key and time.

[0126] In step S702, the target perturbation hash value is obtained by performing an XOR operation based on the same dynamic token and query value.

[0127] In step S703, the leaf node corresponding to the target perturbation hash value is found in the keyword hash tree to obtain the target document identifier.

[0128] exist Figure 7 In the illustrated embodiment, corresponding to Figure 6 The embodiment shown uses dynamic tokens. To generate identical dynamic tokens, an XOR operation is performed between the generated tokens and the query value to obtain the target perturbation hash value. Then, the leaf node corresponding to the target perturbation hash value is searched in the keyword hash tree to obtain the target document identifier. This target document identifier is the document identifier corresponding to the original document containing the keyword entered by the user.

[0129] In step S206, the user terminal performs data verification. Only when the data verification is successful will the subsequent data download and restoration steps be executed.

[0130] Before downloading the encrypted document from the storage node based on the target document identifier, the user first performs data verification. When the data verification is successful, the encrypted document is then downloaded from the storage node and the original document is restored. This ensures that the downloaded encrypted document is accurate, thereby ensuring the accuracy of the obtained original document.

[0131] In some embodiments, data verification on the user end may involve verifying only the root hash of the document hash tree according to actual needs, in order to verify the integrity of the document data, such as verifying whether the CID document identifier is forged.

[0132] For example, verifying the root hash of the document hash tree includes: the user terminal calculating the target hash value corresponding to the target document identifier; combining the target hash value with the hash values ​​of other parent nodes of the document hash tree to obtain the first root hash; comparing the first root hash with the root hash of the document hash tree; and determining whether the data verification passes based on the comparison result. Specifically, when the first root hash and the root hash of the document hash tree are the same, the data verification passes; when the first root hash and the root hash of the document hash tree are different, the data verification fails.

[0133] In some embodiments, data verification on the user end can be performed by verifying only the root hash of the keyword hash tree according to actual needs, in order to verify the integrity of the keyword hash tree. For example, it can be used to verify whether the server has modified the keyword hash tree or to deliberately conceal some CIDs and not return them.

[0134] For example, verifying the root hash of the keyword hash tree includes: the user concatenates the target perturbation hash value and the corresponding list hash root, then performs a hash operation to obtain the hash value of the first leaf node of the keyword hash tree; based on the hash value of the first leaf node, it combines the hash values ​​of the other leaf nodes of the keyword hash tree to obtain the second root hash; the second root hash is compared with the root hash of the keyword hash tree, and the data verification is determined based on the comparison result. Specifically, when the second root hash and the root hash of the keyword hash tree are the same, the data verification passes; when the second root hash and the root hash of the keyword hash tree are different, the data verification fails.

[0135] In some embodiments, data validation on the user end can involve validating both the root hash of the document hash tree and the root hash of the keyword hash tree, and combining the comparison results of the two to determine whether the data validation passes or fails, thereby improving the accuracy of the data validation results. Specifically, data validation fails when the first root hash and the root hash of the document hash tree are inconsistent, or when the second root hash and the root hash of the keyword hash tree are inconsistent; data validation passes when the first root hash and the root hash of the document hash tree are consistent, and the second root hash and the root hash of the keyword hash tree are consistent.

[0136] In some embodiments, data verification on the user end can also be performed by verifying the global root hash to verify the overall data integrity. That is, by verifying the global root hash, the root hash of the document hash tree and the root hash of the keyword hash tree are verified.

[0137] Figure 8 An embodiment of this application is shown. Figure 2 The detailed flowchart of step S206 is as follows: Figure 8 As shown, the data verification steps include the following steps S801-S805, which are described in detail below:

[0138] In step S801, the target hash value corresponding to the target document identifier is calculated, and the target hash value is combined with the hash values ​​of other parent nodes of the document hash tree to obtain the first root hash.

[0139] In step S803, the target perturbation hash value is concatenated with the list hash root of the corresponding document identifier list, and then a hash operation is performed. The list hash root is obtained by concatenating the hash values ​​corresponding to all document identifiers contained in the document identifier list and then performing a hash operation.

