Encrypted data searchable method and system based on counting bloom filter

Abstract

The invention relates to an encrypted data searchable method and system based on a counting bloom filter, belongs to the technical field of data information security, and solves the technical problems of low search efficiency of encrypted data and data privacy security protection in the search process. Comprising the steps that an authority center generates a system public key and a main private key; generating a user private key of the data user based on the user attribute set of the data user, the system public key and the main private key; the data owner encrypts a to-be-stored data file f by using a ciphertext generation function to obtain a target ciphertext CT and uploads the target ciphertext CT to cloud storage; wherein the parameters of the ciphertext generation function comprise a system public key PK and a counting Bloom filter; the data user generates a query trap door based on the user private key and the query keyword set; the cloud storage performs matching search on the query trap door and the stored target ciphertext; and if the matching is successful, returning the corresponding file ciphertext to the data user. And efficient search of the encrypted data is realized.

Description

Technical Field

[0001] This invention relates to the field of data information security technology, and in particular to a method and system for searching encrypted data based on a count Bloom filter. Background Technology

[0002] In recent years, with the development and application of cloud computing, cloud computing can provide users with a variety of convenient services, such as cloud computing, cloud storage, data backup, and data sharing. With cloud storage and cloud computing processing becoming mainstream applications, data breaches have occurred frequently. Large-scale data breaches in recent years have exposed the security vulnerabilities of traditional databases, posing challenges to data ownership and data privacy security control. Users have solved the data privacy and security issues by encrypting data locally before entrusting it to cloud storage service providers. However, traditional encryption methods cannot support fast data retrieval, and a large number of encryption and decryption operations affect the timeliness of queries.

[0003] To address the above issues, there is an urgent need to research searchable methods that support encrypted data. Symmetric searchable encryption methods combine data retrieval with data encryption, solving the problem of the inability to retrieve encrypted data. Public-key encrypted keyword search methods solve the key distribution and management problems brought about by key escrow in symmetric searchable encryption mechanisms. Attribute-based encryption methods have been widely used to implement fine-grained access control of data. To simultaneously achieve searchability and access control for encrypted data, attribute-based multi-keyword searchable schemes realize multi-keyword searchable encryption based on attribute encryption. However, the computational and storage costs of this method for keyword indexing increase linearly with the number of keywords, and its main operations are pairwise and modulo operations, resulting in high computational overhead and low retrieval efficiency. Summary of the Invention

[0004] Based on the above analysis, the embodiments of the present invention aim to provide a searchable method and system for encrypted data based on a count Bloom filter, in order to solve the technical problems of low search efficiency for encrypted data and data privacy and security protection during the search process in existing methods.

[0005] This invention provides a searchable method for encrypted data based on a count Bloom filter, comprising the following steps:

[0006] Step S1: The authoritative center generates a system public key PK and a master private key MSK; and based on the user attribute set S of the data user, as well as the system public key PK and the master private key MSK, generates the user's private key SK. S ;

[0007] Step S2: The data owner uses a ciphertext generation function to encrypt the data file f to be stored, obtains the target ciphertext CT, and uploads it to cloud storage; wherein, the parameters of the ciphertext generation function include the system public key PK and the count Bloom filter;

[0008] Step S3: The data user uses the user's private key SK S and query keyword set Generate a query trapdoor Q;

[0009] Step S4: The cloud storage performs a matching search between the query trap Q and the stored target ciphertext CT; if the match is successful, the corresponding searched file ciphertext C is returned to the data user.

[0010] Furthermore, the authoritative center generates the system's public key PK and master private key MSK based on the security parameter λ, as follows:

[0011]

[0012] Where g is a loop Generators; and group of integers The numbers are uniformly randomly selected from the middle; p is a large prime number determined by the safety parameter λ, and it is also a cyclic group. order and integer group The model; The first hash function; Here, is the second hash function; CBF(m,k) is the counting Bloom filter, where m is the length of the binary vector in the Bloom filter and k is the number of hash functions in the Bloom filter; The result of the modular exponentiation generated using the bilinear mapping e(g,g) and α1; The result of the modular exponentiation generated using g and α2; This represents the result of the modular exponentiation operation generated using g and α1.

[0013] Further, the generation of the data user's private key based on the user attribute set S of the data user, and the system public key PK and master private key MSK, includes:

[0014] From the group of integers Randomly select master random number

[0015] Based on PK and MSK And the master random number r, generating the master key component

[0016] Generate an independent random number r for each attribute in the user attribute set S. i Where i is the attribute index;

[0017] Calculate the attribute key component (D) for each attribute i D i ');in,

[0018] Based on the master key component D, and the attribute key component (D) corresponding to each attribute of the user attribute set. i D i The user's private key is obtained as follows:

[0019]

[0020] Among them, SK S For data users' private keys.

[0021] Further, step S2 includes:

[0022] Randomly generate the permutation parameter σ;

[0023] A symmetric encryption key κ is randomly generated using a symmetric encryption algorithm;

[0024] Construct an access policy tree based on the data owner's data access control requirements.

[0025] Based on PK, f, CBF(m,k), σ, κ, W f Ciphertext generation function;

[0026] The ciphertext generation function is used to perform symmetric encryption on the data file f to be stored, resulting in the target ciphertext CT = {C, I1, I2}.

[0027] Where C is the ciphertext obtained by encrypting the data file f to be stored using κ; I1 is the ciphertext based on σ, κ, and The obtained access policy ciphertext; I2 is the set of keywords W corresponding to the data file f to be stored, obtained by using a count Bloom filter. f The binary vector is mapped to a binary vector, and the encrypted keyword index is generated by scrambling the binary vector using a randomly generated permutation parameter σ.

[0028] The target ciphertext CT = {C, I1, I2} is uploaded to cloud storage.

