Searchable encryption method and device based on sm4 algorithm

Abstract

The invention discloses a searchable encryption method and device based on an sm4 algorithm, and the method comprises the following steps: a secret key generation step: a data owner generates two secret keys s1 and s2 corresponding to the SM4 algorithm based on preset security parameters, s1 and s2 belong to {0, 1} k, k is the length of the secret key, and s1 and s2 serve as encryption operation basic secret keys of the SM4 algorithm; through innovative fusion of the SM4 algorithm and the searchable encryption technology, the technical breakthrough of efficient retrieval, low resource consumption and strong adaptability is realized on the premise of ensuring the security and privacy of cloud data, the core contradiction that security and efficiency are difficult to consider in the prior art is solved, and the security and privacy of the cloud data are ensured. The method can be widely applied to scenes with high requirements on data security and retrieval efficiency, such as personal cloud storage, enterprise-level document management, medical data sharing and the like, and has extremely high commercial value and application prospect.

Description

Technical Field

[0001] This invention relates to the field of cloud storage technology, and in particular to a searchable encryption method and device based on the sm4 algorithm. Background Technology

[0002] With the rapid development of information technology, cloud computing, with its advantages of large-scale storage, elastic expansion, and low-cost operation and maintenance, has become the mainstream choice for personal and enterprise data storage, and the popularization of cloud storage services has greatly improved the convenience of data management. However, in the process of data storage and sharing in the cloud, the contradiction between security and ease of use has become increasingly prominent, becoming a core bottleneck restricting the further promotion of cloud storage.

[0003] From a data security perspective, cloud servers, as data storage carriers, present two key security risks: First, cloud servers may exhibit "semi-honest" or "curious" characteristics, meaning that while server operators may not actively tamper with data, they may attempt to infer user privacy by analyzing stored data streams and access records. Even worse, some cloud servers may engage in malicious activities, stealing user data through unauthorized technical means. Second, because cloud servers store massive amounts of user data, they naturally become primary targets for cyberattacks. External attackers can illegally obtain data through vulnerability exploitation and brute-force attacks, leading to the leakage of sensitive information such as user personal information and corporate trade secrets. To address these risks, the current mainstream solution is for users to encrypt their data locally before uploading the encrypted data to the cloud server, ensuring data security during transmission and storage through "ciphertext storage."

[0004] While encrypted storage solves the data security problem, it introduces a new challenge: low retrieval efficiency. Because encryption algorithms destroy the original structure and content coherence of plaintext data, traditional plaintext retrieval techniques (such as keyword-based fast matching) cannot be directly applied to encrypted data. Currently, for legitimate users to retrieve encrypted data from the cloud, the following steps are typically required: first, download the entire encrypted document set stored in the cloud to their local machine; then, use a local decryption tool to restore the ciphertext to plaintext; and finally, perform a keyword search on the plaintext documents. This process has significant drawbacks: first, it incurs high communication overhead, as downloading large-scale document sets requires substantial network bandwidth and is time-consuming; second, it incurs enormous computational costs, as local decryption and plaintext retrieval consume significant computing power from the terminal device. Especially for enterprise-level massive datasets (such as hundreds of thousands or even millions of documents), the retrieval process often takes hours or even longer, severely impacting the user experience.

[0005] To address the challenge of encrypted data retrieval, searchable encryption (SE) technology has emerged, with its core objective being to achieve efficient keyword retrieval of encrypted data in the cloud without revealing the plaintext data. However, existing searchable encryption technologies still have many shortcomings and struggle to meet the needs of practical applications:

[0006] 1. Insufficient Security: Most existing solutions can only defend against basic information leakage attacks. Under the IND1-CKA (Indistinguishability against Selective Keyword Attacks) model, it is difficult to guarantee the privacy of encrypted indexes and the retrieval process. Furthermore, they are weakly defended against inference attacks (attackers infer user keywords by collecting statistical data on user searches and the number of documents returned as results) and file injection attacks (attackers inject forged encrypted documents to interfere with search results). For example, existing solutions typically employ complex redundant data padding strategies to resist inference attacks, leading to a significant increase in storage and communication overhead and a substantial decrease in overall efficiency.

[0007] 2. Computational and Adaptability Deficiencies: Most mainstream searchable encryption schemes rely on public-key cryptography algorithms (such as RSA and ECC) to implement retrieval functions. However, public-key cryptography algorithms suffer from high computational complexity and long processing time, making them difficult to adapt to real-time retrieval scenarios for large-scale data. In addition, some schemes use encryption algorithms (such as asymmetric block ciphers) that do not match the underlying requirements of symmetric searchable encryption, resulting in low encryption efficiency and complex key management.

