Double-server combined keyword dynamic searchable encryption method with forward and backward security

Abstract

The invention provides a double-server combined keyword dynamic searchable encryption method with forward and backward security, which is applied to a system comprising a data owner, a data user, a first server and a second server. Keywords and associated file identifiers are stored in each leaf node, information of non-leaf nodes is mapped to a non-distinguishable long filter, and through a random state updating mechanism, a keyword double-state array and a time factor trap door design, it is guaranteed that keyword joint search is achieved, and meanwhile, the information of the non-leaf nodes can be quickly and efficiently searched. And the forward safety and the backward safety are also ensured. According to the dual-server architecture, security index storage and trap door verification are separated, so that the problem of KPRP leakage is effectively relieved.

Description

Technical Field

[0001] This invention relates to the field of data security, and in particular to a dual-server joint keyword dynamic searchable encryption method. Background Technology

[0002] With the continuous improvement of cloud computing processing capabilities, enterprises and users can enjoy powerful cloud computing capabilities on demand while reducing their local processing burden. However, while providing a convenient storage environment, cloud servers also expose many data security issues. Data stored in plaintext on cloud servers is prone to loss of control and ownership; some malicious cloud servers may attempt to steal user data. To address this problem, users have begun to consider storing data in encrypted form on cloud servers to ensure data security. However, encrypted data loses its original plaintext data structure, which poses a challenge to data retrieval on cloud servers.

[0003] Therefore, searchable encryption technology has been proposed, which enables search functionality on encrypted data without leaking sensitive information. Searchable encryption technologies can be divided into Static Searchable Encryption (SSE) and Dynamic Searchable Encryption (DSE) based on data updability. In SSE schemes, if a user wants to add, delete, or modify data, the entire index and encrypted database must be rebuilt. This severely limits scalability and maintainability in real-world scenarios, making SSE unsuitable for scenarios with frequent data updates. In DSE schemes, frequent data updates pose significant security risks, potentially leading to the leakage of sensitive and private information. Most existing SSE schemes still focus on single-keyword searches, meaning users can only use one keyword to query at a time. However, in practical applications, users often need to enter multiple keywords and retrieve files containing all keywords simultaneously; this requirement is called federated keyword search.

[0004] For example, Wu et al., in their paper [WU Z, LI K. Vbtree: forward secure conjunctive queries over encrypted data for cloud computing[J].The VLDB journal,2019,28(1):25-46.], designed a new tree-like data structure, VBTree, which implemented a dynamic symmetric searchable encryption scheme supporting conjunctive keyword queries. By organizing index elements into a virtual binary tree, VBTree can efficiently perform conjunctive queries on encrypted data, while avoiding the privacy leakage problem caused by directly exposing traditional tree structures to the cloud. The core innovation of this scheme lies in its ability to perform dynamic data updates, such as addition and deletion operations, in sublinear time without rebuilding the entire tree structure, thereby improving update efficiency and reducing potential security risks. Subsequently, VBTree was used as an effective data structure in many DSE schemes. However, VBTree can only ensure forward privacy and will leak document matching information, which will lead to the exposure of documents matching a certain keyword to the server, especially when processing conjunctive queries with multiple keywords. In 2024, Jin et al., in document number [JIN Z,LID,ZHANG X,et al.Research on dynamic searchable encryption method based on bloom filter[J].AppliedSciences,2024,14(8):3379.], proposed an improved Bloom filter called Authenticator Bloom Filter (ABF) and applied it to a dynamic searchable encryption scheme. This scheme can simultaneously support forward security, backward security, multi-user environments, and dynamic update functionality. However, the ABF used in the scheme requires maintaining both a bit array and a counter, thus introducing additional storage and computational overhead.

[0005] Current DSE solutions still face the risk of Keyword to Result Pattern (KPRP) leakage and cannot simultaneously meet the requirements of forward and backward security and efficiency. Summary of the Invention

[0006] To address the shortcomings of the aforementioned background technology, this invention proposes a dual-server joint keyword dynamic searchable encryption method with forward and backward security, which solves the problems of KPRP leakage and the inability to simultaneously satisfy forward and backward security and efficiency in the prior art.

[0007] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0008] A dual-server joint keyword dynamic searchable encryption method with forward and backward security, applied to a system including a data owner, data user, a first server, and a second server, includes the following steps:

[0009] Step 1: The data owner generates a key set and a dual-state array based on security parameters, extracts keyword-file identifier pairs from the database, and encrypts the file using the key to generate ciphertext;

[0010] Step 2: The data owner constructs a secure index based on a complete binary tree using the dual-state array and the keyword-file identifier pair;

[0011] Step 3: The data owner sends the dual-state array to the first server, the security index and ciphertext to the second server, and the key set to the data user;

[0012] Step 4: When an update operation is required, the data owner generates a new keyword state based on the update type, updates the dual-state array, calculates the update trapdoor, and updates the security index based on the update trapdoor;

[0013] Step 5: The data user initiates a joint keyword search query and generates a set of search trapdoors with timestamps for each query keyword based on the key set;

[0014] Step 6: The first server receives the search trapdoor set, verifies the validity of the timestamp and the consistency between the query keyword status in the search trapdoor set and the updated dual-state array;

[0015] Step 7: The second server receives the verified set of search trapdoors, traverses the current security index through a complete binary tree, and obtains the encrypted file identifier;

[0016] Step 8: The data user receives the encrypted file identifier obtained from the index, decrypts it to obtain the file identifier that matches all query keywords.

[0017] Furthermore, step 1 includes: generating a two-state array Σ based on the security parameter λ using a key generation algorithm, which is used to record the addition state st of each keyword w. add Add a counter c add and delete status st del Delete count c del Initialize the non-distinguishable cloning filter to map keyword union information; generate the key set K = {k s ,k w ,k e}, where k s Used to encrypt keyword status, kw Used to encrypt keywords, k e The dual-state array Σ, used to generate ciphertext for encrypting files, is maintained by the data owner, data user, and first server, and access is prohibited to the second server.

[0018] Furthermore, the leaf nodes of the complete binary tree store encrypted keywords and file identifiers in the form of a multi-bitmap, while the non-leaf nodes store keyword union information mapped to the non-distinguishable cloning filter.

[0019] Furthermore, the method for constructing a secure index based on a complete binary tree is as follows:

[0020] Step 21: Initialize the complete binary tree BT, and select the parameters for the leaf node index and non-leaf node index used to construct the complete binary tree;

[0021] Step 22: Traverse the non-leaf nodes of the complete binary tree, calculate the search trapdoor for each keyword in the keyword-file identifier pair based on the double state array Σ, perform non-distinguishable cloning filter mapping based on the search trapdoor, and construct the non-leaf node index.

[0022] Step 23: Traverse the leaf nodes of the complete binary tree, construct a multi-bit graph index for the leaf nodes based on the file identifier in the keyword-file identifier pair, and combine it with the index of the non-leaf nodes to obtain the safe index T.