[0029] Further, step S3 includes:

[0030] The data user requests the user's private key SK from the authority. S Request the target encrypted CT from cloud storage;

[0031] Using the user's private key SK S The system public key PK is used to decrypt the policy ciphertext I1 in the target ciphertext CT;

[0032] When the user's private key SK S The corresponding user attribute set S satisfies the access policy tree. If the decryption is successful, the permutation parameters and the symmetric encryption key σ||κ are obtained.

[0033] And based on the set of query keywords The permutation parameter σ and the count Bloom filter CBF(m,k) are used to generate the query trapdoor Q.

[0034] Furthermore, the generation of the query trapdoor Q includes:

[0035] The set of query keywords Input the count Bloom filter CBF(m,k) to generate the original binary vector.

[0036] Using the permutation parameter σ By scrambling the positions, a query trap is obtained. Send to cloud storage.

[0037] Further, step S4 includes:

[0038] The cloud storage performs an element-by-element numerical comparison between the query trap Q and the encrypted keyword index I2 in the stored target ciphertext;

[0039] If the value of each element in the query trap Q is less than or equal to the value of the corresponding element in the encrypted keyword index I2, then the match is successful, and the file ciphertext C in the target ciphertext is returned to the data user; otherwise, an empty string or an error code is returned.

[0040] Furthermore, the data user decrypts the ciphertext C of the file obtained through the search using a symmetric encryption key to obtain the corresponding plaintext query result.

[0041] Furthermore, the authority center is either an internal key management server of the enterprise or a trusted third-party service.

[0042] The present invention also discloses an encrypted data searchable system based on a count Bloom filter, the system comprising a key management module M1, a data encryption module M2, a data query module M3, and a cloud service module M4;

[0043] The key management module M1 is used by the authority center to generate the system public key PK and master private key MSK; and to generate the user private key SK of the data user based on the user attribute set S of the data user, as well as the system public key PK and master private key MSK. S ;

[0044] The data encryption module M2 is used by the data owner to encrypt the data file f to be stored using a ciphertext generation function to obtain the target ciphertext CT and upload it to cloud storage; wherein, the parameters of the ciphertext generation function include the system public key PK and the count Bloom filter;

[0045] The data query module M3 is used by data users based on the user's private key SK. S and query keyword set Generate a query trapdoor Q;

[0046] The cloud service module M4 is used by the cloud storage to match the query trap Q with the stored target ciphertext CT; if the match is successful, the corresponding searched file ciphertext C is returned to the data user.

[0047] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0048] 1. This invention introduces a Counting Bloom Filter (CBF) as the data structure for keyword indexing, transforming the keyword set matching problem into a fast "less than or equal to" comparison of a fixed-length binary vector (O(n) time complexity), replacing the complex bilinear pairing operation in existing methods that increases linearly with the number of keywords. Regardless of the size of the original keyword set, the index is compressed into a fixed-length vector with constant storage overhead, solving the technical problem that the computation and storage costs of keyword indexing increase linearly with the number of keywords in existing methods.

[0049] 2. This invention uses a permutation parameter σ and a symmetric encryption key κ as a unified object for attribute-based encryption. Only users whose attributes meet the access policy number can decrypt and simultaneously obtain σ and κ to generate a query trapdoor. This ensures that the set of users authorized to search is completely equivalent to the set of users authorized to decrypt. It prevents security vulnerabilities that may result from the separation of permissions, achieving true "who can see, who can search." Access control policies are unified and enforced in both search and decryption dimensions. This solves the technical problem that existing searchable encryption and access control are often separated, posing a risk that unauthorized users may gain search capabilities through other means and launch probing attacks on ciphertext.

[0050] 3. This invention employs a counting Bloom filter instead of a standard Bloom filter. Because a Bloom filter stores count values ​​rather than Boolean values, when a keyword needs to be deleted from the file keyword set, the count value at the corresponding position can be safely decremented by 1 without rebuilding the entire encrypted index. This makes this solution applicable to real-world business scenarios requiring dynamic maintenance of the encrypted index, such as keyword revision in encrypted data files and user permission revocation, thus solving the problem of insufficient flexibility in static solutions. It also addresses the technical challenge of standard Bloom filters or static indexing schemes in supporting the secure deletion or modification of keywords in an already encrypted index.

[0051] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0052] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0053] Figure 1 This is a flowchart of a method for making encrypted data searchable based on a count Bloom filter, as described in an embodiment of the present invention.

[0054] Figure 2 This is a schematic diagram of the entities executing the method in the embodiments of the present invention;

[0055] Figure 3 This is a schematic diagram illustrating the working principle of the counting Bloom filter in an embodiment of the present invention;

[0056] Figure 4 This is a schematic diagram of a binary vector based on the permutation principle in an embodiment of the present invention;

[0057] Figure 5 This is a schematic diagram illustrating the index matching principle in an embodiment of the present invention;

[0058] Figure 6 This is a schematic diagram of an encrypted data searchable system module based on a count Bloom filter in an embodiment of the present invention. Detailed Implementation

[0059] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0060] Example 1:

[0061] To address the aforementioned issues, this invention combines attribute encryption with count Bloom filters, designing a multi-keyword searchable method based on the attribute base of a count Bloom filter. This improves the efficiency of encrypted data retrieval while supporting searchability and access control for encrypted data. This invention relates to a searchable method for encrypted data in data privacy and security protection, enabling efficient retrieval of encrypted data while ensuring data security.