[0008] 3. Insufficient practicality: Existing solutions generally lack "non-interactive backward security," meaning that data users and owners need to interact frequently to complete retrieval authorization, and the security of historical retrieval records is difficult to guarantee when the key is updated. At the same time, some encryption schemes adopt deterministic encryption modes in pursuit of security, where the same plaintext generates fixed ciphertext under the same key. Attackers can infer the correlation between plaintexts by comparing ciphertexts, further threatening data privacy.

[0009] In summary, existing cloud storage data encryption and retrieval technologies have not yet been able to simultaneously achieve a balance between "high security, high retrieval efficiency, and strong adaptability." There is an urgent need for a new technical solution to resolve the contradiction between data security and efficient retrieval in cloud storage, and to meet the core needs of individuals and enterprises for cloud data management. Summary of the Invention

[0010] In order to overcome the shortcomings of the prior art, one of the objectives of this invention is to provide a searchable encryption method and device based on the sm4 algorithm.

[0011] One of the objectives of this invention is achieved through the following technical solution:

[0012] A searchable encryption method based on the SM4 algorithm includes the following steps:

[0013] Key generation steps: The data owner generates two keys, s1 and s2, corresponding to the SM4 algorithm based on preset security parameters, where s1, s2 ∈ {0, 1}. k k is the key length, and s1 and s2 are both used as the basic keys for encryption operations in the SM4 algorithm;

[0014] Index building steps: The data owner builds a secure inverted index and completes encryption, specifically including:

[0015] Document preprocessing sub-step: Scan the target dataset C and extract keywords contained in all documents in dataset C, forming a keyword set W = (w1, w2, ..., w...). m (m is the total number of keywords); for each keyword w i ∈W (1≤i≤m), construct a string containing the keyword w. i The document set F(w) i ), F(w i Each document in the document corresponds to a unique document identifier;

[0016] Inverted index construction sub-steps: Using the keyword set W as a term dictionary, construct the inverted index I; for each keyword w i Create the corresponding inverted index table I(w) i ), F(w i Document identifiers for all documents in ) <id(F ij )>(1≤j≤|F(w i )|),|F(w i )| is F(w i The number of documents in each document is stored sequentially in I(w) i );

[0017] The index encryption sub-step involves encrypting the inverted index I, specifically by using a pseudo-random permutation function based on key s1 for all 1 ≤ i ≤ m. Processing keywords w i ,get and with Replace the original keyword w in inverted index I i For each inverted index table I(w) i ), generating |F(w) i The format is <0i′||id(F) ij The nodes of the array (where i is a preset fixed bit length, and ||' represents bit string concatenation) are assigned a pseudo-random function based on key s2. Encrypt all nodes; simultaneously, encrypt all inverted index tables I(w) iThe length of each node is uniform. For inverted indexes that are too short, fill them with random numbers that are the same length as the node values.

[0018] Traps generation steps: Data users generate search traps for the keyword W to be queried.

[0019] in The result of performing a pseudo-random permutation operation on w based on key s1. The result of performing a pseudo-random function operation on w based on key s2;

[0020] Search steps: The cloud server receives the search trap T sent by the data user. w Then, match the encrypted inverted index I with... Consistent index entries determine the corresponding inverted index table I(w) i (satisfying w = w) i ); using a trapdoor For this inverted index table I(w i Decrypt all encrypted nodes in the document and extract the document identifier from the decrypted nodes. <id(F ij The function returns the corresponding encrypted document to the data user based on the document identifier.

[0021] Furthermore, the SM4 algorithm has a block length of 128 bits, and both the keys s1 and s2 are 128 bits long. The SM4 algorithm is also compatible with the requirements of symmetric block cipher algorithms that can be symmetrically searched for encryption.

[0022] Furthermore, in the index encryption sub-step, the bit length of l′ is related to the document identifier.

[0023] <id(F ij The bit lengths of the numbers are consistent; the padding random numbers are generated by the SM4 algorithm that meets the security requirements of a pseudo-random generator (PRG), and the PRG satisfies the security condition that "no valid statistical test can distinguish its output from a true random sequence".

[0024] Furthermore, the SM4 algorithm uses GCM mode to perform encryption operations. GCM mode is a non-deterministic encryption mode, which ensures that the ciphertext generated each time is different for the same document and the same key.