[0140] In step S803, the hash operation result is combined with the hash values ​​of other leaf nodes of the keyword hash tree to obtain the second root hash.

[0141] In step S804, the first root hash and the second root hash are bound together to obtain the third root hash.

[0142] In step S805, the third root hash and the global root hash are compared, and the data verification is determined based on the comparison result.

[0143] Specifically, data verification passes when the third root hash matches the global root hash; otherwise, data verification fails.

[0144] exist Figure 8 In the illustrated embodiment, the root hash of the document hash tree and the root hash of the keyword hash tree are verified by verifying the global root hash. This simplifies the data verification logic, streamlines the data verification process, and improves data verification efficiency.

[0145] In step S207, the user terminal downloads the encrypted document from the storage node based on the target document identifier, and restores the original document based on the downloaded encrypted document.

[0146] In some embodiments, corresponding to the data encryption method in step S202, the user terminal restores the original document based on the downloaded encrypted document, including: decrypting and encrypting the downloaded encrypted document based on the second subkey, encryption vector, and encryption algorithm to obtain the original document: D_i = Y.Decrypt(K_enc,C_i,IV), where Y represents the specific encryption / decryption algorithm used.

[0147] It is understood that the execution order of the various steps described in the above embodiments is only some examples of this application. In other embodiments, the order of some steps may also be adjusted. For example, the keyword hash tree construction step may be executed first, followed by the document hash tree construction step; the second root hash acquisition step may be executed first, followed by the first root hash acquisition step, etc.

[0148] It is understandable that the user terminal executing the query initiation step, data verification step, and data download and restoration step can be the same user terminal as the user terminal executing the key generation step and data processing and uploading step, or they can be different user terminals. For example, the user terminal executing the key generation step and data processing and uploading step is the original document owner, while the user terminal executing the query initiation step, data verification step, and data download and restoration step is a document user authorized by the original document owner.

[0149] The implementation process of the data retrieval method of this application will be described below using a specific embodiment as an example:

[0150] On the user side, the original document is defined as D_i, the encryption vector is IV, and the data is encrypted using a symmetric encryption algorithm to obtain the encrypted document C_i = Y.Encrypt(K_enc,D_i,IV). Taking a smart home platform as an example, the device data D_i for IoT devices such as aquarium heaters is:

[0151] D_1={"device_id":"Sensor_123","temp":45,"status":"Overheat"};

[0152] D_2={"device_id":"Sensor_123","temp":32,"status":"Normal"};

[0153] D_3={"device_id":"Sensor_456","temp":13,"status":"Cold"}.

[0154] The encryption vector IV is: 0x4233878dd7f6c5c45a5b8c11.

[0155] The encrypted document is C_i = Enc_i||C_t, where C_t is an authentication tag generated by the encryption algorithm Y and used to verify the integrity and authenticity of the data.

[0156] for example:

[0157] C_1=0x0e55779f720f3ebe5eae3250249f7cef1f161ec657688e675ac55a225f14b3f409b9e240fed0 1d3c8c85a8ae2b710e4b90c3d2fa1983cc4f53d441094b||0xc79f4ef60a8b63e44bc6e580655a3ef1;

[0158] C_2=0x0e55779f720f3ebe5eae3250249f7cef1f161ec657688e675ac55a225f14b3f409b9e240f8 d61d3c8c85a8ae2b710e4b90c3d2fb0094d3465a9748||0x87f69368d7a0e90c57506aca027ec446;

[0159] C_3=0x0e55779f720f3ebe5eae3250249f7cef1f161ec657688e675ac55a225f14b3f409b9e240f8 d41d3c8c85a8ae2b710e4b90c3d2fb0094d3465a9748||0x9e0d84a43330522956b85b01944a0d7f.

[0160] In a distributed storage system, each encrypted document corresponds to a unique document identifier. The document identifier CID_i = X.Add(C_i), corresponding to the aforementioned C_1, C_2, and C_3, as follows:

[0161] CID_1="QmeqkB56qzDA4xm64Rqk13Fc9xeKx57UjUEDKkUcdMNXJm";

[0162] CID_2="QmZDzPr4n56pwgzKDM2s8khCGDsq1GYoUDZY2NzXYfBEvC";

[0163] CID_3="QmYs69THdqtfdP9RZ7ibmzp3eN2tLxm6RfhgqwJXoiQPAi".