[0062] One specific embodiment of the present invention discloses a method for searchable encrypted data based on a count Bloom filter, such as... Figure 1 As shown, it includes the following steps:

[0063] Step S1: The authoritative center generates a system public key PK and a master private key MSK; and based on the user attribute set S of the data user, as well as the system public key PK and the master private key MSK, generates the user's private key SK. S ;

[0064] Step S2: The data owner uses a ciphertext generation function to encrypt the data file f to be stored, obtains the target ciphertext CT, and uploads it to cloud storage; wherein, the parameters of the ciphertext generation function include the system public key PK and the count Bloom filter;

[0065] Step S3: The data user uses the user's private key SK S and query keyword set Generate a query trapdoor Q;

[0066] Step S4: The cloud storage performs a matching search between the query trap Q and the stored target ciphertext CT; if the match is successful, the corresponding retrieved file ciphertext C is returned to the data user.

[0067] like Figure 2 As shown, the implementation of this technical solution involves four entities: the authoritative center, the data owner, the data user, and the cloud storage.

[0068] (1) The authoritative center generates system public key PK and master private key MSK pairs to provide public and private key pairs for data owners and data users;

[0069] The authoritative center is either an internal enterprise key management server or a trusted third-party service.

[0070] (2) The data owner completes the encryption of the data file to be stored and the corresponding keywords of the data file to be stored, and entrusts the generated target ciphertext to the cloud storage service provider for storage;

[0071] (3) Data users construct query traps and send them to cloud storage;

[0072] (4) Cloud storage is responsible for storing the target ciphertext of the data owner on the one hand, and searching for the target ciphertext based on the query trap of the data user on the other hand, and feeding back the search results to the data user.

[0073] Step S1 includes steps S11-S12.

[0074] Step S11: The authoritative center generates the system public key PK and master private key MSK.

[0075] The authoritative center generates the system's public key PK and master private key MSK based on the security parameter λ, as follows:

[0076]

[0077] Where g is a loop Generators; and group of integers The numbers are uniformly randomly selected from the middle; p is a large prime number determined by the safety parameter λ, and it is also a cyclic group. order and integer group The model; The first hash function; Here, is the second hash function; CBF(m,k) is the counting Bloom filter, where m is the length of the binary vector in the Bloom filter and k is the number of hash functions in the Bloom filter; The result of the modular exponentiation generated using the bilinear mapping e(g,g) and α1; The result of the modular exponentiation generated using g and α2; This represents the result of the modular exponentiation operation generated using g and α1.

[0078] For example, cyclic groups It belongs to the elliptic curve group; It is an integer addition group; This indicates uniform random selection. To map binary strings of arbitrary length to a group For mapping to The non-zero element.

[0079] The authoritative center uses the initialization function Setup(λ) as input, with the safety parameter λ as the input parameter. For example, λ is 128 bits in size. The bit length of a large prime number p is determined by λ, which is also 128 bits, making it a sufficiently large and safe prime number, thus generating a group of order p. The function; generates an additive cyclic group of modulo p. In this invention, Its main functions are to select the random number field and the exponent operation field; generate bilinear pairs e(g,g); and finally generate the system public key PK and master private key MSK.

[0080] The administrator of the authority center determines the security level based on actual needs. λ=128 means choosing a 128-bit security strength level, which can resist attacks requiring 2... 128 An attack that requires several basic operations to break.

[0081] For example, the initialization function uses the PBC (Pairing-Based Cryptography) open-source cryptographic library. The pseudocode for the initialization function is as follows:

[0082] Function Setup(λ) :

[0083] / / (1) Generate the underlying mathematical structure based on security parameters

[0084] p = generate_large_prime(λ) / / Generate a large prime number p, the bit length is related to λ.

[0085] / / Generating a cyclic group of order p

[0086] g = select_generator_of(G) / / From Select generator g

[0087] / / (2) Select the system's master secret random number

[0088] / / from α1 is randomly selected from the middle

[0089] / / from α2 is randomly selected from the middle

[0090] / / (3) Define the first and second hash functions

[0091]

[0092] / / (4) Initialize the count Bloom filter

[0093] CBF=CountingBloomFilter.new(m,k)

[0094] / / Create a count Bloom filter with length m binary vectors and k hash functions.

[0095] / / (5) Calculate the components in the public key PK

[0096] / / Calculate the bilinear pairing results

[0097] / / Calculate the result of the group index operation

[0098] / / 6. Assemble PK and MSK and output them

[0099] return(PK,MSK)

[0100] The initialization function is executed by the administrator of the authority center or the startup script, and is performed once during the initial system deployment. The generated PK is made public to the data owner and data user, while the MSK is securely stored in the trusted hardware security module of the authority center (the MSK is top secret and held only by the authority center).

[0101] The purpose of step S11 is for the authoritative center to generate public-private key pairs through an initialization function, providing public-private key pairs for data owners and data users.

[0102] Step S12: Based on the user attribute set S of the data user, and the system public key PK and master private key MSK, the authority center generates the user private key SK for the data user. S .

[0103] The process of generating the user's private key based on the user attribute set S of the data user, and the system public key PK and master private key MSK, includes:

[0104] From the group of integers Randomly select master random number

[0105] Based on PK and MSK And the master random number r, generating the master key component

[0106] Generate an independent random number r for each attribute in the user attribute set S. i Where i is the attribute index;

[0107] Calculate the attribute key component (D) for each attribute i D i ');in,

[0108] Based on the master key component D, and the attribute key component (D) corresponding to each attribute of the user attribute set. i D i The user's private key is obtained as follows:

[0109]

[0110] Among them, SK S For data users' private keys.

[0111] The authoritative center executes the key generation function F1(PK,MSK,S), which uses the user attribute set S of the data user, the system public key PK, and the master private key MSK as input to generate the user's private key SK. S .

[0112] Step 1: Select random numbers: from the integer group A master random number r is randomly selected. Each user's r is different, ensuring that each user's private key is not linked to another.