[0025] Furthermore, in the search step, when the cloud server returns encrypted documents, the number of documents in the returned results is hidden by using a unified inverted index table length to resist inference attacks; and the encryption performance of the SM4 algorithm in ECB mode is no less than 20Gbps, and the encryption performance in GCM mode is no less than 2.5Gbps (implemented based on an Intel 17 processor, 2.8GHz clock speed, single-core single-threaded environment).

[0026] Furthermore, the trapdoor generation step and the search step are implemented in a non-interactive manner, and the entire encryption and retrieval process is based on the SM4 algorithm as a puncturable pseudo-random function, without relying on computationally complex public-key cryptography algorithms, and has non-interactive backward security.

[0027] Furthermore, when a new document is added to the dataset C, the document preprocessing sub-step updates the keyword set w using an incremental scanning method, and simultaneously updates the document set F(w) corresponding to the keywords. i ) and inverted record table I (w i The updated inverted index still performs the encryption and length unification processing described in claim 1.

[0028] Furthermore, in the search step, for a dataset containing 4,762,706 documents and keyword pairs, when the maximum number of entries in the inverted index matching a given keyword is 63,893, the storage consumption of the entire inverted index entries does not exceed 3.4GB of memory, and the decryption time of a single encrypted node does not exceed 0.07ms.

[0029] A searchable encryption device based on the SM4 algorithm includes a key generation module, an index construction module, a trapdoor generation module, and a search module. These modules work together to implement the searchable encryption method based on the SM4 algorithm as described in any one of claims 1-8, wherein:

[0030] Key generation module: Configured on the data owner's side, it is used to generate SM4 algorithm keys s1 and s2 based on preset security parameters, and supports outputting keys that meet the 128-bit length requirement;

[0031] Index building module: configured on the data owner's side, including a preprocessing unit, an index building unit, and an encryption unit; the preprocessing unit is used to scan the data set C, extract the keyword set w, and establish the document set F(w) corresponding to each keyword. i The index building unit is used to build an inverted index I and an inverted record table I (w) corresponding to each keyword, using w as the term dictionary. i The encryption unit is used to employ... Replace original keywords, use Encrypt the nodes of the inverted index and perform uniform length processing on the inverted index;

[0032] Trapdoor generation module: Configured on the data user side, it receives the keyword w to be queried from the data user and calls the same pseudo-random permutation function as the key generation module. and pseudo-random functions Generate search trapdoor

[0033] Search module: Configured on the cloud server side, used to receive T sent by the trapdoor generation module. w Matching in the encrypted inverted index The corresponding inverted index table, called Decrypt the nodes and extract the document identifier, and finally return the corresponding document ciphertext.

[0034] Furthermore,

[0035] The key generation module integrates the ECB and GCM encryption engines of the SM4 algorithm, supporting switching between encryption modes according to data security requirements; and the encryption engine achieves a throughput of no less than 20Gbps in ECB mode and no less than 2.5Gbps in GCM mode under the conditions of an Intel i7 processor, 2.8GHz clock speed, and single-core single-threaded environment.

[0036] The encryption unit of the index building module has a built-in pseudo-random number generator. This generator is based on the SM4 algorithm and the output random numbers meet the PRG security requirements. It is used to fill in inverted record tables that are not long enough.

[0037] The search module has a result privacy protection unit. By designing a unified inverted record table length through the index building module, it hides the number of documents returned in each search, in order to resist adversaries' inference attacks that deduce keyword information from statistical data, and at the same time resist file injection attacks.

[0038] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0039] (i) Provide comprehensive protection for cloud data security and privacy, and defend against various attack risks.

[0040] 1. Achieve end-to-end data privacy protection: This invention utilizes the SM4 algorithm to achieve end-to-end encrypted processing of "encrypted storage + encrypted retrieval." The data owner generates SM4 keys (s1 and s2) locally and distributes these keys only to authorized users. The cloud server has no access to the plaintext keys or plaintext data throughout the entire process, fundamentally preventing data leakage caused by "semi-honest / curious" or malicious behavior from the cloud server. Simultaneously, document encryption employs the GCM mode (non-deterministic encryption) of the SM4 algorithm. Even with the same document and the same key, each encryption generates a different ciphertext, effectively preventing attackers from inferring the correlation between plaintext content through ciphertext comparison, further strengthening data privacy protection.

