Volume-hidden joint query dynamic searchable encryption method

Abstract

The invention provides a capacity-hidden joint query dynamic searchable encryption method, and belongs to the technical field of searchable encryption. According to the method, a new index structure is constructed based on an extensible bitmap, a homomorphic addition symmetric encryption algorithm is used for transforming the bitmap of each keyword into an'encryption and homomorphic accumulation 'index structure, and only one corresponding encrypted bitmap index is maintained for each keyword; a new index structure is a fixed-length encrypted bitmap, a server can only observe the length of the bitmap and the query round, and the number of real hit documents and the intersection scale are difficult to recover, so that the query result capacity hiding is realized while the joint query is supported; in the updating process, the client encrypts the increment bitmap through a one-time secret key, the server only executes modular addition operation on an existing ciphertext so that addition and deletion can be completed in a ciphertext domain, all rounds of secret keys are independent, the search state evolves along with counting, and therefore associated leakage of updating and querying is weakened.

Description

Technical Field

[0001] This invention relates to a capacity-hiding, dynamically searchable encryption method for joint queries, belonging to the field of searchable encryption technology. Background Technology

[0002] With the development of information technology and cloud computing, Searchable Symmetric Encryption (SSE) has gradually become an important cryptographic mechanism supporting retrieval under the premise of "encrypted data storage and plaintext invisibility". Its core idea is to enable clients to perform matching operations on ciphertext indexes or ciphertext databases stored on servers based on query keywords or more general query expressions without decrypting outsourced data. Typically, the data owner encrypts documents and their indexes using a symmetric key, and generates a search token using the key during the query phase. The server relies solely on this token and the ciphertext structure to complete the retrieval and output the corresponding ciphertext results, without directly accessing the plaintext content. Depending on the specific construction, SSE schemes differ in index organization, supported query types, interaction rounds, and leakage modes, and have become one of the fundamental technologies supporting privacy retrieval in scenarios such as cloud storage, healthcare, finance, and the Internet of Things.

[0003] However, existing searchable encryption schemes still expose some information during the query process. Especially in Dynamic Searchable Symmetric Encryption (DSSE) scenarios, which are more relevant to practical applications, auxiliary information such as access patterns and update locations generated with each update is often observed by the server. If these leaks are misused, attackers may use them to infer query keywords, thereby launching update abuse attacks or query recovery attacks. In DSSE research, existing schemes typically focus on single-keyword retrieval and define and construct them around forward and backward privacy. If federated queries (such as multi-keyword retrieval, equi-joins, etc.) are further supported, the leakage surface will significantly expand. For example, the capacity of the returned results (number of documents / ciphertext length) itself is a potential leakage signal. Attackers can manipulate update and query frequencies through capacity injection attacks to amplify the leakage, inferring keywords to achieve a high proportion of query recovery. However, existing work still has significant shortcomings in federated queries: most schemes are either statically constructed, lacking the flexibility of dynamic file addition or deletion; or they only provide forward / backward privacy definitions under single-keyword semantics, making it difficult to accurately characterize information exposure and result capacity leakage in federated scenarios. Therefore, designing a dynamically searchable symmetric encryption scheme that supports both capacity-hidden federated queries and SSE schemes that achieve forward and backward privacy has become a technical challenge. Patranabis et al. proposed ODXT, a dynamic encrypted search system that supports federated queries on symmetric encrypted data, maintaining effective forward and backward privacy during dynamic updates. ODXT is centered on cross-tags: it maintains an updatable tag structure for each keyword and generates a search token for a main query keyword during queries, while generating composable cross-tags for the remaining keywords. The server then filters the encrypted index and returns matching document identifiers. This scheme achieves rapid updates and federated retrieval in dynamic scenarios and provides formal security guarantees for forward and Type-II backward privacy, and can be extended to large-scale databases with diverse data patterns.

[0004] While ODXT supports join queries on dynamic databases and provides effective forward and backward privacy and security, it has the following key issues:

[0005] 1. Capacity hiding is not possible. ODXT achieves dynamic updates and federated queries through a dynamic cross-labeling mechanism and a blinded matching mechanism based on the Diffie-Hellman exponential relationship. During the query phase, the server needs to perform matching within the encrypted domain based on the relevant indexes and cross-labels of the main query keywords, and return a result set corresponding to the size of the hit set. Since the size of the returned result is linearly related to the number of hit documents, in ODXT, the server can infer the number and distribution of query hit documents through external signals such as response length, number of bytes transmitted, or processing time, resulting in capacity leakage. In federated query scenarios, this leakage is amplified by the historical update frequency of the main query keywords, allowing the server to infer the activity level and update frequency of keyword-related files.

[0006] 2. Update operations rely on index reconstruction and cannot be performed directly on the encrypted data. ODXT's update mechanism is based on a cross-tag structure. Whenever a file is added or deleted, the client needs to regenerate and upload the corresponding index entry. Each tag records the operation type and updates the corresponding position in the server's index table. Because the client needs to maintain an update count for each keyword and recalculate the cross-tags with each update, the server can infer the update distribution and temporal order of some keywords by observing the frequency of index updates, the number of entries, and tag change patterns. This makes the update behavior somewhat correlated with subsequent queries, thus weakening the strictness of forward privacy. Furthermore, this update process cannot be completed directly in the encrypted domain but relies on the client to reconstruct and upload the index, resulting in communication and computational burdens and potentially exposing the system's update patterns.

[0007] 3. Updates and queries still have potential correlations, and forward privacy is incomplete. ODXT supports federated queries on dynamic databases and formally provides security definitions for forward and Type-II backward privacy. However, its forward privacy model fails to fully cover certain specific types of federated scenarios. Specifically, when the main query keyword and its associated keywords share an update history, the server can infer potential correlations between different keywords by observing side-channel information such as keyword update time, tag change patterns, and update counts. Especially when multiple queries share some keywords or document identifiers, the server can identify that they belong to the same or adjacent update sequences through the co-occurrence of common keyword timestamps. This type of situation belongs to "specific forms of join queries," that is, when different federated queries share keywords or timelines, ODXT cannot guarantee forward privacy in a strict sense, thus allowing inferable connections to still exist between updates and queries.