[0164] On the user side, keywords w are extracted from the original document for subsequent keyword hash tree construction and retrieval. The extracted keywords are as follows:

[0165] w1 = "Sensor_123";

[0166] w2 = "Overheat".

[0167] XOR the keyword with the first subkey to obtain the encrypted keyword w_xor; then perform a double hash H_perturb(w) = SHA(SHA(w1_xor)) on the encrypted keyword to obtain the perturbation hash value, as follows:

[0168] H_perturb(w1)=0xd88c4978b1b2cc57c42e359f7caf4946922fa55509361636c8a4fca551b2a1db;

[0169] H_perturb(w2)=0xa5dcfcbb5987ddfcd73eb2e2274e67d2fa0e64fc422c2602c79f5a5aa857e294.

[0170] The client provides the document identifier CID_i and perturbation hash value H_perturb(w) to the server. Since the content of CID_i is encrypted by the user, the server cannot obtain the real content.

[0171] On the server side, construct the document hash tree:

[0172] Leaf nodes: Each leaf node is h_i = SHA(CID_i), for example:

[0173] h1=SHA(CID_1)=0x2a7d5f9e1c4b6a8d2f0e3c9a8b7d6e1f4a2c3b5d7e9f0a1b2c3d4e5f6a7b8;

[0174] h2=SHA(CID_2)=0x3d4e5f6a8b7c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2;

[0175] h3=SHA(CID_3)=0x4b2c9a8d3e1f5a7b0c3d6e9f2a5b8d1e4c7f0a3b6c9d2e5f8a1b4c7d0.

[0176] h1, h2, and h3 are leaf nodes.

[0177] Parent node:

[0178] Hash(h1||h2)=0x5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b;

[0179] Hash(h3||empty node) = SHA(0x4b2c9a8d...||0x0000...) = 0x1f2e3d4c5b6a7980a9b8c7d6e5f4a3b.

[0180] Root node:

[0181] Root_D = SHA(Hash(h1||h2)||Hash(h3||empty node)) = 0x8f9ab1c2d3e4f5a6b7c8d9e0f1a2b3c.

[0182] On the server side, construct a keyword hash tree:

[0183] A keyword hash tree is a Merkle tree structure where each leaf node corresponds to a perturbation hash value (H_perturb(w)) for a keyword and is associated with an inverted index (storing a list of document CIDs containing that keyword). The structure of a keyword hash tree is as follows:

[0184] Leaf nodes: Each leaf node contains hw_i = H_perturb(w).

[0185] {

[0186] "hash":"...", / / Perturbation hash value of the keyword

[0187] "root_list":"..." / / Merkle root of the CID list

[0188] "cids":["CID_1","CID_2"] / / List of associated CIDs

[0189] }

[0190] Parent node: Stores the concatenated hash value Hash(Hw1||Root_list1||Hw2||Root_list2) of its child nodes.

[0191] Root node (Root_W): The final hash value of the tree, representing the state of the entire keyword index.

[0192] For example:

[0193] Keyword w1 = Sensor_123;

[0194] CID list: [CID_1, CID_2];

[0195] Merkle root of the CID list (Root_list1): Root_list1 = SHA(h1||h2) = 0x5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b;

[0196] Keyword w2 = Cold;

[0197] CID list: [CID_3];

[0198] Merkle root of CID list (Root_list2): Root_list2 = h3 = 0x4b2c9a8d3e1f5a7b0c3d6e9f2a5b8d1e4c7f0a3b6c9d2e5f8a1b4c7d0;

[0199] Leaf node 1: Lw_1 = SHA(H_perturb(w1)||Root_list1) = 0x3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d;

[0200] Leaf node 2: Lw_2 = SHA(H_perturb(w2)||Root_list2) = 0x9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b;

[0201] Root node: Root_W = SHA(Lw_1||Lw_2) = 0x2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c.