[0023] Furthermore, the method for calculating the search trapdoor for each keyword in the keyword-file identifier pair based on the two-state array Σ is as follows: obtain the current state and update the count according to the two-state array Σ, and then use a pseudo-random function. For the keyword w i Perform calculations to obtain keyword tokens This indicates bit string concatenation. Crypto tokens as keywords As an auxiliary token; obtain the search trapdoor generation time ts i Use pseudo-random functions Encryption token for keywords Current state st add Search trapdoor generation time ts i The concatenated results are encrypted to generate a search trapdoor:

[0024] Furthermore, the method for constructing the non-leaf node index based on the search trapdoor non-distinct cloning filter mapping is as follows:

[0025] a. Calculate the two-cell location index of the non-discriminable cloning filter. (h j ) 1≤j≤kHere, k is the number of pairs of data that need to be mapped to the key, and path(n) is the hash function. i ) indicates that it is the current node n i Path in a binary tree;

[0026] b. Using hash function h k+1 The hash function H0 maps keywords to a non-distinguishable cloning filter, and the selected cell is set to 1. For the XOR operation, unselected cells are set to 0: r∈{0,1} λ ;

[0027] c. Map the keyword information stored in the non-distinguishable cloning filter to the security index; H1 is a hash function used to generate the index address of the secure index T, and IBF represents a non-distinguishable cloning filter.

[0028] Furthermore, the method for constructing a leaf node multi-bitmap index based on the file identifier in the keyword-file identifier pair is as follows:

[0029] Use hash function H2 to process auxiliary tokens and add count c add After processing, XORing the encrypted file identifier (bs) with the encrypted file identifier (bs) yields the encrypted file identifier. The encrypted file identifier is then mapped to a secure index.

[0030]

[0031] Step 2 also includes generating the state index SI:

[0032] Using hash function H3 to search for trapdoors Perform calculations to obtain the address u of the state index SI. i Using the hash function H4 to search for trapdoors After calculation, the encrypted state information e is obtained. i Address u based on state index SI i Encrypt the status information e i Mapped to the state index SI.

[0033] Furthermore, step 4, which involves generating new keyword states based on the update type and updating the dual-state array, includes:

[0034] If the update type is an add operation, generate a new add state for the added keyword using a random string, and update the double state array according to the new add state for the added keyword: replace the old add state with the new add state, increment the add count by one, and record the old add state and the old add count;

[0035] If the update type is a deletion operation, generate a new deletion state with added keywords using a random string, and update the double-state array based on the new deletion state with added keywords: replace the old deletion state with the new deletion state, increment the deletion count by one, and record the old deletion state and the old deletion count.

[0036] Furthermore, the updated trapdoor described in step 4 is as follows: t w For the encrypted token of the keyword to be added or removed, st new For newly added or deleted states during an update, ts current To update the trapdoor generation time;

[0037] In step 4, when updating the state index, it is associated with the old trapdoor to obtain the updated encrypted state information e: st old For old added or old deleted status;

[0038] In step 4, when updating the multi-bitmap index of the leaf nodes, the auxiliary token t′ of the key to be added or deleted is processed using the hash function H2. w After processing the counts before and after the update, the updated encrypted file identifier e is obtained by associating it with the file identifier bs corresponding to the keyword to be added or deleted. w :

[0039]

[0040] Here, counter is the old addition count or the old deletion count.

[0041] Furthermore, step 6 includes: obtaining the updated trapdoor generation time ts current Verify whether the timestamp accompanying the search trapdoor in step 5 is within the valid window. Use the current state index to verify if there is an added state and added count in the current dual-state array that match the search trapdoor in step 5. If any verification fails, the search for the query keyword is rejected. If the verification passes, the search trapdoor is opened. Forwarded to the second server.

[0042] The beneficial effects of this invention are:

[0043] A dual-server architecture is proposed, with server 1 responsible for storing the encrypted index and server 2 responsible for secure trapdoor verification. This prevents server 1 from directly accessing the keyword state, and a single server cannot obtain complete association information. At the same time, the trapdoor is generated based on random states without containing plaintext keywords or association identifiers, thereby improving the overall system's security and anti-attack capabilities and solving the problem of KPRP leakage.

[0044] A secure index is built based on a complete binary tree data structure. Leaf nodes store keywords and file identifiers containing those keywords in the form of a multi-bitmap index, directly outputting the combined results without exposing matching files for individual keywords. Keywords for non-leaf nodes are stored using an Indistinguishable Bloom Filter (IBF), hiding non-leaf node information and preventing the leakage of tree branches, thus enhancing privacy. This structure allows for the simultaneous retrieval of all files containing the search keyword without needing to search each file individually.

[0045] A dual-state array and timestamp factor are introduced to support secure update operations. The dual-state array records the state and update count of each keyword during addition and deletion. During addition, a new random addition state is generated; during deletion, a new random deletion state is generated. Search traps generated by data users (DUs) are verified only using the current addition state. Old traps use old addition states and cannot match newly added files, ensuring forward security. New traps cannot retrieve deleted files, ensuring backward security. The timestamp factor is used to limit the effectiveness of traps, strengthening both forward and backward security through timeliness. The combination of the dual-state array and timestamp factor effectively ensures both forward and backward security, thereby improving the overall security strength of dynamic data management.

[0046] Using a complete binary tree as the logical structure for indexing, when adding / deleting a file, only the leaf node containing the associated keyword and its ancestor non-leaf nodes need to be updated. The update operation only requires traversing h nodes, where h is the height of the tree, and the complexity is O(log|W|), where |W| is the total number of keywords, thus improving update efficiency. When performing a joint keyword search, server 2 starts from the root node, determines whether the subtree contains the current keyword, and only traverses the subtree path containing the target keyword. Each path has a length of log|W|, rather than the entire tree, achieving sublinear search time complexity. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart of a dual-server conjunctive keyword dynamic searchable encryption method (DS-CKDSE) with forward and backward security according to the present invention.

[0049] Figure 2 This is a system model diagram of the present invention.

[0050] Figure 3 This is an example diagram of a complete binary tree according to the present invention.

[0051] Figure 4 The following are examples of multi-bitmap indexes of the present invention: (a) is a multi-bitmap index, (b) is an add operation, (c) is a delete operation, and (d) is a combined keyword search.

[0052] Figure 5 This is an example diagram of the indistinguishable bloom filter (IBF) of the present invention.

[0053] Figure 6 This is an example diagram of the security index of the present invention.

[0054] Figure 7 The following is a performance comparison chart of the method proposed in this invention with other joint keyword searchable encryption schemes: (a) shows the change in update time as the number of files increases, (b) shows the change in update time as the number of keywords increases, (c) shows the change in search time as the number of files increases, and (d) shows the change in search time as the number of keywords increases.