[0041] 2. Resist multiple attacks and meet the IND1-CKA security model:

[0042] To address inference attacks: During the index construction process, this invention fills all inverted index tables with random numbers that match the node length, making them all the same length. This prevents attackers from inferring the number and content of documents corresponding to keywords through statistical data such as "return result size" and "index length," and does not require additional storage and communication overhead. This solves the problem of existing solutions where "anti-attack resistance and efficiency are difficult to balance."

[0043] To prevent file injection attacks: Documents encrypted in SM4-GCM mode contain authentication tags. Cloud servers can verify and identify forged encrypted documents through tag verification, effectively filtering illegal data injected by attackers.

[0044] Targeting chosen-keyword attacks (IND1-CKA model): using a pseudo-random permutation function based on the SM4 key s1. Encrypting keywords makes it impossible for attackers to distinguish the semantic differences between different keywords in the encrypted index, thus satisfying the "indistinguishability" security requirement under the IND1-CKA model.

[0045] (ii) Significantly improve retrieval and encryption efficiency and reduce resource consumption.

[0046] 1. Completely solves the high overhead problem of traditional retrieval: This invention constructs an "encrypted inverted index", which enables cloud servers to directly complete keyword matching and document location in the encrypted index based on search traps. Data users do not need to download the entire encrypted document set, but only need to receive the encrypted text of the matched document. The communication overhead and computing cost are reduced by more than 90% compared with traditional solutions (for example, for the retrieval of 4,762,706 documents, only the encrypted text corresponding to a single keyword needs to be transmitted, instead of the full set of documents).

[0047] 2. Excellent encryption and retrieval performance, suitable for large-scale data scenarios: As a high-efficiency symmetric block cipher algorithm, the SM4 algorithm has optimized underlying performance: Under an Intel i7 processor (2.8GHz, single-core, single-threaded), the ECB mode (for index encryption) achieves a throughput of 20Gbps, enabling rapid encryption construction of large-scale indexes; the GCM mode (for document encryption) achieves a throughput of 2.5Gbps, meeting the rapid encryption needs of massive documents. Simultaneously, the decryption time of a single encryption node during retrieval is only 0.07ms, and the memory usage of the encrypted inverted index is only 3.4GB (for an index with 156,320 keywords and a maximum of 63,893 entries), supporting 100+ concurrent retrieval requests per second, fully adaptable to real-time retrieval scenarios for enterprise-level large-scale data.

[0048] (III) Enhance the adaptability and practicality of technology and lower the application threshold.

[0049] 1. Perfectly adapted to symmetric searchable encryption requirements: The SM4 algorithm has a block length and key length of 128 bits, which is highly compatible with the requirements of symmetric block cipher primitives for symmetric searchable encryption. At the same time, the pseudo-random generator (PRG) built based on the SM4 algorithm can generate random sequences that meet the requirement of "statistical indistinguishability", providing secure and reliable random number support for index filling, key generation and other processes, without the need for additional integration of third-party random number generation modules.

[0050] 2. Supports non-interactive backward security and simplifies key management: The trapdoor generation and retrieval process of this invention does not require real-time interaction between the data owner and the user (only pre-synchronization of the SM4 key is required), which greatly improves the ease of use; at the same time, the SM4 algorithm is used as a puncturable pseudo-random function, replacing the computationally complex public key cryptographic algorithms (such as RSA) in existing schemes. This not only reduces the computing power consumption of terminal devices, but also has "non-interactive backward security" - after the key is updated, the security of historical retrieval records is not affected, simplifying the enterprise-level key management process.

[0051] (iv) Possesses good scalability and adapts to dynamic changes in business.

[0052] This invention supports incremental updates of data sets: when a new document is added, only the new keywords need to be extracted through incremental scanning, the corresponding document set and inverted record table need to be updated, and the same encryption and length uniform processing needs to be performed. There is no need to reconstruct the entire encrypted index, which is suitable for the dynamic scenario of "continuous growth" of enterprise business data and avoids the resource waste and service interruption problems caused by "full index reconstruction" in traditional solutions.

[0053] In summary, this invention, through the innovative integration of the SM4 algorithm and searchable encryption technology, achieves a technological breakthrough of "high-efficiency retrieval, low resource consumption, and strong adaptability" while ensuring the security and privacy of cloud data. It solves the core contradiction of "difficulty in balancing security and efficiency" in existing technologies, and can be widely applied to scenarios with high requirements for both data security and retrieval efficiency, such as personal cloud storage, enterprise-level document management, and medical data sharing. It has extremely high commercial value and application prospects.