[0008] To overcome the above shortcomings, this invention proposes a capacity-hiding, dynamically searchable encrypted joint query method. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings of existing technologies and propose a dynamically searchable symmetric encryption method with capacity hiding, forward privacy, and backward privacy guarantees. This method designs a capacity hiding mechanism with fixed-length return and a dynamically updated structure within the ciphertext field, making it difficult for the server to infer the number of hit files from queries or to correlate additions, deletions, and subsequent queries, thus simultaneously satisfying forward and backward privacy requirements. This method significantly outperforms existing comparative schemes in retrieval speed while maintaining competitive communication overhead, meeting deployable bandwidth and latency constraints.

[0010] The purpose of this method is achieved through the following technical solution.

[0011] This invention proposes a capacity-hidden, dynamically searchable encrypted joint query method, comprising the following steps:

[0012] Step 1: Client initialization, which includes the following sub-steps:

[0013] Step 1.1: Parameter Generation

[0014] The client first selects a security parameter λ and randomly generates a symmetric master key K, then selects an integer parameter n=2. al Where a is the number of bits required to represent a single file, and l is the maximum number of files supported by the system. The parameter n is used to define the modulus space of the homomorphic addition symmetric encryption algorithm Π=(Enc,Dec,Add) used in this invention, that is, all encryption, accumulation and decryption operations are performed in a ring domain modulo n.

[0015] Step 1.2: Index structure initialization

[0016] The client initializes the local keyword state table CT with an empty mapping, where CT represents the mapping from keyword w to state entry (ST). c The mapping of c), ST c Here, c is the latest search token for keyword w, and c is the corresponding update count. The encrypted database M on the server side is also initialized to an empty mapping. M is a key-value mapping-based storage structure that uses the update token UT as the key and maps it to the corresponding encrypted database item EDB[UT], denoted as M[UT] = EDB[UT].

[0017] Step 1.3: Return of status parameters and encrypted database

[0018] The client encapsulates the elements required for this method into a state σ = (n, K, CT), which serves as input for subsequent update and query phases. Simultaneously, it returns an encrypted database EDB = M, stored on the server side. It should be noted that (K, CT) remains only on the client side to maintain its privacy; the server cannot access this content.

[0019] Step 2: Update the client-side keyword status and update the server-side encrypted text, which includes the following sub-steps:

[0020] Step 2.1: The client initializes and advances the keyword status.

[0021] The client first uses the keyword w to derive the private key K from the master key K using a key derivation function. w and auxiliary key K′ w The format is as follows:

[0022] K w ||K′ w =F K (w)

[0023] Among them, F K (w) is a key derivation function that takes the master key K as input and can be implemented by any secure pseudo-random function, K. w Used to generate a search token, which is associated with the encrypted state stored on the server side; K′ w Used to generate a one-time encryption key, which is then associated with the subsequent implementation of the homomorphic algorithm.

[0024] Then, the client extracts the status entry corresponding to keyword w from the local keyword status table CT, including the latest search token ST. c And the corresponding update count c. If the entry is empty (i.e., the keyword appears for the first time), then initialize the update count to -1 and randomly generate a λ-bit search token, in the following form:

[0025] c = -1, ST C ={0,1} λ

[0026] If the keyword w is already in the CT table, then write the update count and search token back to CT, in the following format:

[0027] CT[w]=(ST c+1 (c+1)

[0028] Among them, ST c+1 Generate a new λ-bit random search token for the next update round, where c+1 is the new update count.

[0029] Step 2.2: Client updates token and counter ciphertext

[0030] The client uses a private key K based on the keyword w. w The unique update token (UT) used in this update is derived from the new random search token. c+1This is used to locate the index position in the encrypted database on the server side. It also generates a new checksum. The update securely encapsulates information from the previous search token, enabling the server to detect whether the index state is evolving continuously and correctly. The update formula is as follows:

[0031] UT c+1 =H1(K w ST c+1 )

[0032]

[0033] H1 and H2 are arbitrary and secure hash functions, which are considered to be independent functions in this invention and are used to generate update tokens and verification values ​​respectively.

[0034] Then, the client uses the keyword auxiliary key K′ w And the latest count-derived one-time key sk c+1 Then, within the modulo n space, the updated bit string bs is encrypted using the homomorphic addition algorithm Π=(Enc,Dec,Add) with the encryption algorithm Enc, resulting in the ciphertext e. c+1 The encryption formula is as follows:

[0035] sk c+1 =H3(K′) w (c+1)

[0036] e c+1 =Enc(sk c+1 ,bs,n)

[0037] H3 is also an arbitrary and secure hash function, and it remains independent of H1 and H2, and is used to generate a one-time encryption key.

[0038] The encryption algorithm Enc of the above homomorphic addition algorithm is described in detail here. For any plaintext m and a randomly selected one-time key sk, the encryption algorithm Enc calculates the ciphertext c:

[0039] c = Enc(sk,m,n) = sk + m mod n

[0040] That is, the plaintext m is added to the key sk in the modulus space n to obtain the ciphertext c.

[0041] It is important to note that this invention further proposes a novel data structure design based on the aforementioned homomorphic addition algorithm to support update operations such as insertion and deletion within the ciphertext domain. Specifically, this invention formalizes the document set associated with a certain keyword as a fixed-length bitmap and uses this bitmap as input to the homomorphic addition algorithm Π = (Enc, Dec, Add). Since the definition of the homomorphic addition algorithm itself does not restrict the structure of the input data, the bitmap method designed in this invention represents a novel data structure. When the client constructs the corresponding incremental bitmap bs according to the update type and encrypts it using Enc, the server performs an insertion or deletion operation on that bitmap when executing the Add algorithm within the ciphertext domain. Therefore, even though the description of the homomorphic addition algorithm does not explicitly include modulo addition and modulo subtraction on the bitmap, the bitmap structure proposed in this invention serves as input to the homomorphic addition algorithm, enabling bitmap updates to be completed in the ciphertext domain using a unified modulo n addition form.