[0113] The second step is to select a random number for each attribute in the user attribute set S. For each attribute in the user attribute set S (e.g., the i-th attribute = "Title: Engineer"), generate an independent random number r for each attribute. i .

[0114] Step 3: Constructing the computational key component: Generating the master key component Using PK and MSK And the result is calculated from the user's random number r.

[0115] Generate attribute key components by calculating a pair of attribute key components (D) for each attribute i (i∈S) in the user attribute set S of the data user. i D i ′):

[0116] (D i D i The pair '' constitutes the "decryption factor" for the i-th attribute. During subsequent decryption, if the ciphertext access policy requires the attribute and the user possesses that attribute, this pair of components can be used to search for encrypted data.

[0117] Step 4: Assemble the user's private key SK S SK S Master key component D and attribute key component pair (D i D i ')constitute.

[0118] For each user attribute i∈S, generate a random number;

[0119] In Master Key Component D The result of the modular exponentiation generated using g, α1, α2, and r;

[0120] D i To utilize g and the master private key Generates the attribute key component related to user attribute i, g r The result of the modular exponentiation generated using g and r; The first hash function The result of the modular exponentiation generated by the user attribute i;

[0121] D′ i To be with D i Paired attribute key components, To utilize g and r i The generated modular exponentiation result.

[0122] For example, the user attribute set S = (Age: 30, Gender: Male, Title: Engineer).

[0123] Data user's private key SK S It includes a master key component D and a set of attribute components (for each attribute owned by the data consumer, there is a pair of attribute key components (D)). i D i ′)).

[0124] Each pair of attribute key components in the user's private key (D i ,D′ i Each of these is uniquely bound to its attribute i. If a user does not have a certain attribute, there will be no corresponding attribute key component pair, and therefore the ciphertext of that attribute cannot be decrypted.

[0125] Each data user has a unique random number r. If two malicious data users attempt to merge their keys to gain more attributes, the corresponding master key components D cannot be merged due to the different r values, thus preventing attribute merging. This is the core security feature of symmetric encryption.

[0126] Only authoritative centers possessing the master private key MSK (especially α1 and α2) can generate a valid master key component D. Data users cannot forge their own user private key SK. S .

[0127] The purpose of step S1 is to establish the basic trust anchor point for the entire cryptographic system by the authoritative center, generate the system public key and master private key, and generate the user private key for the data user; this step is the trust initialization and user authorization stage, which provides the cryptographic foundation and identity credentials for the entire ciphertext searchable method that supports fine-grained access control.

[0128] Step S2: This step is performed by the data owner.

[0129] Randomly generate the permutation parameter σ;

[0130] A symmetric encryption key κ is randomly generated using a symmetric encryption algorithm;

[0131] Construct an access policy tree based on the data owner's data access control requirements.

[0132] Based on PK, f, CBF(m,k), σ, κ, W f Ciphertext generation function;

[0133] The ciphertext generation function is used to perform symmetric encryption on the data file f to be stored, resulting in the target ciphertext CT = {C, I1, I2}.

[0134] Where C is the ciphertext obtained by encrypting the data file f to be stored using κ; I1 is the ciphertext based on σ, κ, and The obtained access policy ciphertext; I2 is the set of keywords W corresponding to the data file f to be stored, obtained by using a count Bloom filter. f The binary vector is mapped to a binary vector, and the encrypted keyword index is generated by scrambling the binary vector using a randomly generated permutation parameter σ.

[0135] The target ciphertext CT = {C, I1, I2} is uploaded to cloud storage.

[0136] (1) Generate the permutation parameter σ and the symmetric encryption key κ.

[0137] σ is a position permutation function that is randomly generated during code implementation. For example, it can be used to randomly shuffle the positions of elements in a dictionary array.

[0138] A symmetric encryption key κ is used for AES encryption; the symmetric encryption key κ is used to generate the encrypted ciphertext C corresponding to the data file f to be stored.

[0139] (2) Define access policies. Construct an access policy tree. The data owner constructs the access policy tree based on the access control requirements of the encrypted data files. An access policy tree is a structured representation of an "access control logic expression" that defines "who (possesses which attributes) can access encrypted data".

[0140] For example, if a data owner wants only data users who meet certain conditions (age > 30 AND department = R&D) to be able to search encrypted data, then an access policy tree is created with the root node being the "AND" gate and the two leaf nodes being the attributes "age: 30" and "department: R&D" respectively. The leaf nodes of the access policy tree are the attribute assertions for the corresponding data users, and the non-leaf nodes are logical operations such as 'AND' and 'OR'.

[0141] (3) Extract the keyword set; the keyword set W corresponding to the data file to be stored f The data is specified by the data owner or defined based on the frequency of terms in the data file to be stored; for example: W f ={run,jump,walk}.

[0142] (4) Perform encryption and encapsulation.

[0143] Based on PK, f, CBF(m,k), σ, κ, W f Ciphertext generation function; Ciphertext generation function Specifically as follows:

[0144] (a) Perform symmetric encryption on the data file to be stored.

[0145] Using the symmetric encryption algorithm AES, a random symmetric encryption key κ is generated. This key κ is then used to encrypt the data file f to be stored, generating the ciphertext C = AES. κ (f) protects the confidentiality of the contents of the data file f to be stored.

[0146] (b) Construct and blind the keyword index in the keyword set corresponding to the data file to be stored.

[0147] For the keyword set W f The corresponding binary vector is generated using a counting Bloom filter (CBF(m,k)). And based on the permutation parameter σ, the binary vector is converted into an encrypted keyword index.

[0148] like Figure 3 As shown, a keyword set W is generated using a counting Bloom filter. f The corresponding binary vector

[0149] Taking m=10 and k=3 as an example, CBF(m,k) is used, which is equivalent to CBF(10,3), and the keyword set W is... f = (run, jump, walk); Use k hash functions to calculate the mapping of the key to k positions in the vector.