[0202] On the server side, generate the global root Root_G = SHA(Root_D||Root_W); for example:

[0203] Root_G=SHA(Root_D||Root_W)=0x7d6e1f4a2c3b5d7e9f0a1b2c3d4e5f6a.

[0204] On the user's end, initiate a query:

[0205] Generate a dynamic token nonce_t: nonce_t = TOTP(K_totp, time);

[0206] For example: if the keyword w = "Sensor_123" and the random number nonce = 0x01a3c5e7..., then:

[0207] nonce_t1=TOTP(0x4b2c9a8d...,20250327224809)=0x5e8fd2a4b7c1e3f9a2d5b8e1f4a7c0d3;

[0208] Calculate the query value q: q = H_perturb(w) ⊕ nonce_t;

[0209] Hash perturbation of keyword w followed by nonce_t XOR processing yields: q = 0x9b2d4f7a8c3e5a1b6d9e0f2a5c8b1d4e7;

[0210] Send q to the server for retrieval.

[0211] On the server side, query processing:

[0212] Locating the leaf node:

[0213] Based on q, the server generates the same nonce_t = TOTP(K_totp,time), restores H_perturb(w) = q⊕nonce_t, and searches for the corresponding leaf node in the keyword hash tree.

[0214] Because of the time-dependent nature of nonce_t, the server may need the nonce from the previous time segment and perform an additional round of retrieval. That is, two retrievals are performed: nonce_t1 and nonce_{t-1}. However, this does not have a significant impact on efficiency.

[0215] Because this process is reversible, we can always locate H_perturb(w).

[0216] For example, H_perturb(w1), then we can get:

[0217] Node information - associated CID: ["CID_1","CID_2"];

[0218] Merkle proof of the CID list: CID_1 and CID_2 to Root_list1.

[0219] On the user side, data verification:

[0220] Calculate the root_D of the document hash tree:

[0221] The search results include:

[0222] CID_1="QmeqkB56qzDA4xm64Rqk13Fc9xeKx57UjUEDKkUcdMNXJm";

[0223] CID_2="QmZDzPr4n56pwgzKDM2s8khCGDsq1GYoUDZY2NzXYfBEvC".

[0224] Calculate its hash:

[0225] h1=SHA(CID_1)=0x2a7d5f9e1c4b6a8d2f0e3c9a8b7d6e1f4a2c3b5d7e9f0a1b2c3d4e5f6a7b8;

[0226] h2=SHA(CID_2)=0x3d4e5f6a8b7c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2;

[0227] Hash(h1||h2)=0x5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b.

[0228] Combining the hash(h3||0x00...) of another node in the server with the hash value 0x1f2e3d4c5b6a7980a9b8c7d6e5f4a3b, we obtain:

[0229] Root_D_local=SHA(0x5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b||0x1f2e3d4c5b6a7980a9b8c7d6e5f4a3b)=0x8f9ab1c2d3e4f5a6b7c8d9e0f1a2b3c.

[0230] Calculate the root_W of the keyword hash tree:

[0231] Calculate the perturbation hash value:

[0232] H_perturb(w)=0xd88c4978b1b2cc57c42e359f7caf4946922fa55509361636c8a4fc a551b2a1db.

[0233] Merkle root of the CID list:

[0234] root_list=SHA(h1||h2)=0x5e6f7a8b....

[0235] Construct the leaf nodes of the key hash tree:

[0236] Lw=SHA(H_perturb(w)||root_list)

[0237] =SHA(0xd88c...||0x5e6f...)

[0238] =0x3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d.

[0239] Combining this with another keyword in the server, the leaf node Lw_2 = 0x9e0f..., we obtain:

[0240] Root_W_local=SHA(Lw||Lw_2)=0x2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c.

[0241] Verify the global root Root_G:

[0242] Root_G_local=SHA(Root_D_local||Root_W_local)

[0243] =SHA(0x8f9ab1c2...||0x2f3a4b5c...)

[0244] =0x7d6e1f4a2c3b5d7e9f0a1b2c3d4e5f6a;

[0245] Compare the data with the Root_G on the server. If they match, the data is completely reliable and can be used with confidence. Verification passed.

