Dynamic searchable encryption method and system supporting spatiotemporal keyword query and medium

Abstract

The application relates to the field of information security, and discloses a dynamic searchable encryption method and system supporting spatiotemporal keyword query and a medium. The method comprises the following steps: S1, a client uniformly converts spatiotemporal keyword multidimensional coding into a set member judgment form, stores a file identifier in a bitmap index, and establishes an encryption mapping with a coding item; S2, the client incrementally updates a global counter in batches, derives an update key by using a range-limited pseudo-random function, generates a storage address in combination with a count value, encrypts the bitmap index by using a homomorphic encryption algorithm, and realizes forward security; S3, the client generates a query token and sends the query token to a server end, the server end returns after homomorphically aggregating multi-version encrypted bitmaps, cannot obtain single-version content, realizes backward security, and the client decrypts to obtain a file identifier set. The application can support comprehensive query of text keywords, spatial ranges and time ranges under the premise of guaranteeing data security and privacy, and has forward security and backward security.

Description

Technical Field

[0001] This application belongs to the field of information security technology, and specifically relates to a dynamic searchable encryption method, system and medium that supports spatiotemporal keyword queries. Background Technology

[0002] With the rapid development and widespread application of cloud computing technology, an increasing number of location-based service providers are outsourcing the management and storage of their spatiotemporal databases to cloud servers. This data outsourcing model allows service providers to reduce their own storage and computing burdens and provide more efficient and higher-quality services to end users. However, the resulting data security and privacy protection issues are becoming increasingly prominent.

[0003] Traditional solutions typically employ symmetric encryption algorithms to encrypt the database, thus ensuring data confidentiality to a certain extent. However, this method has significant limitations: encrypted data cannot be effectively retrieved without decryption, hindering users from achieving flexible and real-time data querying and processing.

[0004] To address this issue, searchable encryption technology has emerged. As an emerging cryptographic method, searchable encryption allows users to directly perform retrieval operations on encrypted data, achieving a balance between data availability and query efficiency while ensuring data confidentiality.

[0005] Although searchable encryption technology has been widely researched and applied, several technical problems still need to be addressed when applying it to dynamic spatiotemporal keyword query scenarios: 1) Insufficient support for spatial and temporal range queries: Most existing searchable encryption schemes only support text keyword queries or spatial range queries, and cannot simultaneously support comprehensive queries involving text keywords, spatial ranges, and temporal ranges; 2) Lack of forward and backward security guarantees: Dynamic spatiotemporal databases usually require continuous addition or deletion of encrypted records. However, existing schemes often cannot effectively guarantee forward and backward security during data updates and queries, posing a risk of information leakage. This could result in historical query tokens being associated with newly updated files, or new queries potentially exposing access to old data; 3) High client-side storage overhead: Most dynamic searchable encryption schemes require the client to maintain state information for each keyword, and their storage overhead increases linearly with the number of keywords.

[0006] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0007] To address or at least mitigate one or more of the above problems, a dynamic searchable encryption method, system, and medium supporting spatiotemporal keyword queries are provided. This method can simultaneously support comprehensive queries based on text keywords, spatial ranges, and time ranges while ensuring data security and privacy. It features both forward and backward security, maintains constant storage overhead on the client side, and supports efficient batch update operations, thereby improving the availability and practicality of the dynamic spatiotemporal database.

[0008] To achieve the above objectives, according to the first aspect of this application, a dynamically searchable encryption method supporting spatiotemporal keyword queries is provided, applied to a client, comprising: Index construction: Multidimensional encoding is performed on spatiotemporal keyword objects to obtain encoded items, namely text keywords, spatial codes, and time codes. The encoded items are then uniformly converted into a set member judgment form. An encrypted database is established, which contains the encrypted mapping relationship between the encoded items and file identifiers. The file identifiers are stored in the form of a bitmap index. Security Update: During batch updates, the global counter is updated, a range-limited pseudo-random function is used to calculate the update key for the encoded item, the storage address for the current batch update is generated by combining the counter value, and the bitmap index is encrypted using the AHSE symmetric encryption algorithm that supports homomorphic operations to generate an encrypted bitmap, which is then stored in the corresponding encrypted mapping relationship and sent to the server. This prevents the generated query token from being associated with subsequent new data, thus achieving forward security. Secure query: Generate a query token based on the query conditions in the query request, send the query token to the server to initiate a query, and allow the server to use the symmetric encryption AHSE algorithm that supports homomorphic operations to homomorphically aggregate the encrypted bitmaps of multiple historical versions of each encoded item and return the encrypted query result, so that the server cannot know the specific content of a single historical version, thus achieving backward security; Decryption of Results: Receive the aggregated encryption result returned by the server, generate a cumulative decryption key based on the counter set corresponding to the query token, decrypt the aggregated encryption result, and obtain a set of file identifiers that meet the query conditions.