[0054] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0055] Figure 1 This is a flowchart of this embodiment;

[0056] Figure 2 This is a flowchart of the overall method in this embodiment;

[0057] Figure 3 This is a flowchart of the key generation steps in this embodiment;

[0058] Figure 4 This is a flowchart of the index construction steps in this embodiment;

[0059] Figure 5 This is a flowchart of the trapdoor generation steps in this embodiment;

[0060] Figure 6 This is a flowchart of the search steps in this embodiment. Detailed Implementation

[0061] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments. It should be noted that, without conflict, the various embodiments or technical features described below can be arbitrarily combined to form new embodiments.

[0062] It should be noted that when a component is described as "fixed to" another component, it can be directly on the other component or may have a component in between. When a component is considered "connected to" another component, it can be directly connected to the other component or may have a component in between. When a component is considered "set on" another component, it can be directly set on the other component or may have a component in between. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.

[0063] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0064] (I) System Architecture

[0065] The searchable encryption system in this embodiment adopts a "local processing + cloud storage" architecture, and the functions and hardware configurations of each participating party are as follows:

[0066]

[0067]

[0068] (II) Core Algorithm Adaptation This embodiment uses the SM4 symmetric block cipher algorithm, with a block length of 128 bits and a key length of 128 bits, which is fully adapted to the requirements of symmetric searchable encryption symmetric block ciphers, wherein:

[0069] Encryption modes: Index encryption uses ECB mode (for high throughput), and document encryption uses GCM mode (for nondeterministic encryption to enhance privacy).

[0070] Pseudo-random function: Implementing a pseudo-random permutation function based on the SM4 algorithm and pseudo-random functions It replaces traditional public-key cryptography algorithms, reducing computational complexity;

[0071] Pseudo-random generator (PRG): The PRG is constructed based on the output of the SM4 algorithm. The random sequences generated by it pass the NISTSP800-22 statistical test and there is no effective method to distinguish them from true random sequences.

[0072] III. Specific Implementation of the Searchable Encryption Method Based on the SM4 Algorithm

[0073] (I) Step 1: Key Generation (Executed on the data owner's side)

[0074] 1. Security parameter settings: Set the security parameter k = 128 (corresponding to a 128-bit key length for the SM4 algorithm);

[0075] 2. Key generation process: The data owner's local SM4 key generation module calls a cryptographically secure random number generator (based on the SM4 algorithm PRG) to generate two independent 128-bit keys:

[0076] Key s1: used for pseudo-random permutations of keywords;

[0077] Key s2: Used for encryption of inverted index nodes;

[0078] 3. Key distribution: Keys s1 and s2 are synchronized to authorized data user terminals through an offline secure channel (such as a USB dongle). The cloud server does not handle any keys, ensuring key privacy.

[0079] (II) Step 2: Index Construction (Executed on the Data Owner's Side) In this embodiment, 4,762,706 business documents (such as contracts, reports, and meeting minutes) within the enterprise are used as the data set C. An encrypted inverted index is constructed. The specific process is as follows:

[0080] 1. Document preprocessing sub-steps

[0081] Keyword extraction: Scan the dataset C using a Chinese word segmentation tool (such as Jieba) to extract keywords from all documents, forming a keyword set W = (w1, w2, ..., w...). m ), where m = 156320 (that is, a total of 156320 unique keywords were extracted);

[0082] Document collection mapping: for each keyword w i ∈W, construct a document set F(w) containing the keyword. i And assign a unique 32-bit document identifier id to each document. ij (e.g., "0x1A3F5B7D2C4E6800"). The document set F(w) matching the keyword "customer information" is... 58 It contains 63,893 documents, for all F(w) i The largest set in ).

[0083] 2. Inverted index construction sub-step

[0084] Term dictionary and inverted index creation: Using the keyword set W as the term dictionary, construct the inverted index I; for each w i Create the corresponding inverted index table I(w) i ), and F(w i Identifiers for all documents in ) <id(F ij Store documents in I(w) according to their creation time. i ).