[0055] Figure 8 This paper compares the communication overhead with the number of query keywords under a single server and the dual-server architecture of this invention. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] A dual-server joint keyword dynamic searchable encryption method with forward and backward security, such as... Figure 1 As shown, in a system including a data owner (DO), a data user (DU), a first server S1, and a second server S2, the system structure is as follows: Figure 2 As shown. The functions of each system are described below:

[0058] Data Owner (DO): To ensure the security of the file before it is uploaded to the second server S2, the data owner DO first extracts keywords from the file and initializes the two-state array Σ. These keywords are then encrypted to generate a secure index T, while the file is encrypted to form ciphertext. Finally, both the secure index T and the ciphertext are uploaded to the second server S2, and the two-state array Σ is sent to S1.

[0059] Data User (DU): The goal of an authorized data user (DU) is to retrieve a collection of documents containing the query keywords without revealing those keywords. To perform a combined keyword search, the data user (DU) constructs a search trapdoor T for the query keyword w. w Then, the search trapdoor is submitted to the first server S1 for query processing.

[0060] First server (S1): Upon receiving the search trap T from data owner DU w Then, the first server S1 uses a pre-stored two-state array Σ to verify the validity of the keywords. If the search trapdoor T... w Invalid; the first server S1 returns "reject" to data user DU. Otherwise, after confirming the search trap T... w After verifying the validity of the test, the first server S1 will search for the trapdoor T. w The message is sent to the second server S2. The first server S1 follows a semi-honest model and assumes it does not collude with the second server S2.

[0061] Second server (S2): Second server S2 is responsible for storing the encrypted database and security index T, as well as processing valid trapdoors received from first server S1. Upon receiving a valid trapdoor, second server S2 traverses the path-encoded binary tree structure to retrieve matching encrypted file identifiers. These results are then returned to data user DU, who decrypts them to obtain the target file identifier.

[0062] A dual-server joint keyword dynamic searchable encryption method with forward and backward security includes the following steps:

[0063] Step 1: The data owner (DO) generates a key set and a dual-state array based on security parameters, extracts keyword-file identifier pairs from the database, and encrypts the file using the key to generate ciphertext.

[0064] During the initialization phase, given the security parameter λ and the initial database DB, the output consists of the key set K, the state array Σ, the security index T, the state index SI, and the encrypted database EDB composed of the ciphertext.

[0065] In this embodiment, the data owner (DO) inputs a security parameter λ to control the security of the scheme. The larger λ is, the stronger the resistance to attacks. A dual-state array Σ is generated through a key generation algorithm, initially empty, to record the addition state st of each keyword w. add Add counter c add and delete status st del Delete counter c del ; An initially empty IBF, used to store non-leaf node keyword information during subsequent secure index construction; and a key set K = {k s ,k w ,k e}, where k s ←{0,1} λ Used to encrypt keyword status, k w ←{0,1} λ Used to generate ciphertext for encrypted keywords, k e ←{0,1} λ Used to generate ciphertext for encrypting files, {0,1} λ Let Σ represent the set of binary strings of length λ. The dual-state array Σ is maintained by the data owner (DO), the data user (DU), and the first server S1, while S2 is strictly prohibited from accessing the keyword state and updating the counter, thereby enhancing security.

[0066] Step 2: The data owner (DO) constructs a secure index based on a complete binary tree based on the dual-state array and the keyword-file identifier pair. The leaf nodes of the complete binary tree store encrypted keywords and file identifiers, and the non-leaf nodes store keyword union information mapped to the indistinguishable cloning filter.

[0067] To support efficient tree traversal and safe search, this scheme uses a complete binary tree. In a binary tree of height h, each non-leaf node has exactly two leaf nodes. The tree contains a total of 2... h -1 nodes, of which 2 h-1 These are leaf nodes. In the DS-CKDSE scheme of this invention, the complete binary tree is used only as a logical structure, and node elements are stored in a hash table in the form of key-value pairs (leaf node address + node encryption information). An example of a complete binary tree is shown below. Figure 3 As shown. The root node contains all the keys in the database. Each non-leaf node stores the union of the key information of its child nodes through an Indistinguishable Intercalation Filter (IBF). Each leaf node stores a key in encrypted form along with a file identifier containing that key. Using path(n i ) represents the distance from the root node to the current node n. i The string formed by connecting all the tree branches, n iThis refers to index i∈[0,2]. h The node is defined as [-2]. A complete binary tree structure uses binary path encoding: the left branch is marked as 0, and the right branch is marked as 1. This encoding ensures that the path from the root to any node n is... i The path can be uniquely represented as a binary string. The binary string path(n) i ) can be obtained from node n i It is calculated by backtracking to the root node and recording the sequence of left and right movements.

[0068] In this embodiment of the application, during the initialization phase, the data owner traverses all files in the database DU and extracts keywords from each file. i And assign a unique identifier bs to each file i For each extracted keyword w i Collect the identifiers of all files containing the keyword to form a one-to-many mapping, and obtain the keyword-file identifier pair. Where |W| represents the total number of keywords in the database DB, w i Keywords, bs i This indicates that the keyword w is included. i The file identifier corresponding to the file, where i is the keyword index.

[0069] The method for constructing a secure index based on a complete binary tree is as follows:

[0070] First, initialize the complete binary tree by selecting the parameters for the leaf node indices and non-leaf node indices used to construct the complete binary tree.

[0071] Specifically, an empty complete binary tree BT←{} is initialized as the main structure of the security index; an empty set Q←{} is initialized to record the trapdoor generation time; and a pseudo-random function is selected based on the key set K. and pseudo-random functions Used to generate keyword tokens for encrypted keywords. Used to generate a search trapdoor; Hash function selected: H0:{0,1} * →[0,1], used to probabilistically select the bit value in each double unit, H1:{0,1} * →{0,1} n The index address used to generate the secure index T, H2:{0,1} * →{0,1} a·m H3:{0,1} is used to encrypt and decrypt file identifiers. x →{0,1} y Used to generate state index addresses, H4:{0,1} x→{0,1} x Used for state encryption to ensure security during state update processes, (h j ) 1≤j≤k+1 :{0,1} * ×{0,1} λ →{0,1} s This is used to map keywords to k two-cell positions in the IBF. Here, s represents the number of two-cell positions in the IBF, x represents the number of keywords in the search query, n represents the maximum number of combined keywords supported by the scheme, a represents the number of bits in the file, m represents the number of files in the database, and y represents the number of files containing all query keywords.

[0072] Furthermore, the non-leaf nodes of the complete binary tree are traversed, and a search trapdoor is calculated for each keyword in the keyword-file identifier pair based on the double-state array Σ. Based on the search trapdoor, IBF mapping is performed to construct the non-leaf node index.

[0073] The method for calculating the search trapdoor is: obtain the current state st of the keyword. add and update count c add (st add ,c add ,-,-)←Σ[w i ]; through pseudo-random functions For the keyword w i Perform calculations to obtain keyword tokens This indicates bit string concatenation. Cryptographic tokens, used as keywords, are employed to search for the generation of trapdoors. As a secondary token, it is used by the data user (DU) for encrypting / decrypting file identifiers; and to obtain the current search trapdoor generation time ts. i Use pseudo-random functions Encryption token for keywords Current state st add Search trapdoor generation time ts i The splicing results are encrypted to generate a search trapdoor.