[0009] To achieve the above objectives, according to the second aspect of this application, a dynamically searchable encryption method supporting spatiotemporal keyword queries is provided, applied on the server side, comprising the following steps: Receive and store an encrypted database sent by a client. The encrypted database includes a storage address and an encrypted bitmap. The encrypted bitmap is obtained by the client encrypting the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations. Receive a query token sent by the client. The query token contains an coded item token and a counter set. Calculate the storage address of all historical versions of each coded item using the coded item token, and extract the corresponding encrypted bitmap from the encrypted database. The AHSE symmetric encryption algorithm, which supports homomorphic operations, is used to homomorphically aggregate multiple historical version encryption bitmaps of each encoded item to obtain an aggregated encryption result. The aggregated encryption result and the counter set corresponding to each encoded item are returned to the client, so that the server cannot know the specific content of a single historical version, thus achieving backward security.

[0010] To achieve the above objectives, according to a third aspect of this application, a dynamic searchable encryption system supporting spatiotemporal keyword query is provided, the dynamic searchable encryption system comprising: a client and a server; The client includes: Index building module: performs multi-dimensional encoding on spatiotemporal keyword objects, converting them into encoded items, namely text keywords, spatial codes, and time codes, and uniformly converting the encoded items into a set member judgment form; establishes an encrypted database, which contains the encrypted mapping relationship between the encoded items and file identifiers, and the file identifiers are stored in the form of bitmap index; The security update module updates the global counter value during batch updates, calculates the update key for the encoded item using a range-limited pseudo-random function, generates the storage address for the current batch update based on the counter value, and encrypts the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations to generate an encrypted bitmap. After storing the bitmap in the corresponding encrypted mapping relationship, it is sent to the server, making it impossible for the generated query token to be associated with subsequent new data, thus achieving forward security. Security query module: Generates a query token based on the query conditions in the query request, sends the query token to the server to initiate a query, and allows the server to use the symmetric encryption AHSE algorithm that supports homomorphic operations to homomorphically aggregate multiple historical version encrypted bitmaps of each encoded item and return encrypted query results, so that the server cannot know the specific content of a single historical version, thus achieving backward security; Result decryption module: Receives the aggregated encryption result returned by the server, generates a cumulative decryption key based on the counter set corresponding to the query token, decrypts the aggregated encryption result, and obtains a set of file identifiers that meet the query conditions; The server includes: The data storage module receives and stores an encrypted database sent by the client. The encrypted database includes a storage address and an encrypted bitmap. The encrypted bitmap is obtained by the client encrypting the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations. The query processing module receives a query token sent by the client. The query token contains an coded item token and a counter set. It uses the coded item token to calculate the storage address of all historical versions of each coded item and extracts the corresponding encrypted bitmap from the encrypted database. The AHSE symmetric encryption algorithm, which supports homomorphic operations, is used to homomorphically aggregate multiple historical version encryption bitmaps of each encoded item to obtain an aggregated encryption result. The aggregated encryption result and the counter set corresponding to each encoded item are returned to the client, so that the server cannot know the specific content of a single historical version, thus achieving backward security.

[0011] To achieve the above objectives, according to the fourth aspect of this application, a computer-readable storage medium is provided, storing a computer program that, when executed by a processor, is used to implement the dynamically searchable encryption method supporting spatiotemporal keyword query as described above.