[0042] The following example illustrates a general example of a bitmap data structure using the homomorphic addition algorithm. Assume the system supports at most l files, each encoded with a bits, then the total bitmap length is a1 bits, corresponding to a modulus n = 2^l. al The bit codes of each file are arranged sequentially in the bitmap, corresponding to files f0 to f1 from right to left. l .

[0043] (1) Insertion operation (adding a new file) i (where 0≤i≤l)

[0044] The initial bitmap can be represented as a string of bits (al), where the bit value at each position corresponds to whether the file is included in the result set for the current keyword. For example, 01 represents inclusion; 00 represents exclusion. To add file f to the results... i The client constructs an "incremental bitmap" only in f i The corresponding bit position 'a' is set to "01" (indicating a count increment of 1), and the remaining positions are "00". The client encrypts this incremental bitmap using Enc, and the server directly performs a modulo n=2 operation on it within the ciphertext field, comparing it with the current encrypted bitmap. al Addition yields an updated encrypted bitmap, the effect of which is in f i The position is incremented by 1 to complete the file f. i Insertion.

[0045] (2) Deletion operation (delete file f) j (where 0≤j≤l)

[0046] Delete file f j In the plaintext domain, this is equivalent to subtracting a segment from the current bitmap that is only in f. jThe incremental bitmap corresponding to bit position "a" being "01". Since all operations are performed modulo n = 2... al The subtraction is performed within a spatial domain. This invention transforms the subtraction into adding its additive inverse, where the additive inverse is defined as satisfying x + x -1 The unique element x ≡ 0 (mod n) -1 Therefore, the process is equivalent to calculating x in the modular space. -1 = (nx) mod n. Then, the client encrypts the "delete incremental bitmap", and the server performs a modulo operation of n=2 on the existing encrypted bitmap in the ciphertext field. al The addition operation, after decryption, yields a new bitmap that is identical to the result of subtraction performed directly on the plaintext, thus enabling the processing of file f. j The deletion operation.

[0047] Finally, the client will use the generated update token UT. c+1 The ciphertext pair with this round of updates After encapsulation, use triples It is sent to the server in the form of [format].

[0048] Step 2.3: Update server-side status records

[0049] After receiving the triple from the client, the server updates the token UT. c+1 Use the index key to store the corresponding ciphertext pair. The information is written to its maintained mapping table M, meaning that the keyword status is updated and maintained without knowing the keywords or plaintext content. The specific operations are as follows:

[0050]

[0051] Where M is a key-value mapping-based storage structure, M[UT] c+1 ] is the encrypted database EDB′ stored after the server update.

[0052] Step 3: The client performs a combined search using multiple keywords, which includes the following sub-steps:

[0053] Step 3.1: The client initiates a joint query q containing several keywords. First, it retrieves the entry CT[w] from the local keyword status table and checks if the entry corresponding to keyword w is empty. If the entry corresponding to keyword w is not empty, the current status label ST is obtained. c And update the counter c. Simultaneously, the client calls the key derivation function F. K (w), generate its private key and auxiliary key pair (K) w ,K′ w The function is consistent with the previous update phase description; if the entry corresponding to a certain keyword w is empty, the client will directly output an empty result, indicating that the query keyword does not exist.

[0054] Subsequently, the client will generate all the triples {(K) of the keywords to be queried. w ST c ,c)} w∈q This is sent to the server as a set of search tokens. Multiple keywords 'w' can be sent at once, but note that the number of keywords is limited to 2. a -1, meaning that when the file size is 'a', a maximum of 2 queries can be performed at a time. a -1 keyword.

[0055] Step 3.2: The server aggregates the results by keyword count.

[0056] There are two accumulators here: a global accumulator (Sum) and a local accumulator (Sum). e The global accumulator Sum is the result of a homomorphic addition algorithm with multiple keywords, while the local accumulator Sum... e This is the historical update and accumulation result for a single keyword w. The calculation principle of each accumulator is explained below:

[0057] First, for a keyword instance (K) w ST c c) Calculate its cumulative result. The server starts from the count c given by the current client and backtracks in order of update sequence from newest to oldest, that is, it executes the calculation sequentially for i = c, c-1, ..., 0, and calculates the index label UT corresponding to this round of update. i Then, the index is used to find the ciphertext pair corresponding to this round of update in the mapping table M. The corresponding operations are as follows:

[0058]

[0059] Among them, when the server is based on the current ST i The state retrieves the ciphertext e corresponding to the i-th round of update. i And the check value pointing to the previous state Therefore, it can be used subsequently. Reverse the state chain to recover the state chain.

[0060] Then, the ciphertext e of this round is added in the modulo n space using the homomorphic addition algorithm Add. i Accumulated to local accumulator Sum e In addition, to save server storage space, the server deletes the entry from the mapping table M after the accumulation is complete, thereby deleting the historical update records that have participated in the accumulation from the database. That is, the server only stores the latest entry status. The operation is as follows:

[0061] Sum = Add(Sum) e ,e i,n), Remove = M[UT i ]

[0062] Here is a detailed description of the homomorphic addition algorithm Add described above. Given two plaintexts m0 and m1 to be encrypted and their corresponding one-time keys sk0 and sk1, the ciphertexts are obtained through Enc:

[0063] c0=m0+sk0 mod n, c1=m1+sk1 mod n

[0064] Without knowing the plaintext, the server performs addition operations only within the ciphertext field:

[0065] c'=Add(c0,c1,n)=c0+c1 mod n

[0066] If the client needs to decrypt, it only needs to possess the synthesized key:

[0067] sk' = sk0 + sk1 mod n

[0068] You can pass:

[0069] Dec(sk',c',n)=c'-sk'mod n=m0+m1 mod n

[0070] The sum of the two plaintext segments was recovered. This demonstrates that, without exposing the plaintext, the server can perform addition on the ciphertext, and the decryptor can obtain the addition result by summing the corresponding parts of the key.