[0074] This invention utilizes an indistinguishable Bloom filter (IBF) to store index elements. Unlike traditional Bloom filters, IBF introduces a double-cell structure and additional hash functions to achieve indistinguishability. An IBF consists of an array B containing s double cells, each double cell containing two 1-bit cells with opposite values ​​(i.e., one cell is 0 and the other is 1). It also includes k+1 hash functions h1, h2, ..., h... k ,h k+1 And a hash function H0. The function (h... j )1≤j≤k+1 Defined as h i : H0 is defined as H0:{0,1} * →[0,1]. To insert a keyword w, k hash functions h are needed. j (w) 1≤j≤k The keyword w is mapped to k bi-unit positions in the IBF. Then, for each position, a randomization value is computed. in Then apply the hash function H0 to this value, and then... One of two 1-bit units in each double cell is probabilistically selected. The selected unit is set to 1, and the unselected unit is set to 0, ensuring that the unit selection process is probabilistic and indistinguishable. To verify the existence of a keyword in the IBF, the same hash calculation is performed, and the bits at the selected positions are checked. Only when all corresponding bits are 1 is the element considered to exist in the IBF with a high probability. Otherwise, if any bit is 0, the keyword definitely does not exist.

[0075] like Figure 5 As shown, the structure of IBF is illustrated, where the dark blue cells represent the selected cells.

[0076] The method for IBF mapping based on the search trapdoor is as follows:

[0077] Calculate IBF two-cell position index

[0078] Through hash function h k+1 The hash function H0 encrypts and maps the keywords to IBF:

[0079]

[0080] Map the keyword information stored in IBF to the secure index and record the current time:

[0081]

[0082] Q←Q∪{ts i}

[0083] Furthermore, traverse the leaf nodes of the complete binary tree, construct a multi-bitmap index for the leaf nodes based on the file identifiers in the keyword-file identifier pairs, and combine it with the index of non-leaf nodes to obtain the safe index T:

[0084] The method for constructing a multi-bitmap index for leaf nodes is as follows: Use the hash function H2 on the auxiliary tokens. and add count c add After processing, it is compared with the file identifier bs iPerform an XOR operation to obtain the encrypted file identifier, then map the encrypted file identifier to the secure index:

[0085]

[0086] The constructed security index T is as follows Figure 6 As shown, specifically, for each non-leaf node n i The keywords are mapped to IBF using a total of k+2 hash functions: {h j} 1≤j≤k+1 And H0. Each leaf node stores a keyword and a file identifier containing that keyword. During query execution, if IBF does not contain the search keyword, the corresponding subtree can be skipped, thus improving search efficiency. Each leaf node n i It represents a keyword and stores the associated file identifier in the form of a multi-bitmap index.

[0087] Constructing the State Index SI: Using the Hash Function H3 to Search for Trapdoors Perform calculations to obtain the address of the state index SI. Using hash function H4 to search for trapdoors The encryption state information is obtained after calculation. Address u based on state index SI i Encrypt the status information e i Mapped to state index SI[u i ]←e i Among them, SI[u i ] indicates the address u of the state index. i Store encrypted state information e i .

[0088] Step 3: The data owner (DO) sends the dual-state array to the first server S1, sends the security index T and the file encrypted with the key to the second server S2, and sends the key set to the data user (DU).

[0089] Step 4: When an update operation needs to be performed on a file, the data owner (DO) generates a new keyword state based on the update type, updates the dual-state array, calculates the update trapdoor, and updates the security index T based on the update trapdoor.

[0090] To improve the efficiency of joint keyword searches on encrypted databases, this invention employs an extended bitmap index structure called a multi-bitmap index. Unlike traditional bitmap indexes (where each keyword maps to a simple binary vector), the multi-bitmap index uses fixed-length bit groups (e.g., 'a' bits) to represent the existence of files. This means that each keyword corresponds to an 'a'-bit string, indicating which files contain that keyword. Assuming the system supports a maximum of m files, each keyword is represented by a bit string of total length a·m. If file f... i If a specific keyword is contained (where 0 ≤ i ≤ m-1), then the bit at position i·a is set to 1, and the subsequent a-1 bits (from position i·a+1 to i·a+a-1) are set to 0. Consider a database containing three files (denoted as f0, f1, and f2), where each file is represented using a 3-bit group (i.e., a = 3). Figure 4 This demonstrates the module 2 in this solution. 9 The modular addition process includes file addition and deletion operations. Figure 4 (a) indicates that files f0 and f2 contain the keyword, file f1 contains w1, and file f2 contains w2. Figure 4 (b) demonstrates adding a file to the system using a modular addition operation. Figure 4 (c) illustrates the process of deleting a file from the system. (d) shows the combined keyword search corresponding to keywords w0, w1, and w2. Bits 6 and 7 are both 1, indicating that the file contains all the query keywords. Figure 4 (b), (c), and (d) are merely examples and are not related to... Figure 4 (a) indicates that the multi-bitmap indexes for each keyword are different.

[0091] When a user initiates a combined keyword search, the server retrieves the multi-bitmap index corresponding to each query keyword. After obtaining the relevant bit strings, the server performs modulo addition on these bit strings and returns the resulting bit vector to the user. If the bits from position i·a to i·a+1 in the resulting bit vector are "11", and if there are multiple keywords, it can be expanded to the binary representation of the resulting bit vector equal to the total number of query keywords k, then it means that the file contains all query keywords; otherwise, the file will be excluded from the final result set.

[0092] During the data update phase, the data owner interacts with the server. The data owner inputs a state array Σ, an operation type op∈{add,del} (where add represents inserting a file into the system and del represents removing a file from the system), a keyword w, a file identifier bs, and a security index T. The algorithm outputs an update trapdoor v. w And send it to the server. The server updates the trapdoor v. wGiven the security index T as input, run the algorithm and output the updated state array Σ′ and the updated security index T′.

[0093] Specifically, in this embodiment, firstly, the parameters for updating the leaf node index and non-leaf node index of the complete binary tree are selected, except for recording the time of trapdoor generation, which are the same as the parameters used during construction.

[0094] Furthermore, based on the update type, generate new keyword states and update the two-state array:

[0095] If the update type is an add operation, generate the add status of the current keyword using a random string:

[0096] st new ←{0,1} λ ;

[0097] Based on the current keyword addition status st new Update the two-state array:

[0098] (st add ,c add ,st del ,c del )←Σ[w];

[0099] (st new ,c add +1,st del ,c del )←Σ'[w];

[0100] counter = c add ;

[0101] st old =st add ;

[0102] If the update type is a deletion operation, generate the deletion status of the current keyword using a random string:

[0103] st new ←{0,1} λ ;

[0104] Based on the current keyword addition status st new Update the two-state array:

[0105] (st add ,c add ,st del ,c del )←Σ[w];

[0106] (st add ,c add ,stnew ,c del +1)←Σ'[w];

[0107] counter = c del ;

[0108] st old =st add .