[0012] By adopting the above technical solution, this application has the following beneficial effects compared with the prior art: This application features the following features: Multidimensional query support: transforming spatial and temporal range queries into set membership judgment problems, achieving unified support for text keywords, spatial ranges, and temporal ranges; Security assurance: introducing a global counter and a range-restricted pseudo-random function during dynamic database updates and queries, combined with additive homomorphic symmetric encryption, to achieve forward security, backward security, and bitmap index security; Efficient updates and constant client storage: leveraging the batch update advantages of the bitmap index structure, combining a global counter with a range-restricted pseudo-random function to achieve batch update operations; and generating constraint keys, eliminating the need for the client to maintain independent state information for each keyword, thereby reducing client storage overhead to a constant level.

[0013] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings. Attached Figure Description

[0014] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application. The illustrative embodiments and descriptions of the application are used to explain the application, but do not constitute an undue limitation of the application. Obviously, the drawings described below are merely some embodiments, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0015] In the attached diagram: Figure 1 This is a flowchart illustrating the dynamic searchable encryption method that supports spatiotemporal keyword query in this specific embodiment. Figure 2 This is a flowchart illustrating the multidimensional encoding process in this specific embodiment; Figure 3 This is a flowchart illustrating the security update process in this specific embodiment; Figure 4 This is a flowchart illustrating the security query process in this specific embodiment; Figure 5 This is a schematic diagram of the structure of a dynamically searchable encrypted system that supports spatiotemporal keyword query in this specific embodiment. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments will be clearly and completely described below with reference to the accompanying drawings. The following embodiments are used to illustrate this application, but are not intended to limit the scope of this application.

[0017] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0018] Please see Figure 1 This application provides a dynamically searchable encryption method that supports spatiotemporal keyword queries, applied to a client, including: Index construction: Multi-dimensional encoding of spatiotemporal keyword objects is performed to obtain encoded items, namely text keywords, spatial codes, and time codes. The encoded items are uniformly converted into set member judgment forms. An encrypted database is established, which contains the encrypted mapping relationship between the encoded items and file identifiers. The file identifiers are stored in the form of bitmap index. Security Update: During batch updates, the global counter value is updated, the update key is calculated using a range-limited pseudo-random function as the encoding item, the storage address of the current batch update is generated by combining the counter value, and the bitmap index is encrypted using the AHSE symmetric encryption algorithm that supports homomorphic operations to generate an encrypted bitmap. After being stored in the corresponding encrypted mapping relationship, it is sent to the server, so that the generated query token cannot be associated with subsequent newly added data, thus achieving forward security. Secure Query: Generate a query token based on the query conditions in the query request, send the query token to the server to initiate a query, and allow the server to use the symmetric encryption AHSE algorithm that supports homomorphic operations to homomorphically aggregate the encrypted bitmaps of multiple historical versions of each encoded item and return the encrypted query result, so that the server cannot know the specific content of a single historical version, thus achieving backward security. Result Decryption: Receive the aggregated encryption result returned by the server, generate a cumulative decryption key based on the counter set corresponding to the query token, decrypt the aggregated encryption result, and obtain the set of file identifiers that meet the query conditions.

[0019] Please see Figure 2 As a specific implementation method, the multidimensional encoding process includes:

[0020] The spatial information of the spatiotemporal keyword object is used to generate a spatial prefix code, i.e., a spatial code, using prefix encoding. The time interval of the spatiotemporal keyword object is then encoded using 0-coding and 1-coding methods to encode the start and end times of the time interval, respectively, resulting in the corresponding time 0-code and time 1-code, i.e., time codes.

[0021] Specifically, text keyword encoding: text keywords are directly used as a keyword set, with each keyword corresponding to a coding item.

[0022] Spatial information encoding: The spatial information of spatiotemporal keyword objects is generated into a spatial encoding set using a prefix encoding method.

[0023] Time range encoding: The time range of the spatiotemporal keyword object is encoded using 0-encoding for the start time and 1-encoding for the end time, generating time 0-encoded sets and time 1-encoded sets respectively. 0-encoding and 1-encoding are methods for encoding timestamps into binary prefix sets, which can support efficient time range queries.