[0071] If the verification value obtained in a certain backtracking cycle If empty, it indicates that the server has backtracked to the earliest valid state of the keyword. At this point, the server terminates the backtracking accumulation process for keyword w and no longer accesses earlier invalid records (as described earlier, the old entries have been deleted or expired). Otherwise, the server...

[0072]

[0073] Calculate the previous round's state label ST i-1 And continue backtracking. Once all valid updated ciphertext for keyword w has been accumulated, the server will partially accumulate the result Sum. e Write back to mapping table M.

[0074] Based on the above description of the single keyword accumulation algorithm, it can be summarized as a "backtracking accumulation + immediate deletion" mechanism. When the client initiates a search for the first time with a count c, the server updates the ciphertext e of the keyword from its initial state to the count c. i Aggregated into a single ciphertext Sum eSimultaneously, intermediate entries are deleted one by one. If the client continues to update the same keyword locally and initiates a search again when the count reaches c′, the server only needs to continue accumulating new update entries from the position where the last accumulation stopped, without retaining or going back to the historical records before c. This ensures that the database size is linearly related to the current state of the keyword rather than the total number of updates, making it very suitable for high-frequency update application scenarios.

[0075] Because this invention supports union queries, the global accumulation register Sum is added to the global register at the end of each keyword processing by calling the same homomorphic addition algorithm, as follows:

[0076] Sum = Add(Sum, Sum e ,n)

[0077] Once all w∈q have been processed, the server sends the final encrypted ciphertext Sum to the client. Throughout the entire process, the server only observes the ciphertext calculation result and cannot know the plaintext bit string bs or its corresponding set of documents.

[0078] Step 3.3: The client decrypts and recovers the final bit string.

[0079] For each keyword w∈q in the query q, the client uses the keyword auxiliary key K′ obtained in step 3.1. w And update the sequence number i∈{c,...,0}, and derive the key corresponding to each round of updates for this keyword through the hash function H3:

[0080] sk i =H3(K′) w ,i)

[0081] For the same keyword w, the client stores all fragments sk in the modulo n space. i By summing them sequentially, we obtain the local key and Sum corresponding to the keywords. sk This corresponds precisely to the Sum obtained by homomorphic addition on the server side; for joint queries, the client further sums the local keys of different keywords to obtain the overall key sum:

[0082] Sum sk =Sum sk +sk i modn

[0083] Finally, the client calls the decryption algorithm Dec of the homomorphic addition algorithm Π = (Enc, Dec, Add) to obtain Sum. sk As the decryption key, the ciphertext Sum is decrypted to recover the final bit string:

[0084] bs = Dec(Sum sk ,Sum,n)

[0085] Here, bs is a bit string of fixed length, corresponding to the bitmap of the matching file.

[0086] Finally, here is a detailed description of the decryption algorithm Dec for the homomorphic addition algorithm described above. Given the same key sk and ciphertext c, the decryption algorithm Dec is calculated as follows:

[0087] m = Dec(sk, c, n) = c - sk mod n

[0088] This allows the original plaintext m to be recovered. Since each plaintext uses a unique one-time key, this scheme can meet the required security while maintaining computational simplicity.

[0089] Beneficial effects

[0090] (1) The present invention constructs a new index structure based on scalable bitmaps and uses a homomorphic addition symmetric encryption algorithm to transform the bitmap of each keyword into an index structure that is "encryptable and homomorphically cumulative". For each keyword, only one corresponding encrypted bitmap index is maintained.

[0091] (2) The new index structure is a fixed-length encrypted bitmap. The server can only observe the bitmap length and query rounds, and it is difficult to recover the actual number of hit documents and the size of the intersection. Thus, while supporting joint queries, the capacity of the query results is hidden.

[0092] (3) During updates, the client encrypts the incremental bitmap with a one-time key, and the server can complete the addition and deletion in the ciphertext field by performing a modular addition operation on the existing ciphertext. Each round of keys is independent, and the search state evolves with the count, thereby reducing the leakage of the association between updates and queries. Attached Figure Description

[0093] Figure 1 This is a flowchart of the joint query process based on the homomorphic addition algorithm of the present invention;

[0094] Figure 2 This is a schematic diagram of the homomorphic addition algorithm and bitmap-based data structure update in the method of this invention. Detailed Implementation

[0095] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0096] Example

[0097] like Figure 1 As shown, the present invention proposes a capacity-hiding, dynamically searchable encrypted joint query method, comprising the following steps:

[0098] Step 1: Client initialization, which includes the following sub-steps:

[0099] Step 1.1: Parameter Generation

[0100] The client first selects a security parameter λ and randomly generates a symmetric master key K, then selects an integer parameter n=2. al Where a is the number of bits required to represent a single file, and l is the maximum number of files supported by the system. The parameter n is used to define the modulus space of the homomorphic addition symmetric encryption algorithm Π=(Enc,Dec,Add) used in this invention.

[0101] Step 1.2: Index structure initialization

[0102] The client initializes the local keyword state table CT with an empty mapping, where CT represents the mapping from keyword w to state entry (ST). c The mapping of c), ST c Here, c is the latest search token for keyword w, and c is the corresponding update count. The encrypted database M on the server side is also initialized to an empty mapping. M is a key-value mapping-based storage structure that uses the update token UT as the key and maps it to the corresponding encrypted database item EDB[UT], denoted as M[UT] = EDB[UT].

[0103] Step 1.3: Return of status parameters and encrypted database

[0104] The client encapsulates the elements required for this method to be implemented as a state σ = (n, K, CT), which serves as the input for subsequent update and query phases. At the same time, it returns an encrypted database EDB = M and stores it on the server side.

[0105] Step 2: Update the client-side keyword status and update the server-side encrypted text, which includes the following sub-steps:

[0106] Step 2.1: The client initializes and advances the keyword status.