[0150] For each keyword in the keyword set, run, jump, walk, calculate its position using the three hash functions (H1, H2, H3) of CBF(m,k), and increment the count value of the corresponding position by 1.

[0151] Initial vector [0,0,0,0,0,0,0,0,0,0]

[0152] run → hash to position [0,2,4] → updated vector [1,0,1,0,1,0,0,0,0,0];

[0153] jump → hash to position [2,4,6] → updated vector [1,0,2,0,2,0,1,0,0,0];

[0154] walk → hash to position [4,7,9] → updated vector [1,0,2,0,3,0,1,1,0,1].

[0155] Generate the final vector [1,0,2,0,3,0,1,1,0,1] represents the keyword set W. f The original representation in CBF is generated as follows:

[0156] For run: H1(run) = 0, H2(run) = 2, H3(run) = 4, that is, using the three hash functions H1, H2, and H3 with run as input, the position results are 0, 2, and 4 respectively, and the number of the 0th, 2nd, and 4th positions of the binary vector is increased by 1;

[0157] For jump: Similarly, using the three hash functions H1, H2, and H3 with jump as input, the position results are 2, 4, and 6 respectively. Then, add 1 to the number of the 2nd, 4th, and 6th positions of the binary vector.

[0158] For `walk`: Similarly, using the three hash functions H1, H2, and H3 with `walk` as input, the resulting positions are 4, 7, and 9 respectively. Increment the count of the 4th, 7th, and 9th positions in the binary vector by 1, and finally obtain the keyword set W. f Corresponding binary vector The result is [1,0,2,0,3,0,1,1,0,1].

[0159] The keyword set is compressed into a fixed-length vector, resulting in extremely low storage and comparison overhead.

[0160] Using a count Bloom filter, the count value records the superposition of each keyword in the keyword combination. In the future, a keyword can be safely deleted (by decrementing the corresponding position by 1), and a dynamically updated encrypted search index is supported.

[0161] like Figure 4 As shown, exemplarily, using the permutation parameter σ = [0, 1, 4, 6, 5, 2][ 7,3,9,8 Binary vector Convert into encrypted keyword index Example as follows, keyword set W fThe corresponding binary vector is [1,0,2,0,3,0,1,1,0,1]. In [0,1,4,6,5,2] and [7,3,9,8], [0,1,4,6,5,2] represents moving the 0th bit to the 1st bit, the 1st bit to the 4th bit, the 4th bit to the 6th bit, the 6th bit to the 5th bit, the 5th bit to the 2nd bit, and the 2nd bit to the 0th bit. The same applies to [7,3,9,8]. Therefore, the original binary vector... [1,0,2,0,3,0,1,1,0,1] becomes [2,1,0,1,0,1,3,0,1,0].

[0162] (c) Output the access policy ciphertext I1 and the encryption keyword index I2 corresponding to the data file f to be stored, as shown below:

[0163]

[0164] Where I1 is the access policy ciphertext, and I2 is the keyword set W. f The corresponding encrypted keyword index, This indicates that W is first generated using a counting Bloom filter CBF(m,k). f The corresponding binary vector (see details) Figure 4 Example), and then use the permutation parameter σ to generate the keyword set W. f Corresponding encrypted keyword index; I σ The result of blinding the permutation parameter σ and the symmetric encryption key κ; This indicates the use of the system public key PK. The result of the modular exponentiation operation generated by m, where m is the integer group. Random numbers; θ represents h m The calculation results; h m The result of the modular exponentiation generated using g, α1, α2, and m; θ y To indicate Calculation results; This indicates the use of g and q y (0) The generated modular exponentiation result; θ y ′ represents y represents the access strategy tree. Leaf nodes; Y represents the access strategy tree. The set of leaf nodes; Indicates the use of q y The results generated by (0) and att(y), q y (0) is the polynomial function corresponding to the leaf node y, and att(y) is the function associated with the leaf node y. Leaf node functions.

[0165] Generate σ, κ, and access policy tree using attribute encryption functions. The corresponding access policy ciphertext I1 contains the symmetric encryption key κ and the permutation parameter σ used to decrypt C.

[0166] I2 is the keyword set W f The encrypted, searchable index of encrypted keywords corresponding to the ciphertext is generated from the keyword set through a count Bloom filter (CBF) and then blinded by permutation.

[0167] (d) Output the ciphertext CT = {C, I1, I2} corresponding to the data file f to be stored.

[0168] Step S2 involves the data owner encapsulating the data file to be stored and its access policy into a secure data packet that supports fine-grained access control and efficient ciphertext retrieval through a three-layer cryptographic process: "symmetric encryption to protect the content, attribute-based encryption to encapsulate the key and permutation, and counting Bloom filters to build a searchable index." This packet is then entrusted to cloud storage. This step completes the conversion from plaintext data files to secure ciphertext. The core of this step lies in using structured encryption methods to integrate data content, access policies, and search capabilities into a single ciphertext object, laying the data foundation for subsequent controlled encrypted retrieval.

[0169] Step S3, specifically.

[0170] Step S3 includes:

[0171] The data user requests the user's private key SK from the authority. S Request the target encrypted CT from cloud storage;

[0172] Using the user's private key SK S The system public key PK is used to decrypt the policy ciphertext I1 in the target ciphertext CT;

[0173] When the user's private key SK S The corresponding user attribute set S satisfies the access policy tree. If the decryption is successful, the permutation parameters and the symmetric encryption key σ||κ are obtained.

[0174] And based on the set of query keywords The permutation parameter σ and the count Bloom filter CBF(m,k) are used to generate a query trapdoor.