[0246] On the user's end, download and decrypt the data:

[0247] Retrieve the ciphertext `C_i` corresponding to `CID_i` from the distributed storage system, and decrypt it to obtain the plaintext:

[0248] D_i = Y.Decrypt(K_enc, C_i, IV)

[0249] ={"device_id":"Sensor_123","temp":45,"status":"Overheat"}.

[0250] On the server side, the index is updated:

[0251] If the user uploads a new log, for example:

[0252] `D_new={"device_id":"Sensor_123","temp":25,"status":"Normal"}`, generate `CID_new="QmAbCdEfGhIjKlMnOpQrStUvWxYz"`.

[0253] Update the document hash tree:

[0254] Insert a new leaf node `h_new = SHA(CID_new) = 0x3d4e5f6a...`;

[0255] Update the path hash to the new root `Root_D`, for example: 0x2d3e4f5a...

[0256] Update the keyword hash tree:

[0257] For the keywords `"Sensor_123"` and `"Normal"`, update the index and recalculate the Merkle path to generate `Root_W`, for example: 0x6f7a8b9c....

[0258] Update global root:

[0259] Root_G'=SHA(Root_D'||Root_W')

[0260] =SHA(0x2d3e4f5a...||0x6f7a8b9c...)

[0261] =0x9c8da2b3c4d5e6f7a8b9c0d1e2f3a4b.

[0262] In summary, this application integrates data privacy protection, efficient retrieval, and integrity verification through a collaborative design of multi-layered hash trees and dynamic tokens. This allows encrypted data in decentralized storage to both conceal sensitive information and quickly locate target content through a controllable privacy retrieval mechanism, while ensuring data trustworthiness throughout its entire lifecycle. By comprehensively considering multiple dimensions such as the hash perturbation logic of the encrypted index, the timeliness of the dynamic token, and the integrity of the user verification path, this application ultimately achieves privacy protection and security verification capabilities in a decentralized storage environment. Furthermore, through key sovereignty and feedback mechanisms, it fosters a virtuous cycle of collaborative optimization between operators and users, providing a practical model for the secure circulation of high-value data in open networks.

[0263] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the appended claims.

Claims

1. A method for data retrieval based on a multi-layered hash tree, characterized in that, The method comprises the following steps: The user terminal encrypts the original document to obtain an encrypted document, uploads the encrypted document to a storage node, each encrypted document corresponding to a unique document identifier, and extracts keywords from the original document to perform encryption and hash operation to obtain a perturbation hash value, and provides the document identifier and the perturbation hash value to a server terminal; The server terminal constructs a keyword hash tree based on the perturbation hash value, the hash value of the leaf node of the keyword hash tree being obtained based on the perturbation hash value of a corresponding keyword, and the leaf node of the keyword hash tree being associated with an inverted index, the inverted index storing a document identifier list corresponding to the encrypted document containing the corresponding keyword; The user terminal obtains a query value based on the perturbation hash value corresponding to the input keyword, and sends the query value to the server terminal; The server terminal restores a target perturbation hash value in response to the query value, and finds the leaf node corresponding to the target perturbation hash value in the keyword hash tree to obtain a target document identifier; The user terminal downloads the encrypted document from the storage node based on the target document identifier, and restores the original document based on the downloaded encrypted document.

2. The method of claim 1, wherein, The method for extracting keywords from the original document to perform encryption and hash operation to obtain a perturbation hash value comprises the following steps: extracting keywords from the original document; performing XOR operation on the keywords and a first sub-key to obtain encrypted keywords; performing double hash operation on the encrypted keywords to obtain a perturbation hash value.

3. The method of claim 1, wherein, The server terminal further constructs a document hash tree based on the document identifier, the hash value of the leaf node of the document hash tree being obtained based on hash operation on the document identifier.