[0107] The client first uses the keyword w to derive the private key K from the master key K using a key derivation function. w and auxiliary key K′ w The format is as follows:

[0108] K w ||K′ w =F K (w)

[0109] Among them, F K (w) is a key derivation function that takes the master key K as input and can be implemented by any secure pseudo-random function, K. wUsed to generate a search token, which is associated with the encrypted state stored on the server side; K′ w Used to generate a one-time encryption key, which is then associated with the subsequent implementation of the homomorphic algorithm.

[0110] Then, the client extracts the status entry corresponding to keyword w from the local keyword status table CT, including the latest search token ST. c And the corresponding update count c. If the entry is empty, initialize the update count to -1 and randomly generate a λ-bit search token, in the following form:

[0111] c = -1, ST C ={0,1} λ

[0112] If the keyword w is already in the CT table, then write the update count and search token back to CT, in the following format:

[0113] CT[w]=(ST c+1 (c+1)

[0114] Among them, ST c+1 Generate a new λ-bit random search token for the next update round, where c+1 is the new update count.

[0115] Step 2.2: Client updates token and counter ciphertext

[0116] The client uses a private key K based on the keyword w. w The unique update token (UT) used in this update is derived from the new random search token. c+1 This is used to locate the index position in the encrypted database on the server side. It also generates a new checksum. The update securely encapsulates information from the previous search token, enabling the server to detect whether the index state is evolving continuously and correctly. The update formula is as follows:

[0117] UT c+1 =H1(K w ST c+1 )

[0118]

[0119] Then, the client uses the keyword auxiliary key K′ w And the latest count-derived one-time key sk c+1 Then, within the modulo n space, the updated bit string bs is encrypted using the homomorphic addition algorithm Π=(Enc,Dec,Add) with the encryption algorithm Enc, resulting in the ciphertext e. c+1 The encryption formula is as follows:

[0120] sk c+1=H3(K′) w (c+1)

[0121] e c+1 =Enc(sk c+1 ,bs,n)

[0122] H3 is also an arbitrary and secure hash function, and it remains independent of H1 and H2, and is used to generate a one-time encryption key.

[0123] like Figure 2 As shown in (a), for any plaintext m and a randomly selected one-time key sk, the ciphertext c is obtained by the encryption algorithm Enc:

[0124] c = Enc(sk,m,n) = sk + m mod n

[0125] That is, the plaintext m is added to the key sk in the modulus space n to obtain the ciphertext c.

[0126] During decryption, given the same key sk and ciphertext c, the decryption algorithm Dec is calculated as follows:

[0127] m = Dec(sk, c, n) = c - sk mod n

[0128] This allows the original plaintext m to be recovered. Since each plaintext uses a unique one-time key, this scheme can meet the required security while maintaining computational simplicity.

[0129] like Figure 2 (c) illustrates the bitmap data structure under the homomorphic addition algorithm: This invention formalizes the encrypted keyword into a bitmap segment and uses the aforementioned homomorphic addition to implement insertion and deletion operations on the bitmap. For ease of explanation, it is assumed that the system supports a maximum of l = 5 files, each file is encoded by a = 2 bits, then the total length of the bitmap is a1 = 10 bits, corresponding to a modulus n = 2. 10 The 2-bit codes of each file are arranged sequentially in the bitmap, for example, from right to left in the image, they correspond to files f0 to f4.

[0130] (1) Insertion operation (add new file f4)

[0131] The initial bitmap can be represented as a 10-bit string, where the bit value at each position corresponds to whether the file is included in the result set of the current keyword. For example, 01 represents inclusion; 00 represents exclusion. To add file f4 to the results, the client constructs an "incremental bitmap," setting only the 2 bits corresponding to f4 to "01" (indicating incrementing the count by 1), and the remaining bits to "00." The client encrypts this incremental bitmap using Enc, and the server directly performs a modulo-2 operation between the encrypted bitmap and the current encrypted bitmap within the ciphertext field. 10The addition operation yields an updated encrypted bitmap, which effectively adds 1 to the f4 position, thus completing the insertion of file f4.

[0132] (2) Deletion operation (delete file f3)

[0133] Deleting file f3 in the plaintext field is equivalent to subtracting an incremental bitmap from the current bitmap, where only the corresponding 2 bits in f3 are "0" or "1". Since all operations are performed modulo n = 2... 10 Within the space, this invention transforms the subtraction into adding its additive inverse: that is, constructing a bit string where positions f3 and f4 are "11" and the rest are "00". The client encrypts this "delete incremental bitmap", and the server performs a modulo-2 operation on it with the existing encrypted bitmap in the ciphertext field. 10 The addition operation, after decryption, produces a new bitmap that is identical to the result of subtraction performed directly in the plaintext, thus enabling the deletion of file f3.

[0134] Through the above method, the present invention can complete the insertion, deletion and update of the encrypted bitmap without decryption. All update processes are uniformly represented as addition operations modulo n (including addition equivalent to modulo subtraction), thereby ensuring security while facilitating efficient homomorphic accumulation of counting information on the server side.

[0135] Finally, the client will use the generated update token UT. c+1 The ciphertext pair with this round of updates After encapsulation, use triples It is sent to the server in the form of [format].

[0136] Step 2.3: Update server-side status records

[0137] After receiving the triple from the client, the server updates the token UT. c+1 Use the index key to store the corresponding ciphertext pair. The information is written to its maintained mapping table M, meaning that the keyword status is updated and maintained without knowing the keywords or plaintext content. The specific operations are as follows:

[0138]

[0139] Where M is a key-value mapping-based storage structure, M[UT] c+1 ] is the encrypted database EDB′ stored after the server update.

[0140] Step 3: The client performs a combined search using multiple keywords, which includes the following sub-steps:

[0141] Step 3.1: The client initiates a joint query q containing several keywords. First, it retrieves the entry CT[w] from the local keyword status table and checks if the entry corresponding to keyword w is empty. If the entry corresponding to keyword w is not empty, the current status label ST is obtained. c And update the counter c. Simultaneously, the client calls the key derivation function F. K (w), generate its private key and auxiliary key pair (K) w ,K′ w The function is consistent with the previous update phase description; if the entry corresponding to a certain keyword w is empty, the client will directly output an empty result, indicating that the query keyword does not exist.