[0175] The data user requests the private key SK from the authority center. S Request the target encrypted text CT from cloud storage, based on the data user's private key SK. S The system public key PK and the target ciphertext CT are used to decrypt the data using the function F2(SK).S ,PK,I1), generate the permutation parameter σ and the symmetric encryption key κ. The decryption function is the operation performed by the data user after obtaining authorization from the authoritative center.

[0176] Decryption function F2(SK) S ,PK,I1), input PK, ciphertext I1 and SK S The output is the decryption result σ||κ. The decryption process is as follows:

[0177] The decryption process involves iterative calculation of Φ. x (CT,SK S ), Φ x (·) represents a loop iteration function; the decryption algorithm recursively calculates the access strategy tree. For any current node in the tree, its type is determined. The calculation rules are as follows:

[0178] (1) When accessing a leaf node x in the policy tree, let its associated attribute i = att(x). First, check if the attribute exists in the attribute set S of the current data user. If i ∈ S, then perform an attribute matching check:

[0179]

[0180] Where att(x) is associated with the access policy tree. Leaf node function; q x (0) is the secret share assigned to node x in the access policy tree.

[0181] like Then DecryptNode(I1,SK) S x)=⊥,Formula (3) terminates the calculation. This indicates that access control for the target ciphertext is not satisfied.

[0182] At each leaf node of the access policy tree (representing a user attribute of a specific data user, such as "Title: Engineer"), check the user's private key SK. S If the corresponding attribute is present, then the random number r in the user's private key is eliminated through bilinear pairwise fractional operations. i Obtain the intermediate secret value This value is the shared secret of this attribute node;

[0183] Otherwise, if it is not included, the decryption function terminates.

[0184] (2) When x is a non-leaf node, i.e., an internal node, calculate DecryptNode(I1,SK) for all its child nodes x′. SFormula (4) represents the calculation of the secret shared value of the parent node corresponding to all child nodes x′, and is set as Φ. x′ This process recursively ascends from the leaf nodes to the root node.

[0185] If S x k is the node x′ x A set of n child nodes, satisfying Φ x′ ≠⊥, perform the following operation on each child node x′:

[0186]

[0187] in, q represents the Lagrange interpolation coefficients. x′ (0) represents the constant term of the polynomial function corresponding to node x′, and q x (i) represents the secret shared value of the i-th node corresponding to the polynomial function of the parent node x of x′;

[0188] Otherwise, output ⊥.

[0189] (3) If the user attribute set S of the data user satisfies the access policy tree Recursively calculate to the root node, decrypt to obtain σ||κ, as follows:

[0190]

[0191] Where σ||κ are the permutation parameters and symmetric key of the concatenation, and is the decryption target; The blinded key component comes from ciphertext I1.

[0192] Formulas (4), (5) and (6) are used to retrieve the symmetric encryption key κ and permutation σ corresponding to the data that the user can access.

[0193] The generated query trapdoor includes:

[0194] The set of query keywords Input the count Bloom filter CBF(m,k) to generate the original binary vector.

[0195] Using the permutation parameter σ By scrambling the positions, a query trap is obtained. Send to cloud storage.

[0196] Using CBF(m,k), PK, and σ, a query trapdoor Q is generated. This step is performed by the data user after successfully decrypting and obtaining the permutation σ, in order to initiate a search.

[0197] The user's plaintext query intent (keyword set) This is transformed into a privacy-protected search token that can be matched with the encrypted index of cloud storage, known as the trapdoor Q.

[0198] Trapdoor generation function This function takes a set of query keywords as input. The count Bloom filter CBF(m,k) and the permutation σ are used to generate the query keyword trapdoor Q.

[0199] CBF(m,k) is a count Bloom filter that is exactly the same as the one used by the data owner when building the encrypted index;

[0200] A set of one or more keywords that a data user wants to query (e.g.

[0201] The permutation parameter σ is the secret permutation parameter specific to the target ciphertext, obtained by decryption from the encrypted ciphertext; Q is the query trapdoor, a blinded binary vector. For example... Figure 5 As shown, it is completely symmetrical to the process of building an encrypted index.

[0202] The specific process is as follows:

[0203] Where Q represents the set of keywords. Corresponding ciphertext index, This is represented as generating using a counting Bloom filter CBF(m,k). corresponding vector Then, the substitution σ is generated. The corresponding query is a trapdoor.

[0204] Set of query keywords Input CBF(m,k) to generate the original binary vector. In this vector, the position hashed by the keyword is set to 1 (or if multiple keywords hash to the same position, they are summed);

[0205] Using the substitution σ pair By scrambling the positions, a query trap is obtained.

[0206] Step S4, specifically.

[0207] Step S4 includes:

[0208] The cloud storage performs an element-by-element numerical comparison between the query trap Q and the encrypted keyword index I2 in the stored target ciphertext;

[0209] If the value of each element in the query trap Q is less than or equal to the value of the corresponding element in the encrypted keyword index I2, then the match is successful, and the file ciphertext C in the target ciphertext is returned to the data user; otherwise, an empty string or an error code is returned.

[0210] Data users decrypt the ciphertext C of the file obtained through the search using a symmetric encryption key to obtain the corresponding plaintext query result.

[0211] Cloud storage uses a retrieval function and a query trapdoor Q, CT = {C, I1, I2} to output the search result C corresponding to Q. This part is executed by cloud storage, completing the search without any decryption.

[0212] The cloud storage receives the user's trapdoor Q, performs a matching operation on the encrypted keyword index I2 of the storage, and determines whether the keyword queried by the user is contained in the target ciphertext I2. If it exists, it returns the matching file ciphertext C.