[0024] Bitmap Index Generation: A bitmap index is generated for each encoded item. The bitmap index is used to identify the set of file identifiers associated with the encoded item. Each bit in the bitmap index corresponds to a file identifier. If the encoded item is associated with a file, the corresponding bit is 1; otherwise, it is 0.

[0025] Encrypted database establishment: Establish an encrypted database containing a text keyword database, a spatial encoding database, a time 0-encoding database, and a time 1-encoding database. Each encoded item corresponds to a storage address used to store the encrypted bitmap index.

[0026] As a specific implementation, the encrypted database includes mapping relationships between text keywords and file identifiers, spatial prefix encoding and file identifiers, time 0-encoding and file identifiers, and time 1-encoding and file identifiers. Each mapping relationship uses a unified encrypted storage format, supports parallel execution of text keyword queries, spatial range queries, and time range queries under the same retrieval framework, and obtains comprehensive query results by performing bitwise AND operations on the search results.

[0027] As a specific implementation method, a unified encrypted storage format includes: Each coded item corresponds to a storage address, which is generated by combining the update key calculated from the coded item with the count value of the global counter. Each storage address stores a bitmap index encrypted using the AHSE symmetric encryption algorithm that supports homomorphic operations. The bitmap index is used to identify the set of file identifiers associated with the coded item.

[0028] In practical applications, the security update process includes forward security mechanisms: Using a range-limited pseudo-random function as input, the update key and global batch update counter are used to generate the state value of the encoded item in the current batch, and the storage address of the encoded item is generated based on the state value. The storage address is calculated only under the current counter value, which makes it impossible to deduce the storage address corresponding to the newly added data from the generated query token. This makes it impossible to associate historical queries with newly added data, thus achieving forward security. The security update process includes backward security mechanisms: The client derives the master key of the AHSE algorithm for each encoded item, combines it with the counter value of the current batch update to generate the encryption key for this update, uses the encryption key to encrypt the bitmap index, generates an encrypted bitmap and stores it in the corresponding encryption mapping relationship; When the client performs a query, for each coded item, it uses the query token to recover the storage address corresponding to all historical versions of the coded item, extracts the encrypted bitmap corresponding to each version from the encrypted database, performs homomorphic operation on all encrypted bitmaps, and obtains the aggregated encryption result. The client uses the master key of the AHSE algorithm and the counter value to generate a cumulative decryption key based on the counter set corresponding to the query token, decrypts the aggregated encryption result, and recovers the merged plaintext bitmap; During homomorphic operations, the server can only perform addition operations on encrypted bitmaps and cannot decrypt individual encrypted bitmaps. It cannot know the specific content of the bitmap index, nor can it distinguish the file addition or deletion operations corresponding to each historical version. This ensures that the query results do not reveal the historical information of deleted files, thus achieving backward security.

[0029] Please see Figure 3 Specifically, the security update process includes: System initialization: Given security parameters The client initializes the system and generates a master key. And set common parameters for the AHSE algorithm. At the same time, the client initializes the global counter. The value is 0, and the system status value is stored locally. The client initializes the encrypted database. And send it to the server, where These represent text keyword encryption database, spatial keyword encryption database, 0-encoding-time keyword encryption database, and 1-encoding-time keyword encryption database, respectively. Incrementing the counter: for each batch of data to be updated ,in Indicates spatial location, Represents a set of text keywords. Indicates a time interval. This represents the corresponding file identifier. To represent the number of elements in the set, the client first uses... The algorithm is for each spatial location Generate the corresponding prefix code and add it to the set. For time intervals , respectively Generation time - Encoding, pair Generation time - Encode and add them to the sets respectively. and In addition, the client generates a bitmap index for all updated file identifiers. The client will use a global counter. Increment by 1, that is ; Key derivation: For each encoded item (text keyword) Spatial coding Or time 0-encoding And Time 1-Encoding ), for example, using text keywords For example, spatial coding and time 0-encoding And Time 1-Encoding The calculation steps are the same. The client uses a range-limited pseudo-random function with the master key. And the encoded item identifier is taken as input, through Calculate the update key Master key for AHSE algorithm ; Storage address generation: based on With counter Using range-limited pseudo-random functions Calculate state values Then through a hash function Mapping state values ​​to memory addresses ; Bitmap encryption: based on With counter Through hash function Generate encryption key Then use Algorithm for bitmap indexing Encryption is performed to obtain an encrypted bitmap. And generate an encrypted database of the text keywords for this update. ; Data upload: The client will Including storage address and encrypted bitmap Send to server-side storage.