4. The method of claim 3, wherein, The method for constructing a document hash tree based on the document identifier comprises the following steps: performing hash operation on the document identifier to obtain the hash value of the leaf node; performing hash operation on the hash values of two adjacent leaf nodes to obtain the hash value of a parent node; performing hash operation on the hash values of two adjacent parent nodes to obtain the hash value of a new parent node, until a root node is finally generated, and a document hash tree with a multi-layer structure is constructed; Before the user terminal downloads the encrypted document from the storage node based on the target document identifier, the method further comprises the following steps: The user terminal calculates a target hash value corresponding to the target document identifier, obtains a first root hash by combining the target hash value and the hash values of other parent nodes of the document hash tree; comparing the first root hash and the root hash of the document hash tree, and determining whether data verification is passed based on the comparison result; when the data verification is passed, performing the step of downloading the encrypted document from the storage node based on the target document identifier.

5. The method of claim 1, wherein, The method for constructing a keyword hash tree based on the perturbation hash value comprises the following steps: for each keyword, an inverted index is used to store a document identifier list corresponding to the encrypted document containing the keyword; performing hash operation on the hash values corresponding to all document identifiers contained in the document identifier list to obtain a list hash root; Splicing the obtained list hash root and the corresponding perturbation hash value, and then performing hash operation to obtain a hash value of a leaf node; Splicing hash values of two adjacent leaf nodes, and then performing hash operation to obtain a hash value of a parent node; Splicing the obtained hash values of the parent nodes two by two, and then calculating a new hash value of a parent node until a root node is finally generated, thereby constructing a keyword hash tree.

6. The method of claim 5, wherein, Before the user end downloads the encrypted document from the storage node based on the target document identifier, the method further comprises: The user end splices the target perturbation hash value and the corresponding list hash root, and then performs hash operation to obtain a hash value of a first leaf node of the keyword hash tree; Based on the hash value of the first leaf node and hash values of other leaf nodes of the keyword hash tree, a second root hash is obtained; The second root hash and the root hash of the keyword hash tree are compared, and whether data verification passes or not is determined based on the comparison result; When data verification passes, the downloading of the encrypted document from the storage node based on the target document identifier is performed again.

7. The method of claim 3, wherein, Before the user end downloads the encrypted document from the storage node based on the target document identifier, the method further comprises: The user end performs data verification; When data verification passes, the downloading of the encrypted document from the storage node based on the target document identifier is performed again.

8. The method of claim 7, wherein, After the document hash tree and the keyword hash tree are constructed, the method further comprises: The root hash of the document hash tree and the root hash of the keyword hash tree are bound to obtain a global root hash; The user end performs data verification, comprising: A target hash value corresponding to the target document identifier is calculated, and a first root hash is obtained by combining the target hash value and hash values of other parent nodes of the document hash tree; The target perturbation hash value and the list hash root of the document identifier list corresponding thereto are spliced, and then hash operation is performed, wherein the list hash root is obtained by splicing hash values corresponding to all document identifiers included in the document identifier list and then performing hash operation; Hash operation results are combined with hash values of other leaf nodes of the keyword hash tree to obtain a second root hash; The first root hash and the second root hash are bound to obtain a third root hash; The third root hash and the global root hash are compared, and whether data verification passes or not is determined based on the comparison result.

9. The method of claim 2, wherein, The user end encrypts an original document to obtain an encrypted document, comprising: The user end performs data encryption on the original document based on a second sub-key, an encryption vector and an encryption algorithm to obtain an encrypted document; The second sub-key is different from the first sub-key; Before the user end performs data encryption on the original document based on a second sub-key, an encryption vector and an encryption algorithm, the method further comprises: The user end generates a master key, and generates the first sub-key and the second sub-key based on the master key; The service end is requested to generate a TOTP key; The user terminal obtains a query value based on the perturbation hash value corresponding to the input keyword, including that the user terminal generates a dynamic token based on the TOTP key and time, and performs exclusive OR operation based on the dynamic token and the perturbation hash value corresponding to the input keyword to obtain the query value; The service terminal restores the target perturbation hash value in response to the query value, including that the service terminal generates the same dynamic token based on the TOTP key and time in response to the received query value, and performs exclusive OR operation based on the same dynamic token and the query value to obtain the target perturbation hash value.

10. The method according to any one of claims 1 to 9, characterized in that, The storage node is a distributed storage system.

Images