[0085] 3. Index Encryption Sub-step

[0086] Keyword encryption: For all 1 ≤ i ≤ 156320, call the SM4 pseudo-random permutation function based on key s1. The original key w i Convert to 128-bit encrypted key

[0087] And replace the original keywords in inverted index I;

[0088] Inverted index node encryption: for each I(w) i )|F(w i | 10 nodes, each node in the format <0 32 ||id(F ij )>where (0 32 The string consists of 32 bits of "0" bits (where "||" indicates bit string concatenation, and the total node length is 64 bits); the SM4 pseudo-random function based on key s2 is called. Encryption is performed on all nodes;

[0089] Index Length Standardization and Padding: To defend against inference attacks (preventing adversaries from inferring the number of documents corresponding to keywords through index length), all inverted index tables I(w) are standardized. i The length of ) is uniformly set to 64,000 nodes (taking the minimum |F(w)). 58 The floor value of I(w) is 63893; for I(w) with a length less than 64000, the floor value is 63893.i The SM4-PRG generates 64-bit random numbers and fills them into 64,000 nodes. The filled random numbers are in the same format as the encrypted nodes and cannot be distinguished by the adversary.

[0090] (III) Step 3: Trapdoor Generation (Executed on the data user side)

[0091] When data users need to retrieve documents containing the keyword "customer information", they should do the following:

[0092] 1. The local terminal calls the SM4 trapdoor generation module and inputs the keyword to be queried, w = "customer information";

[0093] 2. Call the pseudo-random permutation function that matches the data owner. (Using key s1) Generate encryption key

[0094] 3. Call the pseudo-random function (Using key s2), generate the decryption key.

[0095] 4. and Combination into a search trapdoor The data is transmitted to the cloud server using HTTPS protocol encryption.

[0096] (iv) Step 4: Search (executed on the cloud server side)

[0097] 1. Cloud server receives trapdoor T w Then, iterate through the encrypted inverted index I to find the matches. (i.e., "0x9E7C5A3B1F2D4C6E8A0B2C4D6E8F0A1B"), locate the corresponding inverted index table I(w 58 );

[0098] 2. Call the SM4 decryption module and use the trapdoor. For I(w) 58 The 64,000 nodes were decrypted one by one, and the randomly numbered nodes used for padding were filtered out (those that did not contain valid document identifiers after decryption).

[0099] <id(F ij From the nodes of )>, 63,893 valid document identifiers were extracted;

[0100] 3. The cloud server retrieves the corresponding encrypted document from the storage pool based on the valid document identifier (the encrypted document is encrypted in SM4-GCM mode, and each encrypted document is a unique value), and packages all the encrypted documents and returns them to the data user terminal.

[0101] 4. The data user terminal uses the locally stored SM4 key (which is consistent with the document encryption key) to decrypt the received ciphertext and obtain the original document containing "customer information".

[0102] IV. Performance Testing and Results

[0103] (I) Testing Environment

[0104] Hardware: The cloud server uses an Intel i7-12700K processor (2.8GHz, single-core single-thread operation);

[0105] Dataset: 4,762,706 business documents (average single document size 2MB), keyword set W contains 156,320 unique keywords, maximum number of inverted index entries 63,893;

[0106] Testing tools: The OpenSSL 3.0 module with integrated SM4 algorithm was used to collect data on retrieval time, memory usage, and throughput using a custom script.

[0107] (II) Test Results

[0108]

[0109]

[0110] V. Security Verification

[0111] (I) Verification of Anti-Attack Capability

[0112] 1. IND1-CKA Model Security: Under the IND1-CKA model where "the index contains the same number of keywords", this embodiment uses SM4 pseudo-random permutation. Encrypted keywords prevent adversaries from inferring the semantics of the original keywords through the encrypted index; at the same time, the encryption of the inverted index nodes and the random number filling mechanism make it impossible for adversaries to distinguish between valid data and filled data in the index, which meets the indistinguishability requirement of the IND1-CKA model.

[0113] 2. Semi-honest adversary defense: In the scenario where the cloud server acts as a semi-honest adversary (passively collecting data without actively tampering with it), the cloud server in this embodiment does not access any plaintext keys, and only processes encrypted trapdoors and encrypted indexes during the retrieval process, and cannot obtain the original information of document content or keywords.

[0114] 3. Defense against inference attacks and file injection attacks:

[0115] Inference attack: By standardizing the length of all inverted index tables (64,000 nodes), the true number of documents corresponding to keywords is hidden, and adversaries cannot infer keyword information through statistical data such as "return result size", thus solving the "inference attack" vulnerability mentioned in the "Patent Description and Supplement".

[0116] File injection attack: Since the document encryption uses SM4-GCM mode (non-deterministic encryption), even if an adversary injects a forged encrypted document, its ciphertext format cannot match the ciphertext of the legitimate document (GCM mode requires associated authentication tags). The cloud server can filter forged documents through tag verification to resist file injection attacks.