[0142] Subsequently, the client will generate all the triples {(K) of the keywords to be queried. w ST c ,c)} w∈q This is sent to the server as a set of search tokens. Multiple keywords 'w' can be sent at once, but note that the number of keywords is limited to 2. a -1, meaning that when the file size is 'a', a maximum of 2 queries can be performed at a time. a -1 keyword.

[0143] Step 3.2: The server aggregates the results by keyword count.

[0144] There are two accumulators here: a global accumulator (Sum) and a local accumulator (Sum). e .

[0145] First, for a keyword instance (K) w ST c c) Calculate its cumulative result. The server starts from the count c given by the current client and backtracks in order of update sequence from newest to oldest, that is, it executes the calculation sequentially for i = c, c-1, ..., 0, and calculates the index label UT corresponding to this round of update. i Then, the index is used to find the ciphertext pair corresponding to this round of update in the mapping table M. The corresponding operations are as follows:

[0146]

[0147] Among them, when the server is based on the current ST i The state retrieves the ciphertext e corresponding to the i-th round of update. i And the check value pointing to the previous state Therefore, it can be used subsequently. Reverse the state chain to recover the state chain.

[0148] Then, the ciphertext e of this round is added in the modulo n space using the homomorphic addition algorithm Add. iAccumulated to local accumulator Sum e In addition, to save server storage space, the server will delete the entry in the mapping table M after the accumulation is completed, as follows:

[0149] Sum = Add(Sum) e ,e i ,n), Remove = M[UT i ]

[0150] like Figure 2 (b) describes the above homomorphic addition algorithm Add in detail. Given two plaintexts m0 and m1 to be encrypted and their corresponding one-time keys sk0 and sk1, the ciphertexts are obtained through Enc:

[0151] c0=m0+sk0 mod n, c1=m1+sk1 mod n

[0152] Without knowing the plaintext, the server performs addition operations only within the ciphertext field:

[0153] c'=Add(c0,c1,n)=c0+c1 mod n

[0154] If the client needs to decrypt, it only needs to possess the synthesized key:

[0155] sk' = sk0 + sk1 mod n

[0156] You can pass:

[0157] Dec(sk',c',n)=c'-sk'mod n=m0+m1 mod n

[0158] The sum of the two plaintext segments was recovered. This demonstrates that, without exposing the plaintext, the server can perform addition on the ciphertext, and the decryptor can obtain the addition result by summing the corresponding parts of the key.

[0159] If the verification value obtained in a certain backtracking cycle If empty, it indicates that the server has backtracked to the earliest valid state of the keyword. In this case, the server terminates the backtracking and accumulation process for keyword w and no longer accesses earlier invalid records. Otherwise, the server...

[0160]

[0161] Calculate the previous round's state label ST i-1 And continue backtracking. Once all valid updated ciphertext for keyword w has been accumulated, the server will partially accumulate the result Sum. e Write back to mapping table M.

[0162] Because this invention supports union queries, the global accumulation register Sum is added to the global register at the end of each keyword processing by calling the same homomorphic addition algorithm, as follows:

[0163] Sum = Add(Sum, Sum e ,n)

[0164] Once all w∈q have been processed, the server sends the final encrypted ciphertext Sum to the client. Throughout the entire process, the server only observes the ciphertext calculation result and cannot know the plaintext bit string bs or its corresponding set of documents.

[0165] Step 3.3: The client decrypts and recovers the final bit string.

[0166] For each keyword w∈q in the query q, the client uses the keyword auxiliary key K′ obtained in step 3.1. w And update the sequence number i∈{c,...,0}, and derive the key corresponding to each round of updates for this keyword through the hash function H3:

[0167] sk i =H3(K′) w ,i)

[0168] For the same keyword w, the client stores all fragments sk in the modulo n space. i By summing them sequentially, we obtain the local key and Sum corresponding to the keywords. sk This corresponds precisely to the Sum obtained by homomorphic addition on the server side; for joint queries, the client further sums the local keys of different keywords to obtain the overall key sum:

[0169] Sum sk =Sum sk +sk i mod n

[0170] Finally, the client calls the decryption algorithm Dec of the homomorphic addition algorithm Π = (Enc, Dec, Add) to obtain Sum. sk As the decryption key, the ciphertext Sum is decrypted to recover the final bit string:

[0171] bs = Dec(Sum sk ,Sum,n)

[0172] Here, bs is a bit string of fixed length, corresponding to the bitmap of the matching file.