[0030] As a specific implementation method, security queries include: For spatial range queries, generate all spatial prefix codes covering the spatial range, obtain the encrypted bitmaps corresponding to each spatial prefix code, and perform homomorphic aggregation. For time range queries, generate a time 1-encode set for the query start time and a time 0-encode set for the query end time, obtain the encrypted bitmap corresponding to each time code and perform homomorphic aggregation; For text keyword queries, directly obtain the encrypted bitmap corresponding to the text keyword; Perform a bitwise AND operation on the query results for text keywords, spatial range, and time range to obtain a comprehensive query result.

[0031] Please see Figure 4 Specifically, the secure query process includes: Query condition encoding: For queries ,in, Indicates the range of space to be queried. Indicates the time range to be queried. To represent the keywords in the text to be queried, the client first uses prefix encoding to generate a set of prefixes for the query space. , Represents spatial coding methods; for time intervals , These represent the upper and lower limits of the time query range, respectively, and generate time 1-encoding sets. and time 0-encoding set , , Indicates the upper and lower limits of the time query range. , The 1-encoded combination and the 0-encoded combination represent the upper limit of the time query range.

[0032] Encoded item token generation: For each encoded item, the client utilizes a range-limited pseudo-random function. Based on the update key and the current counter value This generates an coded item token. The coded item token allows the server to calculate all state values ​​corresponding to the coded item from its initial value to the current counter value, but it cannot deduce the state values ​​corresponding to future updates.

[0033] For example, taking text keywords as an example, the client, for each text keyword... The key is updated using a range-limited pseudo-random function. Master key of the derived AHSE algorithm Using a range-limited pseudo-random function to and the current counter value As input, generate text keyword tokens. , is represented as: ; ; in, Represents keyed pseudo-random function , Restricted key generation algorithms in range-limited pseudo-random functions; Query token generation: The client combines the token set with the current counter value. Combined into a query token ,in, Indicates a space-encoded token. Indicates time 1-coded token, The time 0-encoded token is sent to the server.

[0034] Server-side query processing: After receiving the query token, the server uses... (Evaluation algorithm in range-limited pseudo-random functions) calculates the set of state values ​​for all historical versions, such as the set of state values ​​for all historical versions of text keywords. Based on this, the storage addresses for each version are generated. From encrypted database Extract the corresponding encrypted bitmaps, and aggregate all encrypted bitmaps using the AHSE algorithm to obtain the aggregated encryption result. .

[0035] S35. Result Return: The server will aggregate and encrypt the results. and the corresponding set of counters Return to the client.

[0036] As a specific implementation method, the result decryption includes: receiving the aggregated encryption result returned by the server, generating a cumulative decryption key based on the counter set corresponding to the query token, decrypting the aggregated encryption result, and obtaining a set of file identifiers that meet the query conditions.

[0037] Specifically, the client receives the aggregated encryption result returned by the server. Then, first initialize the key sets required for AHSE decryption. ;in, The corresponding decryption keys for text keywords, spatial encoding, time 0-encoding, and time 1-encoding are initialized to 0; Cumulative key generation: For each encoded item (text keyword, spatial encoding, time 0-encoding, and time 1-encoding), taking text keyword as an example, the client generates a key based on the returned set of counters. Using the formula Calculate the cumulative decryption key That is to Perform the summation operation to obtain the final result. , Initialize to 0; Bitmap Decryption: Through (Decryption operations in symmetric encryption algorithms that support homomorphic operations) Utilizing the accumulated decryption key Aggregated encryption results Decryption yields the plaintext bitmap. ; Result merging: Perform a bitwise AND operation on the plaintext bitmap of each encoded item to obtain the set R of file identifiers that satisfy all query conditions. & & & ,in, , , These are plaintext bitmaps with spatial encoding, time 0-encoding, and time 1-encoding, respectively.