[0109] st old This indicates whether the status is old (added or deleted), and `counter` represents the old addition or deletion count.

[0110] Furthermore, updating the trapdoor only uses the current valid keyword state st new This randomization mechanism ensures that updated and historical search trapdoors are independent, effectively preventing information leakage and ensuring forward and backward security during the update process.

[0111] The method for calculating and updating the trapdoor based on the new state of the keywords is as follows: using a pseudo-random function. Calculate and obtain keyword tokens for the keyword w to be added or deleted. t w Cryptographic tokens, serving as keywords to be added or removed, are used to update the generation of trapdoors. w As a secondary token, it is used by the data user (DU) to encrypt / decrypt the file identifier corresponding to the keyword to be added or deleted; and to obtain the current update trapdoor generation time ts. current Using pseudo-random functions Encryption token t for keywords to be added or deleted w Current state st new Update trapdoor generation time ts current The splicing results are encrypted to generate an updated trapdoor.

[0112] Furthermore, the method for updating the trapdoor state index SI' and the security index T' is as follows:

[0113] Update the state index: Update the trapdoor v using hash function H3. w Perform calculations to obtain the address u of the state index SI':

[0114] u←H3(v w );

[0115] Update trapdoor v using hash function H4 w After the calculation, the result is XORed with the old trapdoor to obtain the encrypted state information e:

[0116]

[0117] The encrypted state information e is mapped to the state index SI' based on the address u of the state index SI':

[0118] SI'[u]←e;

[0119] Only those with new trapdoors v w Only then can H4(v) be calculated. w Only then can the "old trapdoor" be recovered from the encrypted state information 'e' through another XOR operation. This ensures that during the update process, the server cannot directly know the old or new trapdoor, but can still perform the update operation.

[0120] Methods for updating the security index T:

[0121] First, traverse the non-leaf nodes of the complete binary tree. For each keyword to be added or deleted, calculate the update trapdoor. Based on the update trapdoor, perform IBF mapping to construct the non-leaf node index.

[0122] Calculate the IBF two-cell location index R to be updated v =(h j (path(n i ),v w )), (h j ) 1≤j≤k ;

[0123] Through hash function h k+1 The hash function H0 cryptographically maps the keywords to be added or deleted to the IBF to be updated:

[0124]

[0125] Map the keyword information to be added or deleted stored in the IBF to the new security index:

[0126] u w ←H1(path(n i ),v w );

[0127] T'[u w ]←IBF;

[0128] Among them, T'[u w ]←IBF indicates the address u of the safe index. w The updated IBF mapping information is stored there.

[0129] Furthermore, traverse the complete binary tree leaf nodes, update the leaf node multi-bitmap index, and update the safe index T by combining the non-leaf node indexes:

[0130] The method for updating the multi-bitmap index of leaf nodes is as follows: Use the hash function H2 to update the auxiliary token t′ respectively. w After processing the counts before and after the update, XORing them with the file identifier bs yields the updated encrypted file identifier e. w Ensure the secure association between the old and new file identifiers:

[0131]

[0132] Map the updated encrypted file identifier to the security index T':

[0133] T'[u w ]←e w .

[0134] Among them, T'[u w ]←e w This indicates the address u of the secure index. w The location stores the updated encrypted file identifier e. w .

[0135] Step 5: The data user (DU) initiates a joint keyword search query and generates a set of search trapdoors with timestamps for each query keyword based on the key set.

[0136] During the search phase, a dual-server architecture is used, where data users interact with the servers. Data users input keywords w, timestamps, and the current state array Σ, which then generates a search trapdoor T. w The data is then transmitted to the server. The server executes a query on the current secure index and returns the corresponding encrypted result, esum, which the user can decrypt to obtain the identifier of the matching file.

[0137] Let q represent a combined keyword search query initiated by a data user (DU). When a data user (DU) initiates a combined keyword search on an encrypted database EDB, this invention generates a time-limited search trapdoor for each query keyword. These trapdoors are then aggregated into a set and sent to a first server S1 for verification.

[0138] Specifically, in this embodiment, empty sets Q2→{} and Q1→{} are first initialized. Q1 is used to store search trapdoors for query keywords, and Q2 is used to store auxiliary information needed by the user for decryption.

[0139] For each query keyword w s ∈q, retrieve its current state and update count:

[0140] (st add ,c add ,st del ,c del )←Σ[wi ];

[0141] Through pseudo-random functions For each query keyword w i Perform calculations to obtain keyword tokens The encrypted token, used as a query keyword, is used to generate the search trapdoor. As a secondary token, it is used by the data user (DU) for encrypting / decrypting the file identifier corresponding to the keyword to be added or deleted; a timestamp ts is selected from the set Q. i Using pseudo-random functions Encryption token for query keywords Current added status st add Time ts i The splicing results are encrypted to generate a search trapdoor. Add the search trap for each query keyword to the collection. Storage of auxiliary information required for decryption Send set Q1 to the first server S1.

[0142] Step 6: The first server S1 receives the search trapdoor set, verifies the validity of the timestamp and the consistency between the query keyword status in the search trapdoor set and the updated dual-state array.

[0143] Upon receiving a search trapdoor, the first server S1 uses a stored double-state array to check the status of each keyword and verifies whether the relevant timestamp falls within a valid time window. If the verification is successful, the first server S1 forwards the verified search trapdoor to the second server S2, which is responsible for index traversal.

[0144] Specifically, in this embodiment of the application, the steps include: obtaining the updated trapdoor generation time ts current Verify the trapdoor generation time ts i Is it within a valid window? | ts current -ts i If |≤Δ, verify whether there is a matching trapdoor in the current two-state array using the current state index. Add st to match add and add count c add If any validation fails, the query will be rejected for the keyword "w". i If the search is successful, the search trap will be opened. Forwarded to the second server S2.

[0145] Step 7: The second server S2 receives the verified set of search trapdoors, updates the security index by traversing a complete binary tree based on the encrypted query keywords, verifies the existence of keywords by using the updated non-distinguishable cloning filter during the traversal, and obtains the encrypted file identifier by combining the multi-bitmap index.

[0146] The second server S2 traverses a complete binary tree index, where information from each non-leaf node is mapped to an IBF (Integrated Tree Framework) to determine if its subtree contains all query keywords. The function `ContainsKey` is used to check if a keyword exists at a given node. When the path length is h-1, indicating that the search has reached a leaf node, the second server S2 retrieves encrypted file identifiers that match the joint search. The set of encrypted file identifiers, `esum`, is then returned to the data user (DU).

[0147] Specifically, in this embodiment of the application, the ContainsKey function is used to verify each search trapdoor. Check if a complete binary tree contains elements that are defined as follows: Nodes with keys:

[0148] if If an error occurs, return "not found"; otherwise, continue traversing the complete binary tree until the encrypted file identifier is found. will with The encrypted file identifiers with keys are XORed into the set esum, and the set esum is returned to the data user (DU).