[0117] (II) Enhanced Privacy Protection

[0118] 1. Nondeterministic encryption: The SM4-GCM mode ensures that the ciphertext generated by each encryption is different for the same document and the same key (because the GCM mode introduces a random initialization vector IV), thus avoiding the privacy risk of "the same ciphertext corresponding to the same plaintext".

[0119] 2. Non-interactive backward security: The trapdoor generation and search process does not require real-time interaction between the data owner and the user (only the key needs to be synchronized in advance). Moreover, the SM4 algorithm, as a puncturable pseudo-random function, replaces the public key cryptographic algorithms (such as RSA) in traditional schemes, reducing key management vulnerabilities in the public key system and possessing "non-interactive backward security" (i.e., subsequent key updates do not affect the security of historical retrieval).

[0120] VI. Implementation of the Equipment Example

[0121] The device implementation in this embodiment fully corresponds to the "searchable encryption device based on the SM4 algorithm" described in claim 2. The hardware integration and functional implementation of each module are as follows:

[0122] 1. Key generation module: Integrated into the enterprise server of the data owner, it is implemented using a hardware encryption chip (such as the national standard SM4 encryption card), supports 128-bit key generation and storage, and the key output conforms to the GM / T0002-2012 "SM4 Block Cipher Algorithm" standard;

[0123] 2. Index building module:

[0124] Preprocessing unit: Keyword extraction is achieved through the Python Jieba word segmentation library, supporting scanning of mainstream document formats such as .docx and .pdf;

[0125] Index building unit: Based on secondary development of Elasticsearch, it builds an inverted index structure to efficiently store 156,320 keywords;

[0126] Encryption Unit: Integrated SM4-ECB / GCM dual-mode encryption engine, automatically completes keyword replacement, node encryption and random number filling;

[0127] 3. Trapdoor generation module: Deployed in the terminal APP of data users (supports Windows / macOS systems), it generates trapdoors by calling the local SM4 algorithm dynamic library, and the trapdoor transmission is encrypted using the TLS1.3 protocol;

[0128] 4. Search Module: Deployed in a Docker container on a cloud server, it includes an index matching engine, an SM4 decryption engine, and a result filtering unit. It supports 100+ concurrent trapdoor processing per second and automatically hides the true number of returned documents through the "Result Privacy Protection Unit".

[0129] The above embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of protection of the present invention. Any non-substantial changes and substitutions made by those skilled in the art based on the present invention shall fall within the scope of protection claimed by the present invention.

Claims

1. A searchable encryption method based on SM4 algorithm, characterized in that, Comprise the following steps: Key generation step: the data owner generates two keys s1 and s2 corresponding to the SM4 algorithm based on preset security parameters, wherein s1, s2∈{0,1} k , k is the key length, and s1 and s2 are both used as the encryption operation base key of the SM4 algorithm; The index construction step: the data owner constructs a secure inverted index and completes encryption, specifically comprising: Document pre-processing sub-step: scan the target data set C and extract all keywords contained in the documents in the data set C to form a keyword set W = (w1, w2,..., w m m) (m is the total number of keywords); for each keyword w i ∈ W (1≤ i≤ m), a document set F(w i ) containing the keyword w i is established; each document in F(w i ) corresponds to a unique document identifier; Inverted index construction sub-steps: Using the keyword set W as a term dictionary, construct the inverted index I; for each keyword w i Create the corresponding inverted index table I(w) i ), F(w i Document identifiers for all documents in ) <id(F ij )>(1≤j≤|F(w i )|),|F(w i )| is F(w i The number of documents in each document is stored sequentially in I(w) i ); Index encryption sub-step: perform encryption processing on the inverted index I, specifically: for all 1≤i≤m, use a pseudo-random permutation function based on key s1 Process keyword w i , get and replace the original keyword w i in the inverted index I with ; for each inverted record table I(w i ), generate |F(w i )| nodes in the format <0i′||id(F ij )> (i is a preset fixed bit length, and ′|| represents bit string splicing), and use a pseudo-random function based on key s2 to encrypt all nodes; at the same time, unify the lengths of all inverted record tables I(w i ), and fill in random numbers with the same length as the node value length for inverted record tables with insufficient length; Trapdoor generating step: the data user generates a search trapdoor for the keyword W to be queried wherein is the result of performing a pseudo-random permutation operation on w based on the key s1, is the result of performing a pseudo-random function operation on w based on the key s2; Search step: the cloud server receives the search trapdoor T sent by the data user w After that, the encrypted inverted index I is matched with the index item consistent with , and the corresponding inverted record table I(w i ) is determined (satisfying w=w i ); the encrypted node in the trapdoor is used to decrypt all encrypted nodes in the inverted record table I(w i ), extract the document identifier <id(F ij )> in the decrypted node, and return the corresponding document ciphertext to the data user according to the document identifier.