[0038] Please see again Figure 1 This application also provides a dynamically searchable encryption method that supports spatiotemporal keyword queries, applied on the server side, including the following steps: Receive and store the encrypted database sent by the client. The encrypted database includes a storage address and an encrypted bitmap. The encrypted bitmap is obtained by the client encrypting the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations. Receive the query token sent by the client. The query token contains an encoded item token and a counter set. Calculate the storage address of all historical versions of each encoded item using the encoded item token, and extract the corresponding encrypted bitmap from the encrypted database. The AHSE symmetric encryption algorithm, which supports homomorphic operations, is used to homomorphically aggregate multiple historical versions of the encrypted bitmap for each encoded item to obtain the aggregated encryption result. The aggregated encryption result and the counter set corresponding to each encoded item are returned to the client, so that the server cannot know the specific content of a single historical version, thus achieving backward security.

[0039] Please see Figure 5 Based on the same inventive concept, this application also provides a dynamic searchable encryption system that supports spatiotemporal keyword query, the dynamic searchable encryption system including: client and server; The client includes: Index building module: Multi-dimensional encoding of spatiotemporal keyword objects, converting them into encoded items, namely text keywords, spatial codes and time codes, and uniformly converting the encoded items into set member judgment form; establishing an encrypted database, which contains the encrypted mapping relationship between the encoded items and file identifiers, and the file identifiers are stored in the form of bitmap index; The security update module updates the global counter value during batch updates, calculates the update key using a range-limited pseudo-random function as the encoding item, generates the storage address for the current batch update by combining the counter value, and encrypts the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations to generate an encrypted bitmap. After storing the bitmap in the corresponding encrypted mapping relationship, it is sent to the server, making it impossible for the generated query token to be associated with subsequent new data, thus achieving forward security. Secure query module: Generates a query token based on the query conditions in the query request, sends the query token to the server to initiate a query, and allows the server to use the symmetric encryption AHSE algorithm that supports homomorphic operations to homomorphically aggregate the encrypted bitmaps of multiple historical versions of each encoded item and return the encrypted query result, so that the server cannot know the specific content of a single historical version, thus achieving backward security; Result decryption module: Receives the aggregated encryption result returned by the server, generates a cumulative decryption key based on the counter set corresponding to the query token, decrypts the aggregated encryption result, and obtains a set of file identifiers that meet the query conditions; The server-side includes: The data storage module receives and stores the encrypted database sent by the client. The encrypted database includes a storage address and an encrypted bitmap. The encrypted bitmap is obtained by the client encrypting the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations. The query processing module receives a query token sent by the client. The query token contains an coded item token and a counter set. It uses the coded item token to calculate the storage address of all historical versions of each coded item and extracts the corresponding encrypted bitmap from the encrypted database. The AHSE symmetric encryption algorithm, which supports homomorphic operations, is used to homomorphically aggregate multiple historical versions of the encrypted bitmap for each encoded item to obtain the aggregated encryption result. The aggregated encryption result and the counter set corresponding to each encoded item are returned to the client, so that the server cannot know the specific content of a single historical version, thus achieving backward security.

[0040] Based on the same inventive concept, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the dynamically searchable encryption method supporting spatiotemporal keyword queries as described above.

[0041] The program product of this application for implementing the above method may employ a portable compact disk read-only memory and include program code, and may run on a terminal device, such as a personal computer. However, the program product of this application is not limited thereto. In this application, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0042] It should be noted that a computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0043] The above are merely preferred embodiments of this application and are not intended to limit this application in any way. Although this application has disclosed preferred embodiments as described above, it is not intended to limit this application. Any person skilled in the art can make some modifications or alterations to the above-mentioned technical content to create equivalent embodiments without departing from the scope of the technical solution of this application. The implementation schemes in the above embodiments can also be further combined or replaced. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of this application without departing from the content of the technical solution of this application shall still fall within the scope of this application.