[0149] Step 8: The data user (DU) receives the encrypted file identifier obtained from the index, and decrypts the file identifier based on the key set to obtain the required file.

[0150] Specifically, in this embodiment of the application, the data user (DU) accesses the set Q2 through... XOR with the set esum to recover the set of file union identifiers: `sum` is a file identifier that includes multiple query keywords in a combined keyword search query `q`.

[0151] The experimental analysis of this application is as follows:

[0152] Correctness Analysis: The correctness of the DS-CKDSE scheme proposed in this invention is demonstrated in the following two cases:

[0153] Case 1: Valid search trapdoor: If the timestamp ts of the trapdoor satisfies |ts current -ts|≤Δ, and its state st add and update counter c addA match with what is stored in Σ means the trapdoor is valid. For each keyword and file stored in the leaf nodes, the invention can encrypt the file identifier as:

[0154]

[0155] And send it to the data user (DU). Upon receiving it, the data user calculates:

[0156]

[0157] It then restores the file identifier. Therefore, the scheme returns the correct result and outputs True.

[0158] Case 2, Invalid Search Trapdoor: If the timestamp ts of the trapdoor satisfies |ts current -ts|>Δ, or the current state st in Σ is changed due to the update. add The state has changed and is inconsistent with the state in Σ, meaning the trapdoor is invalid. At this point, server S1 rejects the trapdoor, and server S2 cannot retrieve a valid encrypted identifier. Therefore, the search operation fails, and the system outputs a failure symbol ⊥.

[0159] Adaptive safety:

[0160] Theorem 1. This invention uses a leakage function. To indicate the leaked information of the solution. If and If it is a secure pseudo-random function, then the DS-CKDSE scheme of this invention has the following leakage function defined. yes - Adaptive and safe.

[0161]

[0162] The search pattern sp(w) = {i | (i, w) ∈ Q} indicates that the keyword w was searched in the i-th query, and path(w) is the path from the root node to the updated node.

[0163] Proof of Theorem 1: This invention proves Theorem 1 through a series of game sequences, which are derived from real-world games. Transition to the ideal game By constructing a game sequence, this invention ultimately proves that real games and ideal games are computationally indistinguishable, thus completing the proof of Theorem 1.

[0164] Game G0: This game is equivalent to a real game.

[0165] Game G1: In G1, this invention uses a true random function instead of a pseudo-random function. In real games, pseudo-random functions... Used to generate encrypted keywords t w and token t′ w pseudo-random function Used to generate As an update trapdoor, G1 uses a mapping table T to store the trapdoor value for each keyword w, compared to G0. and keyword token t′ w When the search algorithm needs to generate When it is ready, it first checks if an entry for w already exists in the mapping table T. If it exists, it returns the corresponding value in T; otherwise, it retrieves the value from {0,1}. λ A random value is generated and recorded in T. If the adversary queries the same keyword w, G1 returns the same random value recorded in T; otherwise, a new random value is generated and recorded. Since pseudo-random functions and true random functions are computationally indistinguishable, the difference is negligible. Therefore, the present invention has: |Pr[G1=1]-Pr[G0=1]|≤negl(λ).

[0166] Game G2: Compared to G1, in G2, this invention replaces the hash functions H1, H2, H3, and H4 with random oracles. A table L is created to record the random values ​​u generated during update operations. If an adversary queries a random oracle for an input that is not defined in an update or search operation, the oracle returns a uniformly random string, and this mapping is recorded in L. If the adversary successfully guesses the correct input (i.e., a "Bad" event occurs), the probability is bounded to 2. -λ Furthermore, since the pseudo-random function and other components of the scheme may introduce negligible advantages, this invention denotes them as negl(λ). Therefore, the probability that an adversary correctly guesses a specific valid input in a single query is at most 2-1. -λ +negl(λ). An adversary operating in polynomial time. At most, poly(λ) queries can be made to the random oracle. Therefore, the probability of the "Bad" event occurring is bounded by: Pr[Bad] ≤ poly(λ)·2 -λ +negl(λ), due to poly(λ)2 -λ Both `negl(λ)` and `negl(λ)` are negligible functions of `λ`, and the probability `Pr[Bad]` itself is also negligible. Only when a "Bad" event occurs can an adversary observe the difference between the random oracle response in G2 and the behavior of the true hash function in G1. Given that `Pr[Bad]` is negligible, from the adversary's perspective, the difference in the output distributions of the two games is negligible. Therefore:

[0167] |Pr[G2=1]-Pr[G1=1]|≤Pr[Bad]≤negl(λ).

[0168] Game G3: The difference between G3 and G2 lies in the randomization of the IBF bit positions. For each keyword, the bit positions in the IBF are randomly generated, with each unit mapped by k+2 hash functions. Under the random oracle model, the encoded values ​​of these units are computationally indistinguishable from uniformly random strings, making it difficult for adversaries to detect. It is impossible to distinguish between real encoded bits and random bits. Therefore, based on the indistinguishability between IBF random strings and simulated random oracles, this invention has:

[0169] |Pr[G3=1]-Pr[G2=1]|≤negl(λ).

[0170] Game G4: In this game, realistic trapdoors and status values ​​are replaced with simulated values. Specifically, all st add and st del All instances are replaced with independent random strings. The timestamp verification logic in this game relies solely on the parameter Δ of the leak function. The simulator can directly verify the timestamp based on the leak. The validity of the trapdoor is determined by the effective time window Δ included in the calculation, without revealing any actual timestamp information. Therefore, the present invention has:

[0171] |Pr[G4=1]-Pr[G3=1]|≤negl(λ).

[0172] Game G5: In this game, the emulator generates a random file identifier bs′←{0,1} for each file. λ Instead of using the actual file identifier bs, the encryption format is set as follows:

[0173]

[0174] Because the original bs is completely masked by the pseudo-random function PRF, and the generated e w Computationally indistinguishable from a uniformly random string, this change is undetectable to an adversary. Therefore, the present invention has:

[0175] |Pr[G5=1]-Pr[G4=1]|≤negl(λ).

[0176] Game G6 (Ideal Game): In this game, the entire system output has been replaced with simulated data. All search trapdoors T w The two-state array Σ and the encrypted file identifier bs are replaced with random strings generated by the simulator. The simulator is based solely on the leak function. Proceed with the response. Since all values ​​(keywords, states, and timestamps) are simulated consistently with the defined leak, the adversary's view is computationally indistinguishable from the view in game G5. Therefore: |Pr[G6=1]-Pr[G5=1]|≤negl(λ).

[0177] By summing the indistinguishability limits of all game transitions, this invention achieves an overall security guarantee:

[0178]

[0179] Forward and backward safety:

[0180] Theorem 2. Let Let be the leakage function defined in Theorem 1. The update leakage function is defined as:

[0181]

[0182] The proposed method satisfies - When using adaptive security combined keyword search conditions, both forward security and backward security can be guaranteed simultaneously.