Claims

1. A capacity-hidden, dynamically searchable, encrypted joint query method, characterized in that, Includes the following steps: Step 1: Client initialization, which includes the following sub-steps: Step 1.1: Parameter Generation The client first selects a security parameter λ and randomly generates a symmetric master key K, then selects an integer parameter n=2. al , where a is the number of bits required to represent a single file, l is the maximum number of files supported by the system, and parameter n is used to define the modulus space of the symmetric encryption algorithm Π=(Enc,Dec,Add) using homomorphic addition adopted in this invention, that is, all encryption, accumulation and decryption operations are performed in the ring domain modulo n; Step 1.2: Index structure initialization The client initializes the local keyword state table CT with an empty mapping, where CT represents the mapping from keyword w to state entry (ST). c The mapping of c), ST c Here, c is the latest search token for keyword w, and c is the corresponding update count. The encrypted database M on the server side is also initialized to an empty mapping. M is a key-value mapping-based storage structure that uses the update token UT as the key and maps it to the corresponding encrypted database item EDB[UT], denoted as M[UT] = EDB[UT]. Step 1.3: Return of status parameters and encrypted database The client encapsulates the elements required for this method into a state σ = (n, K, CT), which serves as the input for subsequent update and query phases. It also returns an encrypted database EDB = M and stores it on the server side. Here, (K, CT) is kept only on the client side to maintain its privacy, and the server cannot obtain the corresponding content. Step 2: Update the client-side keyword status and update the server-side encrypted text, which includes the following sub-steps: Step 2.1: The client initializes and advances the keyword status; Step 2.2: The client updates the token and count ciphertext; Step 2.3: Update server-side status records; Step 3: The client performs a combined search using multiple keywords, which includes the following sub-steps: Step 3.1: The client initiates a joint query q containing several keywords. First, it retrieves the entry CT[w] from the local keyword status table and checks whether the entry corresponding to keyword w is empty. If the entry corresponding to keyword w is not empty, the current status label ST is obtained. c And update the counter c, while the client calls the key derivation function F. K (w), generate its private key and auxiliary key pair (K) w ,K′ w The function is consistent with the previous update phase description; if the entry corresponding to a certain keyword w is empty, the client will directly output an empty result, indicating that the query keyword does not exist; Subsequently, the client will generate all the triples {(K) of the keywords to be queried. w ST c ,c)} w∈q As a set of search tokens, it is sent to the server. Multiple keywords 'w' can be carried at once, but the number of keywords is limited to 2. a -1, meaning that when the file size is 'a', a maximum of 2 queries can be performed at a time. a -1 keyword; Step 3.2: The server aggregates the results by keyword count. There are two accumulators here: a global accumulator (Sum) and a local accumulator (Sum). e The global accumulator Sum is the result of a homomorphic addition algorithm with multiple keywords, while the local accumulator Sum... e It is the historical update and cumulative result of a single keyword w; Step 3.3: The client decrypts and recovers the final bit string. For each keyword w∈q in the query q, the client uses the keyword auxiliary key K′ obtained in step 3.

1. w And update the sequence number i∈{c,...,0}, and derive the key corresponding to each round of updates for this keyword through the hash function H3: sk i =H3(K′ w ,in) For the same keyword w, the client stores all fragments sk in the modulo n space. i By summing them sequentially, we obtain the local key and Sum corresponding to the keywords. sk This corresponds precisely to the Sum obtained by homomorphic addition on the server side; for joint queries, the client further sums the local keys of different keywords to obtain the overall key sum: Sum sk =Total sk +sk i towards n Finally, the client calls the decryption algorithm Dec of the homomorphic addition algorithm Π = (Enc, Dec, Add) to obtain Sum. sk As the decryption key, the ciphertext Sum is decrypted to recover the final bit string: bs=Dec(Sum sk ,Sum,n) Where bs is a fixed-length bit string, corresponding to the bitmap of the matching file; The decryption algorithm Dec of the homomorphic addition algorithm, given the same key sk and ciphertext c, is calculated as follows: m = Dec(sk, c, n) = c - sk mod n This allows the original plaintext m to be recovered. Since each plaintext uses an independent one-time key, this scheme can meet the required security while maintaining computational simplicity.

2. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 1, characterized in that, Step 2.1 is as follows: The client first uses the keyword w to derive the private key K from the master key K using a key derivation function. w and auxiliary key K′ w The format is as follows: K w ||K′ w =F K (w) Among them, F K (w) is a key derivation function that takes the master key K as input and can be implemented by any secure pseudo-random function, K. w Used to generate a search token, which is associated with the encrypted state stored on the server side; K′ w Used to generate a one-time encryption key, which is associated with the subsequent implementation of the homomorphic algorithm; Then, the client extracts the status entry corresponding to keyword w from the local keyword status table CT, including the latest search token ST. c And the corresponding update count c; if the entry is empty, initialize the update count to -1 and randomly generate a λ-bit search token, in the following form: c=-1,ST C ={0,1} λ If the keyword w is already in the CT table, then write the update count and search token back to CT, in the following format: CT[w]=(ST c+1 ,c+1) Among them, ST c+1 Generate a new λ-bit random search token for the next update round, where c+1 is the new update count.

3. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 1, characterized in that, Step 2.2 is as follows: The client uses a private key K based on the keyword w. w The unique update token (UT) used in this update is derived from the new random search token. c+1 It is used to locate the index position in the encrypted database on the server side and generate a new checksum. The information from the previous search token is securely encapsulated in this update, enabling the server to detect whether the index state is evolving continuously and correctly. The update formula is as follows: OUT c+1 =H1(K w ,ST c+1 ) H1 and H2 are arbitrary and secure hash functions, which are treated as independent functions in this invention and are used to generate update tokens and verification values ​​respectively. Then, the client uses the keyword auxiliary key K′ w And the latest count-derived one-time key sk c+1 Then, within the modulo n space, the updated bit string bs is encrypted using the homomorphic addition algorithm Π=(Enc,Dec,Add) with the encryption algorithm Enc, resulting in the ciphertext e. c+1 The encryption formula is as follows: en c+1 =H3(K′ w ,c+1) e c+1 =Enc(sk c+1 ,bs,n) H3 is also an arbitrary and secure hash function, and it remains independent of H1 and H2, and is used to generate a one-time encryption key; Finally, the client will use the generated update token UT. c+1 The ciphertext pair with this round of updates After packaging, use triples Send it to the server in the form of [format].

4. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 3, characterized in that, The encryption algorithm Enc of the homomorphic addition algorithm, for any plaintext m and a randomly selected one-time key sk, calculates ciphertext c using Enc: c = Enc(sk,m,n) = sk + m mod n That is, in the modulus space n, the plaintext m is added to the key sk to obtain the ciphertext c; This invention further proposes a novel data structure design based on the aforementioned homomorphic addition algorithm to support update operations such as insertion and deletion within the ciphertext domain. Specifically, this invention formalizes the document set associated with a certain keyword as a bitmap of fixed length and uses this bitmap as the input to the homomorphic addition algorithm Π = (Enc, Dec, Add). Since the definition of the homomorphic addition algorithm itself does not restrict the structure of the input data, while the bitmap method designed in this invention is a new data structure, when the client constructs the corresponding incremental bitmap bs according to the update type and encrypts it with Enc, the server performs an insertion or deletion operation on the bitmap when executing the Add algorithm within the ciphertext domain. Therefore, even though the description of the homomorphic addition algorithm does not explicitly include modulo addition and modulo subtraction on the bitmap, the bitmap structure proposed in this invention serves as the input to the homomorphic addition algorithm, enabling bitmap updates to be completed in the ciphertext domain in a unified modulo n addition form.

5. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 4, characterized in that, A general example of a bitmap data structure under the homomorphic addition algorithm is as follows: Assuming the system supports at most l files, and each file is encoded by a bits, then the total length of the bitmap is a1 bits, corresponding to a modulus n = 2. al The bit codes of each file are arranged sequentially in the bitmap, corresponding to files f0 to f1 from right to left. l ; (1) Insertion operation (adding a new file) i (where 0≤i≤l) The initial bitmap can be represented as a string of bits, where the bit value at each file position reflects whether the file is included in the result set of the current keyword. For example, 01 represents inclusion, and 00 represents non-inclusion. This is to add file f to the result set. i The client constructs an "incremental bitmap" only in f i The corresponding bit position 'a' is set to "01" (indicating a count increment of 1), and the remaining positions are "00". The client uses Enc to encrypt this incremental bitmap, and the server directly performs a modulo n=2 operation on it within the ciphertext field, comparing it with the current encrypted bitmap. al Addition yields an updated encrypted bitmap, the effect of which is in f i The position is incremented by 1 to complete the file f. i Insertion; (2) Deletion operation (delete file f) j (where 0≤j≤l) Delete file f j In the plaintext domain, this is equivalent to subtracting a segment from the current bitmap that is only in f. j For the incremental bitmap where bit position a is "01", since all operations are performed modulo n=2... al The subtraction is performed within a spatial domain. This invention transforms the subtraction into adding its additive inverse, where the additive inverse is defined as satisfying x + x -1 The unique element x ≡ 0 (mod n) -1 Therefore, the process is equivalent to calculating x in the modular space. -1 = (nx) mod n, then the client encrypts "delete incremental bitmap", and the server performs a modulo operation of n=2 on it with the existing encrypted bitmap in the ciphertext field. al The addition operation, after decryption, yields a new bitmap that is identical to the result of subtraction performed directly on the plaintext, thus enabling the processing of file f. j The deletion operation.

6. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 1, characterized in that, Step 2.3 is as follows: After receiving the triple from the client, the server updates the token UT. c+1 Use the index key to store the corresponding ciphertext pair. Write it into its maintained mapping table M, that is, complete the update and maintenance of keyword status without knowing the keywords and plaintext content. The specific operation is as follows: Where M is a key-value mapping-based storage structure, M[UT] c+1 ] is the encrypted database EDB′ stored after the server update.

7. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 1, characterized in that, The calculation principle of each accumulator in step 3.2 is as follows: First, for a keyword instance (K) w ST c c) Calculate its cumulative result. The server starts from the count c given by the current client and backtracks in order of update sequence from newest to oldest, that is, it executes the calculation sequentially for i = c, c-1, ..., 0, and calculates the index label UT corresponding to this round of update. i Then, the index is used to find the ciphertext pair corresponding to this round of update in the mapping table M. The corresponding operations are as follows: Among them, when the server is based on the current ST i The state retrieves the ciphertext e corresponding to the i-th round of update. i And the check value pointing to the previous state Therefore, it can be used subsequently. Reverse the state chain to recover it; Then, the ciphertext e of this round is added in the modulo n space using the homomorphic addition algorithm Add. i Accumulated to local accumulator Sum e In addition, to save server storage space, the server deletes the entry from the mapping table M after the accumulation is complete, thereby deleting the historical update records that have participated in the accumulation from the database. That is, the server only stores the latest entry status. The operation is as follows: Sum=Add(Sum e ,e i ,n),Remove=M[UT i ] If the verification value obtained in a certain backtracking cycle If empty, it indicates that the server has backtracked to the earliest valid state of the keyword. In this case, the server terminates the backtracking and accumulation process for keyword w and no longer accesses earlier invalid records; otherwise, the server... Calculate the previous round's state label ST i-1 And continue backtracking, once all valid updated ciphertext for keyword w has been accumulated, the server will partially accumulate the result Sum. e Write back to mapping table M; Based on the above description of the single keyword accumulation algorithm, it can be summarized as a "backtracking accumulation + immediate deletion" mechanism. When the client initiates a search for the first time with a count c, the server updates the ciphertext e of the keyword from its initial state to the count c. i Aggregated into a single ciphertext Sum e Meanwhile, intermediate entries are deleted one by one. If the client continues to update the same keyword locally and initiates a search again when the count is increased to c′, the server only needs to continue to add new update entries from the position where the last accumulation stopped, and no longer retains or goes back to the history before c. Because this invention supports union queries, the global accumulation register Sum is added to the global register at the end of each keyword processing by calling the same homomorphic addition algorithm, as follows: Sum=Add(Sum,Sum e ,n) Once all w∈q have been processed, the server sends the final encrypted ciphertext Sum to the client. Throughout the entire process, the server only observes the ciphertext calculation result and cannot know the plaintext bit string bs or its corresponding set of documents.

8. The capacity-hiding, dynamically searchable encrypted joint query method as described in claim 7, characterized in that, The homomorphic addition algorithm Add is as follows: Given two plaintexts m0 and m1 to be encrypted and their corresponding one-time keys sk0 and sk1, the ciphertexts are obtained through Enc: c0=m0+sk0 mod n, c1=m1+sk1 mod n Without knowing the plaintext, the server performs addition operations only within the ciphertext field: c'=Add(c0,c1,n)=c0+c1 mod n If the client needs to decrypt, it only needs to possess the synthesized key: sk' = sk0 + sk1 mod n You can pass: Dec(sk',c',n)=c'-sk'mod n=m0+m1 mod n The sum of the two plaintext segments was recovered. This shows that without exposing the plaintext, the server can perform addition on the ciphertext, and the decryptor can obtain the addition result by summing the corresponding key.

Images