Claims

1. A dynamically searchable encrypted method supporting spatiotemporal keyword queries, applied to the client side, characterized in that: include: Index construction: Multidimensional encoding is performed on spatiotemporal keyword objects to obtain encoded items, namely text keywords, spatial codes, and time codes. The encoded items are then uniformly converted into a set member judgment form. An encrypted database is established, which contains the encrypted mapping relationship between the encoded items and file identifiers. The file identifiers are stored in the form of a bitmap index. Security Update: During batch updates, the global counter is updated, a range-limited pseudo-random function is used to calculate the update key for the encoded item, the storage address for the current batch update is generated by combining the counter value, and the bitmap index is encrypted using the AHSE symmetric encryption algorithm that supports homomorphic operations to generate an encrypted bitmap, which is then stored in the corresponding encrypted mapping relationship and sent to the server. This prevents the generated query token from being associated with subsequent new data, thus achieving forward security. Secure query: Generate a query token based on the query conditions in the query request, send the query token to the server to initiate a query, and allow the server to use the symmetric encryption AHSE algorithm that supports homomorphic operations to homomorphically aggregate the encrypted bitmaps of multiple historical versions of each encoded item and return the encrypted query result, so that the server cannot know the specific content of a single historical version, thus achieving backward security; Decryption of Results: Receive the aggregated encryption result returned by the server, generate a cumulative decryption key based on the counter set corresponding to the query token, decrypt the aggregated encryption result, and obtain a set of file identifiers that meet the query conditions.

2. The method according to claim 1, characterized in that, The process involves multi-dimensional encoding of spatiotemporal keyword objects to obtain encoded items, namely text keywords, spatial codes, and temporal codes. These encoded items are then uniformly converted into a set membership judgment format, including: The spatial information of the spatiotemporal keyword object is used to generate a spatial prefix code, i.e., a spatial code, using prefix encoding. The time interval of the spatiotemporal keyword object is then encoded using 0-coding and 1-coding methods to encode the start and end times of the time interval, respectively, to obtain the corresponding time 0-code and time 1-code, i.e., time codes.

3. The method according to claim 2, characterized in that, The encrypted database includes mappings between text keywords and file identifiers, spatial prefix codes and file identifiers, time 0-codes and file identifiers, and time 1-codes and file identifiers. Each of the mapping relationships adopts a unified encrypted storage format, supports parallel execution of text keyword queries, spatial range queries, and time range queries under the same retrieval framework, and obtains comprehensive query results by performing bitwise AND operations on the retrieval results.

4. The method according to claim 3, characterized in that, The unified encrypted storage format includes: Each coded item corresponds to a storage address, which is generated by combining the update key calculated by the coded item with the count value of the global counter; each storage address stores a bitmap index encrypted using the AHSE symmetric encryption algorithm that supports homomorphic operations, and the bitmap index is used to identify the set of file identifiers associated with the coded item.

5. The method according to claim 3, characterized in that, The security query includes: For spatial range queries, generate all spatial prefix codes covering the spatial range, obtain the encrypted bitmaps corresponding to each spatial prefix code, and perform homomorphic aggregation. For time range queries, generate a time 1-encode set for the query start time and a time 0-encode set for the query end time, obtain the encrypted bitmap corresponding to each time code and perform homomorphic aggregation; For text keyword queries, directly obtain the encrypted bitmap corresponding to the text keyword; Perform a bitwise AND operation on the query results for text keywords, spatial range, and time range to obtain a comprehensive query result.

6. The method according to claim 1, characterized in that, The security update steps include a forward security mechanism: Using a range-limited pseudo-random function as input, the update key and a global batch update counter are used to generate the state value of the encoded item in the current batch, and the storage address of the encoded item is generated based on the state value. The storage address is calculated only under the current counter value, so that the generated query token cannot deduce the storage address corresponding to the newly added data, thus making it impossible to associate historical queries with newly added data and achieving forward security.