[0183] Proof of Theorem 2: Forward Safety: Forward safety guarantees that previously generated trapdoors cannot be used to search newly added files. Each keyword w is associated with a two-state array Σ = (st add ,c add ,st del ,c del For file append operations, the data owner generates a random string as the new status st. new To replace the previous state. The updated trapdoor calculation is as follows: The new state is completely independent of the previous state, ensuring complete randomness and confidentiality. An adversary cannot computationally associate the new state with the old one. Therefore, search trapdoors generated before the state update cannot match newly added files, thus ensuring forward security.

[0184] Backward security: Backward security ensures that after a document containing the keyword is deleted, even if an adversary retains previous search traps, the deleted document cannot be retrieved through future searches. This solution ensures backward security through the following two mechanisms.

[0185] Timestamp constraints in trapdoor verification: For each search trapdoor T w Each includes a timestamp `ts` to restrict its validity. During verification, the server checks the timestamp condition: |ts current -ts|≤Δ. This constraint ensures that the trapdoor is only valid within a finite time window Δ, preventing old trapdoors from being reused to retrieve deleted files.

[0186] Deletion State Integration: The DS-CKDSE scheme utilizes a two-state array Σ=(st add ,c add ,st del ,c del Explicitly track the addition and deletion status of each keyword. When a document containing "w" is deleted, the data owner generates a new random deletion status "st". new ∈{0,1} λ And increment the counter c del Future trapdoors will only use the active added state st add The state of the deleted file is unaffected by its state. This separation prevents the server from inferring the original content of the deleted file, ensuring that an adversary cannot recover the deleted file through future queries.

[0187] Therefore, the DS-CKDSE scheme guarantees both forward and backward security.

[0188] Keyword privacy in results schema:

[0189] To demonstrate that the proposed scheme can effectively prevent KPRP leakage, this invention compares it with the ODXT scheme, reference number [PATRANABIS S, MUKHOPADHYAY D. Forward and backward private conjunctive searchable symmetric encryption[J / OL]. Cryptology ePrint Archive, 2020, 2020(1100).

[0190] A comparison was made at [https: / / eprint.iacr.org / 2020 / 1100.]. KPRP leakage refers to the fact that a semi-honest server can obtain partial intersection results of individual keyword pairs during a union query, which may allow attackers to infer the underlying query structure by repeated observations.

[0191] This invention demonstrates an improvement in privacy protection through a specific example. Consider a database storing five encrypted files and their associated keywords, as shown in Table 1.

[0192] Table 1: Documents and Related Keywords

[0193]

[0194] Suppose a user issues a union query q = (w1∧w2∧w3), and the corresponding document set is DB(w3) = {f1, f4}, where DB(w3) represents the set of files in database DB that contain the keyword w3. The server then checks whether these files contain both w1 and w2.

[0195] In the ODXT scheme: the server can obtain partial intersection results, for example:

[0196] DB(w1)∩DB(w2)={f1,f3}, DB(w1)∩DB(w3)={f1}.

[0197] Therefore, although the final intersection result is {f1}, the server obtains additional information about the intermediate keyword relationship, leading to a KPRP leak.

[0198] In the scheme of this invention, the trapdoor structure employs randomized states and timestamp factors to prevent the server from obtaining the matching results of any intermediate keyword pairs. The server can only know the result of the final joint query q, DB(q) = {f1}, and cannot observe the results of DB(w1)∩DB(w2) or DB(w1)∩DB(w3). Therefore, the DS-CKDSE scheme of this invention eliminates KPRP leakage.

[0199] Performance Analysis: This invention evaluates the performance of the DS-CKDSE scheme by comparing it with existing representative DSE schemes. As shown in Table 2, this invention compares its scheme with existing schemes in several aspects. The comparison includes dynamic update efficiency, search efficiency, forward and backward security, and KPRP privacy. Compared with these schemes, only the scheme of this invention meets all functional requirements. The experiment is implemented in Java. Experimental Platform Configuration The system features a Core™ i5-13600kf processor, 16GB of RAM, and Windows 11 operating system. The Enron email dataset was used as experimental data for testing.

[0200] Table 2: Joint Keyword Scheme

[0201]

[0202] Note: y represents the number of files containing all query keywords, |W| represents the total number of keywords in the database, and x represents the number of search keywords in the query. Typically, x ≤ y ≤ |W|.

[0203] Update efficiency: In terms of update efficiency, the proposed scheme was compared with other joint keyword searchable encryption schemes (such as ESP-CKS and VBtree). Figure 7(a) shows how update time changes with the number of files. The results indicate that the update time of DS-CKDSE increases relatively smoothly with the number of files, without a significant increase. This is attributed to the fact that multi-bitmap indexing supports batch processing of multiple files, thereby reducing redundant operations on individual files. Therefore, DS-CKDSE achieves better update efficiency and more stable performance when processing a large number of files. Figure 7 (b) shows how update time changes with the number of search keywords. The experimental results show that update time is linearly related to the number of keywords. This is because the height h of the binary tree increases with the number of keywords. Therefore, to maintain high update performance, the number of keywords must be reasonably controlled.

[0204] Search efficiency: Regarding search efficiency, experimental results show that the search time of DS-CKDSE is independent of the number of files, such as... Figure 7 As shown in (c). This is because DS-CKDSE builds a secure index based on a complete binary tree; the search process depends only on the path of the keywords, and the search process does not need to traverse all files. The search time increases linearly with the number of query keywords, such as... Figure 7 As shown in (d), the height of the secure index depends only on the number of keywords. Compared to the BVBTree scheme, DS-CKDSE achieves more consistent search performance when handling large sets of documents. This is because the height of the tree is affected only by the number of keywords, and not by the total number of documents.

[0205] Comparison of communication overhead between single-server and dual-server architectures: Figure 8 As shown, the communication load (in bytes) during search operations is compared between a dual-server scheme and a single-server scheme when the number of query keywords differs. The scheme proposed by Liu et al. (document number [LIU Y, XIAO X, KONG F, et al. Towards efficient privacy-preserving conjunctive keywords search over encrypted cloud data[J]. FutureGeneration Computer Systems, 2025, 166:107716]) uses a single-server architecture, where communication primarily occurs between the data owner and the server. In contrast, the scheme of this invention is based on a dual-server architecture, with communication occurring between DU and S1, S1 and S2, and S2 and DU. The DS-CKDSE scheme also employs a dual-server architecture. While this design introduces additional communication load, its key advantage lies in separating index storage and trapdoor verification between the two servers (S1 and S2). This separation effectively resists KPRP leakage.

[0206] The proposed DS-CKDSE scheme achieves both forward and backward security in a dual-server architecture. By integrating a complete binary tree structure, an indistinguishable interleaving filter (IBF), and a multi-bitmap index, DS-CKDSE enables privacy-preserving joint keyword search. The dual-server architecture separates trapdoor verification from index storage, thus preventing Keyword Pattern Recovery (KPRP) attacks from leaking the target keyword. Furthermore, dual state arrays and a timestamp mechanism jointly ensure both forward and backward security. Through a series of game proofs, this invention demonstrates that the scheme achieves security within the defined leakage function. The following satisfies - Adaptive safety. Experimental results show that this scheme maintains high efficiency in both update and search operations.