2. The method of claim 1, wherein: The group length of the SM4 algorithm is 128 bits, the key s1 and s2 are both 128 bits long, and the SM4 algorithm adapts to the demand of symmetric block cipher algorithm of symmetric searchable encryption.

3. The method of claim 1, wherein: In the index encryption sub-step, the bit length of l' is consistent with the bit length of the document identifier <id(F ij )>; the filled random number is generated by the SM4 algorithm meeting the pseudo-random generator (PRG) security, and the PRG meets the security condition that "no effective statistical test can distinguish its output from a true random sequence".

4. The method of claim 1, wherein: The SM4 algorithm performs encryption operation in GCM mode, and the GCM mode is a non-deterministic encryption mode, so that the ciphertext generated each time under the same document and the same key is different.

5. The method of claim 1, wherein: In the search step, when the cloud server returns the document ciphertext, the number of returned documents is hidden by uniforming the length of the inverted record table to resist inference attacks; and the encryption performance of the SM4 algorithm in ECB mode is not less than 20Gbps, and the encryption performance in GCM mode is not less than 2.5Gbps (based on Intel I7 processor, frequency 2.8GHz, single core single thread environment implementation).

6. The method of claim 1, wherein: The trapdoor generation step and the search step are implemented in a non-interactive manner, and the entire encryption and retrieval process uses the SM4 algorithm as a puncturable pseudo-random function, which does not depend on public key cryptography with high computational complexity, and has non-interactive backward security.

7. The method of claim 1, wherein: When a document is added to the data collection C, the document preprocessing sub-step updates the keyword set w in an incremental scanning manner, and synchronously updates the document set F(w i ) and the inverted record table I(w i ) corresponding to the keyword, and the updated inverted record table still performs the encryption and length uniformization processing of claim 1.

8. The method of claim 1, wherein: In the search step, for a data set containing 4762706 documents and keyword pairs, when the maximum number of inverted record table entries matching a given keyword is 63893, the entry storage consumption of the entire inverted index does not exceed 3.4GB of memory, and the decryption time of a single encryption node does not exceed 0.07ms.

9. A searchable encryption device based on an SM4 algorithm, characterized in that, The key generation module, the index construction module, the trapdoor generation module and the search module are included, and each module cooperates to realize the searchable encryption method based on the SM4 algorithm in any one of claims 1-8, wherein: The key generation module: configured on the data owner side, used for generating the keys s1 and s2 of the SM4 algorithm based on the preset security parameters, and supporting outputting the keys meeting the length requirement of 128 bits; The index construction module is configured on the data owner side, and includes a preprocessing unit, an index construction unit and an encryption unit; the preprocessing unit is used for scanning a data set C, extracting a keyword set w and establishing a document set F(w corresponding to each keyword i ); the index construction unit is used for constructing an inverted index I and an inverted record table I(w i ) corresponding to each keyword with w as a term dictionary; and the encryption unit is used for replacing original keywords with , encrypting inverted record table nodes with , and performing length uniform processing on the inverted record table. Trapdoor generating module: configured on the data user side, used for receiving the query keyword w input by the data user, and calling the pseudo-random permutation function consistent with the key generating module and a pseudo-random function Generating a search trapdoor Search module: configured on the cloud server side, used for receiving the T w In the encrypted inverted index matching The corresponding inverted record table, call Decrypt the node and extract the document identifier, and finally return the corresponding document ciphertext.

10. The device of claim 9, wherein: The key generation module integrates the ECB mode and GCM mode encryption engines of the SM4 algorithm, supports switching the encryption mode according to the data security requirement; and the encryption engine has an ECB mode throughput of not less than 20Gbps and a GCM mode throughput of not less than 2.5Gbps under the condition of Intel I7 processor, frequency 2.8GHz, single core single thread environment; The encryption unit of the index construction module is internally provided with a pseudo-random number generator, which is implemented based on the SM4 algorithm, and the output random number meets the PRG security requirement, and is used for performing padding on the inverted record table with insufficient length; The search module has a result privacy protection unit, which hides the number of returned documents each time by the design of uniforming the length of the inverted record table, so as to resist the inference attack of the enemy through statistical data inference keyword information, and resist the file injection attack.

Images