7. The method according to claim 1, characterized in that, The security update step includes a backward security mechanism: The client derives the master key of the AHSE algorithm for each encoded item, combines it with the counter value of the current batch update to generate the encryption key for this update, uses the encryption key to encrypt the bitmap index, generates an encrypted bitmap, and stores it in the corresponding encryption mapping relationship; When the client performs a query, for each coded item, it uses the query token to recover the storage address corresponding to all historical versions of the coded item, extracts the encrypted bitmap corresponding to each version from the encrypted database, performs homomorphic operation on all encrypted bitmaps, and obtains the aggregated encryption result. The client generates a cumulative decryption key based on the counter set corresponding to the query token, using the master key of the AHSE algorithm and the counter value, and decrypts the aggregated encryption result to recover the merged plaintext bitmap; During homomorphic operations, the server can only perform addition operations on encrypted bitmaps and cannot decrypt individual encrypted bitmaps. It cannot know the specific content of the bitmap index, nor can it distinguish the file addition or deletion operations corresponding to each historical version. This ensures that the query results do not reveal the historical information of deleted files, thus achieving backward security.

8. A dynamically searchable encrypted method supporting spatiotemporal keyword queries, applied on the server side, characterized in that... Includes the following steps: Receive and store an encrypted database sent by a client. The encrypted database includes a storage address and an encrypted bitmap. The encrypted bitmap is obtained by the client encrypting the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations. Receive a query token sent by the client. The query token contains an coded item token and a counter set. Calculate the storage address of all historical versions of each coded item using the coded item token, and extract the corresponding encrypted bitmap from the encrypted database. The AHSE symmetric encryption algorithm, which supports homomorphic operations, is used to homomorphically aggregate multiple historical version encryption bitmaps of each encoded item to obtain an aggregated encryption result. The aggregated encryption result and the counter set corresponding to each encoded item are returned to the client, so that the server cannot know the specific content of a single historical version, thus achieving backward security.

9. A dynamically searchable encrypted system supporting spatiotemporal keyword queries, characterized in that: The dynamic searchable encryption system includes: a client and a server; The client includes: Index building module: performs multi-dimensional encoding on spatiotemporal keyword objects, converting them into encoded items, namely text keywords, spatial codes, and time codes, and uniformly converting the encoded items into a set member judgment form; establishes an encrypted database, which contains the encrypted mapping relationship between the encoded items and file identifiers, and the file identifiers are stored in the form of bitmap index; The security update module updates the global counter value during batch updates, calculates the update key for the encoded item using a range-limited pseudo-random function, generates the storage address for the current batch update based on the counter value, and encrypts the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations to generate an encrypted bitmap. After storing the bitmap in the corresponding encrypted mapping relationship, it is sent to the server, making it impossible for the generated query token to be associated with subsequent new data, thus achieving forward security. Security query module: Generates a query token based on the query conditions in the query request, sends the query token to the server to initiate a query, and allows the server to use the symmetric encryption AHSE algorithm that supports homomorphic operations to homomorphically aggregate multiple historical version encrypted bitmaps of each encoded item and return encrypted query results, so that the server cannot know the specific content of a single historical version, thus achieving backward security; Result decryption module: Receives the aggregated encryption result returned by the server, generates a cumulative decryption key based on the counter set corresponding to the query token, decrypts the aggregated encryption result, and obtains a set of file identifiers that meet the query conditions; The server includes: The data storage module receives and stores an encrypted database sent by the client. The encrypted database includes a storage address and an encrypted bitmap. The encrypted bitmap is obtained by the client encrypting the bitmap index using the AHSE symmetric encryption algorithm that supports homomorphic operations. The query processing module receives a query token sent by the client. The query token contains an coded item token and a counter set. It uses the coded item token to calculate the storage address of all historical versions of each coded item and extracts the corresponding encrypted bitmap from the encrypted database. The AHSE symmetric encryption algorithm, which supports homomorphic operations, is used to homomorphically aggregate multiple historical version encryption bitmaps of each encoded item to obtain an aggregated encryption result. The aggregated encryption result and the counter set corresponding to each encoded item are returned to the client, so that the server cannot know the specific content of a single historical version, thus achieving backward security.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it is used to implement the dynamic searchable encryption method supporting spatiotemporal keyword query as described in any one of claims 1-8.

Images