[0213] The retrieval function (I2, Q) takes I2 and Q as input and returns C. The calculation process is as follows:

[0214] For two binary vectors I2 and Q, verify whether the size of each element in vector Q is less than or equal to the size of the corresponding element in I2. If so, it indicates that... Right now The corresponding query trapdoor Q matches the encrypted keyword index I2, such as Figure 5 As shown, the ciphertext C corresponding to file f is returned.

[0215] Finally, the data user uses the AES decryption algorithm and the symmetric private key κ to recover the corresponding plaintext content of the ciphertext C of the file.

[0216] Figure 5 The matching principle is illustrated below:

[0217] The binary vector generated from the file's key-to-keyword correspondence by Figure 3 W f = (run, jump, walk) indicates that User's query keywords Corresponding trap door It is known that the vector The size of each element at each position is greater than or equal to The element at the corresponding position represents the set of query keywords. In the set of document keywords W f middle.

[0218] If the match is successful, the encrypted file C is returned; otherwise, if the match fails, nothing is returned or an empty value ⊥ is returned.

[0219] Matching rule: Verify that the value of each element in the query trapdoor Q is less than or equal to the value of the element at the corresponding position in I2.

[0220] The encrypted keyword index I2 records the hash summation result of all keywords in the encrypted file. For example, the value at position 4 is 3, which means that three different keywords (such as run, jump, and walk) have all hashed to this position.

[0221] The query trapdoor Q records the hash summation results of the user's query keywords. For example, query... Therefore, the value at position 4 is 2;

[0222] Inclusion relation constraint: If the query is a set of keywords It is the set of keywords W for encrypted files f For each hash position of CBF, the number of times Q "hit" at that position (count value) must not exceed the total number of hits of I2 at that position;

[0223] Conversely, if the value at a certain position in Q is greater than the value at the corresponding position in I2, the match fails.

[0224] Because I2 and Q use the same secret permutation σ for blinding, their positional correspondence is synchronized. Although the cloud storage server does not know σ, it can correctly perform position-by-position comparison.

[0225] Cloud storage servers can determine the subset inclusion relationship by comparing each element of a vector in a single operation with a time complexity of O(n) (assuming the length of the vector is n), without needing to know the contents at all.

[0226] Step S3 allows data users to use their attribute private key to decrypt the encrypted file key and permutation parameters within their access permissions, and generate a searchable query trapdoor based on this, thereby initiating a keyword search request to the cloud storage while protecting privacy, and obtaining the corresponding encrypted file.

[0227] Example 2:

[0228] One specific embodiment of the present invention discloses a searchable encrypted data system based on a count Bloom filter, thereby implementing the searchable encrypted data method based on a count Bloom filter in Embodiment 1. The specific implementation of each module is described in the corresponding description in Embodiment 1.

[0229] like Figure 5 As shown, an encrypted data searchable system based on a count Bloom filter is disclosed. The system includes a key management module M1, a data encryption module M2, a data query module M3, and a cloud service module M4.

[0230] The key management module M1 is used by the authority center to generate the system public key PK and master private key MSK; and to generate the user private key SK of the data user based on the user attribute set S of the data user, as well as the system public key PK and master private key MSK. S ;

[0231] The data encryption module M2 is used by the data owner to encrypt the data file f to be stored using a ciphertext generation function to obtain the target ciphertext CT and upload it to cloud storage; wherein, the parameters of the ciphertext generation function include the system public key PK and the count Bloom filter;

[0232] The data query module M3 is used by data users based on the user's private key SK. S and query keyword set Generate a query trapdoor Q;

[0233] The cloud service module M4 is used by the cloud storage to match the query trap Q with the stored target ciphertext CT; if the match is successful, the corresponding file ciphertext C is returned to the data user.

[0234] Since the system in this embodiment and the method in Embodiment 1 are related and can be referenced from each other, this description is redundant and will not be repeated here. Because this system embodiment shares the same principle as the above method embodiment, it also possesses the corresponding technical effects of the above method embodiment.

[0235] In summary, the encrypted data searchable method and system based on a count Bloom filter according to embodiments of the present invention have the following beneficial effects:

[0236] 1. This invention introduces a Counting Bloom Filter (CBF) as the data structure for keyword indexing, transforming the keyword set matching problem into a fast "less than or equal to" comparison of a fixed-length binary vector (O(n) time complexity), replacing the complex bilinear pairing operation in existing methods that increases linearly with the number of keywords. Regardless of the size of the original keyword set, the index is compressed into a fixed-length vector with constant storage overhead, solving the technical problem that the computation and storage costs of keyword indexing increase linearly with the number of keywords in existing methods.

[0237] 2. This invention uses a permutation parameter σ and a symmetric encryption key κ as a unified object for attribute-based encryption. Only users whose attributes meet the access policy number can decrypt and simultaneously obtain σ and κ to generate a query trapdoor. This ensures that the set of users authorized to search is completely equivalent to the set of users authorized to decrypt. It prevents security vulnerabilities that may result from the separation of permissions, achieving true "who can see, who can search." Access control policies are unified and enforced in both search and decryption dimensions. This solves the technical problem that existing searchable encryption and access control are often separated, posing a risk that unauthorized users may gain search capabilities through other means and launch probing attacks on ciphertext.

[0238] 3. This invention employs a counting Bloom filter instead of a standard Bloom filter. Because a Bloom filter stores count values ​​rather than Boolean values, when a keyword needs to be deleted from the file keyword set, the count value at the corresponding position can be safely decremented by 1 without rebuilding the entire encrypted index. This makes this solution applicable to real-world business scenarios requiring dynamic maintenance of the encrypted index, such as keyword revision in encrypted data files and user permission revocation, thus solving the problem of insufficient flexibility in static solutions. It also addresses the technical challenge of standard Bloom filters or static indexing schemes in supporting the secure deletion or modification of keywords in an already encrypted index.