[0207] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dual-server joint keyword dynamic searchable encryption method with forward and backward security, characterized in that, Applied to systems including data owners, data users, a first server, and a second server, the steps include: Step 1: The data owner generates a key set and a dual-state array based on security parameters, extracts keyword-file identifier pairs from the database, and encrypts the file using the key to generate ciphertext; Step 2: The data owner constructs a secure index based on a complete binary tree using the dual-state array and the keyword-file identifier pair; Step 3: The data owner sends the dual-state array to the first server, the security index and ciphertext to the second server, and the key set to the data user; Step 4: When an update operation is required, the data owner generates a new keyword state based on the update type, updates the dual-state array, calculates the update trapdoor, and updates the security index based on the update trapdoor; Step 5: The data user initiates a joint keyword search query and generates a set of search trapdoors with timestamps for each query keyword based on the key set; Step 6: The first server receives the search trapdoor set, verifies the validity of the timestamp and the consistency between the query keyword status in the search trapdoor set and the updated dual-state array; Step 7: The second server receives the verified set of search trapdoors, traverses the current security index through a complete binary tree, and obtains the encrypted file identifier; Step 8: The data user receives the encrypted file identifier obtained from the index, decrypts it to obtain the file identifier that matches all query keywords.

2. The dual-server joint keyword dynamic searchable encryption method with forward and backward security as described in claim 1, characterized in that, Step 1 includes: based on security parameters A two-state array is generated using a key generation algorithm. Used to record each keyword Adding status Add a counter and deletion status Deletion count Initialize the non-distinguishable cloning filter to map keyword union information; generate the key set. ,in, Used to encrypt keyword status. Used to encrypt keywords, The dual-state array is used to generate ciphertext for encrypting files. It is maintained by the data owner, data user, and the first server, and access by the second server is prohibited.

3. The dual-server joint keyword dynamic searchable encryption method with forward and backward security as described in claim 1, characterized in that, The leaf nodes of the complete binary tree store encrypted keywords and file identifiers in the form of a multi-bitmap, while the non-leaf nodes store keyword union information mapped to the non-distinguishable cloning filter.

4. The dual-server joint keyword dynamic searchable encryption method with forward and backward security according to any one of claims 1-3, characterized in that, The method for constructing a secure index based on a complete binary tree is as follows: Step 21: Initialize the complete binary tree Choose the parameters for the leaf node indexes and non-leaf node indexes used to construct the complete binary tree; Step 22: Traverse the non-leaf nodes of the complete binary tree using a two-state array. For each keyword in the keyword-document identifier pair, calculate the search trapdoor, perform non-distinguishable cloning filter mapping based on the search trapdoor, and construct the non-leaf node index. Step 23: Traverse the leaf nodes of the complete binary tree, construct a multi-bit graph index for the leaf nodes based on the file identifier in the keyword-file identifier pair, and combine it with the index of the non-leaf nodes to obtain the safe index T.

5. The dual-server joint keyword dynamic searchable encryption method with forward and backward security as described in claim 4, characterized in that, Based on dual-state array The method for calculating the search trapdoor for each keyword in the keyword-document identifier pair is as follows: Based on the two-state array Obtain the current state and update the count using a pseudo-random function. Keywords Perform calculations to obtain keyword tokens , || indicates bit string concatenation. Crypto tokens as keywords As a secondary token; Get the time of trapdoor generation Use pseudo-random functions Encryption token for keywords Current status Search trapdoor generation time The concatenated results are encrypted to generate a search trapdoor: .

6. The dual-server joint keyword dynamic searchable encryption method with forward and backward security according to claim 5, characterized in that, The method for constructing a non-leaf node index based on a search trapdoor-based non-distinct cloning filter mapping is as follows: a. Calculate the two-cell location index of the non-discriminable cloning filter. , Here, k is the hash function, and k is the number of pairs of cells that the key needs to be mapped to. This indicates the current node. Path in a binary tree; b. Using a hash function and hash function Map keywords to the non-distinguishable cloning filter, and set the selected cell to 1: , For the XOR operation, unselected cells are set to 0: , ; c. Map the keyword information stored in the non-distinguishable cloning filter to the security index; , Here is a hash function used to generate the index address of the secure index T. This indicates a non-distinguishable cyclone filter.

7. The dual-server joint keyword dynamic searchable encryption method with forward and backward security as described in claim 6, characterized in that, The method for constructing a leaf node multi-bitmap index based on the file identifier in the keyword-file identifier pair is as follows: Using hash functions For auxiliary tokens and add count After processing, XORing the encrypted file identifier (bs) with the encrypted file identifier (bs) yields the encrypted file identifier. The encrypted file identifier is then mapped to a secure index. ； Step 2 also includes generating the state index SI: Using hash functions Search trapdoor Perform calculations to obtain the address of the state index SI. Using hash functions Search trapdoor The encryption state information is obtained after calculation. Address based on state index SI Encrypt status information Mapped to the state index SI.

8. The dual-server joint keyword dynamic searchable encryption method with forward and backward security according to any one of claims 1-3 and 5-7, characterized in that, Step 4, which generates new keyword states based on the update type and updates the two-state array, includes: If the update type is an add operation, generate a new add state for the added keyword using a random string, and update the double state array according to the new add state for the added keyword: replace the old add state with the new add state, increment the add count by one, and record the old add state and the old add count; If the update type is a deletion operation, generate a new deletion state with added keywords using a random string, and update the double-state array based on the new deletion state with added keywords: replace the old deletion state with the new deletion state, increment the deletion count by one, and record the old deletion state and the old deletion count.

9. The dual-server joint keyword dynamic searchable encryption method with forward and backward security according to claim 5, characterized in that, The updated trapdoor mentioned in step 4 is: , An encrypted token for the keyword to be added or removed. This refers to the newly added or newly deleted status during the update. To update the trapdoor generation time; In step 4, when updating the state index, it is associated with the old trapdoor to obtain the updated encrypted state information. : , For old added or old deleted status; In step 4, when updating the multi-bitmap index of the leaf nodes, hash functions are used respectively. Auxiliary tokens for adding or deleting keywords After processing the counts before and after the update, the updated encrypted file identifier is obtained by associating it with the file identifier bs corresponding to the keyword to be added or deleted. : ； in, Add a count to the old count or delete a count from the old count.

10. The dual-server joint keyword dynamic searchable encryption method with forward and backward security according to claim 9, characterized in that, Step 6 includes: obtaining the updated trapdoor generation time. Verify whether the timestamp accompanying the search trapdoor in step 5 is within the valid window. Use the current state index to verify if there is an added state and added count in the current dual-state array that match the search trapdoor in step 5. If any verification fails, the search for the query keyword is rejected. If the verification passes, the search trapdoor is opened. Forwarded to the second server.

Images