[0239] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0240] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for searchable encrypted data based on a count Bloom filter, characterized in that, Includes the following steps: Step S1: The authoritative center generates a system public key PK and a master private key MSK; and based on the user attribute set S of the data user, as well as the system public key PK and the master private key MSK, generates the user's private key SK. S ; Step S2: The data owner uses a ciphertext generation function to encrypt the data file f to be stored, obtains the target ciphertext CT, and uploads it to cloud storage; wherein, the parameters of the ciphertext generation function include the system public key PK and the count Bloom filter; Step S3: The data user uses the user's private key SK S and query keyword set Generate a query trapdoor Q; Step S4: The cloud storage performs a matching search between the query trap Q and the stored target ciphertext CT; if the match is successful, the corresponding searched file ciphertext C is returned to the data user.

2. The encrypted data searchable method based on a count Bloom filter according to claim 1, characterized in that, The authoritative center generates the system's public key PK and master private key MSK based on the security parameter λ, as follows: Where g is a loop Generators; and group of integers The numbers are uniformly randomly selected from the middle; p is a large prime number determined by the safety parameter λ, and it is also a cyclic group. order and integer group The model; The first hash function; Here, is the second hash function; CBF(m,k) is the counting Bloom filter, where m is the length of the binary vector in the Bloom filter and k is the number of hash functions in the Bloom filter; The result of the modular exponentiation generated using the bilinear mapping e(g,g) and α1; The result of the modular exponentiation generated using g and α2; This represents the result of the modular exponentiation operation generated using g and α1.

3. The encrypted data searchable method based on a count Bloom filter according to claim 2, characterized in that, The process of generating the user's private key based on the user attribute set S of the data user, and the system public key PK and master private key MSK, includes: From the group of integers Randomly select master random number Based on PK and MSK And the master random number r, generating the master key component Generate an independent random number r for each attribute in the user attribute set S. i Where i is the attribute index; Calculate the attribute key component (D) for each attribute i D i ');in, Based on the master key component D, and the attribute key component (D) corresponding to each attribute of the user attribute set. i D i The user's private key is obtained as follows: Among them, SK S For data users' private keys.

4. The encrypted data searchable method based on a count Bloom filter according to claim 3, characterized in that, Step S2 includes: Randomly generate the permutation parameter σ; A symmetric encryption key κ is randomly generated using a symmetric encryption algorithm; Construct an access policy tree based on the data owner's data access control requirements. Based on PK, f, CBF(m,k), σ, κ, W f Ciphertext generation function; The ciphertext generation function is used to perform symmetric encryption on the data file f to be stored, resulting in the target ciphertext CT = {C, I1, I2}. Where C is the ciphertext obtained by encrypting the data file f to be stored using κ; I1 is the ciphertext based on σ, κ, and The obtained access policy ciphertext; I2 is the set of keywords W corresponding to the data file f to be stored, obtained by using a count Bloom filter. f The binary vector is mapped to a binary vector, and the encrypted keyword index is generated by scrambling the binary vector using a randomly generated permutation parameter σ. The target ciphertext CT = {C, I1, I2} is uploaded to cloud storage.

5. The encrypted data searchable method based on a count Bloom filter according to claim 4, characterized in that, Step S3 includes: The data user requests the user's private key SK from the authority. S Request the target encrypted CT from cloud storage; Using the user's private key SK S The system public key PK is used to decrypt the policy ciphertext I1 in the target ciphertext CT; When the user's private key SK S The corresponding user attribute set S satisfies the access policy tree. If the decryption is successful, the permutation parameters and the symmetric encryption key σ||κ are obtained. And based on the set of query keywords The permutation parameter σ and the count Bloom filter CBF(m,k) are used to generate the query trapdoor Q.

6. The encrypted data searchable method based on a count Bloom filter according to claim 5, characterized in that, The generation of the query trapdoor Q includes: The set of query keywords Input the count Bloom filter CBF(m,k) to generate the original binary vector. Using the permutation parameter σ By scrambling the positions, a query trap is obtained. Send to cloud storage.

7. The encrypted data searchable method based on a count Bloom filter according to claim 6, characterized in that, Step S4 includes: The cloud storage performs an element-by-element numerical comparison between the query trap Q and the encrypted keyword index I2 in the stored target ciphertext; If the value of each element in the query trap Q is less than or equal to the value of the corresponding element in the encrypted keyword index I2, then the match is successful, and the file ciphertext C in the target ciphertext is returned to the data user; otherwise, an empty string or an error code is returned.

8. The encrypted data searchable method based on a count Bloom filter according to claim 7, characterized in that, Data users decrypt the ciphertext C of the file obtained through the search using a symmetric encryption key to obtain the corresponding plaintext query result.

9. The encrypted data searchable method based on a count Bloom filter according to any one of claims 1-8, characterized in that, The authoritative center is either an internal enterprise key management server or a trusted third-party service.

10. A searchable encrypted data system based on a count Bloom filter, characterized in that, The system includes a key management module M1, a data encryption module M2, a data query module M3, and a cloud service module M4; The key management module M1 is used by the authority center to generate the system public key PK and master private key MSK; and to generate the user private key SK of the data user based on the user attribute set S of the data user, as well as the system public key PK and master private key MSK. S ; The data encryption module M2 is used by the data owner to encrypt the data file f to be stored using a ciphertext generation function to obtain the target ciphertext CT and upload it to cloud storage; wherein, the parameters of the ciphertext generation function include the system public key PK and the count Bloom filter; The data query module M3 is used by data users based on the user's private key SK. S and query keyword set Generate a query trapdoor Q; The cloud service module M4 is used by the cloud storage to match the query trap Q with the stored target ciphertext CT; if the match is successful, the corresponding searched file ciphertext C is returned to the data user.

Images